permdock 0.4.0 → 0.5.0

package/dist/supabase-Dbqr141s.js

@@ -1,83 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/supabase.ts
-function supabase(ctx) {
-	return defineCommand({
-		meta: {
-			name: "supabase",
-			description: COMMAND_DESCRIPTIONS.supabase
-		},
-		args: {
-			...globalArgs,
-			area: {
-				type: "positional",
-				required: false,
-				description: "hook or inspect"
-			},
-			verb: {
-				type: "positional",
-				required: false,
-				description: "hook: generate"
-			},
-			out: {
-				type: "string",
-				description: "File to write; a bare --out on inspect writes permdock.manifest.json",
-				valueHint: "file"
-			},
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the file on disk is stale; write nothing"
-			},
-			db: {
-				type: "string",
-				description: "Postgres connection string",
-				valueHint: "url"
-			},
-			"active-from": {
-				type: "string",
-				description: "Where the hook reads the active tenant",
-				valueHint: "source"
-			},
-			budget: {
-				type: "string",
-				description: "Byte budget for the memberships claim",
-				valueHint: "bytes"
-			},
-			schema: {
-				type: "string",
-				description: "Schema for the hook function",
-				valueHint: "name"
-			},
-			"grants-out": {
-				type: "string",
-				description: "File for the privileges db diff drops",
-				valueHint: "file"
-			}
-		},
-		async run({ args: parsed }) {
-			const out = parsed.out === "" ? true : stringArg(parsed.out);
-			const db = stringArg(parsed.db);
-			const activeFrom = stringArg(parsed["active-from"]);
-			const budget = stringArg(parsed.budget);
-			const schema = stringArg(parsed.schema);
-			const grantsOut = stringArg(parsed["grants-out"]);
-			const { runSupabase } = await import("./supabase-hook-BULg7Ut_.js");
-			ctx.report(await runSupabase({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				check: parsed.check === true,
-				json: ctx.json,
-				io: ctx.io,
-				...out === void 0 ? {} : { out },
-				...db === void 0 ? {} : { db },
-				...activeFrom === void 0 ? {} : { activeFrom },
-				...budget === void 0 ? {} : { budget },
-				...schema === void 0 ? {} : { schema },
-				...grantsOut === void 0 ? {} : { grantsOut }
-			}));
-		}
-	});
-}
-//#endregion
-export { supabase };

package/dist/supabase-hook-BULg7Ut_.js

@@ -1,2 +0,0 @@
-import { i as runSupabase } from "./supabase-hook-Cva3ikXz.js";
-export { runSupabase };

package/dist/thenable-QSmvt-vZ.js

@@ -1,65 +0,0 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-//#region src/core/paths.ts
-const FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isForbiddenKey(key) {
-	return FORBIDDEN_KEYS.has(key);
-}
-function assertSafeKey(key, context) {
-	if (key.length === 0 || key.split(".").some(isForbiddenKey)) throw new Error(`PermDock: forbidden ${context} key '${key}'`);
-}
-function ownGet(object, key) {
-	if (isForbiddenKey(key)) return;
-	if (!Object.hasOwn(object, key)) return;
-	return object[key];
-}
-function ownKeys(object) {
-	return Object.keys(object).filter((key) => !isForbiddenKey(key));
-}
-function splitPath(path) {
-	return path.split(".").filter((segment) => segment.length > 0);
-}
-function readPath(root, path) {
-	const segments = splitPath(path);
-	let current = root;
-	for (const segment of segments) {
-		if (isForbiddenKey(segment)) return;
-		if (current === null || current === void 0 || typeof current !== "object") return;
-		current = ownGet(current, segment);
-	}
-	return current;
-}
-//#endregion
-//#region src/core/thenable.ts
-function isThenable(value) {
-	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
-}
-/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
-function ignoreRejection(value) {
-	Promise.resolve(value).then(void 0, () => void 0);
-}
-/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
-function validateSync(schema, value) {
-	const result = schema["~standard"].validate(value);
-	if (isThenable(result)) {
-		ignoreRejection(result);
-		return { ok: false };
-	}
-	return result.issues === void 0 ? {
-		ok: true,
-		value: result.value
-	} : {
-		ok: false,
-		issues: result.issues
-	};
-}
-/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
-function validateRecord(schema, value) {
-	const validated = validateSync(schema, value);
-	return validated.ok && isRecord(validated.value) ? validated.value : void 0;
-}
-//#endregion
-export { assertSafeKey as a, ownKeys as c, validateSync as i, readPath as l, isThenable as n, isForbiddenKey as o, validateRecord as r, ownGet as s, ignoreRejection as t, splitPath as u };

package/dist/types-C0dee0Qf.d.ts

@@ -1,197 +0,0 @@
-import { K as JwtClaims, Or as Principal, Z as MembershipSource, ct as TokenFailureCause, kr as Subject, ut as TokenVerifier, vr as Actor, yn as AuthEvent } from "./policy-types-sp9P1iIV.js";
-import { f as ApprovalStore } from "./types-Br9IXUBG.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
-import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/ssf/types.d.ts
-type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change";
-type SetSubject = {
-  readonly format: string;
-  readonly [key: string]: unknown;
-};
-type SsfSubject = {
-  readonly id: string;
-  readonly session?: string;
-  readonly issuer?: string;
-};
-type SsfSubjectMapper = (setSubject: SetSubject, meta?: {
-  readonly session?: string;
-  readonly issuer?: string;
-}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
-type SsfEventInput = {
-  readonly subject: SsfSubject;
-  readonly event: Readonly<Record<string, unknown>>;
-  readonly event_timestamp?: number;
-  readonly jti: string;
-  readonly type: string;
-};
-type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
-type SsfOnEvent = { readonly [K in CaepEventName]?: SsfEventHandler; } & {
-  readonly "*"?: SsfEventHandler;
-};
-/**
- * Keys are opaque strings namespaced by issuer. A store that implements both
- * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
- * one with only `seen` and `remember` is checked and recorded non-atomically.
- */
-type ReplayStore = {
-  seen(key: string): boolean | Promise<boolean>;
-  remember(key: string, expiresAt?: number): void | Promise<void>;
-  /** Records `key` and returns `true` only if it was not already recorded. */
-  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
-  /** Forgets a claimed `key` so a failed delivery can be retried. */
-  release?(key: string): void | Promise<void>;
-};
-type SsfAuditEvent = {
-  readonly type: string;
-  readonly subject?: SsfSubject;
-  readonly transmitter?: string;
-  readonly jti?: string;
-  readonly replayed?: true;
-  readonly cancelled?: number;
-  readonly unknown?: "event" | "subject";
-  readonly err?: string;
-  readonly cause?: TokenFailureCause;
-};
-type SsfEventListener = (event: SsfAuditEvent) => void;
-type PollOptions = {
-  readonly endpoint: string;
-  readonly every?: number | string;
-  readonly token?: string;
-  readonly fetch?: typeof fetch;
-  readonly signal?: AbortSignal;
-};
-type PollHandle = {
-  readonly stop: () => void;
-};
-type PollResult = {
-  readonly acked: readonly string[];
-};
-type SsfPermDockOptions = {
-  readonly issuer?: string;
-  readonly audience: string | readonly string[];
-  readonly jwks?: JwtJwks | string;
-  readonly discovery?: DiscoveryInput;
-  readonly verifier?: TokenVerifier;
-  readonly subject: SsfSubjectMapper;
-  readonly onEvent?: SsfOnEvent;
-  readonly replay?: ReplayStore;
-  readonly approvals?: ApprovalStore;
-  /**
-   * Publishes `session-revoked` for a revoked session and `changed` for
-   * credential, assurance and claims changes, so open connections end or
-   * revalidate.
-   */
-  readonly revocations?: RevocationFeed;
-  readonly clockTolerance?: number;
-};
-type SsfReceiver = {
-  push(request: Request): Promise<Response>;
-  logout(request: Request): Promise<Response>;
-  poll(options: PollOptions): Promise<PollResult> | PollHandle;
-  on(event: "event", handler: SsfEventListener): () => void;
-};
-type SsfPermDock = {
-  readonly receiver: SsfReceiver;
-};
-//#endregion
-//#region src/jwt/types.d.ts
-type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
-type JwtProfile = "fapi2";
-type JsonWebKeySet = {
-  readonly keys: readonly Record<string, unknown>[];
-};
-type JwtJwks = URL | string | JsonWebKeySet | {
-  readonly secret: Uint8Array | string;
-};
-type DiscoveryInput = string | {
-  readonly issuer: string;
-  readonly metadata?: {
-    readonly issuer?: string;
-    readonly jwks_uri?: string;
-  };
-};
-type JwksCacheOptions = {
-  readonly minTtl?: number;
-  readonly maxTtl?: number;
-  readonly cooldown?: number;
-  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
-  readonly timeout?: number;
-};
-type JoseTokenVerifierOptions = {
-  readonly jwks?: JwtJwks;
-  readonly discovery?: DiscoveryInput;
-  readonly issuer?: string;
-  readonly algorithms?: readonly JwtAlgorithm[];
-  readonly typ?: string | readonly string[];
-  readonly audience?: string | readonly string[];
-  readonly clockTolerance?: number;
-  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
-  readonly decryptionAlgorithms?: readonly string[];
-  readonly profile?: JwtProfile;
-  readonly jwksCache?: JwksCacheOptions;
-  readonly fetch?: typeof fetch;
-};
-type JoseTokenSignerOptions = {
-  readonly key: Record<string, unknown> | Uint8Array;
-  readonly alg: JwtAlgorithm;
-  readonly kid: string;
-  readonly issuer?: string;
-};
-type JwtClaimPaths = {
-  readonly id?: string;
-  readonly roles?: string;
-  readonly groups?: string;
-  readonly entitlements?: string;
-  readonly plans?: string;
-  readonly tenant?: string;
-  readonly memberships?: string;
-  readonly kind?: string;
-  readonly assurance?: string | {
-    readonly acr?: string;
-    readonly amr?: string;
-    readonly authTime?: string;
-    /** OpenID Connect for Identity Assurance; default `verified_claims`. */
-    readonly verified?: string;
-  };
-  readonly session?: string;
-};
-type JwtDelegationPaths = {
-  readonly scopes?: string;
-  readonly authorizationDetails?: string;
-  readonly access?: string;
-};
-type JwtSubjectOptions = JoseTokenVerifierOptions & {
-  readonly accept?: "access-token" | "id-token";
-  readonly claims?: JwtClaimPaths;
-  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
-  readonly schema?: StandardSchemaV1;
-  readonly delegation?: JwtDelegationPaths;
-  readonly actor?: {
-    readonly from?: "act";
-    readonly kind?: string;
-    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
-    readonly clients?: ClientNames;
-  } | ((claims: JwtClaims) => Actor | undefined);
-  readonly sender?: "none" | "dpop" | "mtls";
-  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
-  readonly replay?: ReplayStore;
-  readonly memberships?: MembershipSource;
-  readonly verifier?: TokenVerifier;
-  readonly certificateThumbprint?: string;
-  readonly onAuth?: (event: AuthEvent) => void;
-  readonly requestId?: string;
-};
-type JwtPrincipal = Principal & {
-  readonly issuer?: string;
-  readonly claims?: Readonly<Record<string, unknown>>;
-};
-type DpopProofResult = {
-  readonly ok: true;
-} | {
-  readonly ok: false;
-  readonly cause: TokenFailureCause;
-};
-type MappedSubject = Subject<JwtPrincipal>;
-//#endregion
-export { SsfPermDock as C, SsfSubjectMapper as D, SsfSubject as E, SsfOnEvent as S, SsfReceiver as T, SetSubject as _, JsonWebKeySet as a, SsfEventInput as b, JwtJwks as c, MappedSubject as d, CaepEventName as f, ReplayStore as g, PollResult as h, JoseTokenVerifierOptions as i, JwtPrincipal as l, PollOptions as m, DpopProofResult as n, JwtAlgorithm as o, PollHandle as p, JoseTokenSignerOptions as r, JwtClaimPaths as s, DiscoveryInput as t, JwtSubjectOptions as u, SsfAuditEvent as v, SsfPermDockOptions as w, SsfEventListener as x, SsfEventHandler as y };

package/dist/types-DvupZE0w.d.ts

@@ -1,9 +0,0 @@
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-//#region src/agent/types.d.ts
-type ToolBinding = {
-  readonly permission: Permission;
-  readonly data?: (args: unknown) => unknown;
-};
-type ToolMap = Readonly<Record<string, ToolBinding>>;
-//#endregion
-export { ToolMap as t };

package/dist/usage-4G6t643F.js

@@ -1,42 +0,0 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/usage.ts
-function usage(ctx) {
-	return defineCommand({
-		meta: {
-			name: "usage",
-			description: COMMAND_DESCRIPTIONS.usage
-		},
-		args: {
-			...globalArgs,
-			strict: {
-				type: "boolean",
-				description: "Exit 1 on any finding"
-			},
-			ignore: {
-				type: "string",
-				description: "Permission keys or globs to skip, repeatable",
-				valueHint: "glob"
-			},
-			"dynamic-as-used": {
-				type: "boolean",
-				description: "Count computed permission references as uses"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./usage-iFLJ0-rr.js")).runUsage({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				ignore: listArg(rawArgs, "ignore"),
-				strict: parsed.strict === true,
-				json: ctx.json,
-				dynamicAsUsed: parsed["dynamic-as-used"] === true,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { usage };

package/dist/usage-iFLJ0-rr.js

@@ -1,2 +0,0 @@
-import { t as runUsage } from "./usage-CG9nOYZw.js";
-export { runUsage };

package/dist/vocabulary-hhEFLFoL.d.ts

@@ -1,65 +0,0 @@
-import { A as WithX, O as AppDataSchema, n as ActionMeta } from "./permission-types-Dg39z9Kv.js";
-//#region src/core/vocabulary.d.ts
-declare const ROLE_KIND: "role";
-declare const PLAN_KIND: "plan";
-/** `defineRoles` and `definePlans` options. */
-type VocabularyOptions<X = never> = {
-  /**
-   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
-   * definition time. On a role tree it also checks the `meta.x` of custom
-   * roles a `RoleSource` returns; an invalid one is dropped, not the role.
-   */
-  readonly x?: AppDataSchema<X>;
-};
-/**
- * A role's metadata. `audience` names the surface its holders use (`'staff'`,
- * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
- * audiences of the roles held in the active scope.
- */
-type RoleMeta = ActionMeta & {
-  readonly audience?: string;
-};
-type Role<K extends string = string> = {
-  readonly key: K;
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable: boolean;
-  readonly meta: RoleMeta;
-  readonly kind: typeof ROLE_KIND;
-};
-type Plan<K extends string = string> = {
-  readonly key: K;
-  readonly meta: ActionMeta;
-  readonly kind: typeof PLAN_KIND;
-};
-type RoleInit = {
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable?: boolean;
-  readonly meta?: RoleMeta;
-};
-type PlanInit = {
-  readonly meta?: ActionMeta;
-};
-type RoleTree = {
-  readonly [key: string]: Role;
-};
-type PlanTree = {
-  readonly [key: string]: Plan;
-};
-type Vocabulary = {
-  readonly permissions?: unknown;
-  readonly roles?: RoleTree;
-  readonly plans?: PlanTree;
-};
-type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
-type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
-declare function isRole(value: unknown): value is Role;
-declare function isPlan(value: unknown): value is Plan;
-declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
-declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
-declare function listRoles(tree: RoleTree | undefined): readonly Role[];
-declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
-declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
-//#endregion
-export { RoleTree as a, definePlans as c, isPlan as d, isRole as f, RoleMeta as i, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u };

package/dist/watch-C8TpsAl4.js

@@ -1,2 +0,0 @@
-import { n as createCollectScheduler } from "./watch-zeucB7eF.js";
-export { createCollectScheduler };