permdock 0.3.1 → 0.5.0

package/dist/drizzle/index.d.ts

@@ -1,6 +1,7 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
+import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
+import { c as WhereResult } from "../permdock-D7eeLJER.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
+import { s as MembershipsMapping } from "../compile-Ckm2HqBZ.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts
@@ -13,7 +14,8 @@ type DrizzleWhereOptions<T = unknown> = {
   readonly memberships?: MembershipsMapping;
   /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
   readonly relations?: RelationsMapping;
-  readonly now?: number;
+  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  readonly now?: Instant;
   readonly operators?: DrizzleOperators;
 };
 type DrizzleOperators = {

package/dist/drizzle/index.js

@@ -1,17 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
-import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
-import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-BwBmCdTR.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CMqMx_IN.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {
 	if (injected !== void 0) return injected;
-	const loader = globalThis.process?.getBuiltinModule?.("node:module");
-	try {
-		if (loader === void 0) throw new Error("no module loader");
-		return loader.createRequire(import.meta.url)("drizzle-orm");
-	} catch {
-		throw new Error("PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
-	}
+	return loadPeer("drizzle-orm", "PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
 }
 function ident(name) {
 	assertSafeKey(name, "sql identifier");
@@ -38,9 +32,7 @@ function tagged(parts, ops) {
 		values.push(part.value);
 		strings.push("");
 	}
-	const template = strings;
-	Object.defineProperty(template, "raw", { value: strings });
-	return ops.sql(template, ...values);
+	return ops.sql(templateOf(strings), ...values);
 }
 function existsSql(node, table, options, ops) {
 	const m = (name) => `m.${ident(name)}`;

package/dist/elysia/index.d.ts

@@ -1,30 +1,31 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
-type ElysiaCtx = {
+type ElysiaRequestContext = {
   readonly request: Request;
   readonly body?: unknown;
   readonly params?: Readonly<Record<string, string | undefined>>;
 };
-type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaCtx, TUser> & {
+type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaRequestContext, TUser> & {
   /** Ends or revalidates open sockets. */
   readonly revocations?: RevocationFeed;
 };
 /** The `ws` Elysia passes to `.ws` handlers; `data` is the upgrade context. */
 type ElysiaSocket = {
-  readonly data: ElysiaCtx;
+  readonly data: ElysiaRequestContext;
   close(code?: number, reason?: string): unknown;
 };
-type ElysiaContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaCtx & {
+type ElysiaPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaRequestContext & {
   permdock: PermDock<V>;
   permdockData?: unknown;
 };
-type ElysiaProtect = (permission: Permission | null, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
-/** The `permdock()` plugin: its global derive types `permdock` in every later handler. */
+type ElysiaProtect = (permission: Permission | null, data?: (ctx: ElysiaRequestContext) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaRequestContext) => Promise<Response | undefined>;
+/** The `middleware()` plugin: its global derive types `permdock` in every later handler. */
 type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
   decorator: Record<never, never>;
   store: Record<never, never>;
@@ -34,7 +35,9 @@ type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysi
   resolve: Record<never, never>;
 }>;
 type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => ElysiaPermDockPlugin<V>;
+  /** The `PermDock` for one request, for code the middleware does not run before. */
+  readonly getPermDock: (ctx: ElysiaRequestContext) => Promise<PermDock<V>>;
+  readonly middleware: () => ElysiaPermDockPlugin<V>;
   readonly protect: ElysiaProtect;
   /**
    * One connection per socket: the same promise for every handler
@@ -46,4 +49,4 @@ type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ElysiaPermDockOptions<TUser>): ElysiaPermDock<V>;
 //#endregion
-export { type ElysiaContext, type ElysiaCtx, type ElysiaPermDock, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, verifyWebBotAuth };
+export { type ElysiaPermDock, type ElysiaPermDockContext, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaRequestContext, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/elysia/index.js

@@ -1,23 +1,23 @@
-import { i as parsedBody, n as hasCredentials } from "../http-SO7qGttf.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts
 function createPermDock(policy, options) {
 	const seed = globalThis.crypto.randomUUID();
-	const { kernel, bind, scopeOf, handlerScope } = bindKernel(policy, options, "elysia", toRequest);
-	const permdock = () => new Elysia({
+	const { kernel, bind, scopeOf, handlerScope, getPermDock, guard: runGuard } = bindKernel(policy, options, "elysia", toRequest);
+	const middleware = () => new Elysia({
 		name: "permdock",
 		seed
 	}).derive({ as: "global" }, async (ctx) => {
-		const instance = await kernel.permdock(bind(ctx), await scopeOf(ctx));
+		const instance = await kernel.getPermDock(bind(ctx), await scopeOf(ctx));
 		decorate(ctx, instance);
 		return { permdock: instance };
 	}).onError({ as: "global" }, ({ error, request }) => problemFromError(error, { credentials: hasCredentials(request) }));
-	const protect = (permission, loadData, protectOptions) => async (ctx) => {
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(ctx), protectOptions)(bind(ctx), await scopeOf(ctx));
+	const protect = (permission, data, protectOptions) => async (ctx) => {
+		const guard = await runGuard(permission, data, ctx, protectOptions);
 		if (!guard.ok) return guard.response;
 		decorate(ctx, guard.permdock, guard.data);
 	};
@@ -25,7 +25,7 @@ function createPermDock(policy, options) {
 	const connection = (ws, connectionOptions) => socketConnection(sockets, ws.data, async () => {
 		const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
 		onRevoked(conn, (problem) => {
-			ws.close(POLICY_VIOLATION, problem.type);
+			ws.close(POLICY_VIOLATION, closeReason(problem));
 		});
 		return conn;
 	});
@@ -37,7 +37,8 @@ function createPermDock(policy, options) {
 		}).post("/", (ctx) => POST(bind(ctx))).get("/", (ctx) => GET(bind(ctx)));
 	};
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
 		permdockHandler,
@@ -56,4 +57,4 @@ function toRequest(ctx) {
 	});
 }
 //#endregion
-export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/env-DJZrPjRi.js

@@ -0,0 +1,8 @@
+//#region src/cli/core/env.ts
+/** `CI` set to anything but an empty string, `0` or `false`. */
+function isCi(env) {
+	const value = env["CI"]?.trim().toLowerCase();
+	return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+}
+//#endregion
+export { isCi };

package/dist/errors-BDUwg2qC.js

@@ -0,0 +1,27 @@
+//#region src/approvals/access-reviews/errors.ts
+var AccessReviewError = class extends Error {
+	name = "AccessReviewError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"review-not-found",
+	"review-closed",
+	"item-not-found",
+	"item-not-pending",
+	"reviewer-unauthenticated",
+	"reviewer-not-eligible",
+	"reviewer-is-holder",
+	"not-revoked",
+	"already-applied"
+]);
+function isAccessReviewError(value) {
+	if (!(value instanceof Error) || value.name !== "AccessReviewError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+export { isAccessReviewError as n, AccessReviewError as t };

package/dist/{errors-Cz5zn0mW.js → errors-BKy0EfhN.js}

@@ -1,6 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { a as wireDenials, n as problemDetails } from "./problem-details-_AMOYz-w.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { a as problemType, n as problemDetails, o as statusProblem } from "./problem-details-cn5X30gZ.js";
+import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
 //#region src/core/errors.ts
 var PermDockDeniedError = class extends Error {
@@ -101,7 +101,7 @@ var PermDockRevokedError = class extends Error {
 	}
 	toProblemDetails(options) {
 		if (this.code === "denied") return compact({
-			type: `${PROBLEM_BASE}/denied`,
+			type: problemType("denied"),
 			title: "Permission denied",
 			status: 403,
 			detail: this.code,
@@ -109,14 +109,10 @@ var PermDockRevokedError = class extends Error {
 			permission: this.permission,
 			denials: this.decision?.outcome === "denied" ? wireDenials(this.decision.denials) : void 0
 		});
-		return compact({
-			type: `${PROBLEM_BASE}/unauthenticated`,
-			title: "Authorization ended",
-			status: 401,
-			detail: this.code,
+		return statusProblem(401, this.code, compact({
 			instance: options?.instance,
 			permission: this.permission
-		});
+		}));
 	}
 };
 //#endregion

package/dist/errors-BWXBMaKK.d.ts

@@ -0,0 +1,11 @@
+//#region src/approvals/errors.d.ts
+type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
+declare class ApprovalError extends Error {
+  override readonly name: "ApprovalError";
+  readonly code: ApprovalErrorCode;
+  constructor(code: ApprovalErrorCode, message: string);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+declare function isApprovalError(value: unknown): value is ApprovalError;
+//#endregion
+export { ApprovalErrorCode as n, isApprovalError as r, ApprovalError as t };

package/dist/{errors-DPdqI50v.d.ts → errors-C2PXIv4c.d.ts}

@@ -1,5 +1,5 @@
-import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { t as Disclosure } from "./problem-details-DX075l9V.js";
+import { Nn as Decision, an as WireDenial, ir as Subject } from "./policy-types-DzwivBgR.js";
+import { t as Disclosure } from "./problem-details-DXlt-vks.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */

package/dist/errors-CWTY6uih.js

@@ -0,0 +1,143 @@
+import { stripVTControlCharacters } from "node:util";
+//#region src/cli/core/errors.ts
+const CODES = {
+	usage: ["Invalid arguments", 2],
+	unknown_command: ["Unknown command", 2],
+	unknown_flag: ["Unknown flag", 2],
+	invalid_value: ["Invalid value", 2],
+	command_moved: ["Command moved", 2],
+	flag_renamed: ["Flag renamed", 2],
+	missing_value: ["Missing value", 2],
+	config_not_found: ["Config file not found", 2],
+	config_invalid: ["Invalid config", 2],
+	dependency_missing: ["Missing dependency", 1],
+	database_unreachable: ["Database unreachable", 1],
+	network_error: ["No response", 1],
+	request_failed: ["Request failed", 1],
+	auth_required: ["Authentication required", 3],
+	dirty_worktree: ["Uncommitted changes", 3],
+	write_failed: ["Write failed", 1],
+	check_failed: ["Out of date", 1],
+	input_required: ["Input required", 3],
+	consent_required: ["Consent required", 3],
+	cancelled: ["Cancelled", 130],
+	internal: ["Unexpected error", 1]
+};
+Object.keys(CODES).filter((code) => code in CODES);
+/** Each code has a heading on this page, so `type` links to its explanation. */
+const CLI_ERRORS_URL = "https://permdock.com/docs/cli/errors";
+/** The exit code a problem with `code` gets. */
+function exitCodeOfProblem(code) {
+	return CODES[code][1];
+}
+const DEFAULT_CODES = {
+	usage: "usage",
+	unavailable: "network_error",
+	failed: "check_failed",
+	action: "input_required",
+	cancelled: "cancelled",
+	internal: "internal"
+};
+var CliError = class extends Error {
+	kind;
+	code;
+	extensions;
+	next;
+	constructor(kind, message, options) {
+		super(message, options);
+		this.name = "CliError";
+		this.kind = kind;
+		this.code = options?.code ?? DEFAULT_CODES[kind];
+		this.extensions = options?.extensions ?? {};
+		this.next = options?.next;
+	}
+};
+function describeError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* The exit code an error ends the run with: its code's, so a `CliError` and
+* the problem printed for it always agree. Anything that is not a
+* `CliError` is a bug in the CLI.
+*/
+function exitCodeOfError(error) {
+	if (error instanceof CliError) return exitCodeOfProblem(error.code);
+	return rejectedDefinition(error) ? exitCodeOfProblem("config_invalid") : exitCodeOf("internal");
+}
+/**
+* The library's own runtime checks throw plain errors whose message starts
+* with `PermDock` (an identifier, a condition, a policy it rejects). Those are
+* the project's to fix, so they count as `config_invalid`, not as a CLI bug.
+*/
+function rejectedDefinition(error) {
+	return error instanceof Error && /^PermDock( CLI)?[:\s]/.test(error.message);
+}
+function exitCodeOf(kind) {
+	switch (kind) {
+		case "usage": return 2;
+		case "unavailable":
+		case "failed":
+		case "internal": return 1;
+		case "action": return 3;
+		case "cancelled": return 130;
+		default: return kind;
+	}
+}
+function kindOfCode(code) {
+	switch (code) {
+		case 2: return "usage";
+		case 3: return "action";
+		case 130:
+		case 143: return "cancelled";
+		case 0:
+		case 1: return "failed";
+		default: return code;
+	}
+}
+function cliProblem(kind, message, command, options) {
+	const code = options?.code ?? DEFAULT_CODES[kind];
+	const [title, exitCode] = CODES[code];
+	return {
+		...options?.extensions,
+		type: `${CLI_ERRORS_URL}#${code}`,
+		title,
+		detail: stripVTControlCharacters(message),
+		code,
+		...command === void 0 ? {} : { command },
+		exitCode: options?.exitCode ?? exitCode
+	};
+}
+function problemOf(error, command) {
+	if (error instanceof CliError) return cliProblem(error.kind, error.message, command, {
+		code: error.code,
+		extensions: error.extensions
+	});
+	return rejectedDefinition(error) ? cliProblem("usage", error.message, command, { code: "config_invalid" }) : cliProblem("internal", describeError(error), command);
+}
+/**
+* The result a command reports for a usage error it caught. A `CliError`
+* propagates instead, so `run()` prints it as Problem Details.
+*/
+function usageResult(error) {
+	if (error instanceof CliError) throw error;
+	return {
+		code: 2,
+		output: describeError(error)
+	};
+}
+/**
+* A config, policy or definition the command cannot compile: the project's
+* to fix, so a usage error (exit 2) and never an `internal` one.
+*/
+function configError(message) {
+	return new CliError("usage", message, { code: "config_invalid" });
+}
+/** The run needs a value only the caller can supply: exit 3 with `missing` naming the flags. */
+function missingInput(command, missing, hint) {
+	return new CliError("action", `${command} needs ${missing.join(" and ")}${hint === void 0 ? "" : `: ${hint}`}`, {
+		code: "input_required",
+		extensions: { missing }
+	});
+}
+//#endregion
+export { describeError as a, missingInput as c, configError as i, problemOf as l, CliError as n, exitCodeOfError as o, cliProblem as r, kindOfCode as s, CLI_ERRORS_URL as t, usageResult as u };