Metadata-Version: 2.4
Name: liteyukibot-v7-permissions
Version: 0.2.0a2
Summary: Versioned access policy service for LiteyukiBot v7 native plugins.
Author: LiteyukiStudio
License-Expression: LicenseRef-LSO
License-File: LICENSE
Requires-Dist: liteyukibot-v7>=7.0.0a3,<8
Requires-Python: >=3.14
Description-Content-Type: text/markdown

# LiteyukiBot v7 Permissions

`liteyukibot-v7-permissions` provides the versioned
`liteyukibot.permissions@1` service for native LiteyukiBot v7 plugins.

The service resolves exact `runtime_id`, `bot_id`, and `actor_id` principals
into named roles and capability tokens. Wildcards and actor-only global
identities are intentionally unsupported.

```toml
[plugins]
enabled = ["liteyukibot.permissions"]

[plugins.config."liteyukibot.permissions".roles]
operator = ["liteyukibot.status.read", "example.echo.manage"]

[[plugins.config."liteyukibot.permissions".grants]]
runtime_id = "nonebot"
bot_id = "10000"
actor_id = "20000"
roles = ["operator"]
capabilities = ["example.echo.use"]
```

Consumers declare `ServiceRequirement(PERMISSION_SERVICE)` and resolve a
`PermissionService` from their plugin context. `allows(event, capability)`
performs an exact, fail-closed check. `resolve(event)` returns a frozen snapshot
for diagnostics. Every event has `public`; plugins check capabilities rather
than deployment role names.

Privileged boundaries call `decide(event, capability, component=...)` instead.
It has the same exact policy outcome and keeps a bounded in-memory audit
snapshot available through `audit()`. Each record contains only the capability,
principal tuple, component, event ID, allow/deny outcome, and stable reason;
message content, API parameters, and tool arguments are never captured.
