permdock 0.3.1 → 0.5.0

package/dist/{collect-DSTE3ml9.js → collect-CrZJJnEF.js}

@@ -1,12 +1,63 @@
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-DdGm82XT.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { T as isOperationEffect } from "./src-DLfUWFAI.js";
+import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
+import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
+import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { a as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-C9wjsfNY.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { i as rel, r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
-import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { t as shortDiff } from "./text-diff-BQcUapOb.js";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
+//#region src/cli/catalog-operations.ts
+function metaOf(name, value) {
+	const fail = (field) => {
+		throw configError(`PermDock CLI: operations.${name}.meta${field} is invalid`);
+	};
+	if (!isRecord(value)) return fail("");
+	const { risk, effects, title } = value;
+	if (risk !== void 0 && !isOperationRisk(risk)) return fail(".risk");
+	if (effects !== void 0 && (!Array.isArray(effects) || !effects.every(isOperationEffect))) return fail(".effects");
+	if (title !== void 0 && typeof title !== "string") return fail(".title");
+	return {
+		...risk === void 0 ? {} : { risk },
+		...effects === void 0 ? {} : { effects },
+		...title === void 0 ? {} : { title }
+	};
+}
+/**
+* The catalog entries of a `defineOperations` map, in definition order.
+* Throws for a value that is not one, such as a module that exports the
+* definitions object instead of the map.
+*/
+function catalogOperations(value) {
+	if (!isRecord(value)) throw configError("PermDock CLI: operations export is not an operation map");
+	const out = [];
+	for (const name of Object.keys(value)) {
+		const operation = value[name];
+		if (!isRecord(operation) || operation["name"] !== name || !isPermission(operation["permission"])) throw configError(`PermDock CLI: operations.${name} is not an operation; export the defineOperations result`);
+		const results = operation["results"];
+		if (results !== void 0 && !isPermission(results)) throw configError(`PermDock CLI: operations.${name}.results is not a permission`);
+		out.push({
+			name,
+			permission: operation["permission"].key,
+			...results === void 0 ? {} : { results: results.key },
+			meta: metaOf(name, operation["meta"])
+		});
+	}
+	return out;
+}
+/** The configured operations module's catalog entries; `undefined` without one. Throws when it is missing or does not load. */
+async function loadConfiguredOperations(cwd, path, options) {
+	if (path === void 0) return;
+	const abs = resolve(cwd, path);
+	if (!existsSync(abs)) throw configError(`PermDock CLI: operations module not found: ${rel(cwd, abs)}`);
+	const mod = await loadModule(abs, options);
+	return catalogOperations(pickNamed(mod, ["operations"]));
+}
+//#endregion
 //#region src/cli/scan.ts
 /** oxc reports recoverable problems as `Warning` or `Advice`; only `Error` leaves the program incomplete. */
 const PARSE_ERRORS = /* @__PURE__ */ new Set(["Error"]);
@@ -20,6 +71,7 @@ const CHECK_CALLS = /* @__PURE__ */ new Set([
 	"actions",
 	"usePermission",
 	"getPermission",
+	"requirePermission",
 	"protect",
 	"allow",
 	"deny",
@@ -83,7 +135,7 @@ function scanSources(cwd, files, knownKeys) {
 				const callee = calleeName(node.callee);
 				if (callee === "snapshot" || callee === "snapshotFor") snapshots.push({
 					file: fileRel,
-					line: lineAt(node.start ?? 0),
+					line: lineAt(node.start),
 					include: includeOf(node.arguments?.[callee === "snapshot" ? 0 : 2], isRoot)
 				});
 			}
@@ -223,7 +275,7 @@ function boundToRoot(name, ancestors, definitions, cache) {
 }
 function recordCall(node, parent, lineAt, fileRel, roots, definitionFiles, usages, unknown, dynamic, roleNames, planNames, _allowKeys, knownKeys) {
 	const callee = calleeName(node.callee);
-	const line = lineAt(node.start ?? 0);
+	const line = lineAt(node.start);
 	if (callee === "definePermissions" || callee === "defineRoles" || callee === "definePlans") {
 		const name = declaredName(parent);
 		if (name !== void 0) {
@@ -262,7 +314,7 @@ function recordMember(node, parent, lineAt, fileRel, isRoot, usages, unknown, dy
 		const root = rootName(node);
 		if (root !== void 0 && isRoot(root)) dynamic.push({
 			file: fileRel,
-			line: lineAt(node.start ?? 0),
+			line: lineAt(node.start),
 			call: callName(parent)
 		});
 		return;
@@ -276,7 +328,7 @@ function recordMember(node, parent, lineAt, fileRel, isRoot, usages, unknown, dy
 	const call = callName(parent);
 	const usage = {
 		file: fileRel,
-		line: lineAt(node.start ?? 0),
+		line: lineAt(node.start),
 		call
 	};
 	if (call === "allow") allowKeys.add(key);
@@ -422,8 +474,20 @@ async function runCollect(input) {
 	const knownKeys = new Set(leavesOf(tree).map((leaf) => leaf.key));
 	const scan = scanSources(input.cwd, files, knownKeys);
 	const policy = input.loadPolicy === void 0 ? await loadConfiguredPolicy(input.cwd, input.config.policy, load) : await input.loadPolicy();
+	let operations;
+	try {
+		operations = await loadConfiguredOperations(input.cwd, input.config.operations, load);
+	} catch (error) {
+		return {
+			code: 2,
+			document: void 0,
+			scan: void 0,
+			outPath,
+			message: describeError(error)
+		};
+	}
 	const generatedAt = input.now.toISOString();
-	const document = buildCatalog(tree, scan, generatedAt, policy);
+	const document = buildCatalog(tree, scan, generatedAt, policy, operations);
 	const next = formatCatalogJson(document);
 	if (input.check) {
 		if (!existsSync(outPath)) return {
@@ -436,7 +500,7 @@ async function runCollect(input) {
 		const current = readFileSync(outPath, "utf8");
 		const currentDoc = JSON.parse(current);
 		const onDisk = catalogForCompare(currentDoc);
-		const generated = catalogForCompare(input.scanPath === void 0 || samePaths(input.scanPath, srcPath) ? document : buildCatalog(tree, scanSources(input.cwd, listSourceFiles(input.cwd, srcPath), knownKeys), generatedAt, policy));
+		const generated = catalogForCompare(input.scanPath === void 0 || samePaths(input.scanPath, srcPath) ? document : buildCatalog(tree, scanSources(input.cwd, listSourceFiles(input.cwd, srcPath), knownKeys), generatedAt, policy, operations));
 		if (onDisk !== generated) {
 			const file = rel(input.cwd, outPath);
 			return {
@@ -455,8 +519,7 @@ async function runCollect(input) {
 			message: `catalog up to date: ${rel(input.cwd, outPath)}`
 		};
 	}
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, next);
+	writeFileEnsuringDir(outPath, next);
 	const written = [outPath];
 	const barrel = input.collect.barrel ?? input.config.collect?.barrel;
 	if (barrel !== void 0 && barrel !== false) {
@@ -495,8 +558,7 @@ import { permissions as collected } from '${specifier.startsWith(".") ? specifie
 
 export const permissions = mergePermissions(collected)
 `;
-	mkdirSync(dirname(abs), { recursive: true });
-	writeFileSync(abs, body);
+	writeFileEnsuringDir(abs, body);
 }
 //#endregion
-export { scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };
+export { loadConfiguredOperations as a, scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };

package/dist/collect-DloHbDVa.js

@@ -0,0 +1,55 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { o as fileOut, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/collect.ts
+const collect = defineLeaf({
+	flags: {
+		...checkFlag,
+		src: {
+			type: "string",
+			repeatable: true,
+			description: "Source roots or globs",
+			valueHint: "path"
+		},
+		out: {
+			type: "string",
+			description: "Catalog file to write",
+			valueHint: "file"
+		},
+		watch: {
+			type: "boolean",
+			description: "Collect again when a source, config or policy file changes"
+		}
+	},
+	async run(ctx, { flags }) {
+		const out = fileOut("collect", flags.out);
+		const overrides = {
+			...flags.src.length > 0 ? { srcPath: [...flags.src] } : {},
+			...out === void 0 ? {} : { out }
+		};
+		if (flags.watch) {
+			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
+			const { watchCollect } = await import("./watch-Cb-NcaUw.js");
+			return watchCollect(ctx, overrides);
+		}
+		const result = await (await import("./collect-FlXJlhus.js")).runCollect({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			collect: overrides,
+			check: flags.check,
+			now: ctx.now,
+			io: ctx.io
+		});
+		return {
+			code: result.code,
+			output: result.message,
+			...result.document === void 0 ? {} : { data: {
+				out: result.outPath,
+				permissions: result.document.permissions.length,
+				...flags.check ? { stale: result.code !== 0 } : {}
+			} }
+		};
+	}
+});
+//#endregion
+export { collect };

package/dist/collect-FlXJlhus.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-CrZJJnEF.js";

package/dist/command-L8EstFNm.js

@@ -0,0 +1,6 @@
+//#region src/cli/core/command.ts
+function defineLeaf(command) {
+	return command;
+}
+//#endregion
+export { defineLeaf as t };

package/dist/{compact-y6vfu2_f.js → compact-CAf557ZB.js}

@@ -15,5 +15,15 @@ function isReadonlyArray(value) {
 function sole(items) {
 	return items.length === 1 ? items[0] : void 0;
 }
+/** A plain object: not `null` and not an array. */
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** The own entries of `record` whose key is not in `reserved`. */
+function omitKeys(record, reserved) {
+	const out = {};
+	for (const [key, value] of Object.entries(record)) if (!reserved.has(key)) out[key] = value;
+	return out;
+}
 //#endregion
-export { isReadonlyArray as n, sole as r, compact as t };
+export { sole as a, omitKeys as i, isReadonlyArray as n, isRecord as r, compact as t };

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BkRyBDBw.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-Ckm2HqBZ.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -1,2 +1 @@
-import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
-export { compileWhere, escapeLike };
+export { t as compileWhere, n as escapeLike } from "../compile-CMqMx_IN.js";

package/dist/{compile-Ba4blROR.js → compile-CMqMx_IN.js}

@@ -1,9 +1,12 @@
-import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
-import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CVdPrWN-.js";
+import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
+import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { t as isoInstant } from "./instant-BluqDvyS.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */
 function quoteSqlName(name) {
@@ -338,8 +341,8 @@ function unwrap(value, subject) {
 		return isScalar(resolved) ? resolved : null;
 	}
 	if (isConditionDate(value)) {
-		const date = new Date(value.date);
-		return Number.isNaN(date.getTime()) ? null : date;
+		const instant = isoInstant(value.date);
+		return instant === void 0 ? null : new Date(instant);
 	}
 	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
 	return value;
@@ -495,7 +498,8 @@ function compileExists(condition, table, subject, now, mappings, scopes) {
 }
 function compileMemberOf(condition, options) {
 	assertSafeKey(condition.field, "condition field");
-	const now = options.now ?? Date.now() / 1e3;
+	const now = epochSeconds(options.now);
+	if (!Number.isFinite(now)) throw new TypeError(`PermDock: compileWhere ${INVALID_NOW.message}`);
 	const scopes = options.scopes ?? scopeList(void 0);
 	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
 	if (condition.scope !== "resource" && scope === void 0) return NEVER;

package/dist/{compile-BkRyBDBw.d.ts → compile-Ckm2HqBZ.d.ts}

@@ -1,5 +1,6 @@
-import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-IB6yxpC3.js";
-import { y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { Rt as Instant, cn as Scope, ir as Subject, lr as Condition } from "./policy-types-DzwivBgR.js";
+import { N as ResourceNode } from "./vocabulary-D6lPdb4Z.js";
+import { c as WhereResult } from "./permdock-D7eeLJER.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {
@@ -32,7 +33,8 @@ type MembershipsMapping = {
 type CompileWhereOptions = {
   readonly subject?: Subject;
   readonly memberships?: MembershipsMapping;
-  readonly now?: number;
+  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  readonly now?: Instant;
   /** The policy's scopes; `where()` results carry them. Defaults to the implicit `tenant` / `team` pair. */
   readonly scopes?: readonly Scope[];
   /** Where the relation graph lives; without it a `related` node is refused. */

package/dist/completion-BqhRBJD8.js

@@ -0,0 +1,143 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { a as suggestion, o as GLOBAL_FLAGS } from "./args-IIolxxKA.js";
+import { a as resolve } from "./manifest-CtKR3GXL.js";
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+//#region src/cli/core/completion.ts
+const SHELLS = [
+	"bash",
+	"zsh",
+	"fish"
+];
+function flagNames(flags) {
+	return Object.entries(flags).filter(([, flag]) => flag.hidden !== true).map(([name]) => `--${name}`);
+}
+/** The flag `token` names when it waits for a separate value, as `--only` does and `--only=x` does not. */
+function valueFlag(flags, token) {
+	if (token === void 0 || !token.startsWith("--") || token.includes("=")) return;
+	const flag = flags[token.slice(2)];
+	return flag === void 0 || flag.type === "boolean" ? void 0 : flag;
+}
+/** The positional the next bare word fills, after the words already typed past the leaf's path. */
+function positionalAt(leaf, typed) {
+	let index = 0;
+	for (let i = 0; i < typed.length; i += 1) {
+		const token = typed[i] ?? "";
+		if (token === "--") return;
+		if (token.startsWith("-")) {
+			if (valueFlag({
+				...GLOBAL_FLAGS,
+				...leaf.flags
+			}, token) !== void 0) i += 1;
+			continue;
+		}
+		index += 1;
+	}
+	const positionals = leaf.positionals ?? [];
+	const last = positionals.at(-1);
+	return positionals[index] ?? (last?.variadic === true ? last : void 0);
+}
+/** Values from `complete`, matched against what follows the last comma when the value is a list. */
+async function valuesFor(complete, partial, list) {
+	const cut = list ? partial.lastIndexOf(",") + 1 : 0;
+	const head = partial.slice(0, cut);
+	const taken = head.split(",");
+	const tail = partial.slice(cut);
+	return (await complete()).filter((value) => value.startsWith(tail) && !taken.includes(value)).map((value) => head + value);
+}
+/**
+* Candidates for the last word of `words`, the tokens typed after
+* `permdock`. An empty list leaves the shell to complete file names.
+*/
+async function candidates(words) {
+	const partial = words.at(-1) ?? "";
+	const before = words.slice(0, -1);
+	const resolved = resolve(before);
+	if (resolved.kind === "group") {
+		if (resolved.unknown !== void 0) return [];
+		return (partial.startsWith("-") ? flagNames(GLOBAL_FLAGS) : resolved.entry.children.filter((child) => child.kind === "group" || child.hidden !== true).map((child) => child.name)).filter((name) => name.startsWith(partial));
+	}
+	const leaf = await resolved.entry.load();
+	const flags = {
+		...GLOBAL_FLAGS,
+		...leaf.flags
+	};
+	const flag = valueFlag(flags, before.at(-1));
+	if (flag?.type === "enum") return valuesFor(() => flag.options, partial, flag.repeatable === true);
+	if (flag?.type === "string") return flag.complete === void 0 ? [] : valuesFor(flag.complete, partial, flag.repeatable === true || flag.list === true);
+	if (partial.startsWith("-")) return flagNames(flags).filter((name) => name.startsWith(partial));
+	const positional = positionalAt(leaf, resolved.rest);
+	return positional?.complete === void 0 ? [] : valuesFor(positional.complete, partial, false);
+}
+const BASH = `# permdock completion for bash: eval "$(permdock completion bash)"
+_permdock() {
+  local -a words=("\${COMP_WORDS[@]:1:COMP_CWORD}")
+  local IFS=$'\\n'
+  COMPREPLY=($(permdock __complete -- "\${words[@]}" 2>/dev/null))
+  if [ \${#COMPREPLY[@]} -eq 0 ]; then
+    COMPREPLY=($(compgen -f -- "\${COMP_WORDS[COMP_CWORD]}"))
+  fi
+}
+complete -o filenames -F _permdock permdock
+`;
+const ZSH = `#compdef permdock
+# permdock completion for zsh: permdock completion zsh > "\${fpath[1]}/_permdock"
+_permdock() {
+  local -a reply
+  reply=("\${(@f)$(permdock __complete -- "\${words[@]:1:CURRENT-1}" 2>/dev/null)}")
+  if (( \${#reply[@]} == 0 )) || [[ -z "\${reply[1]}" ]]; then
+    _files
+  else
+    compadd -a reply
+  fi
+}
+compdef _permdock permdock
+`;
+const FISH = `# permdock completion for fish: permdock completion fish > ~/.config/fish/completions/permdock.fish
+function __permdock_complete
+  set -l words (commandline -opc)[2..-1] (commandline -ct)
+  permdock __complete -- $words 2>/dev/null
+end
+complete -c permdock -f -a '(__permdock_complete)'
+`;
+function completionScript(shell) {
+	switch (shell) {
+		case "bash": return BASH;
+		case "zsh": return ZSH;
+		case "fish": return FISH;
+		default: return shell;
+	}
+}
+//#endregion
+//#region src/cli/commands/completion.ts
+const completion = defineLeaf({
+	positionals: [{
+		name: "shell",
+		description: "bash, zsh or fish",
+		required: true
+	}],
+	flags: {},
+	run(_ctx, { args }) {
+		const typed = args["shell"] ?? "";
+		const shell = SHELLS.find((name) => name === typed);
+		if (shell === void 0) throw new CliError("usage", `completion: unknown shell '${typed}'.${suggestion(typed, SHELLS)} Use bash, zsh or fish.`, { code: "invalid_value" });
+		return {
+			code: 0,
+			output: completionScript(shell),
+			data: { shell }
+		};
+	}
+});
+const complete = defineLeaf({
+	flags: {},
+	async run(ctx, { passthrough }) {
+		const found = await candidates(passthrough);
+		ctx.io.stdout(found.length === 0 ? "" : `${found.join("\n")}\n`);
+		return {
+			code: 0,
+			output: "",
+			streamed: true
+		};
+	}
+});
+//#endregion
+export { complete, completion };

package/dist/config-B46rm9sc.js

@@ -0,0 +1,26 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { a as failOnFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/config.ts
+const config = defineLeaf({
+	flags: {
+		print: {
+			type: "boolean",
+			description: "Print the effective config as JSON: the file, as written, and each default"
+		},
+		...failOnFlag
+	},
+	async run(ctx, { flags }) {
+		const { runConfig } = await import("./config-report-DUgj62Ai.js");
+		return runConfig({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			file: ctx.configPath,
+			warnings: ctx.configWarnings,
+			print: flags.print,
+			json: ctx.json,
+			strict: flags["fail-on"] === "warning"
+		});
+	}
+});
+//#endregion
+export { config };

package/dist/{config-BJiM-xAm.js → config-bs_kZeYq.js}

@@ -1,7 +1,8 @@
-import { t as CliError } from "./errors-CWfoNg9N.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as CliError } from "./errors-CWTY6uih.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
-//#region src/cli/config-schema.ts
+//#region src/cli/project/config-schema.ts
 const SECTIONS = {
 	collect: {
 		srcPath: true,
@@ -25,6 +26,7 @@ const SECTIONS = {
 		teamType: true,
 		scopeTypes: true,
 		roleClaim: true,
+		roleValues: true,
 		gucPrefix: true,
 		out: true,
 		drizzle: true,
@@ -33,6 +35,8 @@ const SECTIONS = {
 		authorize: true,
 		policyPerRole: true,
 		customRoles: true,
+		triggers: true,
+		audit: true,
 		capabilities: true,
 		anonymousSignIns: true,
 		fields: true,
@@ -59,7 +63,10 @@ const SECTIONS = {
 		realtime: true,
 		storage: true
 	},
-	supabase: { hook: true },
+	supabase: {
+		hook: true,
+		schemas: true
+	},
 	powersync: {
 		out: true,
 		resources: true,
@@ -79,11 +86,9 @@ const SECTIONS = {
 const TOP_LEVEL = /* @__PURE__ */ new Set([
 	"permissions",
 	"policy",
+	"operations",
 	...Object.keys(SECTIONS)
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function isSection(key) {
 	return Object.hasOwn(SECTIONS, key);
 }
@@ -101,7 +106,7 @@ function parseConfig(value, file) {
 	const warnings = [];
 	const unknown = (path, known) => `${file}: unknown key ${path}; PermDock reads ${[...known].join(", ")}`;
 	for (const [key, entry] of Object.entries(value)) {
-		if (key === "permissions" || key === "policy") {
+		if (key === "permissions" || key === "policy" || key === "operations") {
 			if (entry !== void 0 && typeof entry !== "string") throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be a module path string`);
 			continue;
 		}
@@ -120,7 +125,7 @@ function parseConfig(value, file) {
 	};
 }
 //#endregion
-//#region src/cli/config.ts
+//#region src/cli/project/config.ts
 const CONFIG_FILES = [
 	"permdock.config.ts",
 	"permdock.config.mts",
@@ -140,8 +145,8 @@ async function readConfig(cwd, fromFlag, options) {
 		warnings: [],
 		file: void 0
 	};
-	if (!existsSync(path)) throw new Error(`PermDock CLI: config file not found: ${path}`);
-	const { loadModule, pickNamed } = await import("./load-DwJUafYN.js");
+	if (!existsSync(path)) throw new CliError("usage", `PermDock CLI: config file not found: ${path}`, { code: "config_not_found" });
+	const { loadModule, pickNamed } = await import("./load-BxEtwlBS.js");
 	return {
 		...parseConfig(pickNamed(await loadModule(path, options), ["default"]), relative(cwd, path).replaceAll("\\", "/")),
 		file: path

package/dist/{config-report-CdCgbRnV.js → config-report-DUgj62Ai.js}

@@ -1,10 +1,10 @@
-import { n as CONFIG_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { a as rel, t as defaultSrcPath } from "./files-D_JIzUrP.js";
+import { r as CONFIG_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-CrZJJnEF.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-DSTE3ml9.js";
-import "./sources-4p0-4xQm.js";
-import { r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
-import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CjdO0wQX.js";
+import "./sources-vs5dGOsS.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {
 	const { cwd, config } = input;
@@ -31,13 +31,22 @@ function configReport(input) {
 function runConfig(input) {
 	const report = configReport(input);
 	const code = input.strict && report.warnings.length > 0 ? 1 : 0;
+	const findings = report.warnings.map((warning) => ({
+		code: "config-warning",
+		severity: "warning",
+		message: warning,
+		...report.file === null ? {} : { file: report.file },
+		docs: `${DOCS_BASE}/config`
+	}));
 	if (input.print || input.json) return {
 		code,
-		output: `${JSON.stringify(report, null, 2)}\n`
+		output: `${JSON.stringify(report, null, 2)}\n`,
+		findings
 	};
 	return {
 		code,
-		output: `${[report.file === null ? "no permdock.config file; every option takes its default" : `${report.file}: ${report.warnings.length === 0 ? "ok" : `${String(report.warnings.length)} warning${report.warnings.length === 1 ? "" : "s"}`}`, ...report.warnings.map((warning) => `  warn ${warning}`)].join("\n")}\n`
+		output: `${[report.file === null ? "no permdock.config file; every option takes its default" : `${report.file}: ${report.warnings.length === 0 ? "ok" : `${String(report.warnings.length)} warning${report.warnings.length === 1 ? "" : "s"}`}`, ...report.warnings.map((warning) => `  warn ${warning}`)].join("\n")}\n`,
+		findings
 	};
 }
 //#endregion

package/dist/{connection-CU8MQxRi.js → connection-DjhIJSs2.js}

@@ -1,5 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { r as PermDockRevokedError } from "./errors-BKy0EfhN.js";
+import { a as durationOf, o as epochSeconds } from "./time-DkWjdL98.js";
 //#region src/server/connection.ts
 /** `setTimeout` stores delays in a signed 32-bit integer. */
 const MAX_DELAY = 2147483647;
@@ -52,7 +53,7 @@ async function openConnection(input) {
 	const controller = new AbortController();
 	const timers = /* @__PURE__ */ new Set();
 	const decideOptions = compact({
-		source: "adapter",
+		call: "adapter",
 		adapter: input.adapter
 	});
 	let unsubscribe;
@@ -123,7 +124,7 @@ async function openConnection(input) {
 		});
 	};
 	schedule = (permdock) => {
-		const now = Date.now() / 1e3;
+		const now = epochSeconds();
 		const expiresAt = permdock.subject.expiresAt;
 		if (expiresAt !== void 0) {
 			if (expiresAt <= now) {
@@ -141,8 +142,8 @@ async function openConnection(input) {
 		}
 		const membership = nextMembershipExpiry(permdock, now);
 		if (membership !== void 0) after((membership - now) * 1e3, revalidate);
-		const every = input.options.revalidate;
-		if (every !== void 0 && Number.isFinite(every) && every > 0) after(every, revalidate);
+		const every = durationOf(input.options.revalidate);
+		if (every !== void 0) after(every * 1e3, revalidate);
 	};
 	try {
 		current = await input.open();
@@ -184,6 +185,7 @@ async function openConnection(input) {
 			const permdock = live();
 			return permdock === void 0 ? [] : permdock.filter(permission, items, decideOptions);
 		},
+		settled: () => chain,
 		close() {
 			closed = true;
 			clear();