bazis 0.140.0 → 0.140.1

package/core/access/Access.module.ts

@@ -2,8 +2,8 @@ import { Module, singleton } from "../di";
 import { AccessCatalog } from "./catalog/AccessCatalog";
 import { IAccessCatalog } from "./catalog/IAccessCatalog.service";
 import { definePermissions } from "./catalog/permissions";
-import { PermissionSourceLoader } from "./catalog/PermissionSourceLoader";
-import { PermissionSources } from "./catalog/PermissionSources";
+import { PermissionSourceLoader } from "./catalog/PermissionSourceLoader.background";
+import { PermissionSourcesService } from "./catalog/PermissionSources.service";
 import { Access } from "./check/Access";
 import { accessConfig } from "./check/accessConfig";
 import { IAccess } from "./check/IAccess.service";
@@ -29,7 +29,7 @@ export const accessPermissions = definePermissions({
   config: [accessConfig],
   permissions: accessPermissions,
   providers: [
-    singleton(PermissionSources),
+    singleton(PermissionSourcesService),
     singleton(IAccessCatalog, AccessCatalog),
     singleton(AccessPolicy, RolesAccessPolicy),
     singleton(IAccess, Access),

package/core/access/catalog/AccessCatalog.ts

@@ -9,7 +9,7 @@ import type { RolePermission } from "../roles/roles";
 import { IAccessCatalog } from "./IAccessCatalog.service";
 import { declarationsOf } from "./moduleFields";
 import type { PermissionSpec } from "./permissions";
-import type { PermissionSources, PermissionSourceState } from "./PermissionSources";
+import type { PermissionSourcesService, PermissionSourceState } from "./PermissionSources.service";
 
 /** A permission with the module that declares it: in `@Module({ permissions })` or through a source. */
 export interface OwnedPermission {
@@ -40,7 +40,10 @@ export class AccessCatalog extends IAccessCatalog {
   private readonly byKind: ReadonlyMap<string, OwnedReferenceKind>;
   private readonly byName: ReadonlyMap<string, DeclaredRole>;
 
-  constructor(services: ServiceProvider, private readonly sourced: PermissionSources, private readonly config: ConfigView<AccessConfig>) {
+  /** The declared permissions and the ones of the sources as one sorted list, good for one revision of the sources. */
+  private merged: { readonly revision: number; readonly list: readonly OwnedPermission[] } | undefined;
+
+  constructor(services: ServiceProvider, private readonly sourced: PermissionSourcesService, private readonly config: ConfigView<AccessConfig>) {
     super();
     const { permissions, kinds, roles } = declarationsOf(services);
     this.byKey = new Map([...permissions].sort((a, b) => a.key.localeCompare(b.key)).map((item) => [item.key, item]));
@@ -49,8 +52,11 @@ export class AccessCatalog extends IAccessCatalog {
   }
 
   permissions(): readonly OwnedPermission[] {
-    const sourced = this.sourced.permissions();
-    return sourced.length === 0 ? [...this.byKey.values()] : [...this.byKey.values(), ...sourced].sort((a, b) => a.key.localeCompare(b.key));
+    const revision = this.sourced.revision;
+    if (this.merged?.revision !== revision) {
+      this.merged = { revision, list: [...this.byKey.values(), ...this.sourced.permissions()].sort((a, b) => a.key.localeCompare(b.key)) };
+    }
+    return [...this.merged.list];
   }
 
   permission(key: string): OwnedPermission | undefined {

package/core/access/catalog/IAccessCatalog.service.ts

@@ -1,6 +1,6 @@
 import type { Grant } from "../contracts/types";
 import type { DeclaredRole, OwnedPermission, OwnedReferenceKind } from "./AccessCatalog";
-import type { PermissionSourceState } from "./PermissionSources";
+import type { PermissionSourceState } from "./PermissionSources.service";
 
 /**
  * What the application's modules declared about access: permissions, reference

package/core/access/catalog/{PermissionSourceLoader.ts → PermissionSourceLoader.background.ts}

@@ -1,14 +1,19 @@
 import type { HostedService, HostedServiceHealth } from "../../di";
-import type { PermissionSources } from "./PermissionSources";
+import type { PermissionSourcesService } from "./PermissionSources.service";
 
 /** After the infrastructure and the schema (phases below), before the HTTP host (phase 10). */
 const PHASE = 5;
+/** How often a failed source is tried again when the versions are not polled. */
+const RETRY_SECONDS = 5;
+/** A failure or two is a database that blinked; `/health` reports a source that keeps failing. */
+const UNHEALTHY_AFTER = 3;
 
 /**
  * Reads the permission sources before the application takes requests and
  * then asks their versions every `access.sourcePollSeconds` (ACCESS-001 §3.1).
  * A source that fails does not stop the start: its permissions do not exist
- * until a later reading succeeds, and `/health` says so.
+ * until a later reading succeeds, and `/health` says so. Without a poll
+ * (`sourcePollSeconds: 0`) only the sources that failed are tried again.
  */
 export class PermissionSourceLoader implements HostedService {
   readonly phase = PHASE;
@@ -16,16 +21,16 @@ export class PermissionSourceLoader implements HostedService {
   private timer: ReturnType<typeof setInterval> | undefined;
   private polling: Promise<void> | undefined;
 
-  constructor(private readonly sources: PermissionSources) {}
+  constructor(private readonly sources: PermissionSourcesService) {}
 
   async start(): Promise<void> {
+    if (this.sources.count === 0) return;
     await this.sources.load();
-    const seconds = this.sources.pollSeconds;
-    if (seconds <= 0) return;
+    const poll = this.sources.pollSeconds;
     this.timer = setInterval(() => {
       // One question at a time: a slow source is not asked again before it answers.
-      this.polling ??= this.sources.poll().finally(() => { this.polling = undefined; });
-    }, seconds * 1000);
+      this.polling ??= (poll > 0 ? this.sources.poll() : this.sources.retry()).catch(() => undefined).finally(() => { this.polling = undefined; });
+    }, (poll > 0 ? poll : RETRY_SECONDS) * 1000);
     this.timer.unref?.();
   }
 
@@ -35,8 +40,9 @@ export class PermissionSourceLoader implements HostedService {
     await this.polling;
   }
 
+  /** Unhealthy: a source without permissions at all, or one whose readings keep failing. */
   checkHealth(): HostedServiceHealth {
-    const failed = this.sources.state().filter((source) => !source.loaded || source.error !== undefined);
+    const failed = this.sources.state().filter((source) => !source.loaded || source.failures >= UNHEALTHY_AFTER);
     if (failed.length === 0) return { healthy: true };
     return { healthy: false, details: failed.map((source) => `permission source "${source.prefix}": ${source.loaded ? "" : "not loaded: "}${source.error ?? "no reading yet"}`).join("; ") };
   }

package/core/access/catalog/{PermissionSources.ts → PermissionSources.service.ts}

@@ -23,6 +23,8 @@ export interface PermissionSourceState {
   readonly version: string | undefined;
   /** Why the last reading failed; the permissions read before it stay. */
   readonly error: string | undefined;
+  /** Readings and version questions that failed in a row; `0` after a success. */
+  readonly failures: number;
   readonly permissions: number;
 }
 
@@ -31,10 +33,13 @@ interface Source extends OwnedPermissionSource {
   loaded: boolean;
   version: string | undefined;
   error: string | undefined;
-  /** When the version was last compared, for the limit of {@link PermissionSources.verify}. */
+  failures: number;
+  /** When the version was last compared, for the limit of {@link PermissionSourcesService.verify}. */
   verifiedAt: number;
   /** Readings of one source go one after another. */
   queue: Promise<unknown>;
+  /** A call that ran out of time and has not answered yet: no new call starts beside it. */
+  unanswered: Promise<void> | undefined;
 }
 
 /** How often a missing key or attribute may ask a source for its version. */
@@ -45,18 +50,21 @@ const VERIFY_EVERY_MS = 1000;
  * the application takes requests, read again when a source's version changes.
  * A specification passes the checks of a declared one; a bad one is logged and
  * the permission does not exist — closed, never open. A reading that fails
- * leaves the permissions read before it.
+ * leaves the permissions read before it. A source that does not answer in
+ * `access.sourceTimeoutSeconds` has failed: it holds neither the start nor a
+ * request.
  */
-export class PermissionSources {
+export class PermissionSourcesService {
   private readonly sources: readonly Source[];
   private readonly kinds: ReadonlySet<string>;
+  private changes = 0;
 
   constructor(private readonly services: ServiceProvider, private readonly config: ConfigView<AccessConfig>) {
     const { sources, kinds } = declarationsOf(services);
     this.kinds = new Set(kinds.map((kind) => kind.kind));
     this.sources = [...sources]
       .sort((left, right) => left.prefix.localeCompare(right.prefix))
-      .map((source) => ({ ...source, permissions: new Map(), loaded: false, version: undefined, error: undefined, verifiedAt: 0, queue: Promise.resolve() }));
+      .map((source) => ({ ...source, permissions: new Map(), loaded: false, version: undefined, error: undefined, failures: 0, verifiedAt: 0, queue: Promise.resolve(), unanswered: undefined }));
   }
 
   /** The prefix of the source that owns the key, or `undefined` — the key is not of a source. */
@@ -74,7 +82,16 @@ export class PermissionSources {
   }
 
   state(): readonly PermissionSourceState[] {
-    return this.sources.map(({ prefix, module, loaded, version, error, permissions }) => ({ prefix, module, loaded, version, error, permissions: permissions.size }));
+    return this.sources.map(({ prefix, module, loaded, version, error, failures, permissions }) => ({ prefix, module, loaded, version, error, failures, permissions: permissions.size }));
+  }
+
+  /** Grows with every reading that changed the permissions: a list built from them is good until it does. */
+  get revision(): number {
+    return this.changes;
+  }
+
+  get count(): number {
+    return this.sources.length;
   }
 
   /** The seconds between two questions about the versions; `0` — never ask. */
@@ -92,6 +109,13 @@ export class PermissionSources {
     await Promise.all(this.sources.map((source) => this.enqueue(source, () => this.compare(source))));
   }
 
+  /** Tries again the sources whose last reading failed: without a poll nothing else would. */
+  async retry(): Promise<void> {
+    await Promise.all(this.sources
+      .filter((source) => !source.loaded || source.error !== undefined)
+      .map((source) => this.enqueue(source, () => this.compare(source))));
+  }
+
   /**
    * The source of the prefix changed. With `keys` only these permissions are
    * read now; the version stays the old one, so the next comparison reads the
@@ -113,7 +137,9 @@ export class PermissionSources {
     const source = this.sources.find((item) => underPrefix(key, item.prefix));
     if (source === undefined) return false;
     return await this.enqueue(source, async () => {
-      if (!force && Date.now() - source.verifiedAt < VERIFY_EVERY_MS) return false;
+      // A clock set back gives a negative time: compare then, do not wait for the clock to catch up.
+      const since = Date.now() - source.verifiedAt;
+      if (!force && since >= 0 && since < VERIFY_EVERY_MS) return false;
       return await this.compare(source);
     });
   }
@@ -129,9 +155,10 @@ export class PermissionSources {
     source.verifiedAt = Date.now();
     if (source.loaded) {
       try {
-        const version = await this.use(source, async (instance) => String(await instance.version()));
+        const version = await this.use(source, async (instance) => versionOf(await instance.version()));
         if (version === source.version) {
           source.error = undefined;
+          source.failures = 0;
           return false;
         }
       } catch (error) {
@@ -146,7 +173,7 @@ export class PermissionSources {
     source.verifiedAt = Date.now();
     try {
       // The version first: data changed during the reading gives a newer version to the next comparison.
-      const { version, declarations } = await this.use(source, async (instance) => ({ version: String(await instance.version()), declarations: await instance.load() }));
+      const { version, declarations } = await this.use(source, async (instance) => ({ version: versionOf(await instance.version()), declarations: await instance.load() }));
       if (typeof declarations !== "object" || declarations === null || Array.isArray(declarations)) throw new TypeError("load() must return an object: key → permission");
       const permissions = new Map<string, OwnedPermission>();
       for (const key of Object.keys(declarations).sort()) {
@@ -157,6 +184,8 @@ export class PermissionSources {
       source.version = version;
       source.loaded = true;
       source.error = undefined;
+      source.failures = 0;
+      this.changes += 1;
       return true;
     } catch (error) {
       this.failed(source, error);
@@ -176,6 +205,9 @@ export class PermissionSources {
         else permissions.set(key, permission);
       }
       source.permissions = new Map([...permissions].sort(([left], [right]) => left.localeCompare(right)));
+      source.error = undefined;
+      source.failures = 0;
+      this.changes += 1;
       return true;
     } catch (error) {
       this.failed(source, error);
@@ -185,33 +217,61 @@ export class PermissionSources {
 
   /** The permission, or `undefined` with the problems logged: it does not exist then. */
   private accept(source: Source, key: string, spec: PermissionSpec): OwnedPermission | undefined {
-    const problems = underPrefix(key, source.prefix) ? permissionProblems(key, spec) : [`permission "${key}": the key must start with "${source.prefix}."`];
-    if (problems.length === 0) {
-      for (const [name, attribute] of Object.entries(spec.on ?? {})) {
-        if (attribute.ref !== undefined && !this.kinds.has(attribute.ref)) problems.push(`permission "${key}": attribute "${name}" refers to kind "${attribute.ref}", which no module declares in references`);
-      }
-      for (const lookup of lookupsOf(spec)) {
-        if (!this.services.has(lookup)) problems.push(`permission "${key}": ${lookup.name} is not registered: add it to providers of ${source.module}`);
+    let problems: string[];
+    let accepted: OwnedPermission | undefined;
+    try {
+      problems = underPrefix(key, source.prefix) ? permissionProblems(key, spec) : [`permission "${key}": the key must start with "${source.prefix}."`];
+      if (problems.length === 0) {
+        for (const [name, attribute] of Object.entries(spec.on ?? {})) {
+          if (attribute.ref !== undefined && !this.kinds.has(attribute.ref)) problems.push(`permission "${key}": attribute "${name}" refers to kind "${attribute.ref}", which no module declares in references`);
+        }
+        for (const lookup of lookupsOf(spec)) {
+          if (!this.services.has(lookup)) problems.push(`permission "${key}": ${lookup.name} is not registered: add it to providers of ${source.module}`);
+        }
       }
+      if (problems.length === 0) accepted = { key, spec: frozenSpec(spec), module: source.module, source: source.prefix };
+    } catch (error) {
+      // Data of any shape may come from a source: what cannot even be checked is one bad permission, not a failed reading.
+      problems = [`permission "${key}": cannot be checked: ${error instanceof Error ? error.message : String(error)}`];
     }
-    if (problems.length > 0) {
-      this.services.tryResolve(LOGGER)?.error("access permission of a source rejected", { source: source.prefix, module: source.module, permission: key, problems });
-      return undefined;
-    }
-    return { key, spec: frozenSpec(spec), module: source.module, source: source.prefix };
+    if (accepted === undefined) this.services.tryResolve(LOGGER)?.error("access permission of a source rejected", { source: source.prefix, module: source.module, permission: key, problems });
+    return accepted;
   }
 
+  /**
+   * One call of the source in a scope of its own, with a deadline. A call that
+   * ran out of time cannot be stopped: its scope is closed when it answers, and
+   * until then no new call starts, so a database that hangs is asked once.
+   */
   private async use<T>(source: Source, work: (instance: PermissionSource) => Promise<T>): Promise<T> {
+    if (source.unanswered !== undefined) throw new Error("the previous call of the source has not answered yet");
+    const seconds = this.config.get("sourceTimeoutSeconds");
     const scope = this.services.createScope();
+    const working = (async () => await work(scope.resolve(source.type)))();
+    const answered = working.then(() => undefined, () => undefined).then(async () => {
+      source.unanswered = undefined;
+      await scope.dispose().catch(() => undefined);
+    });
+    let late = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const deadline = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => {
+        late = true;
+        source.unanswered = answered;
+        reject(new Error(`the source did not answer in ${seconds} s (access.sourceTimeoutSeconds)`));
+      }, seconds * 1000);
+    });
     try {
-      return await work(scope.resolve(source.type));
+      return await Promise.race([working, deadline]);
     } finally {
-      await scope.dispose();
+      clearTimeout(timer);
+      if (!late) await answered;
     }
   }
 
   private failed(source: Source, error: unknown): void {
     source.error = error instanceof Error ? error.message : String(error);
+    source.failures += 1;
     this.services.tryResolve(LOGGER)?.error("access permission source failed", {
       source: source.prefix,
       module: source.module,
@@ -220,3 +280,13 @@ export class PermissionSources {
     });
   }
 }
+
+/**
+ * A version is what the catalog compares to learn of a change: `undefined`,
+ * `null` or an empty string would look like a version that never changes.
+ */
+function versionOf(value: unknown): string {
+  if (typeof value === "string" && value !== "") return value;
+  if ((typeof value === "number" && Number.isFinite(value)) || typeof value === "bigint") return String(value);
+  throw new TypeError(`version() must return a non-empty string or a number, got ${value === null ? "null" : typeof value === "string" ? "an empty string" : typeof value}`);
+}

package/core/access/catalog/moduleFields.ts

@@ -17,7 +17,7 @@ import { isDeclaredRoles, rolePermission, type RoleDeclarations, type RolePermis
 import { IAccess } from "../check/IAccess.service";
 import type { DeclaredRole, OwnedPermission, OwnedReferenceKind } from "./AccessCatalog";
 import { isDeclaredPermissions, isReferenceKind, isSourcePrefix, lookupsOf, permissionProblems, underPrefix, type PermissionDeclarations, type PermissionSpec } from "./permissions";
-import type { OwnedPermissionSource } from "./PermissionSources";
+import type { OwnedPermissionSource } from "./PermissionSources.service";
 
 interface PermissionPayload { readonly key: string; readonly spec: PermissionSpec }
 interface ReferencePayload { readonly kind: string; readonly type: Class<References> }

package/core/access/catalog/permissions.ts

@@ -97,7 +97,9 @@ export function permissionProblems(key: string, spec: PermissionSpec): string[]
   if (!isText(spec.title, 200)) problems.push(`${at}: title must be a non-empty text up to 200 characters`);
   if (spec.description !== undefined && !isText(spec.description, 2000)) problems.push(`${at}: description must be a non-empty text up to 2000 characters`);
   const scope = spec.scope;
-  if (scope !== undefined && scope !== "none" && scope !== "request") {
+  if (typeof scope !== "object" || scope === null) {
+    if (scope !== undefined && scope !== "none" && scope !== "request") problems.push(`${at}: scope must be "none", "request", { column } or { lookup }`);
+  } else {
     const column = (scope as { column?: unknown }).column;
     const lookup = (scope as { lookup?: unknown }).lookup;
     if ((column === undefined) === (lookup === undefined)) problems.push(`${at}: scope must be "none", "request", { column } or { lookup }`);
@@ -126,7 +128,7 @@ export function permissionProblems(key: string, spec: PermissionSpec): string[]
 /** The lookup classes a permission needs registered. */
 export function lookupsOf(spec: PermissionSpec): Class<AttributeLookup>[] {
   const lookups: Class<AttributeLookup>[] = [];
-  if (typeof spec.scope === "object" && "lookup" in spec.scope) lookups.push(spec.scope.lookup);
+  if (typeof spec.scope === "object" && spec.scope !== null && "lookup" in spec.scope) lookups.push(spec.scope.lookup);
   for (const attribute of Object.values(spec.on ?? {})) if (attribute.lookup !== undefined) lookups.push(attribute.lookup);
   return lookups;
 }
@@ -149,7 +151,7 @@ export function underPrefix(key: string, prefix: string): boolean {
 
 /** A frozen copy of a specification a source gave: the catalog keeps it, the source may change its own. */
 export function frozenSpec(spec: PermissionSpec): PermissionSpec {
-  const scope = typeof spec.scope === "object" ? { ...spec.scope } : spec.scope;
+  const scope = typeof spec.scope === "object" && spec.scope !== null ? { ...spec.scope } : spec.scope;
   const on = spec.on === undefined ? undefined : Object.fromEntries(Object.entries(spec.on).map(([name, attribute]) => [name, { ...attribute }]));
   const title = typeof spec.title === "object" ? { ...spec.title } : spec.title;
   const description = typeof spec.description === "object" ? { ...spec.description } : spec.description;

package/core/access/check/accessConfig.ts

@@ -15,12 +15,15 @@ export interface AccessConfig {
    * `IAccessCatalog.changed` on every instance itself.
    */
   sourcePollSeconds: number;
+  /** Seconds a permission source has for one answer; after them the reading has failed. */
+  sourceTimeoutSeconds: number;
 }
 
 export const accessConfig = defineConfig<AccessConfig>("access", {
-  default: { kindClaim: "", roleClaim: "role", maxInList: 1000, sourcePollSeconds: 5 },
+  default: { kindClaim: "", roleClaim: "role", maxInList: 1000, sourcePollSeconds: 5, sourceTimeoutSeconds: 10 },
   validate: {
     maxInList: (value) => Number.isSafeInteger(value) && value >= 1 && value <= 100_000 ? undefined : "must be an integer 1–100000",
     sourcePollSeconds: (value) => Number.isFinite(value) && value >= 0 && value <= 3600 ? undefined : "must be a number 0–3600",
+    sourceTimeoutSeconds: (value) => Number.isFinite(value) && value > 0 && value <= 600 ? undefined : "must be a number above 0, up to 600",
   },
 });

package/core/access/contracts/PermissionSource.ts

@@ -20,9 +20,10 @@ export abstract class PermissionSource {
    * The version of the source's data: a counter or a timestamp that changes in
    * one transaction with the data. Every instance of the application asks it
    * every `access.sourcePollSeconds` and reads the permissions again when it
-   * differs.
+   * differs. Nothing — `undefined`, `null`, an empty string — is a failed
+   * reading: it would look like a version that never changes.
    */
-  abstract version(): string | Promise<string>;
+  abstract version(): PermissionSourceVersion | Promise<PermissionSourceVersion>;
 
   /**
    * The permissions of the prefix, in the form of `definePermissions`. With
@@ -30,3 +31,6 @@ export abstract class PermissionSource {
    */
   abstract load(keys?: readonly string[]): PermissionDeclarations | Promise<PermissionDeclarations>;
 }
+
+/** A counter (a number, a bigint) or any non-empty string: the catalog only tells whether it differs. */
+export type PermissionSourceVersion = string | number | bigint;

package/core/access/generated/deps.ts

@@ -4,15 +4,15 @@ import { registerFrameworkClassDeps } from "../../di/module/autoDeps";
 import { ServiceProvider } from "../../di/ServiceProvider";
 import { AccessCatalog } from "../catalog/AccessCatalog";
 import { IAccessCatalog } from "../catalog/IAccessCatalog.service";
-import { PermissionSourceLoader } from "../catalog/PermissionSourceLoader";
-import { PermissionSources } from "../catalog/PermissionSources";
+import { PermissionSourceLoader } from "../catalog/PermissionSourceLoader.background";
+import { PermissionSourcesService } from "../catalog/PermissionSources.service";
 import { Access } from "../check/Access";
 import { RolesAccessPolicy } from "../roles/RolesAccessPolicy";
 
 registerFrameworkClassDeps([
   [Access, [IAccessCatalog, "Config:access"]],
-  [AccessCatalog, [ServiceProvider, PermissionSources, "Config:access"]],
-  [PermissionSourceLoader, [PermissionSources]],
-  [PermissionSources, [ServiceProvider, "Config:access"]],
+  [AccessCatalog, [ServiceProvider, PermissionSourcesService, "Config:access"]],
+  [PermissionSourceLoader, [PermissionSourcesService]],
+  [PermissionSourcesService, [ServiceProvider, "Config:access"]],
   [RolesAccessPolicy, [IAccessCatalog, "Config:access"]],
 ]);

package/core/access/index.ts

@@ -26,7 +26,7 @@ export interface BazisPermissionSources {}
 
 export { AccessModule } from "./Access.module";
 export { definePermissions, type AnyPermissionKey, type AttributeSpec, type OwnPermissionKey, type PermissionDeclarations, type PermissionKey, type PermissionsOf, type PermissionSpec, type ScopeSource, type SourcePermissionKey } from "./catalog/permissions";
-export type { PermissionSourceState } from "./catalog/PermissionSources";
+export type { PermissionSourceState } from "./catalog/PermissionSources.service";
 export { IAccessCatalog } from "./catalog/IAccessCatalog.service";
 export type { DeclaredRole, OwnedPermission, OwnedReferenceKind } from "./catalog/AccessCatalog";
 export { IAccess } from "./check/IAccess.service";
@@ -36,7 +36,7 @@ export { can } from "./check/can";
 export { grantsToWhere, type AccessFilter, type ColumnCondition } from "./check/filter";
 export { AccessPolicy, type ScopePrincipals } from "./contracts/AccessPolicy";
 export { AttributeLookup, type LookupColumn } from "./contracts/AttributeLookup";
-export { PermissionSource } from "./contracts/PermissionSource";
+export { PermissionSource, type PermissionSourceVersion } from "./contracts/PermissionSource";
 export { References, type ReferenceContext, type ReferenceItem, type ReferencePage } from "./contracts/References";
 export { AccessFilterTooLargeError, AccessSetupError } from "./contracts/errors";
 export type {

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.140.0" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.140.1" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.140.0",
+  "version": "0.140.1",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",