permdock 0.4.0 → 0.6.0

package/dist/arazzo-41WuzHou.js

@@ -0,0 +1,36 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, u as permissionsFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/arazzo.ts
+const check = defineLeaf({
+	flags: {
+		doc: {
+			type: "string",
+			description: "Arazzo document",
+			valueHint: "arazzo.json"
+		},
+		openapi: {
+			type: "string",
+			description: "OpenAPI document the workflows call",
+			valueHint: "doc.json"
+		},
+		workflow: {
+			type: "string",
+			description: "Check one workflow",
+			valueHint: "id"
+		},
+		...permissionsFlag
+	},
+	async run(ctx, { flags }) {
+		return (await import("./arazzo-CaUVBn7D.js")).runArazzo({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			doc: given(flags.doc),
+			openapi: given(flags.openapi),
+			workflow: given(flags.workflow),
+			from: given(flags.permissions),
+			json: ctx.json
+		});
+	}
+});
+//#endregion
+export { check };

package/dist/{arazzo-C4BcskbX.js → arazzo-CaUVBn7D.js}

@@ -1,20 +1,16 @@
-import { m as arazzoFindings } from "./snapshot-Dc9CHPME.js";
+import { p as arazzoFindings } from "./src-Cu2m75uo.js";
+import { c as missingInput } from "./errors-CWTY6uih.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-C3_oTHyO.js";
+import { t as ARAZZO_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts
 async function runArazzo(input) {
-	if (input.rest[0] !== "check") return {
-		code: 2,
-		output: "permdock arazzo check --doc <arazzo> --openapi <doc>"
-	};
 	const docPath = input.doc;
 	const openapiPath = input.openapi;
-	if (docPath === void 0 || openapiPath === void 0) return {
-		code: 2,
-		output: "arazzo check requires --doc and --openapi"
-	};
+	if (docPath === void 0 || openapiPath === void 0) throw missingInput("arazzo check", [...docPath === void 0 ? ["--doc"] : [], ...openapiPath === void 0 ? ["--openapi"] : []]);
 	const arazzoFile = resolve(input.cwd, docPath);
 	const openapiFile = resolve(input.cwd, openapiPath);
 	if (!existsSync(arazzoFile) || !existsSync(openapiFile)) return {
@@ -51,20 +47,30 @@ async function runArazzo(input) {
 		openapi,
 		workflowId: input.workflow
 	}, tree);
+	const located = findings.map((finding) => ({
+		code: finding.reason,
+		severity: "error",
+		message: `${finding.workflowId} ${finding.stepId}: ${finding.detail}`,
+		file: docPath,
+		docs: `${DOCS_BASE}/arazzo`
+	}));
 	if (input.json) return {
 		code: findings.length === 0 ? 0 : 1,
 		output: JSON.stringify({
-			$schema: "permdock-arazzo-check",
+			$schema: ARAZZO_REPORT_SCHEMA,
 			findings
-		})
+		}),
+		findings: located
 	};
 	if (findings.length === 0) return {
 		code: 0,
-		output: "arazzo check: all steps documented"
+		output: "arazzo check: all steps documented",
+		findings: located
 	};
 	return {
 		code: 1,
-		output: findings.map((finding) => `${finding.workflowId} ${finding.stepId}: ${finding.reason} (${finding.detail})`).join("\n")
+		output: findings.map((finding) => `${finding.workflowId} ${finding.stepId}: ${finding.reason} (${finding.detail})`).join("\n"),
+		findings: located
 	};
 }
 //#endregion

package/dist/args-IIolxxKA.js

@@ -0,0 +1,197 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { closest, distance } from "fastest-levenshtein";
+//#region src/cli/core/context.ts
+/** Flags every command accepts, read from anywhere before `--`. */
+const GLOBAL_FLAGS = {
+	cwd: {
+		type: "string",
+		description: "Run as if started in this directory",
+		valueHint: "dir"
+	},
+	config: {
+		type: "string",
+		description: "Config file (default permdock.config.{ts,mts,js,mjs})",
+		valueHint: "file"
+	},
+	json: {
+		type: "boolean",
+		description: "Print the cli-result-v1 JSON envelope on stdout"
+	},
+	format: {
+		type: "enum",
+		options: [
+			"text",
+			"json",
+			"github",
+			"sarif"
+		],
+		description: "Output format; github and sarif render findings"
+	},
+	yes: {
+		type: "boolean",
+		alias: "y",
+		description: "Never prompt; take the answer the flags give"
+	},
+	confirm: {
+		type: "string",
+		description: "The token a consent_required result gave, once the person agreed",
+		valueHint: "token"
+	},
+	agent: {
+		type: "enum",
+		options: [
+			"auto",
+			"yes",
+			"no"
+		],
+		description: "Agent mode: no prompts, JSON by default (default auto, PERMDOCK_AGENT)"
+	},
+	debug: {
+		type: "boolean",
+		description: "Log each step and the cause of an error on stderr"
+	},
+	color: {
+		type: "boolean",
+		description: "Styled output on a colour terminal",
+		default: true,
+		negativeDescription: "Plain output"
+	},
+	help: {
+		type: "boolean",
+		alias: "h",
+		description: "Print help"
+	}
+};
+//#endregion
+//#region src/cli/core/args.ts
+/** The closest name within a small edit distance, or `undefined`. */
+function didYouMean(given, names) {
+	if (names.length === 0) return;
+	const best = closest(given, [...names]);
+	return distance(given, best) <= Math.max(1, Math.floor(given.length / 3)) ? best : void 0;
+}
+/** A sentence suggesting `suggestion`, or nothing. */
+function suggestion(given, names) {
+	const best = didYouMean(given, names);
+	return best === void 0 ? "" : ` Did you mean ${best}?`;
+}
+/** Every spelling a flag set accepts: `--name`, `--no-name` for booleans, `-x` aliases. */
+function lookupOf(flags) {
+	const lookup = /* @__PURE__ */ new Map();
+	for (const [name, flag] of Object.entries(flags)) {
+		lookup.set(`--${name}`, {
+			name,
+			negated: false
+		});
+		if (flag.type === "boolean") lookup.set(`--no-${name}`, {
+			name,
+			negated: true
+		});
+		if (flag.alias !== void 0) lookup.set(`-${flag.alias}`, {
+			name,
+			negated: false
+		});
+	}
+	return lookup;
+}
+function flagSpellings(flags) {
+	return [...lookupOf(flags).keys()];
+}
+/** A value never starts with `-`, bar `-` itself: `--out --check` is a bare `--out`. */
+function isValue(token) {
+	return token !== void 0 && (token === "-" || !token.startsWith("-"));
+}
+function split(value) {
+	return value.split(",").map((item) => item.trim()).filter((item) => item !== "");
+}
+function checkEnum(command, name, flag, value) {
+	if (flag.type === "enum" && !flag.options.includes(value)) throw new CliError("usage", `${command}: --${name} ${value === "" ? "needs a value" : `'${value}' is not one of ${flag.options.join(", ")}`}.${suggestion(value, flag.options)}`, { code: "invalid_value" });
+}
+/**
+* Splits argv into the flags `flags` declares, positionals and the tokens
+* after `--`. An undeclared flag is a usage error naming the nearest one.
+* `--name=value`, `--name value`, `--no-name` and `-x` aliases all read.
+*/
+function parseFlags(command, argv, flags) {
+	const lookup = lookupOf(flags);
+	const values = /* @__PURE__ */ new Map();
+	const positionals = [];
+	let passthrough = [];
+	for (let i = 0; i < argv.length; i += 1) {
+		const token = argv[i] ?? "";
+		if (token === "--") {
+			passthrough = argv.slice(i + 1);
+			break;
+		}
+		if (token === "-" || !token.startsWith("-")) {
+			positionals.push(token);
+			continue;
+		}
+		const eq = token.indexOf("=");
+		const spelling = eq === -1 ? token : token.slice(0, eq);
+		const found = lookup.get(spelling);
+		if (found === void 0) throw new CliError("usage", `${command}: unknown flag '${spelling}'.${suggestion(spelling, [...lookup.keys(), ...lookupOf(GLOBAL_FLAGS).keys()].filter((key) => key.startsWith("--")))} Run permdock ${command} --help for the flags it takes.`, { code: "unknown_flag" });
+		const flag = flags[found.name];
+		if (flag === void 0) continue;
+		if (flag.type === "boolean") {
+			if (eq !== -1) {
+				const raw = token.slice(eq + 1);
+				if (raw !== "true" && raw !== "false") throw new CliError("usage", `${command}: ${spelling} takes true or false, got '${raw}'`, { code: "invalid_value" });
+				values.set(found.name, raw === "true" !== found.negated);
+			} else values.set(found.name, !found.negated);
+			continue;
+		}
+		let value;
+		if (eq !== -1) value = token.slice(eq + 1);
+		else if (isValue(argv[i + 1])) {
+			value = argv[i + 1] ?? "";
+			i += 1;
+		} else value = "";
+		if (flag.repeatable === true) {
+			const items = split(value);
+			for (const item of items) checkEnum(command, found.name, flag, item);
+			const previous = values.get(found.name);
+			values.set(found.name, [...Array.isArray(previous) ? previous : [], ...items]);
+			continue;
+		}
+		checkEnum(command, found.name, flag, value);
+		values.set(found.name, value);
+	}
+	return {
+		values,
+		positionals,
+		passthrough
+	};
+}
+/** The leaf's input: defaults applied, positionals named and counted. */
+function parseLeaf(command, argv, flags, positionals = []) {
+	const raw = parseFlags(command, argv, flags);
+	const values = {};
+	for (const [name, flag] of Object.entries(flags)) {
+		const given = raw.values.get(name);
+		if (given !== void 0) values[name] = given;
+		else if (flag.type === "boolean") values[name] = flag.default ?? false;
+		else if (flag.repeatable === true) values[name] = [];
+		else values[name] = flag.type === "enum" ? flag.default : void 0;
+	}
+	const args = {};
+	const rest = [...raw.positionals];
+	for (const positional of positionals) {
+		args[positional.name] = positional.variadic === true ? rest[0] : rest.shift();
+		if (positional.required === true && args[positional.name] === void 0) throw new CliError("action", `${command}: <${positional.name}> is required. Run permdock ${command} --help.`, {
+			code: "input_required",
+			extensions: { missing: [`<${positional.name}>`] }
+		});
+	}
+	const variadic = positionals.at(-1)?.variadic === true;
+	const extra = variadic ? [] : rest;
+	if (extra.length > 0) throw new CliError("usage", `${command}: unexpected argument '${extra[0] ?? ""}'. Run permdock ${command} --help.`, { code: "usage" });
+	return {
+		flags: values,
+		args,
+		rest: variadic ? rest : [],
+		passthrough: raw.passthrough
+	};
+}
+//#endregion
+export { suggestion as a, parseLeaf as i, flagSpellings as n, GLOBAL_FLAGS as o, parseFlags as r, didYouMean as t };

package/dist/astro/index.d.ts

@@ -0,0 +1,43 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { APIContext, MiddlewareHandler } from "astro";
+//#region src/astro/create.d.ts
+type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;
+/** What the adapter sets on `context.locals`. */
+type AstroPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The context a wrapped endpoint receives: its own `APIContext` with typed `locals`. */
+type AstroPermDockContext<TContext extends APIContext = APIContext, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TContext & {
+  readonly locals: AstroPermDockLocals<TData, V>;
+};
+/** Wraps an endpoint; the route keeps its own `APIContext` type. */
+type AstroGuarded<TData, V extends PolicyVocabulary = PolicyVocabulary> = <TContext extends APIContext, R = Response>(handler: (context: AstroPermDockContext<TContext, TData, V>) => R | Promise<R>) => (context: TContext) => Promise<R | Response>;
+type AstroProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<APIContext, T | null | undefined>, protectOptions?: ProtectOptions): AstroGuarded<NonNullable<T>, V>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<APIContext, OperationInput<TOperation>>, protectOptions?: ProtectOptions): AstroGuarded<unknown, V>;
+};
+type AstroPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** `onRequest` in `src/middleware.ts`: sets `context.locals.permdock`; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => MiddlewareHandler;
+  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  readonly protect: AstroProtect<V>;
+  /** Types `context.locals.permdock` for an endpoint and answers a thrown PermDock error with Problem Details. */
+  readonly withPermDock: AstroGuarded<unknown, V>;
+  /** The instance for an endpoint, an action or a page's frontmatter (`Astro` is an `APIContext`). */
+  readonly getPermDock: (context: APIContext) => Promise<PermDock<V>>;
+  /** The snapshot a page passes to a `permdock/react` island. */
+  readonly getSnapshot: (context: APIContext, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (context: APIContext, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `export const { GET, POST } = permdockHandler()` in `src/pages/api/permdock.ts`. */
+  readonly permdockHandler: () => PermDockHandlers<APIContext>;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: AstroPermDockOptions<TUser>): AstroPermDock<V>;
+//#endregion
+export { type AstroGuarded, type AstroPermDock, type AstroPermDockContext, type AstroPermDockLocals, type AstroPermDockOptions, type AstroProtect, type ContextReader, InvalidSignatureError, type PermDockHandlers, type ProtectTarget, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/astro/index.js

@@ -0,0 +1,27 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+//#region src/astro/create.ts
+const route = {
+	context: (context) => context,
+	locals: (context) => context.locals
+};
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "astro", (context) => context.request);
+	const middleware = () => async (context, next) => {
+		const attached = await adapter.ensure(context.locals, context);
+		return attached.ok ? next() : attached.response;
+	};
+	const protect = ((target, data, protectOptions) => guardedRoute(adapter, route, target, data, protectOptions));
+	return {
+		middleware,
+		protect,
+		withPermDock: instanceRoute(adapter, route),
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		connection: adapter.connection,
+		permdockHandler: adapter.handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/audience-DabClFLQ.js

@@ -0,0 +1,55 @@
+import { t as whoCan } from "./who-can-DWBAcaCQ.js";
+//#region src/delivery/audience.ts
+async function granted(permdock, ids, permission, row) {
+	const unique = [...new Set(ids.filter((id) => typeof id === "string" && id !== ""))];
+	const decisions = await Promise.all(unique.map(async (id) => {
+		try {
+			return (await permdock.decideFor(id, permission, row)).outcome;
+		} catch {
+			return "denied";
+		}
+	}));
+	return unique.filter((_, index) => decisions[index] === "granted");
+}
+/**
+* Who may receive a delivery about `row`: the holders `whoCan` lists (or
+* `candidates`), kept only where `decideFor` grants `permission` in the
+* sender's active tenant. A collection permission has no holders to list,
+* so it needs `candidates`; without them it is empty and incomplete.
+*/
+async function audience(permdock, permission, row, options = {}) {
+	if (options.candidates !== void 0) return Object.freeze({
+		principals: Object.freeze(await granted(permdock, options.candidates, permission, row)),
+		complete: true
+	});
+	if (permission.kind !== "instance" || permdock.subject.principal === null) return Object.freeze({
+		principals: Object.freeze([]),
+		complete: permdock.subject.principal === null
+	});
+	let listed;
+	try {
+		listed = await whoCan(permdock, permission, row);
+	} catch {
+		return Object.freeze({
+			principals: Object.freeze([]),
+			complete: false
+		});
+	}
+	return Object.freeze({
+		principals: Object.freeze(await granted(permdock, listed.holders.map((holder) => holder.principal.id), permission, row)),
+		complete: listed.complete
+	});
+}
+/**
+* The subscribers whose principal `decideFor` grants the event's
+* permission on its row, in their order: the per-event filter for webhook
+* endpoints and realtime channels. A subscriber without a string
+* `principal` is dropped.
+*/
+async function subscribersFor(permdock, event, subscribers) {
+	const ids = subscribers.map((subscriber) => subscriber.principal).filter((id) => typeof id === "string");
+	const allowed = new Set(await granted(permdock, ids, event.permission, event.row));
+	return subscribers.filter((subscriber) => typeof subscriber.principal === "string" && allowed.has(subscriber.principal));
+}
+//#endregion
+export { subscribersFor as n, audience as t };

package/dist/auth-DRLEizbL.js

@@ -0,0 +1,178 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { h as secondsAt } from "./time-DkWjdL98.js";
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { a as refreshCredential, c as stringField, n as discoverAuthorizationServer } from "./device-BARQ8eYG.js";
+import { i as writeCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
+import { existsSync } from "node:fs";
+import path from "node:path";
+//#region src/cli/cloud/issuer.ts
+/** The PermDock Cloud platform issuer and API base. */
+const PLATFORM_ISSUER = "https://permdock.com/api";
+/** The public OAuth client the `permdock` binary registers as. */
+const CLI_CLIENT_ID = "permdock-cli";
+const READ_SCOPES = ["projects:read", "policy:read"];
+const WRITE_SCOPE = "catalog:write";
+function firstNonEmpty(...values) {
+	for (const value of values) if (value !== void 0 && value !== "") return value;
+	return "";
+}
+/** `--url`, then `PERMDOCK_CLOUD_URL`, then the platform issuer; never a trailing slash. */
+function cloudUrl(flag, env) {
+	return firstNonEmpty(flag, env["PERMDOCK_CLOUD_URL"], PLATFORM_ISSUER).replace(/\/+$/u, "");
+}
+async function issuerMetadata(issuer, runtime) {
+	const body = await discoverAuthorizationServer(issuer, runtime);
+	if (body === null) return null;
+	const endpoint = (name) => {
+		const value = stringField(body, name);
+		return value !== void 0 && isHttps(value, issuer) ? value : void 0;
+	};
+	return {
+		issuer,
+		...optional("authorizationEndpoint", endpoint("authorization_endpoint")),
+		...optional("deviceAuthorizationEndpoint", endpoint("device_authorization_endpoint")),
+		...optional("tokenEndpoint", endpoint("token_endpoint")),
+		...optional("revocationEndpoint", endpoint("revocation_endpoint")),
+		...optional("registrationEndpoint", endpoint("registration_endpoint"))
+	};
+}
+function optional(key, value) {
+	return value === void 0 ? {} : { [key]: value };
+}
+/**
+* An endpoint must be `https:`, except on a loopback issuer, which a local
+* Cloud serves over plain HTTP.
+*/
+function isHttps(value, issuer) {
+	try {
+		const url = new URL(value);
+		if (url.protocol === "https:") return true;
+		const host = new URL(issuer).hostname;
+		return url.protocol === "http:" && (host === "localhost" || host === "127.0.0.1" || host === "[::1]");
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/cli/cloud/auth.ts
+/** The service name credentials are stored under, in the keychain or the config directory. */
+const CREDENTIAL_SERVICE = "permdock";
+/** Seconds before `expires_at` at which a stored access token counts as expired. */
+const EXPIRY_SKEW_SECONDS = 30;
+const KEYRING_PACKAGE = "@napi-rs/keyring";
+function cliRuntime(io, env) {
+	const now = io.now;
+	return {
+		env,
+		...io.fetch === void 0 ? {} : { fetch: io.fetch },
+		...now === void 0 ? {} : { now: () => ({ epochMilliseconds: now().getTime() }) }
+	};
+}
+/**
+* `Entry` from the optional peer `@napi-rs/keyring` when the project installed
+* it; without it credentials go to the mode-0600 file.
+*/
+async function loadKeyring() {
+	let loaded;
+	try {
+		loaded = await import(KEYRING_PACKAGE);
+	} catch {
+		return;
+	}
+	if (!isRecord(loaded) || typeof loaded["Entry"] !== "function") return;
+	return loaded["Entry"];
+}
+async function credentialStorage() {
+	const keyring = await loadKeyring();
+	return keyring === void 0 ? { service: CREDENTIAL_SERVICE } : {
+		service: CREDENTIAL_SERVICE,
+		keyring
+	};
+}
+/** The git work tree `cwd` sits in, or `null` outside one. */
+function repositoryRoot(cwd) {
+	let dir = path.resolve(cwd);
+	for (;;) {
+		if (existsSync(path.join(dir, ".git"))) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** The credentials file when it would land inside the repository at `cwd`; `null` when it is outside. */
+function credentialsInsideRepository(cwd, runtime) {
+	const root = repositoryRoot(cwd);
+	if (root === null) return null;
+	const file = path.resolve(credentialsPath(CREDENTIAL_SERVICE, runtime));
+	return file.startsWith(`${root}${path.sep}`) ? file : null;
+}
+function scopesOf(credential) {
+	return (credential.scope ?? "").split(" ").filter((scope) => scope !== "");
+}
+function authRequired(message, login, ci) {
+	return new CliError("action", message, {
+		code: "auth_required",
+		next: [{
+			command: login,
+			when: "to log in on this machine"
+		}, {
+			command: ci,
+			when: "in CI"
+		}]
+	});
+}
+/** The stored login for `issuer`, refreshed when its access token has expired. */
+async function storedLogin(issuer, runtime) {
+	const storage = await credentialStorage();
+	const credential = readCredentials(storage, issuer, runtime);
+	if (credential === null) return null;
+	const now = secondsAt(runtime.now?.());
+	if (credential.expires_at === void 0 || credential.expires_at - EXPIRY_SKEW_SECONDS > now) return credential;
+	const metadata = await issuerMetadata(issuer, runtime);
+	const refreshed = metadata?.tokenEndpoint === void 0 ? null : await refreshCredential({
+		clientId: CLI_CLIENT_ID,
+		tokenEndpoint: metadata.tokenEndpoint
+	}, credential, runtime);
+	if (refreshed === null) return "expired";
+	const kept = {
+		...refreshed,
+		...refreshed.refresh_token === void 0 && credential.refresh_token !== void 0 ? { refresh_token: credential.refresh_token } : {},
+		...refreshed.scope === void 0 && credential.scope !== void 0 ? { scope: credential.scope } : {}
+	};
+	writeCredentials(storage, issuer, kept, runtime);
+	return kept;
+}
+/**
+* The bearer for the read API: `PERMDOCK_CLOUD_TOKEN` (a read-only key pinned
+* to one environment, for CI), then the stored login for `issuer`. Throws an
+* `auth_required` error when there is neither.
+*/
+async function readAuth(command, issuer, env, runtime) {
+	const token = env["PERMDOCK_CLOUD_TOKEN"];
+	if (token !== void 0 && token !== "") return {
+		bearer: token,
+		source: "PERMDOCK_CLOUD_TOKEN"
+	};
+	const login = await storedLogin(issuer, runtime);
+	if (login === "expired" || login === null) throw authRequired(login === null ? `${command} needs a login: run permdock login, or set PERMDOCK_CLOUD_TOKEN in CI` : `${command}: the login for ${issuer} has expired; run permdock login`, "permdock login", "export PERMDOCK_CLOUD_TOKEN=<read-only key>");
+	return {
+		bearer: login.access_token,
+		source: "login"
+	};
+}
+/** The bearer for `cloud push`: `PERMDOCK_CLOUD_KEY`, then a login holding `catalog:write`. */
+async function pushAuth(issuer, env, runtime) {
+	const key = env["PERMDOCK_CLOUD_KEY"];
+	if (key !== void 0 && key !== "") return {
+		bearer: key,
+		source: "PERMDOCK_CLOUD_KEY"
+	};
+	const login = await storedLogin(issuer, runtime);
+	if (login === "expired" || login === null || !scopesOf(login).includes("catalog:write")) throw authRequired(login === "expired" ? `permdock cloud push: the login for ${issuer} has expired; run permdock login --scope ${WRITE_SCOPE}` : login === null ? `permdock cloud push needs PERMDOCK_CLOUD_KEY in the environment, or a login from permdock login --scope ${WRITE_SCOPE}` : `permdock cloud push needs ${WRITE_SCOPE}: run permdock login --scope ${WRITE_SCOPE}`, `permdock login --scope ${WRITE_SCOPE}`, "export PERMDOCK_CLOUD_KEY=<write key>");
+	return {
+		bearer: login.access_token,
+		source: "login"
+	};
+}
+//#endregion
+export { pushAuth as a, READ_SCOPES as c, issuerMetadata as d, credentialsInsideRepository as i, cloudUrl as l, cliRuntime as n, readAuth as o, credentialStorage as r, CLI_CLIENT_ID as s, CREDENTIAL_SERVICE as t, firstNonEmpty as u };

package/dist/authzen/index.d.ts

@@ -1,9 +1,10 @@
-import { E as Policy, Or as Principal } from "../policy-types-sp9P1iIV.js";
-import { f as ApprovalStore } from "../types-Br9IXUBG.js";
-import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-C_1vdSZc.js";
 //#region src/authzen/types.d.ts
 type AuthzenResourceAdapter = {
-  readonly load?: (id: string) => unknown;
+  readonly data?: (id: string) => unknown;
   readonly list?: (query: {
     readonly where?: unknown;
   }) => readonly unknown[] | Promise<readonly unknown[]>;
@@ -29,11 +30,30 @@ type AuthzenPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly maxEvaluations?: number;
 };
 type AuthzenPermDock = {
-  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly permdockHandler: () => (request: Request) => Promise<Response>;
 };
 type AuthzenFactory = <TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: AuthzenPermDockOptions<TUser>) => AuthzenPermDock;
 //#endregion
 //#region src/authzen/create.d.ts
 export declare const createPermDock: AuthzenFactory;
 //#endregion
-export type { AuthzenFactory, AuthzenPermDock, AuthzenPermDockOptions, AuthzenResourceAdapter, AuthzenSubjectRecord };
+//#region src/authzen/map.d.ts
+type AuthzenEntity = {
+  readonly type?: unknown;
+  readonly id?: unknown;
+  readonly properties?: unknown;
+  readonly name?: unknown;
+};
+type AuthzenItem = {
+  readonly subject?: AuthzenEntity;
+  readonly action?: AuthzenEntity;
+  readonly resource?: AuthzenEntity;
+  readonly context?: unknown;
+};
+/**
+ * One item of an `evaluations` batch with the request's top-level `subject`,
+ * `action`, `resource` and `context` filled in where the item omits them.
+ */
+export declare function mergeEvaluationItem(shared: AuthzenItem, item: unknown): AuthzenItem;
+//#endregion
+export { type AuthzenEntity, type AuthzenFactory, type AuthzenItem, type AuthzenPermDock, type AuthzenPermDockOptions, type AuthzenResourceAdapter, type AuthzenSubjectRecord, EVALUATIONS_SEMANTICS, type EvaluationsSemantic, evaluateBatch, evaluationsSemantic };