permdock 0.4.0 → 0.6.0

package/dist/{role-builder-B4GbKM-i.js → role-builder-uWQZ4v84.js}

@@ -1,14 +1,14 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as assertSafeKey, c as ownKeys, o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
-import { c as isConditionRef, l as isSqlFunctionField, n as isSubjectRef, o as isCondition, s as isConditionDate } from "./refs-f3imMjNW.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, l as isSqlFunctionField, n as isSubjectRef, o as isCondition, s as isConditionDate } from "./refs-K6eWUJ0H.js";
 import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-CqPOLD-o.js";
-import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-CV8pqqMi.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-BsblpB-z.js";
-import { d as isSelfParented } from "./resource-relations-D1Un3pcz.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-CXY-0C87.js";
-import { n as normalizeValidity, o as sanitizeFields } from "./validity-dVrUEPJt.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
+import { a as durationOf, r as assertDuration } from "./time-DkWjdL98.js";
+import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-hxrUsbpM.js";
+import { c as sanitizeFields, n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {
 	return freezeDeep({
@@ -257,7 +257,7 @@ function normalizeApproval(approval, permission) {
 	if (approval.staleOn !== void 0 && approval.staleOn !== "resource-change") throw new Error(`PermDock: approval staleOn must be 'resource-change', got '${String(approval.staleOn)}'`);
 	const label = permission ?? "a grant";
 	assertQuorum(approval.quorum, "approval.quorum", label);
-	if (approval.ttl !== void 0 && parseDuration(approval.ttl) === void 0) throw new Error(`PermDock: approval.ttl on '${label}' must be a duration such as '30m', got '${approval.ttl}'`);
+	if (approval.ttl !== void 0) assertDuration(approval.ttl, `approval.ttl on '${label}'`);
 	const escalation = normalizeEscalation(approval.escalation, label);
 	const mode = approval.mode ?? "any";
 	if (mode !== "any") return compact({
@@ -301,7 +301,7 @@ function normalizeStages(approval, mode, label) {
 }
 function normalizeEscalation(escalation, label) {
 	if (escalation === void 0) return;
-	if (parseDuration(escalation.after) === void 0) throw new Error(`PermDock: approval.escalation.after on '${label}' must be a duration such as '4h', got '${escalation.after}'`);
+	assertDuration(escalation.after, `approval.escalation.after on '${label}'`);
 	return {
 		after: escalation.after,
 		to: asApprover(escalation.to)
@@ -359,47 +359,12 @@ function approverRelationResource(start, through, resources) {
 	return current;
 }
 //#endregion
-//#region src/core/limits.ts
-const UNIT_SECONDS = {
-	s: 1,
-	sec: 1,
-	secs: 1,
-	second: 1,
-	seconds: 1,
-	m: 60,
-	min: 60,
-	mins: 60,
-	minute: 60,
-	minutes: 60,
-	h: 3600,
-	hr: 3600,
-	hrs: 3600,
-	hour: 3600,
-	hours: 3600,
-	d: 86400,
-	day: 86400,
-	days: 86400
-};
-function isThenable(value) {
-	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
-}
-const PER_PATTERN = /^(\d+)\s*(s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days)$/u;
-/** The window length of `per` in seconds, or `undefined` when unrecognised. */
-function limitWindowSeconds(per) {
-	const trimmed = per.trim().toLowerCase();
-	const named = UNIT_SECONDS[trimmed];
-	if (named !== void 0) return named;
-	const match = PER_PATTERN.exec(trimmed);
-	if (match === null) return;
-	const amount = Number(match[1]);
-	const unit = UNIT_SECONDS[match[2] ?? ""];
-	return unit !== void 0 && Number.isSafeInteger(amount) && amount > 0 ? amount * unit : void 0;
-}
+//#region src/core/limit-grants.ts
 /** Throws at definition time for a `limit` no store could count. */
 function assertLimit(limit, permissionKey) {
 	if (limit === void 0) return;
 	if (!Number.isSafeInteger(limit.count) || limit.count <= 0) throw new Error(`PermDock: limit count on '${permissionKey}' must be a positive integer`);
-	if (limitWindowSeconds(limit.per) === void 0) throw new Error(`PermDock: limit per '${limit.per}' on '${permissionKey}' is not a duration such as 'hour' or '15 min'`);
+	if (durationOf(limit.per) === void 0) throw new Error(`PermDock: limit per on '${permissionKey}' must be a whole number of seconds above 0 (3600 for an hour), got ${JSON.stringify(limit.per)}`);
 	if (limit.mode !== void 0 && limit.mode !== "hard" && limit.mode !== "soft") throw new Error(`PermDock: limit mode on '${permissionKey}' must be 'hard' or 'soft'`);
 	if (limit.alertAt !== void 0 && (typeof limit.alertAt !== "number" || !(limit.alertAt > 0 && limit.alertAt <= 1))) throw new Error(`PermDock: limit alertAt on '${permissionKey}' must be a fraction above 0 and at most 1`);
 }
@@ -413,165 +378,6 @@ function normalizeLimit(limit) {
 		...limit.alertAt === void 0 ? {} : { alertAt: limit.alertAt }
 	};
 }
-function limitWindowId(per, now) {
-	const seconds = limitWindowSeconds(per);
-	return seconds === void 0 ? void 0 : String(Math.floor(now / seconds));
-}
-function limitCacheKey(input, now) {
-	const window = limitWindowId(input.per, now);
-	return window === void 0 ? void 0 : JSON.stringify([
-		input.tenant ?? null,
-		input.subjectId,
-		input.key,
-		input.per,
-		window
-	]);
-}
-function locate(input) {
-	const now = input.now ?? Date.now() / 1e3;
-	const seconds = limitWindowSeconds(input.per);
-	const id = limitCacheKey(input, now);
-	if (seconds === void 0 || id === void 0) return;
-	return {
-		id,
-		until: (Math.floor(now / seconds) + 1) * seconds,
-		now
-	};
-}
-function memoryLimitStore() {
-	const used = /* @__PURE__ */ new Map();
-	let earliest = Number.POSITIVE_INFINITY;
-	const sweep = (now) => {
-		if (now < earliest) return;
-		earliest = Number.POSITIVE_INFINITY;
-		for (const [id, entry] of used) if (entry.until <= now) used.delete(id);
-		else earliest = Math.min(earliest, entry.until);
-	};
-	return {
-		remaining(input) {
-			const cap = input.count;
-			const slot = locate(input);
-			if (!Number.isFinite(cap) || cap <= 0 || slot === void 0) return { remaining: -1 };
-			return { remaining: cap - (used.get(slot.id)?.count ?? 0) };
-		},
-		consume(input) {
-			const cap = input.count;
-			const slot = locate(input);
-			if (!Number.isFinite(cap) || cap <= 0 || slot === void 0) return { remaining: -1 };
-			sweep(slot.now);
-			const seen = used.get(slot.id)?.count ?? 0;
-			if (seen >= cap) return { remaining: -1 };
-			used.set(slot.id, {
-				count: seen + 1,
-				until: slot.until
-			});
-			earliest = Math.min(earliest, slot.until);
-			return { remaining: cap - seen - 1 };
-		},
-		size() {
-			return used.size;
-		}
-	};
-}
-/**
-* `left` is what remains once this call counts: the store's answer after
-* `consume`, or one less than `remaining` when only peeking. Below zero the
-* call is past the count.
-*/
-function verdictFor(limit, left, now) {
-	const seconds = limitWindowSeconds(limit.per);
-	if (seconds === void 0) return {
-		ok: false,
-		reason: "limit-unavailable"
-	};
-	const resetsAt = (Math.floor(now / seconds) + 1) * seconds;
-	if (left < 0) return limit.mode === "soft" ? {
-		ok: true,
-		quota: {
-			remaining: 0,
-			resetsAt
-		},
-		obligations: [{ kind: "over-limit" }]
-	} : {
-		ok: false,
-		reason: "limit",
-		detail: {
-			count: limit.count,
-			window: seconds,
-			resetsAt
-		}
-	};
-	return limit.alertAt !== void 0 && (limit.count - left) / limit.count >= limit.alertAt ? {
-		ok: true,
-		quota: {
-			remaining: left,
-			resetsAt
-		},
-		obligations: [{ kind: "near-limit" }]
-	} : {
-		ok: true,
-		quota: {
-			remaining: left,
-			resetsAt
-		}
-	};
-}
-function applyQuota(input) {
-	const limit = input.grant.limit;
-	if (limit === void 0) return { ok: true };
-	if (input.store === void 0) return {
-		ok: false,
-		reason: "limit-unavailable"
-	};
-	const payload = {
-		key: input.permissionKey,
-		subjectId: input.subjectId,
-		count: limit.count,
-		per: limit.per,
-		now: input.now,
-		...input.tenant === void 0 ? {} : { tenant: input.tenant }
-	};
-	const cacheKey = limitCacheKey(payload, input.now);
-	if (cacheKey === void 0) return {
-		ok: false,
-		reason: "limit-unavailable"
-	};
-	if (!input.consume) {
-		try {
-			const peeked = input.store.remaining(payload);
-			if (isThenable(peeked)) return {
-				ok: false,
-				reason: "limit-unavailable"
-			};
-			if (peeked !== void 0) return verdictFor(limit, peeked.remaining - 1, input.now);
-		} catch {
-			return {
-				ok: false,
-				reason: "limit-unavailable"
-			};
-		}
-		const cached = input.cache.get(cacheKey);
-		if (cached === void 0) return {
-			ok: false,
-			reason: "limit-unavailable"
-		};
-		return verdictFor(limit, cached - 1, input.now);
-	}
-	try {
-		const consumed = input.store.consume(payload);
-		if (isThenable(consumed)) return {
-			ok: false,
-			reason: "limit-unavailable"
-		};
-		input.cache.set(cacheKey, consumed.remaining);
-		return verdictFor(limit, consumed.remaining, input.now);
-	} catch {
-		return {
-			ok: false,
-			reason: "limit-unavailable"
-		};
-	}
-}
 //#endregion
 //#region src/core/grant-builders.ts
 function isClosure(value) {
@@ -766,6 +572,7 @@ function normalizeActivation(roleName, option) {
 	if (option === void 0) return;
 	const justification = option.justification ?? "optional";
 	if (justification !== "required" && justification !== "optional") throw new Error(`PermDock: role '${roleName}' activation justification must be 'required' or 'optional'`);
+	if (option.maxDuration !== void 0) assertDuration(option.maxDuration, `activation.maxDuration on role '${roleName}'`);
 	return compact({
 		maxDuration: option.maxDuration,
 		justification,
@@ -813,4 +620,4 @@ function roleRules(roleName, scope, options) {
 	});
 }
 //#endregion
-export { assertSqlFunctionName as _, deny as a, withGrantSchema as c, assertApprovalRelations as d, assertApprovalVersions as f, assertSqlFunctionArg as g, assertPortableTwin as h, completeGrant as i, applyQuota as l, normalizeWhere as m, role as n, flattenGrants as o, normalizeApproval as p, allow as r, flattenPermissions as s, normalizeAssurance as t, memoryLimitStore as u, opaque as v };
+export { opaque as _, deny as a, withGrantSchema as c, assertApprovalVersions as d, normalizeApproval as f, assertSqlFunctionName as g, assertSqlFunctionArg as h, completeGrant as i, asApprover as l, assertPortableTwin as m, role as n, flattenGrants as o, normalizeWhere as p, allow as r, flattenPermissions as s, normalizeAssurance as t, assertApprovalRelations as u };

package/dist/{rpc-nYC3cR_u.js → rpc-VSl5ylaQ.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-BBoKefeS.js";
-import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { t as adapterKernel } from "./bind-kk-uyCwH.js";
-import { n as guardIterable } from "./stream-BMui98KK.js";
+import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
+import { t as adapterKernel } from "./bind-CAvgUuKs.js";
+import { r as guardIterable } from "./stream-CvdUS9V1.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */
 function rpcCode(status) {
@@ -58,13 +58,13 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 		const opts = optsByRequest.get(request);
 		return opts === void 0 ? { tenant: void 0 } : scopeOf(opts);
 	});
-	const guard = async (permission, loadData, opts, protectOptions) => {
+	const guard = async (permission, data, opts, protectOptions) => {
 		const request = bind(opts);
 		const scope = await scopeOf(opts);
 		return {
 			request,
 			scope,
-			guard: await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope)
+			guard: await kernel.protect(permission, data === void 0 ? void 0 : () => data(opts), protectOptions)(request, scope)
 		};
 	};
 	const evaluate = (request, opts) => {
@@ -84,10 +84,10 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 	};
 }
 /** Wraps a streamed result so revocation ends it and items the subscriber cannot read drop. */
-async function guardStream(source, open, permission, loadData, protectOptions, guard) {
+async function guardStream(source, open, permission, data, protectOptions, guard) {
 	const conn = await open(permission === null ? {} : compact({
 		permission,
-		data: loadData
+		data
 	}));
 	return guardIterable(source, conn, compact({
 		items: protectOptions?.items,