permdock 0.6.0 → 0.7.0

package/dist/cloud/index.d.ts

@@ -1,21 +1,137 @@
-import { Jt as AutomationEvent, Kt as AccessEvent, Qt as DeliveryEvent, Rt as Instant, Xt as DecisionEvent, Yt as CredentialEvent, Zt as DeliveryChannel, en as DirectoryEvent, nn as MembershipEvent, ut as TokenSigner } from "../policy-types-n0uRTsW8.js";
-import { m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-4-eQIRWf.js";
-import { c as DeliveryTransport } from "../types-BtHtcKMr.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-8RnwUAvE.js";
-import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
-import { l as ReplayStore } from "../types-C791HFu9.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-rbD7LS6h.js";
+import { $t as CredentialEvent, Qt as AutomationEvent, Rt as Instant, Xt as AccessEvent, en as DecisionEvent, in as DirectoryEvent, nn as DeliveryEvent, on as MembershipEvent, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
+import { m as ApprovalStore } from "../types-DC44-hqb.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Cp_Eot9W.js";
+import { c as DeliveryTransport } from "../types-g7Oy6Zg4.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-DBHftjgS.js";
+import { n as ApprovalWaiter } from "../waiter-DwEyouan.js";
+import { l as ReplayStore } from "../types-cTos-H7p.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-B_qRg0ws.js";
+//#region src/cloud/base-url.d.ts
+/**
+ * The one base URL of PermDock Cloud. The platform issuer is this URL; its
+ * OAuth routes, `/.well-known/oauth-authorization-server` and `/openapi.json`
+ * sit at the root, unversioned, and the data routes under `/v1`.
+ */
+export declare const CLOUD_BASE_URL = "https://permdock.com/api";
+/** The scopes the platform issuer grants a person's login. */
+type CloudScope = "projects:read" | "policy:read" | "catalog:write" | "evidence:read" | "approvals:read";
+//#endregion
 //#region src/cloud/request.d.ts
 /**
- * The environment URL and JWK Set URL `cloud()` uses, resolved with the same
- * fallbacks (`PERMDOCK_CLOUD_URL`; `PERMDOCK_CLOUD_ENV`, `VERCEL_ENV`, `production`).
+ * The environment URL and JWK Set URL `cloud()` uses when the environment is
+ * configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
+ * is set; `resolveCloudEndpoints` then asks the Cloud which environment the
+ * key belongs to.
  */
 export declare function cloudEndpoints(options?: CloudEndpointOptions): CloudEndpoints;
+/**
+ * The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
+ * when the environment is configured, else the environment `GET
+ * /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
+ * Cloud does not answer or answers another issuer.
+ */
+export declare function resolveCloudEndpoints(options?: CloudConnectionOptions): Promise<CloudEndpoints>;
 //#endregion
 //#region src/cloud/create.d.ts
 export declare function cloud(options?: CloudOptions): CloudClient;
 //#endregion
+//#region src/cloud/oauth.d.ts
+type CloudOAuthOptions = {
+  /** The client id the dashboard issued, or one from `/oauth/register`. */
+  readonly clientId: string;
+  /** Registered with the client; the Cloud redirects here with `code` and `state`. */
+  readonly redirectUri: string;
+  /** A confidential client's secret, sent as `client_secret_basic` (RFC 6749 section 2.3.1). Server-only. */
+  readonly clientSecret?: string;
+  /** The Cloud base URL and platform issuer; defaults to `CLOUD_BASE_URL`. */
+  readonly url?: string;
+  /** Requested on `authorizeUrl`; defaults to `projects:read` and `policy:read`. */
+  readonly scopes?: readonly CloudScope[];
+  readonly fetch?: typeof fetch;
+  /** The clock `expires_at` is computed from; defaults to the system clock. */
+  readonly now?: () => Instant;
+};
+/** A token response, with RFC 6749 field names; `expires_at` is seconds since the epoch. */
+type CloudCredential = {
+  readonly access_token: string;
+  readonly token_type?: string;
+  readonly expires_at?: number;
+  readonly refresh_token?: string;
+  readonly scope?: string;
+};
+/** A started authorization. Keep `state` and `codeVerifier` server-side until the callback. */
+type CloudAuthorization = {
+  /** Where to send the browser. */
+  readonly url: string;
+  readonly state: string;
+  readonly codeVerifier: string;
+};
+/** `GET /v1/projects` item. A project is one environment: `id` is the `{env}` of `/v1/environments/{env}`. */
+type CloudProject = {
+  readonly id: string;
+  readonly name: string;
+  readonly environment: string;
+  readonly slug?: string;
+  readonly issuer?: string;
+  readonly catalog?: {
+    readonly version: number;
+    readonly fingerprint: string;
+  };
+  readonly updatedAt?: string;
+};
+type CloudProjectPage = {
+  readonly items: readonly CloudProject[];
+  /** Pass back as `cursor` for the next page. */
+  readonly next?: string;
+};
+type CloudOAuthClient = {
+  /** The platform issuer the client discovers its endpoints from. */
+  readonly issuer: string;
+  /** An authorization code request with PKCE `S256` and a fresh `state`. */
+  readonly authorizeUrl: (options?: {
+    readonly scopes?: readonly CloudScope[];
+  }) => Promise<CloudAuthorization>;
+  /**
+   * Redeems the callback URL. Throws `state-mismatch` unless it echoes
+   * `pending.state`, `issuer-mismatch` for an RFC 9207 `iss` of another
+   * server, and `authorization-denied` for an `error` or a missing `code`.
+   */
+  readonly exchangeCode: (callback: string | URL, pending: Pick<CloudAuthorization, "state" | "codeVerifier">) => Promise<CloudCredential>;
+  readonly refresh: (refreshToken: string) => Promise<CloudCredential>;
+  /** `GET /v1/projects` with a login holding `projects:read`. */
+  readonly listProjects: (accessToken: string, options?: {
+    readonly cursor?: string;
+  }) => Promise<CloudProjectPage>;
+};
+/**
+ * An OAuth 2.0 client of the PermDock Cloud platform issuer, for an app that
+ * signs its users in to PermDock Cloud and reads their projects. Endpoints come
+ * from the issuer's RFC 8414 metadata; every call throws a `CloudAuthError`.
+ */
+export declare function cloudOAuth(options: CloudOAuthOptions): CloudOAuthClient;
+//#endregion
+//#region src/cloud/oauth-error.d.ts
+type CloudAuthErrorCode = "discovery-failed" | "state-mismatch" | "issuer-mismatch" | "authorization-denied" | "token-refused" | "invalid-token" | "insufficient-scope" | "forbidden" | "rate-limited" | "unreachable" | "unexpected-response";
+type CloudAuthErrorDetails = {
+  /** The HTTP status, when the Cloud answered. */
+  readonly status?: number;
+  /** The RFC 6749 or RFC 6750 `error` the Cloud sent (`invalid_grant`, `insufficient_scope`). */
+  readonly error?: string;
+  /** The scope an `insufficient_scope` challenge names. */
+  readonly scope?: string;
+};
+/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+export declare class CloudAuthError extends Error {
+  override readonly name: "CloudAuthError";
+  readonly code: CloudAuthErrorCode;
+  readonly status: number | undefined;
+  readonly error: string | undefined;
+  readonly scope: string | undefined;
+  constructor(code: CloudAuthErrorCode, message: string, details?: CloudAuthErrorDetails);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+export declare function isCloudAuthError(value: unknown): value is CloudAuthError;
+//#endregion
 //#region src/cloud/delivery.d.ts
 /**
  * A `DeliveryTransport` for `channel` that hands each checked recipient to
@@ -126,4 +242,4 @@ export declare function approvalTokensOf(events: readonly PermDockCloudEvent[]):
  */
 export declare function cloudApprovalWaiter(options: CloudApprovalWaiterOptions): CloudApprovalWaiter;
 //#endregion
-export type { CloudApprovalWaiter, CloudApprovalWaiterOptions, CloudApproverOptions, CloudCatalog, CloudCatalogPush, CloudClient, CloudConnectionOptions, CloudEndpointOptions, CloudEndpoints, CloudOptions, CloudSignerOptions, PermDockCloudEvent, VerifiedWebhook, WebhookFailureCause, WebhookOptions };
+export type { CloudApprovalWaiter, CloudApprovalWaiterOptions, CloudApproverOptions, CloudAuthErrorCode, CloudAuthErrorDetails, CloudAuthorization, CloudCatalog, CloudCatalogPush, CloudClient, CloudConnectionOptions, CloudCredential, CloudEndpointOptions, CloudEndpoints, CloudOAuthClient, CloudOAuthOptions, CloudOptions, CloudProject, CloudProjectPage, CloudScope, CloudSignerOptions, PermDockCloudEvent, VerifiedWebhook, WebhookFailureCause, WebhookOptions };

package/dist/cloud/index.js

@@ -1,13 +1,261 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
+import { h as secondsAt } from "../time-DkWjdL98.js";
 import { r as CLOUD_EVENT_TYPES } from "../sink-BEZSlMS_.js";
-import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-CCP0-yQS.js";
+import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-C144oW4M.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
 import { c as problemResponse } from "../problem-CTviyH5L.js";
+import { t as timeoutSignal } from "../timeout-D51niuQP.js";
 import { n as webhookVerifier } from "../standard-webhooks-DgFFD-Ga.js";
+import { c as stringField, n as discoverAuthorizationServer, r as parseToken } from "../device-BARQ8eYG.js";
 import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
 import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
-import { i as isCompactJws, n as cloudConnection, r as cloudEndpoints, t as cloud } from "../create-CQWIpUG-.js";
+import { t as CLOUD_BASE_URL } from "../base-url-BQbddZO5.js";
+import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-nGWma08S.js";
+import { n as randomToken, t as pkce } from "../pkce-5h8NgMQJ.js";
+//#region src/cloud/oauth-error.ts
+/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+var CloudAuthError = class extends Error {
+	name = "CloudAuthError";
+	code;
+	status;
+	error;
+	scope;
+	constructor(code, message, details = {}) {
+		super(message);
+		this.code = code;
+		this.status = details.status;
+		this.error = details.error;
+		this.scope = details.scope;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"discovery-failed",
+	"state-mismatch",
+	"issuer-mismatch",
+	"authorization-denied",
+	"token-refused",
+	"invalid-token",
+	"insufficient-scope",
+	"forbidden",
+	"rate-limited",
+	"unreachable",
+	"unexpected-response"
+]);
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+function isCloudAuthError(value) {
+	if (!(value instanceof Error) || value.name !== "CloudAuthError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+//#region src/cloud/oauth.ts
+/** Milliseconds a Cloud OAuth or read request may take; a slower one fails with `unreachable`. */
+const OAUTH_TIMEOUT_MS = 1e4;
+const DEFAULT_SCOPES = ["projects:read", "policy:read"];
+function trimSlash(value) {
+	return value.replace(/\/+$/u, "");
+}
+/** The form-urlencoding RFC 6749 section 2.3.1 applies to client_secret_basic credentials. */
+function formEncode(value) {
+	return encodeURIComponent(value).replaceAll("%20", "+");
+}
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/** An endpoint must be `https:`, except on a loopback issuer, which a local Cloud serves over plain HTTP. */
+function secureEndpoint(value, issuer) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" || url.protocol === "http:" && isLoopback(new URL(issuer).hostname);
+	} catch {
+		return false;
+	}
+}
+async function readRecord(response) {
+	const text = await readBodyText(response);
+	if (!text.ok) return null;
+	try {
+		const body = JSON.parse(text.text);
+		return isRecord(body) ? body : null;
+	} catch {
+		return null;
+	}
+}
+function optionalString(value) {
+	return value === void 0 || typeof value === "string";
+}
+function parseProject(value) {
+	if (!isRecord(value) || typeof value["id"] !== "string" || value["id"] === "" || typeof value["name"] !== "string" || typeof value["environment"] !== "string" || value["environment"] === "" || !optionalString(value["slug"]) || !optionalString(value["issuer"]) || !optionalString(value["updatedAt"])) return null;
+	const catalog = value["catalog"];
+	if (catalog !== void 0 && (!isRecord(catalog) || !Number.isInteger(catalog["version"]) || typeof catalog["fingerprint"] !== "string")) return null;
+	return compact({
+		id: value["id"],
+		name: value["name"],
+		environment: value["environment"],
+		slug: value["slug"],
+		issuer: value["issuer"],
+		catalog: isRecord(catalog) && typeof catalog["version"] === "number" && typeof catalog["fingerprint"] === "string" ? {
+			version: catalog["version"],
+			fingerprint: catalog["fingerprint"]
+		} : void 0,
+		updatedAt: value["updatedAt"]
+	});
+}
+function refusal$1(response) {
+	const challenge = bearerChallenge(response.headers.get("www-authenticate"));
+	const error = challenge?.params["error"];
+	const status = response.status;
+	if (status === 401) return new CloudAuthError("invalid-token", "PermDock Cloud refused the access token; refresh it or sign in again", compact({
+		status,
+		error: error ?? "invalid_token"
+	}));
+	if (status === 403 && error === "insufficient_scope") {
+		const scope = challenge?.params["scope"];
+		return new CloudAuthError("insufficient-scope", `The access token lacks ${scope ?? "a required scope"}; sign in again with it`, compact({
+			status,
+			error,
+			scope
+		}));
+	}
+	if (status === 403) return new CloudAuthError("forbidden", "The access token may not read this resource", compact({
+		status,
+		error
+	}));
+	if (status === 429) return new CloudAuthError("rate-limited", `PermDock Cloud rate-limited the request; retry after ${response.headers.get("retry-after") ?? "a while"} seconds`, { status });
+	return new CloudAuthError("unexpected-response", `PermDock Cloud answered HTTP ${String(status)}`, { status });
+}
+/**
+* An OAuth 2.0 client of the PermDock Cloud platform issuer, for an app that
+* signs its users in to PermDock Cloud and reads their projects. Endpoints come
+* from the issuer's RFC 8414 metadata; every call throws a `CloudAuthError`.
+*/
+function cloudOAuth(options) {
+	const issuer = trimSlash(options.url ?? "https://permdock.com/api");
+	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+	const scopes = options.scopes ?? DEFAULT_SCOPES;
+	let discovered;
+	const discover = async () => {
+		const body = await discoverAuthorizationServer(issuer, { fetch: fetchFn });
+		const authorization = body === null ? void 0 : stringField(body, "authorization_endpoint");
+		const token = body === null ? void 0 : stringField(body, "token_endpoint");
+		const methods = body?.["code_challenge_methods_supported"];
+		if (authorization === void 0 || token === void 0 || !secureEndpoint(authorization, issuer) || !secureEndpoint(token, issuer) || !Array.isArray(methods) || !methods.includes("S256")) throw new CloudAuthError("discovery-failed", `No usable RFC 8414 metadata for ${issuer}`);
+		return {
+			authorization,
+			token
+		};
+	};
+	const endpoints = () => {
+		discovered ??= discover().catch((error) => {
+			discovered = void 0;
+			throw error;
+		});
+		return discovered;
+	};
+	const send = async (url, init) => {
+		try {
+			return await fetchFn(url, {
+				...init,
+				signal: timeoutSignal(OAUTH_TIMEOUT_MS)
+			});
+		} catch {
+			throw new CloudAuthError("unreachable", `PermDock Cloud at ${issuer} did not answer`);
+		}
+	};
+	const token = async (fields) => {
+		const headers = new Headers({
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		});
+		const form = new URLSearchParams(fields);
+		if (options.clientSecret === void 0) form.set("client_id", options.clientId);
+		else headers.set("authorization", `Basic ${btoa(`${formEncode(options.clientId)}:${formEncode(options.clientSecret)}`)}`);
+		const response = await send((await endpoints()).token, {
+			method: "POST",
+			headers,
+			body: form
+		});
+		const body = await readRecord(response);
+		if (body === null) throw new CloudAuthError("unexpected-response", "PermDock Cloud answered the token request with a body that is not a JSON object", { status: response.status });
+		const parsed = parseToken(body, secondsAt(options.now?.()));
+		if (!parsed.ok || !response.ok) {
+			const error = parsed.ok ? void 0 : parsed.error;
+			throw new CloudAuthError("token-refused", `PermDock Cloud refused the token request${error === void 0 ? "" : `: ${error}`}`, compact({
+				status: response.status,
+				error
+			}));
+		}
+		return parsed.credential;
+	};
+	return Object.freeze({
+		issuer,
+		async authorizeUrl(request = {}) {
+			const { authorization } = await endpoints();
+			const { verifier, challenge } = await pkce();
+			const state = randomToken(16);
+			const url = new URL(authorization);
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set("client_id", options.clientId);
+			url.searchParams.set("redirect_uri", options.redirectUri);
+			url.searchParams.set("scope", (request.scopes ?? scopes).join(" "));
+			url.searchParams.set("state", state);
+			url.searchParams.set("code_challenge", challenge);
+			url.searchParams.set("code_challenge_method", "S256");
+			return Object.freeze({
+				url: url.href,
+				state,
+				codeVerifier: verifier
+			});
+		},
+		async exchangeCode(callback, pending) {
+			let params;
+			try {
+				params = new URL(callback).searchParams;
+			} catch {
+				throw new CloudAuthError("authorization-denied", "The callback is not a URL");
+			}
+			if (pending.state === "" || params.get("state") !== pending.state) throw new CloudAuthError("state-mismatch", "The callback does not echo the state of the authorization");
+			const iss = params.get("iss");
+			if (iss !== null && trimSlash(iss) !== issuer) throw new CloudAuthError("issuer-mismatch", `The callback names the issuer ${iss}, not ${issuer}`);
+			const error = params.get("error");
+			const code = params.get("code");
+			if (error !== null || code === null || code === "") throw new CloudAuthError("authorization-denied", `The authorization was not granted${error === null ? "" : `: ${error}`}`, error === null ? {} : { error });
+			return await token({
+				grant_type: "authorization_code",
+				code,
+				redirect_uri: options.redirectUri,
+				code_verifier: pending.codeVerifier
+			});
+		},
+		refresh(refreshToken) {
+			return token({
+				grant_type: "refresh_token",
+				refresh_token: refreshToken
+			});
+		},
+		async listProjects(accessToken, request = {}) {
+			const url = new URL(`${issuer}/v1/projects`);
+			if (request.cursor !== void 0) url.searchParams.set("cursor", request.cursor);
+			const response = await send(url, { headers: {
+				authorization: `Bearer ${accessToken}`,
+				accept: "application/json"
+			} });
+			if (!response.ok) throw refusal$1(response);
+			const body = await readRecord(response);
+			const raw = body?.["items"];
+			const items = Array.isArray(raw) ? raw.map(parseProject) : null;
+			const next = body?.["next"];
+			if (items === null || items.includes(null) || !optionalString(next)) throw new CloudAuthError("unexpected-response", "PermDock Cloud sent a project list that does not match cloud-api-v1.json", { status: response.status });
+			return Object.freeze(compact({
+				items: Object.freeze(items.filter((item) => item !== null)),
+				next
+			}));
+		}
+	});
+}
+//#endregion
 //#region src/cloud/delivery.ts
 function failed(cause, retryable, reason) {
 	return {
@@ -294,4 +542,4 @@ function cloudApprovalWaiter(options) {
 	});
 }
 //#endregion
-export { approvalTokensOf, cloud, cloudApprovalWaiter, cloudDeliveryTransport, cloudEndpoints, cloudSigner, parseCloudEvent, verifyWebhook };
+export { CLOUD_BASE_URL, CloudAuthError, approvalTokensOf, cloud, cloudApprovalWaiter, cloudDeliveryTransport, cloudEndpoints, cloudOAuth, cloudSigner, isCloudAuthError, parseCloudEvent, resolveCloudEndpoints, verifyWebhook };

package/dist/{cloud-ytQ3uviA.js → cloud-CO8pYtwr.js}

@@ -1,6 +1,6 @@
-import { n as secretInput } from "./credentials-DPyHmYz5.js";
+import { n as secretInput } from "./credentials-BpuTwd7a.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag } from "./flags-C3DktBDY.js";
+import { c as given, i as dryRunFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/cloud.ts
 const sharedFlags = {
 	url: {
@@ -30,7 +30,7 @@ const push = defineLeaf({
 		...sharedFlags,
 		project: {
 			type: "string",
-			description: "Cloud project id (default PERMDOCK_CLOUD_ENV, then VERCEL_ENV, then production)",
+			description: "Cloud project id (default PERMDOCK_CLOUD_ENV, then the key's environment)",
 			valueHint: "id"
 		},
 		...dryRunFlag,
@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-BD4f15co.js")).runCloud({
+		return (await import("./push-tVdG8dUL.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		const { runCloudPull } = await import("./pull-CvpINcMK.js");
+		const { runCloudPull } = await import("./pull-Cty6Ovyu.js");
 		return runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{codemod-ua2hHy7w.js → codemod-BP6n8N9L.js}

@@ -1,9 +1,9 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
 import { a as rel } from "./files-D_JIzUrP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-dvL2XEe1.js";
+import { n as ROOT } from "./manifest-Dv6q4i5s.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
-import { r as refuseDirty, t as applyFiles } from "./files-C5ZI27eV.js";
+import { r as refuseDirty, t as applyFiles } from "./files-acUbNwWt.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { extname, join, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";

package/dist/{codemod-5mpSpnUY.js → codemod-i4N2BhDc.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { i as dryRunFlag } from "./flags-C3DktBDY.js";
+import { i as dryRunFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/codemod.ts
 const codemod = defineLeaf({
 	positionals: [{
@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-ua2hHy7w.js")).codemodVersions();
+			return (await import("./codemod-BP6n8N9L.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		const { runCodemod } = await import("./codemod-ua2hHy7w.js");
+		const { runCodemod } = await import("./codemod-BP6n8N9L.js");
 		return runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],

package/dist/{collect-mLTY4nwb.js → collect-BaWeMjwV.js}

@@ -1,13 +1,13 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { T as isOperationEffect } from "./src-Cu2m75uo.js";
-import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
-import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
+import { k as isOperationEffect } from "./src-DLFrtrrC.js";
+import { o as isPermission } from "./permission-registry-DpPtSKNZ.js";
+import { r as isOperationRisk } from "./permissions-CyH2MV_B.js";
+import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { a as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
+import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { t as shortDiff } from "./text-diff-BQcUapOb.js";
+import { t as shortDiff } from "./text-diff-DhITNCnD.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
@@ -499,10 +499,19 @@ async function runCollect(input) {
 		};
 		const current = readFileSync(outPath, "utf8");
 		const currentDoc = JSON.parse(current);
+		const generatedDoc = input.scanPath === void 0 || samePaths(input.scanPath, srcPath) ? document : buildCatalog(tree, scanSources(input.cwd, listSourceFiles(input.cwd, srcPath), knownKeys), generatedAt, policy, operations);
 		const onDisk = catalogForCompare(currentDoc);
-		const generated = catalogForCompare(input.scanPath === void 0 || samePaths(input.scanPath, srcPath) ? document : buildCatalog(tree, scanSources(input.cwd, listSourceFiles(input.cwd, srcPath), knownKeys), generatedAt, policy, operations));
+		const generated = catalogForCompare(generatedDoc);
 		if (onDisk !== generated) {
 			const file = rel(input.cwd, outPath);
+			if (catalogForDrift(currentDoc) === catalogForDrift(generatedDoc)) return {
+				code: 0,
+				document,
+				scan,
+				outPath,
+				positionsMoved: true,
+				message: `catalog usages moved (lines only): ${file}; run permdock collect to refresh`
+			};
 			return {
 				code: 1,
 				document,

package/dist/{collect-Ci6akVwH.js → collect-DNm3oKOk.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { o as fileOut, t as checkFlag } from "./flags-C3DktBDY.js";
+import { o as fileOut, t as checkFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/collect.ts
 const collect = defineLeaf({
 	flags: {
@@ -29,10 +29,10 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			const { watchCollect } = await import("./watch--ovlPOc0.js");
+			const { watchCollect } = await import("./watch-Bd9mx3rd.js");
 			return watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-D7eQDffE.js")).runCollect({
+		const result = await (await import("./collect-k_Dulxr5.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,
@@ -46,7 +46,8 @@ const collect = defineLeaf({
 			...result.document === void 0 ? {} : { data: {
 				out: result.outPath,
 				permissions: result.document.permissions.length,
-				...flags.check ? { stale: result.code !== 0 } : {}
+				...flags.check ? { stale: result.code !== 0 } : {},
+				...result.positionsMoved === true ? { positionsMoved: true } : {}
 			} }
 		};
 	}

package/dist/collect-k_Dulxr5.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-BaWeMjwV.js";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-1bsAezL0.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-COM2VKuN.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -1 +1 @@
-export { t as compileWhere, n as escapeLike } from "../compile-CMqMx_IN.js";
+export { t as compileWhere, n as escapeLike } from "../compile-BAEO5bOk.js";

package/dist/{compile-CMqMx_IN.js → compile-BAEO5bOk.js}

@@ -1,11 +1,11 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-CNJBiTFo.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { t as expiredAt } from "./expiry-D4_YKRKD.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { f as scopeList, h as tenantOf, l as rootScope, m as subjectMemberships, s as resolveScope, u as scopeChain } from "./scopes-BHsc-wp-.js";
 import { t as isoInstant } from "./instant-BluqDvyS.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */

package/dist/{compile-1bsAezL0.d.ts → compile-COM2VKuN.d.ts}

@@ -1,6 +1,6 @@
-import { Rt as Instant, ar as Subject, cn as Scope, ur as Condition } from "./policy-types-n0uRTsW8.js";
-import { N as ResourceNode } from "./vocabulary-CN8H_9UF.js";
-import { c as WhereResult } from "./permdock-SV8ZINYT.js";
+import { Rt as Instant, fn as Scope, lr as Subject, mr as Condition } from "./policy-types-B-F-qAZk.js";
+import { b as ResourceNode } from "./permission-types-DhNEmoRG.js";
+import { u as WhereResult } from "./permdock-Dco6dyCK.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion-BTFrHZhX.js → completion-BNdVf7X2.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { a as suggestion, o as GLOBAL_FLAGS } from "./args-IIolxxKA.js";
-import { a as resolve } from "./manifest-dvL2XEe1.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { a as suggestion, o as GLOBAL_FLAGS } from "./args-CC3OwyHW.js";
+import { a as resolve } from "./manifest-Dv6q4i5s.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [