permdock 0.3.1 → 0.4.0

package/dist/{openapi-CqqEbHsL.js → openapi-BJdBmYDG.js}

@@ -1,15 +1,15 @@
-import { n as validateOverlay, t as validateOpenapi } from "./openapi-schema--ARjyfQr.js";
-import { c as getResource, i as findPermission } from "./permissions-DVoF6dMt.js";
-import { a as definePolicy } from "./policy-xyWg7QdR.js";
-import { a as loadModule, n as asPolicy, o as pickNamed, t as asPermissionTree } from "./load-DhWEB9P1.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-Bol6gqXA.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { a as getResource, n as findPermission } from "./permission-registry-BsblpB-z.js";
+import { o as definePolicy } from "./hosted-CBHgkzDl.js";
+import { i as readJsonFile, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-C3_oTHyO.js";
 import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { c as openapiVersion, o as createPermDock } from "./openapi-BqRBvAng.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-//#region src/cli/openapi.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
+import { c as openapiVersion, o as createPermDock } from "./openapi-DBzHQbov.js";
+import { r as fileDrift } from "./output-files-CgIsvdSa.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/openapi/openapi.ts
 function mergeRecord(base, extra) {
 	const result = {};
 	for (const [key, value] of Object.entries(base)) result[key] = value;
@@ -192,7 +192,7 @@ async function runOpenapi(input) {
 	};
 	let parsed;
 	try {
-		parsed = JSON.parse(readFileSync(docPath, "utf8"));
+		parsed = readJsonFile(docPath);
 	} catch {
 		return {
 			code: 2,
@@ -223,27 +223,23 @@ async function runOpenapi(input) {
 		output: conformance
 	};
 	const text = stableJson(result);
-	const outPath = resolve(input.cwd, input.out ?? input.doc);
+	const outFile = input.out ?? input.doc;
+	const outPath = resolve(input.cwd, outFile);
 	if (input.check) {
-		if (!existsSync(outPath)) return {
-			code: 1,
-			output: `openapi drift: missing ${input.out ?? input.doc}`
-		};
-		const current = readFileSync(outPath, "utf8");
-		if (current === text) return {
+		const found = fileDrift(outPath, text);
+		if (found === void 0) return {
 			code: 0,
 			output: "openapi up to date"
 		};
 		return {
 			code: 1,
-			output: `openapi drift\n${shortDiff(input.out ?? input.doc, current, text)}`
+			output: found.kind === "missing" ? `openapi drift: missing ${outFile}` : `openapi drift\n${shortDiff(outFile, found.onDisk, text)}`
 		};
 	}
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, text);
+	writeFileEnsuringDir(outPath, text);
 	return {
 		code: 0,
-		output: `wrote ${input.out ?? input.doc}`
+		output: `wrote ${outFile}`
 	};
 }
 //#endregion

package/dist/{openapi-BqRBvAng.js → openapi-DBzHQbov.js}

@@ -1,5 +1,5 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { _ as listPermissions, i as findPermission, p as isPermission } from "./permissions-DVoF6dMt.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { c as listPermissions, n as findPermission, o as isPermission } from "./permission-registry-BsblpB-z.js";
 import { n as sha256 } from "./sha256-BO0swRXL.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { i as PROFILE_PARAMETERS, n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "./pins-8ILTftC9.js";
@@ -402,9 +402,6 @@ function operationPermissions(operations, options = {}) {
 		}
 	};
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
 * The operation permissions an OpenAPI document declares: every operation
 * whose `x-permdock-permissions` names exactly one permission of `tree`, keyed

package/dist/{openapi-CQTsgKoB.js → openapi-DcQ1Kg40.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {
@@ -122,7 +122,7 @@ function openapi(ctx) {
 			const doc = listArg(rawArgs, "doc")[0];
 			if (parsed._[0] === "import") {
 				if (doc === void 0) throw new Error("openapi --doc is required");
-				const { runOpenapiImport } = await import("./openapi-import-cmwetbzw.js");
+				const { runOpenapiImport } = await import("./import-UHk1N7vH.js");
 				ctx.report(await runOpenapiImport({
 					cwd: ctx.cwd,
 					doc,
@@ -134,7 +134,7 @@ function openapi(ctx) {
 				}));
 				return;
 			}
-			const result = await (await import("./openapi-CqqEbHsL.js")).runOpenapi({
+			const result = await (await import("./openapi-BJdBmYDG.js")).runOpenapi({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
-import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
+import { A as ConnectionOptions, O as Connection, i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
+import { t as StreamProtectOptions } from "../stream-Dwsg6WwE.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {

package/dist/orpc/index.js

@@ -1,10 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { p as isPermission } from "../permissions-DVoF6dMt.js";
-import { a as problemMessage } from "../http-SO7qGttf.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-CuzGytRf.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { o as isPermission } from "../permission-registry-BsblpB-z.js";
+import { o as problemMessage } from "../http-BBoKefeS.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { n as attached } from "../bind-kk-uyCwH.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-BMui98KK.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-nYC3cR_u.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {
@@ -71,7 +71,7 @@ function permissionOf(procedure) {
 	}
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
+	const { kernel, bind, attach, scopeOf, connection, evaluate, guard: runGuard } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
 	/** Instances this factory built, with the tenant each was built for. */
 	const issued = /* @__PURE__ */ new WeakMap();
 	const issue = (instance, scope) => {
@@ -107,9 +107,7 @@ function createPermDock(policy, options) {
 	};
 	const protect = (permission, loadData, protectOptions) => tagged(permission, (async (mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
-		const request = bind(opts);
-		const scope = await scopeOf(opts);
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope);
+		const { request, scope, guard } = await runGuard(permission, loadData, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.context,

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { D as PolicyVocabulary, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-QCuYJh4q.js";
+import { j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-CUcFZfpU.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/otel/index.js

@@ -1,4 +1,6 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as wrapPermDock } from "../wrap-DWsU_5Bd.js";
+import { r as appObligationNames } from "../ocsf-uYFXGVw2.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";
 const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
@@ -91,6 +93,8 @@ function attributesOf(event, options, parent) {
 		"permdock.actor.kind": event.subject.actor?.kind,
 		"permdock.delegation.scopes": event.subject.delegation?.scopes?.join(","),
 		"permdock.matched.role": event.matched?.role,
+		"permdock.matched.name": event.matched?.name,
+		"permdock.obligations": appObligationNames(event)?.join(","),
 		"permdock.denials.count": event.denials?.length,
 		"permdock.token": event.token,
 		"permdock.validate": event.trusted ? "trusted" : "boundary",
@@ -170,28 +174,27 @@ function instrument(permdock, options = {}) {
 	return listen(permdock, options, resolveApi(options.api), () => void 0);
 }
 function instrumented(permdock, options, api) {
-	let started;
-	listen(permdock, options, api, () => started);
-	const timed = (fn) => (...args) => {
-		const outer = started === void 0;
-		if (outer) started = now();
-		try {
-			return fn(...args);
-		} finally {
-			if (outer) started = void 0;
-		}
-	};
-	return Object.freeze({
-		...permdock,
-		can: timed(permdock.can),
-		decide: timed(permdock.decide),
-		assert: timed(permdock.assert),
-		explain: timed(permdock.explain),
-		filter: timed(permdock.filter),
-		pick: timed(permdock.pick),
-		actions: timed(permdock.actions),
-		tenant: (id) => instrumented(permdock.tenant(id), options, api),
-		team: (id) => instrumented(permdock.team(id), options, api)
+	return wrapPermDock(permdock, (inner) => {
+		let started;
+		listen(inner, options, api, () => started);
+		const timed = (fn) => (...args) => {
+			const outer = started === void 0;
+			if (outer) started = now();
+			try {
+				return fn(...args);
+			} finally {
+				if (outer) started = void 0;
+			}
+		};
+		return {
+			can: timed(inner.can),
+			decide: timed(inner.decide),
+			assert: timed(inner.assert),
+			explain: timed(inner.explain),
+			filter: timed(inner.filter),
+			pick: timed(inner.pick),
+			actions: timed(inner.actions)
+		};
 	});
 }
 /** Returns an instrumented instance: timed spans and histogram, derived instances included. */

package/dist/output-files-CgIsvdSa.js

@@ -0,0 +1,140 @@
+import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+/** How `path` on disk differs from `expected`; `undefined` when `same` holds. */
+function fileDrift(path, expected, same = (a, b) => a === b) {
+	if (!existsSync(path)) return { kind: "missing" };
+	const onDisk = readFileSync(path, "utf8");
+	return same(onDisk, expected) ? void 0 : {
+		kind: "differs",
+		onDisk
+	};
+}
+/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+function driftOf(cwd, files) {
+	const drift = [];
+	for (const file of files) {
+		if (file.rel === "-") continue;
+		const found = fileDrift(resolve(cwd, file.rel), file.text);
+		if (found?.kind === "missing") drift.push(`${file.part}: missing ${file.rel}`);
+		else if (found?.kind === "differs") drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, found.onDisk, file.text)}`);
+	}
+	return drift;
+}
+/** Writes every file but the stdout ones, whose text it returns for printing. */
+function writeOutputFiles(cwd, files) {
+	const wrote = [];
+	const printed = [];
+	for (const file of files) {
+		if (file.rel === "-") {
+			printed.push(file.text.trimEnd());
+			continue;
+		}
+		const path = resolve(cwd, file.rel);
+		writeFileEnsuringDir(path, file.text);
+		wrote.push(file.rel);
+	}
+	return {
+		wrote,
+		printed: printed.join("\n")
+	};
+}
+const PARTS = [
+	"helpers",
+	"seeds",
+	"indexes",
+	"policies",
+	"hook"
+];
+/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+function parseSplit(raw) {
+	if (raw === void 0) return;
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return PARTS.filter((part) => names.includes(part));
+}
+/** The path of one split part: `{part}` in `out` replaced by the part name. */
+function partPath(out, part) {
+	return out.replaceAll("{part}", part);
+}
+/**
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
+* their dependencies, so no file needs a number to apply first.
+*/
+function pgDeltaPath(root, part, schema) {
+	switch (part) {
+		case "helpers":
+		case "indexes":
+		case "seeds": return `${root}/${schema}/${part}.sql`;
+		case "policies": return `${root}/public/policies/permdock.sql`;
+		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
+		default: return part;
+	}
+}
+/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+function isSeedsDirectory(cwd, out) {
+	if (out === "-") return false;
+	if (out.endsWith("/")) return true;
+	const path = resolve(cwd, out);
+	return existsSync(path) && statSync(path).isDirectory();
+}
+/**
+* A generated data migration at `out`: a file, `-` for stdout, or a
+* migrations directory that gets a new versioned file only when the newest
+* one starting with `marker` differs. With `check`, the planned file is
+* always returned, so drift names it.
+*/
+function dataMigrationFile(input) {
+	if (!isSeedsDirectory(input.cwd, input.out)) return {
+		part: input.part,
+		rel: input.out,
+		text: input.text
+	};
+	const planned = seedsMigration(input.cwd, input.out, input.marker, input.text, input.now, input.part);
+	return !planned.current || input.check ? {
+		part: input.part,
+		rel: planned.rel,
+		text: input.text
+	} : void 0;
+}
+/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
+}
+const VERSION_PREFIX = /^\d{14}(?=_)/u;
+/**
+* The version of a new migration that sorts after every migration in
+* `names`: one second past the newest, so the same directory always gives the
+* same name. Only a directory with no versioned migration falls back to `now`.
+*/
+function nextMigrationVersion(names, now) {
+	const times = names.flatMap((name) => {
+		const stamp = VERSION_PREFIX.exec(name)?.[0];
+		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
+	});
+	return times.length === 0 ? migrationVersion(now) : migrationVersion(new Date(Math.max(...times) + 1e3));
+}
+/**
+* The seeds part in a migrations directory: the newest migration there that
+* starts with \`marker\` when its text is \`text\` already, otherwise a new
+* \`<version>_permdock_seeds.sql\` one second after the newest migration
+* (\`nextMigrationVersion\`), so a regeneration of the same directory names it
+* the same. \`current\` is false when a new one is due. \`label\` replaces
+* \`seeds\` in the file name for the other generated data migrations.
+*/
+function seedsMigration(cwd, dir, marker, text, now, label = "seeds") {
+	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
+	const path = resolve(cwd, base);
+	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
+	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
+		rel: `${base}/${latest}`,
+		current: true
+	};
+	return {
+		rel: `${base}/${nextMigrationVersion(existsSync(path) ? readdirSync(path) : [], now)}_permdock_${label}.sql`,
+		current: false
+	};
+}
+//#endregion
+export { parseSplit as a, seedsMigration as c, isSeedsDirectory as i, writeOutputFiles as l, driftOf as n, partPath as o, fileDrift as r, pgDeltaPath as s, dataMigrationFile as t };