permdock 0.4.0 → 0.6.0

package/dist/device-BARQ8eYG.js

@@ -0,0 +1,193 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { h as secondsAt } from "./time-DkWjdL98.js";
+import { n as readBodyText } from "./body-text-QcXok_SI.js";
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+//#region src/terminal/device.ts
+/** Milliseconds an authorization server request may take. */
+const TERMINAL_TIMEOUT_MS = 1e4;
+async function readJson(response) {
+	const text = await readBodyText(response);
+	if (!text.ok) return null;
+	try {
+		const body = JSON.parse(text.text);
+		return isRecord(body) ? body : null;
+	} catch {
+		return null;
+	}
+}
+/** POSTs a form and reads a JSON object back; any network or parse failure is `null`. */
+async function postForm(runtime, url, fields) {
+	const fetchImpl = runtime.fetch ?? fetch;
+	try {
+		return await readJson(await fetchImpl(url, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(fields),
+			signal: timeoutSignal(TERMINAL_TIMEOUT_MS)
+		}));
+	} catch {
+		return null;
+	}
+}
+function withoutTrailingSlash(url) {
+	return url.replace(/\/+$/u, "");
+}
+/**
+* Where RFC 8414 metadata may live: the well-known segment inserted before
+* the issuer's path (section 3.1), then appended after it for servers that
+* predate the rule. An issuer without a path has one location.
+*/
+function metadataUrls(issuer) {
+	const parsed = new URL(issuer);
+	const path = withoutTrailingSlash(parsed.pathname);
+	const inserted = `${parsed.origin}/.well-known/oauth-authorization-server${path}`;
+	return path === "" ? [inserted] : [inserted, `${withoutTrailingSlash(issuer)}/.well-known/oauth-authorization-server`];
+}
+/**
+* The issuer's RFC 8414 metadata, or `null`. Metadata whose `issuer` is not
+* the configured issuer is refused (section 3.3), so a mix-up never routes a
+* credential to another server.
+*/
+async function discoverAuthorizationServer(issuer, runtime) {
+	const fetchImpl = runtime.fetch ?? fetch;
+	let urls;
+	try {
+		urls = metadataUrls(issuer);
+	} catch {
+		return null;
+	}
+	for (const url of urls) {
+		let body;
+		try {
+			const response = await fetchImpl(url, { signal: timeoutSignal(TERMINAL_TIMEOUT_MS) });
+			body = response.ok ? await readJson(response) : null;
+		} catch {
+			body = null;
+		}
+		if (body === null) continue;
+		return typeof body["issuer"] === "string" && withoutTrailingSlash(body["issuer"]) === withoutTrailingSlash(issuer) ? body : null;
+	}
+	return null;
+}
+async function discoverDeviceEndpoints(issuer, runtime) {
+	const body = await discoverAuthorizationServer(issuer, runtime);
+	if (body === null) return {};
+	return compact({
+		authorizationEndpoint: stringField(body, "device_authorization_endpoint"),
+		tokenEndpoint: stringField(body, "token_endpoint"),
+		revocationEndpoint: stringField(body, "revocation_endpoint")
+	});
+}
+function stringField(body, name) {
+	const value = body[name];
+	return typeof value === "string" ? value : void 0;
+}
+function parseAuthorization(body) {
+	if (typeof body["device_code"] !== "string" || typeof body["user_code"] !== "string" || typeof body["verification_uri"] !== "string" || typeof body["expires_in"] !== "number") return null;
+	return compact({
+		device_code: body["device_code"],
+		user_code: body["user_code"],
+		verification_uri: body["verification_uri"],
+		verification_uri_complete: typeof body["verification_uri_complete"] === "string" ? body["verification_uri_complete"] : void 0,
+		expires_in: body["expires_in"],
+		interval: typeof body["interval"] === "number" ? body["interval"] : void 0
+	});
+}
+function parseToken(body, now) {
+	if (typeof body["error"] === "string") return {
+		ok: false,
+		error: body["error"]
+	};
+	if (typeof body["access_token"] !== "string") return {
+		ok: false,
+		error: "invalid-token"
+	};
+	return {
+		ok: true,
+		credential: compact({
+			access_token: body["access_token"],
+			refresh_token: typeof body["refresh_token"] === "string" ? body["refresh_token"] : void 0,
+			expires_at: typeof body["expires_in"] === "number" ? now + body["expires_in"] : void 0,
+			token_type: typeof body["token_type"] === "string" ? body["token_type"] : void 0,
+			scope: stringField(body, "scope")
+		})
+	};
+}
+async function runDeviceFlow(device, runtime, write) {
+	const sleep = runtime.sleep ?? defaultSleep;
+	const now = () => secondsAt(runtime.now?.());
+	let authorizationEndpoint = device.authorizationEndpoint;
+	let tokenEndpoint = device.tokenEndpoint;
+	if ((authorizationEndpoint === void 0 || tokenEndpoint === void 0) && device.issuer !== void 0) {
+		const discovered = await discoverDeviceEndpoints(device.issuer, runtime);
+		authorizationEndpoint = authorizationEndpoint ?? discovered.authorizationEndpoint;
+		tokenEndpoint = tokenEndpoint ?? discovered.tokenEndpoint;
+	}
+	if (authorizationEndpoint === void 0 || tokenEndpoint === void 0) return null;
+	const startedBody = await postForm(runtime, authorizationEndpoint, {
+		client_id: device.clientId,
+		scope: device.scope ?? ""
+	});
+	const authorization = startedBody === null ? null : parseAuthorization(startedBody);
+	if (authorization === null) return null;
+	device.onPrompt?.(compact({
+		user_code: authorization.user_code,
+		verification_uri: authorization.verification_uri,
+		verification_uri_complete: authorization.verification_uri_complete
+	}));
+	write(`Visit ${authorization.verification_uri} and enter ${authorization.user_code}\n`);
+	if (authorization.verification_uri_complete !== void 0) device.open?.(authorization.verification_uri_complete);
+	let interval = authorization.interval ?? 5;
+	const deadline = now() + authorization.expires_in;
+	while (now() < deadline) {
+		await sleep(interval * 1e3);
+		const polledBody = await postForm(runtime, tokenEndpoint, {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: authorization.device_code,
+			client_id: device.clientId
+		});
+		if (polledBody === null) return null;
+		const token = parseToken(polledBody, now());
+		if (token.ok) return token.credential;
+		if (token.error === "slow_down") {
+			interval += 5;
+			continue;
+		}
+		if (token.error === "authorization_pending") continue;
+		return null;
+	}
+	return null;
+}
+async function refreshCredential(device, credential, runtime) {
+	if (credential.refresh_token === void 0) return null;
+	const now = () => secondsAt(runtime.now?.());
+	let tokenEndpoint = device.tokenEndpoint;
+	if (tokenEndpoint === void 0 && device.issuer !== void 0) tokenEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).tokenEndpoint;
+	if (tokenEndpoint === void 0) return null;
+	const body = await postForm(runtime, tokenEndpoint, {
+		grant_type: "refresh_token",
+		refresh_token: credential.refresh_token,
+		client_id: device.clientId
+	});
+	if (body === null) return null;
+	const token = parseToken(body, now());
+	return token.ok ? token.credential : null;
+}
+async function revokeCredential(device, credential, runtime) {
+	if (device === void 0 || credential.refresh_token === void 0) return;
+	let revocationEndpoint = device.revocationEndpoint;
+	if (revocationEndpoint === void 0 && device.issuer !== void 0) revocationEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).revocationEndpoint;
+	if (revocationEndpoint === void 0) return;
+	await postForm(runtime, revocationEndpoint, {
+		token: credential.refresh_token,
+		token_type_hint: "refresh_token",
+		client_id: device.clientId
+	});
+}
+function defaultSleep(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+//#endregion
+export { refreshCredential as a, stringField as c, postForm as i, discoverAuthorizationServer as n, revokeCredential as o, parseToken as r, runDeviceFlow as s, TERMINAL_TIMEOUT_MS as t };

package/dist/{diff-rpqoe7Ag.js → diff-3jbx6Rm4.js}

@@ -1,14 +1,59 @@
-import { g as memoryRoleSource } from "./src-Bb7no-hS.js";
-import { n as findPermission } from "./permission-registry-BsblpB-z.js";
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { t as createPermDock } from "./permdock-L26udHSk.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { t as buildCatalog } from "./catalog-doc-DWtg0gGR.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-C3_oTHyO.js";
-import { t as parseCatalog } from "./parse-CVFQHk6c.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-h2eG2OZV.js";
+import { E as memoryCustomRoleSource } from "./src-Cu2m75uo.js";
+import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as getPermDock } from "./permdock-BrAscV28.js";
+import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import { t as operationFindings } from "./operation-findings-DgATDpvh.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
+//#region src/cli/diff/format.ts
+function describeGrant(grant) {
+	const role = grant.role === null ? "top-level" : `role ${grant.role}`;
+	const scope = grant.scope === "global" ? "" : typeof grant.scope === "string" ? ` in ${grant.scope}` : ` on ${grant.scope.resource}`;
+	return `${grant.effect} ${grant.permission} (${role}${scope})`;
+}
+function describeDelegation(delegation) {
+	const narrowed = delegation.to.id ?? delegation.to.client;
+	const to = narrowed === void 0 ? delegation.to.kind : `${delegation.to.kind} ${narrowed}`;
+	return `delegation ${canonicalJson(delegation.from)} → ${to} (${delegation.permissions.join(", ")})`;
+}
+function formatText(diff) {
+	const lines = [];
+	const section = (title, added, removed, changed = []) => {
+		if (added.length === 0 && removed.length === 0 && changed.length === 0) return;
+		lines.push(title);
+		for (const item of added) lines.push(`  + ${item}`);
+		for (const item of removed) lines.push(`  - ${item}`);
+		for (const item of changed) lines.push(`  ~ ${item}`);
+	};
+	section("permissions", diff.permissions.added, diff.permissions.removed, diff.permissions.renamed.map((rename) => `${rename.from} → ${rename.to} (renamed)`));
+	section("levels", diff.levels.added.map((item) => `${item.permission}@${item.level}`), diff.levels.removed.map((item) => `${item.permission}@${item.level}`));
+	section("scopes", diff.scopes.added, diff.scopes.removed);
+	section("roles", diff.roles.added, diff.roles.removed, diff.roles.changed.map((name) => `${name}: declaration changed`));
+	if (diff.grants === void 0) lines.push("grants: not compared (a catalog was built without its policy; run `permdock collect` with `policy` configured)");
+	else section("grants", diff.grants.added.map(describeGrant), diff.grants.removed.map(describeGrant), diff.grants.changed.map((change) => `${describeGrant(change.after)}: ${change.changes.join(", ")}`));
+	if (diff.delegations !== void 0) section("delegations", diff.delegations.added.map(describeDelegation), diff.delegations.removed.map(describeDelegation), diff.delegations.changed.map((change) => `${describeDelegation(change.after)}: ${change.changes.join(", ")}`));
+	section("operations", [], [], diff.operations.map((finding) => `${[finding.operation, `(${finding.permission})`].join(" ")}: ${finding.code === "operation-risk-raised" ? `risk ${[finding.previous, finding.risk].join(" → ")}` : "approval no longer required"}`));
+	if (diff.impact !== void 0) {
+		lines.push(diff.impact.length === 0 ? "impact: no fixture changes outcome" : `impact (${String(diff.impact.length)} fixture(s) change outcome)`);
+		for (const row of diff.impact) {
+			const where = row.tenant === void 0 ? "" : ` in ${row.tenant}`;
+			lines.push(`  ${row.subject}${where} ${row.action}: ${row.before} → ${row.after}`);
+		}
+	}
+	if (lines.length === 0) lines.push("no changes");
+	if (diff.breaking.length > 0) {
+		lines.push(`breaking (${String(diff.breaking.length)})`);
+		for (const change of diff.breaking) lines.push(`  ${change.kind}: ${change.detail}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/cli/diff/diff.ts
 const EMPTY_SCAN = {
 	roots: [],
@@ -24,7 +69,7 @@ const EMPTY_SCAN = {
 };
 async function loadSide(cwd, source, now) {
 	const abs = resolve(cwd, source);
-	if (!existsSync(abs)) throw new Error(`PermDock CLI: not found: ${source}`);
+	if (!existsSync(abs)) throw configError(`PermDock CLI: not found: ${source}`);
 	if (abs.endsWith(".json")) return {
 		source,
 		catalog: parseCatalog(readFileSync(abs, "utf8")),
@@ -78,8 +123,8 @@ function fieldsChange(before, after) {
 	const kept = new Set(after);
 	return before.every((field) => kept.has(field)) ? "fields widened" : "fields narrowed";
 }
-const validFrom = (value) => value?.from ?? Number.NEGATIVE_INFINITY;
-const validUntil = (value) => value?.until ?? Number.POSITIVE_INFINITY;
+const validFrom = (value) => secondsOf(value?.from) ?? Number.NEGATIVE_INFINITY;
+const validUntil = (value) => secondsOf(value?.until) ?? Number.POSITIVE_INFINITY;
 /** Narrowed when the window starts later or ends earlier than before; a new window on an open grant narrows it. */
 function validityChange(before, after) {
 	return validFrom(after) > validFrom(before) || validUntil(after) < validUntil(before) ? "validity narrowed" : "validity widened";
@@ -98,22 +143,12 @@ const NARROWING = /* @__PURE__ */ new Set([
 	"purpose changed",
 	"portable: false"
 ]);
-function describeGrant(grant) {
-	const role = grant.role === null ? "top-level" : `role ${grant.role}`;
-	const scope = grant.scope === "global" ? "" : typeof grant.scope === "string" ? ` in ${grant.scope}` : ` on ${grant.scope.resource}`;
-	return `${grant.effect} ${grant.permission} (${role}${scope})`;
-}
 function delegationIdentity(delegation) {
 	return canonicalJson({
 		from: delegation.from,
 		to: delegation.to
 	});
 }
-function describeDelegation(delegation) {
-	const narrowed = delegation.to.id ?? delegation.to.client;
-	const to = narrowed === void 0 ? delegation.to.kind : `${delegation.to.kind} ${narrowed}`;
-	return `delegation ${canonicalJson(delegation.from)} → ${to} (${delegation.permissions.join(", ")})`;
-}
 function delegationChanges(before, after) {
 	const changes = [];
 	const lost = before.permissions.filter((key) => !after.permissions.includes(key));
@@ -340,16 +375,17 @@ function diffCatalogs(original, b) {
 		},
 		...grants === void 0 ? {} : { grants },
 		...delegations === void 0 ? {} : { delegations },
+		operations: operationFindings(original.catalog, b.catalog),
 		breaking
 	};
 }
 async function impactOf(input) {
 	const { fixtures, customRoles } = await loadFixtures(input.cwd, input.fixtures);
-	const now = Math.floor(input.now.getTime() / 1e3);
+	const now = { epochMilliseconds: Math.floor(input.now.getTime() / 1e3) * 1e3 };
 	const outcome = async (policy, fixture) => {
 		const permission = findPermission(policy.permissions, fixture.action);
 		if (permission === void 0) return "unknown";
-		const [decision] = (await createPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryRoleSource(customRoles) })).simulate([[permission, fixtureRow(fixture, permission.kind)]], { now });
+		const [decision] = (await getPermDock(policy, fixtureSubject(fixture.subject), { customRoles: memoryCustomRoleSource(customRoles) })).simulate([[permission, fixtureRow(fixture, permission.kind)]], { now });
 		return decision?.outcome ?? "denied";
 	};
 	const rows = [];
@@ -375,36 +411,6 @@ async function impactOf(input) {
 		breaking
 	};
 }
-function formatText(diff) {
-	const lines = [];
-	const section = (title, added, removed, changed = []) => {
-		if (added.length === 0 && removed.length === 0 && changed.length === 0) return;
-		lines.push(title);
-		for (const item of added) lines.push(`  + ${item}`);
-		for (const item of removed) lines.push(`  - ${item}`);
-		for (const item of changed) lines.push(`  ~ ${item}`);
-	};
-	section("permissions", diff.permissions.added, diff.permissions.removed, diff.permissions.renamed.map((rename) => `${rename.from} → ${rename.to} (renamed)`));
-	section("levels", diff.levels.added.map((item) => `${item.permission}@${item.level}`), diff.levels.removed.map((item) => `${item.permission}@${item.level}`));
-	section("scopes", diff.scopes.added, diff.scopes.removed);
-	section("roles", diff.roles.added, diff.roles.removed, diff.roles.changed.map((name) => `${name}: declaration changed`));
-	if (diff.grants === void 0) lines.push("grants: not compared (a catalog was built without its policy; run `permdock collect` with `policy` configured)");
-	else section("grants", diff.grants.added.map(describeGrant), diff.grants.removed.map(describeGrant), diff.grants.changed.map((change) => `${describeGrant(change.after)}: ${change.changes.join(", ")}`));
-	if (diff.delegations !== void 0) section("delegations", diff.delegations.added.map(describeDelegation), diff.delegations.removed.map(describeDelegation), diff.delegations.changed.map((change) => `${describeDelegation(change.after)}: ${change.changes.join(", ")}`));
-	if (diff.impact !== void 0) {
-		lines.push(diff.impact.length === 0 ? "impact: no fixture changes outcome" : `impact (${String(diff.impact.length)} fixture(s) change outcome)`);
-		for (const row of diff.impact) {
-			const where = row.tenant === void 0 ? "" : ` in ${row.tenant}`;
-			lines.push(`  ${row.subject}${where} ${row.action}: ${row.before} → ${row.after}`);
-		}
-	}
-	if (lines.length === 0) lines.push("no changes");
-	if (diff.breaking.length > 0) {
-		lines.push(`breaking (${String(diff.breaking.length)})`);
-		for (const change of diff.breaking) lines.push(`  ${change.kind}: ${change.detail}`);
-	}
-	return `${lines.join("\n")}\n`;
-}
 async function runDiff(input) {
 	const [sourceA, sourceB, ...extra] = input.sources;
 	if (sourceA === void 0 || sourceB === void 0 || extra.length > 0) return {

package/dist/diff-CmuSD3vc.js

@@ -0,0 +1,37 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/diff.ts
+const diff = defineLeaf({
+	positionals: [{
+		name: "before",
+		description: "A permissions.catalog.json or a module exporting policy (default the committed catalog)"
+	}, {
+		name: "after",
+		description: "The same, for the new side (default the working tree)"
+	}],
+	flags: {
+		impact: {
+			type: "boolean",
+			description: "Run the fixtures through both sides and report changed outcomes"
+		},
+		fixtures: {
+			type: "string",
+			description: "Fixtures file for --impact",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags, args }) {
+		return (await import("./diff-3jbx6Rm4.js")).runDiff({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			sources: [args["before"], args["after"]].filter((value) => value !== void 0),
+			impact: flags.impact,
+			fixtures: given(flags.fixtures),
+			json: ctx.json,
+			now: ctx.now,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { diff };

package/dist/doctor-3ZqNHX_G.js

@@ -0,0 +1,44 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { a as failOnFlag } from "./flags-C3DktBDY.js";
+import { n as ask, t as CANCELLED } from "./prompt-DfZLJLIn.js";
+//#region src/cli/commands/doctor.ts
+const doctor = defineLeaf({
+	flags: {
+		only: {
+			type: "string",
+			repeatable: true,
+			description: "Check codes or groups to run",
+			valueHint: "code",
+			async complete() {
+				const { DOCTOR_CHECKS } = await import("./doctor-BdZw53-k.js");
+				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
+			}
+		},
+		fix: {
+			type: "boolean",
+			description: "Apply safe fixes: install skills, regenerate the catalog"
+		},
+		...failOnFlag
+	},
+	async run(ctx, { flags }) {
+		let fix = flags.fix;
+		if (fix && ctx.interactive && !ctx.yes) {
+			const answer = await ask(`Install the Agent Skills and regenerate the catalog in ${ctx.cwd}?`);
+			if (answer === void 0) return CANCELLED;
+			fix = answer;
+		}
+		return (await import("./doctor-BdZw53-k.js")).runDoctor({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			only: flags.only,
+			json: ctx.json,
+			fix,
+			strict: flags["fail-on"] === "warning",
+			color: ctx.color,
+			now: ctx.now,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { doctor };