pipework 0.8.7 → 0.8.8

package/dist/pipework.js

@@ -0,0 +1,222 @@
+import { loadConfig as parseConfig } from './config/load.js';
+import { createManagedConnection } from './db/pool.js';
+import { InvariantViolation } from './invariants/assert.js';
+import { startSurfaces } from './surface/start.js';
+import { orchestrateStartup } from './lifecycle/startup.js';
+import { getBaseLogger } from './logging/index.js';
+import { validateStartup } from './validation/startup.js';
+import { createJobContext } from './context/create.js';
+import { runInContext } from './context/store.js';
+/**
+ * Creates the Pipework application instance. This is the entry point for every Pipework app.
+ * Define in `pipework.config.ts` and export as default.
+ */
+export function createManifold(raw) {
+    const { surfaces: surfacesDef, lifecycle: lifecycleDef, ...blueprintRaw } = raw;
+    const config = parseConfig(blueprintRaw);
+    const pool = createPoolState(config);
+    const isolation = createIsolationState();
+    const connections = createConnectionTracker();
+    const surfaces = surfacesDef ?? {};
+    const lifecycleConfig = lifecycleDef ?? {};
+    let running = null;
+    let signalCleanup = null;
+    const manifold = {
+        config,
+        env: config.env,
+        pool,
+        isolation,
+        connections,
+        surfaceNames() {
+            return Object.keys(surfaces);
+        },
+        surfaceMap() {
+            return { ...surfaces };
+        },
+        async start() {
+            if (running !== null) {
+                throw new Error('[pipework] Manifold is already started.\n\n' +
+                    '  Call stop() before starting again.\n');
+            }
+            const startupOpts = {};
+            if (lifecycleConfig.preStart !== undefined) {
+                ;
+                startupOpts.hooks = lifecycleConfig.preStart;
+            }
+            if (lifecycleConfig.startupTimeoutMs !== undefined) {
+                ;
+                startupOpts.timeoutMs = lifecycleConfig.startupTimeoutMs;
+            }
+            await orchestrateStartup(manifold, startupOpts);
+            await validateStartup({
+                configuredDatabases: config.databaseNames(),
+                environment: config.environment,
+                surfaces,
+                defaultDbAvailable: config.databaseNames().length === 1,
+                databases: config.databases(),
+            });
+            const context = manifold;
+            running = await startSurfaces(context, config, surfaces);
+            signalCleanup = installSignalHandlers(manifold);
+        },
+        async seed(fn, options) {
+            const ctx = createJobContext({
+                instance: manifold,
+                jobType: options?.jobType ?? 'seed',
+                auth: options?.auth ?? null,
+                tenant: options?.tenant ?? null,
+            });
+            return runInContext(ctx, fn);
+        },
+        async stop() {
+            const logger = getBaseLogger();
+            if (signalCleanup !== null) {
+                signalCleanup();
+                signalCleanup = null;
+            }
+            if (lifecycleConfig.preShutdown) {
+                for (const hook of lifecycleConfig.preShutdown) {
+                    try {
+                        await hook.execute();
+                    }
+                    catch (err) {
+                        logger.error({ hook: hook.name, err }, 'Pre-shutdown hook failed');
+                    }
+                }
+            }
+            if (running !== null) {
+                await running.stop();
+                running = null;
+            }
+            await pool.closeAll();
+        },
+    };
+    return manifold;
+}
+function installSignalHandlers(manifold) {
+    const logger = getBaseLogger();
+    let stopping = false;
+    const handler = (signal) => {
+        if (stopping)
+            return;
+        stopping = true;
+        logger.info({ signal }, 'Shutdown signal received');
+        void manifold.stop().then(() => {
+            process.exit(0);
+        }).catch((err) => {
+            logger.error({ err }, 'Error during shutdown');
+            process.exit(1);
+        });
+    };
+    const sigterm = () => handler('SIGTERM');
+    const sigint = () => handler('SIGINT');
+    process.on('SIGTERM', sigterm);
+    process.on('SIGINT', sigint);
+    return () => {
+        process.removeListener('SIGTERM', sigterm);
+        process.removeListener('SIGINT', sigint);
+    };
+}
+function createPoolState(resolvedConfig) {
+    const map = new Map();
+    const overrides = new Map();
+    return {
+        getOrCreate(config) {
+            const overridden = overrides.get(config.name);
+            if (overridden)
+                return overridden;
+            const existing = map.get(config.name);
+            if (existing)
+                return existing;
+            const managed = createManagedConnection(config, () => map.delete(config.name), resolvedConfig.observability);
+            map.set(config.name, managed);
+            return managed;
+        },
+        get(name) {
+            return overrides.get(name) ?? map.get(name);
+        },
+        async closeAll() {
+            const closing = [...map.values()].map(c => c.close());
+            await Promise.all(closing);
+            overrides.clear();
+        },
+        count() {
+            return map.size + overrides.size;
+        },
+        override(name, conn) {
+            overrides.set(name, conn);
+        },
+        clearOverrides() {
+            overrides.clear();
+        },
+    };
+}
+function createIsolationState() {
+    let active = 0;
+    let totalBegins = 0;
+    let totalEnds = 0;
+    return {
+        markBegin() {
+            active++;
+            totalBegins++;
+        },
+        markEnd() {
+            if (active <= 0) {
+                throw new InvariantViolation('isolation-end-without-begin', {
+                    activeIsolationContexts: active,
+                    totalBegins,
+                    totalEnds,
+                });
+            }
+            active--;
+            totalEnds++;
+        },
+        assertClean() {
+            if (active !== 0) {
+                throw new InvariantViolation('isolation-context-leak', {
+                    activeIsolationContexts: active,
+                    totalBegins,
+                    totalEnds,
+                    delta: totalBegins - totalEnds,
+                });
+            }
+        },
+        stats() {
+            return { active, totalBegins, totalEnds };
+        },
+        reset() {
+            active = 0;
+            totalBegins = 0;
+            totalEnds = 0;
+        },
+    };
+}
+function createConnectionTracker() {
+    const tracked = new Map();
+    return {
+        track(id, name, context) {
+            tracked.set(id, { name, createdAt: Date.now(), context });
+        },
+        release(id) {
+            tracked.delete(id);
+        },
+        activeCount() {
+            return tracked.size;
+        },
+        assertNoLeaks(maxExpected) {
+            if (tracked.size > maxExpected) {
+                throw new InvariantViolation('connection-pool-bounded', {
+                    active: tracked.size,
+                    maxExpected,
+                    connections: [...tracked.entries()].map(([id, c]) => ({
+                        id,
+                        name: c.name,
+                        age_ms: Date.now() - c.createdAt,
+                        context: c.context,
+                    })),
+                });
+            }
+        },
+    };
+}
+//# sourceMappingURL=pipework.js.map

package/dist/pipework.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipework.js","sourceRoot":"","sources":["../src/pipework.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAI5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAG3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AA0EjD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,GAIC;IAED,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,GAAG,GAAG,CAAA;IAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAA;IAC7C,MAAM,QAAQ,GAAG,WAAW,IAAI,EAAE,CAAA;IAClC,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAA;IAE1C,IAAI,OAAO,GAAuB,IAAI,CAAA;IACtC,IAAI,aAAa,GAAwB,IAAI,CAAA;IAE7C,MAAM,QAAQ,GAAmB;QAC/B,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,GAA2B;QACvC,IAAI;QACJ,SAAS;QACT,WAAW;QAEX,YAAY;YACV,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9B,CAAC;QAED,UAAU;YACR,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;QACxB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,6CAA6C;oBAC7C,wCAAwC,CACzC,CAAA;YACH,CAAC;YAED,MAAM,WAAW,GAAoD,EAAE,CAAA;YACvE,IAAI,eAAe,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3C,CAAC;gBAAC,WAAiD,CAAC,KAAK,GAAG,eAAe,CAAC,QAAkC,CAAA;YAChH,CAAC;YACD,IAAI,eAAe,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnD,CAAC;gBAAC,WAAqC,CAAC,SAAS,GAAG,eAAe,CAAC,gBAAgB,CAAA;YACtF,CAAC;YACD,MAAM,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YAE/C,MAAM,eAAe,CAAC;gBACpB,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ;gBACR,kBAAkB,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,MAAM,KAAK,CAAC;gBACvD,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;aAC9B,CAAC,CAAA;YAEF,MAAM,OAAO,GAAmB,QAAQ,CAAA;YACxC,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YAExD,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,EAAwB,EAAE,OAAqB;YAC3D,MAAM,GAAG,GAAG,gBAAgB,CAAC;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,MAAM;gBACnC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;aAChC,CAAC,CAAA;YACF,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC9B,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;YAE9B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,aAAa,EAAE,CAAA;gBACf,aAAa,GAAG,IAAI,CAAA;YACtB,CAAC;YAED,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;oBAC/C,IAAI,CAAC;wBACH,MAAO,IAAqB,CAAC,OAAO,EAAE,CAAA;oBACxC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAA;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;gBACpB,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;YAED,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;KACF,CAAA;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAkB;IAC/C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,EAAE;QACjC,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAEnD,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAA;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAEtC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE5B,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,cAA8B;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;IAEtD,OAAO;QACL,WAAW,CAAC,MAAwB;YAClC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC7C,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAA;YAEjC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAE7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAA;YAC5G,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC7B,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,GAAG,CAAC,IAAY;YACd,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;YACrD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC1B,SAAS,CAAC,KAAK,EAAE,CAAA;QACnB,CAAC;QAED,KAAK;YACH,OAAO,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;QAClC,CAAC;QAED,QAAQ,CAAC,IAAY,EAAE,IAAuB;YAC5C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,cAAc;YACZ,SAAS,CAAC,KAAK,EAAE,CAAA;QACnB,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,OAAO;QACL,SAAS;YACP,MAAM,EAAE,CAAA;YACR,WAAW,EAAE,CAAA;QACf,CAAC;QAED,OAAO;YACL,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,EAAE;oBAC1D,uBAAuB,EAAE,MAAM;oBAC/B,WAAW;oBACX,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,EAAE,CAAA;YACR,SAAS,EAAE,CAAA;QACb,CAAC;QAED,WAAW;YACT,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE;oBACrD,uBAAuB,EAAE,MAAM;oBAC/B,WAAW;oBACX,SAAS;oBACT,KAAK,EAAE,WAAW,GAAG,SAAS;iBAC/B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,KAAK;YACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;QAC3C,CAAC;QAED,KAAK;YACH,MAAM,GAAG,CAAC,CAAA;YACV,WAAW,GAAG,CAAC,CAAA;YACf,SAAS,GAAG,CAAC,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgE,CAAA;IAEvF,OAAO;QACL,KAAK,CAAC,EAAU,EAAE,IAAY,EAAE,OAAe;YAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,OAAO,CAAC,EAAU;YAChB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;QAED,aAAa,CAAC,WAAmB;YAC/B,IAAI,OAAO,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE;oBACtD,MAAM,EAAE,OAAO,CAAC,IAAI;oBACpB,WAAW;oBACX,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACpD,EAAE;wBACF,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS;wBAChC,OAAO,EAAE,CAAC,CAAC,OAAO;qBACnB,CAAC,CAAC;iBACJ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/rbac/cache.d.ts

@@ -0,0 +1,13 @@
+import type { PermissionSet } from './types.js';
+export declare class PermissionCache {
+    private readonly store;
+    private readonly ttlMs;
+    constructor(ttlMs: number);
+    get(userId: string, tenantId: string, authVersion: number): PermissionSet | null;
+    set(permissionSet: PermissionSet): void;
+    invalidate(userId: string, tenantId: string): void;
+    clear(): void;
+    get size(): number;
+    private key;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/rbac/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/rbac/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;gBAElB,KAAK,EAAE,MAAM;IAIzB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAWhF,GAAG,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAQvC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IASlD,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,GAAG;CAGZ"}

package/dist/rbac/cache.js

@@ -0,0 +1,43 @@
+export class PermissionCache {
+    store = new Map();
+    ttlMs;
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+    }
+    get(userId, tenantId, authVersion) {
+        const key = this.key(userId, tenantId, authVersion);
+        const entry = this.store.get(key);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.store.delete(key);
+            return null;
+        }
+        return entry.set;
+    }
+    set(permissionSet) {
+        const key = this.key(permissionSet.userId, permissionSet.tenantId, permissionSet.authVersion);
+        this.store.set(key, {
+            set: permissionSet,
+            expiresAt: Date.now() + this.ttlMs,
+        });
+    }
+    invalidate(userId, tenantId) {
+        const prefix = `${userId}:${tenantId}:`;
+        for (const key of this.store.keys()) {
+            if (key.startsWith(prefix)) {
+                this.store.delete(key);
+            }
+        }
+    }
+    clear() {
+        this.store.clear();
+    }
+    get size() {
+        return this.store.size;
+    }
+    key(userId, tenantId, authVersion) {
+        return `${userId}:${tenantId}:${authVersion}`;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/rbac/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/rbac/cache.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,eAAe;IACT,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IACrC,KAAK,CAAQ;IAE9B,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAA;IAClB,CAAC;IAED,GAAG,CAAC,aAA4B;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;QAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAAgB;QACzC,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,QAAQ,GAAG,CAAA;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IACxB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,WAAmB;QAC/D,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAA;IAC/C,CAAC;CACF"}

package/dist/rbac/check.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedPermission } from './types.js';
+export declare function scopeSatisfies(granted: string, required: string, hierarchy?: readonly string[]): boolean;
+export declare function hasPermission(permissions: readonly ResolvedPermission[], resource: string, action: string, requiredScope?: string, hierarchy?: readonly string[]): boolean;
+//# sourceMappingURL=check.d.ts.map

package/dist/rbac/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/rbac/check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAIpD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAKT;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,OAAO,CAQT"}

package/dist/rbac/check.js

@@ -0,0 +1,20 @@
+const DEFAULT_HIERARCHY = ['own', 'team', 'territory', 'tenant'];
+export function scopeSatisfies(granted, required, hierarchy = DEFAULT_HIERARCHY) {
+    const grantedIdx = hierarchy.indexOf(granted);
+    const requiredIdx = hierarchy.indexOf(required);
+    if (grantedIdx === -1 || requiredIdx === -1)
+        return false;
+    return grantedIdx >= requiredIdx;
+}
+export function hasPermission(permissions, resource, action, requiredScope, hierarchy = DEFAULT_HIERARCHY) {
+    for (const perm of permissions) {
+        if (perm.resource === resource && perm.action === action) {
+            if (requiredScope === undefined)
+                return true;
+            if (scopeSatisfies(perm.scope, requiredScope, hierarchy))
+                return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=check.js.map

package/dist/rbac/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/rbac/check.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAEnF,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,QAAgB,EAChB,YAA+B,iBAAiB;IAEhD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,UAAU,IAAI,WAAW,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,WAA0C,EAC1C,QAAgB,EAChB,MAAc,EACd,aAAsB,EACtB,YAA+B,iBAAiB;IAEhD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzD,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;QACvE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/rbac/index.d.ts

@@ -0,0 +1,8 @@
+import type { RbacConfig, Rbac } from './types.js';
+export type { RbacConfig, Rbac, PermissionSet, ResolvedPermission, Scope, SeedData, SeedPermission, SeedRole, SeedRolePermission, SeedUserRole } from './types.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+/** Creates an Rbac instance from role/permission config — provides check, enforce, and seed operations. */
+export declare function createRbac(config: RbacConfig): Rbac;
+//# sourceMappingURL=index.d.ts.map

package/dist/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAA2B,MAAM,YAAY,CAAA;AAM3E,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAClK,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CA0BnD"}

package/dist/rbac/index.js

@@ -0,0 +1,32 @@
+import { PermissionCache } from './cache.js';
+import { resolveUserPermissions } from './resolve.js';
+import { hasPermission } from './check.js';
+import { seedRbac } from './seed.js';
+export { hasPermission, scopeSatisfies } from './check.js';
+export { PermissionCache } from './cache.js';
+export { enforcePermission } from './middleware.js';
+/** Creates an Rbac instance from role/permission config — provides check, enforce, and seed operations. */
+export function createRbac(config) {
+    const cache = new PermissionCache(config.cacheTtlMs ?? 60_000);
+    const scopes = config.scopes ?? ['own', 'team', 'territory', 'tenant'];
+    return {
+        async resolve(db, userId, tenantId, authVersion) {
+            const cached = cache.get(userId, tenantId, authVersion);
+            if (cached)
+                return cached;
+            const resolved = await resolveUserPermissions(db, userId, tenantId, authVersion, config);
+            cache.set(resolved);
+            return resolved;
+        },
+        check(permissions, resource, action, requiredScope) {
+            return hasPermission(permissions.permissions, resource, action, requiredScope, scopes);
+        },
+        invalidate(userId, tenantId) {
+            cache.invalidate(userId, tenantId);
+        },
+        async seed(db, data) {
+            await seedRbac(db, data, config);
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;IAEtE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,MAAc,EAAE,QAAgB,EAAE,WAAmB;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YACxF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnB,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,WAA0B,EAAE,QAAgB,EAAE,MAAc,EAAE,aAAsB;YACxF,OAAO,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;QACxF,CAAC;QAED,UAAU,CAAC,MAAc,EAAE,QAAgB;YACzC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACpC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,IAAc;YAC/B,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/rbac/middleware.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { Rbac } from './types.js';
+export declare function enforcePermission(rbac: Rbac, db: DB, userId: string, tenantId: string, authVersion: number, resource: string, action: string, requiredScope?: string): Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/rbac/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/rbac/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/rbac/middleware.js

@@ -0,0 +1,9 @@
+import { ForbiddenError } from '../errors/index.js';
+export async function enforcePermission(rbac, db, userId, tenantId, authVersion, resource, action, requiredScope) {
+    const permissions = await rbac.resolve(db, userId, tenantId, authVersion);
+    const granted = rbac.check(permissions, resource, action, requiredScope);
+    if (!granted) {
+        throw new ForbiddenError(`Missing permission: ${resource}:${action}`);
+    }
+}
+//# sourceMappingURL=middleware.js.map

package/dist/rbac/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/rbac/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,QAAgB,EAChB,MAAc,EACd,aAAsB;IAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAA;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,uBAAuB,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/dist/rbac/namespace.d.ts

@@ -0,0 +1,15 @@
+import { createRbac, hasPermission, enforcePermission, scopeSatisfies, PermissionCache } from './index.js';
+/** Role-based access control namespace — permission checking, enforcement, scope hierarchy. */
+export declare const rbac: {
+    /** Creates an Rbac instance from config (roles, permissions, hierarchy). */
+    create: typeof createRbac;
+    /** Checks if a permission set includes the required resource/action/scope. Pure function, no DB. */
+    check: typeof hasPermission;
+    /** Checks permission and throws ForbiddenError if denied. Loads permissions from DB with caching. */
+    enforce: typeof enforcePermission;
+    /** Checks if a granted scope satisfies a required scope given a hierarchy (e.g. org > team > self). */
+    satisfies: typeof scopeSatisfies;
+    /** LRU cache for resolved permissions — avoids repeated DB lookups within a request. */
+    PermissionCache: typeof PermissionCache;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/rbac/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/rbac/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE1G,+FAA+F;AAC/F,eAAO,MAAM,IAAI;IACf,4EAA4E;;IAE5E,oGAAoG;;IAEpG,qGAAqG;;IAErG,uGAAuG;;IAEvG,wFAAwF;;CAEzF,CAAA"}

package/dist/rbac/namespace.js

@@ -0,0 +1,15 @@
+import { createRbac, hasPermission, enforcePermission, scopeSatisfies, PermissionCache } from './index.js';
+/** Role-based access control namespace — permission checking, enforcement, scope hierarchy. */
+export const rbac = {
+    /** Creates an Rbac instance from config (roles, permissions, hierarchy). */
+    create: createRbac,
+    /** Checks if a permission set includes the required resource/action/scope. Pure function, no DB. */
+    check: hasPermission,
+    /** Checks permission and throws ForbiddenError if denied. Loads permissions from DB with caching. */
+    enforce: enforcePermission,
+    /** Checks if a granted scope satisfies a required scope given a hierarchy (e.g. org > team > self). */
+    satisfies: scopeSatisfies,
+    /** LRU cache for resolved permissions — avoids repeated DB lookups within a request. */
+    PermissionCache,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/rbac/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/rbac/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE1G,+FAA+F;AAC/F,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,4EAA4E;IAC5E,MAAM,EAAE,UAAU;IAClB,oGAAoG;IACpG,KAAK,EAAE,aAAa;IACpB,qGAAqG;IACrG,OAAO,EAAE,iBAAiB;IAC1B,uGAAuG;IACvG,SAAS,EAAE,cAAc;IACzB,wFAAwF;IACxF,eAAe;CAChB,CAAA"}

package/dist/rbac/resolve.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { RbacConfig, PermissionSet } from './types.js';
+export declare function resolveUserPermissions(db: DB, userId: string, tenantId: string, authVersion: number, config: RbacConfig): Promise<PermissionSet>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/rbac/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/rbac/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAA;AAG/E,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/dist/rbac/resolve.js

@@ -0,0 +1,24 @@
+import { sql } from '../db/sql.js';
+import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
+export async function resolveUserPermissions(db, userId, tenantId, authVersion, config) {
+    const userRolesTable = config.table?.userRoles ?? 'pipework_user_roles';
+    const rolePermissionsTable = config.table?.rolePermissions ?? 'pipework_role_permissions';
+    const permissionsTable = config.table?.permissions ?? 'pipework_permissions';
+    assertValidIdentifier(userRolesTable, 'userRoles table');
+    assertValidIdentifier(rolePermissionsTable, 'rolePermissions table');
+    assertValidIdentifier(permissionsTable, 'permissions table');
+    const rows = await db.execute(sql `
+    SELECT p.resource, p.action, rp.scope
+    FROM ${sql.raw(quoteIdentifier(userRolesTable, 'userRoles table'))} ur
+    JOIN ${sql.raw(quoteIdentifier(rolePermissionsTable, 'rolePermissions table'))} rp ON rp.role_id = ur.role_id
+    JOIN ${sql.raw(quoteIdentifier(permissionsTable, 'permissions table'))} p ON p.id = rp.permission_id
+    WHERE ur.user_id = ${userId} AND ur.tenant_id = ${tenantId}
+  `);
+    const permissions = rows.map((row) => ({
+        resource: row['resource'],
+        action: row['action'],
+        scope: row['scope'],
+    }));
+    return { userId, tenantId, authVersion, permissions };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/rbac/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/rbac/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,MAAkB;IAElB,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,qBAAqB,CAAA;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,2BAA2B,CAAA;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAA;IAE5E,qBAAqB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IACxD,qBAAqB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IACpE,qBAAqB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;WAExB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;WAC3D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;WACvE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;yBACjD,MAAM,uBAAuB,QAAQ;GAC3D,CAAC,CAAA;IAEF,MAAM,WAAW,GAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAW;QACnC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;QAC/B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAW;KAC9B,CAAC,CAAC,CAAA;IAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,CAAA;AACvD,CAAC"}

package/dist/rbac/seed.d.ts

@@ -0,0 +1,4 @@
+import type { DB } from '../db/index.js';
+import type { RbacConfig, SeedData } from './types.js';
+export declare function seedRbac(db: DB, data: SeedData, config: RbacConfig): Promise<void>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/rbac/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/rbac/seed.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGtD,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAgEf"}

package/dist/rbac/seed.js

@@ -0,0 +1,63 @@
+import { sql } from '../db/sql.js';
+import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
+export async function seedRbac(db, data, config) {
+    const permissionsTable = config.table?.permissions ?? 'pipework_permissions';
+    const rolesTable = config.table?.roles ?? 'pipework_roles';
+    const rolePermissionsTable = config.table?.rolePermissions ?? 'pipework_role_permissions';
+    const userRolesTable = config.table?.userRoles ?? 'pipework_user_roles';
+    assertValidIdentifier(permissionsTable, 'permissions table');
+    assertValidIdentifier(rolesTable, 'roles table');
+    assertValidIdentifier(rolePermissionsTable, 'rolePermissions table');
+    assertValidIdentifier(userRolesTable, 'userRoles table');
+    const permQ = quoteIdentifier(permissionsTable, 'permissions table');
+    const rolesQ = quoteIdentifier(rolesTable, 'roles table');
+    const rolePermQ = quoteIdentifier(rolePermissionsTable, 'rolePermissions table');
+    const userRolesQ = quoteIdentifier(userRolesTable, 'userRoles table');
+    for (const perm of data.permissions) {
+        await db.execute(sql `
+      INSERT INTO ${sql.raw(permQ)} (resource, action)
+      VALUES (${perm.resource}, ${perm.action})
+      ON CONFLICT (resource, action) DO NOTHING
+    `);
+    }
+    for (const role of data.roles) {
+        if (role.description !== undefined) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolesQ)} (name, tenant_id, description)
+        VALUES (${role.name}, ${role.tenantId}, ${role.description})
+        ON CONFLICT (tenant_id, name) DO UPDATE SET
+          description = EXCLUDED.description
+      `);
+        }
+        else {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolesQ)} (name, tenant_id)
+        VALUES (${role.name}, ${role.tenantId})
+        ON CONFLICT (tenant_id, name) DO UPDATE SET
+          description = EXCLUDED.description
+      `);
+        }
+        for (const rp of role.permissions) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(rolePermQ)} (role_id, permission_id, scope)
+        SELECT r.id, p.id, ${rp.scope}
+        FROM ${sql.raw(rolesQ)} r, ${sql.raw(permQ)} p
+        WHERE r.name = ${role.name} AND r.tenant_id = ${role.tenantId}
+          AND p.resource = ${rp.resource} AND p.action = ${rp.action}
+        ON CONFLICT (role_id, permission_id) DO UPDATE SET scope = EXCLUDED.scope
+      `);
+        }
+    }
+    if (data.userRoles) {
+        for (const ur of data.userRoles) {
+            await db.execute(sql `
+        INSERT INTO ${sql.raw(userRolesQ)} (user_id, role_id, tenant_id)
+        SELECT ${ur.userId}, r.id, ${ur.tenantId}
+        FROM ${sql.raw(rolesQ)} r
+        WHERE r.name = ${ur.roleName} AND r.tenant_id = ${ur.tenantId}
+        ON CONFLICT (user_id, role_id, tenant_id) DO NOTHING
+      `);
+        }
+    }
+}
+//# sourceMappingURL=seed.js.map

package/dist/rbac/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/rbac/seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAGlC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAM,EACN,IAAc,EACd,MAAkB;IAElB,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,sBAAsB,CAAA;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,gBAAgB,CAAA;IAC1D,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,2BAA2B,CAAA;IACzF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,qBAAqB,CAAA;IAEvE,qBAAqB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IAC5D,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAChD,qBAAqB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IACpE,qBAAqB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IAExD,MAAM,KAAK,GAAG,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IAChF,MAAM,UAAU,GAAG,eAAe,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAA;IAErE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;oBACJ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAClB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM;;KAExC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;kBACnB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW;;;OAG3D,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;kBACnB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ;;;OAGtC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;6BACX,EAAE,CAAC,KAAK;eACtB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;yBAC1B,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC,QAAQ;6BACxC,EAAE,CAAC,QAAQ,mBAAmB,EAAE,CAAC,MAAM;;OAE7D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACJ,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;iBACxB,EAAE,CAAC,MAAM,WAAW,EAAE,CAAC,QAAQ;eACjC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;yBACL,EAAE,CAAC,QAAQ,sBAAsB,EAAE,CAAC,QAAQ;;OAE9D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/rbac/types.d.ts

@@ -0,0 +1,56 @@
+import type { DB } from '../db/index.js';
+export type Scope = 'own' | 'team' | 'territory' | 'tenant';
+export interface RbacConfig {
+    readonly database: string;
+    readonly scopes?: readonly string[];
+    readonly cacheTtlMs?: number;
+    readonly table?: {
+        readonly permissions?: string;
+        readonly roles?: string;
+        readonly rolePermissions?: string;
+        readonly userRoles?: string;
+    };
+}
+export interface ResolvedPermission {
+    readonly resource: string;
+    readonly action: string;
+    readonly scope: string;
+}
+export interface PermissionSet {
+    readonly userId: string;
+    readonly tenantId: string;
+    readonly authVersion: number;
+    readonly permissions: readonly ResolvedPermission[];
+}
+export interface SeedPermission {
+    readonly resource: string;
+    readonly action: string;
+}
+export interface SeedRolePermission {
+    readonly resource: string;
+    readonly action: string;
+    readonly scope: string;
+}
+export interface SeedRole {
+    readonly name: string;
+    readonly tenantId: string;
+    readonly description?: string;
+    readonly permissions: readonly SeedRolePermission[];
+}
+export interface SeedUserRole {
+    readonly userId: string;
+    readonly roleName: string;
+    readonly tenantId: string;
+}
+export interface SeedData {
+    readonly permissions: readonly SeedPermission[];
+    readonly roles: readonly SeedRole[];
+    readonly userRoles?: readonly SeedUserRole[];
+}
+export interface Rbac {
+    resolve(db: DB, userId: string, tenantId: string, authVersion: number): Promise<PermissionSet>;
+    check(permissions: PermissionSet, resource: string, action: string, requiredScope?: string): boolean;
+    invalidate(userId: string, tenantId: string): void;
+    seed(db: DB, data: SeedData): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/rbac/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAExC,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE3D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;QACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,IAAI;IACnB,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9F,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACpG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAClD,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C"}