permdock 0.6.0 → 0.7.0

package/dist/{role-builder-uWQZ4v84.js → role-builder-C1VJzvcr.js}

@@ -1,13 +1,13 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as isConditionRef, l as isSqlFunctionField, n as isSubjectRef, o as isCondition, s as isConditionDate } from "./refs-K6eWUJ0H.js";
+import { c as isConditionDate, l as isConditionRef, r as isSubjectRef, s as isCondition, u as isSqlFunctionField } from "./refs-CNJBiTFo.js";
 import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-CqPOLD-o.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
 import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, r as assertDuration } from "./time-DkWjdL98.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-hxrUsbpM.js";
+import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-BrRANrpT.js";
 import { c as sanitizeFields, n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {

package/dist/rolldown-runtime-C3I60J0A.js

@@ -0,0 +1,4 @@
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
+//#endregion
+export { __commonJSMin as t };

package/dist/{rpc-VSl5ylaQ.js → rpc-Bk1bE-ch.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-BBoKefeS.js";
 import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as adapterKernel } from "./bind-CAvgUuKs.js";
+import { t as adapterKernel } from "./bind-D1nO6fiC.js";
 import { r as guardIterable } from "./stream-CvdUS9V1.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/run-Bz7DXGEv.js

@@ -0,0 +1 @@
+export { t as run } from "./run-uLD2aWuO.js";

package/dist/{run-ticket-sxFI6LAk.js → run-ticket-B5d_63Ma.js}

@@ -7,6 +7,27 @@ import { n as toWireDelegation, t as fromWireDelegation } from "./wire-delegatio
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/server/run-ticket.ts
 const RUN_TICKET_TYP = "vnd.permdock.run+jwt";
+/**
+* Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps.
+* A signing service passes only these to its signer.
+*/
+const RUN_TICKET_CLAIMS = Object.freeze([
+	"v",
+	"iss",
+	"sub",
+	"aud",
+	"jti",
+	"iat",
+	"exp",
+	"kind",
+	"act",
+	"scope",
+	"authorization_details",
+	"automation",
+	"tenant",
+	"trigger",
+	"binding"
+]);
 const RUN_KINDS = [
 	"automation",
 	"job",
@@ -334,4 +355,4 @@ async function subjectFromRunTicket(token, options) {
 	}));
 }
 //#endregion
-export { signRunTicket as n, subjectFromRunTicket as r, parseRunTicket as t };
+export { subjectFromRunTicket as i, parseRunTicket as n, signRunTicket as r, RUN_TICKET_CLAIMS as t };

package/dist/{run-ticket-DocwaTKn.d.ts → run-ticket-BpNi7BCi.d.ts}

@@ -1,5 +1,5 @@
-import { $n as Delegation, Rt as Instant, Yn as AuthorizationDetail, ar as Subject, dt as TokenVerifier, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
+import { $n as AuthorizationDetail, Rt as Instant, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
 //#region src/server/run-ticket.d.ts
 /** What started the run: a saved automation, a background job, or a caller's own request. */
 type RunKind = "automation" | "job" | "caller";
@@ -38,6 +38,11 @@ type RunTicket = {
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
 };
+/**
+ * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps.
+ * A signing service passes only these to its signer.
+ */
+declare const RUN_TICKET_CLAIMS: readonly (keyof RunTicket)[];
 type RunTicketInput = {
   /** The principal the run acts for (`sub`). */
   readonly principal: string;
@@ -121,4 +126,4 @@ declare function signRunTicket(input: RunTicketInput, signer: TokenSigner, optio
  */
 declare function subjectFromRunTicket(token: string | undefined | null, options: RunTicketSubjectOptions): Promise<Subject<RunPrincipal>>;
 //#endregion
-export { RunKind as a, RunTicketAutomations as c, RunTicketOptions as d, RunTicketSubjectOptions as f, subjectFromRunTicket as h, RunContext as i, RunTicketFailureCause as l, signRunTicket as m, RunAutomation as n, RunPrincipal as o, parseRunTicket as p, RunBinding as r, RunTicket as s, RunActClaim as t, RunTicketInput as u };
+export { RunContext as a, RunTicket as c, RunTicketInput as d, RunTicketOptions as f, subjectFromRunTicket as g, signRunTicket as h, RunBinding as i, RunTicketAutomations as l, parseRunTicket as m, RunActClaim as n, RunKind as o, RunTicketSubjectOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketFailureCause as u };

package/dist/{run-CUKuz0A8.js → run-uLD2aWuO.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-CWTY6uih.js";
+import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-DpP_U6Bf.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as resolveCwd, i as readConfig } from "./config-bs_kZeYq.js";
+import { a as resolveCwd, i as readConfig } from "./config-CoQHDrDi.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-IIolxxKA.js";
-import { r as progressReporter, t as redact } from "./credentials-DPyHmYz5.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
-import { t as createStyle } from "./style-Uao76wO7.js";
-import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-1im__-08.js";
+import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-CC3OwyHW.js";
+import { r as progressReporter, t as redact } from "./credentials-BpuTwd7a.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { t as createStyle } from "./style-Cqo7-73x.js";
+import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-DgSDLrta.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{runtime-D3VTAiCA.js → runtime-Vif3_-zf.js}

@@ -1,4 +1,4 @@
-import { l as scopedTenant, s as protectedView } from "./views-DTIIO-oQ.js";
+import { l as scopedTenant, s as protectedView } from "./views-BB8E9dTP.js";
 //#region src/svelte/protected.ts
 /** The instance for `tenant`, built once per store change rather than once per check. */
 function scopedFor(store, tenant, _generation) {

package/dist/{saas-BCXRuXca.js → saas-Az_Kz-4D.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as principal } from "./refs-K6eWUJ0H.js";
-import { a as deny, n as role, r as allow } from "./role-builder-uWQZ4v84.js";
-import { E as memoryCustomRoleSource, _ as limits, g as memoryRelationSource, v as memoryLimitStore } from "./src-Cu2m75uo.js";
+import { i as principal } from "./refs-CNJBiTFo.js";
+import { a as deny, n as role, r as allow } from "./role-builder-C1VJzvcr.js";
+import { A as memoryCustomRoleSource, S as memoryLimitStore, b as memoryRelationSource, x as limits } from "./src-DLFrtrrC.js";
 import { h as secondsAt } from "./time-DkWjdL98.js";
-import { l as relation, n as anyone } from "./grantee-hxrUsbpM.js";
-import { n as definePolicy } from "./policy-DbM5YYtV.js";
-import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-BPxlwVhN.js";
+import { l as relation, n as anyone } from "./grantee-BrRANrpT.js";
+import { n as definePolicy } from "./policy-DaJy4nK4.js";
+import { s as quoteSqlLiteral } from "./sql-B96movIM.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-DArULThq.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/{scan-qvOe0hS3.js → scan-DSljDE1Y.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-DCYe60Pi.js");
+		const { runAdoptionScan } = await import("./adoption-scan-D-feE7BE.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-yLuBWWsh.js → schema-gIcCx7zM.js}

@@ -1,7 +1,7 @@
-import { t as require__2020 } from "./2020-C9VN-x8c.js";
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
 import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/openapi/schema.ts

package/dist/scim/index.d.ts

@@ -1,2 +1,3 @@
-import { A as ScimPage, C as GROUP_SCHEMA, D as SCIM_CONTENT_TYPE, E as ROLES_EXTENSION, F as isDirectoryNotFoundError, I as isDirectoryUniquenessError, M as ScimPatchOp, N as ScimTokenOptions, O as ScimFilter, P as USER_SCHEMA, S as ERROR_SCHEMA, T as PATCH_SCHEMA, _ as DirectoryMembershipSourceOptions, a as scimHandler, b as DirectoryUniquenessError, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryGroup, h as DirectoryChange, i as tenantFromPath, j as ScimPageResult, k as ScimHandlerOptions, l as resourceTypes, m as APP_DATA_EXTENSION, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryNotFoundError, w as LIST_SCHEMA, x as DirectoryUser, y as DirectoryStore } from "../index-Ch8LpNDp.js";
-export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };
+import { t as SqlQuery } from "../sql-CDEPCA0g.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-DH9DUDEM.js";
+export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1 +1,3 @@
-export { f as APP_DATA_EXTENSION, p as DirectoryNotFoundError, m as DirectoryUniquenessError, h as ERROR_SCHEMA, g as GROUP_SCHEMA, _ as LIST_SCHEMA, v as PATCH_SCHEMA, y as ROLES_EXTENSION, b as SCIM_CONTENT_TYPE, x as USER_SCHEMA, w as authenticateScim, n as directoryMembershipSource, o as filterSupported, S as isDirectoryNotFoundError, C as isDirectoryUniquenessError, s as matchFilter, t as memoryDirectoryStore, a as normalizePatchOps, c as parseScimFilter, l as resourceTypes, u as schemas, r as scimHandler, d as serviceProviderConfig, T as sha256Hex, i as tenantFromPath } from "../scim-ClHtpyV3.js";
+import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-YNieBO1U.js";
+import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-BL9M_CA1.js";
+export { APP_DATA_EXTENSION, DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim-C7JYhySg.js

@@ -0,0 +1,44 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-aaeRAdiD.js";
+//#region src/cli/commands/scim.ts
+const generate = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write, - for stdout (default supabase/schemas/<schema>/scim.sql, else permdock_scim.sql)",
+			valueHint: "file"
+		},
+		dialect: {
+			type: "enum",
+			options: [
+				"supabase",
+				"neon",
+				"guc"
+			],
+			description: "Which client roles lose access to the tables (default rls.dialect, else supabase)"
+		},
+		schema: {
+			type: "string",
+			description: "Schema for the directory tables (default rls.schema, else permdock)",
+			valueHint: "name"
+		},
+		...checkFlag,
+		...dryRunFlag
+	},
+	async run(ctx, { flags }) {
+		const out = given(flags.out);
+		const schema = given(flags.schema);
+		const { runScimGenerate } = await import("./generate-3FNO5P5Q.js");
+		return runScimGenerate({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			check: flags.check,
+			dryRun: flags["dry-run"],
+			...out === void 0 ? {} : { out },
+			...schema === void 0 ? {} : { schema },
+			...flags.dialect === void 0 ? {} : { dialect: flags.dialect }
+		});
+	}
+});
+//#endregion
+export { generate };