permdock 0.4.0 → 0.6.0

package/dist/{credential-kue0qpbm.js → credential-BcoiejpY.js}

@@ -1,11 +1,20 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-BsblpB-z.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { a as ownRecord, n as idList, r as isId } from "./capability-txATtKV4.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as coveredByDelegation } from "./delegation-j6-rc37o.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
+/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+function isFeedId(value) {
+	return /^[a-z0-9-]{1,16}$/u.test(value);
+}
 const MAX_NAME = 256;
 function policies(policy) {
 	return isReadonlyArray(policy) ? policy : [policy];
@@ -18,10 +27,14 @@ function policies(policy) {
 function credentialPolicyViolation(credential, policy) {
 	const list = policies(policy);
 	for (const item of list) if (item.kinds !== void 0 && !item.kinds.includes(credential.kind)) return "kind";
-	if (credential.expiresAt === void 0) return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	if (credential.expiresAt === void 0) {
+		if (credential.kind === "feed") return;
+		return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	}
+	const lifetime = (secondsOf(credential.expiresAt) ?? NaN) - (secondsOf(credential.createdAt) ?? NaN);
 	for (const item of list) {
 		const max = item.maxTtl;
-		if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max) || max < 0 || credential.expiresAt - credential.createdAt > max)) return "ttl";
+		if (max !== void 0 && (!Number.isSafeInteger(max) || max < 0 || !(lifetime <= max))) return "ttl";
 	}
 }
 function parsePermissions(value) {
@@ -39,9 +52,6 @@ function parsePermissions(value) {
 	}
 	return out;
 }
-function isTime(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
 /**
 * Validates an untrusted credential record and returns a frozen copy with
 * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
@@ -51,19 +61,30 @@ function isTime(value) {
 function parseCredential(input) {
 	const value = ownRecord(input);
 	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
-	if (value["kind"] !== "user" && value["kind"] !== "service") return;
+	if (value["kind"] !== "user" && value["kind"] !== "service" && value["kind"] !== "feed") return;
 	if (!isId(value["principal"]) || !isId(value["createdBy"])) return;
 	const permissions = parsePermissions(value["permissions"]);
-	if (permissions === void 0 || !isTime(value["createdAt"])) return;
-	if (value["expiresAt"] !== void 0 && !isTime(value["expiresAt"])) return;
+	if (permissions === void 0 || !isRfc3339(value["createdAt"])) return;
+	if (value["expiresAt"] !== void 0 && !isRfc3339(value["expiresAt"])) return;
 	if (value["name"] !== void 0 && (typeof value["name"] !== "string" || value["name"].length > MAX_NAME)) return;
 	let tenant;
 	let roles;
+	let on;
 	if (value["kind"] === "service") {
 		roles = idList(value["roles"]);
-		if (!isId(value["tenant"]) || roles === void 0) return;
+		if (!isId(value["tenant"]) || roles === void 0 || value["on"] !== void 0) return;
 		tenant = value["tenant"];
-	} else if (value["roles"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+	} else if (value["kind"] === "feed") {
+		roles = idList(value["roles"]);
+		const target = ownRecord(value["on"]);
+		if (roles === void 0 || target === void 0 || !isId(target["resource"]) || !isId(target["id"]) || value["principal"] !== value["id"] || !isFeedId(value["id"])) return;
+		if (value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+		tenant = typeof value["tenant"] === "string" ? value["tenant"] : void 0;
+		on = {
+			resource: target["resource"],
+			id: target["id"]
+		};
+	} else if (value["roles"] !== void 0 || value["on"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
 	else tenant = value["tenant"];
 	return freezeDeep(compact({
 		v: 1,
@@ -72,6 +93,7 @@ function parseCredential(input) {
 		principal: value["principal"],
 		tenant,
 		roles,
+		on,
 		permissions,
 		createdBy: value["createdBy"],
 		createdAt: value["createdAt"],
@@ -120,7 +142,7 @@ function credentialDelegation(credential, permissions) {
 * owner, passed live as `owner` (roles and memberships as of this request),
 * with the credential's delegation: every check is the owner's rights
 * intersected with the key's. One that names a `tenant` makes it the active
-* tenant, and `createPermDock` then keeps only the owner's memberships
+* tenant, and `getPermDock` then keeps only the owner's memberships
 * inside it and no global role. A `service` credential is a `service`
 * principal whose only membership is `roles` in `tenant`. An owner whose id
 * is not the credential's `principal`, or who is not a user, is anonymous.
@@ -128,7 +150,20 @@ function credentialDelegation(credential, permissions) {
 function credentialSubject(credential, options) {
 	const delegation = credentialDelegation(credential, options.permissions);
 	let principal;
-	if (credential.kind === "user") {
+	if (credential.kind === "feed") {
+		if (credential.on === void 0 || credential.roles === void 0) return anonymousSubject();
+		const membership = compact({
+			on: credential.on,
+			roles: credential.roles,
+			via: "feed"
+		});
+		principal = compact({
+			id: credential.id,
+			kind: "feed",
+			memberships: [membership],
+			credential
+		});
+	} else if (credential.kind === "user") {
 		const owner = options.owner ?? {
 			id: credential.principal,
 			kind: "user"
@@ -158,11 +193,11 @@ function credentialSubject(credential, options) {
 		principal,
 		delegation,
 		context: {},
-		expiresAt: credential.expiresAt
+		expiresAt: secondsOf(credential.expiresAt)
 	}));
 }
 function credentialToken(credential) {
-	const payload = JSON.stringify({
+	const payload = canonicalJson({
 		t: "credential",
 		id: credential.id,
 		kind: credential.kind,
@@ -170,11 +205,12 @@ function credentialToken(credential) {
 		tenant: credential.tenant ?? null,
 		roles: credential.roles ?? null,
 		permissions: credential.permissions,
+		...credential.on === void 0 ? {} : { on: credential.on },
 		createdBy: credential.createdBy,
 		expiresAt: credential.expiresAt ?? null,
 		name: credential.name ?? null
 	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+	return sha256Digest(payload);
 }
 function denied(reason, detail) {
 	return freezeDeep({
@@ -213,28 +249,90 @@ function refuse(reason, detail) {
 		decision: denied(reason, detail)
 	};
 }
+function oneResource(resource) {
+	const names = new Set(listPermissions(resource).map((leaf) => leaf.resource));
+	const [name] = names;
+	return names.size === 1 && name !== void 0 ? name : void 0;
+}
+function granteeOnResource(to, resource, role) {
+	for (const grant of flattenGrantee(to)) if (grant.kind === "role" && grant.role === role && typeof grant.scope === "object" && grant.scope.resource === resource) return true;
+	return false;
+}
+function roleDeclaredOn(permdock, resource, resourceName, roleName, id, row) {
+	const preview = permdock.simulate({
+		roles: [],
+		memberships: [{
+			on: {
+				resource: resourceName,
+				id
+			},
+			roles: [roleName]
+		}]
+	});
+	for (const leaf of listPermissions(resource)) {
+		if (leaf.resource !== resourceName) continue;
+		const decision = preview.explain(leaf, row, { trusted: true });
+		const seen = [
+			..."matched" in decision && decision.matched !== void 0 ? [decision.matched] : [],
+			...decision.trace?.allows ?? [],
+			...decision.trace?.denies ?? [],
+			..."denials" in decision ? decision.denials : []
+		];
+		for (const grant of seen) {
+			if (grant.role !== roleName) continue;
+			if (granteeOnResource(grant.to, resourceName, roleName)) return true;
+		}
+	}
+	return false;
+}
+function feedTarget(permdock, request, entries) {
+	const resource = oneResource(request.on.resource);
+	if (resource === void 0 || !isFeedId(request.id) || !isId(request.on.id) || request.row === void 0 || request.row === null || request.roles.length === 0) return refuse("validation");
+	for (const entry of entries) {
+		if (entry.leaf.resource !== resource) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (entry.ids !== void 0 && (entry.ids.length !== 1 || entry.ids[0] !== request.on.id)) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (permdock.decide(entry.leaf, request.row, { trusted: true }).outcome !== "granted") return refuse("exceeds-creator", { permission: entry.leaf.key });
+	}
+	for (const name of request.roles) if (!roleDeclaredOn(permdock, request.on.resource, resource, name, request.on.id, request.row)) return refuse("exceeds-creator", { role: name });
+	return {
+		ok: true,
+		resource
+	};
+}
+function feedOn(request, feed) {
+	if (request.kind !== "feed" || feed === void 0) return;
+	if (feed.ok && "resource" in feed) return {
+		resource: feed.resource,
+		id: request.on.id
+	};
+}
 function checkRequest(permdock, request, now) {
 	const creator = permdock.subject.principal;
 	if (creator === null) return refuse("anonymous");
-	if (creator.kind === "link" || "credential" in creator) return refuse("exceeds-creator", { creator: creator.kind === "link" ? "link" : "credential" });
+	if (creator.kind === "link" || creator.kind === "feed" || creator.kind === "contact") return refuse("exceeds-creator", { creator: creator.kind });
+	if ("credential" in creator) return refuse("exceeds-creator", { creator: "credential" });
 	const entries = permissionEntries(request, leafByKey(permdock.permissions));
-	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (!isTime(request.expiresAt) || request.expiresAt <= now)) return refuse("validation");
+	const expires = request.expiresAt === void 0 ? void 0 : secondsOf(request.expiresAt);
+	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (expires === void 0 || expires <= now)) return refuse("validation");
+	const feed = request.kind === "feed" ? feedTarget(permdock, request, entries) : void 0;
+	if (feed !== void 0 && !feed.ok) return feed;
 	const subject = permdock.subject;
 	for (const entry of entries) for (const id of entry.ids ?? [void 0]) if (coveredByDelegation(entry.leaf, subject.delegation, id, subject.actor !== void 0) !== void 0) return refuse("exceeds-creator", { permission: entry.leaf.key });
 	const credential = parseCredential(compact({
 		v: 1,
 		id: request.id,
 		kind: request.kind,
-		principal: request.kind === "service" ? request.principal ?? request.id : creator.id,
-		tenant: request.tenant,
-		roles: request.kind === "service" ? request.roles : void 0,
+		principal: request.kind === "service" ? request.principal ?? request.id : request.kind === "feed" ? request.id : creator.id,
+		tenant: "tenant" in request ? request.tenant : void 0,
+		roles: request.kind === "service" || request.kind === "feed" ? request.roles : void 0,
+		on: feedOn(request, feed),
 		permissions: entries.map((entry) => compact({
 			permission: entry.leaf.key,
-			ids: entry.ids
+			ids: request.kind === "feed" ? [request.on.id] : entry.ids
 		})),
 		createdBy: creator.id,
-		createdAt: now,
-		expiresAt: request.expiresAt === void 0 ? void 0 : Math.floor(request.expiresAt),
+		createdAt: rfc3339(now),
+		expiresAt: request.expiresAt,
 		name: request.name
 	}));
 	if (credential === void 0) return refuse("validation");
@@ -275,8 +373,31 @@ function credentialTenant(credential, active) {
 * its token. PermDock never stores the credential; the application does,
 * after a `granted` result.
 */
-async function decideCredential(permdock, request, options = {}) {
-	const checked = checkRequest(permdock, request, options.now ?? Math.floor(Date.now() / 1e3));
+/**
+* Decides whether the subject of `permdock` may create the credential in
+* `request`: the creator's own reach, the `credentials` policy of the key's
+* tenant (the call's `settings`, else the instance's), and `approval`.
+* PermDock never stores the credential; the application does, after a
+* `granted` result. An instance built from a snapshot denies with
+* `unsupported`.
+*/
+function decideCredential(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideCredentialWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideCredentialWith(permdock, request, options) {
+	const checked = checkRequest(permdock, request, nowSeconds(options.now));
 	if (!checked.ok) return checked.decision;
 	const { credential } = checked;
 	const tenant = credentialTenant(credential, permdock.subject.principal?.tenant);
@@ -303,4 +424,4 @@ async function decideCredential(permdock, request, options = {}) {
 	});
 }
 //#endregion
-export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, credentialDelegation as t };
+export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, isFeedId as o, credentialSubject as r, parseCredential as s, credentialDelegation as t };

package/dist/credentials-DPyHmYz5.js

@@ -0,0 +1,74 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+//#region src/cli/core/io.ts
+const FRAMES = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const FRAME_MS = 80;
+/**
+* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI
+* output stay readable. `done` replaces the spinner with a final line.
+*/
+function progressReporter(input) {
+	return (message) => {
+		if (!input.tty) {
+			input.write(`${message}\n`);
+			return { done: (final) => {
+				if (final !== void 0) input.write(`${final}\n`);
+			} };
+		}
+		let frame = 0;
+		const draw = () => {
+			input.write(`\r${input.style.paint("cyan", FRAMES[frame % FRAMES.length] ?? "")} ${message}`);
+			frame += 1;
+		};
+		draw();
+		const timer = setInterval(draw, FRAME_MS);
+		timer.unref();
+		return { done: (final) => {
+			clearInterval(timer);
+			input.write(`\r\u001B[2K${final === void 0 ? "" : `${input.style.okMark} ${final}\n`}`);
+		} };
+	};
+}
+/** The value of a `--*-stdin` secret: stdin up to the first newline, trimmed. */
+async function readSecret(readStdin) {
+	if (readStdin === void 0) return;
+	const text = (await readStdin()).split(/\r?\n/u, 1)[0]?.trim() ?? "";
+	return text === "" ? void 0 : text;
+}
+//#endregion
+//#region src/cli/core/credentials.ts
+const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]+)@/giu;
+/** `text` with every registered secret and every URL password masked. */
+function redact(text, secrets) {
+	let out = text.replace(URL_PASSWORD, "$1***@");
+	for (const secret of secrets) if (secret.length >= 4) out = out.replaceAll(secret, "***");
+	return out;
+}
+/**
+* The secret piped in for `--<flag>-stdin`, when it was passed, registered
+* for redaction.
+*/
+async function secretInput(ctx, input) {
+	let value;
+	if (input.stdin) {
+		value = await readSecret(ctx.io.readStdin);
+		if (value === void 0) throw new CliError("usage", `${ctx.command}: --${input.flag}-stdin read nothing from stdin`, {
+			code: "missing_value",
+			extensions: { flag: `--${input.flag}-stdin` }
+		});
+	}
+	if (value !== void 0) ctx.addSecret(value);
+	return value;
+}
+//#endregion
+export { secretInput as n, progressReporter as r, redact as t };

package/dist/delegation-j6-rc37o.js

@@ -0,0 +1,286 @@
+import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { t as isoInstant } from "./instant-BluqDvyS.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { t as isActive } from "./validity-CZ7-y0Cj.js";
+import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
+//#region src/conditions/evaluate.ts
+function resolveRef(ref, subject) {
+	return resolveConditionRef(ref, subject);
+}
+function unwrap(value, subject) {
+	if (isConditionRef(value)) return resolveRef(value.ref, subject);
+	if (isConditionDate(value)) return new Date(isoInstant(value.date) ?? NaN);
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+function instantOf(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") return isoInstant(value);
+}
+function comparablePair(left, right) {
+	if (left instanceof Date || right instanceof Date) {
+		const a = instantOf(left);
+		const b = instantOf(right);
+		return a === void 0 || b === void 0 ? void 0 : [a, b];
+	}
+	const kind = typeof left;
+	if (kind === typeof right && (kind === "string" || kind === "number" || kind === "boolean")) return [left, right];
+}
+function compare(op, left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	const comparable = comparablePair(left, right);
+	if (comparable === void 0) return false;
+	const [a, b] = comparable;
+	switch (op) {
+		case "eq": return a === b;
+		case "ne": return a !== b;
+		case "gt": return a > b;
+		case "gte": return a >= b;
+		case "lt": return a < b;
+		case "lte": return a <= b;
+		default: return op;
+	}
+}
+function contains(left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	if (typeof left === "string" && typeof right === "string") return left.includes(right);
+	if (Array.isArray(left)) return left.includes(right);
+	return false;
+}
+function inList(left, right) {
+	if (left === void 0 || left === null || !Array.isArray(right)) return false;
+	return right.includes(left);
+}
+function matchesParentHop(data, parents, on) {
+	for (const parent of parents ?? []) {
+		const hop = parentHop(parent);
+		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
+		if (sameId(ownGet(data, hop.field), on.id)) return true;
+	}
+	return false;
+}
+function evaluateMemberOf(condition, data, subject, now, scopes) {
+	if (data === null || typeof data !== "object") return false;
+	const rowValue = ownGet(data, condition.field);
+	if (rowValue === void 0 || rowValue === null) return false;
+	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return false;
+	for (const membership of memberships) {
+		if (expiredAt(membership, now)) continue;
+		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
+		if (scope !== void 0) {
+			if (membership.scope !== scope || !sameId(membership.id, rowValue)) continue;
+			const tenant = tenantOf(membership, scopes);
+			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
+			return true;
+		}
+		if (membership.on === void 0) continue;
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) {
+			if (matchesParentHop(data, condition.parents, membership.on)) return true;
+			continue;
+		}
+		if (sameId(membership.on.id, rowValue)) return true;
+		if (matchesParentHop(data, condition.parents, membership.on)) return true;
+	}
+	return false;
+}
+function evaluateCondition(condition, data, subject, now = epochSeconds(), scopes = scopeList(void 0), related, onOpaque) {
+	switch (condition.op) {
+		case "and": return condition.conditions.every((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "or": return condition.conditions.some((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "not": return !evaluateCondition(condition.condition, data, subject, now, scopes, related, onOpaque);
+		case "isNull": {
+			if (data === null || typeof data !== "object") return false;
+			const value = ownGet(data, condition.field);
+			const isNull = value === null || value === void 0;
+			return condition.value ? isNull : !isNull;
+		}
+		case "in":
+		case "notIn": {
+			if (data === null || typeof data !== "object") return false;
+			const left = ownGet(data, condition.field);
+			const matched = inList(left, unwrap(condition.value, subject));
+			return condition.op === "in" ? matched : !matched && left !== void 0 && left !== null;
+		}
+		case "contains":
+			if (data === null || typeof data !== "object") return false;
+			return contains(ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (condition.field === "_" && condition.op === "eq") return condition.value === true;
+			if (data === null || typeof data !== "object") return false;
+			return compare(condition.op, ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "memberOf": return evaluateMemberOf(condition, data, subject, now, scopes);
+		case "related": return related?.(condition, data) === true;
+		case "sqlFunction": return evaluateCondition(condition.twin, data, subject, now, scopes, related, onOpaque);
+		case "opaque":
+			onOpaque?.();
+			return false;
+		case "liveSession": return subject.liveSession === true;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/core/row-pair.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+/**
+* The row a `where` reads and the row a `check` reads. An instance check
+* takes a `{ current, next }` pair or one row for both; a collection check
+* has no current row, only the input it creates.
+*/
+function rowValues(permission, data) {
+	if (permission.kind === "collection") return {
+		current: void 0,
+		next: data
+	};
+	if (permission.kind === "instance" && isRowPair(data)) return {
+		current: data.current,
+		next: data.next
+	};
+	return {
+		current: data,
+		next: data
+	};
+}
+/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+function rowIdOf(row, field = "id") {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
+	const id = Reflect.get(row, field);
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+}
+//#endregion
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+/** A `readOnly` actor never uses a permission without `readOnlyHint`, delegated or not. */
+function readOnlyActorRefuses(actor, permission) {
+	return actor?.readOnly === true && !annotationsFor(permission).readOnlyHint;
+}
+/**
+* Whether an `agent` actor may call the tool `name`: its `tools` list names it.
+* An agent without a `tools` list and any other actor kind are not restricted
+* here; a `tools` value that is not a list of strings refuses every tool.
+*/
+function actorMayCallTool(actor, name) {
+	if (actor?.kind !== "agent" || !Object.hasOwn(actor, "tools")) return true;
+	const tools = actor["tools"];
+	return Array.isArray(tools) && tools.some((tool) => typeof tool === "string" && tool === name);
+}
+function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
+	return (requires ?? []).every((key) => {
+		const leaf = findPermission(tree, key);
+		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
+	});
+}
+function requiresStandIn(grant) {
+	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
+export { readOnlyActorRefuses as a, rowIdOf as c, delegatedPermissions as i, rowValues as l, coveredByDelegation as n, requiresStandIn as o, coversRequirements as r, isRowPair as s, actorMayCallTool as t, evaluateCondition as u };

package/dist/delivery/index.d.ts

@@ -0,0 +1,5 @@
+import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-n0uRTsW8.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-BtHtcKMr.js";
+import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-CueFnxQc.js";
+export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, type ChatMessage, type ChatTransport, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type Recipient, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -0,0 +1,5 @@
+import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+import { n as subscribersFor, t as audience } from "../audience-DabClFLQ.js";
+import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
+import { n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-DCAgNyCn.js";
+export { approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };