@endora-commerce/cli 0.100.0

package/dist/rules/action-route-permissions.js

@@ -0,0 +1,556 @@
+/**
+ * CI check — a manifest action's `requiredPermission` is the code enforced on
+ * the route behind its own `targetRoute` (issue #232; Principle XVI item 2, "the
+ * code gating the target surface, so the palette never advertises a 403").
+ *
+ * `test/contract/admin_users/permission-inventory.test.ts` already sweeps two
+ * directions — every enforced code is grantable, every grantable code is
+ * enforced — and **both** of the defects that produced this check passed it,
+ * because both codes were real, declared and enforced somewhere:
+ *
+ *  - `settings`' `open-settings` action declared no `requiredPermission` at all
+ *    while `/api/v1/admin/settings` is `requireAdmin('settings:read')`, so ⌘K
+ *    offered the screen to every role and every role without the code collected
+ *    a guaranteed 403;
+ *  - `inventory`' `open-inventory` declared `catalog:write` while
+ *    `/api/v1/admin/inventory` is `requireAdmin('orders:read')` — wrong in both
+ *    directions at once, hiding the screen from operators who can open it and
+ *    offering it to some who cannot.
+ *
+ * Neither is visible to a sweep over the *set* of codes. The third direction —
+ * the code is the one enforced on **this action's** target — is what this check
+ * adds.
+ *
+ * ## What "agrees" means
+ *
+ * Permission codes are opaque: `hasPermission(userId, code)` compares strings
+ * (plus the `'*'` wildcard), so `catalog:write` does not imply `catalog:read`.
+ * The property is therefore **sufficiency**, not equality: *holding the declared
+ * code, and nothing else, must be enough to open the target screen.* For
+ * `requireAdmin('x')` that collapses to equality; for
+ * `requireAdminAny(['customers:read', 'customers:manage'])` — the one any-of
+ * gate in the tree — either member is sufficient and either is accepted.
+ *
+ * Sufficiency leaves one residue, deliberately: an action naming one member of
+ * an any-of gate is hidden from an operator holding only the other member. That
+ * is under-advertising, not a 403, and the manifest field is a single code, so
+ * the palette cannot express the alternative. The sidebar can (MR !736 gave
+ * `NavItem.requiredPermission` an any-of array for exactly this route); a
+ * manifest action cannot, and widening the contract for one route is not
+ * something this check should force.
+ *
+ * ## Which route is "the" route
+ *
+ * A `targetRoute` is an admin SPA path (`/inventory`), not an API path
+ * (`/api/v1/admin/inventory`), and nothing in the tree declares the link. The
+ * check reconstructs it as the **entry route**: the request the browser must be
+ * allowed to make for the screen to render at all. Resolution runs in levels,
+ * first non-empty level wins, and stops at the first level that answers:
+ *
+ *   1. **exact** — a registration at `/api/v1/admin` + the target;
+ *   2. **subtree** — the shallowest registrations under it, for a screen whose
+ *      data hangs off sub-resources (`/custom-fields` →
+ *      `/api/v1/admin/custom-fields/definitions`);
+ *   3. **module** — the shallowest registrations the owning module ships at all,
+ *      for a screen whose SPA placement is not its API path (`/settings/stripe`
+ *      is placed under Settings; its API is `/api/v1/admin/stripe/config`).
+ *
+ * An action targeting `/x/new` is a create form, so the parent path is resolved
+ * instead and the method class flips from GET to the write verbs: the gate that
+ * decides whether that form can be submitted is the POST's, not the list's.
+ *
+ * Where the shallowest candidates disagree on their gate, or where a selected
+ * gate is a `preHandler` the scanner cannot read, the action is reported
+ * `unresolvable` rather than compared against a guess. An entry route that gates
+ * on **no** code accepts any declaration: holding a code the route does not ask
+ * for still opens the screen, so it cannot produce a 403 — it can only
+ * under-advertise, and no shipped action does.
+ *
+ * What the check cannot settle is where the label promises a write and the
+ * screen opens on a read: one field cannot say both codes, and
+ * `ACTION_PERMISSION_DISAGREEMENTS` holds those three with the question that
+ * would retire each.
+ *
+ * ## The artefact this reads, and when it refuses to judge it
+ *
+ * The route half is source text, walked. The **manifest** half is imported, and
+ * a module that has become a workspace package resolves through its own
+ * `exports` map at its build output (D-164) — so an action edited in
+ * `packages/modules/<id>/src/manifest.ts` and not rebuilt is not the action
+ * this check sees. Measured three consecutive times on
+ * `specs/091-module-owned-admin-surfaces/`'s admin drain, most sharply on
+ * !1203, where a `requiredPermission` changed from `payu:read` to `payu:write`
+ * reported `findings=3 violations=0` and exit 0 before
+ * `pnpm --filter @endora-commerce/mod-payu run build`, and `findings=4
+ * violations=1` and exit 1 after it. So a run whose manifest artefact is older
+ * than the source it was emitted from **exits 2** and names the package: the
+ * tree is not in violation, this run could not see it. See
+ * `scripts/lib/emitted-freshness.ts`, where the derivation lives, and the
+ * `emitted-manifests` token on the `read:` line, which is how a clean run says
+ * which artefact it read.
+ *
+ * Usage: `tsx scripts/check-action-route-permissions.ts [--list]`
+ * Exit 0 = every action's declared code is the one its target enforces (or the
+ * disagreement is ledgered); exit 1 = at least one is not, or a ledger entry is
+ * stale; exit 2 = the scan read no route or no action, or the manifest artefact
+ * it read has been outrun by its source — a green would have meant "not
+ * looking" (issue #113).
+ *
+ * ## One analysis, two hosts
+ *
+ * This file is the analysis (`specs/101-endora-check/contracts/package-scope-layout.md`
+ * §6). `backend/scripts/check-action-route-permissions.ts` hosts it over this
+ * repository's module walk roots, its overlay root and its emitted manifests,
+ * and holds `ACTION_PERMISSION_DISAGREEMENTS` — a ledger of *this* tree's owner
+ * decisions, which is why the ledger is an argument rather than a value this
+ * file reads.
+ *
+ * `endora check`'s host lands with Phase 3 and its estate entry says why, with
+ * the measurement: half this estate writes a permission code as a module-level
+ * constant, the reader that follows one is `admin_roles`' `ConstantResolver`,
+ * and no module package can reach it. Without it 27 gates in 11 of the 70
+ * module packages read as `unreadable` — findings about correct code, which
+ * §5.1 refuses.
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import ts from 'typescript';
+import { moduleIdOf as segmentModuleIdOf, NO_HOST_RESIDENT_MODULES, } from '../lib/module-population.js';
+/** Every admin API path starts here; nothing else is an admin surface. */
+const ADMIN_API_PREFIX = '/api/v1/admin';
+/** The Fastify shorthand methods a route registration can be written as. */
+const ROUTE_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete']);
+/** The verbs a create form submits through — the write half of a surface. */
+const WRITE_METHODS = new Set(['post', 'put', 'patch', 'delete']);
+/** The guard family whose argument is a permission code. */
+const GUARD_NAMES = new Set(['requireAdmin', 'requireAdminAny']);
+// ---------------------------------------------------------------------------
+// Route extraction
+// ---------------------------------------------------------------------------
+/** The trailing identifier of a callee: `deps.requireAdmin` → `requireAdmin`. */
+function tailName(node) {
+    if (ts.isIdentifier(node))
+        return node.text;
+    if (ts.isPropertyAccessExpression(node))
+        return node.name.text;
+    if (ts.isAsExpression(node) ||
+        ts.isNonNullExpression(node) ||
+        ts.isParenthesizedExpression(node)) {
+        return tailName(node.expression);
+    }
+    return null;
+}
+/** The string a node denotes, through casts. Template literals are handled apart. */
+function stringLiteralOf(node) {
+    if (ts.isStringLiteralLike(node) && !ts.isTemplateExpression(node))
+        return node.text;
+    if (ts.isAsExpression(node) ||
+        ts.isNonNullExpression(node) ||
+        ts.isParenthesizedExpression(node)) {
+        return stringLiteralOf(node.expression);
+    }
+    return null;
+}
+/** Every `const x = <initialiser>` in a file, by name — the local scope this reads. */
+function localBindings(sf) {
+    const bindings = new Map();
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+            // First writer wins: a name re-bound in an inner scope is the exception,
+            // and taking the outer one keeps the answer stable across files.
+            if (!bindings.has(node.name.text))
+                bindings.set(node.name.text, node.initializer);
+        }
+        node.forEachChild(visit);
+    };
+    sf.forEachChild(visit);
+    return bindings;
+}
+/**
+ * The path a route registration's first argument denotes.
+ *
+ * Two spellings appear: a plain literal, and a template whose head is a
+ * module-local `const base = '/api/v1/admin/<module>'` (`newsletter`,
+ * `transactional_emails`). A span that cannot be resolved yields `null` — the
+ * registration is then not attributed to any target, and the run says how many
+ * such there were rather than quietly shrinking the population.
+ */
+function routePathOf(node, bindings) {
+    const literal = stringLiteralOf(node);
+    if (literal !== null)
+        return literal;
+    if (ts.isTemplateExpression(node)) {
+        let out = node.head.text;
+        for (const span of node.templateSpans) {
+            const name = ts.isIdentifier(span.expression) ? span.expression.text : null;
+            const bound = name === null ? undefined : bindings.get(name);
+            const value = bound === undefined ? null : stringLiteralOf(bound);
+            if (value === null)
+                return null;
+            out += value + span.literal.text;
+        }
+        return out;
+    }
+    return null;
+}
+/** The permission codes a guard call requires, as one clause, or `null`. */
+function clauseOfGuardCall(call, file, input) {
+    const [argument] = call.arguments;
+    if (argument === undefined)
+        return []; // `requireAdmin()` — any authenticated admin.
+    const absolute = input.absolutePathOf?.(file) ?? file;
+    const lookup = input.lookupConstant ?? (() => null);
+    const codeOf = (node) => {
+        const literal = stringLiteralOf(node);
+        if (literal !== null)
+            return literal;
+        if (ts.isIdentifier(node))
+            return lookup(absolute, node.text, null);
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
+            return lookup(absolute, node.expression.text, node.name.text);
+        }
+        return null;
+    };
+    if (ts.isArrayLiteralExpression(argument)) {
+        const codes = [];
+        for (const element of argument.elements) {
+            const code = ts.isSpreadElement(element) ? null : codeOf(element);
+            if (code === null)
+                return null;
+            codes.push(code);
+        }
+        return codes;
+    }
+    const code = codeOf(argument);
+    return code === null ? null : [code];
+}
+/**
+ * The gate a route's options argument installs.
+ *
+ * The shapes present in the tree, all of them resolved module-locally:
+ * `{ preHandler: requireAdmin('code') }` and its `deps.`/cradle receivers, the
+ * same through a `const guard = requireAdmin(CODE)` binding, an options object
+ * held in a `const read = { preHandler: … }` and passed bare or spread
+ * (`{ ...write, bodyLimit }`), and an array of pre-handlers.
+ */
+function gateOf(node, file, input, bindings, depth = 0) {
+    const text = node === undefined ? '' : node.getText().replace(/\s+/g, ' ').slice(0, 120);
+    if (node === undefined || depth > 4)
+        return { clauses: node === undefined ? [] : null, text };
+    // A handler, not an options object: the registration installs no gate.
+    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node))
+        return { clauses: [], text: '' };
+    if (ts.isIdentifier(node)) {
+        const bound = bindings.get(node.text);
+        return bound === undefined
+            ? { clauses: null, text }
+            : { ...gateOf(bound, file, input, bindings, depth + 1), text };
+    }
+    if (ts.isObjectLiteralExpression(node)) {
+        const clauses = [];
+        let unreadable = false;
+        let sawGateSlot = false;
+        for (const property of node.properties) {
+            if (ts.isSpreadAssignment(property)) {
+                const spread = gateOf(property.expression, file, input, bindings, depth + 1);
+                if (spread.clauses === null)
+                    unreadable = true;
+                else if (spread.clauses.length > 0) {
+                    sawGateSlot = true;
+                    clauses.push(...spread.clauses);
+                }
+                continue;
+            }
+            if (!ts.isPropertyAssignment(property) || property.name.getText() !== 'preHandler')
+                continue;
+            sawGateSlot = true;
+            const handlers = ts.isArrayLiteralExpression(property.initializer)
+                ? property.initializer.elements
+                : [property.initializer];
+            let recognised = false;
+            for (const handler of handlers) {
+                const clause = clauseOfPreHandler(handler, file, input, bindings, depth + 1);
+                if (clause === undefined)
+                    continue;
+                recognised = true;
+                if (clause === null)
+                    unreadable = true;
+                else if (clause.length > 0)
+                    clauses.push(clause);
+            }
+            if (!recognised)
+                unreadable = true;
+        }
+        if (unreadable)
+            return { clauses: null, text };
+        return { clauses: sawGateSlot ? clauses : [], text: sawGateSlot ? text : '' };
+    }
+    return { clauses: null, text };
+}
+/**
+ * One pre-handler's clause: `null` when it is a guard whose code cannot be read,
+ * `undefined` when it is not a permission guard at all (an ETag validator, a
+ * rate limiter — those gate nothing this check is about).
+ */
+function clauseOfPreHandler(node, file, input, bindings, depth) {
+    if (depth > 6)
+        return null;
+    // `deps.requireAdmin?.('blog.write') ?? (async () => {})` — the guard is the
+    // left operand and the fallback is a no-op the harness never takes. Reading
+    // the `??` as unreadable is what hid `blog`'s and `cms`'s gates from a first
+    // draft of this check.
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken) {
+        return clauseOfPreHandler(node.left, file, input, bindings, depth + 1);
+    }
+    if (ts.isCallExpression(node)) {
+        const callee = tailName(node.expression);
+        if (callee !== null && GUARD_NAMES.has(callee))
+            return clauseOfGuardCall(node, file, input);
+        return undefined;
+    }
+    if (ts.isIdentifier(node)) {
+        const bound = bindings.get(node.text);
+        return bound === undefined ? undefined : clauseOfPreHandler(bound, file, input, bindings, depth + 1);
+    }
+    if (ts.isObjectLiteralExpression(node) || ts.isArrayLiteralExpression(node))
+        return null;
+    return undefined;
+}
+/** Every `/api/v1/admin/**` route registration under `sources`, with its gate. */
+export function findAdminRoutes(input) {
+    const routes = [];
+    let unreadablePaths = 0;
+    for (const [file, text] of input.sources) {
+        if (!text.includes(ADMIN_API_PREFIX))
+            continue;
+        const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+        const bindings = localBindings(sf);
+        const moduleId = moduleIdOf(file, input.hostResidentModules);
+        const visit = (node) => {
+            if (ts.isCallExpression(node) &&
+                ts.isPropertyAccessExpression(node.expression) &&
+                ROUTE_METHODS.has(node.expression.name.text) &&
+                node.arguments.length >= 2) {
+                const [pathArgument, optionsArgument] = node.arguments;
+                if (pathArgument !== undefined) {
+                    const looksLikePath = ts.isStringLiteralLike(pathArgument) || ts.isTemplateExpression(pathArgument);
+                    const path = looksLikePath ? routePathOf(pathArgument, bindings) : null;
+                    if (looksLikePath && path === null && pathArgument.getText().includes(ADMIN_API_PREFIX)) {
+                        unreadablePaths += 1;
+                    }
+                    if (path !== null && path.startsWith(ADMIN_API_PREFIX)) {
+                        const gate = gateOf(optionsArgument, file, input, bindings);
+                        routes.push({
+                            file,
+                            line: sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1,
+                            method: node.expression.name.text,
+                            path,
+                            moduleId,
+                            clauses: gate.clauses,
+                            gateText: gate.text,
+                        });
+                    }
+                }
+            }
+            node.forEachChild(visit);
+        };
+        sf.forEachChild(visit);
+    }
+    routes.sort((a, b) => (a.path === b.path ? a.method.localeCompare(b.method) : a.path.localeCompare(b.path)));
+    return { routes, unreadablePaths };
+}
+/**
+ * The module a source key belongs to, or `null` outside every module tree.
+ *
+ * The two anchored answers are the application's, on keys relative to its own
+ * `src/`. The third is `lib/module-population.ts`' segment reader, which is what
+ * attributes a module that has become a workspace package — its key is
+ * repository-relative and starts with neither `modules` nor `apps` (feature
+ * 080, T040a).
+ */
+export function moduleIdOf(file, hostResident = NO_HOST_RESIDENT_MODULES) {
+    const segments = file.split('/');
+    if (segments[0] === 'modules')
+        return segments[1] ?? null;
+    // `apps/<deployment>/modules/<id>/…` — an overlay module is an ordinary
+    // lifecycle participant and owns its actions the same way (feature 057).
+    if (segments[0] === 'apps' && segments[2] === 'modules')
+        return segments[3] ?? null;
+    return segmentModuleIdOf(file, hostResident);
+}
+const depthOf = (path) => path.split('/').length;
+function shallowest(routes) {
+    if (routes.length === 0)
+        return routes;
+    const min = Math.min(...routes.map((route) => depthOf(route.path)));
+    return routes.filter((route) => depthOf(route.path) === min);
+}
+/**
+ * The entry route for an action's target, or `null` when no registration
+ * corresponds to it at all — which is a defect of its own: a palette entry must
+ * point at a real surface.
+ */
+export function resolveTarget(action, routes) {
+    const creating = action.targetRoute.endsWith('/new');
+    const path = creating ? action.targetRoute.slice(0, -'/new'.length) : action.targetRoute;
+    const wanted = (route) => creating ? WRITE_METHODS.has(route.method) : route.method === 'get';
+    const base = ADMIN_API_PREFIX + path;
+    const exact = routes.filter((route) => route.path === base && wanted(route));
+    if (exact.length > 0)
+        return { level: 'exact', routes: shallowest(exact) };
+    const subtree = routes.filter((route) => route.path.startsWith(`${base}/`) && wanted(route));
+    if (subtree.length > 0)
+        return { level: 'subtree', routes: shallowest(subtree) };
+    const owned = routes.filter((route) => route.moduleId === action.moduleId && wanted(route));
+    if (owned.length > 0)
+        return { level: 'module', routes: shallowest(closestTo(path, owned)) };
+    return null;
+}
+/**
+ * The module-level candidates whose path names most of the target's segments.
+ *
+ * At this level the SPA path and the API path have already been established not
+ * to correspond, so "shallowest" alone picks by accident: `/platform/modules`
+ * would compare against `/api/v1/admin/api-interceptors` as readily as against
+ * `/api/v1/admin/modules`, and the two carry different gates. Ranking by shared
+ * segment names first keeps the comparison against the route the screen is
+ * actually named after, and leaves the ambiguity report for the case where
+ * nothing distinguishes the candidates.
+ */
+function closestTo(target, routes) {
+    const wanted = new Set(target.split('/').filter((segment) => segment.length > 0));
+    const score = (route) => route.path
+        .slice(ADMIN_API_PREFIX.length)
+        .split('/')
+        .filter((segment) => wanted.has(segment)).length;
+    const best = Math.max(...routes.map(score));
+    return routes.filter((route) => score(route) === best);
+}
+/** Whether holding `code` alone passes a gate. Membership in every clause. */
+export function isSufficient(code, clauses) {
+    return clauses.every((clause) => clause.includes(code));
+}
+/** A gate's clauses as a stable string, so two candidates can be compared. */
+function gateKey(clauses) {
+    return clauses === null ? '<unreadable>' : JSON.stringify(clauses.map((c) => [...c].sort()));
+}
+/** `<moduleId>:<actionId>` — the ledger key, and the identity of a finding. */
+export function keyOf(finding) {
+    return `${finding.moduleId}:${finding.actionId}`;
+}
+/**
+ * A route's permission clauses, rendered for a message. Exported because the
+ * sentence is part of the rule: an author outside this checkout reads the same
+ * one this repository's run prints.
+ */
+export function renderClauses(clauses) {
+    if (clauses.length === 0)
+        return '(no code — any authenticated admin)';
+    return clauses.map((clause) => (clause.length === 1 ? clause[0] : `any of [${clause.join(', ')}]`)).join(' and ');
+}
+/** Every action whose declared code is not the one its target enforces. */
+export function findDisagreements(input) {
+    const findings = [];
+    for (const action of input.actions) {
+        const base = {
+            moduleId: action.moduleId,
+            actionId: action.actionId,
+            targetRoute: action.targetRoute,
+            declared: action.requiredPermission ?? null,
+        };
+        const resolved = resolveTarget(action, input.routes);
+        if (resolved === null) {
+            findings.push({
+                ...base,
+                kind: 'unresolvable',
+                enforced: '(no registration)',
+                where: `no /api/v1/admin route corresponds to ${action.targetRoute}, and ${action.moduleId} registers none`,
+            });
+            continue;
+        }
+        const keys = new Set(resolved.routes.map((route) => gateKey(route.clauses)));
+        const [first] = resolved.routes;
+        if (first === undefined)
+            continue;
+        if (keys.size > 1) {
+            findings.push({
+                ...base,
+                kind: 'unresolvable',
+                enforced: '(ambiguous)',
+                where: `the ${resolved.level}-level candidates for ${action.targetRoute} disagree: ` +
+                    resolved.routes
+                        .map((route) => `${route.method.toUpperCase()} ${route.path} → ${renderClauses(route.clauses ?? [])}`)
+                        .join('; '),
+            });
+            continue;
+        }
+        if (first.clauses === null) {
+            findings.push({
+                ...base,
+                kind: 'unresolvable',
+                enforced: '(unreadable gate)',
+                where: `${first.file}:${first.line} — preHandler \`${first.gateText}\` could not be read`,
+            });
+            continue;
+        }
+        const clauses = first.clauses;
+        const where = `${first.method.toUpperCase()} ${first.path} (${first.file}:${first.line}, ${resolved.level})`;
+        if (action.requiredPermission === undefined) {
+            if (clauses.length === 0)
+                continue; // Ungated surface, undeclared action — agreed.
+            findings.push({ ...base, kind: 'missing', enforced: renderClauses(clauses), where });
+            continue;
+        }
+        if (!isSufficient(action.requiredPermission, clauses)) {
+            findings.push({ ...base, kind: 'mismatched', enforced: renderClauses(clauses), where });
+        }
+    }
+    return findings.sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
+}
+export function checkActionRoutePermissions(input, ledger) {
+    const findings = findDisagreements(input);
+    const keys = new Set(findings.map(keyOf));
+    return {
+        findings,
+        violations: findings.filter((finding) => ledger[keyOf(finding)] === undefined),
+        ledgered: findings.filter((finding) => ledger[keyOf(finding)] !== undefined),
+        stale: Object.keys(ledger).filter((key) => !keys.has(key)),
+    };
+}
+/**
+ * The whole analysis, source text in and findings out — the entry a real run
+ * takes and the one a red proof has to take with it (issue #130). A fixture
+ * handed a ready-made `AdminRoute[]` would prove the comparison and skip the
+ * route reading the comparison rests on, which is where every gate shape lives.
+ */
+export function analyse(input, ledger) {
+    const scan = findAdminRoutes(input);
+    return { ...checkActionRoutePermissions({ actions: input.actions, routes: scan.routes }, ledger), scan };
+}
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+/**
+ * Every TypeScript source under `dir`, with the rule's own prunes applied.
+ *
+ * Exported because the population is part of the rule: two hosts computing
+ * "which files this check reads" two ways is the shape that lets one of them go
+ * half-blind.
+ */
+export function collectRouteSources(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory()) {
+            if (name === 'node_modules' || name === 'dist')
+                continue;
+            collectRouteSources(full, out);
+        }
+        else if (name.endsWith('.ts') && !name.endsWith('.test.ts') && !name.endsWith('.d.ts')) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=action-route-permissions.js.map

package/dist/rules/action-route-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-route-permissions.js","sourceRoot":"","sources":["../../src/rules/action-route-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EACL,UAAU,IAAI,iBAAiB,EAC/B,wBAAwB,GAEzB,MAAM,6BAA6B,CAAC;AAGrC,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzE,6EAA6E;AAC7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,4DAA4D;AAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AA6DjE,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,iFAAiF;AACjF,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC5C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/D,IACE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC;QACvB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAClC,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACrF,IACE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC;QACvB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAClC,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,EAAiB;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrF,yEAAyE;YACzE,iEAAiE;YACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAmB,EAAE,QAA4C;IACpF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CACxB,IAAuB,EACvB,IAAY,EACZ,KAAqB;IAErB,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,CAAC,8CAA8C;IACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACtD,MAAM,MAAM,GAAmB,KAAK,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAiB,EAAE;QACpD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACrC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAC,IAAyB,EAAE,IAAY,EAAE,KAAqB,EAAE,QAA4C,EAAE,KAAK,GAAG,CAAC;IACrI,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAE9F,uEAAuE;IACvE,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAEhG,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;YACzB,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7E,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;oBAAE,UAAU,GAAG,IAAI,CAAC;qBAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,WAAW,GAAG,IAAI,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,YAAY;gBAAE,SAAS;YAC7F,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAChE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ;gBAC/B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3B,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7E,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,UAAU,GAAG,IAAI,CAAC;gBAClB,IAAI,MAAM,KAAK,IAAI;oBAAE,UAAU,GAAG,IAAI,CAAC;qBAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,UAAU,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,IAAI,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAmB,EACnB,IAAY,EACZ,KAAqB,EACrB,QAA4C,EAC5C,KAAa;IAEb,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,uBAAuB;IACvB,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;QACnG,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAE7D,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBACzB,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC9C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAC1B,CAAC;gBACD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,aAAa,GACjB,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;oBAChF,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACxE,IAAI,aAAa,IAAI,IAAI,KAAK,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACxF,eAAe,IAAI,CAAC,CAAC;oBACvB,CAAC;oBACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;wBAC5D,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI;4BACJ,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;4BAClE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI;4BACjC,IAAI;4BACJ,QAAQ;4BACR,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;yBACpB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,eAAoC,wBAAwB;IAE5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1D,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACpF,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC/C,CAAC;AAeD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAEjE,SAAS,UAAU,CAAC,MAA6B;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAoB,EACpB,MAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAW,EAAE,CAC5C,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC;IACtE,MAAM,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAE3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;IAE7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,MAA6B;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAU,EAAE,CAC1C,KAAK,CAAC,IAAI;SACP,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAuC;IAChF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,OAAoB;IACnC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAqBD,+EAA+E;AAC/E,MAAM,UAAU,KAAK,CAAC,OAA+C;IACnE,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qCAAqC,CAAC;IACvE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpH,CAAC;AAOD,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,kBAAkB,IAAI,IAAI;SAC5C,CAAC;QACF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,mBAAmB;gBAC7B,KAAK,EAAE,yCAAyC,MAAM,CAAC,WAAW,SAAS,MAAM,CAAC,QAAQ,iBAAiB;aAC5G,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,aAAa;gBACvB,KAAK,EACH,OAAO,QAAQ,CAAC,KAAK,yBAAyB,MAAM,CAAC,WAAW,aAAa;oBAC7E,QAAQ,CAAC,MAAM;yBACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;yBACrG,IAAI,CAAC,IAAI,CAAC;aAChB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,mBAAmB;gBAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,mBAAmB,KAAK,CAAC,QAAQ,sBAAsB;aAC1F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC;QAC7G,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,+CAA+C;YACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAUD,MAAM,UAAU,2BAA2B,CACzC,KAAsB,EACtB,MAAwC;IAExC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAC9E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAC5E,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CACrB,KAAoB,EACpB,MAAwC;IAExC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,EAAE,GAAG,2BAA2B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAED,8EAA8E;AAC9E,MAAM;AACN,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAgB,EAAE;IACjE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS;YACzD,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rules/bundle-pairing.d.ts

@@ -0,0 +1,74 @@
+/** The log prefix both hosts print under — one grammar, one spelling. */
+export declare const PREFIX = "[bundle-pairing]";
+export type BundlePairingFindingKind = 'missing-language-bundle' | 'empty-bundle' | 'unparseable-bundle' | 'undeclared-bundle-dir';
+/** One registered module, as the generated index and its manifest describe it. */
+export interface ModuleUnderCheck {
+    readonly moduleId: string;
+    /** The module's own directory — `dirname(manifestPath)`, absolute. */
+    readonly directory: string;
+    /** `i18n.bundlesDir` from the manifest, or `null` when it declares none. */
+    readonly bundlesDir: string | null;
+}
+/**
+ * The filesystem, injected.
+ *
+ * Not for the red proofs — those build a fixture module tree on disk and use the
+ * real one, because a fixture that hands in a reader proves the classifier and
+ * leaves the walk that feeds it unproven. It exists so a caller measuring a tree
+ * it does not own can supply its own reader without this file learning about it.
+ */
+export interface BundlePairingFs {
+    readonly isDirectory: (path: string) => boolean;
+    readonly isFile: (path: string) => boolean;
+    readonly readFile: (path: string) => string;
+}
+export declare const nodeBundlePairingFs: BundlePairingFs;
+export interface BundlePairingInput {
+    readonly modules: readonly ModuleUnderCheck[];
+    /** The platform's shipped languages — `SUPPORTED_LANGUAGES` in a real run. */
+    readonly languages: readonly string[];
+    readonly fs?: BundlePairingFs;
+}
+export interface BundlePairingFinding {
+    readonly kind: BundlePairingFindingKind;
+    readonly moduleId: string;
+    /** The language it is about, or `null` where the finding is about the module. */
+    readonly language: string | null;
+    /** The file or directory it names, absolute. */
+    readonly path: string;
+    /** The sentence the author reads, without the shared remedy. */
+    readonly detail: string;
+}
+export interface BundlePairingResult {
+    readonly findings: readonly BundlePairingFinding[];
+    /** Every bundle file opened — the read line's `files`. */
+    readonly filesRead: readonly string[];
+    /** Every module classified — the read line's `sites`. */
+    readonly classified: readonly string[];
+    /** Modules shipping at least one bundle: the ones the predicate binds. */
+    readonly shipping: readonly string[];
+    /** Modules shipping none: exempt by § 1's conditional, and reported clean. */
+    readonly shippingNothing: readonly string[];
+    /**
+     * How many shipped languages the walk actually probed for — `0` when no module
+     * shipped anything at all, which is the vacuous state § 4's fourth condition
+     * refuses. It is deliberately *not* "languages a bundle was found in": every
+     * module dropping `pl` is a run of findings, not a run that read nothing.
+     */
+    readonly languagesProbed: number;
+}
+/** The directory names the manifests themselves declare — never a literal. */
+export declare function declaredBundleDirectories(modules: readonly ModuleUnderCheck[]): readonly string[];
+/**
+ * The findings, over the modules and languages handed in.
+ *
+ * Pure but for the injected reader, so a red proof enters where a real run
+ * enters: a module tree on disk plus the index's own answer about which modules
+ * exist (issue #130). A fixture handing in a per-module classification would
+ * prove the reporter and leave the classifier — which is all of the analysis —
+ * unproven.
+ */
+export declare function checkBundlePairing(input: BundlePairingInput): BundlePairingResult;
+/** The remedy paragraph, one per finding kind. */
+export declare const REMEDIES: Readonly<Record<BundlePairingFindingKind, string>>;
+//# sourceMappingURL=bundle-pairing.d.ts.map