permdock 0.6.0 → 0.8.0

package/dist/orpc/index.js

@@ -1,11 +1,42 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { o as isPermission } from "../permission-registry-Br4jSNVi.js";
-import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { n as attached } from "../bind-CAvgUuKs.js";
-import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-VSl5ylaQ.js";
-import { ORPCError } from "@orpc/server";
+import { o as isPermission } from "../permission-registry-B8tYxPIt.js";
+import { o as problemMessage } from "../http-DKLXrFGk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as attached } from "../bind-D_sZSVA3.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
+import { ORPCError, os } from "@orpc/server";
+//#region src/orpc/operations.ts
+const root = os;
+function routeOf(name, value) {
+	if (typeof (value !== null && typeof value === "object" ? Reflect.get(value, "handler") : void 0) !== "function") throw new TypeError(`operationsRouter: the route for operation "${name}" needs a handler function.`);
+	return value;
+}
+/**
+* Builds one oRPC procedure per operation: `middleware()`, the route's `input`
+* schema, then `protect(operation.permission, operation.data)`. Throws at
+* definition time when a route names no operation, an operation has no route,
+* or an operation with `data` has no `input` schema.
+*/
+function operationsRouterOf(deps) {
+	return (operations, routes, options = {}) => {
+		for (const name of Object.keys(routes)) if (!Object.hasOwn(operations, name)) throw new TypeError(`operationsRouter: "${name}" is not an operation passed to operationsRouter.`);
+		const router = {};
+		for (const [name, operation] of Object.entries(operations)) {
+			if (!Object.hasOwn(routes, name)) throw new TypeError(`operationsRouter: operation "${name}" has no route.`);
+			const route = routeOf(name, Reflect.get(routes, name));
+			const load = operation.data;
+			if (load !== void 0 && route.input === void 0) throw new TypeError(`operationsRouter: operation "${name}" loads a row from its input, so its route needs an input schema.`);
+			const base = root.meta(...options.meta?.(operation) ?? []).use(deps.middleware());
+			router[name] = (route.input === void 0 ? base : base.input(route.input)).use(deps.protect(operation.permission, load === void 0 ? void 0 : (opts) => load(opts.input))).handler(({ input, context }) => route.handler({
+				input,
+				context
+			}));
+		}
+		return router;
+	};
+}
+//#endregion
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {
 	return compact({
@@ -18,7 +49,10 @@ function toOpts(mw, input, next) {
 function isErrorConstructor(value) {
 	return typeof value === "function";
 }
-/** Uses the procedure's own constructor when it declares the code, so the declared status and `defined` apply. */
+/**
+* Uses the procedure's own constructor when it declares the code, so the
+* declared status and `defined` apply.
+*/
 function orpcError(code, message, data, errors) {
 	const declared = errors !== void 0 && Object.hasOwn(errors, code) ? errors[code] : void 0;
 	return isErrorConstructor(declared) ? declared({
@@ -38,7 +72,10 @@ async function throwOrpcError(response, errors) {
 	const code = rpcCode(response.status);
 	throw orpcError(code, problemMessage(data, code), data, errors);
 }
-/** A PermDock error thrown further down (an `assert` in a handler) becomes the ORPCError `protect` throws. */
+/**
+* A PermDock error thrown further down (an `assert` in a handler) becomes the
+* ORPCError `protect` throws.
+*/
 function mapDownstream(run, errors) {
 	return new Promise((resolve) => {
 		resolve(run());
@@ -58,9 +95,9 @@ function readOwn(value, key) {
 	return (typeof value === "object" || typeof value === "function") && value !== null && Object.hasOwn(value, key) ? Reflect.get(value, key) : void 0;
 }
 /**
-* The permission the procedure's first `protect` decides, or `undefined`
-* when no `protect` is attached. Reads the procedure definition only and
-* never decides.
+* The permission the procedure's first `protect` decides, or `undefined` when
+* no `protect` is attached. Reads the procedure definition only and never
+* decides.
 */
 function permissionOf(procedure) {
 	const ordered = readOwn(readOwn(procedure, "~orpc"), "orderedMiddlewares");
@@ -140,8 +177,20 @@ function createPermDock(policy, options) {
 		openapi: {
 			protect,
 			security: kernelOpenApi.security,
+			spec: (permission) => {
+				const fragment = kernelOpenApi.security(permission);
+				return (current) => ({
+					...current,
+					security: fragment.security.map((requirement) => Object.fromEntries(Object.entries(requirement).map(([scheme, scopes]) => [scheme, [...scopes]]))),
+					"x-permdock-permissions": [...fragment["x-permdock-permissions"]]
+				});
+			},
 			securitySchemes: kernelOpenApi.securitySchemes
-		}
+		},
+		operationsRouter: operationsRouterOf({
+			middleware,
+			protect
+		})
 	};
 }
 //#endregion

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { j as PolicyVocabulary } from "../policy-types-n0uRTsW8.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-lUlG3TVd.js";
+import { j as PolicyVocabulary } from "../policy-types-CCiDRZBH.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-DHKPcqzr.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is
@@ -8,7 +8,10 @@ import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap
  * `withOtel` for timings and for `tenant()` / `team()` derived instances.
  */
 export declare function instrument(permdock: PermDock, options?: OtelOptions): () => void;
-/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+/**
+ * Returns an instrumented instance: timed spans and histogram, derived
+ * instances included.
+ */
 export declare function withOtel<V extends PolicyVocabulary = PolicyVocabulary>(permdock: PermDock<V>, options?: OtelOptions): PermDock<V>;
 //#endregion
 export { GENAI_SEMCONV_PIN, GEN_AI_TOOL_CALL_ID, GEN_AI_TOOL_NAME, type OtelApi, type OtelOptions, type OtelWrap, type StructuralLogger };

package/dist/otel/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as wrapPermDock } from "../wrap-gX61EtpB.js";
-import { r as appObligationNames } from "../ocsf-BFp-PZZA.js";
+import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { r as appObligationNames } from "../ocsf-TcjRBgIs.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";
 const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
@@ -87,8 +87,8 @@ function omitPath(attributes, path) {
 }
 /**
 * `error.type` for a decision that failed: a boundary validation failure
-* always, and the first denial reason when `errorOnDeny` marks every denial
-* an error.
+* always, and the first denial reason when `errorOnDeny` marks every denial an
+* error.
 */
 function errorType(event, options) {
 	if (event.outcome !== "denied") return;
@@ -220,7 +220,10 @@ function instrumented(permdock, options, api) {
 		};
 	});
 }
-/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+/**
+* Returns an instrumented instance: timed spans and histogram, derived
+* instances included.
+*/
 function withOtel(permdock, options = {}) {
 	return instrumented(permdock, options, resolveApi(options.api));
 }

package/dist/output-files-BHOIlrfD.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-BIQ_9pIs.js";

package/dist/{output-files-DhRBBE4n.js → output-files-BIQ_9pIs.js}

@@ -1,6 +1,6 @@
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { t as shortDiff } from "./text-diff-BQcUapOb.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 /** How `path` on disk differs from `expected`; `undefined` when `same` holds. */
@@ -12,7 +12,10 @@ function fileDrift(path, expected, same = (a, b) => a === b) {
 		onDisk
 	};
 }
-/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+/**
+* `--check`: one entry per file that is missing or differs, naming its part; a
+* differing file carries a short diff.
+*/
 function driftOf(cwd, files) {
 	const drift = [];
 	for (const file of files) {
@@ -23,7 +26,10 @@ function driftOf(cwd, files) {
 	}
 	return drift;
 }
-/** Writes every file but the stdout ones, all or nothing, and returns the stdout text for printing. */
+/**
+* Writes every file but the stdout ones, all or nothing, and returns the stdout
+* text for printing.
+*/
 function writeOutputFiles(cwd, files) {
 	const onDisk = files.filter((file) => file.rel !== "-");
 	applyFiles(cwd, onDisk.map((file) => ({
@@ -42,7 +48,10 @@ const SPLIT_PARTS = [
 	"policies",
 	"hook"
 ];
-/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+/**
+* `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order,
+* or an error.
+*/
 function parseSplit(raw) {
 	if (raw === void 0) return;
 	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
@@ -54,8 +63,8 @@ function partPath(out, part) {
 	return out.replaceAll("{part}", part);
 }
 /**
-* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
-* their dependencies, so no file needs a number to apply first.
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by their
+* dependencies, so no file needs a number to apply first.
 */
 function pgDeltaPath(root, part, schema) {
 	switch (part) {
@@ -67,7 +76,10 @@ function pgDeltaPath(root, part, schema) {
 		default: return part;
 	}
 }
-/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+/**
+* Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is
+* an existing directory.
+*/
 function isSeedsDirectory(cwd, out) {
 	if (out === "-") return false;
 	if (out.endsWith("/")) return true;
@@ -75,11 +87,11 @@ function isSeedsDirectory(cwd, out) {
 	return existsSync(path) && statSync(path).isDirectory();
 }
 /**
-* A generated data migration at `out`: a file, `-` for stdout, or a
-* migrations directory that gets a new versioned file only when the newest
-* one starting with `marker` differs. With `check`, the planned file is
-* always returned, so drift names it. `reserved` lists the files this run
-* already plans, so two data migrations never share a version.
+* A generated data migration at `out`: a file, `-` for stdout, or a migrations
+* directory that gets a new versioned file only when the newest one starting
+* with `marker` differs. With `check`, the planned file is always returned, so
+* drift names it. `reserved` lists the files this run already plans, so two
+* data migrations never share a version.
 */
 function dataMigrationFile(input) {
 	if (!isSeedsDirectory(input.cwd, input.out)) return {
@@ -100,9 +112,9 @@ function migrationVersion(now) {
 }
 const VERSION_PREFIX = /^\d{14}(?=_)/u;
 /**
-* The version of a new migration that sorts after every migration in
-* `names`: one second past the newest, so the same directory always gives the
-* same name. Only a directory with no versioned migration falls back to `now`.
+* The version of a new migration that sorts after every migration in `names`:
+* one second past the newest, so the same directory always gives the same name.
+* Only a directory with no versioned migration falls back to `now`.
 */
 function nextMigrationVersion(names, now) {
 	const times = names.flatMap((name) => {

package/dist/{output-1im__-08.js → output-tkju6U7R.js}

@@ -1,5 +1,5 @@
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {
@@ -23,8 +23,8 @@ function dataOf(output) {
 }
 const LOCATION = /^([^\s:]+\.[A-Za-z0-9]+):(\d+)\b/u;
 /**
-* A finding whose `file` and `line` default to the `path:line` a message
-* opens with, the form doctor, usage and scan already print.
+* A finding whose `file` and `line` default to the `path:line` a message opens
+* with, the form doctor, usage and scan already print.
 */
 function findingOf(input) {
 	if (input.file !== void 0) return input;
@@ -45,11 +45,14 @@ function escapeProperty(value) {
 /** GitHub Actions workflow commands, one per finding. */
 function githubAnnotations(findings) {
 	return findings.map((finding) => {
-		return `::${finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "notice"} ${[
+		const level = finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "notice";
+		const properties = [
 			...finding.file === void 0 ? [] : [`file=${escapeProperty(finding.file)}`],
 			...finding.line === void 0 ? [] : [`line=${String(finding.line)}`],
 			`title=${escapeProperty(finding.code)}`
-		].join(",")}::${escapeData(finding.fix === void 0 ? finding.message : `${finding.message}\nFix: ${finding.fix}`)}`;
+		].join(",");
+		const text = finding.id === void 0 ? finding.message : `${finding.message} [${finding.id}]`;
+		return `::${level} ${properties}::${escapeData(finding.fix === void 0 ? text : `${text}\nFix: ${finding.fix}`)}`;
 	}).join("\n");
 }
 /** A SARIF 2.1.0 log with one run, one rule per finding code. */
@@ -65,6 +68,7 @@ function sarifLog(command, findings) {
 		ruleId: finding.code,
 		level: finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "note",
 		message: { text: finding.message },
+		...finding.id === void 0 ? {} : { partialFingerprints: { "permdockId/v1": finding.id } },
 		...finding.file === void 0 ? {} : { locations: [{ physicalLocation: {
 			artifactLocation: { uri: finding.file },
 			...finding.line === void 0 ? {} : { region: { startLine: finding.line } }
@@ -84,5 +88,9 @@ function sarifLog(command, findings) {
 		}]
 	}, null, 2)}\n`;
 }
+/** `text`, or `fallback` when `text` is empty. */
+function nonEmptyOr(text, fallback) {
+	return text === "" ? fallback : text;
+}
 //#endregion
-export { sarifLog as a, githubAnnotations as i, envelope as n, findingOf as r, dataOf as t };
+export { nonEmptyOr as a, githubAnnotations as i, envelope as n, sarifLog as o, findingOf as r, dataOf as t };