permdock 0.3.1 → 0.5.0

package/dist/relations-BnCWnJGI.js

@@ -0,0 +1,163 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as idText } from "./expiry-D4_YKRKD.js";
+import { n as isThenable } from "./thenable-yD7SabqG.js";
+import { a as expandRelation } from "./resource-relations-D_jw0BFx.js";
+//#region src/core/relations.ts
+function isInstant(value) {
+	return value === void 0 || typeof value === "number" && Number.isFinite(value);
+}
+function asChain(value) {
+	if (!isRecord(value) || !Array.isArray(value["ancestors"])) return;
+	const ancestors = [];
+	for (const item of value["ancestors"]) {
+		if (!isRecord(item) || typeof item["id"] !== "string" || item["id"] === "") return;
+		ancestors.push(item["restricted"] === true ? {
+			id: item["id"],
+			restricted: true
+		} : { id: item["id"] });
+	}
+	return {
+		ancestors,
+		...value["restricted"] === true ? { restricted: true } : {},
+		...value["truncated"] === true ? { truncated: true } : {}
+	};
+}
+function asRow(value) {
+	if (value === null || value === void 0) return { row: null };
+	return isRecord(value) ? { row: value } : void 0;
+}
+function asGroup(value) {
+	if (!isRecord(value) || typeof value["resource"] !== "string" || typeof value["id"] !== "string" || typeof value["relation"] !== "string" || value["id"] === "") return;
+	return {
+		resource: value["resource"],
+		id: value["id"],
+		relation: value["relation"]
+	};
+}
+function asHolders(value) {
+	if (!Array.isArray(value)) return;
+	const holders = [];
+	for (const item of value) {
+		if (!isRecord(item) || !isInstant(item["startsAt"]) || !isInstant(item["expiresAt"])) return;
+		const period = {
+			...item["startsAt"] === void 0 ? {} : { startsAt: item["startsAt"] },
+			...item["expiresAt"] === void 0 ? {} : { expiresAt: item["expiresAt"] }
+		};
+		if (isRecord(item["principal"]) && typeof item["principal"]["id"] === "string") {
+			holders.push({
+				principal: { id: item["principal"]["id"] },
+				...period
+			});
+			continue;
+		}
+		const group = asGroup(item["group"]);
+		if (group === void 0) return;
+		holders.push({
+			group,
+			...period
+		});
+	}
+	return holders;
+}
+function read(cache, key, call, validate) {
+	const entry = cache.get(key);
+	if (entry !== void 0) return entry.state === "ready" ? entry.value : entry.state;
+	if (call === void 0) return "failed";
+	const settle = (value) => {
+		const valid = validate(value);
+		cache.set(key, valid === void 0 ? { state: "failed" } : {
+			state: "ready",
+			value: valid
+		});
+	};
+	let result;
+	try {
+		result = call();
+	} catch {
+		cache.set(key, { state: "failed" });
+		return "failed";
+	}
+	if (isThenable(result)) {
+		const promise = Promise.resolve(result).then(settle, () => {
+			cache.set(key, { state: "failed" });
+		});
+		cache.set(key, {
+			state: "pending",
+			promise
+		});
+		return "pending";
+	}
+	settle(result);
+	const settled = cache.get(key);
+	return settled?.state === "ready" ? settled.value : "failed";
+}
+function relationReader(source, cache, resources) {
+	const concrete = (resource, id, relation) => read(cache, JSON.stringify([
+		"holders",
+		resource,
+		id,
+		relation
+	]), source === void 0 ? void 0 : () => source.related({
+		resource,
+		id,
+		relation
+	}), asHolders);
+	return {
+		available: source !== void 0,
+		row(query) {
+			const load = source?.row?.bind(source);
+			return read(cache, JSON.stringify([
+				"row",
+				query.resource,
+				query.id
+			]), load === void 0 ? void 0 : () => load({
+				resource: query.resource,
+				id: query.id
+			}), asRow);
+		},
+		chain(query) {
+			const through = query.through ?? "parent";
+			return read(cache, JSON.stringify([
+				"chain",
+				query.resource,
+				query.id,
+				query.depth,
+				through
+			]), source === void 0 ? void 0 : () => source.ancestors({
+				resource: query.resource,
+				id: query.id,
+				depth: query.depth,
+				through
+			}), asChain);
+		},
+		holders(query) {
+			const node = resources?.get(query.resource);
+			const names = node === void 0 ? [query.relation] : expandRelation(node, query.relation);
+			const out = [];
+			let unread;
+			for (const name of names) {
+				const answer = concrete(query.resource, query.id, name);
+				if (answer === "pending" || answer === "failed") {
+					unread = answer === "failed" || unread === "failed" ? "failed" : "pending";
+					continue;
+				}
+				for (const holder of answer) out.push({
+					...holder,
+					relation: name
+				});
+			}
+			return unread ?? out;
+		}
+	};
+}
+/** The loads still in flight, for an instance that awaits them before deciding. */
+function pendingRelations(cache) {
+	const out = [];
+	for (const entry of cache.values()) if (entry.state === "pending") out.push(entry.promise);
+	return out;
+}
+function relationId(value) {
+	return idText(value);
+}
+//#endregion
+export { relationId as n, relationReader as r, pendingRelations as t };

package/dist/renames-CGj7YwcQ.js

@@ -0,0 +1,175 @@
+//#region src/cli/core/renames.ts
+const DB_COMMANDS = [
+	"rls generate",
+	"rls import",
+	"rls verify",
+	"supabase hook generate",
+	"powersync verify"
+];
+const FLAG_RENAMES = [
+	{
+		commands: DB_COMMANDS,
+		from: "--db",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: DB_COMMANDS,
+		from: "--db-url",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: ["rls generate"],
+		from: "--force",
+		to: "--force-rls"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--emit",
+		to: "--kind"
+	},
+	{
+		commands: ["catalog"],
+		from: "--format",
+		to: "--kind",
+		values: {
+			json: "catalog",
+			schema: "json-schema",
+			markdown: "markdown"
+		}
+	},
+	{
+		commands: ["openapi emit"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate",
+			"powersync generate",
+			"powersync verify",
+			"openapi emit"
+		],
+		from: "--from",
+		to: "--policy"
+	},
+	{
+		commands: ["catalog", "arazzo check"],
+		from: "--from",
+		to: "--permissions"
+	},
+	{
+		commands: ["rls import", "openapi import"],
+		from: "--schema",
+		to: "--validator"
+	},
+	{
+		commands: [
+			"usage",
+			"config",
+			"doctor"
+		],
+		from: "--strict",
+		to: "--fail-on",
+		hint: "--fail-on warning",
+		rewrite: "--fail-on warning"
+	},
+	{
+		commands: ["login"],
+		from: "--write",
+		to: "--scope",
+		hint: "--scope catalog:write",
+		rewrite: "--scope catalog:write"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--agent",
+		to: "--for"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--client",
+		to: "--for"
+	},
+	{
+		commands: ["init"],
+		from: "--agent",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--ui",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--src",
+		to: "--out-dir"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate"
+		],
+		from: "--rbac-scaffold",
+		to: "--rbac",
+		hint: "--rbac supabase",
+		rewrite: "--rbac supabase"
+	},
+	{
+		commands: ["rls migrate"],
+		from: "--write",
+		hint: "rls migrate writes by default; --dry-run prints the plan without writing",
+		rewrite: ""
+	},
+	{
+		commands: ["cloud push"],
+		from: "--environment",
+		to: "--project",
+		hint: "--project <id>: a project id is its environment"
+	},
+	{
+		commands: ["scan"],
+		from: "--legacy",
+		hint: "permdock scan lists the checks written without PermDock; drop --legacy",
+		rewrite: ""
+	}
+];
+const COMMAND_MOVES = [
+	{
+		from: "openapi",
+		to: "openapi emit"
+	},
+	{
+		from: "skills",
+		to: "skills install"
+	},
+	{
+		from: "arazzo",
+		to: "arazzo check"
+	}
+];
+const DEFAULT_CHANGES = [{
+	command: "rls migrate",
+	unless: ["--write", "--retire-out"],
+	add: "--dry-run"
+}];
+/** The rename that matches `flag` (as typed, before any `=`) on `command`. */
+function flagRename(command, flag) {
+	return FLAG_RENAMES.find((rename) => rename.from === flag && rename.commands.includes(command));
+}
+function renameMessage(command, rename) {
+	const replacement = rename.hint ?? rename.to;
+	return replacement === void 0 ? `${command}: ${rename.from} was removed in 0.5.0.` : rename.to === void 0 ? `${command}: ${rename.from} was removed in 0.5.0: ${replacement}.` : `${command}: ${rename.from} is ${replacement} since 0.5.0.`;
+}
+//#endregion
+export { renameMessage as i, DEFAULT_CHANGES as n, flagRename as r, COMMAND_MOVES as t };

package/dist/{replay-CYyiLiwO.d.ts → replay-D7iKcLFe.d.ts}

@@ -1,4 +1,4 @@
-import { g as ReplayStore } from "./types-Cq_H8N_X.js";
+import { l as ReplayStore } from "./types-DiQjupG2.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{replay-BsOyTrdV.js → replay-Du1tJjG7.js}

@@ -1,7 +1,8 @@
+import { o as epochSeconds } from "./time-DkWjdL98.js";
 //#region src/ssf/replay.ts
 function memoryReplayStore() {
 	const seen = /* @__PURE__ */ new Map();
-	function evict(now = Date.now() / 1e3) {
+	function evict(now = epochSeconds()) {
 		for (const [jti, expiresAt] of seen) if (expiresAt !== void 0 && expiresAt <= now) seen.delete(jti);
 	}
 	return {

package/dist/request-context-BTRTG7OT.js

@@ -0,0 +1,71 @@
+import { t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { t as buildInstance } from "./build-instance-BMnAudHn.js";
+//#region src/core/request-context.ts
+/**
+* Errors an adapter raises around one instance (a `context` hook that threw,
+* an `onDenied` that failed), fed to the instance's `on('error')` handlers and
+* replayed to later ones, as core replays its own.
+*/
+function deliver(handler, error) {
+	try {
+		handler(error);
+	} catch {}
+}
+function errorChannel(queued) {
+	const errors = [...queued];
+	const handlers = /* @__PURE__ */ new Set();
+	return {
+		report: (error) => {
+			errors.push(error);
+			for (const handler of handlers) deliver(handler, error);
+		},
+		attach: (permdock) => wrapPermDock(permdock, (inner) => ({ on: (event, handler) => {
+			const off = inner.on(event, handler);
+			if (event !== "error") return off;
+			handlers.add(handler);
+			for (const error of errors) deliver(handler, error);
+			return () => {
+				off();
+				handlers.delete(handler);
+			};
+		} }))
+	};
+}
+/**
+* `buildInstance` with an error channel: the instance's `on('error')`
+* replays `errors` raised while resolving the request, and `report` adds
+* more. Kept beside `errorChannel`, so adapters without one do not bundle it.
+*/
+async function buildReportingInstance(input) {
+	const channel = errorChannel(input.errors);
+	const { wrap } = input;
+	return {
+		...await buildInstance({
+			...input,
+			wrap: (created) => {
+				const attached = channel.attach(created);
+				return wrap === void 0 ? attached : wrap(attached);
+			}
+		}),
+		report: channel.report
+	};
+}
+/**
+* Runs an adapter's `context` hook. A throw, or a value that is not a JSON
+* object, adds no context and lands in `errors`.
+*/
+async function requestContext(hook, input, errors) {
+	if (hook === void 0) return;
+	try {
+		const value = await hook(input);
+		if (value === void 0) return;
+		assertAppData(value, "context");
+		return value;
+	} catch (error) {
+		errors.push(error);
+		return;
+	}
+}
+//#endregion
+export { requestContext as n, buildReportingInstance as t };

package/dist/request-context-C2_1lchh.d.ts

@@ -0,0 +1,5 @@
+//#region src/core/request-context.d.ts
+/** What a `context` hook returns: plain JSON, merged into `subject.context`. */
+type RequestContext = Readonly<Record<string, unknown>>;
+//#endregion
+export { RequestContext as t };

package/dist/request-schema-CMreVuFM.js

@@ -0,0 +1,148 @@
+//#region src/approvals/request-schema.ts
+/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
+const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
+const STRINGS = {
+	type: "array",
+	items: { type: "string" }
+};
+/**
+* `schemas/approval-request-v1.json`: the `ApprovalRequest` an approval store
+* holds. Self-contained (`$defs`, no remote `$ref`) so `rls.jsonSchema` can
+* inline it into a pg_jsonschema check constraint.
+*/
+const APPROVAL_REQUEST_SCHEMA = {
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/approval-request-v1.json",
+	title: "PermDock approval request",
+	description: "An ApprovalRequest as an ApprovalStore holds it, wire format v1. Unknown properties are allowed so a v1 minor release can add one.",
+	type: "object",
+	required: [
+		"v",
+		"id",
+		"token",
+		"permission",
+		"scope",
+		"resource",
+		"subject",
+		"detail",
+		"createdAt",
+		"expiresAt",
+		"status"
+	],
+	properties: {
+		v: { const: 1 },
+		id: {
+			type: "string",
+			minLength: 1
+		},
+		token: {
+			type: "string",
+			minLength: 1
+		},
+		permission: {
+			type: "string",
+			minLength: 1
+		},
+		scope: { type: "string" },
+		resource: {
+			type: "object",
+			required: ["type"],
+			properties: {
+				type: { type: "string" },
+				id: { type: "string" }
+			}
+		},
+		subject: { $ref: "#/$defs/subject" },
+		membership: {
+			type: "object",
+			required: ["roles"],
+			properties: { roles: STRINGS }
+		},
+		approvers: { type: "object" },
+		detail: { type: "string" },
+		adapter: { type: "string" },
+		createdAt: { $ref: "#/$defs/instant" },
+		expiresAt: { $ref: "#/$defs/instant" },
+		status: { enum: [
+			"pending",
+			"approved",
+			"rejected",
+			"expired"
+		] },
+		approvals: {
+			type: "array",
+			items: { $ref: "#/$defs/signature" }
+		},
+		resolvedAt: { $ref: "#/$defs/instant" },
+		resolvedBy: { type: "string" },
+		vouched: { type: "string" },
+		note: { type: "string" },
+		consumedAt: { $ref: "#/$defs/instant" },
+		x: {
+			type: "object",
+			description: "The application's own data, set when the request opens: plain JSON, never read by a decision."
+		}
+	},
+	$defs: {
+		instant: {
+			type: "string",
+			format: "date-time",
+			pattern: INSTANT
+		},
+		subject: {
+			type: "object",
+			required: ["principal"],
+			properties: {
+				principal: { anyOf: [{ type: "null" }, {
+					type: "object",
+					required: ["id", "roles"],
+					properties: {
+						id: { type: "string" },
+						roles: STRINGS,
+						tenant: { type: "string" }
+					}
+				}] },
+				actor: {
+					type: "object",
+					required: ["id", "kind"],
+					properties: {
+						id: { type: "string" },
+						kind: { type: "string" }
+					}
+				},
+				session: { type: "string" },
+				delegation: {
+					type: "object",
+					properties: {
+						scope: { type: "string" },
+						authorization_details: {
+							type: "array",
+							items: {
+								type: "object",
+								required: ["type"],
+								properties: { type: { type: "string" } }
+							}
+						}
+					}
+				}
+			}
+		},
+		signature: {
+			type: "object",
+			required: ["by", "at"],
+			properties: {
+				by: { type: "string" },
+				at: { $ref: "#/$defs/instant" },
+				stage: {
+					type: "integer",
+					minimum: 0
+				},
+				vouched: { type: "string" },
+				onBehalfOf: { type: "string" },
+				delegation: { type: "string" }
+			}
+		}
+	}
+};
+//#endregion
+export { APPROVAL_REQUEST_SCHEMA as t };

package/dist/resend/index.d.ts

@@ -0,0 +1,126 @@
+import { q as DecisionSink } from "../policy-types-DzwivBgR.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-DX0LaKTb.js";
+import { l as ReplayStore } from "../types-DiQjupG2.js";
+//#region src/resend/approval-email.d.ts
+type ApprovalEmailOptions = {
+  /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */
+  readonly approvalUrl: ApprovalUrl;
+  /** The product name in the footer line. */
+  readonly product?: string;
+};
+/**
+ * The default approval prompt email: an `approval`-category message whose
+ * one link opens the app's approval page for the request. It carries no
+ * approve or reject link; the signed-in approver decides on that page.
+ * Throws a `TypeError` for an approval page that is not https. Replace it
+ * with a React Email template by building the same `EmailMessage`.
+ */
+export declare function approvalEmail(prompt: ApprovalPrompt, options: ApprovalEmailOptions): EmailMessage;
+//#endregion
+//#region src/resend/transport.d.ts
+/** One email as `resend.emails.send` and `resend.batch.send` take it. */
+type ResendEmailPayload = {
+  readonly from: string;
+  readonly to: string[];
+  readonly subject: string;
+  readonly text: string;
+  readonly html?: string;
+  readonly replyTo?: string;
+  readonly headers?: Record<string, string>;
+  readonly tags?: {
+    readonly name: string;
+    readonly value: string;
+  }[];
+};
+type ResendError = {
+  readonly name: string;
+  readonly message: string;
+  readonly statusCode: number | null;
+};
+type ResendResult<T> = {
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly data: null;
+  readonly error: ResendError;
+};
+/** The part of a `Resend` client the transport calls; a `new Resend(key)` fits. */
+type ResendClient = {
+  readonly emails: {
+    send(payload: ResendEmailPayload, options?: {
+      readonly idempotencyKey?: string;
+    }): Promise<ResendResult<{
+      readonly id: string;
+    }>>;
+  };
+  readonly batch?: {
+    send(payloads: ResendEmailPayload[], options?: {
+      readonly idempotencyKey?: string;
+    }): Promise<ResendResult<{
+      readonly data: readonly {
+        readonly id: string;
+      }[];
+    }>>;
+  };
+};
+type ResendTransportOptions = {
+  /** The `from` of an email whose message and router set none. */
+  readonly from?: string;
+  /** The `replyTo` of an email whose message sets none. */
+  readonly replyTo?: string;
+  /** Tags added to every email; names and values are ASCII letters, digits, `_` and `-`. */
+  readonly tags?: Readonly<Record<string, string>>;
+};
+/**
+ * The failure a Resend error name means. Rate limits, quotas and server
+ * errors are retryable with the same idempotency key; a key, sender or
+ * validation error is final. An unknown name is retryable only for a 5xx or
+ * a missing status.
+ */
+export declare function resendFailure(error: ResendError): DeliveryResult;
+/**
+ * Sends the email channel of `permdock/delivery` through Resend. The
+ * idempotency key is Resend's `idempotencyKey`. The delivery id, key and
+ * category travel as tags, so `resendWebhook` can join provider events to
+ * the delivery. Two or more recipients go out through `batch.send`, up to
+ * 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+ */
+export declare function resendTransport(resend: ResendClient, options?: ResendTransportOptions): EmailTransport;
+//#endregion
+//#region src/resend/webhook.d.ts
+/** The part of a `Resend` client the webhook calls; a `new Resend(key)` fits. */
+type ResendWebhookClient = {
+  readonly webhooks: {
+    verify(input: {
+      readonly payload: string;
+      readonly headers: {
+        readonly id: string;
+        readonly timestamp: string;
+        readonly signature: string;
+      };
+      readonly webhookSecret: string;
+    }): unknown;
+  };
+};
+type ResendWebhookOptions = {
+  readonly resend: ResendWebhookClient;
+  /** The endpoint's signing secret, `whsec_…`. */
+  readonly secret: string;
+  readonly sink: DecisionSink;
+  /** Claims each message id, so a redelivered message writes no second event. */
+  readonly replay: ReplayStore;
+  /** The event `source`; defaults to `permdock`. */
+  readonly source?: string;
+};
+/**
+ * A fetch handler for Resend webhooks. It verifies the Standard Webhooks
+ * signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
+ * header names both work), claims the message id, and writes one delivery
+ * event for `email.delivered`, `email.bounced`, `email.complained`,
+ * `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
+ * failure releases the claim and answers `503`, so Resend retries.
+ */
+export declare function resendWebhook(options: ResendWebhookOptions): (request: Request) => Promise<Response>;
+//#endregion
+export type { ApprovalEmailOptions, ResendClient, ResendEmailPayload, ResendError, ResendResult, ResendTransportOptions, ResendWebhookClient, ResendWebhookOptions };