permdock 0.3.1 → 0.5.0

package/dist/doctor-collect-CjdO0wQX.js

@@ -1,665 +0,0 @@
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { h as separationConflicts } from "./policy-xyWg7QdR.js";
-import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { b as validateCustomRole } from "./permdock-CbgvLnuo.js";
-import { o as parseCredential } from "./credential-8P81ff4u.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
-import { a as sqlFiles, n as doctorSrcPath } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DSTE3ml9.js";
-import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
-import { T as graphSqlName } from "./rls-shared-Cewd_-zI.js";
-import { W as contextRefs, h as tableFor, p as commandFor } from "./rls-fields-CZOMlwHl.js";
-import { d as rowConditionMessage, l as helperTablePolicies, n as graphPlan, o as ROW_CONDITION_FIX } from "./rls-graph-CHwx0V8q.js";
-import { t as runUsage } from "./usage-ItS7nLcl.js";
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-//#region src/cli/doctor-collect.ts
-async function pd002(input) {
-	const collected = await collectedOf(input);
-	if (collected.scan === void 0) return [];
-	return collected.scan.unknown.map((usage) => ({
-		code: "PD002",
-		severity: "error",
-		message: `unknown permission ${usage.call} at ${usage.file}:${String(usage.line)}`,
-		fix: "use a defined permission reference"
-	}));
-}
-async function pd003(input) {
-	if (input.config.policy === void 0) return [];
-	const usage = await runUsage({
-		cwd: input.cwd,
-		config: input.config,
-		ignore: [],
-		strict: false,
-		json: true,
-		dynamicAsUsed: false,
-		now: input.now,
-		io: input.io,
-		collected: () => collectedOf(input),
-		policy: () => policyOf(input)
-	});
-	if (usage.code === 2) return [];
-	return JSON.parse(usage.output).ungranted.map((item) => ({
-		code: "PD003",
-		severity: "warning",
-		message: `${item.key} is used but never granted (${item.detail})`,
-		fix: "add an allow() with a to: selector, or a role() binding, in definePolicy"
-	}));
-}
-async function pd004(input) {
-	const collected = await collectedOf(input);
-	if (collected.code === 0) return [];
-	if (collected.code === 2) return [];
-	return [{
-		code: "PD004",
-		severity: "error",
-		message: collected.message,
-		fix: "pnpm exec permdock collect"
-	}];
-}
-async function pd027(input) {
-	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	for (const grant of policy.grants) {
-		const refs = [.../* @__PURE__ */ new Set([...contextRefs(grant.where), ...contextRefs(grant.check)])];
-		if (refs.length === 0) continue;
-		findings.push({
-			code: "PD027",
-			severity: "warning",
-			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} reads ${refs.join(", ")}: request context is not in the token, so permdock rls generate cannot compile it and the database cannot enforce it`,
-			fix: "move the value to a server-set claim and compare with principal.claims.<name>, or keep the check API-side and pass --skip-closures to rls generate"
-		});
-	}
-	return findings;
-}
-async function pd016(input) {
-	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	let opaque = false;
-	let sqlFunction = false;
-	for (const grant of policy.grants) {
-		if (hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque")) opaque = true;
-		if (hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction")) sqlFunction = true;
-	}
-	if (opaque) findings.push({
-		code: "PD016",
-		severity: "warning",
-		message: "policy has opaque RLS conditions that deny in memory",
-		fix: "add rls.functions.<name> with a portable twin, or rewrite as sqlFunction()"
-	});
-	if (sqlFunction) {
-		const fixtures = input.config.rls.fixtures ?? "rls.fixtures.json";
-		if (!existsSync(resolve(input.cwd, fixtures)) && !existsSync(resolve(input.cwd, "rls.fixtures.ts"))) findings.push({
-			code: "PD016",
-			severity: "warning",
-			message: "sqlFunction grants have no rls fixtures for verify --db",
-			fix: "add rls.fixtures.json and run permdock rls verify --db"
-		});
-	}
-	return findings;
-}
-const DEFAULT_SENSITIVE_ACTIONS = [
-	"approve",
-	"pay",
-	"settle",
-	"submit",
-	"transfer",
-	"refund",
-	"disburse"
-];
-async function loadPolicy(cwd, path) {
-	try {
-		return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
-	} catch {
-		return;
-	}
-}
-/** The configured policy, through the project's memoised load when there is one. */
-function policyOf(input) {
-	const path = input.config.policy;
-	if (path === void 0) return Promise.resolve(void 0);
-	return input.policy === void 0 ? loadPolicy(input.cwd, path) : input.policy();
-}
-/** `collect --check`, through the project's memoised run when there is one. */
-function collectedOf(input) {
-	return input.collected === void 0 ? runCollect({
-		cwd: input.cwd,
-		config: input.config,
-		collect: input.config.collect ?? {},
-		scanPath: doctorSrcPath(input.config),
-		check: true,
-		now: input.now,
-		io: input.io
-	}) : input.collected();
-}
-async function pd017(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
-	const denied = new Set(policy.grants.filter((grant) => grant.effect === "deny").map((grant) => grant.permission.key));
-	const findings = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const grant of policy.grants) {
-		if (grant.effect !== "allow") continue;
-		if (!sensitive.has(grant.permission.action)) continue;
-		if (grant.approval !== void 0) continue;
-		if (denied.has(grant.permission.key)) continue;
-		if (seen.has(grant.permission.key)) continue;
-		seen.add(grant.permission.key);
-		findings.push({
-			code: "PD017",
-			severity: "warning",
-			message: `${grant.permission.key} is a sensitive verb without approval`,
-			fix: "add approval: { by } on the allow, or a deny on the same leaf"
-		});
-	}
-	return findings;
-}
-async function pd024(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	for (const grant of policy.grants) {
-		const approval = grant.approval;
-		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.distinct !== false) continue;
-		findings.push({
-			code: "PD024",
-			severity: "warning",
-			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.distinct: false, so the requester can approve their own request`,
-			fix: "remove distinct: false unless the requester confirming their own call (an agent asking its user) is the intent"
-		});
-	}
-	return findings;
-}
-function asMembershipsFixture(parsed) {
-	return parsed !== null && typeof parsed === "object" ? parsed : {};
-}
-async function pd018(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	const declared = new Set(policy.roles.map((item) => item.name));
-	for (const binding of policy.roles) for (const name of binding.exclusiveWith ?? []) if (!declared.has(name)) findings.push({
-		code: "PD018",
-		severity: "error",
-		message: `exclusiveWith names undeclared role ${name} on ${binding.name}`,
-		fix: "declare the exclusive role with role() or remove it from exclusiveWith"
-	});
-	const fixturePath = input.config.doctor?.memberships;
-	if (fixturePath === void 0) return findings;
-	const absolute = resolve(input.cwd, fixturePath);
-	if (!existsSync(absolute)) {
-		findings.push({
-			code: "PD018",
-			severity: "warning",
-			message: `doctor.memberships fixture ${fixturePath} is missing`,
-			fix: "add the JSON fixture or remove doctor.memberships"
-		});
-		return findings;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(absolute, "utf8"));
-	} catch {
-		findings.push({
-			code: "PD018",
-			severity: "warning",
-			message: `doctor.memberships fixture ${fixturePath} is not valid JSON`,
-			fix: "fix the JSON fixture"
-		});
-		return findings;
-	}
-	const record = asMembershipsFixture(parsed);
-	for (const custom of record.customRoles ?? []) {
-		const conflicts = separationConflicts(policy, [{
-			principal: custom.name,
-			...custom.tenant === void 0 ? {} : { tenant: custom.tenant },
-			roles: custom.includes ?? []
-		}]);
-		for (const conflict of conflicts) findings.push({
-			code: "PD018",
-			severity: "warning",
-			message: `custom role ${custom.name} includes exclusive roles ${conflict.roles.join(" and ")}`,
-			fix: "split the custom role so it does not include exclusiveWith pairs"
-		});
-	}
-	for (const conflict of separationConflicts(policy, record.memberships ?? [])) findings.push({
-		code: "PD018",
-		severity: "warning",
-		message: `membership ${conflict.principal || "unknown"} holds exclusive roles ${conflict.roles.join(" and ")}`,
-		fix: "remove one of the exclusive roles from the membership fixture"
-	});
-	return findings;
-}
-async function pd020(input) {
-	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const tables = input.config.rls.tables;
-	const compiled = (policy.hostable ?? []).filter((key) => {
-		const resource = key.slice(0, key.lastIndexOf("."));
-		return tables === void 0 || tables[resource] !== void 0;
-	});
-	if (compiled.length === 0) return [];
-	return [{
-		code: "PD020",
-		severity: "warning",
-		message: `hostable permissions are also compiled into RLS, which never sees hosted grants: ${compiled.join(", ")}`,
-		fix: "remove them from hostable, or drop their tables from rls.tables and enforce them in the application"
-	}];
-}
-async function pd021(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0 || (policy.hostable ?? []).length === 0) return [];
-	const missing = ["PERMDOCK_CLOUD_URL", "PERMDOCK_CLOUD_KEY"].filter((name) => (input.env[name] ?? "") === "");
-	if (missing.length === 0) return [];
-	return [{
-		code: "PD021",
-		severity: "warning",
-		message: `the policy lists hostable permissions but ${missing.join(" and ")} is not set, so no hosted grant can be published or fetched`,
-		fix: "set the variables from the PermDock Cloud dashboard, or remove hostable"
-	}];
-}
-async function pd019(input) {
-	const rls = input.config.rls;
-	if ((rls?.authorize ?? rls?.rbac?.authorize) !== "jwt") return [];
-	const expiry = supabaseConfig(input.cwd).jwtExpiry ?? 3600;
-	if (expiry <= 3600 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
-	const keys = [...new Set(policy.grants.filter((grant) => grant.effect === "allow" && sensitive.has(grant.permission.action)).map((grant) => grant.permission.key))];
-	if (keys.length === 0) return [];
-	return [{
-		code: "PD019",
-		severity: "warning",
-		message: `the RLS helpers and authorize() read roles from the JWT and jwt_expiry is ${String(expiry)}s: a revoked role keeps ${keys.join(", ")} until the token expires`,
-		fix: "set rls.authorize: 'database', or lower [auth] jwt_expiry in supabase/config.toml to 3600 or less"
-	}];
-}
-function customRoleLabel(role) {
-	return role.tenant === void 0 ? `global custom role ${role.name}` : `custom role ${role.name} in ${role.tenant}`;
-}
-async function pd023(input) {
-	const fixturePath = input.config.doctor?.memberships;
-	if (input.config.policy === void 0 || fixturePath === void 0) return [];
-	const absolute = resolve(input.cwd, fixturePath);
-	if (!existsSync(absolute)) return [];
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(absolute, "utf8"));
-	} catch {
-		return [];
-	}
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const entry of validateCustomRole(policy, custom).dropped) {
-		const what = "role" in entry ? `include ${entry.role}` : `permission ${entry.permission}`;
-		findings.push({
-			code: "PD023",
-			severity: "warning",
-			message: `${customRoleLabel(custom)} drops ${what} (${entry.reason})`,
-			fix: entry.reason === "outside-ceiling" ? "grant it to a declared assignable role, or remove it from the custom role" : entry.reason === "condition-not-allowed" ? "remove the condition; custom-role grants inherit the declared grant condition" : "use a declared permission key or assignable role name"
-		});
-	}
-	return findings;
-}
-/**
-* PD055: a stored custom role names a permission by a key it was renamed
-* from. It still resolves; the alias can only be dropped once storage holds
-* the current key.
-*/
-async function pd055(input) {
-	const fixturePath = input.config.doctor?.memberships;
-	if (input.config.policy === void 0 || fixturePath === void 0) return [];
-	const absolute = resolve(input.cwd, fixturePath);
-	if (!existsSync(absolute)) return [];
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(absolute, "utf8"));
-	} catch {
-		return [];
-	}
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const table = `${input.config.rls?.schema ?? "permdock"}.custom_role_permissions`;
-	const findings = [];
-	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const { from, to } of validateCustomRole(policy, custom).renamed) findings.push({
-		code: "PD055",
-		severity: "warning",
-		message: `${customRoleLabel(custom)} stores ${from}, which was renamed to ${to}`,
-		fix: `rewrite the stored key before removing the alias: update ${table} set permission = ${quoteSqlLiteral(to)} where permission = ${quoteSqlLiteral(from)};`
-	});
-	return findings;
-}
-function readJson(cwd, path) {
-	if (path === void 0) return;
-	const absolute = resolve(cwd, path);
-	if (!existsSync(absolute)) return;
-	try {
-		return JSON.parse(readFileSync(absolute, "utf8"));
-	} catch {
-		return;
-	}
-}
-function listField(value, field) {
-	if (value === null || typeof value !== "object") return [];
-	const list = value[field];
-	return Array.isArray(list) ? list : [];
-}
-/** Fixture API keys that never expire, credential policies that allow it, and records that are not v1 credentials. */
-function pd029(input) {
-	const parsed = readJson(input.cwd, input.config.doctor?.credentials);
-	const findings = [];
-	for (const [index, record] of listField(parsed, "credentials").entries()) {
-		const credential = parseCredential(record);
-		if (credential === void 0) {
-			findings.push({
-				code: "PD029",
-				severity: "warning",
-				message: `credentials[${String(index)}] is not a valid v1 credential, so it verifies to no subject`,
-				fix: "give it v: 1, id, kind, principal, permissions, createdBy and createdAt; a service key also needs tenant and roles"
-			});
-			continue;
-		}
-		if (credential.expiresAt === void 0) findings.push({
-			code: "PD029",
-			severity: "warning",
-			message: `API key ${credential.id} never expires`,
-			fix: "set expiresAt and rotate the key before it; a leaked key without expiry stays live until someone revokes it"
-		});
-	}
-	const settings = parsed !== null && typeof parsed === "object" ? parsed.settings : void 0;
-	const tenants = settings !== null && typeof settings === "object" ? Object.entries(settings) : [];
-	for (const [tenant, value] of tenants) if ((value !== null && typeof value === "object" ? value.credentials : void 0)?.allowNoExpiry === true) findings.push({
-		code: "PD029",
-		severity: "warning",
-		message: `tenant ${tenant} allows API keys that never expire`,
-		fix: "drop allowNoExpiry and set maxTtl, or keep it only for a tenant that rotates keys on its own schedule"
-	});
-	return findings;
-}
-/** Fixture memberships the policy's scopes would drop: an undeclared scope, a missing parent id, mixed shapes. */
-/**
-* A scope whose roles can all be removed can end up with nobody able to
-* manage it. Setting `min` on any of its roles (even `min: 0`) records the
-* decision and silences the warning.
-*/
-async function pd026(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const scopes = scopeList(policy.scopes);
-	const findings = [];
-	for (const { name } of scopes) {
-		const held = policy.roles.filter((binding) => typeof binding.on === "string" && resolveScope(scopes, binding.on) === name);
-		if (held.length === 0 || held.some((binding) => binding.min !== void 0)) continue;
-		findings.push({
-			code: "PD026",
-			severity: "warning",
-			message: `no role on scope '${name}' keeps a holder: every ${name} can lose its last ${held.map((binding) => binding.name).join(" / ")}`,
-			fix: `set min: 1 on the role that manages a ${name} (role(..., { on: '${name}', min: 1 })), or min: 0 to record that none must stay`
-		});
-	}
-	return findings;
-}
-async function pd025(input) {
-	const fixturePath = input.config.doctor?.memberships;
-	if (input.config.policy === void 0 || fixturePath === void 0) return [];
-	const absolute = resolve(input.cwd, fixturePath);
-	if (!existsSync(absolute)) return [];
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(absolute, "utf8"));
-	} catch {
-		return [];
-	}
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const scopes = scopeList(policy.scopes);
-	const names = scopes.map((scope) => scope.name).join(", ");
-	const findings = [];
-	for (const [index, membership] of (asMembershipsFixture(parsed).memberships ?? []).entries()) {
-		if (normalizeMemberships([membership], scopes).length > 0) continue;
-		findings.push({
-			code: "PD025",
-			severity: "warning",
-			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, or it mixes shapes`,
-			fix: "use { scope, id, within: { <parent>: id }, roles } with a declared scope, or { on: { resource, id }, roles }"
-		});
-	}
-	return findings;
-}
-/** Columns of `resource` a field-limited read grant can hide: missing from an allow's list, or on a deny's. */
-function limitedColumns(policy, resource, actions) {
-	const reads = policy.grants.filter((grant) => grant.permission.resource === resource && grant.fields !== void 0 && commandFor(grant.permission.action, actions) === "select");
-	const node = policy.resources.get(resource);
-	const schema = node === void 0 ? null : jsonSchemaOf(node);
-	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
-	const columns = properties !== null && typeof properties === "object" ? Object.keys(properties) : [...new Set(reads.flatMap((grant) => grant.fields ?? []))];
-	const key = node?.id ?? "id";
-	return columns.filter((column) => column !== key && reads.some((grant) => grant.effect === "deny" ? (grant.fields ?? []).includes(column) : !(grant.fields ?? []).includes(column)));
-}
-/**
-* `fields` redact in the application; RLS is row-level unless field views
-* compile, and a field view protects nothing while the base table still
-* returns the columns to a direct read.
-*/
-async function pd030(input) {
-	const rls = input.config.rls;
-	if (rls === void 0 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const resources = [...new Set(policy.grants.filter((grant) => grant.fields !== void 0 && commandFor(grant.permission.action, rls.actions) === "select").map((grant) => grant.permission.resource))].toSorted();
-	const findings = [];
-	for (const resource of resources) {
-		const columns = limitedColumns(policy, resource, rls.actions);
-		if (columns.length === 0) continue;
-		const table = tableFor(resource, rls.tables);
-		if (rls.fields !== "views") {
-			findings.push({
-				code: "PD030",
-				severity: "warning",
-				message: `read grants on ${resource} limit ${columns.join(", ")}, but RLS on ${table} is row-level: any client that reads ${table} directly gets those columns`,
-				fix: `set rls.fields: 'views' and rls.revokeColumns: true (permdock rls generate --fields views --revoke-columns), or keep direct reads server-side and redact with pick`
-			});
-			continue;
-		}
-		if (rls.revokeColumns !== true) findings.push({
-			code: "PD030",
-			severity: "warning",
-			message: `${table}_visible masks ${columns.join(", ")}, but ${table} still returns them to a direct read`,
-			fix: `set rls.revokeColumns: true (--revoke-columns) so clients read ${columns.join(", ")} only through ${table}_visible`
-		});
-	}
-	return findings;
-}
-/**
-* A self-parented resource no `through` grant walks, or a `restricted`
-* column no graph grant reaches: the declaration has no effect on any
-* decision, and `rls generate` keeps no closure for it.
-*/
-async function pd031(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const plan = graphPlan(policy);
-	const findings = [];
-	for (const node of policy.resources.values()) {
-		const walked = plan.get(node.name)?.closure !== void 0;
-		if (node.parent?.resource === node.name && !walked) findings.push({
-			code: "PD031",
-			severity: "warning",
-			message: `${node.name} parents itself through ${node.parent.field}, but no grant walks it with relation(..., { through: 'parent' }): its ancestors grant nothing and rls generate keeps no closure for it`,
-			fix: `grant through the chain (relation(permissions.${node.name}, '<relation>', { through: 'parent', depth: 16 })) or drop the self-parent`
-		});
-		const reached = [...plan.values()].some((entry) => entry.node.name === node.name || node.parent?.resource === entry.node.name && entry.node.name !== node.name);
-		if (node.restricted !== void 0 && !reached) findings.push({
-			code: "PD031",
-			severity: "warning",
-			message: `${node.name} declares restricted: '${node.restricted}', but no graph grant reaches ${node.name} rows, so the column keeps nothing out`,
-			fix: `add a relation(..., { through: 'parent' }) grant that reaches ${node.name}, or remove restricted`
-		});
-	}
-	return findings;
-}
-/**
-* Under an `rls` config, a graph resource `rls generate` cannot name a helper
-* for: one that shares a scope's name (its `permitted_<name>_ids` would
-* replace the scope helper) or is not a lowercase SQL name.
-*/
-async function pd032(input) {
-	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const scopes = scopeList(policy.scopes);
-	const findings = [];
-	const sqlNames = /* @__PURE__ */ new Map();
-	for (const name of graphPlan(policy).keys()) {
-		const sql = graphSqlName(name);
-		if (sql === void 0) {
-			findings.push({
-				code: "PD032",
-				severity: "error",
-				message: `graph resource ${name} is not a SQL name, so rls generate cannot name its permitted_<name>_ids helper`,
-				fix: "rename the resource to letters, digits and underscores, starting with a letter"
-			});
-			continue;
-		}
-		if (scopes.some((scope) => scope.name === sql)) findings.push({
-			code: "PD032",
-			severity: "error",
-			message: `graph resource ${name} shares its SQL name with the ${sql} scope: permitted_${sql}_ids would replace the scope helper, so rls generate refuses it`,
-			fix: `rename the resource (for example ${sql}s or ${sql}_node) or the scope`
-		});
-		const other = sqlNames.get(sql);
-		if (other !== void 0) findings.push({
-			code: "PD032",
-			severity: "error",
-			message: `graph resources ${other} and ${name} both become permitted_${sql}_ids in SQL, so rls generate refuses them`,
-			fix: "rename one of the resources"
-		});
-		sqlNames.set(sql, name);
-	}
-	return findings;
-}
-/** Reads the doctor memberships fixture, if one is configured and parseable. */
-function membershipsFixture(input) {
-	const fixturePath = input.config.doctor?.memberships;
-	if (fixturePath === void 0) return {};
-	const absolute = resolve(input.cwd, fixturePath);
-	if (!existsSync(absolute)) return {};
-	try {
-		return asMembershipsFixture(JSON.parse(readFileSync(absolute, "utf8")));
-	} catch {
-		return {};
-	}
-}
-/**
-* PD033: a role activation without a `maxDuration` (an elevation with no
-* ceiling never expires on its own), and an activation role that a fixture
-* membership also holds standing (an eligible-only role must never be held
-* directly).
-*/
-async function pd033(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	const activation = /* @__PURE__ */ new Set();
-	for (const binding of policy.roles) {
-		if (binding.activation === void 0) continue;
-		activation.add(binding.name);
-		if (binding.activation.maxDuration === void 0) findings.push({
-			code: "PD033",
-			severity: "warning",
-			message: `role '${binding.name}' has activation without maxDuration: an elevation never expires on its own`,
-			fix: `set activation: { maxDuration: '4h', ... } on role '${binding.name}'`
-		});
-	}
-	const fixture = membershipsFixture(input);
-	const standing = /* @__PURE__ */ new Set();
-	const eligible = /* @__PURE__ */ new Set();
-	for (const membership of fixture.memberships ?? []) {
-		for (const name of membership.roles ?? []) standing.add(name);
-		for (const name of membership.eligible ?? []) eligible.add(name);
-	}
-	for (const name of activation) if (standing.has(name)) findings.push({
-		code: "PD033",
-		severity: "warning",
-		message: `activation role '${name}' is held standing by a fixture membership: an eligible-only role must never be held directly`,
-		fix: `list '${name}' under eligible, never roles, and activate it with permdock.activate`
-	});
-	return findings;
-}
-/**
-* PD034: a break-glass grant under an `rls` config. RLS never compiles a
-* break-glass override; the server must read through a `security definer`
-* function that checks a signed break-glass session and writes an audit row.
-*/
-async function pd034(input) {
-	if (input.config.policy === void 0 || input.config.rls === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const keys = /* @__PURE__ */ new Set();
-	for (const grant of policy.grants) if (grant.breakGlass !== void 0) keys.add(grant.permission.key);
-	return [...keys].map((key) => ({
-		code: "PD034",
-		severity: "warning",
-		message: `break-glass grant on ${key} cannot be compiled to RLS: it would leak the override into a database policy`,
-		fix: "read break-glass rows through a security definer function that checks a signed break-glass session and writes an audit row"
-	}));
-}
-/**
-* PD035: a `supportAccess` role without `actorRequired`. Support access is
-* impersonation; without an actor the session is unattributed.
-*/
-async function pd035(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const findings = [];
-	for (const binding of policy.roles) if (binding.support !== void 0 && !binding.support.actorRequired) findings.push({
-		code: "PD035",
-		severity: "warning",
-		message: `support access role '${binding.name}' has actorRequired: false: a support session then runs as the tenant, unattributed`,
-		fix: `set actorRequired: true on supportAccess({ role: '${binding.name}', ... })`
-	});
-	return findings;
-}
-/**
-* Storage and Realtime policies written outside PermDock that call the SQL helpers for a permission whose grants
-* carry row conditions: the helpers check only role and scope.
-*/
-async function pd037(input) {
-	if (input.config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const conditioned = policyRowConditionKeys(policy);
-	const findings = [];
-	for (const file of sqlFiles(input.cwd, input.config.doctor?.migrations ?? MIGRATION_DIRS)) for (const found of helperTablePolicies(readFileSync(file, "utf8"))) {
-		const keys = found.keys.filter((key) => conditioned.has(key));
-		if (keys.length > 0) findings.push({
-			code: "PD037",
-			severity: "error",
-			message: rowConditionMessage(found, keys),
-			fix: ROW_CONDITION_FIX
-		});
-	}
-	return findings;
-}
-//#endregion
-export { pd035 as C, policyOf as E, pd034 as S, pd055 as T, pd029 as _, pd004 as a, pd032 as b, pd018 as c, pd021 as d, pd023 as f, pd027 as g, pd026 as h, pd003 as i, pd019 as l, pd025 as m, collectedOf as n, pd016 as o, pd024 as p, pd002 as r, pd017 as s, DEFAULT_SENSITIVE_ACTIONS as t, pd020 as u, pd030 as v, pd037 as w, pd033 as x, pd031 as y };

package/dist/duration-xK2jGFVc.js

@@ -1,25 +0,0 @@
-//#region src/core/duration.ts
-/**
-* Parses a duration string (`'30s'`, `'15m'`, `'4h'`, `'7d'`, `'2w'`) into
-* whole seconds. Fail-closed: a malformed or non-positive duration is
-* `undefined`, and every caller treats that as "no bound", never a default.
-*/
-const UNITS = {
-	s: 1,
-	m: 60,
-	h: 3600,
-	d: 86400,
-	w: 604800
-};
-function parseDuration(input) {
-	if (typeof input === "number") return Number.isFinite(input) && input > 0 ? Math.floor(input) : void 0;
-	if (typeof input !== "string") return;
-	const match = /^(\d+)(s|m|h|d|w)$/u.exec(input.trim());
-	if (match === null) return;
-	const amount = Number(match[1]);
-	const unit = UNITS[match[2] ?? ""];
-	if (unit === void 0 || !Number.isFinite(amount) || amount <= 0) return;
-	return amount * unit;
-}
-//#endregion
-export { parseDuration as t };