permdock 0.6.0 → 0.8.0

package/dist/connector-schema-CYLQNMYq.js

@@ -0,0 +1,434 @@
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+//#region src/delivery/connector-schema.ts
+/**
+* `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
+* `oneOf` branch per kind with a closed `config`. Only the `otlp` and `siem`
+* `headers` maps hold a secret; a store seals their values and lists names
+* only.
+*/
+const CONNECTOR_SCHEMA = freezeDeep({
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/connector-v1.json",
+	title: "PermDock Cloud connector",
+	description: "A connector on PermDock Cloud's /connectors route, wire format v1: the closed list of kinds, one branch per kind. Trusted issuers have their own route (/trusted-issuers).",
+	oneOf: [
+		{
+			description: "CloudEvents batches signed with Standard Webhooks.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "webhook" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["url"],
+					properties: {
+						url: {
+							type: "string",
+							pattern: "^https://"
+						},
+						types: {
+							type: "array",
+							items: {
+								type: "string",
+								minLength: 1
+							},
+							uniqueItems: true,
+							description: "CloudEvents types to deliver; all when absent."
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "OTLP/HTTP log records and spans with the permdock.* attributes.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "otlp" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["endpoint"],
+					properties: {
+						endpoint: {
+							type: "string",
+							pattern: "^https://"
+						},
+						headers: {
+							type: "object",
+							description: "Request headers sent to the collector, such as an Authorization header; write-only.",
+							additionalProperties: { type: "string" }
+						},
+						signals: {
+							type: "array",
+							items: { enum: ["logs", "traces"] },
+							minItems: 1,
+							uniqueItems: true
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "The OCSF projection posted to a SIEM ingest API.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "siem" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["destination", "endpoint"],
+					properties: {
+						destination: { enum: [
+							"splunk-hec",
+							"sentinel",
+							"security-lake",
+							"google-secops",
+							"elastic",
+							"datadog"
+						] },
+						endpoint: {
+							type: "string",
+							pattern: "^https://"
+						},
+						headers: {
+							type: "object",
+							description: "Request headers sent to the collector, such as the Splunk HEC Authorization or Datadog DD-API-KEY; write-only.",
+							additionalProperties: { type: "string" }
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "A scheduled decision-log export.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "evidence" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["format", "destination"],
+					properties: {
+						format: { enum: [
+							"jws",
+							"ocsf",
+							"csv"
+						] },
+						destination: {
+							type: "string",
+							pattern: "^https://"
+						},
+						schedule: { enum: ["hourly", "daily"] }
+					}
+				}
+			}
+		},
+		{
+			description: "A hosted SCIM 2.0 relay for one tenant, replayed to the application's scimHandler.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "scim" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["tenant", "target"],
+					properties: {
+						tenant: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						target: {
+							type: "string",
+							pattern: "^https://"
+						},
+						groupRoles: {
+							type: "object",
+							description: "Group id to declared assignable role.",
+							additionalProperties: {
+								type: "string",
+								minLength: 1,
+								maxLength: 256
+							}
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "An SSF transmitter whose SETs the Cloud receives (POST /ssf/receive/:connector, or poll).",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "caep-transmitter" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["issuer", "delivery"],
+					properties: {
+						issuer: {
+							type: "string",
+							pattern: "^https://"
+						},
+						jwks_uri: {
+							type: "string",
+							pattern: "^https://"
+						},
+						delivery: { enum: ["push", "poll"] },
+						poll_endpoint: {
+							type: "string",
+							pattern: "^https://"
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "An OIDC upstream the Cloud issuer federates to with authorization code plus PKCE.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "federated-upstream" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["discovery", "client_id"],
+					properties: {
+						discovery: {
+							type: "string",
+							pattern: "^https://"
+						},
+						client_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						scopes: {
+							type: "array",
+							items: {
+								type: "string",
+								minLength: 1
+							},
+							uniqueItems: true
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "Approval cards through the Vercel Chat SDK.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "chat" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["platform", "workspace"],
+					properties: {
+						platform: { enum: ["slack", "teams"] },
+						workspace: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						}
+					}
+				}
+			}
+		},
+		{
+			description: "The Cloud's hosted email sender for approval and delivery messages.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "email" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["from"],
+					properties: { from: {
+						type: "string",
+						pattern: "^[^@\\s]+@[^@\\s]+$"
+					} }
+				}
+			}
+		},
+		{
+			description: "Vercel OIDC federation tokens accepted as hosted ADS callers.",
+			type: "object",
+			required: [
+				"kind",
+				"name",
+				"config"
+			],
+			properties: {
+				id: {
+					type: "string",
+					minLength: 1,
+					maxLength: 256
+				},
+				kind: { const: "vercel-oidc" },
+				name: {
+					type: "string",
+					minLength: 1,
+					maxLength: 200
+				},
+				config: {
+					type: "object",
+					additionalProperties: false,
+					required: ["team_id"],
+					properties: {
+						team_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						project_id: {
+							type: "string",
+							minLength: 1,
+							maxLength: 256
+						},
+						environment: { enum: [
+							"production",
+							"preview",
+							"development"
+						] }
+					}
+				}
+			}
+		}
+	]
+});
+//#endregion
+export { CONNECTOR_SCHEMA as t };

package/dist/{context-B_u3_bDJ.js → context-BnIzxTNE.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { i as isPromiseLike } from "./store-options-u0ycEe8s.js";
-import { n as switchTenant, t as providerStore } from "./provider-store-DM6DNcta.js";
+import { a as isPromiseLike } from "./store-options-Dil3lraY.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-CaTv00tr.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts
@@ -36,7 +36,8 @@ function connectSvelteStore(options) {
 		maxAge: options.maxAge,
 		onSnapshot: options.onSnapshot,
 		onClear: options.onClear,
-		approvalInterval: options.approvalInterval
+		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn
 	}), () => ({
 		headers: typeof headers === "function" ? headers() : headers,
 		fetch: options.fetch,

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-zi_4T-rx.js";
+import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {
@@ -20,9 +20,15 @@ type ConvexQueryBuilder = (definition: {
 }) => unknown;
 type ConvexPermDockOptions<TCtx, TUser = unknown> = InstanceOptions & {
   readonly subject: ConvexSubject<TCtx, TUser>;
-  /** The active tenant: a fixed id or a function of the Convex context; a throw is no tenant. */
+  /**
+   * The active tenant: a fixed id or a function of the Convex context; a throw
+   * is no tenant.
+   */
   readonly tenant?: string | ((ctx: TCtx) => string | undefined | Promise<string | undefined>);
-  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  /**
+   * The agent or service acting for the subject; anything but an `Actor` is
+   * ignored.
+   */
   readonly actor?: (ctx: TCtx) => unknown;
   readonly query?: ConvexQueryBuilder;
 };

package/dist/convex/index.js

@@ -1,11 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
-import { n as tenantScope, t as actorFrom } from "../adapter-context-CRhqyzCk.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { n as tenantScope, t as actorFrom } from "../adapter-context-CIQpQxbE.js";
 //#region src/convex/create.ts
-/** Convex's runtime sends `data` to the client only for an error carrying this symbol. */
+/**
+* Convex's runtime sends `data` to the client only for an error carrying this
+* symbol.
+*/
 const CONVEX_ERROR = Symbol.for("ConvexError");
 var ConvexError = class extends Error {
 	name = "ConvexError";