permdock 0.6.0 → 0.8.0

package/dist/{policy-DbM5YYtV.js → policy-CLQ8__GF.js}

@@ -1,16 +1,16 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-uWQZ4v84.js";
-import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-Br4jSNVi.js";
-import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as defineScopes, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-hxrUsbpM.js";
-import { n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
-import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DN2QAx9z.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-B8tYxPIt.js";
+import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-8-pCScBO.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as defineScopes, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { n as normalizeValidity } from "./validity-Buc7w8E9.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-5d1zVBvK.js";
 //#region src/core/policy-assertions.ts
 function assertParentGraph(resources) {
 	for (const node of resources.values()) {
@@ -20,8 +20,8 @@ function assertParentGraph(resources) {
 }
 /**
 * Graph relation grantees must reach their resource: `through: 'parent'` from
-* the row to its parent resource or along its own self-parent, and never over
-* a `memberOf` relation, which is tenancy, not the object graph.
+* the row to its parent resource or along its own self-parent, and never over a
+* `memberOf` relation, which is tenancy, not the object graph.
 */
 function assertRelationGrants(grants, resources) {
 	for (const grant of grants) for (const item of flattenGrantee(grant.to)) {
@@ -80,7 +80,10 @@ function rescopeGrantee(to, declared) {
 	const [single] = mapped;
 	return single ?? to;
 }
-/** Resolves `tenant` / `team` aliases to declared names; an undeclared scope throws. */
+/**
+* Resolves `tenant` / `team` aliases to declared names; an undeclared scope
+* throws.
+*/
 function rescopeGrant(grant, declared) {
 	const scope = scopeOfGrant(grant.scope, declared);
 	const to = rescopeGrantee(grant.to, declared);
@@ -162,7 +165,10 @@ function normalizeDelegation(input, index, tree) {
 		validity: normalizeValidity(input, label)
 	});
 }
-/** RFC 6749 section 3.3 `scope-token`: printable ASCII without space, `"` or `\`. */
+/**
+* RFC 6749 section 3.3 `scope-token`: printable ASCII without space, `"` or
+* `\`.
+*/
 function isScopeToken(value) {
 	return /^[!#-[\]-~]+$/u.test(value);
 }
@@ -188,10 +194,11 @@ function normalizeOAuthScopes(input, tree) {
 }
 //#endregion
 //#region src/core/policy-fingerprint.ts
-function canonicalPolicy(grants, delegations, levels) {
+function canonicalPolicy(grants, delegations, levels, orderedLevels = []) {
 	const payload = canonicalGrants(grants);
 	const withDelegations = delegations.length === 0 ? payload : `${payload}\n${JSON.stringify(delegations)}`;
-	return levels === void 0 ? withDelegations : `${withDelegations}\nlevels:${canonicalJson(levels)}`;
+	const withLevels = levels === void 0 ? withDelegations : `${withDelegations}\nlevels:${canonicalJson(levels)}`;
+	return orderedLevels.length === 0 ? withLevels : `${withLevels}\norderedLevels:${JSON.stringify(orderedLevels)}`;
 }
 function canonicalGrants(grants) {
 	const payload = grants.map((grant) => ({
@@ -271,6 +278,17 @@ function levelCondition(policy, resource, level) {
 function levelNames(policy, resource) {
 	return policyLevels(policy, resource).map(([name]) => name);
 }
+/**
+* The levels a holder of `held` on `resource` may hand out, in declaration
+* order: with `orderedLevels`, each held level and every level declared before
+* it; otherwise `held` itself.
+*/
+function coveredLevels(policy, resource, held) {
+	const names = levelNames(policy, resource);
+	if (policy.orderedLevels?.includes(resource) !== true) return names.filter((name) => held.includes(name));
+	const widest = Math.max(...held.map((name) => names.indexOf(name)));
+	return names.slice(0, widest + 1);
+}
 function isVocabularyInput(value) {
 	return value !== null && typeof value === "object" && "permissions" in value && isRegistryTree(value.permissions);
 }
@@ -334,8 +352,9 @@ function definePolicy(permissions, options) {
 	assertInheritGrants(grants, resources, tree);
 	const delegations = (options.delegations ?? []).map((item, index) => normalizeDelegation(item, index, tree));
 	const levels = normalizeLevels(resources);
+	const orderedLevels = [...resources.values()].filter((node) => node.orderedLevels === true).map((node) => node.name).toSorted(byCodePoint);
 	const oauthScopes = normalizeOAuthScopes(options.oauthScopes, tree);
-	const fingerprint = sha256Digest(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels) : `${canonicalPolicy(grants, delegations, levels)}\noauthScopes:${canonicalJson(oauthScopes)}`);
+	const fingerprint = sha256Digest(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels, orderedLevels) : `${canonicalPolicy(grants, delegations, levels, orderedLevels)}\noauthScopes:${canonicalJson(oauthScopes)}`);
 	const hostable = [...new Set((options.hostable ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	const fresh = [...new Set((options.fresh ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	return freezeDeep({
@@ -358,6 +377,7 @@ function definePolicy(permissions, options) {
 		fresh,
 		delegations: delegations.length === 0 ? void 0 : delegations,
 		levels,
+		orderedLevels: orderedLevels.length === 0 ? void 0 : orderedLevels,
 		oauthScopes: oauthScopes.length === 0 ? void 0 : oauthScopes,
 		index: indexPolicy(roles, grants, vocabulary)
 	});
@@ -374,6 +394,15 @@ function grantList(policy) {
 function declaredRoleNames(policy) {
 	return policy.index.declaredRoles;
 }
+/**
+* Whether `value` names a role the policy declares, for a role read as a string
+* from a database or a token. A name it rejects is an unknown role, which
+* grants nothing (`unknown-role`). A tenant's custom roles are not declared;
+* `CustomRoleSource` resolves them.
+*/
+function isRoleName(policy, value) {
+	return typeof value === "string" && policy.index.declaredRoles.has(value);
+}
 function separationConflicts(policy, memberships) {
 	const exclusive = exclusivePairs(policy);
 	const seen = /* @__PURE__ */ new Set();
@@ -396,4 +425,4 @@ function separationConflicts(policy, memberships) {
 	return conflicts;
 }
 //#endregion
-export { levelCondition as a, separationConflicts as c, indexPolicy as i, policyX as l, definePolicy as n, levelNames as o, grantList as r, policyLevels as s, declaredRoleNames as t, normalizeDelegation as u };
+export { indexPolicy as a, levelNames as c, policyX as d, normalizeDelegation as f, grantList as i, policyLevels as l, declaredRoleNames as n, isRoleName as o, definePolicy as r, levelCondition as s, coveredLevels as t, separationConflicts as u };

package/dist/{policy-from-catalog-C2gMa2Dj.js → policy-from-catalog-CJgOm6aq.js}

@@ -1,17 +1,17 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { p as normalizeWhere } from "./role-builder-uWQZ4v84.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { _ as resource, i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as defineScopes } from "./scopes-CUPSjo9q.js";
-import { f as definePlans, p as defineRoles } from "./grantee-hxrUsbpM.js";
-import { r as readWireValidity } from "./validity-CZ7-y0Cj.js";
-import { i as indexPolicy, u as normalizeDelegation } from "./policy-DbM5YYtV.js";
-import { r as isPortableCondition } from "./hosted-B46-5LYE.js";
-import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { n as parsePushedPolicy } from "./pushed-policy-CqtxkV4G.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { p as normalizeWhere } from "./role-builder-BK2-T6oD.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { i as getRegistry, n as findPermission, v as resource } from "./permission-registry-B8tYxPIt.js";
+import { n as defineScopes } from "./scopes-0Up_UA2t.js";
+import { f as definePlans, p as defineRoles } from "./grantee-Dke-9rd1.js";
+import { r as readWireValidity } from "./validity-Buc7w8E9.js";
+import { a as indexPolicy, f as normalizeDelegation } from "./policy-CLQ8__GF.js";
+import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { t as definePermissions } from "./permissions-CVXmRILq.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { n as parsePushedPolicy } from "./pushed-policy-ITwYKvvH.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",
@@ -159,8 +159,8 @@ function refusing(keyword) {
 /**
 * A Standard Schema that validates against a catalog resource's JSON Schema.
 * `null` (no JSON Schema in the catalog) gives `undefined`. A schema that uses
-* a keyword outside the supported subset rejects every value, so a hosted
-* check never validates less than the code did.
+* a keyword outside the supported subset rejects every value, so a hosted check
+* never validates less than the code did.
 */
 function resourceSchemaFromJson(json) {
 	if (json === null || json === void 0) return;
@@ -185,8 +185,8 @@ function resourceSchemaFromJson(json) {
 //#endregion
 //#region src/catalog/policy-from-catalog.ts
 /**
-* Stands in for a condition that only code can evaluate: an allow that holds
-* it never matches and a deny that holds it always applies.
+* Stands in for a condition that only code can evaluate: an allow that holds it
+* never matches and a deny that holds it always applies.
 */
 const CODE_CONDITION = freezeDeep({
 	op: "opaque",
@@ -267,7 +267,10 @@ function permissionTree(catalog) {
 		return invalid(error instanceof Error ? error.message : "invalid permission tree", error);
 	}
 }
-/** A portable grant's condition must be in the portable subset; a non-portable one is read as written and fails closed where it cannot evaluate. */
+/**
+* A portable grant's condition must be in the portable subset; a non-portable
+* one is read as written and fails closed where it cannot evaluate.
+*/
 function condition(value, label, portable) {
 	if (value === void 0) return;
 	if (portable && !isPortableCondition(value)) return invalid(`${label} is not a portable condition`);
@@ -384,14 +387,14 @@ function identity(user) {
 * Rebuilds an evaluable `Policy` from a catalog (`permissions.catalog.json`)
 * and the policy `permdock cloud push` sent with it, for a service that holds
 * no application code: the hosted AuthZEN endpoint or a `mergeHostedGrants`
-* pre-check. Throws `PermDockValidationError` when either input is malformed
-* or the two disagree.
+* pre-check. Throws `PermDockValidationError` when either input is malformed or
+* the two disagree.
 *
-* What only code can answer fails closed: an allow whose condition is a
-* closure never grants and such a deny always applies; a resource schema
-* keyword outside the supported JSON Schema subset rejects every value; a
-* support role has no one who may consent. Grant levels and OAuth scopes
-* are not in a catalog, so the rebuilt policy has none.
+* What only code can answer fails closed: an allow whose condition is a closure
+* never grants and such a deny always applies; a resource schema keyword
+* outside the supported JSON Schema subset rejects every value; a support role
+* has no one who may consent. Grant levels and OAuth scopes are not in a
+* catalog, so the rebuilt policy has none.
 */
 function policyFromCatalog(catalogInput, pushedInput, options = {}) {
 	const catalog = parseCatalog(catalogInput);

package/dist/{policy-module-CTlwMvLI.js → policy-module-xym9fnSq.js}

@@ -1,8 +1,11 @@
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 //#region src/cli/importers/policy-module.ts
 const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
-/** Actions a collection permission decides: there is no row yet, or a list of rows. */
+/**
+* Actions a collection permission decides: there is no row yet, or a list of
+* rows.
+*/
 const COLLECTION_ACTIONS = /* @__PURE__ */ new Set(["create", "list"]);
 /** Whether `name` can be a resource or action key in generated code. */
 function isIdentifier(name) {
@@ -38,7 +41,10 @@ function renderGrant(grant) {
 function usesPrincipal(where) {
 	return where !== void 0 && JSON.stringify(where).includes("\"principal\"");
 }
-/** Resources keyed by name, each with its actions split into instance and collection ones. */
+/**
+* Resources keyed by name, each with its actions split into instance and
+* collection ones.
+*/
 function resourcesOf(actions) {
 	return [...actions.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([name, set]) => {
 		const sorted = [...set].toSorted();
@@ -51,8 +57,8 @@ function resourcesOf(actions) {
 }
 /**
 * A deterministic module with the imported `permissions` and a `policy` of
-* their roles. Rules stay data: an import writes declarations and grants,
-* never code an application maintains by hand.
+* their roles. Rules stay data: an import writes declarations and grants, never
+* code an application maintains by hand.
 */
 function emitPolicyModule(input) {
 	const permissionsModule = emitPermissionsModule({