endpoint-permissions-kit 0.1.0 → 0.2.0

package/dist/esm/cli/generate.js

@@ -6,375 +6,70 @@ import { fileURLToPath } from "node:url";
 import { parseArgs, promisify } from "node:util";
 
 // src/cli/protocol.ts
-var EXIT_CODE = { success: 0, failure: 1, usage: 2 };
-var CATALOG_MARKER = "__PKIT_CATALOG__";
-var CHILD_TIMEOUT_MS = 30000;
-var CHILD_MAX_BUFFER_BYTES = 1048576;
-
-// src/constants.ts
-var METHODS = ["find", "update", "create", "remove"];
-var GENERAL_ROLE = "general";
-var GLOBAL_HOOK_OWNER = "*";
-var ALL_FIELDS = "*";
-var MODULE_SEPARATOR = ".";
-var PERMISSION_ID_SEPARATOR = "::";
-
-// src/errors.ts
-function pkitError(code, message) {
-  return Object.assign(new Error(message), { name: "PkitError", code });
-}
-
-// src/resolve.ts
-var DIRECT_AUTHORIZATION = Object.freeze({ direct: true, grantedBy: Object.freeze([]) });
-var DISABLED_ACCESS = Object.freeze({ status: "disabled" });
-var UNASSIGNED_ACCESS = Object.freeze({ status: "unassigned" });
-function permissionIdOf(role, action, name) {
-  return [role, action, name].join(PERMISSION_ID_SEPARATOR);
-}
-function resolveAccess(nameEntry, permissionId, role, method, assigned) {
-  if (assigned.has(permissionId))
-    return resolveDirectAccess(nameEntry, role, method);
-  return resolveGrantedAccess(nameEntry, method, assigned);
-}
-function resolveDirectAccess(nameEntry, role, method) {
-  const definition = nameEntry.actions.get(role)?.[method];
-  if (!definition?.enabled)
-    return DISABLED_ACCESS;
-  return { status: "granted", properties: definition.properties, authorization: DIRECT_AUTHORIZATION };
-}
-function resolveGrantedAccess(nameEntry, method, assigned) {
-  const grantedBy = [];
-  const properties = new Set;
-  let reachable = false;
-  for (const [enablingId, grant] of nameEntry.grants) {
-    if (!assigned.has(enablingId))
-      continue;
-    reachable = true;
-    const definition = grant.actions[method];
-    if (!definition)
-      continue;
-    grantedBy.push(enablingId);
-    for (const field of definition.properties)
-      properties.add(field);
-  }
-  if (grantedBy.length === 0)
-    return reachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
-  const authorization = Object.freeze({ direct: false, grantedBy: Object.freeze(grantedBy.sort()) });
-  return { status: "granted", properties: Object.freeze([...properties]), authorization };
-}
+var protocol = {
+  EXIT_CODE: { success: 0, failure: 1, usage: 2 },
+  CATALOG_MARKER: "__PKIT_CATALOG__",
+  CHILD_TIMEOUT_MS: 30000,
+  CHILD_MAX_BUFFER_BYTES: 1048576
+};
+var protocol_default = protocol;
 
-// src/validators.ts
-function validateObject(value, failure) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw pkitError(failure.code, failure.message);
-  }
-}
-function validateStrings(value, rules) {
-  if (!Array.isArray(value))
-    throw pkitError(rules.code, rules.message);
-  for (const field of value) {
-    if (typeof field !== "string" || field.length < rules.minimumLength) {
-      throw pkitError(rules.code, rules.message);
-    }
-  }
-}
-function validateContextKey(key) {
-  if (key !== "roles")
-    throw pkitError("INVALID_DEFINITION", `unknown context key: "${String(key)}"`);
-}
-function validateOpenRegistry(state) {
-  if (state.snapshot)
-    throw pkitError("SEALED", "pkit.seal() was already called: no more registrations allowed");
-}
-function validateSnapshot(snapshot) {
-  if (snapshot === null) {
-    throw pkitError("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
-  }
-}
-function validateRole(role, roles, code) {
-  if (typeof role === "string" && roles.has(role))
-    return;
-  if (code === "ROLE_NOT_DECLARED") {
-    throw pkitError(code, `role "${String(role)}" is not declared. Available roles: ${[...roles].join(", ")}.
-` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
-  }
-  throw pkitError(code, `role "${String(role)}" is not declared`);
-}
-function validateRoleCatalog(roles, state) {
-  validateOpenRegistry(state);
-  if (state.modules.size) {
-    throw pkitError("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
-  }
-  validateStrings(roles, {
-    code: "INVALID_DEFINITION",
-    message: "roles must be an array of non-empty strings",
-    minimumLength: 1
-  });
-  if (roles.length === 0)
-    throw pkitError("INVALID_DEFINITION", "roles must declare at least one role");
-  for (const role of roles)
-    validateRoleSegment(role);
-}
-function isCleanSegment(value) {
-  return value.length > 0 && value.trim() === value && !value.includes(":");
-}
-function validateRoleSegment(role) {
-  if (typeof role === "string" && isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid role: "${String(role)}" (non-empty string, no ":" or surrounding whitespace; "${GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
-}
-function validateModuleName(moduleName) {
-  if (typeof moduleName === "string" && isCleanSegment(moduleName) && !moduleName.includes(MODULE_SEPARATOR))
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid module name: "${String(moduleName)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
-}
-function validatePermissionName(name) {
-  if (typeof name === "string" && isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid permission name: "${String(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
-}
-function parsePermissionId(value, failure) {
-  if (typeof value !== "string")
-    throw pkitError(failure.code, failure.message);
-  const parts = value.split(PERMISSION_ID_SEPARATOR);
-  const [role, action, name] = parts;
-  if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
-    throw pkitError(failure.code, failure.message);
-  }
-  const isValidRole = isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER;
-  const isValidName = isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER;
-  const isValidAction = action.split(MODULE_SEPARATOR).every(isCleanSegment);
-  if (!isValidRole || !isValidName || !isValidAction)
-    throw pkitError(failure.code, failure.message);
-  return { role, action, name };
-}
-function validateMethod(method, failure) {
-  if (METHODS.includes(method))
-    return;
-  throw pkitError(failure.code, `${failure.message}: method "${String(method)}" does not exist. Methods: ${METHODS.join(", ")}`);
-}
-function readActionDefinition(definition, permissionPath) {
-  validateObject(definition, { code: "INVALID_DEFINITION", message: `${permissionPath}: must be an object` });
-  if (typeof definition.enabled !== "boolean") {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
-  }
-  const { properties } = definition;
-  if (properties === ALL_FIELDS)
-    return Object.freeze({ enabled: definition.enabled, properties });
-  validateStrings(properties, {
-    code: "INVALID_DEFINITION",
-    message: `${permissionPath}: properties must be string[] or '*'`,
-    minimumLength: 1
-  });
-  if (properties.includes(ALL_FIELDS)) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: '${ALL_FIELDS}' is only allowed as the whole properties value`);
-  }
-  if (new Set(properties).size !== properties.length) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
-  }
-  return Object.freeze({ enabled: definition.enabled, properties: Object.freeze([...properties]) });
-}
-function readActionDefinitions(actions, permissionPath) {
-  validateObject(actions, { code: "INVALID_DEFINITION", message: `${permissionPath}: registerActions expects an object` });
-  const registeredActions = Object.create(null);
-  for (const [method, definition] of Object.entries(actions)) {
-    validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-    registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
-  }
-  return Object.freeze(registeredActions);
-}
-function validateActions(actions, registration, state) {
-  const { action, name, role } = registration;
-  validateOpenRegistry(state);
-  validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  if (state.modules.get(action)?.names.get(name)?.actions.has(role)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has actions registered for role "${role}"`);
-  }
-  return readActionDefinitions(actions, `${action}::${name} [${role}]`);
-}
-function validateGrantActions(actions, registration, state) {
-  const { action, name, permissionId } = registration;
-  validateOpenRegistry(state);
-  const source = parsePermissionId(permissionId, {
-    code: "INVALID_DEFINITION",
-    message: `"${action}::${name}": invalid grantTo identifier: "${String(permissionId)}" (format role::module::name)`
-  });
-  validateRole(source.role, state.roles, "ROLE_NOT_DECLARED");
-  if (source.action === action && source.name === name) {
-    throw pkitError("INVALID_DEFINITION", `"${permissionId}" cannot grant to itself`);
-  }
-  if (state.modules.get(action)?.names.get(name)?.grants.has(permissionId)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has a grant for "${permissionId}"`);
-  }
-  const permissionPath = `${action}::${name} [grantTo ${permissionId}]`;
-  const registeredActions = readActionDefinitions(actions, permissionPath);
-  for (const [method, definition] of Object.entries(registeredActions)) {
-    if (definition.enabled !== true) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
-    }
-    if (definition.properties === ALL_FIELDS) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
-    }
-  }
-  return { source, actions: registeredActions };
-}
-function validateHook(hook, registration, state) {
-  const { action, name, role, method } = registration;
-  validateOpenRegistry(state);
-  if (role !== undefined && role !== GLOBAL_HOOK_OWNER)
-    validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  const permissionPath = name === undefined ? action : `${action}::${name}`;
-  validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-  if (typeof hook !== "function")
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
-}
-function declaresMethod(nameEntry, method) {
-  for (const actions of nameEntry.actions.values()) {
-    if (Object.hasOwn(actions, method))
-      return true;
-  }
-  return false;
-}
-function hasAccessPath(nameEntry, role, method) {
-  if (nameEntry.actions.get(role)?.[method])
-    return true;
-  for (const grant of nameEntry.grants.values()) {
-    if (grant.source.role === role && grant.actions[method])
-      return true;
-  }
-  return false;
-}
-function validateGrantReferences(permissionPath, nameEntry, modules) {
-  for (const [permissionId, grant] of nameEntry.grants) {
-    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
-    if (!sourceEntry?.actions.has(grant.source.role)) {
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
-    }
-    for (const method of Object.keys(grant.actions)) {
-      if (declaresMethod(nameEntry, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
-    }
-  }
-}
-function validateRoleHooks(permissionPath, nameEntry) {
-  for (const [hookRole, methodHooks] of nameEntry.hooks) {
-    if (hookRole === GLOBAL_HOOK_OWNER)
-      continue;
-    for (const method of methodHooks.keys()) {
-      if (hasAccessPath(nameEntry, hookRole, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
-    }
-  }
-}
-function validateSealedRegistry(modules) {
-  for (const [action, registeredModule] of modules) {
-    if (registeredModule.names.size === 0) {
-      throw pkitError("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
+// src/cli/generate.ts
+var generator = {
+  async generate(options) {
+    const { content, ...generationResult } = await loadRoleDeclaration(options);
+    writeFileSync(generationResult.outPath, content);
+    return generationResult;
+  },
+  async checkGenerated(options) {
+    const { content, ...generationResult } = await loadRoleDeclaration(options);
+    const isStale = !existsSync(generationResult.outPath) || readFileSync(generationResult.outPath, "utf8") !== content;
+    return { ...generationResult, isStale };
+  },
+  async main(commandArguments) {
+    const request = readRequest(commandArguments);
+    if (request === null) {
+      console.error("usage: pkit generate [--config pkit.config.js] [--out pkit.generated.d.ts] [--check]");
+      process.exitCode = protocol_default.EXIT_CODE.usage;
+      return;
     }
-    for (const [name, nameEntry] of registeredModule.names) {
-      const permissionPath = `${action}::${name}`;
-      if (nameEntry.actions.size === 0) {
-        throw pkitError("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
+    try {
+      const { options } = request;
+      if (request.isCheck) {
+        const checkResult = await generator.checkGenerated(options);
+        console.log(checkResult.isStale ? `pkit: ${checkResult.outPath} is stale, run pkit generate` : `pkit: ${checkResult.outPath} is up to date`);
+        process.exitCode = checkResult.isStale ? protocol_default.EXIT_CODE.failure : protocol_default.EXIT_CODE.success;
+        return;
       }
-      validateGrantReferences(permissionPath, nameEntry, modules);
-      validateRoleHooks(permissionPath, nameEntry);
+      const generationResult = await generator.generate(options);
+      console.log(`pkit: ${generationResult.roles.length} roles written to ${generationResult.outPath}`);
+      process.exitCode = protocol_default.EXIT_CODE.success;
+    } catch (cause) {
+      console.error(`pkit: ${cause instanceof Error ? cause.message : String(cause)}`);
+      process.exitCode = protocol_default.EXIT_CODE.failure;
     }
   }
-}
-function validateAssignments(permissions, role, assignable) {
-  validateStrings(permissions, { code: "INVALID_INPUT", message: "permissions must be an array of strings", minimumLength: 1 });
-  const assigned = new Set;
-  for (const permissionId of permissions) {
-    const reference = parsePermissionId(permissionId, {
-      code: "INVALID_INPUT",
-      message: `invalid permission identifier: "${permissionId}" (format role::module::name)`
+};
+function readRequest(commandArguments) {
+  try {
+    const { positionals, values } = parseArgs({
+      args: [...commandArguments],
+      allowPositionals: true,
+      options: { config: { type: "string" }, out: { type: "string" }, check: { type: "boolean" } }
     });
-    if (reference.role !== role) {
-      throw pkitError("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
-    }
-    if (!assignable.has(permissionId)) {
-      throw pkitError("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
-    }
-    assigned.add(permissionId);
-  }
-  return assigned;
-}
-function validateIdentity(assignments, state) {
-  validateSnapshot(state.snapshot);
-  const { role, permissions } = assignments;
-  if (typeof role !== "string")
-    throw pkitError("INVALID_INPUT", "role is required");
-  validateRole(role, state.roles, "UNKNOWN_ROLE");
-  return { role, assigned: validateAssignments(permissions, role, state.snapshot.assignable) };
-}
-function trimSelection(select, properties) {
-  validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-  const selectedFields = [];
-  for (const field of select) {
-    if (properties.includes(field))
-      selectedFields.push(field);
+    if (positionals[0] !== "generate" || positionals.length !== 1)
+      return null;
+    return { options: { cwd: process.cwd(), config: values.config, out: values.out }, isCheck: values.check === true };
+  } catch {
+    return null;
   }
-  return selectedFields;
 }
-function rejectForbiddenFields(data, properties, permissionPath) {
-  const forbiddenFields = [];
-  for (const field of Object.keys(data)) {
-    if (!properties.includes(field))
-      forbiddenFields.push(field);
-  }
-  if (forbiddenFields.length === 0)
-    return;
-  throw Object.assign(pkitError("PROPERTIES_NOT_ALLOWED", `fields not allowed in "${permissionPath}": ${forbiddenFields.join(", ")}`), { fields: forbiddenFields });
-}
-function validateRequest(input, state) {
-  validateSnapshot(state.snapshot);
-  const { action, name, method } = input;
-  validateMethod(method, { code: "INVALID_INPUT", message: "method is required" });
-  if (method !== "find" && Object.hasOwn(input, "select"))
-    throw pkitError("INVALID_INPUT", "select only applies to find");
-  if (typeof action !== "string" || typeof name !== "string")
-    throw pkitError("INVALID_INPUT", "action and name are required");
-  const { role, assigned } = validateIdentity(input, state);
-  const registeredModule = state.modules.get(action);
-  if (!registeredModule)
-    throw pkitError("UNKNOWN_ACTION", `module "${action}" is not registered`);
-  const nameEntry = registeredModule.names.get(name);
-  if (!nameEntry)
-    throw pkitError("UNKNOWN_PERMISSION", `permission "${action}::${name}" is not registered`);
-  const permissionId = permissionIdOf(role, action, name);
-  const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
-  if (access.status === "unassigned") {
-    throw pkitError("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
-  }
-  if (access.status === "disabled")
-    throw pkitError("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
-  const { data, context } = input;
-  if (context !== undefined)
-    validateObject(context, { code: "INVALID_INPUT", message: "context must be an object" });
-  const { properties, authorization } = access;
-  const permission = Object.freeze({ role, action, name, permissionId, method, enabled: true, properties, authorization });
-  const request = { registeredModule, nameEntry, permission, data, context };
-  if (method === "find") {
-    if (data !== undefined)
-      validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-    const { select } = input;
-    if (select === undefined)
-      return { ...request, result: properties };
-    if (properties === ALL_FIELDS) {
-      validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-      return { ...request, result: select };
-    }
-    return { ...request, result: trimSelection(select, properties) };
-  }
-  validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-  if (properties !== ALL_FIELDS)
-    rejectForbiddenFields(data, properties, `${permissionId}.${method}`);
-  return { ...request, result: data };
+async function loadRoleDeclaration(options) {
+  const configPath = resolveConfigPath(options.cwd, options.config);
+  const roles = await readRoleCatalog(configPath, options.cwd);
+  const outPath = resolve(options.cwd, options.out === undefined ? "pkit.generated.d.ts" : options.out);
+  return { configPath, outPath, roles, content: renderRoleDeclarations(roles) };
 }
-
-// src/cli/generate.ts
 function resolveConfigPath(workingDirectory, config) {
   if (config !== undefined)
     return resolve(workingDirectory, config);
@@ -394,24 +89,33 @@ async function readRoleCatalog(configPath, workingDirectory) {
     childArguments.unshift("--experimental-strip-types");
   const { stdout } = await promisify(execFile)(process.execPath, childArguments, {
     cwd: workingDirectory,
-    timeout: CHILD_TIMEOUT_MS,
+    timeout: protocol_default.CHILD_TIMEOUT_MS,
     killSignal: "SIGKILL",
-    maxBuffer: CHILD_MAX_BUFFER_BYTES
+    maxBuffer: protocol_default.CHILD_MAX_BUFFER_BYTES
   });
   for (const outputLine of stdout.split(`
 `)) {
-    if (!outputLine.startsWith(CATALOG_MARKER))
-      continue;
-    const catalog = JSON.parse(outputLine.slice(CATALOG_MARKER.length));
-    validateStrings(catalog.roles, {
-      code: "INVALID_DEFINITION",
-      message: "child process returned an invalid role catalog",
-      minimumLength: 1
-    });
-    return catalog.roles;
+    if (outputLine.startsWith(protocol_default.CATALOG_MARKER))
+      return parseRoleCatalog(outputLine.slice(protocol_default.CATALOG_MARKER.length));
   }
   throw new Error("child process did not return the role catalog");
 }
+function parseRoleCatalog(payload) {
+  let catalog = null;
+  try {
+    catalog = JSON.parse(payload);
+  } catch {
+    throw new Error("child process returned a malformed role catalog");
+  }
+  const roles = catalog !== null && typeof catalog === "object" ? catalog.roles : undefined;
+  if (!Array.isArray(roles))
+    throw new Error("child process returned an invalid role catalog");
+  for (const role of roles) {
+    if (typeof role !== "string" || role.length === 0)
+      throw new Error("child process returned an invalid role catalog");
+  }
+  return roles;
+}
 function renderRoleDeclarations(roles) {
   const declarations = [
     "import 'endpoint-permissions-kit/types';",
@@ -425,55 +129,9 @@ function renderRoleDeclarations(roles) {
   return declarations.join(`
 `);
 }
-async function loadRoleDeclaration(options) {
-  const { cwd: workingDirectory, config, out } = options;
-  const configPath = resolveConfigPath(workingDirectory, config);
-  const roles = await readRoleCatalog(configPath, workingDirectory);
-  const outPath = out === undefined ? resolve(workingDirectory, "pkit.generated.d.ts") : resolve(workingDirectory, out);
-  return { configPath, outPath, roles, content: renderRoleDeclarations(roles) };
-}
-async function generate(options) {
-  const { content, ...generationResult } = await loadRoleDeclaration(options);
-  writeFileSync(generationResult.outPath, content);
-  return generationResult;
-}
-async function checkGenerated(options) {
-  const { content, ...generationResult } = await loadRoleDeclaration(options);
-  if (!existsSync(generationResult.outPath))
-    return { ...generationResult, isStale: true };
-  return { ...generationResult, isStale: readFileSync(generationResult.outPath, "utf8") !== content };
-}
-async function main(commandArguments) {
-  try {
-    const { positionals, values } = parseArgs({
-      args: [...commandArguments],
-      allowPositionals: true,
-      options: { config: { type: "string" }, out: { type: "string" }, check: { type: "boolean" } }
-    });
-    if (positionals[0] !== "generate" || positionals.length !== 1) {
-      console.error("usage: pkit generate [--config pkit.config.js] [--out pkit.generated.d.ts] [--check]");
-      process.exitCode = EXIT_CODE.usage;
-      return;
-    }
-    const options = { cwd: process.cwd(), config: values.config, out: values.out };
-    if (values.check) {
-      const checkResult = await checkGenerated(options);
-      console.log(checkResult.isStale ? `pkit: ${checkResult.outPath} is stale, run pkit generate` : `pkit: ${checkResult.outPath} is up to date`);
-      process.exitCode = checkResult.isStale ? EXIT_CODE.failure : EXIT_CODE.success;
-      return;
-    }
-    const generationResult = await generate(options);
-    console.log(`pkit: ${generationResult.roles.length} roles written to ${generationResult.outPath}`);
-    process.exitCode = EXIT_CODE.success;
-  } catch (cause) {
-    console.error(`pkit: ${cause instanceof Error ? cause.message : String(cause)}`);
-    process.exitCode = EXIT_CODE.failure;
-  }
-}
+var generate_default = generator;
 export {
-  checkGenerated,
-  generate,
-  main
+  generate_default as default
 };
 
-//# debugId=32F0EF205A005A3364756E2164756E21
+//# debugId=1516241B0551E2F164756E2164756E21