permdock 0.6.0 → 0.8.0

package/dist/{vocabulary-CN8H_9UF.d.ts → permission-types-CAY-GU7e.d.ts}

@@ -11,7 +11,10 @@ type AppData = Readonly<Record<string, MetaValue>>;
  * its output is the type PermDock gives the `x` field it checks.
  */
 type AppDataSchema<X = AppData> = StandardSchemaV1<unknown, X>;
-/** A leaf whose `meta.x` is typed by a schema; intersected so it stays assignable to the untyped leaf. */
+/**
+ * A leaf whose `meta.x` is typed by a schema; intersected so it stays
+ * assignable to the untyped leaf.
+ */
 type WithX<L, X> = [X] extends [never] ? L : L & {
   readonly meta: {
     readonly x?: Readonly<X>;
@@ -22,9 +25,26 @@ type WithX<L, X> = [X] extends [never] ? L : L & {
 declare const RESOURCE_BRAND: unique symbol;
 /**
  * Phantom key carrying a tree's resource `x` type for `getResource`. Exported
- * as a type only, so a consumer's declaration emit can name it; it has no value.
+ * as a type only, so a consumer's declaration emit can name it; it has no
+ * value.
  */
 declare const RESOURCE_X: unique symbol;
+/**
+ * Phantom key carrying the literal `name` a `resource(…, { name })` was given,
+ * so its leaves type `resource` by that name rather than the path segment. Type
+ * only; it has no value.
+ */
+declare const RESOURCE_NAME: unique symbol;
+/**
+ * Phantom key carrying a policy's `scopes` input type for `ScopeNameOf`. Type
+ * only; it has no value.
+ */
+declare const POLICY_SCOPES: unique symbol;
+/**
+ * Phantom key carrying a permission's row type for `RowOf`. Type only; a leaf
+ * never has it at run time, so leaves stay plain JSON.
+ */
+declare const PERMISSION_ROW: unique symbol;
 //#endregion
 //#region src/core/permission-types.d.ts
 /** `definePermissions` options. */
@@ -37,24 +57,33 @@ type PermissionsOptions<PX = never, RX = never> = {
    */
   readonly renamed?: Readonly<Record<string, string>>;
   /**
-   * Standard Schemas for app data. `permission` checks every action's
-   * `meta.x` and types it on the leaves; `resource` checks every resource's
-   * `meta.x` and types it on `getResource`. Both validate synchronously at
-   * definition time and throw on invalid data.
+   * Standard Schemas for app data. `permission` checks every action's `meta.x`
+   * and types it on the leaves; `resource` checks every resource's `meta.x` and
+   * types it on `getResource`. Both validate synchronously at definition time
+   * and throw on invalid data.
    */
   readonly x?: {
     readonly permission?: AppDataSchema<PX>;
     readonly resource?: AppDataSchema<RX>;
   };
 };
-/** A resource's metadata. PermDock carries it to the catalog and never reads `x`. */
+/**
+ * A resource's metadata. PermDock carries it to the catalog and never reads
+ * `x`.
+ */
 type ResourceMeta<X = AppData> = {
   readonly title?: string;
   readonly description?: string;
-  /** Data the application owns. Plain JSON, typed by `definePermissions(…, { x: { resource } })`. */
+  /**
+   * Data the application owns. Plain JSON, typed by `definePermissions(…, { x:
+   * { resource } })`.
+   */
   readonly x?: X;
 };
-/** A tree whose resources carry `meta.x` of type `X`, read through `getResource`. */
+/**
+ * A tree whose resources carry `meta.x` of type `X`, read through
+ * `getResource`.
+ */
 type ResourceXTree<X> = {
   readonly [RESOURCE_X]?: X;
 };
@@ -63,7 +92,10 @@ type ActionMeta = {
   readonly description?: string;
   readonly tags?: readonly string[];
   readonly readOnly?: boolean;
-  /** The action may destroy or overwrite data; only meaningful when not `readOnly`. */
+  /**
+   * The action may destroy or overwrite data; only meaningful when not
+   * `readOnly`.
+   */
   readonly destructive?: boolean;
   /** Repeating the action with the same input has no further effect. */
   readonly idempotent?: boolean;
@@ -72,12 +104,15 @@ type ActionMeta = {
    * assign the whole custom-role ceiling, not only what they hold themselves.
    */
   readonly manageRoles?: boolean;
-  /** Set by a generator (`permdock openapi import`) to the operation an action was inferred from. */
+  /**
+   * Set by a generator (`permdock openapi import`) to the operation an action
+   * was inferred from.
+   */
   readonly inferredFrom?: string;
   /**
    * Data the application owns, such as a risk level or an undo window. Plain
-   * JSON; PermDock carries it on the leaf, the catalog and snapshots and
-   * never reads it. `definePermissions(…, { x: { permission } })` types it.
+   * JSON; PermDock carries it on the leaf, the catalog and snapshots and never
+   * reads it. `definePermissions(…, { x: { permission } })` types it.
    */
   readonly x?: AppData;
 };
@@ -89,7 +124,17 @@ type Permission<K extends string = string, T = unknown, Kind extends PermissionK
   readonly action: string;
   readonly meta: ActionMeta;
   readonly kind: Kind;
-} & ([T] extends [never] ? unknown : unknown);
+  /**
+   * The resource row type. Method syntax keeps it bivariant: a typed leaf is
+   * still a `Permission`, and an untyped one still takes a typed closure.
+   */
+  [PERMISSION_ROW]?(row: T): void;
+};
+/**
+ * The row type of a permission's resource; `unknown` for an untyped
+ * `Permission`.
+ */
+type RowOf<P> = P extends Permission<string, infer T> ? T : unknown;
 type ResourceParent = {
   readonly field: string;
   readonly resource: string;
@@ -101,15 +146,21 @@ type RelationIncludes = {
 /** The row's `field` holds the principal id (or, with `memberOf`, a scope id). */
 type FieldRelation = RelationIncludes & {
   readonly field: string;
-  /** A declared scope name (or the `tenant` / `team` alias): the field holds that scope's id. */
+  /**
+   * A declared scope name (or the `tenant` / `team` alias): the field holds
+   * that scope's id.
+   */
   readonly memberOf?: string;
 };
-/** Literal values an edge row's columns must hold, so one table backs several relations. */
+/**
+ * Literal values an edge row's columns must hold, so one table backs several
+ * relations.
+ */
 type EdgeMatch = Readonly<Record<string, string | number | boolean>>;
 /**
- * One group resource of an edge: the relation whoever the row names must
- * hold on the group, and, when the group's id has its own typed column, that
- * column in place of the edge's `subject`.
+ * One group resource of an edge: the relation whoever the row names must hold
+ * on the group, and, when the group's id has its own typed column, that column
+ * in place of the edge's `subject`.
  */
 type EdgeGroup = string | {
   readonly relation: string;
@@ -117,12 +168,12 @@ type EdgeGroup = string | {
 };
 /**
  * Edge rows that name a group instead of a principal: `column` holds the
- * resource name, `subject` the group's id, and the row holds for whoever
- * holds `resources[<name>]` on that group. A null `column` (or `direct`)
- * names a principal; any other value matches nothing. A group with its own
- * `subject` column reads the group's id from it; without `column`, a row
- * names that group when the column is not null, and a principal when the
- * edge's `subject` is not null.
+ * resource name, `subject` the group's id, and the row holds for whoever holds
+ * `resources[<name>]` on that group. A null `column` (or `direct`) names a
+ * principal; any other value matches nothing. A group with its own `subject`
+ * column reads the group's id from it; without `column`, a row names that group
+ * when the column is not null, and a principal when the edge's `subject` is not
+ * null.
  */
 type EdgeGroups = {
   /** Required unless every group names its own `subject` column. */
@@ -131,7 +182,10 @@ type EdgeGroups = {
   /** The `column` value of a row naming a principal, besides `null`. */
   readonly direct?: string;
 };
-/** One row per holder in an edge table: `object` holds the resource id, `subject` the principal id. */
+/**
+ * One row per holder in an edge table: `object` holds the resource id,
+ * `subject` the principal id.
+ */
 type EdgeRelation = RelationIncludes & {
   readonly edge: string;
   /** Default `<resource>_id`. */
@@ -143,10 +197,16 @@ type EdgeRelation = RelationIncludes & {
   readonly match?: EdgeMatch;
   readonly groups?: EdgeGroups;
 };
-/** On a principal resource: the row's `principal` column holds the principal who holds the relation over it. */
+/**
+ * On a principal resource: the row's `principal` column holds the principal who
+ * holds the relation over it.
+ */
 type PrincipalRelation = RelationIncludes & {
   readonly principal: string;
-  /** Timestamp columns bounding when the relation holds; `null` leaves that side open. */
+  /**
+   * Timestamp columns bounding when the relation holds; `null` leaves that side
+   * open.
+   */
   readonly period?: {
     readonly startsAt?: string;
     readonly expiresAt?: string;
@@ -158,7 +218,10 @@ type ComputedRelation = {
 };
 type ResourceRelation = FieldRelation | EdgeRelation | PrincipalRelation | ComputedRelation;
 type ResourceRelationInput = string | ResourceRelation;
-/** A to-one link from a row to another resource's instance, walked by `through: [<link>]`. */
+/**
+ * A to-one link from a row to another resource's instance, walked by `through:
+ * [<link>]`.
+ */
 type ResourceLink = {
   readonly field: string;
   readonly resource: string;
@@ -170,8 +233,8 @@ type ResourceRestricted = {
 type ActionList = readonly string[] | Record<string, ActionMeta>;
 type ResourceOptions<A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined> = {
   /**
-   * The resource name leaves, tables, relations and AuthZEN types use; the
-   * last path segment when absent. Names are unique across a tree.
+   * The resource name leaves, tables, relations and AuthZEN types use; the last
+   * path segment when absent. Names are unique across a tree.
    */
   readonly name?: string;
   readonly id?: string;
@@ -182,7 +245,8 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
   readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
   /**
    * The row field that changes whenever the row does (`updatedAt`, a revision
-   * counter). An `approval: { staleOn: 'resource-change' }` binds to its value.
+   * counter). An `approval: { staleOn: 'resource-change' }` binds to its
+   * value.
    */
   readonly version?: string;
   /**
@@ -198,19 +262,32 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
   /**
    * Named grant levels a custom role may pick per permission, each a row
    * condition (`where` shorthand or a `Condition`), such as `own`, `team` and
-   * `all`. A level narrows the ceiling grant it applies to and never widens
-   * it; it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
+   * `all`. A level narrows the ceiling grant it applies to and never widens it;
+   * it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
    */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
-  /** Display text and app data for the resource; carried to the catalog, never read in evaluation. */
+  /**
+   * `true`: `levels` run from narrowest to widest in declaration order, and a
+   * holder of a level may hand out every level declared before it. Evaluation
+   * is unchanged: each level still applies only its own condition.
+   */
+  readonly orderedLevels?: true;
+  /**
+   * Display text and app data for the resource; carried to the catalog, never
+   * read in evaluation.
+   */
   readonly meta?: ResourceMeta;
 };
-/** A level's row condition: `where` shorthand or a normalised `Condition`, checked by `definePolicy`. */
+/**
+ * A level's row condition: `where` shorthand or a normalised `Condition`,
+ * checked by `definePolicy`.
+ */
 type ResourceLevel = Readonly<Record<string, unknown>>;
-type ResourceInit<T = unknown, A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined> = {
+type ResourceInit<T = unknown, A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined, N extends string = string> = {
   readonly [RESOURCE_BRAND]: true;
   readonly schema: StandardSchemaV1<unknown, T> | undefined;
   readonly options: ResourceOptions<A, C>;
+  readonly [RESOURCE_NAME]?: N;
 };
 type ResourceNode<T = unknown> = {
   readonly name: string;
@@ -226,8 +303,13 @@ type ResourceNode<T = unknown> = {
   readonly disclosure: "hide" | "reveal";
   readonly instanceActions: ReadonlySet<string>;
   readonly collectionActions: ReadonlySet<string>;
-  /** Declared level names to their raw condition; `definePolicy` normalises them. */
+  /**
+   * Declared level names to their raw condition; `definePolicy` normalises
+   * them.
+   */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** Set when the resource declares `orderedLevels: true`. */
+  readonly orderedLevels?: true;
   /** The resource's `meta`, when it declares one. */
   readonly meta?: ResourceMeta;
 };
@@ -235,73 +317,17 @@ type PermissionTree = {
   readonly [key: string]: PermissionTree | Permission;
 };
 type ActionNames<A extends ActionList | undefined> = A extends readonly string[] ? A[number] : A extends Record<string, ActionMeta> ? keyof A & string : never;
-type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>, X>; };
-type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
+type LastSegment<Path extends string> = Path extends `${string}.${infer Rest}` ? LastSegment<Rest> : Path;
+type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never, R extends string = string> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind> & {
+  readonly resource: R;
+  readonly action: K;
+}, X>; };
+type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C, infer N> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X, [N] extends [never] ? LastSegment<Prefix> : N> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X, [N] extends [never] ? LastSegment<Prefix> : N> : object;
 type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
-//#endregion
-//#region src/core/vocabulary.d.ts
-declare const ROLE_KIND: "role";
-declare const PLAN_KIND: "plan";
-/** `defineRoles` and `definePlans` options. */
-type VocabularyOptions<X = never> = {
-  /**
-   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
-   * definition time. On a role tree it also checks the `meta.x` of custom
-   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
-   */
-  readonly x?: AppDataSchema<X>;
-};
 /**
- * A role's metadata. `audience` names the surface its holders use (`'staff'`,
- * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
- * audiences of the roles held in the active scope.
+ * The tree `definePermissions(input, options)` returns, nameable for an
+ * explicit annotation under `isolatedDeclarations`.
  */
-type RoleMeta = ActionMeta & {
-  readonly audience?: string;
-};
-type Role<K extends string = string> = {
-  readonly key: K;
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable: boolean;
-  readonly meta: RoleMeta;
-  /** A shared custom role: the platform defines it for every tenant, and a tenant admin cannot edit it. */
-  readonly shared?: true;
-  readonly kind: typeof ROLE_KIND;
-};
-type Plan<K extends string = string> = {
-  readonly key: K;
-  readonly meta: ActionMeta;
-  readonly kind: typeof PLAN_KIND;
-};
-type RoleInit = {
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable?: boolean;
-  readonly meta?: RoleMeta;
-};
-type PlanInit = {
-  readonly meta?: ActionMeta;
-};
-type RoleTree = {
-  readonly [key: string]: Role;
-};
-type PlanTree = {
-  readonly [key: string]: Plan;
-};
-type Vocabulary = {
-  readonly permissions?: unknown;
-  readonly roles?: RoleTree;
-  readonly plans?: PlanTree;
-};
-type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
-type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
-declare function isRole(value: unknown): value is Role;
-declare function isPlan(value: unknown): value is Plan;
-declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
-declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
-declare function listRoles(tree: RoleTree | undefined): readonly Role[];
-declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
-declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
+type PermissionsOf<Input, PX = never, RX = never> = InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
 //#endregion
-export { ResourceLevel as A, RESOURCE_X as B, InferPermissionTree as C, PermissionsOptions as D, PermissionTree as E, ResourceParent as F, AppDataSchema as H, ResourceRelation as I, ResourceRelationInput as L, ResourceMeta as M, ResourceNode as N, PrincipalRelation as O, ResourceOptions as P, ResourceRestricted as R, FieldRelation as S, PermissionKind as T, MetaValue as U, AppData as V, ComputedRelation as _, RoleTree as a, EdgeMatch as b, definePlans as c, isPlan as d, isRole as f, ActionMeta as g, ActionList as h, RoleMeta as i, ResourceLink as j, ResourceInit as k, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u, EdgeGroup as v, Permission as w, EdgeRelation as x, EdgeGroups as y, ResourceXTree as z };
+export { RESOURCE_NAME as A, ResourceRelation as C, RowOf as D, ResourceXTree as E, WithX as F, AppData as M, AppDataSchema as N, PERMISSION_ROW as O, MetaValue as P, ResourceParent as S, ResourceRestricted as T, ResourceLevel as _, EdgeGroups as a, ResourceNode as b, FieldRelation as c, PermissionKind as d, PermissionTree as f, ResourceInit as g, PrincipalRelation as h, EdgeGroup as i, RESOURCE_X as j, POLICY_SCOPES as k, InferPermissionTree as l, PermissionsOptions as m, ActionMeta as n, EdgeMatch as o, PermissionsOf as p, ComputedRelation as r, EdgeRelation as s, ActionList as t, Permission as u, ResourceLink as v, ResourceRelationInput as w, ResourceOptions as x, ResourceMeta as y };

package/dist/{permissions-u_KHg-sN.d.ts → permissions-Bx6UI8n1.d.ts}

@@ -1,10 +1,14 @@
-import { C as InferPermissionTree, k as ResourceInit, r as Role, t as Plan } from "./vocabulary-CN8H_9UF.js";
+import { g as ResourceInit, l as InferPermissionTree } from "./permission-types-CAY-GU7e.js";
+import { r as Role, t as Plan } from "./vocabulary-DEJ5j4mR.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/permissions.d.ts
 declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;
 declare const SaasDocSchema: StandardSchemaV1<SaasDoc>;
 declare const SaasFolderSchema: StandardSchemaV1<SaasFolder>;
-/** A folder in an org's tree; `restricted` keeps grants held on its ancestors out. */
+/**
+ * A folder in an org's tree; `restricted` keeps grants held on its ancestors
+ * out.
+ */
 type SaasFolder = {
   readonly id: string;
   readonly orgId: string;

package/dist/{permissions-B-wCP5ZC.js → permissions-CVXmRILq.js}

@@ -1,6 +1,6 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-Br4jSNVi.js";
-import { r as assertGraphTargets } from "./resource-relations-D_jw0BFx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-B8tYxPIt.js";
+import { r as assertGraphTargets } from "./resource-relations-8-pCScBO.js";
 //#region src/core/operation-risks.ts
 /** Every `meta.risk` level, lowest first. */
 const OPERATION_RISKS = Object.freeze([

package/dist/{permissions-BPxlwVhN.js → permissions-mDcTWoBs.js}

@@ -1,7 +1,7 @@
-import { i as crud } from "./src-Cu2m75uo.js";
-import { _ as resource } from "./permission-registry-Br4jSNVi.js";
-import { f as definePlans, p as defineRoles } from "./grantee-hxrUsbpM.js";
-import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
+import { c as crud } from "./src-DZ0l9UAg.js";
+import { v as resource } from "./permission-registry-B8tYxPIt.js";
+import { f as definePlans, p as defineRoles } from "./grantee-Dke-9rd1.js";
+import { t as definePermissions } from "./permissions-CVXmRILq.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {
 	switch (kind) {
@@ -126,7 +126,10 @@ const saasRoles = defineRoles({
 		on: "team",
 		assignable: true
 	},
-	/** Resource-scoped; `role(..., { on: saasPermissions.project })` in the policy. */
+	/**
+	* Resource-scoped; `role(..., { on: saasPermissions.project })` in the
+	* policy.
+	*/
 	collaborator: { assignable: true }
 });
 const saasPlans = definePlans({

package/dist/pg-DQTqRrou.js

@@ -0,0 +1,60 @@
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { i as requirePeer } from "./peer-Q0fuZ6hx.js";
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command, cwd) {
+	return requirePeer(() => import("pg"), "pg", command, cwd);
+}
+function options(db) {
+	return {
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, {
+		cause,
+		code: "database_unreachable"
+	});
+}
+/**
+* The default `connect` of a command: one connection, failing with a message
+* that names `command`.
+*/
+function pgConnector(command, cwd = process.cwd()) {
+	return (db) => connectPg(db, command, cwd);
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command, cwd) {
+	const client = new (await (loadPg(command, cwd))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => client.query(sql, values),
+		end: () => client.end()
+	};
+}
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command, cwd = process.cwd()) {
+	const pool = new (await (loadPg(command, cwd))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: () => pool.end()
+	};
+}
+//#endregion
+export { pgConnector as n, connectPgPool as t };

package/dist/{pins-8ILTftC9.js → pins-nqarl3oE.js}

@@ -5,7 +5,10 @@ const DRAFT_PINS = {
 	overlay: "1.2-dev@edd4adea"
 };
 const PROFILE_NAMES = { fapi2: "fapi-20-security-profile" };
-/** PermDock's published `supportedParametersSchema` per profile, stable across pins. */
+/**
+* PermDock's published `supportedParametersSchema` per profile, stable across
+* pins.
+*/
 const PROFILE_PARAMETERS = { fapi2: "https://permdock.com/schemas/security-profiles/fapi2.json" };
 const GNAP_RESERVED = "scheme.type 'gnap' is reserved and emits nothing. See https://permdock.com/docs/standards/watch-list#gnap";
 //#endregion

package/dist/pkce-CnmmYqUZ.js

@@ -0,0 +1,21 @@
+//#region src/cloud/pkce.ts
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
+}
+/** `length` random bytes as base64url, from Web Crypto. */
+function randomToken(length) {
+	return base64url(globalThis.crypto.getRandomValues(new Uint8Array(length)));
+}
+/** An RFC 7636 verifier of 43 characters and its `S256` challenge. */
+async function pkce() {
+	const verifier = randomToken(32);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+//#endregion
+export { randomToken as n, pkce as t };

package/dist/{policy-77FSAq_V.d.ts → policy-Ba4bDhaj.d.ts}

@@ -1,14 +1,14 @@
-import { T as Policy, ar as Subject, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-u_KHg-sN.js";
+import { T as Policy, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-Bx6UI8n1.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;
 /**
  * The shared multi-tenant SaaS policy: four tenant roles, a team role, a
  * resource-scoped role, plan-gated features, a closure deny, a quota, an
- * approval and a folder tree shared through edges. Row conditions and
- * relations are portable; the closure is not, and the folder grants need
- * a `RelationSource` (`saasRelations()`).
+ * approval and a folder tree shared through edges. Row conditions and relations
+ * are portable; the closure is not, and the folder grants need a
+ * `RelationSource` (`saasRelations()`).
  */
 type SaasVocabulary = {
   readonly permissions: typeof saasPermissions;