permdock 0.6.0 → 0.8.0

package/dist/{automation-BNM3TtDo.d.ts → automation-DqEoWHBc.d.ts}

@@ -1,18 +1,18 @@
-import { Lt as InstanceHandle, Pn as Denial, Rt as Instant } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { t as Operation } from "./operations-X0VM7F3m.js";
+import { Lt as InstanceHandle, Rn as Denial, Rt as Instant } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { t as Operation } from "./operations-Ci_rT6Uo.js";
 //#region src/core/automation.d.ts
 /**
  * Who an automation runs as. `publisher`: the person who published it, with
- * their rights as of each run. `service`: a `kind: 'service'` principal
- * holding `roles` in `tenant`, capped at what the publisher could assign.
+ * their rights as of each run. `service`: a `kind: 'service'` principal holding
+ * `roles` in `tenant`, capped at what the publisher could assign.
  */
 type AutomationMode = "publisher" | "service";
 /**
- * Automation v1: a published, versioned run of operations. Every run acts
- * as `principal` with live rights, narrowed to `permissions` (the
- * operations' permissions) and to any policy delegation to
- * `actor('automation')`. The event that triggers a run never grants.
+ * Automation v1: a published, versioned run of operations. Every run acts as
+ * `principal` with live rights, narrowed to `permissions` (the operations'
+ * permissions) and to any policy delegation to `actor('automation')`. The event
+ * that triggers a run never grants.
  */
 type Automation = {
   readonly v: 1;
@@ -32,7 +32,10 @@ type Automation = {
   readonly operations: readonly string[];
   /** The delegation: the permission keys of `operations`. */
   readonly permissions: readonly string[];
-  /** The permission key a caller needs to start a run; absent, only server code starts one. */
+  /**
+   * The permission key a caller needs to start a run; absent, only server code
+   * starts one.
+   */
   readonly run?: string;
   readonly revoked?: boolean;
   readonly name?: string;
@@ -41,16 +44,22 @@ type Automation = {
 type AutomationSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  /** The automation as of now, or `null` for an unknown one. A throw is no automation. */
-  automation(id: string, options?: {
+  /**
+   * The automation as of now, or `null` for an unknown one. A throw is no
+   * automation.
+   */
+  automation: (id: string, options?: {
     readonly tenant?: string;
-  }): Automation | null | Promise<Automation | null>;
+  }) => Automation | null | Promise<Automation | null>;
 };
 type OperationRef = Pick<Operation, "name" | "permission">;
 type AutomationRequest = {
   readonly id: string;
   readonly version: number | string;
-  /** The operations the automation runs: entries of an `OperationMap`, or the map itself. */
+  /**
+   * The operations the automation runs: entries of an `OperationMap`, or the
+   * map itself.
+   */
   readonly operations: readonly OperationRef[] | Readonly<Record<string, OperationRef>>;
   /** Defaults to `'publisher'`. */
   readonly mode?: AutomationMode;
@@ -76,38 +85,39 @@ type DecideAutomationOptions = {
   readonly now?: Instant;
 };
 /**
- * Validates an untrusted automation record and returns a frozen copy with
- * only the v1 fields, or `undefined`. A service automation needs `tenant`
- * and `roles`; a publisher automation runs as `publishedBy` and has no
- * `roles`.
+ * Validates an untrusted automation record and returns a frozen copy with only
+ * the v1 fields, or `undefined`. A service automation needs `tenant` and
+ * `roles`; a publisher automation runs as `publishedBy` and has no `roles`.
  */
 declare function parseAutomation(input: unknown): Automation | undefined;
 type MemoryAutomationSource = {
-  automation(id: string, options?: {
+  automation: (id: string, options?: {
     readonly tenant?: string;
-  }): Automation | null;
+  }) => Automation | null;
   /** Adds or replaces a record by id; an invalid record throws. */
-  put(automation: Automation): void;
+  put: (automation: Automation) => void;
 };
-/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+/**
+ * An in-process `AutomationSource`; records are kept by id and checked with
+ * `parseAutomation`.
+ */
 declare function memoryAutomationSource(automations?: readonly Automation[]): MemoryAutomationSource;
 /**
  * Decides whether the subject of `permdock` may publish the automation in
- * `request`, and returns the record to store. The publisher must be a
- * signed-in user or service that is not a link, a feed, a contact, a
- * credential or a run, and must be able to use every operation's permission
- * now (`exceeds-creator`); each run re-checks their live rights. A
- * `service` automation's tenant must be one the publisher is a member of,
- * its roles among their `assignableRoles` there and its permissions within
- * `assignablePermissions`. PermDock never stores the record; the
- * application does, after a `granted` result.
+ * `request`, and returns the record to store. The publisher must be a signed-in
+ * user or service that is not a link, a feed, a contact, a credential or a run,
+ * and must be able to use every operation's permission now (`exceeds-creator`);
+ * each run re-checks their live rights. A `service` automation's tenant must be
+ * one the publisher is a member of, its roles among their `assignableRoles`
+ * there and its permissions within `assignablePermissions`. PermDock never
+ * stores the record; the application does, after a `granted` result.
  */
 /**
  * Decides whether the subject of `permdock` may publish the automation in
  * `request` and returns the record to store: the publisher's own reach over
  * every operation's permission and, for a `service` automation, their
- * assignable ceiling. Each run re-checks the publisher live. An instance
- * built from a snapshot denies with `unsupported`.
+ * assignable ceiling. Each run re-checks the publisher live. An instance built
+ * from a snapshot denies with `unsupported`.
  */
 declare function decideAutomation(permdock: InstanceHandle, request: AutomationRequest, options?: DecideAutomationOptions): Promise<AutomationDecision>;
 //#endregion

package/dist/{automation-DVjOckjV.js → automation-x3KEUusw.js}

@@ -1,20 +1,19 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as isId, r as idList } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 //#region src/core/automation.ts
 const MAX_NAME = 256;
 function isVersion(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 || isId(value);
 }
 /**
-* Validates an untrusted automation record and returns a frozen copy with
-* only the v1 fields, or `undefined`. A service automation needs `tenant`
-* and `roles`; a publisher automation runs as `publishedBy` and has no
-* `roles`.
+* Validates an untrusted automation record and returns a frozen copy with only
+* the v1 fields, or `undefined`. A service automation needs `tenant` and
+* `roles`; a publisher automation runs as `publishedBy` and has no `roles`.
 */
 function parseAutomation(input) {
 	const value = ownRecord(input);
@@ -44,7 +43,10 @@ function parseAutomation(input) {
 		name
 	}));
 }
-/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+/**
+* An in-process `AutomationSource`; records are kept by id and checked with
+* `parseAutomation`.
+*/
 function memoryAutomationSource(automations = []) {
 	const byId = /* @__PURE__ */ new Map();
 	const put = (automation) => {
@@ -77,21 +79,20 @@ function operationList(operations) {
 }
 /**
 * Decides whether the subject of `permdock` may publish the automation in
-* `request`, and returns the record to store. The publisher must be a
-* signed-in user or service that is not a link, a feed, a contact, a
-* credential or a run, and must be able to use every operation's permission
-* now (`exceeds-creator`); each run re-checks their live rights. A
-* `service` automation's tenant must be one the publisher is a member of,
-* its roles among their `assignableRoles` there and its permissions within
-* `assignablePermissions`. PermDock never stores the record; the
-* application does, after a `granted` result.
+* `request`, and returns the record to store. The publisher must be a signed-in
+* user or service that is not a link, a feed, a contact, a credential or a run,
+* and must be able to use every operation's permission now (`exceeds-creator`);
+* each run re-checks their live rights. A `service` automation's tenant must be
+* one the publisher is a member of, its roles among their `assignableRoles`
+* there and its permissions within `assignablePermissions`. PermDock never
+* stores the record; the application does, after a `granted` result.
 */
 /**
 * Decides whether the subject of `permdock` may publish the automation in
 * `request` and returns the record to store: the publisher's own reach over
 * every operation's permission and, for a `service` automation, their
-* assignable ceiling. Each run re-checks the publisher live. An instance
-* built from a snapshot denies with `unsupported`.
+* assignable ceiling. Each run re-checks the publisher live. An instance built
+* from a snapshot denies with `unsupported`.
 */
 function decideAutomation(permdock, request, options = {}) {
 	const internals = internalsOf(permdock);

package/dist/base-url-BQbddZO5.js

@@ -0,0 +1,9 @@
+//#region src/cloud/base-url.ts
+/**
+* The one base URL of PermDock Cloud. The platform issuer is this URL; its
+* OAuth routes, `/.well-known/oauth-authorization-server` and `/openapi.json`
+* sit at the root, unversioned, and the data routes under `/v1`.
+*/
+const CLOUD_BASE_URL = "https://permdock.com/api";
+//#endregion
+export { CLOUD_BASE_URL as t };

package/dist/better-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { N as RoleBinding, W as CustomRoleSource, ar as Subject, q as DecisionSink, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { E as PermissionTree } from "../vocabulary-CN8H_9UF.js";
+import { N as RoleBinding, W as CustomRoleSource, lr as Subject, q as DecisionSink, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts
 type BetterAuthPrincipal = Principal & {

package/dist/better-auth/index.js

@@ -1,10 +1,10 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as role, r as allow } from "../role-builder-uWQZ4v84.js";
-import { c as listPermissions } from "../permission-registry-Br4jSNVi.js";
-import { r as validateRecord } from "../thenable-yD7SabqG.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
+import { c as listPermissions } from "../permission-registry-B8tYxPIt.js";
+import { r as validateRecord } from "../thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { d as membershipEvent } from "../sink-BEZSlMS_.js";
+import { d as membershipEvent } from "../sink-D9_vh372.js";
 //#region src/better-auth/parse.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : value.split(",").map((item) => item.trim()).filter((item) => item !== "");
@@ -159,7 +159,10 @@ function betterAuthCustomRoleSource(auth, options = {}) {
 		}
 	};
 }
-/** A team role sits in the second scope inside its organization; an organization role in the first. */
+/**
+* A team role sits in the second scope inside its organization; an organization
+* role in the first.
+*/
 function scopeOfChange(event) {
 	const tenant = event.organizationId;
 	if (tenant === void 0) return {};
@@ -243,7 +246,10 @@ async function organizationIds(auth, tenant, options) {
 	return [...new Set(ids)];
 }
 const MEMBER_LIMIT = 5e3;
-/** Every member row of the user in one adapter query, or `undefined` without an adapter. */
+/**
+* Every member row of the user in one adapter query, or `undefined` without an
+* adapter.
+*/
 async function memberRows(auth, userId) {
 	try {
 		const findMany = (await auth.$context)?.adapter?.findMany;