permdock 0.3.1 → 0.5.0

package/dist/authzen/index.js

@@ -1,46 +1,192 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { E as ownGet, _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
-import { t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
-import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { r as ownGet } from "../paths-DXSHAMIa.js";
+import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { t as fromWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as hasCredentials } from "../http-SO7qGttf.js";
-import { i as methodNotAllowed, l as unauthenticatedProblem, s as problemResponse, t as batchTooLarge, u as validationProblem } from "../problem-B43ztKIm.js";
-import { t as applyApprovalResume } from "../evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as permissionLookup } from "../evaluation-items-CfCCejQd.js";
-import { a as endsWithPath, c as mergeItem, d as pathnameOf, f as permissionOf, g as userFromEntity, h as tenantOf, i as delegationOf, l as pageOf, m as resourceIdOf, n as UNKNOWN, o as evaluationRow, p as resourceData, r as actorOf, s as isRecord, t as UNAVAILABLE, u as paged } from "../map-AcxK9o_D.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
+import { r as hasCredentials } from "../http-BBoKefeS.js";
+import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CTviyH5L.js";
+import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { _ as wireResourceId, a as evaluationReasons, c as unknownSemanticProblem, g as permissionLookup, h as itemResourceData, i as evaluateBatch, l as withRequestId, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-DZ2CbV5k.js";
+//#region src/authzen/map.ts
+const UNKNOWN = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "unknown-permission"
+	}],
+	alternatives: []
+};
+const UNAVAILABLE = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "resource-unavailable"
+	}],
+	alternatives: []
+};
+function actionNameOf(item) {
+	if (typeof item.action?.name === "string") return item.action.name;
+	if (!isRecord(item.action?.properties)) return;
+	const scope = item.action.properties["scope"];
+	return typeof scope === "string" ? scope : void 0;
+}
+function permissionOf(lookup, item) {
+	return lookup(actionNameOf(item), item.resource);
+}
+function resourceData(item) {
+	return itemResourceData(item.resource);
+}
+/** The row id an item names; `undefined` for none and for the collection sentinel `id: "*"`. */
+function resourceIdOf(item) {
+	return wireResourceId(item.resource?.id);
+}
+function userFromEntity(entity) {
+	if (entity === void 0) return null;
+	const result = {};
+	if (typeof entity.id === "string" || typeof entity.id === "number") result["id"] = String(entity.id);
+	if (isRecord(entity.properties)) for (const [key, value] of Object.entries(entity.properties)) {
+		if (key === "actor" || key === "delegation") continue;
+		result[key] = value;
+	}
+	return Object.keys(result).length === 0 ? null : result;
+}
+function contextOrSubject(item, name) {
+	return (isRecord(item.context) ? item.context[name] : void 0) ?? (isRecord(item.subject?.properties) ? item.subject.properties[name] : void 0);
+}
+function actorOf(item) {
+	const raw = contextOrSubject(item, "actor");
+	if (!isRecord(raw) || typeof raw["id"] !== "string") return;
+	const kind = typeof raw["kind"] === "string" ? raw["kind"] : "oauth-client";
+	return {
+		id: raw["id"],
+		kind
+	};
+}
+function delegationOf(item) {
+	return fromWireDelegation(contextOrSubject(item, "delegation"));
+}
+function tenantOf(item) {
+	if (!isRecord(item.context) || typeof item.context["tenant"] !== "string") return;
+	return item.context["tenant"];
+}
+function permdockContext(decision) {
+	switch (decision.outcome) {
+		case "granted": return { outcome: "granted" };
+		case "denied": {
+			const unknown = decision.denials.some((denial) => denial.detail === "unknown-permission");
+			return compact({
+				outcome: "denied",
+				denials: decision.denials.map((denial) => ({
+					role: denial.role,
+					reason: denial.reason
+				})),
+				reason: unknown ? "unknown-permission" : void 0
+			});
+		}
+		case "approval-required": return {
+			outcome: "approval-required",
+			token: decision.token
+		};
+		default: return decision;
+	}
+}
+function evaluationRow(decision, permission) {
+	return {
+		decision: decision.outcome === "granted",
+		context: {
+			permdock: permdockContext(decision),
+			...evaluationReasons(decision, permission)
+		}
+	};
+}
+function pathnameOf(request) {
+	return new URL(request.url).pathname;
+}
+function endsWithPath(pathname, suffix) {
+	return pathname === suffix || pathname.endsWith(suffix);
+}
+/**
+* One item of an `evaluations` batch with the request's top-level `subject`,
+* `action`, `resource` and `context` filled in where the item omits them.
+*/
+function mergeEvaluationItem(shared, item) {
+	if (!isRecord(item)) return shared;
+	return compact({
+		subject: isRecord(item["subject"]) ? item["subject"] : shared.subject,
+		action: isRecord(item["action"]) ? item["action"] : shared.action,
+		resource: isRecord(item["resource"]) ? item["resource"] : shared.resource,
+		context: item["context"] ?? shared.context
+	});
+}
+function pageOf(body) {
+	const page = isRecord(body["page"]) ? body["page"] : {};
+	const raw = typeof page["token"] === "string" ? page["token"] : typeof page["next_token"] === "string" ? page["next_token"] : "0";
+	const parsed = Math.trunc(Number(raw));
+	const sizeRaw = page["limit"] ?? page["size"];
+	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : 50;
+	return {
+		offset: Number.isFinite(parsed) && parsed > 0 ? parsed : 0,
+		size
+	};
+}
+function paged(items, offset, size) {
+	const slice = items.slice(offset, offset + size);
+	const next = offset + slice.length;
+	return {
+		results: slice,
+		page: {
+			next_token: next < items.length ? String(next) : "",
+			count: slice.length,
+			total: items.length
+		}
+	};
+}
+//#endregion
 //#region src/authzen/create.ts
 function notFound(detail) {
-	return problemResponse({
-		type: `${PROBLEM_BASE}/not-found`,
-		title: "Not found",
-		status: 404,
-		detail
-	});
+	return problemResponse(statusProblem(404, detail));
 }
 async function readJson(request) {
+	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return validationProblem("AuthZEN requests must use Content-Type: application/json");
+	const read = await readBodyText(request);
+	if (!read.ok) return read.cause === "too-large" ? bodyTooLarge() : validationProblem("AuthZEN body was not valid JSON");
 	try {
-		return await request.json();
+		return JSON.parse(read.text);
 	} catch {
 		return validationProblem("AuthZEN body was not valid JSON");
 	}
 }
-const SEMANTICS = [
-	"execute_all",
-	"deny_on_first_deny",
-	"permit_on_first_permit"
-];
-function semanticOf(body) {
-	const options = body["options"];
-	const value = isRecord(options) ? options["evaluations_semantic"] : void 0;
-	if (value === void 0) return "execute_all";
-	return SEMANTICS.find((semantic) => semantic === value);
+/**
+* The 400 for a request missing a required entity or one of its required
+* fields (AuthZEN 1.0 sections 5, 6.1 and 10.1.1), or `undefined`.
+*/
+function missingProblem(body, required) {
+	for (const name of ["subject", "resource"]) {
+		const needs = required[name];
+		if (needs === void 0) continue;
+		const entity = body[name];
+		if (!isRecord(entity) || typeof entity["type"] !== "string") return validationProblem(`${name}.type is required`);
+		if (needs === "type-id" && typeof entity["id"] !== "string") return validationProblem(`${name}.id is required`);
+	}
+	if (required.action === true) {
+		const action = body["action"];
+		if (!isRecord(action) || typeof action["name"] !== "string") return validationProblem("action.name is required");
+	}
 }
+const EVALUATION = {
+	subject: "type-id",
+	action: true,
+	resource: "type-id"
+};
 const WELL_KNOWN = "/.well-known/authzen-configuration";
-function withRequestId(request, response) {
-	const id = request.headers.get("x-request-id");
-	if (id !== null && id !== "") response.headers.set("X-Request-ID", id);
-	return response;
+/** The name an item's action gives, for the reasons of an unknown permission. */
+function actionName(item) {
+	return typeof item.action?.name === "string" ? item.action.name : "unknown";
 }
 const createPermDock = (policy, options) => {
 	const maxEvaluations = options.maxEvaluations ?? 256;
@@ -56,24 +202,23 @@ const createPermDock = (policy, options) => {
 	};
 	const allowAnonymous = options.anonymous === true;
 	async function authenticate(request) {
-		let pep;
-		try {
-			pep = await options.subject(request);
-		} catch {
-			pep = null;
-		}
+		const pep = await resolveOrNull(() => options.subject(request));
 		if ((pep === null || pep === void 0) && !allowAnonymous) return unauthenticatedProblem(hasCredentials(request));
 		return { pep: pep ?? null };
 	}
-	function instantiate(pep, item) {
+	async function instantiate(pep, item) {
 		const trusted = trusts(pep);
 		const user = (trusted ? userFromEntity(item.subject) : null) ?? pep;
-		return createPermDock$1(policy, user, compact({
-			actor: trusted ? actorOf(item) : void 0,
-			delegation: trusted ? delegationOf(item) : void 0,
-			tenant: tenantOf(item),
-			...instanceOptions(options)
-		}));
+		return (await buildInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				actor: trusted ? actorOf(item) : void 0,
+				delegation: trusted ? delegationOf(item) : void 0,
+				tenant: tenantOf(item)
+			}
+		})).permdock;
 	}
 	async function resourceOf(item) {
 		const properties = item.resource?.properties;
@@ -83,7 +228,7 @@ const createPermDock = (policy, options) => {
 		};
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const id = resourceIdOf(item);
-		const load = type !== void 0 && options.resources !== void 0 ? options.resources[type]?.load : void 0;
+		const load = type !== void 0 && options.resources !== void 0 ? options.resources[type]?.data : void 0;
 		if (id !== void 0 && load !== void 0) try {
 			return {
 				data: await load(id),
@@ -106,22 +251,27 @@ const createPermDock = (policy, options) => {
 		const permdock = await instantiate(pep, item);
 		const decide = permdock.decide;
 		const decision = decide(permission, data, trusted ? {
-			source: "endpoint",
+			call: "endpoint",
 			adapter: "authzen",
 			trusted: true
 		} : {
-			source: "endpoint",
+			call: "endpoint",
 			adapter: "authzen",
 			trusted: false,
 			boundary: "decision-endpoint"
 		});
-		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, item.resource?.id), "authzen");
+		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, resourceIdOf(item)), "authzen");
+	}
+	async function rowOf(request, pep, item) {
+		return evaluationRow(await decideItem(request, pep, item), permissionOf(lookup, item)?.key ?? actionName(item));
 	}
 	async function evaluation(request, pep) {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("evaluation body must be an object");
-		return Response.json(evaluationRow(await decideItem(request, pep, body)));
+		const missing = missingProblem(body, EVALUATION);
+		if (missing !== void 0) return missing;
+		return Response.json(await rowOf(request, pep, body));
 	}
 	async function evaluations(request, pep) {
 		const body = await readJson(request);
@@ -129,31 +279,27 @@ const createPermDock = (policy, options) => {
 		if (!isRecord(body)) return validationProblem("evaluations body must be an object");
 		const items = body["evaluations"] ?? [];
 		if (!Array.isArray(items)) return validationProblem("evaluations must be an array");
-		if (items.length === 0) return Response.json(evaluationRow(await decideItem(request, pep, body)));
+		if (items.length === 0) return missingProblem(body, EVALUATION) ?? Response.json(await rowOf(request, pep, body));
 		if (items.length > maxEvaluations) return batchTooLarge(maxEvaluations);
-		const semantic = semanticOf(body);
-		if (semantic === void 0) return validationProblem(`options.evaluations_semantic must be one of ${SEMANTICS.join(", ")}`);
+		const semantic = evaluationsSemantic(body);
+		if (semantic === void 0) return unknownSemanticProblem();
 		const shared = compact({
 			subject: isRecord(body["subject"]) ? body["subject"] : void 0,
 			action: isRecord(body["action"]) ? body["action"] : void 0,
 			resource: isRecord(body["resource"]) ? body["resource"] : void 0,
 			context: body["context"]
 		});
-		const rowOf = (item) => decideItem(request, pep, mergeItem(shared, item)).then(evaluationRow);
-		if (semantic === "execute_all") return Response.json({ evaluations: await Promise.all(items.map(rowOf)) });
-		const stopOn = semantic === "permit_on_first_permit";
-		const rows = [];
-		for (const item of items) {
-			const row = await rowOf(item);
-			rows.push(row);
-			if (row.decision === stopOn) break;
-		}
-		return Response.json({ evaluations: rows });
+		return Response.json({ evaluations: await evaluateBatch(items, semantic, (item) => rowOf(request, pep, mergeEvaluationItem(shared, item))) });
 	}
 	async function searchAction(request, pep) {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/action body must be an object");
+		const missingAction = missingProblem(body, {
+			subject: "type-id",
+			resource: "type-id"
+		});
+		if (missingAction !== void 0) return missingAction;
 		const item = body;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const leaves = listPermissions(policy.permissions).filter((leaf) => type === void 0 || leaf.resource === type);
@@ -184,6 +330,12 @@ const createPermDock = (policy, options) => {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/resource body must be an object");
+		const missingResource = missingProblem(body, {
+			subject: "type-id",
+			action: true,
+			resource: "type"
+		});
+		if (missingResource !== void 0) return missingResource;
 		const item = body;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const permission = permissionOf(lookup, item);
@@ -209,6 +361,12 @@ const createPermDock = (policy, options) => {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/subject body must be an object");
+		const missingSubject = missingProblem(body, {
+			subject: "type",
+			action: true,
+			resource: "type-id"
+		});
+		if (missingSubject !== void 0) return missingSubject;
 		let records;
 		try {
 			records = await options.subjects.list();
@@ -243,15 +401,11 @@ const createPermDock = (policy, options) => {
 	}
 	function discovery(request, pathname) {
 		const pdp = `${new URL(request.url).origin}${pathname.slice(pathname.indexOf(WELL_KNOWN) + 34).replace(/\/+$/u, "")}`;
-		const document = {
-			policy_decision_point: pdp,
-			access_evaluation_endpoint: `${pdp}/access/v1/evaluation`,
-			access_evaluations_endpoint: `${pdp}/access/v1/evaluations`,
-			search_action_endpoint: `${pdp}/access/v1/search/action`,
-			search_resource_endpoint: `${pdp}/access/v1/search/resource`
-		};
-		if (options.subjects?.list !== void 0) document["search_subject_endpoint"] = `${pdp}/access/v1/search/subject`;
-		return Response.json(document);
+		return Response.json(authzenMetadata(pdp, {
+			action: true,
+			resource: true,
+			subject: options.subjects?.list !== void 0
+		}));
 	}
 	async function route(request) {
 		const pathname = pathnameOf(request);
@@ -294,9 +448,8 @@ const createPermDock = (policy, options) => {
 		}
 		return notFound("unknown AuthZEN path");
 	}
-	return { async permdockHandler(request) {
-		return withRequestId(request, await route(request));
-	} };
+	const handler = async (request) => withRequestId(request, await route(request));
+	return { permdockHandler: () => handler };
 };
 //#endregion
-export { createPermDock };
+export { EVALUATIONS_SEMANTICS, createPermDock, evaluateBatch, evaluationsSemantic, mergeEvaluationItem };

package/dist/automation-BMZPIVUM.d.ts

@@ -0,0 +1,114 @@
+import { Lt as InstanceHandle, Pn as Denial, Rt as Instant } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { t as Operation } from "./operations-CxybZErY.js";
+//#region src/core/automation.d.ts
+/**
+ * Who an automation runs as. `publisher`: the person who published it, with
+ * their rights as of each run. `service`: a `kind: 'service'` principal
+ * holding `roles` in `tenant`, capped at what the publisher could assign.
+ */
+type AutomationMode = "publisher" | "service";
+/**
+ * Automation v1: a published, versioned run of operations. Every run acts
+ * as `principal` with live rights, narrowed to `permissions` (the
+ * operations' permissions) and to any policy delegation to
+ * `actor('automation')`. The event that triggers a run never grants.
+ */
+type Automation = {
+  readonly v: 1;
+  readonly id: string;
+  /** Changes on every edit; a run ticket for another version is refused. */
+  readonly version: number | string;
+  readonly mode: AutomationMode;
+  /** The principal each run acts as: the publisher, or the service principal. */
+  readonly principal: string;
+  readonly publishedBy: string;
+  /** RFC 3339. */
+  readonly publishedAt: string;
+  readonly tenant?: string;
+  /** Service mode only: the roles the service principal holds in `tenant`. */
+  readonly roles?: readonly string[];
+  /** The operation names the automation runs. */
+  readonly operations: readonly string[];
+  /** The delegation: the permission keys of `operations`. */
+  readonly permissions: readonly string[];
+  /** The permission key a caller needs to start a run; absent, only server code starts one. */
+  readonly run?: string;
+  readonly revoked?: boolean;
+  readonly name?: string;
+};
+/** The live record of each automation, read on every run. */
+type AutomationSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  /** The automation as of now, or `null` for an unknown one. A throw is no automation. */
+  automation(id: string, options?: {
+    readonly tenant?: string;
+  }): Automation | null | Promise<Automation | null>;
+};
+type OperationRef = Pick<Operation, "name" | "permission">;
+type AutomationRequest = {
+  readonly id: string;
+  readonly version: number | string;
+  /** The operations the automation runs: entries of an `OperationMap`, or the map itself. */
+  readonly operations: readonly OperationRef[] | Readonly<Record<string, OperationRef>>;
+  /** Defaults to `'publisher'`. */
+  readonly mode?: AutomationMode;
+  /** Defaults to the publisher's active tenant; required for `service`. */
+  readonly tenant?: string;
+  /** Service mode: the service principal's id; defaults to `automation:<id>`. */
+  readonly principal?: string;
+  /** Service mode: the roles the service principal holds in `tenant`. */
+  readonly roles?: readonly string[];
+  /** The permission a caller needs to start a run. */
+  readonly run?: Permission;
+  readonly name?: string;
+};
+type AutomationDecision = {
+  readonly outcome: "granted";
+  readonly automation: Automation;
+} | {
+  readonly outcome: "denied";
+  readonly denials: readonly Denial[];
+};
+type DecideAutomationOptions = {
+  /** The publication time; defaults to the clock. */
+  readonly now?: Instant;
+};
+/**
+ * Validates an untrusted automation record and returns a frozen copy with
+ * only the v1 fields, or `undefined`. A service automation needs `tenant`
+ * and `roles`; a publisher automation runs as `publishedBy` and has no
+ * `roles`.
+ */
+declare function parseAutomation(input: unknown): Automation | undefined;
+type MemoryAutomationSource = {
+  automation(id: string, options?: {
+    readonly tenant?: string;
+  }): Automation | null;
+  /** Adds or replaces a record by id; an invalid record throws. */
+  put(automation: Automation): void;
+};
+/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+declare function memoryAutomationSource(automations?: readonly Automation[]): MemoryAutomationSource;
+/**
+ * Decides whether the subject of `permdock` may publish the automation in
+ * `request`, and returns the record to store. The publisher must be a
+ * signed-in user or service that is not a link, a feed, a contact, a
+ * credential or a run, and must be able to use every operation's permission
+ * now (`exceeds-creator`); each run re-checks their live rights. A
+ * `service` automation's tenant must be one the publisher is a member of,
+ * its roles among their `assignableRoles` there and its permissions within
+ * `assignablePermissions`. PermDock never stores the record; the
+ * application does, after a `granted` result.
+ */
+/**
+ * Decides whether the subject of `permdock` may publish the automation in
+ * `request` and returns the record to store: the publisher's own reach over
+ * every operation's permission and, for a `service` automation, their
+ * assignable ceiling. Each run re-checks the publisher live. An instance
+ * built from a snapshot denies with `unsupported`.
+ */
+declare function decideAutomation(permdock: InstanceHandle, request: AutomationRequest, options?: DecideAutomationOptions): Promise<AutomationDecision>;
+//#endregion
+export { AutomationSource as a, decideAutomation as c, AutomationRequest as i, memoryAutomationSource as l, AutomationDecision as n, DecideAutomationOptions as o, AutomationMode as r, MemoryAutomationSource as s, Automation as t, parseAutomation as u };

package/dist/automation-DVjOckjV.js

@@ -0,0 +1,157 @@
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+//#region src/core/automation.ts
+const MAX_NAME = 256;
+function isVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 || isId(value);
+}
+/**
+* Validates an untrusted automation record and returns a frozen copy with
+* only the v1 fields, or `undefined`. A service automation needs `tenant`
+* and `roles`; a publisher automation runs as `publishedBy` and has no
+* `roles`.
+*/
+function parseAutomation(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"]) || !isVersion(value["version"]) || value["mode"] !== "publisher" && value["mode"] !== "service" || !isId(value["principal"]) || !isId(value["publishedBy"]) || !isRfc3339(value["publishedAt"])) return;
+	const operations = idList(value["operations"]);
+	const permissions = idList(value["permissions"]);
+	const roles = value["roles"] === void 0 ? void 0 : idList(value["roles"]);
+	const { tenant, run, revoked, name } = value;
+	if (operations === void 0 || permissions === void 0 || value["roles"] !== void 0 && roles === void 0 || tenant !== void 0 && !isId(tenant) || run !== void 0 && !isId(run) || revoked !== void 0 && typeof revoked !== "boolean" || name !== void 0 && (typeof name !== "string" || name.length > MAX_NAME)) return;
+	if (value["mode"] === "service") {
+		if (tenant === void 0 || roles === void 0) return;
+	} else if (roles !== void 0 || value["principal"] !== value["publishedBy"]) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		version: value["version"],
+		mode: value["mode"],
+		principal: value["principal"],
+		publishedBy: value["publishedBy"],
+		publishedAt: value["publishedAt"],
+		tenant,
+		roles,
+		operations,
+		permissions,
+		run,
+		revoked: revoked === true ? true : void 0,
+		name
+	}));
+}
+/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+function memoryAutomationSource(automations = []) {
+	const byId = /* @__PURE__ */ new Map();
+	const put = (automation) => {
+		const parsed = parseAutomation(automation);
+		if (parsed === void 0) throw new TypeError("PermDock: invalid automation record");
+		byId.set(parsed.id, parsed);
+	};
+	for (const automation of automations) put(automation);
+	return Object.freeze({
+		automation(id, options) {
+			const found = byId.get(id);
+			if (found === void 0 || options?.tenant !== void 0 && found.tenant !== void 0 && found.tenant !== options.tenant) return null;
+			return found;
+		},
+		put
+	});
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function operationList(operations) {
+	return isReadonlyArray(operations) ? operations : Object.values(operations);
+}
+/**
+* Decides whether the subject of `permdock` may publish the automation in
+* `request`, and returns the record to store. The publisher must be a
+* signed-in user or service that is not a link, a feed, a contact, a
+* credential or a run, and must be able to use every operation's permission
+* now (`exceeds-creator`); each run re-checks their live rights. A
+* `service` automation's tenant must be one the publisher is a member of,
+* its roles among their `assignableRoles` there and its permissions within
+* `assignablePermissions`. PermDock never stores the record; the
+* application does, after a `granted` result.
+*/
+/**
+* Decides whether the subject of `permdock` may publish the automation in
+* `request` and returns the record to store: the publisher's own reach over
+* every operation's permission and, for a `service` automation, their
+* assignable ceiling. Each run re-checks the publisher live. An instance
+* built from a snapshot denies with `unsupported`.
+*/
+function decideAutomation(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	return Promise.resolve().then(() => decideAutomationWith(internals.instance, request, options));
+}
+function decideAutomationWith(permdock, request, options) {
+	const publisher = permdock.subject.principal;
+	if (publisher === null) return denied("anonymous");
+	if (publisher.kind === "link" || publisher.kind === "feed" || publisher.kind === "contact") return denied("exceeds-creator", { creator: publisher.kind });
+	if ("credential" in publisher || "runTicket" in publisher) return denied("exceeds-creator", { creator: "credential" in publisher ? "credential" : "run" });
+	const mode = request.mode ?? "publisher";
+	const refs = operationList(request.operations);
+	if (!isId(request.id) || !isVersion(request.version) || refs.length === 0 || mode !== "publisher" && mode !== "service") return denied("validation");
+	const names = [];
+	const keys = [];
+	for (const ref of refs) {
+		const leaf = findPermission(permdock.permissions, ref.permission.key);
+		if (!isId(ref.name) || leaf === void 0 || names.includes(ref.name)) return denied("validation");
+		names.push(ref.name);
+		if (!keys.includes(leaf.key)) keys.push(leaf.key);
+		if (!permdock.mayUse(leaf)) return denied("exceeds-creator", { permission: leaf.key });
+	}
+	const run = request.run === void 0 ? void 0 : findPermission(permdock.permissions, request.run.key);
+	if (request.run !== void 0 && run === void 0) return denied("validation");
+	const tenant = request.tenant ?? publisher.tenant;
+	if (tenant !== void 0 && !permdock.tenants().includes(tenant)) return denied("exceeds-creator", { tenant });
+	if (mode === "service") {
+		if (tenant === void 0 || request.roles === void 0) return denied("validation");
+		const assignable = new Set(permdock.assignableRoles({ tenant }).map((role) => role.key));
+		for (const role of request.roles) if (!assignable.has(role)) return denied("exceeds-creator", { role });
+		const ceiling = new Set(permdock.assignablePermissions({ tenant }).map((leaf) => leaf.key));
+		for (const key of keys) if (!ceiling.has(key)) return denied("exceeds-creator", { permission: key });
+	}
+	const automation = parseAutomation(compact({
+		v: 1,
+		id: request.id,
+		version: request.version,
+		mode,
+		principal: mode === "service" ? request.principal ?? `automation:${request.id}` : publisher.id,
+		publishedBy: publisher.id,
+		publishedAt: rfc3339(nowSeconds(options.now)),
+		tenant,
+		roles: mode === "service" ? request.roles : void 0,
+		operations: names,
+		permissions: keys,
+		run: run?.key,
+		name: request.name
+	}));
+	if (automation === void 0) return denied("validation");
+	return freezeDeep({
+		outcome: "granted",
+		automation
+	});
+}
+//#endregion
+export { memoryAutomationSource as n, parseAutomation as r, decideAutomation as t };