permdock 0.7.0 → 0.8.0

package/dist/{doctor-BoK_y0KO.js → doctor-D3wo-yuz.js}

@@ -1,6 +1,6 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-aaeRAdiD.js";
-import { n as ask, t as CANCELLED } from "./prompt-DwtVemER.js";
+import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { n as ask, t as CANCELLED } from "./prompt-BYc6drYW.js";
 //#region src/cli/commands/doctor.ts
 const doctor = defineLeaf({
 	flags: {
@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-BU1szn63.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-CHD1M9R5.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-BU1szn63.js")).runDoctor({
+		return (await import("./doctor-CHD1M9R5.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/drizzle/index.d.ts

@@ -1,20 +1,29 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-B-F-qAZk.js";
-import { u as WhereResult } from "../permdock-Dco6dyCK.js";
-import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-COM2VKuN.js";
-import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
+import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
+import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts
-/** A column of the Drizzle table `T` or an `SQL` expression; anything for a structural stand-in. */
+/**
+ * A column of the Drizzle table `T` or an `SQL` expression; anything for a
+ * structural stand-in.
+ */
 type DrizzleColumnOf<T> = T extends Table ? T["_"]["columns"][keyof T["_"]["columns"]] | SQL : unknown;
 type DrizzleWhereOptions<T = unknown> = {
   /** Condition field to column of the table passed to `toWhere`. */
   readonly columns?: Readonly<Record<string, DrizzleColumnOf<T>>>;
   readonly subject?: Subject;
   readonly memberships?: MembershipsMapping;
-  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  /**
+   * Where the relation graph lives; graph grants compile to Postgres subqueries
+   * with it and are refused without.
+   */
   readonly relations?: RelationsMapping;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
   readonly operators?: DrizzleOperators;
 };
@@ -41,25 +50,29 @@ type DrizzleWithSubjectOptions = WithSubjectOptions & {
 };
 //#endregion
 //#region src/drizzle/to-where.d.ts
-/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+/**
+ * Compiles a condition into a Drizzle `SQL` filter over `table`; no grant
+ * compiles to `false`.
+ */
 export declare function toWhere<T extends object>(input: Condition | WhereResult, table: T, options?: DrizzleWhereOptions<T>): SQL;
 type DrizzleDatabase<Tx> = {
-  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+  transaction: <T>(fn: (tx: Tx) => Promise<T>) => Promise<T>;
 };
 /**
- * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
- * RLS policies decide for the same subject as the in-process checks.
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+ * the generated RLS policies decide for the same subject as the in-process
+ * checks.
  */
 export declare function withSubject<Tx extends {
-  execute(query: never): unknown;
+  execute: (query: never) => unknown;
 }, T>(db: DrizzleDatabase<Tx>, permdock: {
   readonly subject: Subject;
 }, fn: (tx: Tx) => Promise<T>, options?: DrizzleWithSubjectOptions): Promise<T>;
 type DrizzleSelectable = {
-  select(fields: Record<string, unknown>): {
-    from(table: never): {
-      where(where: unknown): {
-        limit(count: number): PromiseLike<readonly {
+  select: (fields: Record<string, unknown>) => {
+    from: (table: never) => {
+      where: (where: unknown) => {
+        limit: (count: number) => PromiseLike<readonly {
           readonly granted?: unknown;
         }[]>;
       };
@@ -67,8 +80,9 @@ type DrizzleSelectable = {
   };
 };
 /**
- * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
- * permission filter keeps the row. Throws when `key` matches more than one row.
+ * One query for one row: `{ found: false }` when `key` matches nothing,
+ * otherwise whether the permission filter keeps the row. Throws when `key`
+ * matches more than one row.
  */
 export declare function checkRow<T extends object>(db: DrizzleSelectable, table: T, input: Condition | WhereResult, key: SQL, options?: DrizzleWhereOptions<T>): Promise<RowCheck>;
 //#endregion

package/dist/drizzle/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as escapeLike, t as compileWhere } from "../compile-BAEO5bOk.js";
-import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
+import { t as assertSafeKey } from "../paths-CUvURzHp.js";
+import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {
 	if (injected !== void 0) return injected;
@@ -18,7 +18,10 @@ function column(table, field, columns) {
 	if (mapped === void 0 || typeof mapped === "function") throw new Error(`PermDock: unknown column '${field}'`);
 	return mapped;
 }
-/** Drizzle's Postgres array columns (`text().array()`) report `dataType: 'array'`. */
+/**
+* Drizzle's Postgres array columns (`text().array()`) report `dataType:
+* 'array'`.
+*/
 function isArrayColumn(col) {
 	if (col === null || typeof col !== "object") return false;
 	const { dataType, dimensions } = col;
@@ -116,7 +119,10 @@ function render(node, table, options, ops) {
 		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
 	}
 }
-/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+/**
+* Compiles a condition into a Drizzle `SQL` filter over `table`; no grant
+* compiles to `false`.
+*/
 function toWhere(input, table, options = {}) {
 	return render(compileWhere(input, compact({
 		subject: options.subject,
@@ -126,8 +132,9 @@ function toWhere(input, table, options = {}) {
 	})), table, options, loadOperators(options.operators));
 }
 /**
-* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
-* RLS policies decide for the same subject as the in-process checks.
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+* the generated RLS policies decide for the same subject as the in-process
+* checks.
 */
 function withSubject(db, permdock, fn, options = {}) {
 	const statements = subjectStatements(permdock, options);
@@ -139,8 +146,9 @@ function withSubject(db, permdock, fn, options = {}) {
 	});
 }
 /**
-* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
-* permission filter keeps the row. Throws when `key` matches more than one row.
+* One query for one row: `{ found: false }` when `key` matches nothing,
+* otherwise whether the permission filter keeps the row. Throws when `key`
+* matches more than one row.
 */
 async function checkRow(db, table, input, key, options = {}) {
 	const { sql } = loadOperators(options.operators);

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {
@@ -18,14 +18,17 @@ type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaRequest
 /** The `ws` Elysia passes to `.ws` handlers; `data` is the upgrade context. */
 type ElysiaSocket = {
   readonly data: ElysiaRequestContext;
-  close(code?: number, reason?: string): unknown;
+  close: (code?: number, reason?: string) => unknown;
 };
 type ElysiaPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaRequestContext & {
   permdock: PermDock<V>;
   permdockData?: unknown;
 };
 type ElysiaProtect = (permission: Permission | null, data?: (ctx: ElysiaRequestContext) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaRequestContext) => Promise<Response | undefined>;
-/** The `middleware()` plugin: its global derive types `permdock` in every later handler. */
+/**
+ * The `middleware()` plugin: its global derive types `permdock` in every later
+ * handler.
+ */
 type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
   decorator: Record<never, never>;
   store: Record<never, never>;
@@ -35,13 +38,16 @@ type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysi
   resolve: Record<never, never>;
 }>;
 type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one request, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one request, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (ctx: ElysiaRequestContext) => Promise<PermDock<V>>;
   readonly middleware: () => ElysiaPermDockPlugin<V>;
   readonly protect: ElysiaProtect;
   /**
-   * One connection per socket: the same promise for every handler
-   * of that socket; closes it with `1008` when the connection aborts.
+   * One connection per socket: the same promise for every handler of that
+   * socket; closes it with `1008` when the connection aborts.
    */
   readonly connection: (ws: ElysiaSocket, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   readonly permdockHandler: () => Elysia;

package/dist/elysia/index.js

@@ -1,8 +1,8 @@
-import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
-import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
+import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts
 function createPermDock(policy, options) {

package/dist/{errors-BKy0EfhN.js → errors-B6R_lg2a.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { a as problemType, n as problemDetails, o as statusProblem } from "./problem-details-cn5X30gZ.js";
+import { a as problemType, n as problemDetails, o as statusProblem } from "./problem-details-CLDgX1KV.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
 //#region src/core/errors.ts
@@ -10,9 +10,15 @@ var PermDockDeniedError = class extends Error {
 	scope;
 	resource;
 	subject;
-	/** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+	/**
+	* The resource's `disclosure` when the denied check carried a row; `'hide'`
+	* answers as `404`.
+	*/
 	disclosure;
-	/** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+	/**
+	* `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary
+	* (`parsePermDockDigest`).
+	*/
 	digest;
 	constructor(input) {
 		super(input.message);
@@ -45,7 +51,10 @@ var PermDockApprovalRequiredError = class extends Error {
 	resource;
 	token;
 	reason;
-	/** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+	/**
+	* `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already
+	* bound to this subject.
+	*/
 	digest;
 	constructor(input) {
 		super(input.message);

package/dist/{errors-BWXBMaKK.d.ts → errors-CHwoRRpB.d.ts}

@@ -5,7 +5,10 @@ declare class ApprovalError extends Error {
   readonly code: ApprovalErrorCode;
   constructor(code: ApprovalErrorCode, message: string);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isApprovalError(value: unknown): value is ApprovalError;
 //#endregion
 export { ApprovalErrorCode as n, isApprovalError as r, ApprovalError as t };

package/dist/{errors-DpP_U6Bf.js → errors-Vpu6rKHl.js}

@@ -57,21 +57,21 @@ function describeError(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 /**
-* The exit code an error ends the run with: its code's, so a `CliError` and
-* the problem printed for it always agree. Anything that is not a
-* `CliError` is a bug in the CLI.
+* The exit code an error ends the run with: its code's, so a `CliError` and the
+* problem printed for it always agree. Anything that is not a `CliError` is a
+* bug in the CLI.
 */
 function exitCodeOfError(error) {
 	if (error instanceof CliError) return exitCodeOfProblem(error.code);
 	return rejectedDefinition(error) ? exitCodeOfProblem("config_invalid") : exitCodeOf("internal");
 }
 /**
-* The library's own runtime checks throw plain errors whose message starts
-* with `PermDock` (an identifier, a condition, a policy it rejects). Those are
-* the project's to fix, so they count as `config_invalid`, not as a CLI bug.
+* The library's own runtime checks throw plain errors whose message starts with
+* `PermDock` (an identifier, a condition, a policy it rejects). Those are the
+* project's to fix, so they count as `config_invalid`, not as a CLI bug.
 */
 function rejectedDefinition(error) {
-	return error instanceof Error && /^PermDock( CLI)?[:\s]/.test(error.message);
+	return error instanceof Error && /^PermDock( CLI)?[:\s]/u.test(error.message);
 }
 function exitCodeOf(kind) {
 	switch (kind) {
@@ -127,13 +127,16 @@ function usageResult(error) {
 	};
 }
 /**
-* A config, policy or definition the command cannot compile: the project's
-* to fix, so a usage error (exit 2) and never an `internal` one.
+* A config, policy or definition the command cannot compile: the project's to
+* fix, so a usage error (exit 2) and never an `internal` one.
 */
 function configError(message) {
 	return new CliError("usage", message, { code: "config_invalid" });
 }
-/** The run needs a value only the caller can supply: exit 3 with `missing` naming the flags. */
+/**
+* The run needs a value only the caller can supply: exit 3 with `missing`
+* naming the flags.
+*/
 function missingInput(command, missing, hint) {
 	return new CliError("action", `${command} needs ${missing.join(" and ")}${hint === void 0 ? "" : `: ${hint}`}`, {
 		code: "input_required",

package/dist/{errors-B_Qg9D3e.d.ts → errors-zi_4T-rx.d.ts}

@@ -1,6 +1,13 @@
-import { Ln as Decision, ln as WireDenial, lr as Subject } from "./policy-types-B-F-qAZk.js";
-import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
+import { Ln as Decision, ln as WireDenial, lr as Subject } from "./policy-types-CCiDRZBH.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/problem-details.d.ts
+type Disclosure = "hide" | "reveal";
+/**
+ * The plans a `not-entitled` denial asks for; empty unless every denial is
+ * `not-entitled`.
+ */
+declare function requiredPlans(decision: Decision): readonly string[];
+//#endregion
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */
 type ApprovalHint = {
@@ -43,9 +50,15 @@ declare class PermDockDeniedError extends Error {
     readonly id?: string;
   };
   readonly subject: Subject;
-  /** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+  /**
+   * The resource's `disclosure` when the denied check carried a row; `'hide'`
+   * answers as `404`.
+   */
   readonly disclosure?: Disclosure;
-  /** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+  /**
+   * `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary
+   * (`parsePermDockDigest`).
+   */
   readonly digest: string;
   constructor(input: {
     readonly decision: Extract<Decision, {
@@ -80,7 +93,10 @@ declare class PermDockApprovalRequiredError extends Error {
   };
   readonly token: string;
   readonly reason: string;
-  /** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+  /**
+   * `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already
+   * bound to this subject.
+   */
   readonly digest: string;
   constructor(input: {
     readonly decision: Extract<Decision, {
@@ -122,4 +138,4 @@ declare class PermDockRevokedError extends Error {
   }): ProblemDetails;
 }
 //#endregion
-export { ProblemDetails as a, PermDockRevokedError as i, PermDockApprovalRequiredError as n, RevokedCode as o, PermDockDeniedError as r, ApprovalHint as t };
+export { ProblemDetails as a, requiredPlans as c, PermDockRevokedError as i, PermDockApprovalRequiredError as n, RevokedCode as o, PermDockDeniedError as r, Disclosure as s, ApprovalHint as t };