permdock 0.7.0 → 0.9.0

package/dist/{role-builder-C1VJzvcr.js → role-builder-BK2-T6oD.js}

@@ -1,14 +1,14 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as isConditionDate, l as isConditionRef, r as isSubjectRef, s as isCondition, u as isSqlFunctionField } from "./refs-CNJBiTFo.js";
-import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-CqPOLD-o.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
-import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, r as assertDuration } from "./time-DkWjdL98.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-BrRANrpT.js";
-import { c as sanitizeFields, n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { c as isConditionDate, l as isConditionRef, r as isSubjectRef, s as isCondition, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
+import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-B4r0N_Uz.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
+import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, r as assertDuration } from "./time-nR1JesoH.js";
+import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Dke-9rd1.js";
+import { c as sanitizeFields, n as normalizeValidity } from "./validity-Buc7w8E9.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {
 	return freezeDeep({
@@ -152,7 +152,10 @@ function normalizeSqlFunction(input) {
 		twin
 	});
 }
-/** `{ session: … }` under `subject`; any other value is a comparison on a `subject` field. */
+/**
+* `{ session: … }` under `subject`; any other value is a comparison on a
+* `subject` field.
+*/
 function isSubjectCondition(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.hasOwn(value, "session");
 }
@@ -213,7 +216,10 @@ function normalizeWhere(input) {
 }
 //#endregion
 //#region src/core/approval-normalize.ts
-/** Every approver a requirement names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
+/**
+* Every approver a requirement names: `by`, each stage and its escalation, and
+* `escalation.to`, inside `anyOf` groups too.
+*/
 function approversOf(requirement) {
 	return [
 		...approverLeaves(requirement.by),
@@ -330,9 +336,9 @@ function assertApprovalVersions(grants, resources) {
 	}
 }
 /**
-* A relation approver is checked by id, from the requested row: the
-* relation lives on the permission's own resource (optionally up its parent
-* chain), or at the end of a list of links from it.
+* A relation approver is checked by id, from the requested row: the relation
+* lives on the permission's own resource (optionally up its parent chain), or
+* at the end of a list of links from it.
 */
 function assertApprovalRelations(grants, resources) {
 	for (const grant of grants) {
@@ -347,7 +353,10 @@ function assertApprovalRelations(grants, resources) {
 		}
 	}
 }
-/** The resource a relation approver's `through` reaches from `start`, or `undefined`. */
+/**
+* The resource a relation approver's `through` reaches from `start`, or
+* `undefined`.
+*/
 function approverRelationResource(start, through, resources) {
 	if (through === void 0) return start;
 	if (through === "parent") return isSelfParented(resources.get(start)) ? start : void 0;
@@ -368,7 +377,10 @@ function assertLimit(limit, permissionKey) {
 	if (limit.mode !== void 0 && limit.mode !== "hard" && limit.mode !== "soft") throw new Error(`PermDock: limit mode on '${permissionKey}' must be 'hard' or 'soft'`);
 	if (limit.alertAt !== void 0 && (typeof limit.alertAt !== "number" || !(limit.alertAt > 0 && limit.alertAt <= 1))) throw new Error(`PermDock: limit alertAt on '${permissionKey}' must be a fraction above 0 and at most 1`);
 }
-/** The declared fields of a validated `limit`, so extra keys never reach the grant. */
+/**
+* The declared fields of a validated `limit`, so extra keys never reach the
+* grant.
+*/
 function normalizeLimit(limit) {
 	if (limit === void 0) return;
 	return {
@@ -436,7 +448,10 @@ function makeGrant(permission, effect, condition) {
 		requires
 	});
 }
-/** Checks a grant's `meta`: plain JSON, string `description`, `x` through the schema when given. */
+/**
+* Checks a grant's `meta`: plain JSON, string `description`, `x` through the
+* schema when given.
+*/
 function grantMeta(meta, key, schema) {
 	if (meta === void 0) return;
 	assertAppData(meta, `meta of a grant on ${key}`);
@@ -478,7 +493,10 @@ function appObligations(input, key, effect) {
 	}
 	return out.length === 0 ? void 0 : freezeDeep(out);
 }
-/** Re-checks every grant's `meta.x` with the policy's grant schema, keeping the schema output. */
+/**
+* Re-checks every grant's `meta.x` with the policy's grant schema, keeping the
+* schema output.
+*/
 function withGrantSchema(grant, schema) {
 	const meta = grant.meta;
 	if (schema === void 0 || meta?.x === void 0) return grant;
@@ -602,7 +620,10 @@ function holderCount(roleName, option, value) {
 	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`PermDock: role '${roleName}' ${option} must be a whole number of holders`);
 	return value;
 }
-/** Ownership rules count holders per scope instance, so they need a named-scope role. */
+/**
+* Ownership rules count holders per scope instance, so they need a named-scope
+* role.
+*/
 function roleRules(roleName, scope, options) {
 	const min = holderCount(roleName, "min", options?.min);
 	const max = holderCount(roleName, "max", options?.max);

package/dist/{row-conditions-h2HythXQ.js → row-conditions-BAGHOmVq.js}

@@ -9,9 +9,10 @@ const ROW_GRANTEES = /* @__PURE__ */ new Set([
 /**
 * Whether a grant depends on more than the role and the scope: a row or body
 * condition, a closure, a field list, a purpose, a break-glass override, a
-* validity window, a `requires`, or a relation, plan, actor or assurance grantee. The SQL helpers
-* (`permdock_has`, `permitted_<scope>_ids`) check only role and scope, so a
-* policy that calls them for such a permission would widen access.
+* validity window, a `requires`, or a relation, plan, actor or assurance
+* grantee. The SQL helpers (`permdock_has`, `permitted_<scope>_ids`) check only
+* role and scope, so a policy that calls them for such a permission would widen
+* access.
 */
 function grantHasRowConditions(grant) {
 	const grantees = Array.isArray(grant.to) ? grant.to : [grant.to];

package/dist/{rpc-Bk1bE-ch.js → rpc-vHIwyXCp.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { s as requestFromContext } from "./http-BBoKefeS.js";
-import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as adapterKernel } from "./bind-D1nO6fiC.js";
-import { r as guardIterable } from "./stream-CvdUS9V1.js";
+import { s as requestFromContext } from "./http-DKLXrFGk.js";
+import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
+import { t as adapterKernel } from "./bind-BNQA9JK9.js";
+import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */
 function rpcCode(status) {
@@ -83,7 +83,10 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 		guard
 	};
 }
-/** Wraps a streamed result so revocation ends it and items the subscriber cannot read drop. */
+/**
+* Wraps a streamed result so revocation ends it and items the subscriber cannot
+* read drop.
+*/
 async function guardStream(source, open, permission, data, protectOptions, guard) {
 	const conn = await open(permission === null ? {} : compact({
 		permission,

package/dist/run-Ck22anC2.js

@@ -0,0 +1 @@
+export { t as run } from "./run-PbRlXTfh.js";

package/dist/{run-uLD2aWuO.js → run-PbRlXTfh.js}

@@ -1,13 +1,13 @@
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-DpP_U6Bf.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as resolveCwd, i as readConfig } from "./config-CoQHDrDi.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import { a as resolveCwd, i as readConfig } from "./config-BwPBfN0t.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-CC3OwyHW.js";
-import { r as progressReporter, t as redact } from "./credentials-BpuTwd7a.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
-import { t as createStyle } from "./style-Cqo7-73x.js";
-import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-DgSDLrta.js";
+import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
+import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { t as createStyle } from "./style-Ds11Hmk4.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DV5dwOTs.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";
@@ -19,8 +19,8 @@ function set(env, name) {
 }
 /**
 * The AI agent running the CLI, from the variables `@vercel/detect-agent`
-* reads, in its order. `CURSOR_TRACE_ID` is also set in Cursor's own
-* terminal, so it counts only when stdout is not a TTY.
+* reads, in its order. `CURSOR_TRACE_ID` is also set in Cursor's own terminal,
+* so it counts only when stdout is not a TTY.
 */
 function detectAgent(env, probe) {
 	const named = env["AI_AGENT"]?.trim();
@@ -94,8 +94,8 @@ function modeOf(value, source) {
 	return mode;
 }
 /**
-* `--agent`, then `PERMDOCK_AGENT`, then detection. An unknown value is a
-* usage error, so a typo never leaves an agent with prompts it cannot answer.
+* `--agent`, then `PERMDOCK_AGENT`, then detection. An unknown value is a usage
+* error, so a typo never leaves an agent with prompts it cannot answer.
 */
 function agentMode(flag, env, probe) {
 	const mode = flag === void 0 ? modeOf(env["PERMDOCK_AGENT"], "PERMDOCK_AGENT") ?? "auto" : modeOf(flag, "--agent") ?? "auto";
@@ -110,8 +110,8 @@ function agentMode(flag, env, probe) {
 //#region src/cli/core/consent.ts
 /**
 * The reasons a run needs consent: it edits files the project owns, it
-* publishes to the Cloud, or `--force` overwrites files PermDock did not
-* write. A `--dry-run` or `--check` run writes nothing and needs none.
+* publishes to the Cloud, or `--force` overwrites files PermDock did not write.
+* A `--dry-run` or `--check` run writes nothing and needs none.
 */
 function consentReasons(effects, flags) {
 	if (flags["dry-run"] === true || flags["check"] === true) return [];
@@ -126,8 +126,8 @@ function quote(token) {
 	return /^[\w@%+=:,./-]+$/u.test(token) ? token : `'${token.replaceAll("'", String.raw`'\''`)}'`;
 }
 /**
-* The argv as a command line to run again, `--confirm` dropped. Secrets
-* only arrive through `--*-stdin` flags, so the line holds none.
+* The argv as a command line to run again, `--confirm` dropped. Secrets only
+* arrive through `--*-stdin` flags, so the line holds none.
 */
 function replayArgv(argv) {
 	const out = [];
@@ -143,8 +143,8 @@ function replayArgv(argv) {
 }
 /**
 * A short token bound to what the person agrees to, the directory and the
-* command line. Hex, because a base64url token may start with `-` and parse
-* as a flag. 16 characters, as better-supabase's.
+* command line. Hex, because a base64url token may start with `-` and parse as
+* a flag. 16 characters, as better-supabase's.
 */
 function consentToken(reasons, argv, cwd) {
 	return createHash("sha256").update(JSON.stringify([
@@ -304,7 +304,10 @@ function document(commands) {
 		commands
 	};
 }
-/** `<command> --help --json`: the `cli-commands-v1` document with that command only. */
+/**
+* `<command> --help --json`: the `cli-commands-v1` document with that command
+* only.
+*/
 function leafDocument(path, entry, leaf) {
 	return document([leafJson(path, entry, leaf)]);
 }
@@ -402,8 +405,8 @@ function lined(text) {
 	return text === "" || text.endsWith("\n") ? text : `${text}\n`;
 }
 /**
-* The step that answers an `input_required` error without its own `next`:
-* the same command line with each missing flag or positional filled by a
+* The step that answers an `input_required` error without its own `next`: the
+* same command line with each missing flag or positional filled by a
 * placeholder the caller replaces.
 */
 function missingInputNext(argv, error) {
@@ -675,7 +678,7 @@ async function run(argv, options) {
 		if (result.streamed === true) return done(result.code);
 		if (format === "github" || format === "sarif") {
 			const findings = result.findings ?? [];
-			writeOut(format === "github" ? githubAnnotations(findings) || "" : sarifLog(name, findings));
+			writeOut(format === "github" ? githubAnnotations(findings) : sarifLog(name, findings));
 			return done(result.code);
 		}
 		if (json) {

package/dist/{run-ticket-BpNi7BCi.d.ts → run-ticket-B2o2Kxz8.d.ts}

@@ -1,7 +1,10 @@
-import { $n as AuthorizationDetail, Rt as Instant, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
+import { Wt as Instant, ar as AuthorizationDetail, hr as Subject, ht as TokenVerifier, lr as Delegation, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
 //#region src/server/run-ticket.d.ts
-/** What started the run: a saved automation, a background job, or a caller's own request. */
+/**
+ * What started the run: a saved automation, a background job, or a caller's own
+ * request.
+ */
 type RunKind = "automation" | "job" | "caller";
 /** RFC 8693 `act`: the party running the work, with the chain of earlier actors. */
 type RunActClaim = {
@@ -9,7 +12,10 @@ type RunActClaim = {
   readonly kind?: string;
   readonly act?: RunActClaim;
 };
-/** The connector and tools a run may reach; carried for the adapter, never a grant. */
+/**
+ * The connector and tools a run may reach; carried for the adapter, never a
+ * grant.
+ */
 type RunBinding = {
   readonly connector?: string;
   readonly tools?: readonly string[];
@@ -18,7 +24,10 @@ type RunAutomation = {
   readonly id: string;
   readonly version: number | string;
 };
-/** The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and `authorization_details` is present. */
+/**
+ * The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and
+ * `authorization_details` is present.
+ */
 type RunTicket = {
   readonly v: 1;
   readonly iss: string;
@@ -34,13 +43,16 @@ type RunTicket = {
   /** Present exactly when `kind` is `automation`. */
   readonly automation?: RunAutomation;
   readonly tenant?: string;
-  /** The event that started the run, as JSON. Evaluation never reads it as a grant. */
+  /**
+   * The event that started the run, as JSON. Evaluation never reads it as a
+   * grant.
+   */
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
 };
 /**
- * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps.
- * A signing service passes only these to its signer.
+ * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
+ * signing service passes only these to its signer.
  */
 declare const RUN_TICKET_CLAIMS: readonly (keyof RunTicket)[];
 type RunTicketInput = {
@@ -49,7 +61,10 @@ type RunTicketInput = {
   readonly kind: RunKind;
   /** Becomes `act`; a nested `act` on the actor is kept as the chain. */
   readonly actor?: Actor;
-  /** The run's ceiling. Required: a ticket never carries the principal's full authority. */
+  /**
+   * The run's ceiling. Required: a ticket never carries the principal's full
+   * authority.
+   */
   readonly delegation: Delegation;
   readonly automation?: RunAutomation;
   readonly tenant?: string;
@@ -67,9 +82,9 @@ type RunTicketOptions = {
 };
 /** The live record of an automation, read on every use of its ticket. */
 type RunTicketAutomations = {
-  automation(id: string, options: {
+  automation: (id: string, options: {
     readonly tenant?: string;
-  }): {
+  }) => {
     readonly id: string;
     readonly version: number | string;
     readonly revoked?: boolean;
@@ -104,9 +119,9 @@ type RunPrincipal = Principal & {
   readonly runTicket: RunTicket;
 };
 /**
- * Validates untrusted run-ticket claims and returns a frozen copy with only
- * the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
- * a known claim, a missing delegation, or an `automation` that does not match
+ * Validates untrusted run-ticket claims and returns a frozen copy with only the
+ * v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in a
+ * known claim, a missing delegation, or an `automation` that does not match
  * `kind` rejects the whole ticket.
  */
 declare function parseRunTicket(claims: unknown): RunTicket | undefined;

package/dist/{run-ticket-B5d_63Ma.js → run-ticket-Dv7aF7Dk.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord, n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { a as isId } from "./expiry-D4_YKRKD.js";
-import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord, n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { a as isId } from "./expiry-6XByK0dm.js";
+import { o as epochSeconds, p as nowSeconds } from "./time-nR1JesoH.js";
 import { n as toWireDelegation, t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/server/run-ticket.ts
 const RUN_TICKET_TYP = "vnd.permdock.run+jwt";
 /**
-* Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps.
-* A signing service passes only these to its signer.
+* Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
+* signing service passes only these to its signer.
 */
 const RUN_TICKET_CLAIMS = Object.freeze([
 	"v",
@@ -155,9 +155,9 @@ function parseBody(record) {
 	});
 }
 /**
-* Validates untrusted run-ticket claims and returns a frozen copy with only
-* the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
-* a known claim, a missing delegation, or an `automation` that does not match
+* Validates untrusted run-ticket claims and returns a frozen copy with only the
+* v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in a
+* known claim, a missing delegation, or an `automation` that does not match
 * `kind` rejects the whole ticket.
 */
 function parseRunTicket(claims) {

package/dist/{runtime-Vif3_-zf.js → runtime-BGnrOkVH.js}

@@ -1,6 +1,9 @@
-import { l as scopedTenant, s as protectedView } from "./views-BB8E9dTP.js";
+import { l as scopedTenant, s as protectedView } from "./views-CD8wuL4Z.js";
 //#region src/svelte/protected.ts
-/** The instance for `tenant`, built once per store change rather than once per check. */
+/**
+* The instance for `tenant`, built once per store change rather than once per
+* check.
+*/
 function scopedFor(store, tenant, _generation) {
 	return scopedTenant(store.get(), tenant);
 }

package/dist/{saas-Az_Kz-4D.js → saas-DK4V-3Is.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as principal } from "./refs-CNJBiTFo.js";
-import { a as deny, n as role, r as allow } from "./role-builder-C1VJzvcr.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, b as memoryRelationSource, x as limits } from "./src-DLFrtrrC.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
-import { l as relation, n as anyone } from "./grantee-BrRANrpT.js";
-import { n as definePolicy } from "./policy-DaJy4nK4.js";
-import { s as quoteSqlLiteral } from "./sql-B96movIM.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-DArULThq.js";
+import { i as principal } from "./refs-C8BKxc_e.js";
+import { a as deny, n as role, r as allow } from "./role-builder-BK2-T6oD.js";
+import { C as memoryLimitStore, S as limits, j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
+import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
+import { r as definePolicy } from "./policy-CLQ8__GF.js";
+import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CYcHj_w7.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -107,6 +107,7 @@ const saasPolicy = definePolicy({
 const SAAS_EXPIRED_AT = 1e9;
 /**
 * Users, one hazard each:
+*
 * - alice: admin in acme, viewer in globex (different role per org)
 * - bob: member in acme (owns p1, p3, p4)
 * - carol: owner in acme
@@ -116,9 +117,11 @@ const SAAS_EXPIRED_AT = 1e9;
 * - mallory: no memberships at all
 * - gina: `lead` of team-a in acme
 * - hank: viewer in acme, `collaborator` on project p3 only
-* - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+* - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one
+*   instant
 * - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
-* - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+* - ivan: viewer in acme who holds the team role `lead` on the tenant membership
+*   (the wrong scope)
 *
 * Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
 * (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
@@ -391,7 +394,10 @@ const saasSeed = Object.freeze({
 		}
 	]
 });
-/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+/**
+* The seed's folder tree and shares as a `RelationSource`, for
+* `createPermDock({ relations })`.
+*/
 function saasRelations(seed = saasSeed) {
 	const edges = (relation) => seed.shares.filter((share) => share.relation === relation).map((share) => share.expiresAt === void 0 ? {
 		id: share.folder,
@@ -432,9 +438,9 @@ function saasMemberships(user, members = saasSeed.members) {
 /** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
 const saasCustomRoles = saasSeed.orgs.flatMap((org) => org.customRoles);
 /**
-* The principal for `user`, with the plans of the requested `tenant`'s org.
-* The tenant itself is passed to `createPermDock({ tenant })`, never trusted
-* from here.
+* The principal for `user`, with the plans of the requested `tenant`'s org. The
+* tenant itself is passed to `createPermDock({ tenant })`, never trusted from
+* here.
 */
 function saasPrincipal(user, tenant) {
 	const org = tenant === void 0 ? void 0 : saasOrg(tenant);
@@ -447,10 +453,10 @@ function saasPrincipal(user, tenant) {
 //#endregion
 //#region src/testing/saas/sql.ts
 /**
-* Postgres tables for the SaaS domain. Column names match the resource
-* fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
-* against them without a column map. RLS is enabled and forced on the row
-* tables; policies come from `permdock rls generate`.
+* Postgres tables for the SaaS domain. Column names match the resource fields
+* (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile against
+* them without a column map. RLS is enabled and forced on the row tables;
+* policies come from `permdock rls generate`.
 */
 const saasSchemaSql = `
 create table org (
@@ -507,7 +513,7 @@ create table folder_editor (
 function literal(value) {
 	if (value === null || value === void 0) return "null";
 	if (typeof value === "number") {
-		if (!Number.isFinite(value)) throw new Error("PermDock: non-finite number in fixture seed");
+		if (!Number.isFinite(value)) throw new TypeError("PermDock: non-finite number in fixture seed");
 		return String(value);
 	}
 	if (typeof value === "boolean") return value ? "true" : "false";
@@ -592,7 +598,7 @@ const SAAS_TOKEN_TTL_SECONDS = 3600;
 function base64url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
 }
 function encodeJson(value) {
 	return base64url(new TextEncoder().encode(JSON.stringify(value)));
@@ -640,9 +646,9 @@ function parseSegment(segment) {
 	}
 }
 /**
-* Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
-* and returns its `sub`, or `null`; never throws. Identity only: memberships
-* and plans come from the seed, never from the token.
+* Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`) and
+* returns its `sub`, or `null`; never throws. Identity only: memberships and
+* plans come from the seed, never from the token.
 */
 async function verifySaasToken(token, now) {
 	return (await verifySaasSession(token, now))?.sub ?? null;
@@ -677,7 +683,10 @@ async function verifySaasSession(token, at) {
 }
 //#endregion
 //#region src/testing/saas/scenarios.ts
-/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+/**
+* What the policy's `subject` receives: the principal, or a `Subject` carrying
+* the actor.
+*/
 function saasUser(scenario) {
 	const principal = saasPrincipal(scenario.user, scenario.tenant);
 	if (scenario.actor === void 0 && scenario.delegation === void 0) return principal;
@@ -713,7 +722,10 @@ function saasLimitStore(used = 0) {
 		}
 	};
 }
-/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+/**
+* The `createPermDock` options a scenario runs with: tenant, custom roles,
+* quota and folder tree.
+*/
 function saasScenarioOptions(scenario) {
 	return {
 		...scenario.tenant === void 0 ? {} : { tenant: scenario.tenant },
@@ -738,8 +750,9 @@ function saasFolder(id) {
 	return row;
 }
 /**
-* The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
-* A snapshot carries no graph, so every graph grant is server-only on a client.
+* The folder tree, decided with `createPermDock({ relations: saasRelations()
+* })`. A snapshot carries no graph, so every graph grant is server-only on a
+* client.
 */
 const saasFolderScenarios = Object.freeze([
 	{
@@ -803,8 +816,8 @@ const saasFolderScenarios = Object.freeze([
 	}
 ]);
 /**
-* Hand-written expectations. Never derive `expected` from the engine: the
-* list is the oracle every adapter, ORM and client suite runs against.
+* Hand-written expectations. Never derive `expected` from the engine: the list
+* is the oracle every adapter, ORM and client suite runs against.
 */
 const saasScenarios = Object.freeze([
 	{

package/dist/{scan-DSljDE1Y.js → scan-CRTj6fke.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-D-feE7BE.js");
+		const { runAdoptionScan } = await import("./adoption-scan-Ch07MdxN.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-B4v0Qrac.js → schema-BOJjqlWL.js}

@@ -1,5 +1,5 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 //#region src/catalog/schema.ts
 const name = {
 	type: "string",
@@ -234,6 +234,7 @@ const catalogSchema = freezeDeep({
 					},
 					renamedFrom: strings,
 					levels: strings,
+					orderedLevels: { const: true },
 					hostable: { const: true },
 					rowConditions: { type: "boolean" },
 					approvals: {

package/dist/{schema-gIcCx7zM.js → schema-BTsE1WRT.js}

@@ -1,6 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { l as packageRoot } from "./version-DMQ0dnN5.js";
+import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -97,9 +98,12 @@ function validatorFor(file) {
 	return compiled;
 }
 function describeErrors(errors) {
-	return (errors ?? []).slice(0, 5).map((error) => `  ${error.instancePath || "/"} ${error.message ?? ""}`).join("\n");
+	return (errors ?? []).slice(0, 5).map((error) => `  ${nonEmptyOr(error.instancePath, "/")} ${error.message ?? ""}`).join("\n");
 }
-/** Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema, and 3.3 against the pinned patch of 3.2. */
+/**
+* Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema,
+* and 3.3 against the pinned patch of 3.2.
+*/
 function validateOpenapi(document) {
 	const version = isRecord(document) ? document["openapi"] : void 0;
 	const match = typeof version === "string" ? /^3\.([123])\.\d+$/u.exec(version) : null;

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
-import { t as SqlQuery } from "../sql-CDEPCA0g.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-DH9DUDEM.js";
+import { t as SqlQuery } from "../sql-B80DFdpG.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dj2qF9VC.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,3 +1,3 @@
-import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-YNieBO1U.js";
-import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-BL9M_CA1.js";
+import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-DcyrPS-r.js";
 export { APP_DATA_EXTENSION, DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };