permdock 0.7.0 → 0.8.0

package/dist/catalog/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, a as ApprovalRequirement, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-BmjzxQhp.js";
-import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-BXMYB7BY.js";
-import { a as CatalogFinding, i as CatalogEventData } from "../sink-Cp_Eot9W.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BbcY9r_4.js";
+import { T as Policy, a as ApprovalRequirement, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-Cmtxogd0.js";
+import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-Dvi7YZG_.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-D1Eoi6NM.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/catalog/drift.d.ts
 /**
@@ -14,7 +14,10 @@ export declare function hostedGrantFindings(policy: Policy, document: PolicyDocu
 type CatalogDriftInput = {
   readonly previous: CatalogDocument;
   readonly next: CatalogDocument;
-  /** The policy rebuilt from `next` (`policyFromCatalog`), which live hosted grants must still pass. */
+  /**
+   * The policy rebuilt from `next` (`policyFromCatalog`), which live hosted
+   * grants must still pass.
+   */
   readonly policy: Policy;
   /** The live hosted grants; absent or `null` when the environment has none. */
   readonly document?: PolicyDocument | null;
@@ -27,7 +30,10 @@ type CatalogDriftInput = {
 export declare function catalogDrift(input: CatalogDriftInput): CatalogEventData;
 //#endregion
 //#region src/catalog/hosted-options.d.ts
-/** The declared roles held at one scope: a scope name as declared, `resource`, or `global` for a role with no `on`. */
+/**
+ * The declared roles held at one scope: a scope name as declared, `resource`,
+ * or `global` for a role with no `on`.
+ */
 type HostedGrantRoleOption = {
   readonly scope: string;
   readonly roles: readonly string[];
@@ -37,7 +43,10 @@ type HostedGrantRelationOption = {
   /** Present when the grant may walk the resource's own parent chain. */
   readonly through?: "parent";
 };
-/** What a hosted grant on one hostable permission may say; any other value is dropped by `mergeHostedGrants`. */
+/**
+ * What a hosted grant on one hostable permission may say; any other value is
+ * dropped by `mergeHostedGrants`.
+ */
 type HostedGrantOption = {
   readonly permission: string;
   readonly resource: string;
@@ -49,11 +58,17 @@ type HostedGrantOption = {
     readonly relations: readonly HostedGrantRelationOption[];
   };
   readonly approval: {
-    /** `true` when a code allow carries an approval: a hosted allow without one at least as strict is dropped (`weaker-approval`). */
+    /**
+     * `true` when a code allow carries an approval: a hosted allow without one
+     * at least as strict is dropped (`weaker-approval`).
+     */
     readonly required: boolean;
     /** The approvals code allows carry; a hosted allow must meet each. */
     readonly meets: readonly ("human" | ApprovalRequirement)[];
-    /** `human` is `approval: 'human'`; `any` is the object form, any one approver per approval. `all` and `sequential` stages are never accepted. */
+    /**
+     * `human` is `approval: 'human'`; `any` is the object form, any one
+     * approver per approval. `all` and `sequential` stages are never accepted.
+     */
     readonly modes: readonly ("human" | "any")[];
     /** The object-form fields a hosted approval may set. */
     readonly fields: readonly string[];
@@ -63,15 +78,18 @@ type HostedGrantOption = {
   readonly conditions: {
     /** `where` and `check` accept the portable condition subset only. */
     readonly portable: true;
-    /** The resource's top-level fields, from its JSON Schema; `null` when the schema exposes none. */
+    /**
+     * The resource's top-level fields, from its JSON Schema; `null` when the
+     * schema exposes none.
+     */
     readonly fields: readonly string[] | null;
   };
 };
 /**
- * What a hosted grant may say on each permission the policy marks
- * `hostable`, in `hostable` order: the grantees, approval forms and
- * conditions `mergeHostedGrants` accepts. For an authoring form; every
- * grant it builds from these still goes through `checkHostedGrant`.
+ * What a hosted grant may say on each permission the policy marks `hostable`,
+ * in `hostable` order: the grantees, approval forms and conditions
+ * `mergeHostedGrants` accepts. For an authoring form; every grant it builds
+ * from these still goes through `checkHostedGrant`.
  */
 export declare function hostedGrantOptions(policy: Policy): readonly HostedGrantOption[];
 //#endregion
@@ -79,8 +97,8 @@ export declare function hostedGrantOptions(policy: Policy): readonly HostedGrant
 /**
  * A Standard Schema that validates against a catalog resource's JSON Schema.
  * `null` (no JSON Schema in the catalog) gives `undefined`. A schema that uses
- * a keyword outside the supported subset rejects every value, so a hosted
- * check never validates less than the code did.
+ * a keyword outside the supported subset rejects every value, so a hosted check
+ * never validates less than the code did.
  */
 export declare function resourceSchemaFromJson(json: unknown): StandardSchemaV1 | undefined;
 //#endregion
@@ -95,8 +113,8 @@ type OperationCatalog = {
 };
 /**
  * Operations, matched by name, whose `meta.risk` rose or whose permission
- * stopped requiring approval between two catalogs. A new or removed
- * operation is not a finding.
+ * stopped requiring approval between two catalogs. A new or removed operation
+ * is not a finding.
  */
 export declare function operationFindings(previous: OperationCatalog, next: OperationCatalog): readonly CatalogFinding[];
 //#endregion
@@ -113,12 +131,15 @@ type ParseCatalogOptions = {
  * Reads a `permissions.catalog.json` document (parsed, or the JSON text),
  * validates it against `schemas/catalog-v1.json`, then checks its references:
  * role scopes, the permission keys operations, grants, delegations and OAuth
- * scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy
- * built from own keys; throws `PermDockValidationError` with every issue,
- * each with its `path`.
+ * scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy built
+ * from own keys; throws `PermDockValidationError` with every issue, each with
+ * its `path`.
  */
 export declare function parseCatalog(json: unknown, options?: ParseCatalogOptions): CatalogDocument;
-/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+/**
+ * Keys of the permissions the catalog marks `rowConditions: true`: the SQL
+ * helpers alone cannot enforce them.
+ */
 export declare function rowConditionKeys(catalog: CatalogDocument): ReadonlySet<string>;
 //#endregion
 //#region src/catalog/policy-from-catalog.d.ts
@@ -130,14 +151,14 @@ type PolicyFromCatalogOptions<TUser = unknown> = {
  * Rebuilds an evaluable `Policy` from a catalog (`permissions.catalog.json`)
  * and the policy `permdock cloud push` sent with it, for a service that holds
  * no application code: the hosted AuthZEN endpoint or a `mergeHostedGrants`
- * pre-check. Throws `PermDockValidationError` when either input is malformed
- * or the two disagree.
+ * pre-check. Throws `PermDockValidationError` when either input is malformed or
+ * the two disagree.
  *
- * What only code can answer fails closed: an allow whose condition is a
- * closure never grants and such a deny always applies; a resource schema
- * keyword outside the supported JSON Schema subset rejects every value; a
- * support role has no one who may consent. Grant levels and OAuth scopes
- * are not in a catalog, so the rebuilt policy has none.
+ * What only code can answer fails closed: an allow whose condition is a closure
+ * never grants and such a deny always applies; a resource schema keyword
+ * outside the supported JSON Schema subset rejects every value; a support role
+ * has no one who may consent. Grant levels and OAuth scopes are not in a
+ * catalog, so the rebuilt policy has none.
  */
 export declare function policyFromCatalog<TUser = unknown>(catalogInput: unknown, pushedInput: unknown, options?: PolicyFromCatalogOptions<TUser>): Policy<TUser>;
 //#endregion

package/dist/catalog/index.js

@@ -1,16 +1,19 @@
 import { r as isRecord } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { a as getResource, n as findPermission } from "../permission-registry-DpPtSKNZ.js";
-import { d as isSelfParented } from "../resource-relations-D_jw0BFx.js";
-import { _ as listPlans, m as findRole } from "../grantee-BrRANrpT.js";
-import { t as declaredRoleNames } from "../policy-DaJy4nK4.js";
-import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-XBgU6RGT.js";
-import { n as rowConditionKeys, t as parseCatalog } from "../parse-Ddhz2xf4.js";
-import { t as operationFindings } from "../operation-findings-kRcEp8lE.js";
-import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DFWYkNdu.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { a as getResource, n as findPermission } from "../permission-registry-B8tYxPIt.js";
+import { d as isSelfParented } from "../resource-relations-8-pCScBO.js";
+import { _ as listPlans, m as findRole } from "../grantee-Dke-9rd1.js";
+import { n as declaredRoleNames } from "../policy-CLQ8__GF.js";
+import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-D0IzESu_.js";
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-1_ZheTW5.js";
+import { t as operationFindings } from "../operation-findings-CXtFzlKJ.js";
+import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-CJgOm6aq.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
 //#region src/catalog/drift.ts
-/** The finding a drop reason becomes; `null` for a reason the catalog did not cause. */
+/**
+* The finding a drop reason becomes; `null` for a reason the catalog did not
+* cause.
+*/
 function findingCode(reason) {
 	switch (reason) {
 		case "unknown-permission": return "permission-removed";
@@ -142,10 +145,10 @@ function optionFor(policy, key) {
 	};
 }
 /**
-* What a hosted grant may say on each permission the policy marks
-* `hostable`, in `hostable` order: the grantees, approval forms and
-* conditions `mergeHostedGrants` accepts. For an authoring form; every
-* grant it builds from these still goes through `checkHostedGrant`.
+* What a hosted grant may say on each permission the policy marks `hostable`,
+* in `hostable` order: the grantees, approval forms and conditions
+* `mergeHostedGrants` accepts. For an authoring form; every grant it builds
+* from these still goes through `checkHostedGrant`.
 */
 function hostedGrantOptions(policy) {
 	return freezeDeep(policy.hostable.flatMap((key) => {

package/dist/{catalog-D69WhFii.js → catalog-BFpz2EmT.js}

@@ -1,9 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as listSourceFiles, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
-import { a as loadConfiguredOperations, i as scanSources, r as runCollect } from "./collect-BaWeMjwV.js";
-import { n as fileSummary, t as applyFiles } from "./files-acUbNwWt.js";
+import { r as listSourceFiles, t as defaultSrcPath } from "./files-BSjrtIHw.js";
+import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
+import { i as scanSources, r as runCollect } from "./collect-B7ZFAJU3.js";
+import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts
@@ -14,18 +15,7 @@ async function runCatalog(input) {
 	};
 	const from = input.from ?? input.config.permissions;
 	let document;
-	if (from !== void 0) {
-		const abs = resolve(input.cwd, from);
-		if (!existsSync(abs)) return {
-			code: 2,
-			output: `PermDock CLI: module not found: ${from}`
-		};
-		const tree = asPermissionTree(pickNamed(await loadModule(abs), ["permissions"]));
-		const srcPath = input.config.collect?.srcPath ?? defaultSrcPath();
-		const files = listSourceFiles(input.cwd, srcPath);
-		const scan = scanSources(input.cwd, files, new Set(leavesOf(tree).map((leaf) => leaf.key)));
-		document = buildCatalog(tree, scan, input.now.toISOString(), await loadConfiguredPolicy(input.cwd, input.config.policy), await loadConfiguredOperations(input.cwd, input.config.operations));
-	} else {
+	if (from === void 0) {
 		const collected = await runCollect({
 			cwd: input.cwd,
 			config: input.config,
@@ -39,6 +29,17 @@ async function runCatalog(input) {
 			output: collected.message
 		};
 		document = collected.document;
+	} else {
+		const abs = resolve(input.cwd, from);
+		if (!existsSync(abs)) return {
+			code: 2,
+			output: `PermDock CLI: module not found: ${from}`
+		};
+		const tree = asPermissionTree(pickNamed(await loadModule(abs), ["permissions"]));
+		const srcPath = input.config.collect?.srcPath ?? defaultSrcPath();
+		const files = listSourceFiles(input.cwd, srcPath);
+		const scan = scanSources(input.cwd, files, new Set(leavesOf(tree).map((leaf) => leaf.key)));
+		document = buildCatalog(tree, scan, input.now.toISOString(), await loadConfiguredPolicy(input.cwd, input.config.policy), await loadConfiguredOperations(input.cwd, input.config.operations));
 	}
 	const filtered = input.include.length === 0 ? document : {
 		...document,
@@ -54,8 +55,8 @@ async function runCatalog(input) {
 	};
 }
 /**
-* The comparable forms of a catalog file: without the fields every run
-* changes, then also without `usages[].line`.
+* The comparable forms of a catalog file: without the fields every run changes,
+* then also without `usages[].line`.
 */
 function comparable(text) {
 	try {

package/dist/{catalog-BaMQfQ6Y.js → catalog-DCspHDc8.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-DpP_U6Bf.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-aaeRAdiD.js";
+import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/catalog.ts
 const RUN_FORMAT = {
 	catalog: "json",
@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-BCCjSAdH.js");
+		const { catalogFile, runCatalog } = await import("./catalog-mRQQQhNK.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{catalog-doc-CV9s6B1S.js → catalog-doc-DjMKzJp9.js}

@@ -1,20 +1,24 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
+import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { m as findRole, v as listRoles } from "./grantee-BrRANrpT.js";
-import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
-import { t as catalogSchema } from "./schema-B4v0Qrac.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { c as generatorBanner, n as CATALOG_SCHEMA } from "./version-CEbQ5UeM.js";
+import { m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { i as wireValidity } from "./validity-Buc7w8E9.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { t as catalogSchema } from "./schema-BOJjqlWL.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { c as generatorBanner, n as CATALOG_SCHEMA } from "./version-DMQ0dnN5.js";
 //#region src/cli/catalog-doc.ts
 function leafLevels(tree, leaf) {
 	if (leaf.kind !== "instance") return;
 	const names = Object.keys({ ...getResource(tree, leaf.resource)?.levels });
 	return names.length === 0 ? void 0 : names;
 }
-/** With `policy`, permissions carry `hostable` and a known `rowConditions` (without, it is `true`), and roles carry `on`, `assignable` and their ownership rules. */
+/**
+* With `policy`, permissions carry `hostable` and a known `rowConditions`
+* (without, it is `true`), and roles carry `on`, `assignable` and their
+* ownership rules.
+*/
 function buildCatalog(tree, scan, generatedAt, policy, operations) {
 	const hostable = new Set(policy?.hostable ?? []);
 	const rowConditions = policy === void 0 ? void 0 : policyRowConditionKeys(policy);
@@ -51,6 +55,7 @@ function buildCatalog(tree, scan, generatedAt, policy, operations) {
 			usages: scan.usages[leaf.key] ?? [],
 			renamedFrom: formerKeys(leaf).length === 0 ? void 0 : formerKeys(leaf),
 			levels: leafLevels(tree, leaf),
+			orderedLevels: leaf.kind === "instance" && getResource(tree, leaf.resource)?.orderedLevels === true ? true : void 0,
 			hostable: hostable.has(leaf.key) ? true : void 0,
 			rowConditions: rowConditions?.has(leaf.key) ?? true,
 			approvals: approvals.get(leaf.key),
@@ -95,8 +100,8 @@ function catalogApproval(approval) {
 /**
 * Every code grant in canonical order: by permission, allows before denies,
 * then by role (top-level grants last) and finally by canonical JSON, so two
-* catalogs of the same policy list the same grants in the same order
-* whatever the declaration order was.
+* catalogs of the same policy list the same grants in the same order whatever
+* the declaration order was.
 */
 function catalogGrant(grant) {
 	const limit = grant.limit === void 0 ? void 0 : withDefined({
@@ -125,7 +130,10 @@ function catalogGrant(grant) {
 		})
 	};
 }
-/** The sort key of a catalog grant: permission, allows first, role (top-level last), then the canonical JSON. */
+/**
+* The sort key of a catalog grant: permission, allows first, role (top-level
+* last), then the canonical JSON.
+*/
 function catalogGrantKey(grant) {
 	return [
 		grant.permission,
@@ -145,7 +153,10 @@ function catalogGrants(policy) {
 		return left < right ? -1 : left > right ? 1 : 0;
 	});
 }
-/** Every policy delegation, sorted by canonical JSON so declaration order does not matter. */
+/**
+* Every policy delegation, sorted by canonical JSON so declaration order does
+* not matter.
+*/
 function catalogDelegations(policy) {
 	return (policy.delegations ?? []).map((delegation) => withDefined({
 		from: delegation.from,
@@ -164,7 +175,10 @@ function catalogOAuthScopes(declared) {
 		permissions: [...new Set(entry.permissions)].toSorted(byCodePoint)
 	})).toSorted((a, b) => byCodePoint(a.scope, b.scope));
 }
-/** Per permission key, the distinct approvals the code allows require, in policy order. */
+/**
+* Per permission key, the distinct approvals the code allows require, in policy
+* order.
+*/
 function codeApprovals(policy) {
 	const out = /* @__PURE__ */ new Map();
 	const seen = /* @__PURE__ */ new Set();

package/dist/{catalog-fingerprint-C144oW4M.js → catalog-fingerprint-e6aCWosn.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { l as isRfc3339 } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { l as isRfc3339 } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { C as EVENT_SCHEMA_IDS, T as SINK_EVENT_SCHEMAS, i as RESERVED_CLOUD_EVENT_TYPES, l as isAbsoluteUri, r as CLOUD_EVENT_TYPES, s as cloudEventType, u as isTraceparent, v as CATALOG_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { C as EVENT_SCHEMA_IDS, T as SINK_EVENT_SCHEMAS, i as RESERVED_CLOUD_EVENT_TYPES, l as isAbsoluteUri, r as CLOUD_EVENT_TYPES, s as cloudEventType, u as isTraceparent, v as CATALOG_EVENT_SCHEMA } from "./sink-D9_vh372.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/core/parse-sink-events.ts
 function hasUnsafeKey(value) {
 	if (Array.isArray(value)) return value.some(hasUnsafeKey);
@@ -32,8 +32,8 @@ function rulesHold(event) {
 	return true;
 }
 /**
-* Validates one untrusted sink event against its family's schema and returns
-* a frozen copy, or `null` for anything else. Never throws.
+* Validates one untrusted sink event against its family's schema and returns a
+* frozen copy, or `null` for anything else. Never throws.
 */
 function parseSinkEvent(value) {
 	if (!isRecord(value)) return null;
@@ -46,8 +46,8 @@ function parseSinkEvent(value) {
 }
 /**
 * Validates an untrusted list of sink events, such as a request body a sink
-* receiver read. Each event that fails its schema is dropped, and a value
-* that is not an array yields no events. Never throws.
+* receiver read. Each event that fails its schema is dropped, and a value that
+* is not an array yields no events. Never throws.
 */
 function parseSinkEvents(value) {
 	if (!Array.isArray(value)) return Object.freeze([]);
@@ -56,7 +56,10 @@ function parseSinkEvents(value) {
 		return event === null ? [] : [event];
 	}));
 }
-/** Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it does not match. */
+/**
+* Validates the data of a `com.permdock.catalog.*` CloudEvent; `null` when it
+* does not match.
+*/
 function parseCatalogEventData(value) {
 	const copy = jsonMatching(value, CATALOG_EVENT_SCHEMA);
 	return copy === null ? null : freezeDeep(copy);
@@ -141,9 +144,10 @@ function fingerprintInput(catalog) {
 	return out;
 }
 /**
-* The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON without `generatedAt`, `generator`, `fingerprint`
-* and every `permissions[].usages`, so neither the CLI version, the clock nor
-* call sites change it.
+* The catalog v1 fingerprint: the `sha-256:` digest of its RFC 8785 JSON
+* without `generatedAt`, `generator`, `fingerprint` and every
+* `permissions[].usages`, so neither the CLI version, the clock nor call sites
+* change it.
 */
 function catalogFingerprint(catalog) {
 	if (!isRecord(catalog)) throw new TypeError("PermDock: a catalog must be an object");

package/dist/catalog-mRQQQhNK.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-BFpz2EmT.js";

package/dist/catalog-operations-Dadrl7Z-.js

@@ -0,0 +1,60 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { k as isOperationEffect } from "./src-DZ0l9UAg.js";
+import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { r as isOperationRisk } from "./permissions-CVXmRILq.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { a as rel } from "./files-BSjrtIHw.js";
+import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/catalog-operations.ts
+function metaOf(name, value) {
+	const fail = (field) => {
+		throw configError(`PermDock CLI: operations.${name}.meta${field} is invalid`);
+	};
+	if (!isRecord(value)) return fail("");
+	const { risk, effects, title } = value;
+	if (risk !== void 0 && !isOperationRisk(risk)) return fail(".risk");
+	if (effects !== void 0 && (!Array.isArray(effects) || !effects.every(isOperationEffect))) return fail(".effects");
+	if (title !== void 0 && typeof title !== "string") return fail(".title");
+	return {
+		...risk === void 0 ? {} : { risk },
+		...effects === void 0 ? {} : { effects },
+		...title === void 0 ? {} : { title }
+	};
+}
+/**
+* The catalog entries of a `defineOperations` map, in definition order. Throws
+* for a value that is not one, such as a module that exports the definitions
+* object instead of the map.
+*/
+function catalogOperations(value) {
+	if (!isRecord(value)) throw configError("PermDock CLI: operations export is not an operation map");
+	const out = [];
+	for (const name of Object.keys(value)) {
+		const operation = value[name];
+		if (!isRecord(operation) || operation["name"] !== name || !isPermission(operation["permission"])) throw configError(`PermDock CLI: operations.${name} is not an operation; export the defineOperations result`);
+		const results = operation["results"];
+		if (results !== void 0 && !isPermission(results)) throw configError(`PermDock CLI: operations.${name}.results is not a permission`);
+		out.push({
+			name,
+			permission: operation["permission"].key,
+			...results === void 0 ? {} : { results: results.key },
+			meta: metaOf(name, operation["meta"])
+		});
+	}
+	return out;
+}
+/**
+* The configured operations module's catalog entries; `undefined` without one.
+* Throws when it is missing or does not load.
+*/
+async function loadConfiguredOperations(cwd, path, options) {
+	if (path === void 0) return;
+	const abs = resolve(cwd, path);
+	if (!existsSync(abs)) throw configError(`PermDock CLI: operations module not found: ${rel(cwd, abs)}`);
+	const mod = await loadModule(abs, options);
+	return catalogOperations(pickNamed(mod, ["operations"]));
+}
+//#endregion
+export { loadConfiguredOperations as t };

package/dist/{challenge-nGWma08S.js → challenge-DImNcR7B.js}

@@ -1,18 +1,24 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as dateAt, p as nowSeconds } from "./time-DkWjdL98.js";
-import { u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
-import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-BEZSlMS_.js";
-import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
-import { t as parseApprovalRequest } from "./parse-request-D_tUXG6M.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as dateAt, p as nowSeconds } from "./time-nR1JesoH.js";
+import { u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
+import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-D9_vh372.js";
+import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { t as parseApprovalRequest } from "./parse-request-CwCZpyjV.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 import { t as CLOUD_BASE_URL } from "./base-url-BQbddZO5.js";
 //#region src/cloud/approver.ts
 const APPROVER_HEADER = "PermDock-Approver";
-/** The RFC 9396 `authorization_details` type that binds an approver token to one verdict. */
+/**
+* The RFC 9396 `authorization_details` type that binds an approver token to one
+* verdict.
+*/
 const APPROVAL_DETAIL_TYPE = "permdock_approval";
-/** Seconds an approver token lives: it proves one resolve call, and the Cloud refuses a replayed `jti`. */
+/**
+* Seconds an approver token lives: it proves one resolve call, and the Cloud
+* refuses a replayed `jti`.
+*/
 const APPROVER_TTL = 60;
 async function facts(read, request, verdict, fallback) {
 	if (read === void 0) return fallback ?? [];
@@ -25,7 +31,10 @@ async function facts(read, request, verdict, fallback) {
 function unauthenticated(detail) {
 	return new ApprovalError("approver-unauthenticated", detail);
 }
-/** A rejection only denies, so the Cloud takes a `system` one without an approver token. */
+/**
+* A rejection only denies, so the Cloud takes a `system` one without an
+* approver token.
+*/
 function isSystemRejection(verdict) {
 	return verdict.status === "rejected" && verdict.by.actor?.kind === "system";
 }
@@ -36,10 +45,10 @@ function isSystemRejection(verdict) {
 * the request id, the verdict status, `vouched`, and the approver's
 * `permissions` and `relations`. With the `roles`, `memberships` and `tenant`
 * claims they are the only facts the Cloud checks a request's `approvers`
-* against in bring-your-own mode. `target` runs only after the
-* approver checks pass. Throws an `ApprovalError` before any resolve when the
-* approver cannot be proven: no signer, no principal, an actor, a failed
-* lookup or a signer failure.
+* against in bring-your-own mode. `target` runs only after the approver checks
+* pass. Throws an `ApprovalError` before any resolve when the approver cannot
+* be proven: no signer, no principal, an actor, a failed lookup or a signer
+* failure.
 */
 async function approverHeaders(verdict, options, issuer, target) {
 	if (isSystemRejection(verdict)) return {};
@@ -80,7 +89,10 @@ async function approverHeaders(verdict, options, issuer, target) {
 }
 //#endregion
 //#region src/cloud/request.ts
-/** Milliseconds a PermDock Cloud request may take; a slower one fails like an unreachable Cloud. */
+/**
+* Milliseconds a PermDock Cloud request may take; a slower one fails like an
+* unreachable Cloud.
+*/
 const CLOUD_TIMEOUT_MS = 1e4;
 function readEnv(name) {
 	const value = globalThis.process?.env?.[name];
@@ -103,15 +115,18 @@ function endpointsOf(url, environment) {
 		jwks: `${issuer}/.well-known/jwks.json`
 	});
 }
-/** `options.environment`, else `PERMDOCK_CLOUD_ENV`, else `""` for the key-bound lookup. */
+/**
+* `options.environment`, else `PERMDOCK_CLOUD_ENV`, else `""` for the key-bound
+* lookup.
+*/
 function configuredEnvironment(options) {
 	return firstNonEmpty(options.environment, readEnv("PERMDOCK_CLOUD_ENV"));
 }
 /**
 * The environment URL and JWK Set URL `cloud()` uses when the environment is
-* configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
-* is set; `resolveCloudEndpoints` then asks the Cloud which environment the
-* key belongs to.
+* configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither is
+* set; `resolveCloudEndpoints` then asks the Cloud which environment the key
+* belongs to.
 */
 function cloudEndpoints(options = {}) {
 	const url = cloudUrl(options);
@@ -134,7 +149,10 @@ async function keyEnvironment(url, key, fetchFn) {
 	if (body["issuer"] !== endpoints.issuer) throw new Error(`PermDock Cloud named issuer ${String(body["issuer"])}, not ${endpoints.issuer}`);
 	return endpoints;
 }
-/** The authenticated connection every `permdock/cloud` client shares. Throws without a key. */
+/**
+* The authenticated connection every `permdock/cloud` client shares. Throws
+* without a key.
+*/
 function cloudConnection(options) {
 	const key = firstNonEmpty(options.key, readEnv("PERMDOCK_CLOUD_KEY"));
 	const url = cloudUrl(options);
@@ -172,10 +190,10 @@ function cloudConnection(options) {
 	});
 }
 /**
-* The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
-* when the environment is configured, else the environment `GET
-* /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
-* Cloud does not answer or answers another issuer.
+* The environment URL and JWK Set URL for a key: `cloudEndpoints(options)` when
+* the environment is configured, else the environment `GET /v1/environment`
+* names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the Cloud does not
+* answer or answers another issuer.
 */
 async function resolveCloudEndpoints(options = {}) {
 	return await cloudConnection(options).endpoints();
@@ -212,7 +230,10 @@ function asApproval(value) {
 	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
 	return value;
 }
-/** The refusal PermDock Cloud names in its body, else the one its status implies. */
+/**
+* The refusal PermDock Cloud names in its body, else the one its status
+* implies.
+*/
 async function approvalErrorFrom(response) {
 	let body;
 	try {
@@ -467,8 +488,8 @@ const SCHEME = /^[\s,]*([!#$%&'*+.^_`|~0-9A-Za-z-]+)(?=[\s,]|$)/u;
 const PARAM = /^\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([!#$%&'*+.^_`|~0-9A-Za-z-]+))\s*(?:,|$)/u;
 const TOKEN68 = /^\s*[A-Za-z0-9._~+/-]+=*\s*(?:,|$)/u;
 /**
-* The first `Bearer` challenge in `header` (RFC 9110 section 11.6.1 syntax),
-* or `null`. Other schemes in the same field are skipped.
+* The first `Bearer` challenge in `header` (RFC 9110 section 11.6.1 syntax), or
+* `null`. Other schemes in the same field are skipped.
 */
 function bearerChallenge(header) {
 	if (header === null) return null;