permdock 0.7.0 → 0.8.0

package/dist/{parse-Ddhz2xf4.js → parse-1_ZheTW5.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as catalogSchema } from "./schema-B4v0Qrac.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as catalogSchema } from "./schema-BOJjqlWL.js";
 //#region src/catalog/references.ts
 function duplicates(issues, list, name, field) {
 	const seen = /* @__PURE__ */ new Set();
@@ -22,10 +22,10 @@ function duplicates(issues, list, name, field) {
 	}
 }
 /**
-* The cross-references JSON Schema cannot express: role scopes, permission
-* keys named by operations, grants, delegations and OAuth scopes, unique
-* keys, and with `requireMeta` the permission `meta` fields a consumer needs.
-* Runs on a document that already passed the schema.
+* The cross-references JSON Schema cannot express: role scopes, permission keys
+* named by operations, grants, delegations and OAuth scopes, unique keys, and
+* with `requireMeta` the permission `meta` fields a consumer needs. Runs on a
+* document that already passed the schema.
 */
 function catalogReferenceIssues(catalog, requireMeta = []) {
 	const issues = [];
@@ -109,9 +109,9 @@ function invalid(issues) {
 * Reads a `permissions.catalog.json` document (parsed, or the JSON text),
 * validates it against `schemas/catalog-v1.json`, then checks its references:
 * role scopes, the permission keys operations, grants, delegations and OAuth
-* scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy
-* built from own keys; throws `PermDockValidationError` with every issue,
-* each with its `path`.
+* scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy built
+* from own keys; throws `PermDockValidationError` with every issue, each with
+* its `path`.
 */
 function parseCatalog(json, options = {}) {
 	const issues = [];
@@ -140,7 +140,10 @@ function parseCatalog(json, options = {}) {
 	if (references.length > 0) invalid(references);
 	return freezeDeep(catalog);
 }
-/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+/**
+* Keys of the permissions the catalog marks `rowConditions: true`: the SQL
+* helpers alone cannot enforce them.
+*/
 function rowConditionKeys(catalog) {
 	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
 }

package/dist/parse-local-manifest-BQhTlLQS.d.ts

@@ -0,0 +1,10 @@
+import { Ut as LocalSnapshotManifest } from "./policy-types-CCiDRZBH.js";
+//#region src/core/parse-local-manifest.d.ts
+/**
+ * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no
+ * prototype keys. A JSON import widens `v: 1` to `number`; this narrows it back
+ * without a cast.
+ */
+declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
+//#endregion
+export { parseLocalSnapshotManifest as t };

package/dist/{parse-local-manifest-T1Q8X3A2.js → parse-local-manifest-DEiCF4ah.js}

@@ -1,7 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 //#region src/core/local-role.ts
-/** The role name custom-role tables in a local snapshot manifest hold their grants under; no declared or tenant role can take it. */
+/**
+* The role name custom-role tables in a local snapshot manifest hold their
+* grants under; no declared or tenant role can take it.
+*/
 const LOCAL_CUSTOM_ROLE = "\0custom";
 //#endregion
 //#region src/core/parse-local-manifest.ts
@@ -19,8 +22,17 @@ function isGrants(value) {
 function isGrantTable(value) {
 	return isRecord(value) && Object.values(value).every(isGrants);
 }
+function isStringTable(value) {
+	return value === void 0 || isRecord(value) && Object.values(value).every(isStrings);
+}
 function isCustomTable(value) {
-	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"]))) && isGrantTable(value["includes"]);
+	const reach = isRecord(value) ? value["includeReach"] : void 0;
+	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"])) && (row["reach"] === void 0 || isStrings(row["reach"])) && isStringTable(row["levelReach"])) && isGrantTable(value["includes"]) && (reach === void 0 || isRecord(reach) && Object.values(reach).every(isStringTable));
+}
+function isAssignable(value) {
+	if (!isRecord(value)) return false;
+	const { roles, manage, permissions } = value;
+	return Array.isArray(roles) && roles.every((item) => isRecord(item) && typeof item["name"] === "string" && typeof item["on"] === "string" && isStrings(item["allows"])) && isRecord(manage) && isStrings(manage["roles"]) && isStrings(manage["permissions"]) && isStringTable(value["assigns"]) && Array.isArray(permissions) && permissions.every((leaf) => isRecord(leaf) && typeof leaf["key"] === "string") && isStringTable(value["levels"]) && isStringTable(value["grants"]);
 }
 function isText(value) {
 	return typeof value === "string" && value !== "";
@@ -46,12 +58,12 @@ function isRows(value) {
 	return Array.isArray(memberships) && memberships.every(isMembershipRows) && (roles === void 0 || isRecord(roles) && isText(roles["table"]) && isText(roles["user"]) && Array.isArray(roles["roles"]) && roles["roles"].length > 0 && roles["roles"].every(isColumn)) && (customRoles === void 0 || isRecord(customRoles) && isText(customRoles["permissions"]) && isText(customRoles["includes"]));
 }
 /**
-* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
-* no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
-* back without a cast.
+* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no
+* prototype keys. A JSON import widens `v: 1` to `number`; this narrows it back
+* without a cast.
 */
 function parseLocalSnapshotManifest(value) {
-	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && (value["rows"] === void 0 || isRows(value["rows"])) && safeKeys(value);
+	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && (value["rows"] === void 0 || isRows(value["rows"])) && (value["assignable"] === void 0 || isAssignable(value["assignable"])) && safeKeys(value);
 }
 //#endregion
 export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/{parse-request-D_tUXG6M.js → parse-request-CwCZpyjV.js}

@@ -1,13 +1,12 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
 //#region src/approvals/parse-request.ts
 /**
-* Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store
-* or the Cloud returns it, validated against
-* `schemas/approval-request-v1.json`. Returns a deep-frozen copy, or `null`
-* for anything that does not match, including a `__proto__`, `constructor`
-* or `prototype` key.
+* Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or
+* the Cloud returns it, validated against `schemas/approval-request-v1.json`.
+* Returns a deep-frozen copy, or `null` for anything that does not match,
+* including a `__proto__`, `constructor` or `prototype` key.
 */
 function parseApprovalRequest(value) {
 	let input = value;

package/dist/{paths-DXSHAMIa.js → paths-CUvURzHp.js}

@@ -15,7 +15,10 @@ function ownGet(object, key) {
 	if (!Object.hasOwn(object, key)) return;
 	return object[key];
 }
-/** A copy holding only own enumerable properties, so a prototype never supplies a field. */
+/**
+* A copy holding only own enumerable properties, so a prototype never supplies
+* a field.
+*/
 function ownRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
 	const record = {};

package/dist/pdp/index.d.ts

@@ -1,8 +1,11 @@
-import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { o as PermDockOptions } from "../permdock-Dco6dyCK.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-D3A19w4A.js";
+import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { o as PermDockOptions } from "../permdock-B6Sf4T_S.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-B4uqKDnp.js";
 //#region src/pdp/create.d.ts
-/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+/**
+ * The PDP-aware instance, built synchronously like core `getPermDockSync`; use
+ * `getPermDock` for asynchronous inputs.
+ */
 export declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): PdpPermDock<V>;
 /** The PDP-aware instance once every source has answered. */
 export declare function getPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
@@ -14,8 +17,8 @@ export declare function getPermDock<TUser, TPrincipal extends Principal = Princi
  */
 export declare function openfga(options: OpenFgaOptions): DecisionProvider;
 /**
- * A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides
- * one row and `LookupResources` lists the ids `filter` and `where` use. A
+ * A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides one
+ * row and `LookupResources` lists the ids `filter` and `where` use. A
  * conditional permissionship (a caveat missing context) is a denial.
  */
 export declare function spicedb(options: SpiceDbOptions): DecisionProvider;

package/dist/pdp/index.js

@@ -1,13 +1,13 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { n as internalsOf, t as attachInternals } from "../internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-DpPtSKNZ.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { n as internalsOf, t as attachInternals } from "../internals-B3IgHrvo.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { r as decideAllAsync, t as canAllAsync } from "../checks-BC_0mPIq.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BfWEeMqk.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-C8LjUdVU.js";
+import { r as decideAllAsync, t as canAllAsync } from "../checks-CGkP3Z7A.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-L-_I_3zP.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-l0oGGetg.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;
@@ -114,7 +114,10 @@ function wrap(permdock, policy, subject, providers) {
 			return denied("pdp-unavailable");
 		}
 	};
-	/** The local trace; a remote decision evaluated no local grant, so its trace is empty. */
+	/**
+	* The local trace; a remote decision evaluated no local grant, so its trace
+	* is empty.
+	*/
 	const explain = async (permission, data, options) => {
 		const decision = await decide(permission, data, {
 			...options,
@@ -145,7 +148,8 @@ function wrap(permdock, policy, subject, providers) {
 	};
 	const can = async (permission, data, options) => {
 		try {
-			return (await decide(permission, data, options)).outcome === "granted";
+			const { outcome } = await decide(permission, data, options);
+			return outcome === "granted";
 		} catch {
 			return false;
 		}
@@ -291,7 +295,10 @@ function wrap(permdock, policy, subject, providers) {
 	if (internals !== void 0) attachInternals(wrapped, internals);
 	return wrapped;
 }
-/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+/**
+* The PDP-aware instance, built synchronously like core `getPermDockSync`; use
+* `getPermDock` for asynchronous inputs.
+*/
 function getPermDockSync(policy, user, options = {}) {
 	const localPolicy = withoutProviders(policy);
 	const permdock = getPermDockSync$1(localPolicy, user, options);
@@ -425,8 +432,8 @@ function subjectReference(check) {
 	});
 }
 /**
-* A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides
-* one row and `LookupResources` lists the ids `filter` and `where` use. A
+* A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides one
+* row and `LookupResources` lists the ids `filter` and `where` use. A
 * conditional permissionship (a caveat missing context) is a denial.
 */
 function spicedb(options) {

package/dist/{peer-DOzzMfZL.js → peer-C9LvBCcb.js}

@@ -1 +1 @@
-export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-12Q5I_RH.js";
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-Q0fuZ6hx.js";

package/dist/{peer-12Q5I_RH.js → peer-Q0fuZ6hx.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";
@@ -939,7 +939,10 @@ async function requirePeer(load, name, command, cwd = process.cwd(), minimumMajo
 		});
 	}
 }
-/** The major version of the installed `name`; `NaN` when its package.json cannot be read, which no minimum rejects. */
+/**
+* The major version of the installed `name`; `NaN` when its package.json cannot
+* be read, which no minimum rejects.
+*/
 function installedMajor(name) {
 	try {
 		const file = createRequire(import.meta.url).resolve(`${name}/package.json`);
@@ -949,7 +952,10 @@ function installedMajor(name) {
 		return NaN;
 	}
 }
-/** The package manager whose lockfile the project has, else the one running the CLI. */
+/**
+* The package manager whose lockfile the project has, else the one running the
+* CLI.
+*/
 async function packageManagerOf(cwd) {
 	return (await detect({ cwd }))?.agent ?? getUserAgent() ?? void 0;
 }