permdock 0.4.0 → 0.5.0

package/dist/authzen/index.js

@@ -1,12 +1,15 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { s as ownGet } from "../thenable-QSmvt-vZ.js";
-import { t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-BsblpB-z.js";
+import { r as ownGet } from "../paths-DXSHAMIa.js";
+import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { t as fromWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
 import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CnWraVhC.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-DIIV9DbC.js";
-import { c as itemResourceData, l as permissionLookup, t as applyApprovalResume } from "../evaluations-C9YJsv3H.js";
+import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CTviyH5L.js";
+import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { _ as wireResourceId, a as evaluationReasons, c as unknownSemanticProblem, g as permissionLookup, h as itemResourceData, i as evaluateBatch, l as withRequestId, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-DZ2CbV5k.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {
 	outcome: "denied",
@@ -38,9 +41,9 @@ function permissionOf(lookup, item) {
 function resourceData(item) {
 	return itemResourceData(item.resource);
 }
+/** The row id an item names; `undefined` for none and for the collection sentinel `id: "*"`. */
 function resourceIdOf(item) {
-	const id = item.resource?.id;
-	if (typeof id === "string" || typeof id === "number") return String(id);
+	return wireResourceId(item.resource?.id);
 }
 function userFromEntity(entity) {
 	if (entity === void 0) return null;
@@ -52,10 +55,11 @@ function userFromEntity(entity) {
 	}
 	return Object.keys(result).length === 0 ? null : result;
 }
+function contextOrSubject(item, name) {
+	return (isRecord(item.context) ? item.context[name] : void 0) ?? (isRecord(item.subject?.properties) ? item.subject.properties[name] : void 0);
+}
 function actorOf(item) {
-	const context = isRecord(item.context) ? item.context : {};
-	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["actor"] : void 0;
-	const raw = context["actor"] ?? fromSubject;
+	const raw = contextOrSubject(item, "actor");
 	if (!isRecord(raw) || typeof raw["id"] !== "string") return;
 	const kind = typeof raw["kind"] === "string" ? raw["kind"] : "oauth-client";
 	return {
@@ -64,16 +68,7 @@ function actorOf(item) {
 	};
 }
 function delegationOf(item) {
-	const context = isRecord(item.context) ? item.context : {};
-	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["delegation"] : void 0;
-	const raw = context["delegation"] ?? fromSubject;
-	if (!isRecord(raw)) return;
-	const scopes = raw["scopes"];
-	const authorizationDetails = raw["authorizationDetails"];
-	return compact({
-		scopes: Array.isArray(scopes) ? scopes.filter((scope) => typeof scope === "string") : void 0,
-		authorizationDetails: Array.isArray(authorizationDetails) ? authorizationDetails : void 0
-	});
+	return fromWireDelegation(contextOrSubject(item, "delegation"));
 }
 function tenantOf(item) {
 	if (!isRecord(item.context) || typeof item.context["tenant"] !== "string") return;
@@ -100,13 +95,13 @@ function permdockContext(decision) {
 		default: return decision;
 	}
 }
-function evaluationContext(decision) {
-	return { permdock: permdockContext(decision) };
-}
-function evaluationRow(decision) {
+function evaluationRow(decision, permission) {
 	return {
 		decision: decision.outcome === "granted",
-		context: evaluationContext(decision)
+		context: {
+			permdock: permdockContext(decision),
+			...evaluationReasons(decision, permission)
+		}
 	};
 }
 function pathnameOf(request) {
@@ -115,7 +110,11 @@ function pathnameOf(request) {
 function endsWithPath(pathname, suffix) {
 	return pathname === suffix || pathname.endsWith(suffix);
 }
-function mergeItem(shared, item) {
+/**
+* One item of an `evaluations` batch with the request's top-level `subject`,
+* `action`, `resource` and `context` filled in where the item omits them.
+*/
+function mergeEvaluationItem(shared, item) {
 	if (!isRecord(item)) return shared;
 	return compact({
 		subject: isRecord(item["subject"]) ? item["subject"] : shared.subject,
@@ -150,36 +149,44 @@ function paged(items, offset, size) {
 //#endregion
 //#region src/authzen/create.ts
 function notFound(detail) {
-	return problemResponse({
-		type: `${PROBLEM_BASE}/not-found`,
-		title: "Not found",
-		status: 404,
-		detail
-	});
+	return problemResponse(statusProblem(404, detail));
 }
 async function readJson(request) {
+	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return validationProblem("AuthZEN requests must use Content-Type: application/json");
+	const read = await readBodyText(request);
+	if (!read.ok) return read.cause === "too-large" ? bodyTooLarge() : validationProblem("AuthZEN body was not valid JSON");
 	try {
-		return await request.json();
+		return JSON.parse(read.text);
 	} catch {
 		return validationProblem("AuthZEN body was not valid JSON");
 	}
 }
-const SEMANTICS = [
-	"execute_all",
-	"deny_on_first_deny",
-	"permit_on_first_permit"
-];
-function semanticOf(body) {
-	const options = body["options"];
-	const value = isRecord(options) ? options["evaluations_semantic"] : void 0;
-	if (value === void 0) return "execute_all";
-	return SEMANTICS.find((semantic) => semantic === value);
+/**
+* The 400 for a request missing a required entity or one of its required
+* fields (AuthZEN 1.0 sections 5, 6.1 and 10.1.1), or `undefined`.
+*/
+function missingProblem(body, required) {
+	for (const name of ["subject", "resource"]) {
+		const needs = required[name];
+		if (needs === void 0) continue;
+		const entity = body[name];
+		if (!isRecord(entity) || typeof entity["type"] !== "string") return validationProblem(`${name}.type is required`);
+		if (needs === "type-id" && typeof entity["id"] !== "string") return validationProblem(`${name}.id is required`);
+	}
+	if (required.action === true) {
+		const action = body["action"];
+		if (!isRecord(action) || typeof action["name"] !== "string") return validationProblem("action.name is required");
+	}
 }
+const EVALUATION = {
+	subject: "type-id",
+	action: true,
+	resource: "type-id"
+};
 const WELL_KNOWN = "/.well-known/authzen-configuration";
-function withRequestId(request, response) {
-	const id = request.headers.get("x-request-id");
-	if (id !== null && id !== "") response.headers.set("X-Request-ID", id);
-	return response;
+/** The name an item's action gives, for the reasons of an unknown permission. */
+function actionName(item) {
+	return typeof item.action?.name === "string" ? item.action.name : "unknown";
 }
 const createPermDock = (policy, options) => {
 	const maxEvaluations = options.maxEvaluations ?? 256;
@@ -221,7 +228,7 @@ const createPermDock = (policy, options) => {
 		};
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const id = resourceIdOf(item);
-		const load = type !== void 0 && options.resources !== void 0 ? options.resources[type]?.load : void 0;
+		const load = type !== void 0 && options.resources !== void 0 ? options.resources[type]?.data : void 0;
 		if (id !== void 0 && load !== void 0) try {
 			return {
 				data: await load(id),
@@ -244,22 +251,27 @@ const createPermDock = (policy, options) => {
 		const permdock = await instantiate(pep, item);
 		const decide = permdock.decide;
 		const decision = decide(permission, data, trusted ? {
-			source: "endpoint",
+			call: "endpoint",
 			adapter: "authzen",
 			trusted: true
 		} : {
-			source: "endpoint",
+			call: "endpoint",
 			adapter: "authzen",
 			trusted: false,
 			boundary: "decision-endpoint"
 		});
-		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, item.resource?.id), "authzen");
+		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, resourceIdOf(item)), "authzen");
+	}
+	async function rowOf(request, pep, item) {
+		return evaluationRow(await decideItem(request, pep, item), permissionOf(lookup, item)?.key ?? actionName(item));
 	}
 	async function evaluation(request, pep) {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("evaluation body must be an object");
-		return Response.json(evaluationRow(await decideItem(request, pep, body)));
+		const missing = missingProblem(body, EVALUATION);
+		if (missing !== void 0) return missing;
+		return Response.json(await rowOf(request, pep, body));
 	}
 	async function evaluations(request, pep) {
 		const body = await readJson(request);
@@ -267,31 +279,27 @@ const createPermDock = (policy, options) => {
 		if (!isRecord(body)) return validationProblem("evaluations body must be an object");
 		const items = body["evaluations"] ?? [];
 		if (!Array.isArray(items)) return validationProblem("evaluations must be an array");
-		if (items.length === 0) return Response.json(evaluationRow(await decideItem(request, pep, body)));
+		if (items.length === 0) return missingProblem(body, EVALUATION) ?? Response.json(await rowOf(request, pep, body));
 		if (items.length > maxEvaluations) return batchTooLarge(maxEvaluations);
-		const semantic = semanticOf(body);
-		if (semantic === void 0) return validationProblem(`options.evaluations_semantic must be one of ${SEMANTICS.join(", ")}`);
+		const semantic = evaluationsSemantic(body);
+		if (semantic === void 0) return unknownSemanticProblem();
 		const shared = compact({
 			subject: isRecord(body["subject"]) ? body["subject"] : void 0,
 			action: isRecord(body["action"]) ? body["action"] : void 0,
 			resource: isRecord(body["resource"]) ? body["resource"] : void 0,
 			context: body["context"]
 		});
-		const rowOf = (item) => decideItem(request, pep, mergeItem(shared, item)).then(evaluationRow);
-		if (semantic === "execute_all") return Response.json({ evaluations: await Promise.all(items.map(rowOf)) });
-		const stopOn = semantic === "permit_on_first_permit";
-		const rows = [];
-		for (const item of items) {
-			const row = await rowOf(item);
-			rows.push(row);
-			if (row.decision === stopOn) break;
-		}
-		return Response.json({ evaluations: rows });
+		return Response.json({ evaluations: await evaluateBatch(items, semantic, (item) => rowOf(request, pep, mergeEvaluationItem(shared, item))) });
 	}
 	async function searchAction(request, pep) {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/action body must be an object");
+		const missingAction = missingProblem(body, {
+			subject: "type-id",
+			resource: "type-id"
+		});
+		if (missingAction !== void 0) return missingAction;
 		const item = body;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const leaves = listPermissions(policy.permissions).filter((leaf) => type === void 0 || leaf.resource === type);
@@ -322,6 +330,12 @@ const createPermDock = (policy, options) => {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/resource body must be an object");
+		const missingResource = missingProblem(body, {
+			subject: "type-id",
+			action: true,
+			resource: "type"
+		});
+		if (missingResource !== void 0) return missingResource;
 		const item = body;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const permission = permissionOf(lookup, item);
@@ -347,6 +361,12 @@ const createPermDock = (policy, options) => {
 		const body = await readJson(request);
 		if (body instanceof Response) return body;
 		if (!isRecord(body)) return validationProblem("search/subject body must be an object");
+		const missingSubject = missingProblem(body, {
+			subject: "type",
+			action: true,
+			resource: "type-id"
+		});
+		if (missingSubject !== void 0) return missingSubject;
 		let records;
 		try {
 			records = await options.subjects.list();
@@ -381,15 +401,11 @@ const createPermDock = (policy, options) => {
 	}
 	function discovery(request, pathname) {
 		const pdp = `${new URL(request.url).origin}${pathname.slice(pathname.indexOf(WELL_KNOWN) + 34).replace(/\/+$/u, "")}`;
-		const document = {
-			policy_decision_point: pdp,
-			access_evaluation_endpoint: `${pdp}/access/v1/evaluation`,
-			access_evaluations_endpoint: `${pdp}/access/v1/evaluations`,
-			search_action_endpoint: `${pdp}/access/v1/search/action`,
-			search_resource_endpoint: `${pdp}/access/v1/search/resource`
-		};
-		if (options.subjects?.list !== void 0) document["search_subject_endpoint"] = `${pdp}/access/v1/search/subject`;
-		return Response.json(document);
+		return Response.json(authzenMetadata(pdp, {
+			action: true,
+			resource: true,
+			subject: options.subjects?.list !== void 0
+		}));
 	}
 	async function route(request) {
 		const pathname = pathnameOf(request);
@@ -432,9 +448,8 @@ const createPermDock = (policy, options) => {
 		}
 		return notFound("unknown AuthZEN path");
 	}
-	return { async permdockHandler(request) {
-		return withRequestId(request, await route(request));
-	} };
+	const handler = async (request) => withRequestId(request, await route(request));
+	return { permdockHandler: () => handler };
 };
 //#endregion
-export { createPermDock };
+export { EVALUATIONS_SEMANTICS, createPermDock, evaluateBatch, evaluationsSemantic, mergeEvaluationItem };

package/dist/automation-BMZPIVUM.d.ts

@@ -0,0 +1,114 @@
+import { Lt as InstanceHandle, Pn as Denial, Rt as Instant } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { t as Operation } from "./operations-CxybZErY.js";
+//#region src/core/automation.d.ts
+/**
+ * Who an automation runs as. `publisher`: the person who published it, with
+ * their rights as of each run. `service`: a `kind: 'service'` principal
+ * holding `roles` in `tenant`, capped at what the publisher could assign.
+ */
+type AutomationMode = "publisher" | "service";
+/**
+ * Automation v1: a published, versioned run of operations. Every run acts
+ * as `principal` with live rights, narrowed to `permissions` (the
+ * operations' permissions) and to any policy delegation to
+ * `actor('automation')`. The event that triggers a run never grants.
+ */
+type Automation = {
+  readonly v: 1;
+  readonly id: string;
+  /** Changes on every edit; a run ticket for another version is refused. */
+  readonly version: number | string;
+  readonly mode: AutomationMode;
+  /** The principal each run acts as: the publisher, or the service principal. */
+  readonly principal: string;
+  readonly publishedBy: string;
+  /** RFC 3339. */
+  readonly publishedAt: string;
+  readonly tenant?: string;
+  /** Service mode only: the roles the service principal holds in `tenant`. */
+  readonly roles?: readonly string[];
+  /** The operation names the automation runs. */
+  readonly operations: readonly string[];
+  /** The delegation: the permission keys of `operations`. */
+  readonly permissions: readonly string[];
+  /** The permission key a caller needs to start a run; absent, only server code starts one. */
+  readonly run?: string;
+  readonly revoked?: boolean;
+  readonly name?: string;
+};
+/** The live record of each automation, read on every run. */
+type AutomationSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  /** The automation as of now, or `null` for an unknown one. A throw is no automation. */
+  automation(id: string, options?: {
+    readonly tenant?: string;
+  }): Automation | null | Promise<Automation | null>;
+};
+type OperationRef = Pick<Operation, "name" | "permission">;
+type AutomationRequest = {
+  readonly id: string;
+  readonly version: number | string;
+  /** The operations the automation runs: entries of an `OperationMap`, or the map itself. */
+  readonly operations: readonly OperationRef[] | Readonly<Record<string, OperationRef>>;
+  /** Defaults to `'publisher'`. */
+  readonly mode?: AutomationMode;
+  /** Defaults to the publisher's active tenant; required for `service`. */
+  readonly tenant?: string;
+  /** Service mode: the service principal's id; defaults to `automation:<id>`. */
+  readonly principal?: string;
+  /** Service mode: the roles the service principal holds in `tenant`. */
+  readonly roles?: readonly string[];
+  /** The permission a caller needs to start a run. */
+  readonly run?: Permission;
+  readonly name?: string;
+};
+type AutomationDecision = {
+  readonly outcome: "granted";
+  readonly automation: Automation;
+} | {
+  readonly outcome: "denied";
+  readonly denials: readonly Denial[];
+};
+type DecideAutomationOptions = {
+  /** The publication time; defaults to the clock. */
+  readonly now?: Instant;
+};
+/**
+ * Validates an untrusted automation record and returns a frozen copy with
+ * only the v1 fields, or `undefined`. A service automation needs `tenant`
+ * and `roles`; a publisher automation runs as `publishedBy` and has no
+ * `roles`.
+ */
+declare function parseAutomation(input: unknown): Automation | undefined;
+type MemoryAutomationSource = {
+  automation(id: string, options?: {
+    readonly tenant?: string;
+  }): Automation | null;
+  /** Adds or replaces a record by id; an invalid record throws. */
+  put(automation: Automation): void;
+};
+/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+declare function memoryAutomationSource(automations?: readonly Automation[]): MemoryAutomationSource;
+/**
+ * Decides whether the subject of `permdock` may publish the automation in
+ * `request`, and returns the record to store. The publisher must be a
+ * signed-in user or service that is not a link, a feed, a contact, a
+ * credential or a run, and must be able to use every operation's permission
+ * now (`exceeds-creator`); each run re-checks their live rights. A
+ * `service` automation's tenant must be one the publisher is a member of,
+ * its roles among their `assignableRoles` there and its permissions within
+ * `assignablePermissions`. PermDock never stores the record; the
+ * application does, after a `granted` result.
+ */
+/**
+ * Decides whether the subject of `permdock` may publish the automation in
+ * `request` and returns the record to store: the publisher's own reach over
+ * every operation's permission and, for a `service` automation, their
+ * assignable ceiling. Each run re-checks the publisher live. An instance
+ * built from a snapshot denies with `unsupported`.
+ */
+declare function decideAutomation(permdock: InstanceHandle, request: AutomationRequest, options?: DecideAutomationOptions): Promise<AutomationDecision>;
+//#endregion
+export { AutomationSource as a, decideAutomation as c, AutomationRequest as i, memoryAutomationSource as l, AutomationDecision as n, DecideAutomationOptions as o, AutomationMode as r, MemoryAutomationSource as s, Automation as t, parseAutomation as u };

package/dist/automation-DVjOckjV.js

@@ -0,0 +1,157 @@
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+//#region src/core/automation.ts
+const MAX_NAME = 256;
+function isVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 || isId(value);
+}
+/**
+* Validates an untrusted automation record and returns a frozen copy with
+* only the v1 fields, or `undefined`. A service automation needs `tenant`
+* and `roles`; a publisher automation runs as `publishedBy` and has no
+* `roles`.
+*/
+function parseAutomation(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"]) || !isVersion(value["version"]) || value["mode"] !== "publisher" && value["mode"] !== "service" || !isId(value["principal"]) || !isId(value["publishedBy"]) || !isRfc3339(value["publishedAt"])) return;
+	const operations = idList(value["operations"]);
+	const permissions = idList(value["permissions"]);
+	const roles = value["roles"] === void 0 ? void 0 : idList(value["roles"]);
+	const { tenant, run, revoked, name } = value;
+	if (operations === void 0 || permissions === void 0 || value["roles"] !== void 0 && roles === void 0 || tenant !== void 0 && !isId(tenant) || run !== void 0 && !isId(run) || revoked !== void 0 && typeof revoked !== "boolean" || name !== void 0 && (typeof name !== "string" || name.length > MAX_NAME)) return;
+	if (value["mode"] === "service") {
+		if (tenant === void 0 || roles === void 0) return;
+	} else if (roles !== void 0 || value["principal"] !== value["publishedBy"]) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		version: value["version"],
+		mode: value["mode"],
+		principal: value["principal"],
+		publishedBy: value["publishedBy"],
+		publishedAt: value["publishedAt"],
+		tenant,
+		roles,
+		operations,
+		permissions,
+		run,
+		revoked: revoked === true ? true : void 0,
+		name
+	}));
+}
+/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+function memoryAutomationSource(automations = []) {
+	const byId = /* @__PURE__ */ new Map();
+	const put = (automation) => {
+		const parsed = parseAutomation(automation);
+		if (parsed === void 0) throw new TypeError("PermDock: invalid automation record");
+		byId.set(parsed.id, parsed);
+	};
+	for (const automation of automations) put(automation);
+	return Object.freeze({
+		automation(id, options) {
+			const found = byId.get(id);
+			if (found === void 0 || options?.tenant !== void 0 && found.tenant !== void 0 && found.tenant !== options.tenant) return null;
+			return found;
+		},
+		put
+	});
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function operationList(operations) {
+	return isReadonlyArray(operations) ? operations : Object.values(operations);
+}
+/**
+* Decides whether the subject of `permdock` may publish the automation in
+* `request`, and returns the record to store. The publisher must be a
+* signed-in user or service that is not a link, a feed, a contact, a
+* credential or a run, and must be able to use every operation's permission
+* now (`exceeds-creator`); each run re-checks their live rights. A
+* `service` automation's tenant must be one the publisher is a member of,
+* its roles among their `assignableRoles` there and its permissions within
+* `assignablePermissions`. PermDock never stores the record; the
+* application does, after a `granted` result.
+*/
+/**
+* Decides whether the subject of `permdock` may publish the automation in
+* `request` and returns the record to store: the publisher's own reach over
+* every operation's permission and, for a `service` automation, their
+* assignable ceiling. Each run re-checks the publisher live. An instance
+* built from a snapshot denies with `unsupported`.
+*/
+function decideAutomation(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	return Promise.resolve().then(() => decideAutomationWith(internals.instance, request, options));
+}
+function decideAutomationWith(permdock, request, options) {
+	const publisher = permdock.subject.principal;
+	if (publisher === null) return denied("anonymous");
+	if (publisher.kind === "link" || publisher.kind === "feed" || publisher.kind === "contact") return denied("exceeds-creator", { creator: publisher.kind });
+	if ("credential" in publisher || "runTicket" in publisher) return denied("exceeds-creator", { creator: "credential" in publisher ? "credential" : "run" });
+	const mode = request.mode ?? "publisher";
+	const refs = operationList(request.operations);
+	if (!isId(request.id) || !isVersion(request.version) || refs.length === 0 || mode !== "publisher" && mode !== "service") return denied("validation");
+	const names = [];
+	const keys = [];
+	for (const ref of refs) {
+		const leaf = findPermission(permdock.permissions, ref.permission.key);
+		if (!isId(ref.name) || leaf === void 0 || names.includes(ref.name)) return denied("validation");
+		names.push(ref.name);
+		if (!keys.includes(leaf.key)) keys.push(leaf.key);
+		if (!permdock.mayUse(leaf)) return denied("exceeds-creator", { permission: leaf.key });
+	}
+	const run = request.run === void 0 ? void 0 : findPermission(permdock.permissions, request.run.key);
+	if (request.run !== void 0 && run === void 0) return denied("validation");
+	const tenant = request.tenant ?? publisher.tenant;
+	if (tenant !== void 0 && !permdock.tenants().includes(tenant)) return denied("exceeds-creator", { tenant });
+	if (mode === "service") {
+		if (tenant === void 0 || request.roles === void 0) return denied("validation");
+		const assignable = new Set(permdock.assignableRoles({ tenant }).map((role) => role.key));
+		for (const role of request.roles) if (!assignable.has(role)) return denied("exceeds-creator", { role });
+		const ceiling = new Set(permdock.assignablePermissions({ tenant }).map((leaf) => leaf.key));
+		for (const key of keys) if (!ceiling.has(key)) return denied("exceeds-creator", { permission: key });
+	}
+	const automation = parseAutomation(compact({
+		v: 1,
+		id: request.id,
+		version: request.version,
+		mode,
+		principal: mode === "service" ? request.principal ?? `automation:${request.id}` : publisher.id,
+		publishedBy: publisher.id,
+		publishedAt: rfc3339(nowSeconds(options.now)),
+		tenant,
+		roles: mode === "service" ? request.roles : void 0,
+		operations: names,
+		permissions: keys,
+		run: run?.key,
+		name: request.name
+	}));
+	if (automation === void 0) return denied("validation");
+	return freezeDeep({
+		outcome: "granted",
+		automation
+	});
+}
+//#endregion
+export { memoryAutomationSource as n, parseAutomation as r, decideAutomation as t };

package/dist/better-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { N as RoleBinding, Or as Principal, W as DecisionSink, kr as Subject, nt as RoleSource } from "../policy-types-sp9P1iIV.js";
-import { p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { N as RoleBinding, W as CustomRoleSource, ir as Subject, q as DecisionSink, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { E as PermissionTree } from "../vocabulary-D6lPdb4Z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts
 type BetterAuthPrincipal = Principal & {
@@ -61,6 +61,8 @@ type BetterAuthLike = {
   };
 };
 type BetterAuthSubjectOptions = {
+  /** The Better Auth instance, read for member, team and organization rows. */
+  readonly auth: BetterAuthLike;
   readonly memberships?: "all" | "active";
   /**
    * Parses the user's additional fields into `principal.claims`. Without it no
@@ -70,7 +72,7 @@ type BetterAuthSubjectOptions = {
   readonly headers?: unknown;
   readonly declared?: readonly string[];
 };
-type BetterAuthRoleSourceOptions = {
+type BetterAuthCustomRoleSourceOptions = {
   readonly assignable?: readonly BetterAuthAssignableRole[];
   readonly headers?: unknown;
 };
@@ -98,12 +100,12 @@ type SeededRoles = RoleBinding<"tenant">[] & {
 export declare function rolesFromAccessControl(access: BetterAuthAccessControl, permissions: PermissionTree, options?: {
   readonly on?: "tenant" | "global";
 }): SeededRoles;
-export declare function betterAuthRoleSource(auth: BetterAuthLike, options?: BetterAuthRoleSourceOptions): RoleSource;
+export declare function betterAuthCustomRoleSource(auth: BetterAuthLike, options?: BetterAuthCustomRoleSourceOptions): CustomRoleSource;
 export declare function onRoleChange(refresh: (event: BetterAuthRoleChangeEvent) => void | Promise<void>, options?: {
   readonly sink?: DecisionSink;
 }): (event: BetterAuthRoleChangeEvent) => Promise<void>;
 //#endregion
 //#region src/better-auth/subject.d.ts
-export declare function subjectFromBetterAuth(auth: BetterAuthLike, session: unknown, options?: BetterAuthSubjectOptions): Promise<Subject<BetterAuthPrincipal>>;
+export declare function subjectFromBetterAuth(session: unknown, options: BetterAuthSubjectOptions): Promise<Subject<BetterAuthPrincipal>>;
 //#endregion
-export type { BetterAuthAccessControl, BetterAuthAccessRole, BetterAuthAssignableRole, BetterAuthLike, BetterAuthMemberQuery, BetterAuthPrincipal, BetterAuthRoleChangeEvent, BetterAuthRoleSourceOptions, BetterAuthStatements, BetterAuthSubjectOptions, BetterAuthUnmatchedStatement, SeededRoles };
+export type { BetterAuthAccessControl, BetterAuthAccessRole, BetterAuthAssignableRole, BetterAuthCustomRoleSourceOptions, BetterAuthLike, BetterAuthMemberQuery, BetterAuthPrincipal, BetterAuthRoleChangeEvent, BetterAuthStatements, BetterAuthSubjectOptions, BetterAuthUnmatchedStatement, SeededRoles };

package/dist/better-auth/index.js

@@ -1,10 +1,10 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as validateRecord } from "../thenable-QSmvt-vZ.js";
-import { n as role, r as allow } from "../role-builder-B4GbKM-i.js";
-import { c as listPermissions } from "../permission-registry-BsblpB-z.js";
-import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { i as membershipEvent } from "../sink-BTtmfPnE.js";
+import { n as role, r as allow } from "../role-builder-CXbis5-X.js";
+import { c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { r as validateRecord } from "../thenable-yD7SabqG.js";
+import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
+import { d as membershipEvent } from "../sink-BEZSlMS_.js";
 //#region src/better-auth/parse.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : value.split(",").map((item) => item.trim()).filter((item) => item !== "");
@@ -137,7 +137,7 @@ function rolesFromAccessControl(access, permissions, options = {}) {
 	}
 	return Object.assign(roles, { unmatched });
 }
-function betterAuthRoleSource(auth, options = {}) {
+function betterAuthCustomRoleSource(auth, options = {}) {
 	const assignableRoles = options.assignable ?? [];
 	return {
 		async rolesFor(tenant) {
@@ -294,8 +294,9 @@ async function loadMemberships(auth, session, user, userId, tenant, options) {
 	}
 	return [...members, ...teams];
 }
-async function subjectFromBetterAuth(auth, session, options = {}) {
+async function subjectFromBetterAuth(session, options) {
 	try {
+		const auth = options.auth;
 		if (session === null || session === void 0 || !isTrustedSession(session)) return anonymousSubject();
 		if (!isRecord(session["user"])) return anonymousSubject();
 		const user = session["user"];
@@ -328,4 +329,4 @@ async function subjectFromBetterAuth(auth, session, options = {}) {
 	}
 }
 //#endregion
-export { betterAuthRoleSource, onRoleChange, rolesFromAccessControl, subjectFromBetterAuth };
+export { betterAuthCustomRoleSource, onRoleChange, rolesFromAccessControl, subjectFromBetterAuth };