endpoint-permissions-kit 0.1.0 → 0.2.0

package/dist/esm/cli/child.js

@@ -2,407 +2,162 @@
 import { pathToFileURL } from "node:url";
 import { resolve } from "node:path";
 
-// src/constants.ts
-var METHODS = ["find", "update", "create", "remove"];
-var GENERAL_ROLE = "general";
-var GLOBAL_HOOK_OWNER = "*";
-var ALL_FIELDS = "*";
-var MODULE_SEPARATOR = ".";
-var PERMISSION_ID_SEPARATOR = "::";
-
-// src/state.ts
-function getOrCreateState() {
-  const stateKey = Symbol.for("endpoint-permissions-kit");
-  const stateHost = globalThis;
-  if (stateHost[stateKey] === undefined) {
-    stateHost[stateKey] = { roles: new Set([GENERAL_ROLE]), modules: new Map, snapshot: null };
-  }
-  return stateHost[stateKey];
-}
-
 // src/errors.ts
-function pkitError(code, message) {
-  return Object.assign(new Error(message), { name: "PkitError", code });
-}
-
-// src/resolve.ts
-var DIRECT_AUTHORIZATION = Object.freeze({ direct: true, grantedBy: Object.freeze([]) });
-var DISABLED_ACCESS = Object.freeze({ status: "disabled" });
-var UNASSIGNED_ACCESS = Object.freeze({ status: "unassigned" });
-function permissionIdOf(role, action, name) {
-  return [role, action, name].join(PERMISSION_ID_SEPARATOR);
-}
-function resolveAccess(nameEntry, permissionId, role, method, assigned) {
-  if (assigned.has(permissionId))
-    return resolveDirectAccess(nameEntry, role, method);
-  return resolveGrantedAccess(nameEntry, method, assigned);
-}
-function resolveDirectAccess(nameEntry, role, method) {
-  const definition = nameEntry.actions.get(role)?.[method];
-  if (!definition?.enabled)
-    return DISABLED_ACCESS;
-  return { status: "granted", properties: definition.properties, authorization: DIRECT_AUTHORIZATION };
-}
-function resolveGrantedAccess(nameEntry, method, assigned) {
-  const grantedBy = [];
-  const properties = new Set;
-  let reachable = false;
-  for (const [enablingId, grant] of nameEntry.grants) {
-    if (!assigned.has(enablingId))
-      continue;
-    reachable = true;
-    const definition = grant.actions[method];
-    if (!definition)
-      continue;
-    grantedBy.push(enablingId);
-    for (const field of definition.properties)
-      properties.add(field);
+var errors = {
+  create(code, message) {
+    return Object.assign(new Error(message), { name: "PkitError", code });
+  },
+  describe(value) {
+    try {
+      return String(value);
+    } catch {
+      return typeof value;
+    }
   }
-  if (grantedBy.length === 0)
-    return reachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
-  const authorization = Object.freeze({ direct: false, grantedBy: Object.freeze(grantedBy.sort()) });
-  return { status: "granted", properties: Object.freeze([...properties]), authorization };
-}
+};
+var errors_default = errors;
 
-// src/validators.ts
-function validateObject(value, failure) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw pkitError(failure.code, failure.message);
-  }
-}
-function validateStrings(value, rules) {
-  if (!Array.isArray(value))
-    throw pkitError(rules.code, rules.message);
-  for (const field of value) {
-    if (typeof field !== "string" || field.length < rules.minimumLength) {
-      throw pkitError(rules.code, rules.message);
+// src/constants.ts
+var constants = {
+  METHODS: Object.freeze(["find", "update", "create", "remove"]),
+  GENERAL_ROLE: "general",
+  GLOBAL_HOOK_OWNER: "*",
+  ALL_FIELDS: "*",
+  MODULE_SEPARATOR: ".",
+  PERMISSION_ID_SEPARATOR: "::"
+};
+var constants_default = constants;
+
+// src/identifiers.ts
+var identifiers = {
+  build(role, action, name) {
+    return `${role}${constants_default.PERMISSION_ID_SEPARATOR}${action}${constants_default.PERMISSION_ID_SEPARATOR}${name}`;
+  },
+  parse(value, code, subject) {
+    if (typeof value !== "string")
+      throw invalidIdentifier(value, code, subject);
+    const parts = value.split(constants_default.PERMISSION_ID_SEPARATOR);
+    const [role, action, name] = parts;
+    if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
+      throw invalidIdentifier(value, code, subject);
     }
-  }
-}
-function validateContextKey(key) {
-  if (key !== "roles")
-    throw pkitError("INVALID_DEFINITION", `unknown context key: "${String(key)}"`);
-}
-function validateOpenRegistry(state) {
-  if (state.snapshot)
-    throw pkitError("SEALED", "pkit.seal() was already called: no more registrations allowed");
-}
-function validateSnapshot(snapshot) {
-  if (snapshot === null) {
-    throw pkitError("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
-  }
-}
-function validateRole(role, roles, code) {
-  if (typeof role === "string" && roles.has(role))
-    return;
-  if (code === "ROLE_NOT_DECLARED") {
-    throw pkitError(code, `role "${String(role)}" is not declared. Available roles: ${[...roles].join(", ")}.
-` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
-  }
-  throw pkitError(code, `role "${String(role)}" is not declared`);
-}
-function validateRoleCatalog(roles, state) {
-  validateOpenRegistry(state);
-  if (state.modules.size) {
-    throw pkitError("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
-  }
-  validateStrings(roles, {
-    code: "INVALID_DEFINITION",
-    message: "roles must be an array of non-empty strings",
-    minimumLength: 1
-  });
-  if (roles.length === 0)
-    throw pkitError("INVALID_DEFINITION", "roles must declare at least one role");
-  for (const role of roles)
-    validateRoleSegment(role);
-}
+    const isValidRole = isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidName = isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidAction = action.split(constants_default.MODULE_SEPARATOR).every(isCleanSegment);
+    if (!isValidRole || !isValidName || !isValidAction)
+      throw invalidIdentifier(value, code, subject);
+    return { role, action, name };
+  },
+  checkRole(role) {
+    if (typeof role === "string" && isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid role: "${errors_default.describe(role)}" (non-empty string, no ":" or surrounding whitespace; "${constants_default.GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
+  },
+  checkModuleSegment(segment) {
+    if (typeof segment === "string" && isCleanSegment(segment) && !segment.includes(constants_default.MODULE_SEPARATOR))
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid module name: "${errors_default.describe(segment)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
+  },
+  checkName(name) {
+    if (typeof name === "string" && isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid permission name: "${errors_default.describe(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
+  }
+};
 function isCleanSegment(value) {
   return value.length > 0 && value.trim() === value && !value.includes(":");
 }
-function validateRoleSegment(role) {
-  if (typeof role === "string" && isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid role: "${String(role)}" (non-empty string, no ":" or surrounding whitespace; "${GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
-}
-function validateModuleName(moduleName) {
-  if (typeof moduleName === "string" && isCleanSegment(moduleName) && !moduleName.includes(MODULE_SEPARATOR))
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid module name: "${String(moduleName)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
-}
-function validatePermissionName(name) {
-  if (typeof name === "string" && isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid permission name: "${String(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
-}
-function parsePermissionId(value, failure) {
-  if (typeof value !== "string")
-    throw pkitError(failure.code, failure.message);
-  const parts = value.split(PERMISSION_ID_SEPARATOR);
-  const [role, action, name] = parts;
-  if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
-    throw pkitError(failure.code, failure.message);
-  }
-  const isValidRole = isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER;
-  const isValidName = isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER;
-  const isValidAction = action.split(MODULE_SEPARATOR).every(isCleanSegment);
-  if (!isValidRole || !isValidName || !isValidAction)
-    throw pkitError(failure.code, failure.message);
-  return { role, action, name };
-}
-function validateMethod(method, failure) {
-  if (METHODS.includes(method))
-    return;
-  throw pkitError(failure.code, `${failure.message}: method "${String(method)}" does not exist. Methods: ${METHODS.join(", ")}`);
-}
-function readActionDefinition(definition, permissionPath) {
-  validateObject(definition, { code: "INVALID_DEFINITION", message: `${permissionPath}: must be an object` });
-  if (typeof definition.enabled !== "boolean") {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
-  }
-  const { properties } = definition;
-  if (properties === ALL_FIELDS)
-    return Object.freeze({ enabled: definition.enabled, properties });
-  validateStrings(properties, {
-    code: "INVALID_DEFINITION",
-    message: `${permissionPath}: properties must be string[] or '*'`,
-    minimumLength: 1
-  });
-  if (properties.includes(ALL_FIELDS)) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: '${ALL_FIELDS}' is only allowed as the whole properties value`);
-  }
-  if (new Set(properties).size !== properties.length) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
-  }
-  return Object.freeze({ enabled: definition.enabled, properties: Object.freeze([...properties]) });
-}
-function readActionDefinitions(actions, permissionPath) {
-  validateObject(actions, { code: "INVALID_DEFINITION", message: `${permissionPath}: registerActions expects an object` });
-  const registeredActions = Object.create(null);
-  for (const [method, definition] of Object.entries(actions)) {
-    validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-    registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
-  }
-  return Object.freeze(registeredActions);
+function invalidIdentifier(value, code, subject) {
+  return errors_default.create(code, `${subject}: "${errors_default.describe(value)}" (format role::module::name)`);
 }
-function validateActions(actions, registration, state) {
-  const { action, name, role } = registration;
-  validateOpenRegistry(state);
-  validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  if (state.modules.get(action)?.names.get(name)?.actions.has(role)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has actions registered for role "${role}"`);
-  }
-  return readActionDefinitions(actions, `${action}::${name} [${role}]`);
-}
-function validateGrantActions(actions, registration, state) {
-  const { action, name, permissionId } = registration;
-  validateOpenRegistry(state);
-  const source = parsePermissionId(permissionId, {
-    code: "INVALID_DEFINITION",
-    message: `"${action}::${name}": invalid grantTo identifier: "${String(permissionId)}" (format role::module::name)`
-  });
-  validateRole(source.role, state.roles, "ROLE_NOT_DECLARED");
-  if (source.action === action && source.name === name) {
-    throw pkitError("INVALID_DEFINITION", `"${permissionId}" cannot grant to itself`);
-  }
-  if (state.modules.get(action)?.names.get(name)?.grants.has(permissionId)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has a grant for "${permissionId}"`);
-  }
-  const permissionPath = `${action}::${name} [grantTo ${permissionId}]`;
-  const registeredActions = readActionDefinitions(actions, permissionPath);
-  for (const [method, definition] of Object.entries(registeredActions)) {
-    if (definition.enabled !== true) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
-    }
-    if (definition.properties === ALL_FIELDS) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
-    }
-  }
-  return { source, actions: registeredActions };
-}
-function validateHook(hook, registration, state) {
-  const { action, name, role, method } = registration;
-  validateOpenRegistry(state);
-  if (role !== undefined && role !== GLOBAL_HOOK_OWNER)
-    validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  const permissionPath = name === undefined ? action : `${action}::${name}`;
-  validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-  if (typeof hook !== "function")
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
-}
-function declaresMethod(nameEntry, method) {
-  for (const actions of nameEntry.actions.values()) {
-    if (Object.hasOwn(actions, method))
-      return true;
-  }
-  return false;
-}
-function hasAccessPath(nameEntry, role, method) {
-  if (nameEntry.actions.get(role)?.[method])
-    return true;
-  for (const grant of nameEntry.grants.values()) {
-    if (grant.source.role === role && grant.actions[method])
-      return true;
-  }
-  return false;
-}
-function validateGrantReferences(permissionPath, nameEntry, modules) {
-  for (const [permissionId, grant] of nameEntry.grants) {
-    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
-    if (!sourceEntry?.actions.has(grant.source.role)) {
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
-    }
-    for (const method of Object.keys(grant.actions)) {
-      if (declaresMethod(nameEntry, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
-    }
-  }
-}
-function validateRoleHooks(permissionPath, nameEntry) {
-  for (const [hookRole, methodHooks] of nameEntry.hooks) {
-    if (hookRole === GLOBAL_HOOK_OWNER)
-      continue;
-    for (const method of methodHooks.keys()) {
-      if (hasAccessPath(nameEntry, hookRole, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
-    }
-  }
-}
-function validateSealedRegistry(modules) {
-  for (const [action, registeredModule] of modules) {
-    if (registeredModule.names.size === 0) {
-      throw pkitError("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
+var identifiers_default = identifiers;
+
+// src/state.ts
+var STATE_KEY = Symbol.for("endpoint-permissions-kit");
+var state = {
+  getOrCreate() {
+    const stateHost = globalThis;
+    if (stateHost[STATE_KEY] === undefined) {
+      stateHost[STATE_KEY] = { roles: new Set([constants_default.GENERAL_ROLE]), cropper: false, modules: new Map, snapshot: null };
     }
-    for (const [name, nameEntry] of registeredModule.names) {
-      const permissionPath = `${action}::${name}`;
-      if (nameEntry.actions.size === 0) {
-        throw pkitError("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
-      }
-      validateGrantReferences(permissionPath, nameEntry, modules);
-      validateRoleHooks(permissionPath, nameEntry);
+    return stateHost[STATE_KEY];
+  },
+  requireOpen(currentState) {
+    if (currentState.snapshot)
+      throw errors_default.create("SEALED", "pkit.seal() was already called: no more registrations allowed");
+  },
+  requireSnapshot(currentState) {
+    if (currentState.snapshot === null) {
+      throw errors_default.create("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
     }
+    return currentState.snapshot;
   }
-}
-function validateAssignments(permissions, role, assignable) {
-  validateStrings(permissions, { code: "INVALID_INPUT", message: "permissions must be an array of strings", minimumLength: 1 });
-  const assigned = new Set;
-  for (const permissionId of permissions) {
-    const reference = parsePermissionId(permissionId, {
-      code: "INVALID_INPUT",
-      message: `invalid permission identifier: "${permissionId}" (format role::module::name)`
-    });
-    if (reference.role !== role) {
-      throw pkitError("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
-    }
-    if (!assignable.has(permissionId)) {
-      throw pkitError("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
+};
+var state_default = state;
+
+// src/context.ts
+var context = Object.freeze({
+  set(key, value) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    state_default.requireOpen(currentState);
+    if (contextKey === "cropper") {
+      if (typeof value !== "boolean")
+        throw errors_default.create("INVALID_DEFINITION", "cropper must be a boolean");
+      currentState.cropper = value;
+      return;
     }
-    assigned.add(permissionId);
-  }
-  return assigned;
-}
-function validateIdentity(assignments, state) {
-  validateSnapshot(state.snapshot);
-  const { role, permissions } = assignments;
-  if (typeof role !== "string")
-    throw pkitError("INVALID_INPUT", "role is required");
-  validateRole(role, state.roles, "UNKNOWN_ROLE");
-  return { role, assigned: validateAssignments(permissions, role, state.snapshot.assignable) };
-}
-function trimSelection(select, properties) {
-  validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-  const selectedFields = [];
-  for (const field of select) {
-    if (properties.includes(field))
-      selectedFields.push(field);
+    currentState.roles = new Set(readRoleCatalog(value, currentState.modules.size));
+  },
+  get(key) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    return contextKey === "cropper" ? currentState.cropper : [...currentState.roles];
+  }
+});
+function checkKey(key) {
+  if (key === "roles" || key === "cropper")
+    return key;
+  throw errors_default.create("INVALID_DEFINITION", `unknown context key: "${errors_default.describe(key)}"`);
+}
+function readRoleCatalog(value, registeredModuleCount) {
+  if (registeredModuleCount > 0) {
+    throw errors_default.create("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
   }
-  return selectedFields;
-}
-function rejectForbiddenFields(data, properties, permissionPath) {
-  const forbiddenFields = [];
-  for (const field of Object.keys(data)) {
-    if (!properties.includes(field))
-      forbiddenFields.push(field);
-  }
-  if (forbiddenFields.length === 0)
-    return;
-  throw Object.assign(pkitError("PROPERTIES_NOT_ALLOWED", `fields not allowed in "${permissionPath}": ${forbiddenFields.join(", ")}`), { fields: forbiddenFields });
-}
-function validateRequest(input, state) {
-  validateSnapshot(state.snapshot);
-  const { action, name, method } = input;
-  validateMethod(method, { code: "INVALID_INPUT", message: "method is required" });
-  if (method !== "find" && Object.hasOwn(input, "select"))
-    throw pkitError("INVALID_INPUT", "select only applies to find");
-  if (typeof action !== "string" || typeof name !== "string")
-    throw pkitError("INVALID_INPUT", "action and name are required");
-  const { role, assigned } = validateIdentity(input, state);
-  const registeredModule = state.modules.get(action);
-  if (!registeredModule)
-    throw pkitError("UNKNOWN_ACTION", `module "${action}" is not registered`);
-  const nameEntry = registeredModule.names.get(name);
-  if (!nameEntry)
-    throw pkitError("UNKNOWN_PERMISSION", `permission "${action}::${name}" is not registered`);
-  const permissionId = permissionIdOf(role, action, name);
-  const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
-  if (access.status === "unassigned") {
-    throw pkitError("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
-  }
-  if (access.status === "disabled")
-    throw pkitError("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
-  const { data, context } = input;
-  if (context !== undefined)
-    validateObject(context, { code: "INVALID_INPUT", message: "context must be an object" });
-  const { properties, authorization } = access;
-  const permission = Object.freeze({ role, action, name, permissionId, method, enabled: true, properties, authorization });
-  const request = { registeredModule, nameEntry, permission, data, context };
-  if (method === "find") {
-    if (data !== undefined)
-      validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-    const { select } = input;
-    if (select === undefined)
-      return { ...request, result: properties };
-    if (properties === ALL_FIELDS) {
-      validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-      return { ...request, result: select };
+  if (!Array.isArray(value))
+    throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
+  for (const role of value) {
+    if (typeof role !== "string" || role.length === 0) {
+      throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
     }
-    return { ...request, result: trimSelection(select, properties) };
   }
-  validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-  if (properties !== ALL_FIELDS)
-    rejectForbiddenFields(data, properties, `${permissionId}.${method}`);
-  return { ...request, result: data };
-}
-
-// src/context.ts
-function setRoles(key, roles) {
-  validateContextKey(key);
-  const state = getOrCreateState();
-  validateRoleCatalog(roles, state);
-  state.roles = new Set(roles);
-}
-function getRoles(key) {
-  validateContextKey(key);
-  return [...getOrCreateState().roles];
+  const catalog = value;
+  if (catalog.length === 0)
+    throw errors_default.create("INVALID_DEFINITION", "roles must declare at least one role");
+  for (const role of catalog)
+    identifiers_default.checkRole(role);
+  return catalog;
 }
-var context = Object.freeze({ set: setRoles, get: getRoles });
+var context_default = context;
 
 // src/cli/protocol.ts
-var EXIT_CODE = { success: 0, failure: 1, usage: 2 };
-var CATALOG_MARKER = "__PKIT_CATALOG__";
-var CHILD_TIMEOUT_MS = 30000;
-var CHILD_MAX_BUFFER_BYTES = 1048576;
+var protocol = {
+  EXIT_CODE: { success: 0, failure: 1, usage: 2 },
+  CATALOG_MARKER: "__PKIT_CATALOG__",
+  CHILD_TIMEOUT_MS: 30000,
+  CHILD_MAX_BUFFER_BYTES: 1048576
+};
+var protocol_default = protocol;
 
 // src/cli/child.ts
 var configPath = process.argv[2];
 if (configPath === undefined) {
   console.error("usage: child <pkit.config.js>");
-  process.exit(EXIT_CODE.usage);
+  process.exit(protocol_default.EXIT_CODE.usage);
 }
 await import(pathToFileURL(resolve(configPath)).href);
 process.stdout.write(`
-${CATALOG_MARKER}${JSON.stringify({ roles: context.get("roles") })}
+${protocol_default.CATALOG_MARKER}${JSON.stringify({ roles: context_default.get("roles") })}
 `);
 
-//# debugId=57FFB67C3BA8C0FD64756E2164756E21
+//# debugId=E06FAADB234DDEA064756E2164756E21