permdock 0.6.0 → 0.8.0

package/dist/{evaluations-C_1vdSZc.d.ts → evaluations-z8dQFDaN.d.ts}

@@ -1,11 +1,14 @@
-import { T as Policy } from "./policy-types-n0uRTsW8.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { T as Policy } from "./policy-types-CCiDRZBH.js";
+import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];
 type EvaluationsSemantic = (typeof EVALUATIONS_SEMANTICS)[number];
-/** The batch's `evaluations_semantic`: `execute_all` when absent, `undefined` for an unknown value. */
+/**
+ * The batch's `evaluations_semantic`: `execute_all` when absent, `undefined`
+ * for an unknown value.
+ */
 declare function evaluationsSemantic(body: Readonly<Record<string, unknown>>): EvaluationsSemantic | undefined;
 /**
  * Evaluates `items` under `semantic`: all at once for `execute_all`, else in
@@ -13,7 +16,7 @@ declare function evaluationsSemantic(body: Readonly<Record<string, unknown>>): E
  */
 declare function evaluateBatch<T extends {
   readonly decision: boolean;
-}>(items: readonly unknown[], semantic: EvaluationsSemantic, rowOf: (item: unknown) => Promise<T>): Promise<T[]>;
+}, I = unknown>(items: readonly I[], semantic: EvaluationsSemantic, rowOf: (item: I) => Promise<T>): Promise<T[]>;
 declare function evaluationsHandler(options: {
   readonly policy: Policy;
   readonly resolve?: (request: Request) => Promise<PermDock>;
@@ -22,7 +25,10 @@ declare function evaluationsHandler(options: {
   }) => Promise<PermDock>;
   readonly store?: ApprovalStore;
   readonly adapter?: string;
-  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
+  /**
+   * The most evaluations one POST may carry; a larger batch is a 413 before any
+   * instance is resolved.
+   */
   readonly maxEvaluations?: number;
 }): {
   readonly POST: (request: Request) => Promise<Response>;

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { u as ApprovalRequest } from "../types-BdtSDbBO.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { u as ApprovalRequest } from "../types-B_tiYvk8.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {
@@ -50,7 +50,10 @@ type EveApprovers = {
   readonly roles: readonly string[];
 } | ((responder: EvePrincipal, request: ApprovalRequest) => boolean);
 type EvePermDockOptions<TUser = unknown> = Omit<AgentAdapterOptions<EveContext, TUser>, "subject"> & {
-  /** Defaults to `subjectFromEve`: the session initiator's id and `roles` attribute. */
+  /**
+   * Defaults to `subjectFromEve`: the session initiator's id and `roles`
+   * attribute.
+   */
   readonly subject?: (context: EveContext) => TUser | Promise<TUser>;
   readonly approvers?: EveApprovers;
 };

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
-import { t as agentRuntime } from "../create-CGm28gyI.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { c as isApprovalError } from "../types-CcUXciSj.js";
+import { o as resolveApproval } from "../helpers-DJicaG6f.js";
+import { t as agentRuntime } from "../create-Cq4Uox0f.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/{event-time-CsegxXxB.js → event-time-BGy48400.js}

@@ -1,10 +1,11 @@
-import { l as isRfc3339, u as isoAt } from "./time-DkWjdL98.js";
+import { l as isRfc3339, u as isoAt } from "./time-nR1JesoH.js";
 //#region src/core/event-time.ts
 const MAX_TIME_VALUE = 864e13;
 /**
 * An event time as RFC 3339, or `undefined` when there is none or it is not a
-* time: NumericDate seconds are converted and an RFC 3339 string passes through.
-* Never throws, so a decision event never fails on a malformed expiry.
+* time: NumericDate seconds are converted and an RFC 3339 string passes
+* through. Never throws, so a decision event never fails on a malformed
+* expiry.
 */
 function eventInstant(value) {
 	if (typeof value === "string") return isRfc3339(value) ? value : void 0;
@@ -12,7 +13,10 @@ function eventInstant(value) {
 	const millis = value * 1e3;
 	return Math.abs(millis) <= MAX_TIME_VALUE ? isoAt(millis) : void 0;
 }
-/** `eventInstant` for a builder input, where a malformed time is the caller's error. */
+/**
+* `eventInstant` for a builder input, where a malformed time is the caller's
+* error.
+*/
 function requireEventInstant(value, field) {
 	if (value === void 0) return;
 	const instant = eventInstant(value);

package/dist/{expiry-D4_YKRKD.js → expiry-6XByK0dm.js}

@@ -1,4 +1,4 @@
-import { c as instantOf } from "./time-DkWjdL98.js";
+import { c as instantOf } from "./time-nR1JesoH.js";
 //#region src/core/ids.ts
 /**
 * The canonical text of a scope or object id: a non-empty string as is, a
@@ -21,7 +21,10 @@ function idList(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ENTRIES || !value.every(isId)) return;
 	return [...new Set(value)];
 }
-/** Whether two ids are the same id once both are read as text; a missing id matches nothing. */
+/**
+* Whether two ids are the same id once both are read as text; a missing id
+* matches nothing.
+*/
 function sameId(left, right) {
 	const text = idText(left);
 	return text !== void 0 && text === idText(right);
@@ -36,9 +39,9 @@ function expiredAt(item, now) {
 	return item.expiresAt !== void 0 && !(item.expiresAt > now);
 }
 /**
-* Unix seconds of a stored expiry: finite Unix seconds, an RFC 3339 string
-* (the Postgres `timestamptz` JSON form), a `Date` or an `Instant`.
-* `undefined` for anything else, which the caller treats as already expired.
+* Unix seconds of a stored expiry: finite Unix seconds, an RFC 3339 string (the
+* Postgres `timestamptz` JSON form), a `Date` or an `Instant`. `undefined` for
+* anything else, which the caller treats as already expired.
 */
 function expirySeconds(value) {
 	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts
@@ -12,7 +12,10 @@ type ExpressPermDockRequest<T = unknown, V extends PolicyVocabulary = PolicyVoca
   permdockData?: T;
 };
 type ExpressPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one request, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one request, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (req: Request) => Promise<PermDock<V>>;
   readonly middleware: () => RequestHandler;
   readonly protect: (permission: Permission | null, data?: (req: Request) => unknown, protectOptions?: ProtectOptions) => RequestHandler;

package/dist/express/index.js

@@ -1,8 +1,8 @@
-import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
-import { n as sendResponse, r as toRequest } from "../http-ujKm0JXE.js";
+import { r as hasCredentials } from "../http-DKLXrFGk.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts
 function run(work, next) {
@@ -18,7 +18,10 @@ function sendProblem(err, req, res, next) {
 		await sendResponse(res, problem);
 	}, next);
 }
-/** Answers a PermDock error with Problem Details; anything else reaches the app's error middleware. */
+/**
+* Answers a PermDock error with Problem Details; anything else reaches the
+* app's error middleware.
+*/
 function respond(req, res, next, work) {
 	work().catch((err) => {
 		sendProblem(err, req, res, next);

package/dist/fastify/index.d.ts

@@ -1,15 +1,15 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */
 type ReplyLike = {
-  code(status: number): unknown;
-  header(key: string, value: string): unknown;
-  send(body: string): unknown;
+  code: (status: number) => unknown;
+  header: (key: string, value: string) => unknown;
+  send: (body: string) => unknown;
 };
 /** Writes `response` to a Fastify-style reply. */
 declare function writeReply(reply: ReplyLike, response: Response): Promise<void>;
@@ -28,12 +28,18 @@ type ProtectRequest<Route extends RouteGenericInterface = RouteGenericInterface,
  */
 type FastifyProtect = <Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault>(permission: Permission | null, data?: (request: ProtectRequest<Route, Schema, Provider>) => unknown, protectOptions?: ProtectOptions) => (request: ProtectRequest<Route, Schema, Provider>, reply: FastifyReply) => Promise<void>;
 type FastifyPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one request, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one request, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (request: FastifyRequest) => Promise<PermDock<V>>;
   readonly middleware: () => FastifyPluginAsync;
   readonly protect: FastifyProtect;
   readonly permdockHandler: () => FastifyPluginAsync;
-  /** Types `request.permdock` for a route registered after `middleware()` or `protect`. */
+  /**
+   * Types `request.permdock` for a route registered after `middleware()` or
+   * `protect`.
+   */
   readonly withPermDock: <Route extends RouteGenericInterface = RouteGenericInterface>(fn: (request: FastifyPermDockRequest<Route, V>, reply: FastifyReply) => unknown) => (request: FastifyRequest<Route>, reply: FastifyReply) => unknown;
   readonly openapi: OpenApiHooks;
 };

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
-import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
+import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";
@@ -15,7 +15,10 @@ function breakEncapsulation(plugin) {
 	Object.defineProperty(plugin, SKIP_OVERRIDE, { value: true });
 	return plugin;
 }
-/** A route registered with `config: { permdock: false }`, such as a health check, gets no instance. */
+/**
+* A route registered with `config: { permdock: false }`, such as a health
+* check, gets no instance.
+*/
 function skipped(request) {
 	const config = request.routeOptions.config;
 	return typeof config === "object" && config !== null && Reflect.get(config, "permdock") === false;

package/dist/{fetch-adapter-Dw0MTS3D.d.ts → fetch-adapter-C1DCvpqV.d.ts}

@@ -1,10 +1,13 @@
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { a as OperationInput, t as Operation } from "./operations-X0VM7F3m.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "./bind-DOyrv6zi.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "./bind-Cp2hBHzP.js";
 //#region src/server/fetch-adapter.d.ts
-/** What `protect` checks: a permission, an operation from `defineOperations`, or `null` for a route that needs only OAuth scopes. */
+/**
+ * What `protect` checks: a permission, an operation from `defineOperations`, or
+ * `null` for a route that needs only OAuth scopes.
+ */
 type ProtectTarget = Permission | Operation | null;
 /** Reads a value from the framework context; may be async. */
 type ContextReader<TContext, T> = (context: TContext) => T | Promise<T>;

package/dist/{fetch-adapter-DD_gfmrC.js → fetch-adapter-JL43jD3E.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { a as methodNotAllowed } from "./problem-CTviyH5L.js";
-import { t as problemFromError } from "./map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "./bind-CAvgUuKs.js";
+import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { r as hasCredentials } from "./http-DKLXrFGk.js";
+import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
+import { t as problemFromError } from "./map-error-pasIGqMT.js";
+import { i as decorate, r as bindKernel } from "./bind-D_sZSVA3.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are
@@ -19,7 +19,10 @@ function guardedRoute(adapter, route, target, data, protectOptions) {
 		return adapter.mapErrors(context, () => handler(event));
 	};
 }
-/** `withPermDock(handler)`: the instance on the event's locals, built when no middleware set it. */
+/**
+* `withPermDock(handler)`: the instance on the event's locals, built when no
+* middleware set it.
+*/
 function instanceRoute(adapter, route) {
 	return (handler) => async (event) => {
 		const context = route.context(event);
@@ -31,8 +34,8 @@ function instanceRoute(adapter, route) {
 const ALLOW = "GET, HEAD, POST";
 /**
 * The permission and row loader behind a `protect` target. For an operation,
-* `input` reads its input from the request and the operation's `data` loads
-* the row; an operation without `data` checks the permission with no row.
+* `input` reads its input from the request and the operation's `data` loads the
+* row; an operation without `data` checks the permission with no row.
 */
 function protectTarget(target, input) {
 	if (target === null || isPermission(target)) return {
@@ -50,9 +53,9 @@ function held(target) {
 	return value === void 0 || value === null ? void 0 : value;
 }
 /**
-* The kernel of an adapter whose framework hands its handlers a Fetch
-* `Request` inside its own context object (SvelteKit, Astro, h3, SolidStart,
-* TanStack Start).
+* The kernel of an adapter whose framework hands its handlers a Fetch `Request`
+* inside its own context object (SvelteKit, Astro, h3, SolidStart, TanStack
+* Start).
 */
 function fetchAdapter(policy, options, adapter, requestOf) {
 	const { kernel, bind, scopeOf, handlerScope, attach, guard } = bindKernel(policy, options, adapter, requestOf);