permdock 0.5.0 → 0.7.0

package/dist/{credential-DM2um3ha.js → credential-CIM7wHwA.js}

@@ -3,12 +3,12 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as ownRecord } from "./paths-DXSHAMIa.js";
 import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
 import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
 /** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */

package/dist/{credentials-DPyHmYz5.js → credentials-BpuTwd7a.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
 //#region src/cli/core/io.ts
 const FRAMES = [
 	"⠋",

package/dist/{deciding-columns-Sq12mEA6.js → deciding-columns-DRo2QM6E.js}

@@ -1,3 +1,4 @@
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 //#region src/cli/sql/statements.ts
 function blankComments(sql) {
 	return sql.replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
@@ -86,9 +87,11 @@ function tableKey(name) {
 * membership (user, scope, id, `within`, role, `via`, expiry), and the id and
 * value columns of a table a role or user column references, keyed by
 * {@link tableKey}. A client that can write one can give itself a membership.
+* The hook's sources count even when `rls.membershipSources` replaces them
+* for the helpers: the token's claims still come from them.
 */
 function membershipColumns(config) {
-	const sources = config.supabase?.hook?.memberships ?? config.rls?.membershipSources ?? [];
+	const sources = /* @__PURE__ */ new Set([...membershipSourcesOf(config), ...config.supabase?.hook?.memberships ?? []]);
 	const byTable = /* @__PURE__ */ new Map();
 	for (const source of sources) {
 		const table = tableKey(source.sql.table);
@@ -110,13 +113,21 @@ function membershipColumns(config) {
 * Every `schema.table.column` a claim or a membership is computed from: the
 * membership columns and the `attrs` table columns. Sorted.
 */
-function decidingColumns(config, attrs) {
+function decidingColumns(config, attrs, teams) {
 	const entries = /* @__PURE__ */ new Set();
 	for (const [table, columns] of membershipColumns(config)) for (const column of columns) entries.add(`${table}.${column}`);
 	if (attrs?.table !== void 0) {
 		const table = tableKey(attrs.table);
 		for (const column of attrs.columns) entries.add(`${table}.${column}`);
 	}
+	if (teams !== void 0) {
+		const table = tableKey(teams.table);
+		for (const column of [
+			teams.user,
+			teams.team,
+			teams.tenant
+		]) if (column !== void 0) entries.add(`${table}.${column}`);
+	}
 	return [...entries].toSorted();
 }
 //#endregion

package/dist/{delegation-DaXVdDhM.js → delegation-C5rOdTp5.js}

@@ -1,14 +1,14 @@
 import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-CNJBiTFo.js";
 import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { o as epochSeconds } from "./time-DkWjdL98.js";
-import { d as scopeList, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
 import { t as isoInstant } from "./instant-BluqDvyS.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
 import { t as isActive } from "./validity-CZ7-y0Cj.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-DzwivBgR.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-DX0LaKTb.js";
-import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-BcHcPyIo.js";
-export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, type ChatMessage, type ChatTransport, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type Recipient, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };
+import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-B-F-qAZk.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-g7Oy6Zg4.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-DLwcuCN_.js";
+export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,6 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
-import { n as subscribersFor, t as audience } from "../audience-Dg8XsRaO.js";
+import { n as subscribersFor, t as audience } from "../audience-BrMs8c4o.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-_VCSsdtD.js";
+import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-rwOKLWRm.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
-import { n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-DCAgNyCn.js";
-export { approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };
+export { CONNECTOR_KINDS, CONNECTOR_SCHEMA, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/{delivery-DCAgNyCn.js → delivery-rwOKLWRm.js}

@@ -1,10 +1,59 @@
-import { t as compact } from "./compact-CAf557ZB.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as ownRecord } from "./paths-DXSHAMIa.js";
 import { n as loadPrincipalByIdentity } from "./principal-source-pHneukrx.js";
 import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
 import { n as CLOUDEVENTS_CONTENT_TYPE } from "./sink-BEZSlMS_.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as CONNECTOR_SCHEMA } from "./connector-schema-_VCSsdtD.js";
 import { a as isWebhookAddress, i as isDeliveryTarget, n as isAddrSpec, r as isChatAddress, t as idempotencyKeyFor } from "./target-Bw37TFNA.js";
+//#region src/delivery/connector.ts
+const BRANCHES = new Map((CONNECTOR_SCHEMA.oneOf ?? []).map((branch) => [branch.properties?.["kind"]?.const, branch]));
+/** The kinds `connector-v1` lists, in schema order. */
+const CONNECTOR_KINDS = Object.freeze([...BRANCHES.keys()]);
+function pointer(path) {
+	return path.map((part) => `/${String(part).replaceAll("~", "~0").replaceAll("/", "~1")}`).join("");
+}
+function fail$1(issues) {
+	return {
+		ok: false,
+		issues: issues.map((item) => ({
+			path: pointer((item.path ?? []).map((part) => typeof part === "object" ? part.key : part)),
+			message: item.message
+		}))
+	};
+}
+/**
+* Checks `input` against `connector-v1.json` and answers a frozen copy, or
+* every issue with a JSON pointer. The branch is chosen by `kind`, so an
+* issue names the field rather than "no branch matched".
+*/
+function parseConnector(input) {
+	const issues = [];
+	const value = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	if (issues.length > 0) return fail$1(issues);
+	const forbidden = forbiddenKeyPath(value);
+	if (forbidden !== void 0) return fail$1([{
+		path: forbidden,
+		message: "Forbidden key"
+	}]);
+	if (!isRecord(value)) return fail$1([{
+		path: [],
+		message: "Expected object"
+	}]);
+	const branch = BRANCHES.get(value["kind"]);
+	if (branch === void 0) return fail$1([{
+		path: ["kind"],
+		message: `Expected one of ${CONNECTOR_KINDS.map((kind) => JSON.stringify(kind)).join(", ")}`
+	}]);
+	checkSchema(branch, value, [], issues, CONNECTOR_SCHEMA);
+	if (issues.length > 0) return fail$1(issues);
+	return {
+		ok: true,
+		connector: freezeDeep(value)
+	};
+}
+//#endregion
 //#region src/delivery/memory-transport.ts
 /** An in-process transport for tests and examples: it records what it would have sent. */
 function memoryDeliveryTransport(channel, options = {}) {
@@ -496,4 +545,4 @@ function webhookTransport(signer, options = {}) {
 	});
 }
 //#endregion
-export { createPermDock as n, memoryDeliveryTransport as r, webhookTransport as t };
+export { parseConnector as a, CONNECTOR_KINDS as i, createPermDock as n, memoryDeliveryTransport as r, webhookTransport as t };

package/dist/{denied-text-D8jDHgsl.d.ts → denied-text-D4qkEtFz.d.ts}

@@ -1,5 +1,5 @@
-import { Nn as Decision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { Ln as Decision } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
 //#region src/agent/denied-text.d.ts
 /** What an agent adapter's `deniedText` receives: the refusal and the text PermDock wrote for it. */
 type DeniedTextEvent = {

package/dist/{describe-BybMRY7A.js → describe-DZlnEtLy.js}

@@ -4,6 +4,7 @@ import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
 const TENANT_REASONS = /* @__PURE__ */ new Set([
 	"tenant-mismatch",
 	"no-membership",
+	"no-tenant",
 	"expired-membership",
 	"scope"
 ]);

package/dist/{describe-BZUsixiL.d.ts → describe-O0SwYIK8.d.ts}

@@ -1,5 +1,5 @@
-import { In as DenialReason, Ln as DeniedDecision, Nn as Decision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {
   readonly kind: "granted" | "denied" | "approval" | "tenant" | "delegation" | "server-only" | "upgrade";

package/dist/{diff-CxZo9pTq.js → diff-Btr1c1Ow.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-C3DktBDY.js";
+import { c as given } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/diff.ts
 const diff = defineLeaf({
 	positionals: [{
@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-DCePiN6M.js")).runDiff({
+		return (await import("./diff-DzT-xD13.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-DCePiN6M.js → diff-DzT-xD13.js}

@@ -1,14 +1,14 @@
-import { E as memoryCustomRoleSource } from "./src-DLfUWFAI.js";
-import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { A as memoryCustomRoleSource } from "./src-DLFrtrrC.js";
+import { n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { g as secondsOf } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
-import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
-import { t as buildCatalog } from "./catalog-doc-C9wjsfNY.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { t as operationFindings } from "./operation-findings-DgATDpvh.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { t as getPermDock } from "./permdock-BfWEeMqk.js";
+import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
+import { t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
+import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
+import { t as operationFindings } from "./operation-findings-kRcEp8lE.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts