permdock 0.0.0 → 0.2.0

package/dist/collect-DDDv_ESs.js

@@ -0,0 +1,502 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { i as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { i as rel, r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
+import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { Visitor, parseSync, visitorKeys } from "oxc-parser";
+//#region src/cli/scan.ts
+/** oxc reports recoverable problems as `Warning` or `Advice`; only `Error` leaves the program incomplete. */
+const PARSE_ERRORS = /* @__PURE__ */ new Set(["Error"]);
+const CHECK_CALLS = /* @__PURE__ */ new Set([
+	"can",
+	"decide",
+	"assert",
+	"filter",
+	"where",
+	"simulate",
+	"actions",
+	"usePermission",
+	"getPermission",
+	"protect",
+	"allow",
+	"deny",
+	"registerTool",
+	"anyone",
+	"authenticated",
+	"relation",
+	"plan",
+	"actor",
+	"assurance",
+	"inherit"
+]);
+function scanSources(cwd, files, knownKeys) {
+	const roots = /* @__PURE__ */ new Set(["permissions"]);
+	const definitionFiles = {};
+	const usages = {};
+	const unknown = [];
+	const dynamic = [];
+	const roleNames = /* @__PURE__ */ new Set();
+	const planNames = /* @__PURE__ */ new Set();
+	const allowKeys = /* @__PURE__ */ new Set();
+	const snapshots = [];
+	const unparsed = [];
+	const parsed = [];
+	for (const file of files) {
+		const source = readFileSync(file, "utf8");
+		const fileRel = rel(cwd, file);
+		try {
+			const result = parseSync(file, source);
+			const error = result.errors.find((item) => PARSE_ERRORS.has(item.severity));
+			if (error !== void 0) unparsed.push({
+				file: fileRel,
+				line: lineIndex(source)(error.labels[0]?.start ?? 0),
+				message: error.message
+			});
+			parsed.push({
+				file,
+				source,
+				program: result.program
+			});
+		} catch (error) {
+			unparsed.push({
+				file: fileRel,
+				line: 1,
+				message: describeError(error)
+			});
+		}
+	}
+	const definitions = /* @__PURE__ */ new Set(["permissions"]);
+	for (const { program } of parsed) walk(program, (node) => {
+		if (node.type === "VariableDeclarator" && node.id?.type === "Identifier" && node.id.name !== void 0 && isDefinePermissions(node.init)) definitions.add(node.id.name);
+	});
+	for (const { file, source, program } of parsed) {
+		const fileRel = rel(cwd, file);
+		const lineAt = lineIndex(source);
+		const scopes = /* @__PURE__ */ new WeakMap();
+		walk(program, (node, parent, ancestors) => {
+			const isRoot = (name) => boundToRoot(name, ancestors, definitions, scopes);
+			if (node.type === "CallExpression") {
+				recordCall(node, parent, lineAt, fileRel, roots, definitionFiles, usages, unknown, dynamic, roleNames, planNames, allowKeys, knownKeys);
+				const callee = calleeName(node.callee);
+				if (callee === "snapshot" || callee === "snapshotFor") snapshots.push({
+					file: fileRel,
+					line: lineAt(node.start ?? 0),
+					include: includeOf(node.arguments?.[callee === "snapshot" ? 0 : 2], isRoot)
+				});
+			}
+			if (node.type === "MemberExpression" && parent?.type !== "MemberExpression") recordMember(node, parent, lineAt, fileRel, isRoot, usages, unknown, dynamic, allowKeys, knownKeys);
+			if (node.type === "ImportDeclaration") recordImport(node, roots, definitions);
+		});
+	}
+	return {
+		roots: [...roots].toSorted(),
+		definitionFiles,
+		usages,
+		unknown,
+		dynamic,
+		roleNames: [...roleNames].toSorted(),
+		planNames: [...planNames].toSorted(),
+		allowKeys: [...allowKeys].toSorted(),
+		snapshots,
+		unparsed
+	};
+}
+function includeOf(options, isRoot) {
+	if (options?.type !== "ObjectExpression") return options === void 0 ? void 0 : null;
+	const property = options.properties?.find((item) => item.key?.name === "include");
+	if (property === void 0) return options.properties?.some((item) => item.type === "SpreadElement") ? null : void 0;
+	const list = property.value;
+	if (list?.type !== "ArrayExpression") return null;
+	const keys = [];
+	for (const element of list.elements ?? []) {
+		const [root, ...rest] = (element?.type === "MemberExpression" ? memberPath(element) : void 0) ?? [];
+		if (root === void 0 || !isRoot(root) || rest.length === 0) return null;
+		keys.push(rest.join("."));
+	}
+	return keys;
+}
+function recordImport(node, roots, definitions) {
+	for (const spec of node.specifiers ?? []) {
+		const local = spec.local?.name;
+		if (local !== void 0 && importsRoot(spec, definitions)) roots.add(local);
+	}
+}
+function isDefinePermissions(node) {
+	return node?.type === "CallExpression" && calleeName(node.callee) === "definePermissions";
+}
+/** An import binding of a permission tree: by its imported name, or a default import named `permissions`. */
+function importsRoot(spec, definitions) {
+	if (spec.type === "ImportSpecifier") {
+		const value = spec.imported?.value;
+		const imported = typeof value === "string" ? value : spec.imported?.name;
+		return imported !== void 0 && definitions.has(imported);
+	}
+	return spec.type === "ImportDefaultSpecifier" && spec.local?.name === "permissions";
+}
+function patternNames(pattern, into) {
+	if (pattern === null || pattern === void 0) return;
+	const type = pattern.type;
+	if (type === "Identifier" && pattern.name !== void 0) into.push(pattern.name);
+	else if (type === "ObjectPattern") for (const property of pattern.properties ?? []) {
+		const value = property.value;
+		patternNames(property.type === "RestElement" ? property.argument : value, into);
+	}
+	else if (type === "ArrayPattern") for (const element of pattern.elements ?? []) patternNames(element, into);
+	else patternNames(pattern.left ?? pattern.argument ?? pattern.parameter, into);
+}
+const NAMED_DECLARATIONS = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"ClassDeclaration",
+	"TSEnumDeclaration"
+]);
+function declareStatement(statement, bindings, definitions) {
+	const type = statement.type;
+	if (type === "VariableDeclaration") for (const declarator of statement.declarations ?? []) {
+		const names = [];
+		patternNames(declarator.id, names);
+		const root = declarator.id?.type === "Identifier" && isDefinePermissions(declarator.init);
+		for (const name of names) bindings.set(name, root);
+	}
+	else if (NAMED_DECLARATIONS.has(type)) {
+		if (statement.id?.name !== void 0) bindings.set(statement.id.name, false);
+	} else if (type === "ExportNamedDeclaration" || type === "ExportDefaultDeclaration") {
+		const declaration = statement.declaration;
+		if (declaration !== void 0 && declaration !== null) declareStatement(declaration, bindings, definitions);
+	} else if (type === "ImportDeclaration") {
+		for (const spec of statement.specifiers ?? []) if (spec.local?.name !== void 0) bindings.set(spec.local.name, importsRoot(spec, definitions));
+	}
+}
+function isNodeList(value) {
+	return Array.isArray(value);
+}
+const BLOCK_SCOPES = /* @__PURE__ */ new Set([
+	"Program",
+	"BlockStatement",
+	"StaticBlock"
+]);
+const FUNCTION_SCOPES = /* @__PURE__ */ new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression"
+]);
+/** The names a scope node declares, each with whether it is a permission tree; `undefined` for a node that opens no scope. */
+function bindingsOf(node, definitions) {
+	const bindings = /* @__PURE__ */ new Map();
+	const type = node.type;
+	const declare = (statements) => {
+		for (const statement of isNodeList(statements) ? statements : []) declareStatement(statement, bindings, definitions);
+	};
+	const names = [];
+	if (BLOCK_SCOPES.has(type)) declare(node.body);
+	else if (FUNCTION_SCOPES.has(type)) {
+		for (const param of node.params ?? []) patternNames(param, names);
+		if (type === "FunctionExpression") patternNames(node.id, names);
+	} else if (type === "ForStatement") declare(node.init === null || node.init === void 0 ? [] : [node.init]);
+	else if (type === "ForInStatement" || type === "ForOfStatement") declare(node.left === void 0 ? [] : [node.left]);
+	else if (type === "CatchClause") patternNames(node.param, names);
+	else if (type === "SwitchStatement") for (const branch of node.cases ?? []) declare(branch.consequent);
+	else return;
+	for (const name of names) bindings.set(name, false);
+	return bindings;
+}
+/**
+* Whether `name`, read inside `ancestors`, is bound to a permission tree: the
+* innermost scope that declares it decides. A name no scope declares keeps
+* matching by name, as a global or generated reference does.
+*/
+function boundToRoot(name, ancestors, definitions, cache) {
+	for (const scope of ancestors.toReversed()) {
+		let bindings = cache.get(scope);
+		if (bindings === void 0) {
+			const found = bindingsOf(scope, definitions);
+			if (found === void 0) continue;
+			bindings = found;
+			cache.set(scope, bindings);
+		}
+		const bound = bindings.get(name);
+		if (bound !== void 0) return bound;
+	}
+	return definitions.has(name);
+}
+function recordCall(node, parent, lineAt, fileRel, roots, definitionFiles, usages, unknown, dynamic, roleNames, planNames, _allowKeys, knownKeys) {
+	const callee = calleeName(node.callee);
+	const line = lineAt(node.start ?? 0);
+	if (callee === "definePermissions" || callee === "defineRoles" || callee === "definePlans") {
+		const name = declaredName(parent);
+		if (name !== void 0) {
+			if (callee === "definePermissions") roots.add(name);
+			definitionFiles[name] = fileRel;
+		}
+		if (callee === "defineRoles") collectObjectKeys(node.arguments?.[0], roleNames);
+		if (callee === "definePlans") collectObjectKeys(node.arguments?.[0], planNames);
+		return;
+	}
+	if (callee === "role") {
+		const first = node.arguments?.[0];
+		if (typeof first?.value === "string") roleNames.add(first.value);
+		else if (first?.type === "MemberExpression" && typeof first.property?.name === "string") roleNames.add(first.property.name);
+		return;
+	}
+	if (callee === "findPermission") {
+		const second = node.arguments?.[1];
+		if (typeof second?.value === "string") {
+			pushUsage(second.value, {
+				file: fileRel,
+				line,
+				call: "findPermission"
+			}, knownKeys, usages, unknown);
+			return;
+		}
+		dynamic.push({
+			file: fileRel,
+			line,
+			call: "findPermission"
+		});
+	}
+}
+function recordMember(node, parent, lineAt, fileRel, isRoot, usages, unknown, dynamic, allowKeys, knownKeys) {
+	if (node.computed === true) {
+		const root = rootName(node);
+		if (root !== void 0 && isRoot(root)) dynamic.push({
+			file: fileRel,
+			line: lineAt(node.start ?? 0),
+			call: callName(parent)
+		});
+		return;
+	}
+	const path = memberPath(node);
+	if (path === void 0 || path.length < 2) return;
+	const [root, ...rest] = path;
+	if (root === void 0 || !isRoot(root)) return;
+	const key = rest.join(".");
+	if (!knownKeys.has(key) && isFieldOrSubtree(rest, knownKeys)) return;
+	const call = callName(parent);
+	const usage = {
+		file: fileRel,
+		line: lineAt(node.start ?? 0),
+		call
+	};
+	if (call === "allow") allowKeys.add(key);
+	pushUsage(key, usage, knownKeys, usages, unknown);
+}
+const LEAF_FIELDS = /* @__PURE__ */ new Set([
+	"key",
+	"resource",
+	"action",
+	"scope",
+	"meta"
+]);
+function isFieldOrSubtree(path, knownKeys) {
+	const last = path.at(-1);
+	if (last !== void 0 && LEAF_FIELDS.has(last) && knownKeys.has(path.slice(0, -1).join("."))) return true;
+	const prefix = `${path.join(".")}.`;
+	return [...knownKeys].some((known) => known.startsWith(prefix));
+}
+function pushUsage(key, usage, knownKeys, usages, unknown) {
+	if (knownKeys.size > 0 && !knownKeys.has(key)) {
+		unknown.push({
+			...usage,
+			call: `${usage.call}:${key}`
+		});
+		return;
+	}
+	const list = usages[key] ?? [];
+	list.push(usage);
+	usages[key] = list;
+}
+function calleeName(node) {
+	if (node === void 0) return;
+	if (node.type === "Identifier") return node.name;
+	if (node.type === "MemberExpression" && node.property?.type === "Identifier") return node.property.name;
+}
+function declaredName(parent) {
+	if (parent?.type === "VariableDeclarator" && parent.id?.type === "Identifier") return parent.id.name;
+}
+function callName(parent) {
+	if (parent?.type === "CallExpression") {
+		const name = calleeName(parent.callee);
+		if (name !== void 0 && CHECK_CALLS.has(name)) return name;
+	}
+	if (parent?.type === "Property" || parent?.type === "ObjectProperty") return "tools";
+	return "reference";
+}
+function memberPath(node) {
+	const parts = [];
+	let current = node;
+	while (current?.type === "MemberExpression") {
+		if (current.computed === true) return;
+		const name = current.property?.name;
+		if (name === void 0) return;
+		parts.unshift(name);
+		current = current.object;
+	}
+	if (current?.type !== "Identifier" || current.name === void 0) return;
+	parts.unshift(current.name);
+	return parts;
+}
+function rootName(node) {
+	let current = node;
+	while (current?.type === "MemberExpression") current = current.object;
+	return current?.type === "Identifier" ? current.name : void 0;
+}
+/** One pass over the file, then a binary search per node. */
+function lineIndex(source) {
+	const starts = [0];
+	for (let i = 0; i < source.length; i += 1) if (source.charCodeAt(i) === 10) starts.push(i + 1);
+	return (index) => {
+		let low = 0;
+		let high = starts.length - 1;
+		while (low < high) {
+			const mid = low + high + 1 >> 1;
+			if ((starts[mid] ?? 0) <= index) low = mid;
+			else high = mid - 1;
+		}
+		return low + 1;
+	};
+}
+function collectObjectKeys(node, into) {
+	if (node?.type !== "ObjectExpression" || node.properties === void 0) return;
+	for (const property of node.properties) {
+		const key = property.key;
+		if (property.computed !== true && typeof key?.name === "string") {
+			into.add(key.name);
+			continue;
+		}
+		if (typeof key?.value === "string") into.add(key.value);
+	}
+}
+/** Every node in source order, with its parent: Oxc nodes carry none, so enter and exit keep a stack. */
+function walk(program, visit) {
+	const stack = [];
+	const handlers = {};
+	for (const type of Object.keys(visitorKeys)) {
+		handlers[type] = (node) => {
+			visit(node, stack.at(-1), stack);
+			stack.push(node);
+		};
+		handlers[`${type}:exit`] = () => {
+			stack.pop();
+		};
+	}
+	new Visitor(handlers).visit(program);
+}
+//#endregion
+//#region src/cli/collect.ts
+async function runCollect(input) {
+	const load = { fresh: input.fresh === true };
+	const srcPath = input.collect.srcPath ?? input.config.collect?.srcPath ?? defaultSrcPath();
+	const outPath = catalogPath(input.config, input.cwd, input.collect.out);
+	const permissionsRel = input.config.permissions ?? guessPermissions(input.cwd, srcPath);
+	if (permissionsRel === void 0) return {
+		code: 2,
+		document: void 0,
+		scan: void 0,
+		outPath,
+		message: "usage: set permissions in permdock.config.ts or pass a definePermissions module"
+	};
+	const permissionsAbs = resolve(input.cwd, permissionsRel);
+	if (!existsSync(permissionsAbs)) return {
+		code: 2,
+		document: void 0,
+		scan: void 0,
+		outPath,
+		message: `PermDock CLI: permissions module not found: ${rel(input.cwd, permissionsAbs)}`
+	};
+	let tree;
+	try {
+		const mod = await loadModule(permissionsAbs, load);
+		tree = asPermissionTree(pickNamed(mod, ["permissions"]));
+	} catch (error) {
+		return {
+			code: 2,
+			document: void 0,
+			scan: void 0,
+			outPath,
+			message: describeError(error)
+		};
+	}
+	const files = listSourceFiles(input.cwd, input.scanPath ?? srcPath);
+	const knownKeys = new Set(leavesOf(tree).map((leaf) => leaf.key));
+	const scan = scanSources(input.cwd, files, knownKeys);
+	const policy = input.loadPolicy === void 0 ? await loadConfiguredPolicy(input.cwd, input.config.policy, load) : await input.loadPolicy();
+	const generatedAt = input.now.toISOString();
+	const document = buildCatalog(tree, scan, generatedAt, policy);
+	const next = formatCatalogJson(document);
+	if (input.check) {
+		if (!existsSync(outPath)) return {
+			code: 1,
+			document,
+			scan,
+			outPath,
+			message: `catalog missing: ${rel(input.cwd, outPath)}`
+		};
+		const current = readFileSync(outPath, "utf8");
+		const currentDoc = JSON.parse(current);
+		const onDisk = catalogForCompare(currentDoc);
+		const generated = catalogForCompare(input.scanPath === void 0 || samePaths(input.scanPath, srcPath) ? document : buildCatalog(tree, scanSources(input.cwd, listSourceFiles(input.cwd, srcPath), knownKeys), generatedAt, policy));
+		if (onDisk !== generated) {
+			const file = rel(input.cwd, outPath);
+			return {
+				code: 1,
+				document,
+				scan,
+				outPath,
+				message: `catalog drift: ${file}\n${shortDiff(file, onDisk, generated)}`
+			};
+		}
+		return {
+			code: 0,
+			document,
+			scan,
+			outPath,
+			message: `catalog up to date: ${rel(input.cwd, outPath)}`
+		};
+	}
+	mkdirSync(dirname(outPath), { recursive: true });
+	writeFileSync(outPath, next);
+	const written = [outPath];
+	const barrel = input.collect.barrel ?? input.config.collect?.barrel;
+	if (barrel !== void 0 && barrel !== false) {
+		const barrelPath = resolve(input.cwd, barrelFile(barrel));
+		writeBarrel(barrelPath, permissionsAbs);
+		written.push(barrelPath);
+	}
+	return {
+		code: 0,
+		document,
+		scan,
+		outPath,
+		message: `wrote ${rel(input.cwd, outPath)}`,
+		written
+	};
+}
+function samePaths(a, b) {
+	return a.length === b.length && a.every((entry, index) => entry === b[index]);
+}
+/** The permissions module `collect` reads when the config names none. */
+function guessPermissions(cwd, srcPath) {
+	return [
+		"src/permissions.ts",
+		"permissions.ts",
+		...srcPath.map((entry) => `${entry.replace(/\/$/, "")}/permissions.ts`)
+	].find((file) => existsSync(resolve(cwd, file)));
+}
+function barrelFile(barrel) {
+	return barrel === true ? "src/permissions.generated.ts" : barrel;
+}
+function writeBarrel(abs, permissionsAbs) {
+	const specifier = relative(dirname(abs), permissionsAbs).replace(/\\/gu, "/").replace(/\.tsx?$/u, ".js");
+	const body = `// @generated by permdock — do not edit
+import { mergePermissions } from 'permdock'
+import { permissions as collected } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}'
+
+export const permissions = mergePermissions(collected)
+`;
+	mkdirSync(dirname(abs), { recursive: true });
+	writeFileSync(abs, body);
+}
+//#endregion
+export { scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };

package/dist/collect-DLlujdHC.js

@@ -0,0 +1,83 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/collect.ts
+function collect(ctx) {
+	return defineCommand({
+		meta: {
+			name: "collect",
+			description: COMMAND_DESCRIPTIONS.collect
+		},
+		args: {
+			...globalArgs,
+			check: {
+				type: "boolean",
+				description: "Exit 1 when the catalog on disk is stale; write nothing"
+			},
+			src: {
+				type: "string",
+				description: "Source roots or globs, repeatable or comma-separated",
+				valueHint: "path"
+			},
+			out: {
+				type: "string",
+				description: "Catalog file to write",
+				valueHint: "file"
+			},
+			watch: {
+				type: "boolean",
+				description: "Collect again when a source, config or policy file changes"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			const src = listArg(rawArgs, "src");
+			const out = stringArg(parsed.out);
+			const overrides = {
+				...src.length > 0 ? { srcPath: src } : {},
+				...out === void 0 ? {} : { out }
+			};
+			if (parsed.watch === true) {
+				if (parsed.check === true) {
+					ctx.report({
+						code: 2,
+						output: "collect: --watch writes the catalog; drop --check"
+					});
+					return;
+				}
+				const { createCollectScheduler } = await import("./watch-Etoa_Mvr.js");
+				const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
+					...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
+					report: (message) => {
+						ctx.io.stderr(message ?? "catalog updated");
+					}
+				});
+				let message;
+				try {
+					message = await scheduler.run(false);
+				} catch (error) {
+					message = describeError(error);
+				}
+				scheduler.watch();
+				ctx.report({
+					code: 0,
+					output: message ?? "watching for changes; Ctrl-C to stop"
+				});
+				return;
+			}
+			const result = await (await import("./collect-rG2IQ3t0.js")).runCollect({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				collect: overrides,
+				check: parsed.check === true,
+				now: ctx.now,
+				io: ctx.io
+			});
+			ctx.report({
+				code: result.code,
+				output: result.message
+			});
+		}
+	});
+}
+//#endregion
+export { collect };

package/dist/collect-rG2IQ3t0.js

@@ -0,0 +1,2 @@
+import { r as runCollect } from "./collect-DDDv_ESs.js";
+export { runCollect };

package/dist/commands-DWOrSQic.js

@@ -0,0 +1,97 @@
+//#region src/cli/commands/context.ts
+/** Flags every command accepts. `run()` reads them from anywhere in argv. */
+const globalArgs = {
+	cwd: {
+		type: "string",
+		description: "Run as if started in this directory",
+		valueHint: "dir"
+	},
+	config: {
+		type: "string",
+		description: "Config file (default permdock.config.{ts,mts,js,mjs})",
+		valueHint: "file"
+	},
+	json: {
+		type: "boolean",
+		description: "Machine-readable output"
+	},
+	yes: {
+		type: "boolean",
+		alias: "y",
+		description: "Never prompt; take the answer the flags give"
+	},
+	color: {
+		type: "boolean",
+		description: "Styled output on a colour terminal",
+		default: true,
+		negativeDescription: "Plain output"
+	}
+};
+/**
+* A list flag: every `--name a,b` and `--name=c` occurrence, comma-split and
+* trimmed, in order. citty keeps only the last occurrence of a string flag.
+*/
+function listArg(rawArgs, name) {
+	const values = [];
+	const flag = `--${name}`;
+	for (const [i, token] of rawArgs.entries()) {
+		if (token === "--") break;
+		let value;
+		if (token.startsWith(`${flag}=`)) value = token.slice(flag.length + 1);
+		else if (token === flag) {
+			const next = rawArgs[i + 1];
+			if (next !== void 0 && (next === "-" || !next.startsWith("-"))) value = next;
+		}
+		if (value !== void 0) values.push(...value.split(",").map((item) => item.trim()));
+	}
+	return values;
+}
+/** A command's flag and positional definitions, whatever form it declared them in. */
+function resolveArgs(command) {
+	const args = command.args;
+	if (args === void 0) return {};
+	return typeof args === "function" ? args() : args;
+}
+/** A string flag, `undefined` when absent or given without a value. */
+function stringArg(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+//#endregion
+//#region src/cli/commands/index.ts
+/** What `permdock --help` lists, without loading any command module. */
+const COMMAND_DESCRIPTIONS = {
+	collect: "Scan the sources for definePermissions() and permission references; write the catalog and barrel",
+	catalog: "Export the catalog as JSON, JSON Schema or Markdown",
+	diff: "Compare two policies or catalogs; exit 1 on a breaking change",
+	usage: "Report unused, ungranted and role-less permissions and conditions on undeclared fields",
+	doctor: "Check a PermDock installation and print a fix for each finding",
+	config: "Check permdock.config.ts for unknown keys, or print the effective config",
+	skills: "Install, update or list the PermDock Agent Skills",
+	openapi: "Emit security into an OpenAPI document, or import one into a generated definition",
+	rls: "Generate, import, verify or migrate Postgres RLS policies from the policy",
+	arazzo: "Resolve every Arazzo step to x-permdock-permissions",
+	cloud: "Publish the catalog, hostable flags and role assignability to a PermDock Cloud environment",
+	supabase: "Generate the Supabase Custom Access Token Hook, or inspect its manifest",
+	powersync: "Generate PowerSync Sync Streams from the policy, or verify them against the fixtures"
+};
+/** Every top-level command, loaded only when it runs or its own `--help` is asked for. */
+const commands = {
+	collect: async () => (await import("./collect-DLlujdHC.js")).collect,
+	catalog: async () => (await import("./catalog-h2tlKFkq.js")).catalog,
+	diff: async () => (await import("./diff-CzqLxZ77.js")).diff,
+	usage: async () => (await import("./usage-D07N9QJ3.js")).usage,
+	doctor: async () => (await import("./doctor-rOr-4ZfS.js")).doctor,
+	config: async () => (await import("./config-Bn00Z3ks.js")).config,
+	skills: async () => (await import("./skills-JaymNCdK.js")).skills,
+	openapi: async () => (await import("./openapi-Bbg4wGVL.js")).openapi,
+	rls: async () => (await import("./rls-CEvs64Kj.js")).rls,
+	arazzo: async () => (await import("./arazzo-cmvX2jDe.js")).arazzo,
+	cloud: async () => (await import("./cloud-BGhHS-lY.js")).cloud,
+	supabase: async () => (await import("./supabase-CwafwxxF.js")).supabase,
+	powersync: async () => (await import("./powersync-yW1UUFzp.js")).powersync
+};
+function isCommand(name) {
+	return Object.hasOwn(commands, name);
+}
+//#endregion
+export { listArg as a, globalArgs as i, commands as n, resolveArgs as o, isCommand as r, stringArg as s, COMMAND_DESCRIPTIONS as t };