permdock 0.4.0 → 0.5.0

package/dist/run-ticket-BjhTOi6u.d.ts

@@ -0,0 +1,124 @@
+import { $n as Delegation, Rt as Instant, Yn as AuthorizationDetail, dt as TokenVerifier, ir as Subject, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
+import { p as PrincipalSource } from "./permdock-D7eeLJER.js";
+//#region src/server/run-ticket.d.ts
+/** What started the run: a saved automation, a background job, or a caller's own request. */
+type RunKind = "automation" | "job" | "caller";
+/** RFC 8693 `act`: the party running the work, with the chain of earlier actors. */
+type RunActClaim = {
+  readonly sub: string;
+  readonly kind?: string;
+  readonly act?: RunActClaim;
+};
+/** The connector and tools a run may reach; carried for the adapter, never a grant. */
+type RunBinding = {
+  readonly connector?: string;
+  readonly tools?: readonly string[];
+};
+type RunAutomation = {
+  readonly id: string;
+  readonly version: number | string;
+};
+/** The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and `authorization_details` is present. */
+type RunTicket = {
+  readonly v: 1;
+  readonly iss: string;
+  readonly sub: string;
+  readonly aud: string | readonly string[];
+  readonly jti: string;
+  readonly iat: number;
+  readonly exp: number;
+  readonly kind: RunKind;
+  readonly act?: RunActClaim;
+  readonly scope?: string;
+  readonly authorization_details?: readonly AuthorizationDetail[];
+  /** Present exactly when `kind` is `automation`. */
+  readonly automation?: RunAutomation;
+  readonly tenant?: string;
+  /** The event that started the run, as JSON. Evaluation never reads it as a grant. */
+  readonly trigger?: Readonly<Record<string, unknown>>;
+  readonly binding?: RunBinding;
+};
+type RunTicketInput = {
+  /** The principal the run acts for (`sub`). */
+  readonly principal: string;
+  readonly kind: RunKind;
+  /** Becomes `act`; a nested `act` on the actor is kept as the chain. */
+  readonly actor?: Actor;
+  /** The run's ceiling. Required: a ticket never carries the principal's full authority. */
+  readonly delegation: Delegation;
+  readonly automation?: RunAutomation;
+  readonly tenant?: string;
+  readonly trigger?: Readonly<Record<string, unknown>>;
+  readonly binding?: RunBinding;
+  /** `jti`; a fresh UUID when absent. */
+  readonly id?: string;
+  /** Lifetime in whole seconds. Exactly one of `expiresIn` and `expiresAt`. */
+  readonly expiresIn?: number;
+  readonly expiresAt?: Instant;
+};
+type RunTicketOptions = {
+  readonly audience?: string | readonly string[];
+  readonly now?: Instant;
+};
+/** The live record of an automation, read on every use of its ticket. */
+type RunTicketAutomations = {
+  automation(id: string, options: {
+    readonly tenant?: string;
+  }): {
+    readonly id: string;
+    readonly version: number | string;
+    readonly revoked?: boolean;
+  } | null | Promise<{
+    readonly id: string;
+    readonly version: number | string;
+    readonly revoked?: boolean;
+  } | null>;
+};
+/** `on('auth')` causes: a verification failure, or one of the run checks. */
+type RunTicketFailureCause = TokenFailureCause | "automation-unavailable" | "automation-changed" | "owner-unavailable";
+type RunTicketSubjectOptions = {
+  readonly verifier: TokenVerifier;
+  readonly principals: PrincipalSource;
+  /** Required to accept a `kind: 'automation'` ticket. */
+  readonly automations?: RunTicketAutomations;
+  readonly audience?: string | readonly string[];
+  readonly issuer?: string;
+  readonly clockTolerance?: number;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/** `subject.context.run` of a subject resolved from a run ticket. */
+type RunContext = {
+  readonly id: string;
+  readonly kind: RunKind;
+  readonly automation?: RunAutomation;
+  readonly binding?: RunBinding;
+};
+/** The principal of a run subject, with the verified ticket attached. */
+type RunPrincipal = Principal & {
+  readonly runTicket: RunTicket;
+};
+/**
+ * Validates untrusted run-ticket claims and returns a frozen copy with only
+ * the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
+ * a known claim, a missing delegation, or an `automation` that does not match
+ * `kind` rejects the whole ticket.
+ */
+declare function parseRunTicket(claims: unknown): RunTicket | undefined;
+/**
+ * Signs a `vnd.permdock.run+jwt` for one run. Throws a `TypeError` on input a
+ * verifier would refuse: no delegation, an `automation` that does not match
+ * `kind`, a non-JSON `trigger`, or an expiry that is not in the future.
+ */
+declare function signRunTicket(input: RunTicketInput, signer: TokenSigner, options?: RunTicketOptions): Promise<string>;
+/**
+ * Resolves a `vnd.permdock.run+jwt` into the subject the run acts as: the
+ * principal loaded live from `principals`, the ticket's actor and its
+ * delegation as the ceiling, with `context.trigger` and `context.run`. Every
+ * failure (verification, malformed claims, an automation that is missing,
+ * revoked or changed, a principal that is gone, a throwing source) is the
+ * anonymous subject, never a throw.
+ */
+declare function subjectFromRunTicket(token: string | undefined | null, options: RunTicketSubjectOptions): Promise<Subject<RunPrincipal>>;
+//#endregion
+export { RunKind as a, RunTicketAutomations as c, RunTicketOptions as d, RunTicketSubjectOptions as f, subjectFromRunTicket as h, RunContext as i, RunTicketFailureCause as l, signRunTicket as m, RunAutomation as n, RunPrincipal as o, parseRunTicket as p, RunBinding as r, RunTicket as s, RunActClaim as t, RunTicketInput as u };

package/dist/run-ticket-sxFI6LAk.js

@@ -0,0 +1,337 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord, n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { a as isId } from "./expiry-D4_YKRKD.js";
+import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as toWireDelegation, t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+//#region src/server/run-ticket.ts
+const RUN_TICKET_TYP = "vnd.permdock.run+jwt";
+const RUN_KINDS = [
+	"automation",
+	"job",
+	"caller"
+];
+const MAX_ACT_DEPTH = 8;
+const MAX_JSON_DEPTH = 16;
+const MAX_JSON_ENTRIES = 256;
+const MAX_TOOLS = 64;
+function isRunKind(value) {
+	return RUN_KINDS.some((kind) => kind === value);
+}
+function isVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 || isId(value);
+}
+function isNumericDate(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function jsonCopy(value, depth, budget) {
+	budget.n -= 1;
+	if (budget.n < 0 || depth > MAX_JSON_DEPTH) return;
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return value;
+	if (Array.isArray(value)) {
+		const out = [];
+		for (const item of value) {
+			const copied = jsonCopy(item, depth + 1, budget);
+			if (copied === void 0) return;
+			out.push(copied);
+		}
+		return out;
+	}
+	if (typeof value !== "object") return;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return;
+	const out = {};
+	for (const [key, item] of Object.entries(value)) {
+		if (isForbiddenKey(key)) return;
+		const copied = jsonCopy(item, depth + 1, budget);
+		if (copied === void 0) return;
+		out[key] = copied;
+	}
+	return out;
+}
+function parseTrigger(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const copied = jsonCopy(value, 0, { n: MAX_JSON_ENTRIES });
+	return ownRecord(copied);
+}
+function parseAct(value, depth) {
+	const record = ownRecord(value);
+	if (record === void 0 || depth > MAX_ACT_DEPTH || !isId(record["sub"])) return;
+	const kind = record["kind"];
+	if (kind !== void 0 && !isId(kind)) return;
+	const inner = record["act"] === void 0 ? void 0 : parseAct(record["act"], depth + 1);
+	if (record["act"] !== void 0 && inner === void 0) return;
+	return compact({
+		sub: record["sub"],
+		kind,
+		act: inner
+	});
+}
+function parseAutomation(value) {
+	const record = ownRecord(value);
+	if (record === void 0 || !isId(record["id"]) || !isVersion(record["version"])) return;
+	return {
+		id: record["id"],
+		version: record["version"]
+	};
+}
+function parseBinding(value) {
+	const record = ownRecord(value);
+	if (record === void 0) return;
+	const connector = record["connector"];
+	const tools = record["tools"];
+	if (connector !== void 0 && !isId(connector)) return;
+	if (tools !== void 0 && !(Array.isArray(tools) && tools.length <= MAX_TOOLS && tools.every(isId) && new Set(tools).size === tools.length)) return;
+	return compact({
+		connector,
+		tools: tools === void 0 ? void 0 : [...tools]
+	});
+}
+function parseAudience(value) {
+	if (isId(value)) return value;
+	if (Array.isArray(value) && value.length > 0 && value.every(isId)) return [...value];
+}
+function parseDetails(value) {
+	if (!Array.isArray(value)) return;
+	const out = [];
+	for (const item of value) {
+		const copied = parseTrigger(item);
+		if (copied === void 0 || typeof copied["type"] !== "string") return;
+		out.push(copied);
+	}
+	return out;
+}
+function optional(record, key, parse) {
+	const raw = record[key];
+	if (raw === void 0) return { ok: true };
+	const value = parse(raw);
+	return value === void 0 ? { ok: false } : {
+		ok: true,
+		value
+	};
+}
+function parseBody(record) {
+	const { sub, kind, tenant, scope } = record;
+	if (record["v"] !== 1 || !isId(sub) || !isRunKind(kind) || tenant !== void 0 && !isId(tenant) || scope !== void 0 && typeof scope !== "string") return;
+	const act = optional(record, "act", (value) => parseAct(value, 0));
+	const details = optional(record, "authorization_details", parseDetails);
+	const automation = optional(record, "automation", parseAutomation);
+	const trigger = optional(record, "trigger", parseTrigger);
+	const binding = optional(record, "binding", parseBinding);
+	if (!act.ok || !details.ok || !automation.ok || !trigger.ok || !binding.ok || scope === void 0 && details.value === void 0 || kind === "automation" !== (automation.value !== void 0)) return;
+	return compact({
+		v: 1,
+		sub,
+		kind,
+		act: act.value,
+		scope,
+		authorization_details: details.value,
+		automation: automation.value,
+		tenant,
+		trigger: trigger.value,
+		binding: binding.value
+	});
+}
+/**
+* Validates untrusted run-ticket claims and returns a frozen copy with only
+* the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
+* a known claim, a missing delegation, or an `automation` that does not match
+* `kind` rejects the whole ticket.
+*/
+function parseRunTicket(claims) {
+	const record = ownRecord(claims);
+	if (record === void 0) return;
+	const { iss, jti, iat, exp } = record;
+	const aud = parseAudience(record["aud"]);
+	const body = parseBody(record);
+	if (body === void 0 || !isId(iss) || !isId(jti) || !isNumericDate(iat) || !isNumericDate(exp) || exp <= iat || aud === void 0) return;
+	return freezeDeep({
+		...body,
+		iss,
+		aud,
+		jti,
+		iat,
+		exp
+	});
+}
+function actClaim(actor, depth) {
+	if (!isId(actor.id) || !isId(actor.kind)) return;
+	const nested = actor["act"];
+	const chain = nested === void 0 ? void 0 : parseAct(nested, depth + 1);
+	if (nested !== void 0 && chain === void 0) return;
+	return compact({
+		sub: actor.id,
+		kind: actor.kind,
+		act: chain
+	});
+}
+function expiryOf(input, issuedAt) {
+	if (input.expiresIn === void 0 === (input.expiresAt === void 0)) return;
+	if (input.expiresIn !== void 0) return Number.isSafeInteger(input.expiresIn) && input.expiresIn > 0 ? issuedAt + input.expiresIn : void 0;
+	const at = nowSeconds(input.expiresAt);
+	return at > issuedAt ? at : void 0;
+}
+function invalid(message) {
+	throw new TypeError(`PermDock: run ticket ${message}`);
+}
+/**
+* Signs a `vnd.permdock.run+jwt` for one run. Throws a `TypeError` on input a
+* verifier would refuse: no delegation, an `automation` that does not match
+* `kind`, a non-JSON `trigger`, or an expiry that is not in the future.
+*/
+function signRunTicket(input, signer, options = {}) {
+	const issuedAt = nowSeconds(options.now);
+	const expiresAt = expiryOf(input, issuedAt);
+	if (expiresAt === void 0) invalid("needs exactly one future expiresIn or expiresAt");
+	const act = input.actor === void 0 ? void 0 : actClaim(input.actor, 0);
+	if (input.actor !== void 0 && act === void 0) invalid("actor needs an id and a kind");
+	const wire = toWireDelegation(input.delegation);
+	const body = parseBody(compact({
+		v: 1,
+		sub: input.principal,
+		kind: input.kind,
+		act,
+		scope: wire?.scope,
+		authorization_details: wire?.authorization_details,
+		automation: input.automation,
+		tenant: input.tenant,
+		trigger: input.trigger,
+		binding: input.binding
+	}));
+	if (body === void 0) invalid("is invalid: check principal, kind, automation, delegation, trigger and binding");
+	if (input.id !== void 0 && !isId(input.id)) invalid("id must be a non-empty string");
+	return signer.sign(body, compact({
+		typ: RUN_TICKET_TYP,
+		audience: options.audience,
+		expiresAt,
+		issuedAt,
+		jti: input.id ?? globalThis.crypto.randomUUID()
+	}));
+}
+function isPrincipalRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.hasOwn(value, "id") && "id" in value && typeof value.id === "string";
+}
+function actorOf(ticket) {
+	if (ticket.act === void 0) return;
+	return {
+		id: ticket.act.sub,
+		kind: ticket.act.kind ?? ticket.kind
+	};
+}
+function delegationOf(ticket) {
+	const delegation = fromWireDelegation(compact({
+		scope: ticket.scope,
+		authorization_details: ticket.authorization_details
+	})) ?? { scopes: [] };
+	return ticket.act?.act === void 0 ? delegation : {
+		...delegation,
+		chain: ticket.act
+	};
+}
+function mediaType(typ) {
+	const lower = typ?.toLowerCase();
+	return lower?.startsWith("application/") === true ? lower.slice(12) : lower;
+}
+async function checkAutomation(ticket, automations) {
+	const expected = ticket.automation;
+	if (expected === void 0) return;
+	if (automations === void 0) return "automation-unavailable";
+	try {
+		const record = await automations.automation(expected.id, ticket.tenant === void 0 ? {} : { tenant: ticket.tenant });
+		const live = ownRecord(record);
+		if (live === void 0 || live["id"] !== expected.id || live["revoked"] === true) return "automation-unavailable";
+		return live["version"] === expected.version ? void 0 : "automation-changed";
+	} catch {
+		return "automation-unavailable";
+	}
+}
+async function loadPrincipal(ticket, principals) {
+	try {
+		const loaded = await principals.principal(ticket.sub, ticket.tenant === void 0 ? {} : { tenant: ticket.tenant });
+		if (!isPrincipalRecord(loaded) || loaded.id !== ticket.sub) return {
+			ok: false,
+			cause: "owner-unavailable"
+		};
+		return {
+			ok: true,
+			principal: ticket.tenant === void 0 ? loaded : {
+				...loaded,
+				tenant: ticket.tenant
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			cause: "owner-unavailable"
+		};
+	}
+}
+function anonymous() {
+	return anonymousSubject();
+}
+/**
+* Resolves a `vnd.permdock.run+jwt` into the subject the run acts as: the
+* principal loaded live from `principals`, the ticket's actor and its
+* delegation as the ceiling, with `context.trigger` and `context.run`. Every
+* failure (verification, malformed claims, an automation that is missing,
+* revoked or changed, a principal that is gone, a throwing source) is the
+* anonymous subject, never a throw.
+*/
+async function subjectFromRunTicket(token, options) {
+	if (typeof token !== "string" || token.length === 0) return anonymous();
+	const deny = (cause) => {
+		try {
+			options.onAuth?.(compact({
+				reason: "invalid-token",
+				cause,
+				source: "run-ticket",
+				typ: RUN_TICKET_TYP,
+				issuer: options.issuer,
+				requestId: options.requestId
+			}));
+		} catch {}
+		return anonymous();
+	};
+	let ticket;
+	try {
+		const verified = await options.verifier.verify(token, compact({
+			typ: RUN_TICKET_TYP,
+			audience: options.audience,
+			issuer: options.issuer,
+			clockTolerance: options.clockTolerance
+		}));
+		if (!verified.ok) return deny(verified.cause);
+		if (mediaType(verified.header.typ) !== RUN_TICKET_TYP) return deny("wrong-token-type");
+		ticket = parseRunTicket(verified.claims);
+	} catch {
+		return deny("malformed");
+	}
+	if (ticket === void 0) return deny("invalid-claims");
+	if (ticket.exp <= epochSeconds()) return deny("expired");
+	const automation = await checkAutomation(ticket, options.automations);
+	if (automation !== void 0) return deny(automation);
+	const loaded = await loadPrincipal(ticket, options.principals);
+	if (!loaded.ok) return deny(loaded.cause);
+	const run = compact({
+		id: ticket.jti,
+		kind: ticket.kind,
+		automation: ticket.automation,
+		binding: ticket.binding
+	});
+	return Object.freeze(compact({
+		principal: Object.freeze({
+			...loaded.principal,
+			runTicket: ticket
+		}),
+		actor: actorOf(ticket),
+		delegation: delegationOf(ticket),
+		context: Object.freeze(compact({
+			trigger: ticket.trigger,
+			run
+		})),
+		expiresAt: ticket.exp
+	}));
+}
+//#endregion
+export { signRunTicket as n, subjectFromRunTicket as r, parseRunTicket as t };

package/dist/{runtime-D_tMXnsq.js → runtime-D3VTAiCA.js}

@@ -1,4 +1,4 @@
-import { c as scopedTenant, o as protectedView } from "./views-CJsrBS1f.js";
+import { l as scopedTenant, s as protectedView } from "./views-DTIIO-oQ.js";
 //#region src/svelte/protected.ts
 /** The instance for `tenant`, built once per store change rather than once per check. */
 function scopedFor(store, tenant, _generation) {

package/dist/{saas-DtaA4JuW.js → saas-FO-Q8oj0.js}

@@ -1,11 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as principal } from "./refs-f3imMjNW.js";
-import { a as deny, n as role, r as allow, u as memoryLimitStore } from "./role-builder-B4GbKM-i.js";
-import { f as memoryRelations, g as memoryRoleSource } from "./src-Bb7no-hS.js";
-import { l as relation, n as anyone } from "./grantee-CXY-0C87.js";
-import { o as definePolicy } from "./hosted-CBHgkzDl.js";
-import { o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CCJ6lmxB.js";
+import { r as principal } from "./refs-K6eWUJ0H.js";
+import { a as deny, n as role, r as allow } from "./role-builder-CXbis5-X.js";
+import { E as memoryCustomRoleSource, _ as limits, g as memoryRelationSource, v as memoryLimitStore } from "./src-DLfUWFAI.js";
+import { h as secondsAt } from "./time-DkWjdL98.js";
+import { l as relation, n as anyone } from "./grantee-Cn1HyUsI.js";
+import { n as definePolicy } from "./policy-DLZJ5gAp.js";
+import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CZKiUfFM.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -67,7 +68,7 @@ const saasPolicy = definePolicy({
 			to,
 			limit: {
 				count: 5,
-				per: "day"
+				per: 86400
 			}
 		})),
 		allow(p.apiKey.revokeAll, {
@@ -400,7 +401,7 @@ function saasRelations(seed = saasSeed) {
 		principal: share.user,
 		expiresAt: share.expiresAt
 	});
-	return memoryRelations(saasPermissions, {
+	return memoryRelationSource(saasPermissions, {
 		rows: { folder: seed.folders },
 		edges: { folder: {
 			viewer: edges("viewer"),
@@ -598,7 +599,7 @@ function encodeJson(value) {
 }
 /** Signs an ES256 access token for `sub` with WebCrypto; no dependency. */
 async function signSaasToken(sub, options = {}) {
-	const iat = options.now ?? Math.floor(Date.now() / 1e3);
+	const iat = secondsAt(options.now);
 	const memberships = options.memberships === false ? void 0 : options.memberships ?? saasMemberships(sub);
 	const header = {
 		alg: "ES256",
@@ -643,11 +644,12 @@ function parseSegment(segment) {
 * and returns its `sub`, or `null`; never throws. Identity only: memberships
 * and plans come from the seed, never from the token.
 */
-async function verifySaasToken(token, now = Math.floor(Date.now() / 1e3)) {
+async function verifySaasToken(token, now) {
 	return (await verifySaasSession(token, now))?.sub ?? null;
 }
 /** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
-async function verifySaasSession(token, now = Math.floor(Date.now() / 1e3)) {
+async function verifySaasSession(token, at) {
+	const now = secondsAt(at);
 	const parts = typeof token === "string" ? token.split(".") : [];
 	const [head, body, signature] = parts;
 	if (parts.length !== 3 || head === void 0 || body === void 0 || signature === void 0) return null;
@@ -715,8 +717,8 @@ function saasLimitStore(used = 0) {
 function saasScenarioOptions(scenario) {
 	return {
 		...scenario.tenant === void 0 ? {} : { tenant: scenario.tenant },
-		customRoles: memoryRoleSource(saasCustomRoles),
-		limits: saasLimitStore(scenario.quotaUsed),
+		customRoles: memoryCustomRoleSource(saasCustomRoles),
+		limits: limits(saasLimitStore(scenario.quotaUsed)),
 		relations: saasRelations()
 	};
 }

package/dist/scan-BOI5tJ-6.js

@@ -0,0 +1,29 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+//#region src/cli/commands/scan.ts
+const scan = defineLeaf({
+	flags: {
+		pattern: {
+			type: "string",
+			repeatable: true,
+			description: "An extra regular expression to report",
+			valueHint: "regex"
+		},
+		src: {
+			type: "string",
+			repeatable: true,
+			description: "Directories to scan (default collect.srcPath or src)",
+			valueHint: "dir"
+		}
+	},
+	async run(ctx, { flags }) {
+		const { runAdoptionScan } = await import("./adoption-scan-B4R5fnMU.js");
+		return runAdoptionScan({
+			cwd: ctx.cwd,
+			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],
+			patterns: flags.pattern,
+			json: ctx.json
+		});
+	}
+});
+//#endregion
+export { scan };