permdock 0.3.1 → 0.5.0

package/dist/{create-B1d519XK.d.ts → server-types-BLd4MnBX.d.ts}

@@ -1,10 +1,14 @@
-import { C as Policy, Cr as Actor, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Tt as Snapshot, Yn as Decision, jr as JsonWebKeyLike, ln as PermDock, pn as SnapshotOptions } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "./types-aqOHTHcp.js";
-import { t as ApprovalHint } from "./errors-DPdqI50v.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
-import { r as PdpFactory } from "./types-DxiCGmmd.js";
-import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+import { Nn as Decision, Rt as Instant, Vt as Snapshot, ir as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as PermDock, s as SnapshotOptions } from "./permdock-D7eeLJER.js";
+import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-C2PXIv4c.js";
+import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
+import { r as PdpFactory } from "./types-ClZaWzfb.js";
+import { i as evaluationsHandler } from "./evaluations-16UqqQ6W.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
@@ -12,7 +16,7 @@ type ConnectionOptions<T = unknown> = {
   readonly permission?: Permission;
   /** The row for `permission`, or a loader re-run on every revalidation. */
   readonly data?: ConnectionData<T>;
-  /** Milliseconds between periodic revalidations; off by default. */
+  /** Seconds between periodic revalidations; off by default. */
   readonly revalidate?: number;
 };
 type Connection = {
@@ -28,6 +32,11 @@ type Connection = {
     readonly trusted?: boolean;
   }) => Decision;
   readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
+  /**
+   * Resolves once every revalidation queued so far has finished, so a message
+   * checked after a revocation event is checked against the rebuilt instance.
+   */
+  readonly settled: () => Promise<void>;
   /** Stops timers and the feed subscription. Call it when the transport closes. */
   readonly close: () => void;
 };
@@ -62,14 +71,18 @@ type WebBotAuthOptions = {
   readonly keys: WebBotAuthKeys | WebBotAuthKeyLookup;
   readonly required?: boolean;
   readonly maxAge?: number;
-  /** Unix seconds; defaults to the system clock. */
-  readonly now?: () => number;
+  /** The clock; defaults to the system clock. */
+  readonly now?: () => Instant;
 };
 /**
- * An adapter's `webBotAuth` option: `(request) => verifyWebBotAuth(request, options)`,
+ * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`,
  * so an app without it does not bundle RFC 9421 verification.
  */
-type WebBotAuthVerifier = (request: Request) => Promise<Actor | undefined>;
+type WebBotAuthVerifier = {
+  readonly name?: string;
+  /** The verified signer as an actor, `undefined` for an unsigned request; throws `InvalidSignatureError` for a bad signature. */
+  verify(request: Request): Promise<Actor | undefined>;
+};
 type DiscoverViaSignatureAgentOptions = {
   readonly allow: readonly string[];
   readonly fetch?: typeof fetch;
@@ -82,37 +95,26 @@ declare class InvalidSignatureError extends Error {
 declare function invalidSignatureResponse(error: unknown): Response | undefined;
 declare function invalidSignatureProblem(detail: string): Response;
 declare function discoverViaSignatureAgent(options: DiscoverViaSignatureAgentOptions): WebBotAuthKeys;
-declare function verifyWebBotAuth(request: Request, options: WebBotAuthOptions | undefined): Promise<Actor | undefined>;
-//#endregion
-//#region src/server/evaluations.d.ts
-declare function createEvaluationsHandler(options: {
-  readonly policy: Policy;
-  readonly resolve?: (request: Request) => Promise<PermDock>;
-  readonly getPermDock?: (query?: {
-    readonly tenant?: string;
-  }) => Promise<PermDock>;
-  readonly store?: ApprovalStore;
-  readonly adapter?: string;
-  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
-  readonly maxEvaluations?: number;
-}): {
-  readonly POST: (request: Request) => Promise<Response>;
-  readonly GET: (request: Request) => Promise<Response>;
-};
+/**
+ * Verifies Web Bot Auth requests: an RFC 9421 signature tagged `web-bot-auth`
+ * that covers `@authority`, and `signature-agent` when the request sends
+ * `Signature-Agent` (draft-meunier-webbotauth-httpsig-protocol).
+ */
+declare function webBotAuthVerifier(options?: WebBotAuthOptions): WebBotAuthVerifier;
 //#endregion
-//#region src/server/create.d.ts
+//#region src/server/server-types.d.ts
 type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
   readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly actor?: (request: Request) => unknown;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
   readonly webBotAuth?: WebBotAuthVerifier;
   readonly tenant?: string | ((request: Request) => string | undefined | Promise<string | undefined>);
   readonly store?: ApprovalStore;
   /** Ends or revalidates open connections; never a decision input. */
   readonly revocations?: RevocationFeed;
   /**
-   * `createPermDock` from `permdock/pdp`: `protect` then decides delegated
+   * `getPermDock` from `permdock/pdp`: `protect` then decides delegated
    * permissions through the remote PDP. The instance handlers receive stays
    * synchronous and keeps denying delegated permissions (`pdp-unavailable`).
    */
@@ -120,7 +122,33 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   /** Added as `approval` to every `approval-required` problem. */
   readonly approval?: ApprovalHint;
   readonly operations?: OperationScopes;
+  /**
+   * Replaces the response of a refused guard. A status below 300, or a
+   * throw, keeps the default response and reports through `on('error')`.
+   */
+  readonly deniedResponse?: DeniedResponse;
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input. A throw
+   * or a value that is not a JSON object adds nothing and reports through
+   * `on('error')`.
+   */
+  readonly context?: (request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
+  /** Wraps each instance the factory builds; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
+  readonly adapter?: string;
 };
+/** What `deniedResponse` receives: the refusal and the default Problem Details for it. */
+type DeniedResponseEvent = {
+  readonly decision: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
+  readonly problem: ProblemDetails;
+  readonly request: Request | undefined;
+};
+/** Returns Problem Details with extra members, a `Response`, or nothing for the default. */
+type DeniedResponse = (event: DeniedResponseEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
 type OperationScopes = {
   oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
 };
@@ -134,6 +162,10 @@ type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
+  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
 };
 /**
  * What `protect(null, …)` resolves to: the route declares OAuth scopes and no
@@ -147,17 +179,21 @@ type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
+  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
 };
 type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
 /**
- * `protect(permission, loadData?, options?)`, or `protect(null, loadData?,
+ * `protect(permission, data?, options?)`, or `protect(null, data?,
  * { oauthScopes })` for a route that needs a signed-in principal and, from a
  * delegated token, one of the OAuth scopes it declares, but no permission.
  */
 type Protect<V extends PolicyVocabulary = PolicyVocabulary, TArgs extends unknown[] = []> = {
-  <T = unknown>(permission: Permission, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V>>;
-  <T = unknown>(permission: null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<ScopeGuard<T, V>>;
-  <T = unknown>(permission: Permission | null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  <T = unknown>(permission: Permission, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V>>;
+  <T = unknown>(permission: null, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<ScopeGuard<T, V>>;
+  <T = unknown>(permission: Permission | null, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
 };
 type OpenApiHooks = {
   readonly security: (permission: Permission) => {
@@ -168,7 +204,7 @@ type OpenApiHooks = {
 };
 type ProtectOptions = {
   /**
-   * `true` when `loadData` returns a row the server loaded itself, to skip
+   * `true` when `data` returns a row the server loaded itself, to skip
    * schema validation. Anything else is validated against the resource
    * schema before the check.
    */
@@ -179,26 +215,24 @@ type ProtectOptions = {
    * for the request. Required, here or there, for `protect(null)`.
    */
   readonly oauthScopes?: readonly string[];
+  /** The field being read or written; only grants whose `fields` cover it match. */
+  readonly field?: string;
+  /** Adds the evaluation `trace` to the guard's decision. */
+  readonly explain?: boolean;
 };
-type ServerKernelOptions<TUser, V extends PolicyVocabulary = PolicyVocabulary> = ServerPermDockOptions<TUser> & {
-  /** Wraps each instance the kernel builds, as `withOtel` does. */
-  readonly wrap?: (permdock: PermDock<V>) => PermDock<V>;
-  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
-  readonly adapter?: string;
-};
-/**
- * What an HTTP adapter builds on: `ServerPermDock` plus an explicit
- * `TenantScope` on every call, so the adapter resolves the tenant from its
- * own framework context.
- */
 type SnapshotQuery = {
   /** The active tenant; defaults to the `tenant` option resolved from the request. */
   readonly tenant?: string;
   readonly include?: SnapshotOptions["include"];
   readonly tenants?: "all";
 };
-type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
+/**
+ * What `createPermDock` from `permdock/server` returns. Every member takes an
+ * optional `TenantScope`, so an adapter resolves the tenant from its own
+ * framework context.
+ */
+type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly getPermDock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
   /**
    * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit, Nuxt), built from the
    * request's cached subject. Send it with `snapshotHeaders(snapshot)`.
@@ -208,8 +242,10 @@ type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
   /**
    * `protect` against an instance the adapter already holds, such as a gateway
    * connection's: the same OAuth scope check, loader, decision and approval resume.
+   * A method, so a `ServerPermDock<V>` stays assignable to `ServerPermDock`.
    */
-  readonly protectOn: <T = unknown>(instance: PermDock<V>, permission: Permission | null, load?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  protectOn<T = unknown>(instance: PermDock<V>, permission: Permission | null, data?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request): Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  /** A long-lived connection for a stream or socket opened by `request`. */
   readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>, scope?: TenantScope) => Promise<Connection>;
   /**
    * Lets `to`, a second `Request` an adapter built for the same incoming
@@ -217,29 +253,12 @@ type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
    * actor already resolved for `from`.
    */
   readonly shareSubject: (from: Request, to: Request) => void;
-  readonly problem: ServerPermDock<V>["problem"];
-  readonly openapi: OpenApiHooks;
-  readonly permdockHandler: (scope?: (request: Request) => TenantScope | Promise<TenantScope>) => ReturnType<typeof createEvaluationsHandler>;
-};
-type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (request: Request) => Promise<PermDock<V>>;
-  readonly getSnapshot: ServerKernel<V>["getSnapshot"];
-  readonly protect: Protect<V>;
-  /** A long-lived connection for a stream or socket opened by `request`. */
-  readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>) => Promise<Connection>;
   readonly problem: (decision: Decision, init?: {
     readonly permission?: Permission;
     readonly instance?: string;
   }) => Response;
   readonly openapi: OpenApiHooks;
-  readonly permdockHandler: () => ReturnType<typeof createEvaluationsHandler>;
+  readonly permdockHandler: (scope?: (request: Request) => TenantScope | Promise<TenantScope>) => ReturnType<typeof evaluationsHandler>;
 };
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerPermDockOptions<TUser>): ServerPermDock<V>;
-/**
- * The kernel behind every HTTP adapter. The subject and actor are resolved
- * once per `Request`; one instance is cached per `(Request, tenant)`, so a
- * global middleware and a later tenant-scoped `protect` never share a tenant.
- */
-declare function createServerKernel<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerKernelOptions<TUser, V>): ServerKernel<V>;
 //#endregion
-export { ConnectionOptions as A, invalidSignatureResponse as C, tenantScope as D, TenantScope as E, Connection as O, invalidSignatureProblem as S, TenantOption as T, WebBotAuthKeyLookup as _, ScopeGuard as a, WebBotAuthVerifier as b, ServerPermDock as c, createPermDock as d, createServerKernel as f, WebBotAuthJwk as g, InvalidSignatureError as h, ProtectOptions as i, ConnectionData as k, ServerPermDockOptions as l, DiscoverViaSignatureAgentOptions as m, OpenApiHooks as n, ServerKernel as o, createEvaluationsHandler as p, OperationScopes as r, ServerKernelOptions as s, Guard as t, SnapshotQuery as u, WebBotAuthKeys as v, verifyWebBotAuth as w, discoverViaSignatureAgent as x, WebBotAuthOptions as y };
+export { TenantScope as C, ConnectionOptions as D, ConnectionData as E, TenantOption as S, Connection as T, WebBotAuthVerifier as _, OperationScopes as a, invalidSignatureResponse as b, ServerPermDock as c, DiscoverViaSignatureAgentOptions as d, InvalidSignatureError as f, WebBotAuthOptions as g, WebBotAuthKeys as h, OpenApiHooks as i, ServerPermDockOptions as l, WebBotAuthKeyLookup as m, DeniedResponseEvent as n, ProtectOptions as o, WebBotAuthJwk as p, Guard as r, ScopeGuard as s, DeniedResponse as t, SnapshotQuery as u, discoverViaSignatureAgent as v, tenantScope as w, webBotAuthVerifier as x, invalidSignatureProblem as y };

package/dist/{sha256-BO0swRXL.js → sha256-D9ihqmvd.js}

@@ -141,10 +141,17 @@ function sha256(message) {
 	outView.setInt32(28, h7, false);
 	return out;
 }
+/**
+* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
+* of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+*/
+function sha256Digest(text) {
+	return `sha-256:${bytesToBase64Url(sha256(text))}`;
+}
 function bytesToBase64Url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCodePoint(byte);
 	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
 //#endregion
-export { sha256 as n, bytesToBase64Url as t };
+export { sha256 as n, sha256Digest as r, bytesToBase64Url as t };

package/dist/shared-CD11nBbC.js

@@ -0,0 +1,304 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { i as configError } from "./errors-CWTY6uih.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
+import "./sources-vs5dGOsS.js";
+//#region src/cli/sql/quote.ts
+function quoteIdent(name) {
+	return quoteSqlIdent(name, CLI);
+}
+function quoteTable(name) {
+	return quoteSqlTable(name, CLI);
+}
+/** A table name with `public.` added when it names no schema, quoted. */
+function quoteQualified(name) {
+	return quoteQualifiedTable(name, CLI);
+}
+function helperSchema(ctx) {
+	return ctx.schema ?? "permdock";
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(helperSchema(ctx))}.${name}`;
+}
+function quoteLiteral(value) {
+	return quoteSqlLiteral(value);
+}
+const CLI = "PermDock CLI";
+function declaredArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+/**
+* A text array as a Postgres literal (`'{admin,owner}'`). An element that
+* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
+* reads as `NULL`, is double-quoted and escaped, so one element can never
+* split into several.
+*/
+function textArrayLiteral(values) {
+	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
+}
+//#endregion
+//#region src/cli/sql/columns.ts
+/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
+function columnTypeOf(property) {
+	if (!isRecord(property)) return;
+	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
+	if (variants !== void 0) {
+		const present = variants.filter((item) => !(isRecord(item) && item["type"] === "null"));
+		return present.length === 1 ? columnTypeOf(present[0]) : void 0;
+	}
+	const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+	if (types.length !== 1) return;
+	switch (types[0]) {
+		case "integer":
+		case "number": return "numeric";
+		case "boolean": return "boolean";
+		case "string": switch (property["format"]) {
+			case "date-time": return "timestamptz";
+			case "date": return "date";
+			case "uuid": return "uuid";
+			default: return;
+		}
+		default: return;
+	}
+}
+/**
+* Column types from a resource's JSON Schema (`~standard.jsonSchema`): numbers
+* compare as `numeric`, booleans as `boolean`, and `date-time`, `date` and
+* `uuid` strings as `timestamptz`, `date` and `uuid`. Other columns are left
+* out and compare as text.
+*/
+function columnTypesOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const types = {};
+	for (const [name, property] of Object.entries(properties)) {
+		const type = isForbiddenKey(name) ? void 0 : columnTypeOf(property);
+		if (type !== void 0) types[name] = type;
+	}
+	return types;
+}
+/**
+* Array columns from a resource's JSON Schema, each with the type its items
+* compare as (`text` when `columnTypesOf` would leave the item out).
+*/
+function arrayColumnsOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const arrays = {};
+	for (const [name, property] of Object.entries(properties)) {
+		if (isForbiddenKey(name) || !isRecord(property)) continue;
+		const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+		if (types.length === 1 && types[0] === "array") arrays[name] = columnTypeOf(property["items"]) ?? "text";
+	}
+	return arrays;
+}
+const SQL_TYPE = /^[A-Za-z_][A-Za-z0-9_]*( [A-Za-z_][A-Za-z0-9_]*)*(\[\])?$/u;
+function sqlType(name) {
+	if (!SQL_TYPE.test(name)) throw configError(`PermDock CLI: unsafe SQL type '${name}'`);
+	return name;
+}
+function tenantTypeOf(ctx) {
+	return sqlType(ctx.tenantType ?? "uuid");
+}
+function teamTypeOf(ctx) {
+	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
+}
+/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
+function scopeTypeOf(ctx, name) {
+	const declared = ctx.scopeTypes?.[name];
+	if (declared !== void 0) return sqlType(declared);
+	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
+}
+//#endregion
+//#region src/cli/sql/context.ts
+const CLAIM = SQL_IDENT;
+function parseMembershipsFlag(raw) {
+	if (raw === void 0 || raw === "") return;
+	const colon = raw.indexOf(":");
+	const table = colon === -1 ? raw : raw.slice(0, colon);
+	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
+	return { tenant: {
+		table,
+		tenant: cols[0] ?? "tenant_id",
+		user: cols[1] ?? "user_id",
+		role: cols[2] ?? "role",
+		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
+	} };
+}
+//#endregion
+//#region src/cli/sql/subject.ts
+/**
+* A role with `for` counts only on a membership of one of those kinds:
+* `case role when 'admin' then via = any(...) ... else true end`. A missing
+* kind (`viaExpr` null) holds none of them. A constant kind folds into the
+* roles it excludes, or no filter. `undefined` when nothing is filtered.
+*/
+function kindFilterSql(ctx, roleExpr, viaExpr) {
+	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	if (kinds.length === 0) return;
+	if (typeof viaExpr !== "string") {
+		const excluded = kinds.filter(([, allowed]) => !viaAllowed(viaExpr.value, allowed)).map(([role]) => role);
+		return excluded.length === 0 ? void 0 : `not (${roleExpr} = any(array[${excluded.map(quoteLiteral).join(", ")}]::text[]))`;
+	}
+	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
+}
+/** The kind check for one known role; `undefined` when it has no `for` or a constant kind it allows. */
+function roleKindSql(ctx, role, viaExpr) {
+	const allowed = ctx.ownership?.kinds[role];
+	if (allowed === void 0) return;
+	if (typeof viaExpr !== "string") return viaAllowed(viaExpr.value, allowed) ? void 0 : "false";
+	return `coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`;
+}
+/** Roles with `for` held globally (no membership, so no kind) grant nothing. */
+function globalKindFilterSql(ctx, roleExpr) {
+	const roles = Object.keys(ctx.ownership?.kinds ?? {}).toSorted();
+	return roles.length === 0 ? void 0 : `not (${roleExpr} = any(array[${roles.map(quoteLiteral).join(", ")}]::text[]))`;
+}
+function keyTenantSql(ctx, tenant) {
+	const keys = ctx.apiKeys;
+	if (keys === void 0) return;
+	const named = `nullif(${subjectClaimJsonSql(ctx, keys.claim)} ->> ${quoteLiteral(keys.tenant)}, '')`;
+	return tenant === void 0 ? `${named} is null` : `(${named} is null or (${tenant})::text = ${named})`;
+}
+/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
+function tenantClaimSql(ctx) {
+	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
+}
+const USER_ID_HELPER = "permdock_user_id";
+function userIdHelperSql(ctx) {
+	return qualified(ctx, USER_ID_HELPER);
+}
+const SESSION_LIVE_HELPER = "permdock_session_live";
+/** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
+function liveSessionSql(ctx) {
+	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
+	return `(select ${qualified(ctx, SESSION_LIVE_HELPER)}())`;
+}
+/**
+* `permdock_session_live()`: the token's `session_id` names a session of its
+* user that is still in `auth.sessions`, so a signed-out or revoked session
+* stops passing before the token's `exp`. A token without one, such as a
+* service key's, is never live.
+*/
+function sessionLiveHelperSql(ctx) {
+	const name = qualified(ctx, SESSION_LIVE_HELPER);
+	return `create or replace function ${name}()
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_session uuid;
+begin
+  begin
+    v_session := nullif((select auth.jwt()) ->> 'session_id', '')::uuid;
+  exception when invalid_text_representation then
+    return false;
+  end;
+  if v_session is null then
+    return false;
+  end if;
+  return exists (
+    select 1
+    from auth.sessions s
+    where s.id = v_session
+      and s.user_id::text = ${subjectIdSql(ctx)}::text
+      and (s.not_after is null or s.not_after > now())
+  );
+end;
+$$;
+revoke execute on function ${name}() from public, anon;
+grant execute on function ${name}() to authenticated;
+`;
+}
+function subjectIdSql(ctx) {
+	if (ctx.subjectId !== void 0) return ctx.subjectId;
+	switch (ctx.dialect) {
+		case "supabase": return `(select ${userIdHelperSql(ctx)}())`;
+		case "neon": return "(select auth.user_id())";
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.user_id`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+function subjectClaimSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw configError(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) ->> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) ->> ${quoteLiteral(claim)})`;
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+/** A claim as `jsonb`; the `guc` dialect stores JSON text in `<prefix>.<claim>`. */
+function subjectClaimJsonSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw configError(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) -> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) -> ${quoteLiteral(claim)})`;
+		case "guc": return `nullif((select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true)), '')::jsonb`;
+		default: return ctx.dialect;
+	}
+}
+function viaAllowed(value, allowed) {
+	return allowed.includes(value ?? "");
+}
+/** The membership kind of a row `m` of `table`: its column as text, or its constant (`null` without one). */
+function memberVia(table) {
+	const via = table.via;
+	if (via === void 0) return { value: null };
+	return typeof via === "string" ? `m.${quoteIdent(via)}::text` : { value: via.value };
+}
+//#endregion
+//#region src/cli/sql/shared.ts
+/** `rls.customRoles` turns custom roles on as `true` or as an object. */
+function customRolesOn(rls) {
+	const custom = rls?.customRoles;
+	return custom === true || typeof custom === "object" && custom !== null;
+}
+/**
+* The per-statement helpers every generated policy calls: `permdock_has` for
+* global roles and one `permitted_<scope>_ids` per scope
+* (`permittedIdsHelper`). Names are part of the SQL contract.
+*/
+const HELPERS = {
+	has: "permdock_has",
+	hasFor: "permdock_has_for"
+};
+/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
+const CUSTOM_ROLES = {
+	permissions: "custom_role_permissions",
+	includes: "custom_role_includes",
+	ceiling: "permdock_ceiling",
+	keys: "permdock_custom_keys",
+	beyond: "permdock_custom_role_beyond",
+	guard: "permdock_custom_role_guard",
+	beyondFor: "permdock_custom_role_beyond_for",
+	guardFor: "permdock_custom_role_guard_for",
+	shape: "permdock_custom_role_shape",
+	entries: "permdock_custom_role_entries",
+	replace: "permdock_replace_custom_role_grants",
+	rename: "permdock_rename_custom_role_grants",
+	remove: "permdock_delete_custom_role_grants",
+	trustedReplace: "permdock_trusted_replace_custom_role_grants",
+	trustedRename: "permdock_trusted_rename_custom_role_grants",
+	trustedRemove: "permdock_trusted_delete_custom_role_grants",
+	cascade: "permdock_cascade_custom_role"
+};
+/** The function `rls.roles` adds. The name is part of the SQL contract. */
+const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
+/** `user` is the SQL for the user id: the dialect's (the default) or the `p_user` parameter of a `_for` helper. */
+function signedIn(ctx, user = subjectIdSql(ctx)) {
+	return `coalesce(${user}::text, '') <> ''`;
+}
+function rootName(ctx) {
+	return ctx.scopes[0]?.name ?? "tenant";
+}
+/** The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`, or `key@level` with levels. */
+function allowEntry(ctx) {
+	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
+}
+//#endregion
+export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, textArrayLiteral as L, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{shared-DRu8VFVM.js → shared-DvvFzYXe.js}

@@ -1,13 +1,12 @@
-import { t as decisionToken } from "./token-CIWxJOCh.js";
+import { a as durationOf, f as nowMillis } from "./time-DkWjdL98.js";
+import { t as decisionToken } from "./token-BLZcjQgt.js";
 //#region src/pdp/shared.ts
-const MAX_CACHE_TTL_MS = 3e4;
+const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
-/** Milliseconds, clamped to `[0, 30s]`; anything unparseable disables the cache. */
+/** Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole number of seconds above 0 disables the cache. */
 function ttlMs(cache) {
-	if (cache === void 0) return 0;
-	const raw = typeof cache.ttl === "number" ? cache.ttl : cache.ttl.endsWith("ms") ? Number(cache.ttl.slice(0, -2)) : Number(cache.ttl.slice(0, -1)) * 1e3;
-	if (!Number.isFinite(raw) || raw <= 0) return 0;
-	return Math.min(raw, MAX_CACHE_TTL_MS);
+	const ttl = durationOf(cache?.ttl);
+	return ttl === void 0 ? 0 : Math.min(ttl, MAX_CACHE_TTL) * 1e3;
 }
 function denied(reason) {
 	return {
@@ -68,13 +67,13 @@ function ttlCache(ttl) {
 		get(key) {
 			if (ttl <= 0) return;
 			const hit = entries.get(key);
-			if (hit !== void 0 && Date.now() - hit.at < ttl) return hit.value;
+			if (hit !== void 0 && nowMillis() - hit.at < ttl) return hit.value;
 			entries.delete(key);
 		},
 		set(key, value) {
 			if (ttl <= 0) return;
 			entries.set(key, {
-				at: Date.now(),
+				at: nowMillis(),
 				value
 			});
 			if (entries.size > CACHE_MAX) {