permdock 0.4.0 → 0.5.0

package/dist/{package-root-DtNnpmUd.js → package-root-Dk_ETdkp.js}

@@ -2,7 +2,7 @@ import { i as readJsonFile } from "./files-D_JIzUrP.js";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-//#region src/cli/package-root.ts
+//#region src/cli/project/package-root.ts
 let cached;
 /**
 * The `permdock` package directory. The bundler may place this module in

package/dist/{parse-CVFQHk6c.js → parse-Cxq0WxrA.js}

@@ -1,7 +1,7 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { t as catalogSchema } from "./schema-DjQBcAP9.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-DBkdUuCO.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as catalogSchema } from "./schema-B4v0Qrac.js";
 //#region src/catalog/parse.ts
 function invalid(issues) {
 	const [first] = issues;

package/dist/{parse-local-manifest-C-q02Pal.js → parse-local-manifest-CVSs6J9I.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 //#region src/core/local-role.ts
 /** The role name custom-role tables in a local snapshot manifest hold their grants under; no declared or tenant role can take it. */
 const LOCAL_CUSTOM_ROLE = "\0custom";

package/dist/{parse-local-manifest-DvYUR0QL.d.ts → parse-local-manifest-DgqtruPn.d.ts}

@@ -1,4 +1,4 @@
-import { in as LocalSnapshotManifest } from "./policy-types-sp9P1iIV.js";
+import { Bt as LocalSnapshotManifest } from "./policy-types-DzwivBgR.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with

package/dist/parse-request-D_tUXG6M.js

@@ -0,0 +1,26 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
+//#region src/approvals/parse-request.ts
+/**
+* Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store
+* or the Cloud returns it, validated against
+* `schemas/approval-request-v1.json`. Returns a deep-frozen copy, or `null`
+* for anything that does not match, including a `__proto__`, `constructor`
+* or `prototype` key.
+*/
+function parseApprovalRequest(value) {
+	let input = value;
+	if (typeof value === "string") try {
+		input = JSON.parse(value);
+	} catch {
+		return null;
+	}
+	const issues = [];
+	const copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	if (issues.length > 0 || forbiddenKeyPath(copy) !== void 0) return null;
+	checkSchema(APPROVAL_REQUEST_SCHEMA, copy, [], issues);
+	return issues.length === 0 ? freezeDeep(copy) : null;
+}
+//#endregion
+export { parseApprovalRequest as t };

package/dist/paths-DXSHAMIa.js

@@ -0,0 +1,42 @@
+//#region src/core/paths.ts
+const FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isForbiddenKey(key) {
+	return FORBIDDEN_KEYS.has(key);
+}
+function assertSafeKey(key, context) {
+	if (key.length === 0 || key.split(".").some(isForbiddenKey)) throw new Error(`PermDock: forbidden ${context} key '${key}'`);
+}
+function ownGet(object, key) {
+	if (isForbiddenKey(key)) return;
+	if (!Object.hasOwn(object, key)) return;
+	return object[key];
+}
+/** A copy holding only own enumerable properties, so a prototype never supplies a field. */
+function ownRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const record = {};
+	for (const [key, item] of Object.entries(value)) if (!isForbiddenKey(key)) record[key] = item;
+	return record;
+}
+function ownKeys(object) {
+	return Object.keys(object).filter((key) => !isForbiddenKey(key));
+}
+function splitPath(path) {
+	return path.split(".").filter((segment) => segment.length > 0);
+}
+function readPath(root, path) {
+	const segments = splitPath(path);
+	let current = root;
+	for (const segment of segments) {
+		if (isForbiddenKey(segment)) return;
+		if (current === null || current === void 0 || typeof current !== "object") return;
+		current = ownGet(current, segment);
+	}
+	return current;
+}
+//#endregion
+export { ownRecord as a, ownKeys as i, isForbiddenKey as n, readPath as o, ownGet as r, splitPath as s, assertSafeKey as t };

package/dist/pdp/index.d.ts

@@ -1,7 +1,11 @@
-import { E as Policy, Mt as PermDockOptions, Or as Principal, U as DecisionProvider, j as PolicyVocabulary } from "../policy-types-sp9P1iIV.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-CIlTojhq.js";
+import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { i as PermDockOptions } from "../permdock-D7eeLJER.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-ClZaWzfb.js";
 //#region src/pdp/create.d.ts
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
+/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+export declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): PdpPermDock<V>;
+/** The PDP-aware instance once every source has answered. */
+export declare function getPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
 //#endregion
 //#region src/pdp/relations.d.ts
 /**

package/dist/pdp/index.js

@@ -1,12 +1,12 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as isThenable } from "../thenable-QSmvt-vZ.js";
 import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
-import { h as isArazzoSimulateInput } from "../snapshot-Dc9CHPME.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-BsblpB-z.js";
-import { t as createPermDock$1 } from "../permdock-L26udHSk.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-JhMeOsDF.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { n as internalsOf, t as attachInternals } from "../internals-Dk8A8fX3.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-B9JxkBwC.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DvvFzYXe.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;
@@ -56,6 +56,7 @@ function isLocalShortCircuit(decision) {
 			case "validation":
 			case "not-delegated":
 			case "no-delegation":
+			case "agent-tool-not-delegated":
 			case "condition":
 			case "deny":
 			case "closure-error":
@@ -115,7 +116,7 @@ function wrap(permdock, policy, subject, providers) {
 	const explain = async (permission, data, options) => {
 		const decision = await decide(permission, data, {
 			...options,
-			source: options?.source ?? "explain",
+			call: options?.call ?? "explain",
 			explain: true
 		});
 		if (decision.trace !== void 0) return decision;
@@ -150,7 +151,7 @@ function wrap(permdock, policy, subject, providers) {
 	const assert = async (permission, data, options) => {
 		const decision = await decide(permission, data, {
 			...options,
-			source: options?.source ?? "assert"
+			call: options?.call ?? "assert"
 		});
 		if (decision.outcome === "granted") return decision;
 		const onDenied = options?.onDenied ?? policy.onDenied;
@@ -183,21 +184,24 @@ function wrap(permdock, policy, subject, providers) {
 	};
 	const simulate = ((input, options) => {
 		if (isReadonlyArray(input)) return Promise.all(input.map(([permission, data]) => decide(permission, data, compact({
-			source: "simulate",
+			call: "simulate",
 			now: options?.now
 		}))));
-		if (isArazzoSimulateInput(input)) return permdock.simulate(input);
 		return wrap(permdock.simulate(input), policy, subject, providers);
 	});
-	return {
+	const wrapped = {
 		can,
 		decide,
+		async decideEach(permission, rows, options) {
+			return Object.freeze(await Promise.all(rows.map((row) => decide(permission, row, options))));
+		},
+		decideFor: permdock.decideFor.bind(permdock),
 		assert,
 		explain,
 		async filter(permission, rows, options) {
 			const next = {
 				...options,
-				source: "filter"
+				call: "filter"
 			};
 			const provider = providerFor(providers, permission);
 			const ids = await permittedIds(provider, permission);
@@ -260,9 +264,9 @@ function wrap(permdock, policy, subject, providers) {
 			const next = permdock.team(id);
 			return wrap(next, policy, next.subject, providers);
 		},
-		derive: (options) => {
-			const next = permdock.derive(options);
-			return isThenable(next) ? next.then((derived) => wrap(derived, policy, derived.subject, providers)) : wrap(next, policy, next.subject, providers);
+		derive: async (options) => {
+			const derived = await permdock.derive(options);
+			return wrap(derived, policy, derived.subject, providers);
 		},
 		memberships: permdock.memberships.bind(permdock),
 		tenants: permdock.tenants.bind(permdock),
@@ -271,19 +275,28 @@ function wrap(permdock, policy, subject, providers) {
 		assignableRoles: permdock.assignableRoles.bind(permdock),
 		assignablePermissions: permdock.assignablePermissions.bind(permdock),
 		assignableLevels: permdock.assignableLevels.bind(permdock),
-		decideRoleChange: permdock.decideRoleChange.bind(permdock),
-		loadRelations: permdock.loadRelations.bind(permdock),
-		whoCan: permdock.whoCan.bind(permdock),
-		activate: permdock.activate.bind(permdock),
+		mayUse: permdock.mayUse.bind(permdock),
+		permittedIds: permdock.permittedIds.bind(permdock),
+		prefetchRelations: permdock.prefetchRelations.bind(permdock),
 		permissions: permdock.permissions,
 		roles: permdock.roles,
 		plans: permdock.plans,
 		subject
 	};
+	const internals = internalsOf(permdock);
+	if (internals !== void 0) attachInternals(wrapped, internals);
+	return wrapped;
+}
+/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+function getPermDockSync(policy, user, options = {}) {
+	const localPolicy = withoutProviders(policy);
+	const permdock = getPermDockSync$1(localPolicy, user, options);
+	return wrap(permdock, localPolicy, permdock.subject, policy.providers ?? []);
 }
-async function createPermDock(policy, user, options = {}) {
+/** The PDP-aware instance once every source has answered. */
+async function getPermDock(policy, user, options = {}) {
 	const localPolicy = withoutProviders(policy);
-	const permdock = await createPermDock$1(localPolicy, user, options);
+	const permdock = await getPermDock$1(localPolicy, user, options);
 	return wrap(permdock, localPolicy, permdock.subject, policy.providers ?? []);
 }
 //#endregion
@@ -500,8 +513,13 @@ function mapEvaluationBody(permission, data, subject, mapping) {
 		properties: compact({
 			orgId: subject.principal?.tenant,
 			roles: subject.principal?.roles,
-			actor: subject.actor,
-			delegation: subject.delegation
+			memberships: subject.principal?.memberships?.map((membership) => compact({
+				scope: membership.scope,
+				id: membership.id,
+				within: membership.within,
+				roles: membership.roles
+			})),
+			actor: subject.actor
 		})
 	});
 	const mappedResource = mapping?.resource?.(permission, data) ?? compact({
@@ -516,7 +534,7 @@ function mapEvaluationBody(permission, data, subject, mapping) {
 		context: compact({
 			tenant: subject.principal?.tenant,
 			actor: subject.actor,
-			delegation: subject.delegation
+			delegation: toWireDelegation(subject.delegation)
 		})
 	};
 }
@@ -525,7 +543,8 @@ function parseRemoteDecision(body, permission, subject, data) {
 	if (body["decision"]) return granted("pdp", permission, subject, data);
 	const context = isRecord(body["context"]) && isRecord(body["context"]["permdock"]) ? body["context"]["permdock"] : {};
 	if (context["outcome"] === "approval-required") {
-		const token = typeof context["token"] === "string" ? context["token"] : "";
+		const token = context["token"];
+		if (typeof token !== "string" || token === "") return denied("pdp-invalid-response");
 		return {
 			outcome: "approval-required",
 			grant: {
@@ -678,4 +697,4 @@ function remotePdp(options) {
 	};
 }
 //#endregion
-export { createPermDock, openfga, remotePdp, spicedb };
+export { getPermDock, getPermDockSync, openfga, remotePdp, spicedb };

package/dist/{peer-BOr_kJE1.js → peer-C8swJ2GH.js}

@@ -1,5 +1,6 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
 import { detect, getUserAgent, resolveCommand } from "package-manager-detector";
-//#region src/cli/peer.ts
+//#region src/cli/core/peer.ts
 /**
 * Loads an optional peer dependency for one command, or fails with the line
 * that installs it with the project's package manager. Only the commands that
@@ -10,10 +11,28 @@ async function requirePeer(load, name, command, cwd = process.cwd()) {
 		return await load();
 	} catch (error) {
 		if (!isMissingModule(error)) throw error;
-		const agent = getUserAgent() ?? (await detect({ cwd }))?.agent;
-		throw new Error(peerHint(name, command, agent), { cause: error });
+		const agent = await packageManagerOf(cwd);
+		throw new CliError("unavailable", peerHint(name, command, agent), {
+			cause: error,
+			code: "dependency_missing",
+			extensions: { package: name },
+			next: [{
+				command: addLine(agent, [name], { dev: true }),
+				when: "to install it"
+			}]
+		});
 	}
 }
+/** The package manager whose lockfile the project has, else the one running the CLI. */
+async function packageManagerOf(cwd) {
+	return (await detect({ cwd }))?.agent ?? getUserAgent() ?? void 0;
+}
+/** The command that adds `packages` with `agent`, npm when there is none. */
+function addLine(agent, packages, options) {
+	const args = options?.dev === true ? ["-D", ...packages] : [...packages];
+	const command = resolveCommand(agent ?? "npm", "add", args);
+	return command === null ? `npm install ${args.join(" ")}` : [command.command, ...command.args].join(" ");
+}
 function isMissingModule(error) {
 	if (typeof error !== "object" || error === null || !("code" in error)) return false;
 	return error.code === "ERR_MODULE_NOT_FOUND" || error.code === "MODULE_NOT_FOUND";
@@ -28,4 +47,4 @@ function peerHint(name, command, agent = getUserAgent() ?? void 0) {
 	return `PermDock CLI: ${command} needs the optional peer ${name}. Install it with: ${install === null || install === void 0 ? `pnpm add -D ${name} (or npm install -D ${name})` : [install.command, ...install.args].join(" ")}`;
 }
 //#endregion
-export { requirePeer as n, peerHint as t };
+export { requirePeer as i, packageManagerOf as n, peerHint as r, addLine as t };

package/dist/peer-CRvC7Hg1.js

@@ -0,0 +1 @@
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-C8swJ2GH.js";