permdock 0.7.0 → 0.8.0

package/dist/pg-DQTqRrou.js

@@ -0,0 +1,60 @@
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { i as requirePeer } from "./peer-Q0fuZ6hx.js";
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command, cwd) {
+	return requirePeer(() => import("pg"), "pg", command, cwd);
+}
+function options(db) {
+	return {
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, {
+		cause,
+		code: "database_unreachable"
+	});
+}
+/**
+* The default `connect` of a command: one connection, failing with a message
+* that names `command`.
+*/
+function pgConnector(command, cwd = process.cwd()) {
+	return (db) => connectPg(db, command, cwd);
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command, cwd) {
+	const client = new (await (loadPg(command, cwd))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => client.query(sql, values),
+		end: () => client.end()
+	};
+}
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command, cwd = process.cwd()) {
+	const pool = new (await (loadPg(command, cwd))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: () => pool.end()
+	};
+}
+//#endregion
+export { pgConnector as n, connectPgPool as t };

package/dist/{pins-8ILTftC9.js → pins-nqarl3oE.js}

@@ -5,7 +5,10 @@ const DRAFT_PINS = {
 	overlay: "1.2-dev@edd4adea"
 };
 const PROFILE_NAMES = { fapi2: "fapi-20-security-profile" };
-/** PermDock's published `supportedParametersSchema` per profile, stable across pins. */
+/**
+* PermDock's published `supportedParametersSchema` per profile, stable across
+* pins.
+*/
 const PROFILE_PARAMETERS = { fapi2: "https://permdock.com/schemas/security-profiles/fapi2.json" };
 const GNAP_RESERVED = "scheme.type 'gnap' is reserved and emits nothing. See https://permdock.com/docs/standards/watch-list#gnap";
 //#endregion

package/dist/{pkce-5h8NgMQJ.js → pkce-CnmmYqUZ.js}

@@ -2,7 +2,7 @@
 function base64url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
 }
 /** `length` random bytes as base64url, from Web Crypto. */
 function randomToken(length) {

package/dist/{policy-B7dg_yzu.d.ts → policy-Ba4bDhaj.d.ts}

@@ -1,14 +1,14 @@
-import { T as Policy, lr as Subject, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-CoqCOfJ3.js";
+import { T as Policy, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-Bx6UI8n1.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;
 /**
  * The shared multi-tenant SaaS policy: four tenant roles, a team role, a
  * resource-scoped role, plan-gated features, a closure deny, a quota, an
- * approval and a folder tree shared through edges. Row conditions and
- * relations are portable; the closure is not, and the folder grants need
- * a `RelationSource` (`saasRelations()`).
+ * approval and a folder tree shared through edges. Row conditions and relations
+ * are portable; the closure is not, and the folder grants need a
+ * `RelationSource` (`saasRelations()`).
  */
 type SaasVocabulary = {
   readonly permissions: typeof saasPermissions;

package/dist/{policy-DaJy4nK4.js → policy-CLQ8__GF.js}

@@ -1,16 +1,16 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-C1VJzvcr.js";
-import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-DpPtSKNZ.js";
-import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-B8tYxPIt.js";
+import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as defineScopes, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-BrRANrpT.js";
-import { n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
-import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
-import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-CmeBQ6Nv.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as defineScopes, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { n as normalizeValidity } from "./validity-Buc7w8E9.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-5d1zVBvK.js";
 //#region src/core/policy-assertions.ts
 function assertParentGraph(resources) {
 	for (const node of resources.values()) {
@@ -20,8 +20,8 @@ function assertParentGraph(resources) {
 }
 /**
 * Graph relation grantees must reach their resource: `through: 'parent'` from
-* the row to its parent resource or along its own self-parent, and never over
-* a `memberOf` relation, which is tenancy, not the object graph.
+* the row to its parent resource or along its own self-parent, and never over a
+* `memberOf` relation, which is tenancy, not the object graph.
 */
 function assertRelationGrants(grants, resources) {
 	for (const grant of grants) for (const item of flattenGrantee(grant.to)) {
@@ -80,7 +80,10 @@ function rescopeGrantee(to, declared) {
 	const [single] = mapped;
 	return single ?? to;
 }
-/** Resolves `tenant` / `team` aliases to declared names; an undeclared scope throws. */
+/**
+* Resolves `tenant` / `team` aliases to declared names; an undeclared scope
+* throws.
+*/
 function rescopeGrant(grant, declared) {
 	const scope = scopeOfGrant(grant.scope, declared);
 	const to = rescopeGrantee(grant.to, declared);
@@ -162,7 +165,10 @@ function normalizeDelegation(input, index, tree) {
 		validity: normalizeValidity(input, label)
 	});
 }
-/** RFC 6749 section 3.3 `scope-token`: printable ASCII without space, `"` or `\`. */
+/**
+* RFC 6749 section 3.3 `scope-token`: printable ASCII without space, `"` or
+* `\`.
+*/
 function isScopeToken(value) {
 	return /^[!#-[\]-~]+$/u.test(value);
 }
@@ -188,10 +194,11 @@ function normalizeOAuthScopes(input, tree) {
 }
 //#endregion
 //#region src/core/policy-fingerprint.ts
-function canonicalPolicy(grants, delegations, levels) {
+function canonicalPolicy(grants, delegations, levels, orderedLevels = []) {
 	const payload = canonicalGrants(grants);
 	const withDelegations = delegations.length === 0 ? payload : `${payload}\n${JSON.stringify(delegations)}`;
-	return levels === void 0 ? withDelegations : `${withDelegations}\nlevels:${canonicalJson(levels)}`;
+	const withLevels = levels === void 0 ? withDelegations : `${withDelegations}\nlevels:${canonicalJson(levels)}`;
+	return orderedLevels.length === 0 ? withLevels : `${withLevels}\norderedLevels:${JSON.stringify(orderedLevels)}`;
 }
 function canonicalGrants(grants) {
 	const payload = grants.map((grant) => ({
@@ -271,6 +278,17 @@ function levelCondition(policy, resource, level) {
 function levelNames(policy, resource) {
 	return policyLevels(policy, resource).map(([name]) => name);
 }
+/**
+* The levels a holder of `held` on `resource` may hand out, in declaration
+* order: with `orderedLevels`, each held level and every level declared before
+* it; otherwise `held` itself.
+*/
+function coveredLevels(policy, resource, held) {
+	const names = levelNames(policy, resource);
+	if (policy.orderedLevels?.includes(resource) !== true) return names.filter((name) => held.includes(name));
+	const widest = Math.max(...held.map((name) => names.indexOf(name)));
+	return names.slice(0, widest + 1);
+}
 function isVocabularyInput(value) {
 	return value !== null && typeof value === "object" && "permissions" in value && isRegistryTree(value.permissions);
 }
@@ -334,8 +352,9 @@ function definePolicy(permissions, options) {
 	assertInheritGrants(grants, resources, tree);
 	const delegations = (options.delegations ?? []).map((item, index) => normalizeDelegation(item, index, tree));
 	const levels = normalizeLevels(resources);
+	const orderedLevels = [...resources.values()].filter((node) => node.orderedLevels === true).map((node) => node.name).toSorted(byCodePoint);
 	const oauthScopes = normalizeOAuthScopes(options.oauthScopes, tree);
-	const fingerprint = sha256Digest(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels) : `${canonicalPolicy(grants, delegations, levels)}\noauthScopes:${canonicalJson(oauthScopes)}`);
+	const fingerprint = sha256Digest(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels, orderedLevels) : `${canonicalPolicy(grants, delegations, levels, orderedLevels)}\noauthScopes:${canonicalJson(oauthScopes)}`);
 	const hostable = [...new Set((options.hostable ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	const fresh = [...new Set((options.fresh ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	return freezeDeep({
@@ -358,6 +377,7 @@ function definePolicy(permissions, options) {
 		fresh,
 		delegations: delegations.length === 0 ? void 0 : delegations,
 		levels,
+		orderedLevels: orderedLevels.length === 0 ? void 0 : orderedLevels,
 		oauthScopes: oauthScopes.length === 0 ? void 0 : oauthScopes,
 		index: indexPolicy(roles, grants, vocabulary)
 	});
@@ -375,10 +395,10 @@ function declaredRoleNames(policy) {
 	return policy.index.declaredRoles;
 }
 /**
-* Whether `value` names a role the policy declares, for a role read as a
-* string from a database or a token. A name it rejects is an unknown role,
-* which grants nothing (`unknown-role`). A tenant's custom roles are not
-* declared; `CustomRoleSource` resolves them.
+* Whether `value` names a role the policy declares, for a role read as a string
+* from a database or a token. A name it rejects is an unknown role, which
+* grants nothing (`unknown-role`). A tenant's custom roles are not declared;
+* `CustomRoleSource` resolves them.
 */
 function isRoleName(policy, value) {
 	return typeof value === "string" && policy.index.declaredRoles.has(value);
@@ -405,4 +425,4 @@ function separationConflicts(policy, memberships) {
 	return conflicts;
 }
 //#endregion
-export { isRoleName as a, policyLevels as c, normalizeDelegation as d, indexPolicy as i, separationConflicts as l, definePolicy as n, levelCondition as o, grantList as r, levelNames as s, declaredRoleNames as t, policyX as u };
+export { indexPolicy as a, levelNames as c, policyX as d, normalizeDelegation as f, grantList as i, policyLevels as l, declaredRoleNames as n, isRoleName as o, definePolicy as r, levelCondition as s, coveredLevels as t, separationConflicts as u };

package/dist/{policy-from-catalog-DFWYkNdu.js → policy-from-catalog-CJgOm6aq.js}

@@ -1,17 +1,17 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { p as normalizeWhere } from "./role-builder-C1VJzvcr.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { i as getRegistry, n as findPermission, v as resource } from "./permission-registry-DpPtSKNZ.js";
-import { n as defineScopes } from "./scopes-BHsc-wp-.js";
-import { f as definePlans, p as defineRoles } from "./grantee-BrRANrpT.js";
-import { r as readWireValidity } from "./validity-CZ7-y0Cj.js";
-import { d as normalizeDelegation, i as indexPolicy } from "./policy-DaJy4nK4.js";
-import { o as isPortableCondition } from "./hosted-XBgU6RGT.js";
-import { t as definePermissions } from "./permissions-CyH2MV_B.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
-import { n as parsePushedPolicy } from "./pushed-policy-CmYeSQqq.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { p as normalizeWhere } from "./role-builder-BK2-T6oD.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { i as getRegistry, n as findPermission, v as resource } from "./permission-registry-B8tYxPIt.js";
+import { n as defineScopes } from "./scopes-0Up_UA2t.js";
+import { f as definePlans, p as defineRoles } from "./grantee-Dke-9rd1.js";
+import { r as readWireValidity } from "./validity-Buc7w8E9.js";
+import { a as indexPolicy, f as normalizeDelegation } from "./policy-CLQ8__GF.js";
+import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { t as definePermissions } from "./permissions-CVXmRILq.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { n as parsePushedPolicy } from "./pushed-policy-ITwYKvvH.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",
@@ -159,8 +159,8 @@ function refusing(keyword) {
 /**
 * A Standard Schema that validates against a catalog resource's JSON Schema.
 * `null` (no JSON Schema in the catalog) gives `undefined`. A schema that uses
-* a keyword outside the supported subset rejects every value, so a hosted
-* check never validates less than the code did.
+* a keyword outside the supported subset rejects every value, so a hosted check
+* never validates less than the code did.
 */
 function resourceSchemaFromJson(json) {
 	if (json === null || json === void 0) return;
@@ -185,8 +185,8 @@ function resourceSchemaFromJson(json) {
 //#endregion
 //#region src/catalog/policy-from-catalog.ts
 /**
-* Stands in for a condition that only code can evaluate: an allow that holds
-* it never matches and a deny that holds it always applies.
+* Stands in for a condition that only code can evaluate: an allow that holds it
+* never matches and a deny that holds it always applies.
 */
 const CODE_CONDITION = freezeDeep({
 	op: "opaque",
@@ -267,7 +267,10 @@ function permissionTree(catalog) {
 		return invalid(error instanceof Error ? error.message : "invalid permission tree", error);
 	}
 }
-/** A portable grant's condition must be in the portable subset; a non-portable one is read as written and fails closed where it cannot evaluate. */
+/**
+* A portable grant's condition must be in the portable subset; a non-portable
+* one is read as written and fails closed where it cannot evaluate.
+*/
 function condition(value, label, portable) {
 	if (value === void 0) return;
 	if (portable && !isPortableCondition(value)) return invalid(`${label} is not a portable condition`);
@@ -384,14 +387,14 @@ function identity(user) {
 * Rebuilds an evaluable `Policy` from a catalog (`permissions.catalog.json`)
 * and the policy `permdock cloud push` sent with it, for a service that holds
 * no application code: the hosted AuthZEN endpoint or a `mergeHostedGrants`
-* pre-check. Throws `PermDockValidationError` when either input is malformed
-* or the two disagree.
+* pre-check. Throws `PermDockValidationError` when either input is malformed or
+* the two disagree.
 *
-* What only code can answer fails closed: an allow whose condition is a
-* closure never grants and such a deny always applies; a resource schema
-* keyword outside the supported JSON Schema subset rejects every value; a
-* support role has no one who may consent. Grant levels and OAuth scopes
-* are not in a catalog, so the rebuilt policy has none.
+* What only code can answer fails closed: an allow whose condition is a closure
+* never grants and such a deny always applies; a resource schema keyword
+* outside the supported JSON Schema subset rejects every value; a support role
+* has no one who may consent. Grant levels and OAuth scopes are not in a
+* catalog, so the rebuilt policy has none.
 */
 function policyFromCatalog(catalogInput, pushedInput, options = {}) {
 	const catalog = parseCatalog(catalogInput);

package/dist/{policy-module-CTlwMvLI.js → policy-module-xym9fnSq.js}

@@ -1,8 +1,11 @@
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 //#region src/cli/importers/policy-module.ts
 const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
-/** Actions a collection permission decides: there is no row yet, or a list of rows. */
+/**
+* Actions a collection permission decides: there is no row yet, or a list of
+* rows.
+*/
 const COLLECTION_ACTIONS = /* @__PURE__ */ new Set(["create", "list"]);
 /** Whether `name` can be a resource or action key in generated code. */
 function isIdentifier(name) {
@@ -38,7 +41,10 @@ function renderGrant(grant) {
 function usesPrincipal(where) {
 	return where !== void 0 && JSON.stringify(where).includes("\"principal\"");
 }
-/** Resources keyed by name, each with its actions split into instance and collection ones. */
+/**
+* Resources keyed by name, each with its actions split into instance and
+* collection ones.
+*/
 function resourcesOf(actions) {
 	return [...actions.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([name, set]) => {
 		const sorted = [...set].toSorted();
@@ -51,8 +57,8 @@ function resourcesOf(actions) {
 }
 /**
 * A deterministic module with the imported `permissions` and a `policy` of
-* their roles. Rules stay data: an import writes declarations and grants,
-* never code an application maintains by hand.
+* their roles. Rules stay data: an import writes declarations and grants, never
+* code an application maintains by hand.
 */
 function emitPolicyModule(input) {
 	const permissionsModule = emitPermissionsModule({