permdock 0.0.0 → 0.2.0

package/dist/eve/index.d.ts

@@ -0,0 +1,86 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { t as ToolMap } from "../types-Bvc4oWT6.js";
+//#region src/eve/create.d.ts
+/** Structural `SessionAuthContext` from `eve`. */
+type EvePrincipal = {
+  readonly principalId: string;
+  readonly principalType?: string;
+  readonly authenticator?: string;
+  readonly issuer?: string;
+  readonly subject?: string;
+  readonly attributes?: Readonly<Record<string, unknown>>;
+};
+/** Structural `ApprovalContext` from `eve/tools/approval`. */
+type EveApprovalContext = {
+  readonly session?: {
+    readonly id?: string;
+    readonly auth?: {
+      readonly initiator?: EvePrincipal | null;
+      readonly current?: EvePrincipal | null;
+    };
+  };
+  readonly callId?: string;
+  readonly toolName: string;
+  readonly toolInput?: unknown;
+};
+/** Structural `ApprovalResponseContext` from `eve/tools/approval`. */
+type EveResponseContext = {
+  readonly request: {
+    readonly callId: string;
+    readonly requestId?: string;
+    readonly toolName: string;
+    readonly toolInput?: unknown;
+  };
+  /** Who answered and how; eve settles the request only on `allowed`. */
+  readonly response: {
+    readonly decision: "approve" | "cancel";
+    readonly principal: EvePrincipal;
+  };
+  readonly session: {
+    readonly id: string;
+    readonly initiator: EvePrincipal | null;
+  };
+};
+/** What `subject`, `actor` and `tenant` receive. */
+type EveContext = Pick<EveApprovalContext, "session" | "callId">;
+type EveApprovers = {
+  readonly roles: readonly string[];
+} | ((responder: EvePrincipal, request: ApprovalRequest) => boolean);
+type EvePermDockOptions<TUser = unknown> = InstanceOptions & {
+  readonly subject?: (context: EveContext) => TUser | Promise<TUser>;
+  readonly actor?: (context: EveContext) => unknown;
+  readonly delegation?: (context: EveContext) => Delegation | undefined | Promise<Delegation | undefined>;
+  readonly tenant?: string | ((context: EveContext) => string | undefined | Promise<string | undefined>);
+  readonly tools: ToolMap;
+  readonly approvers?: EveApprovers;
+  readonly store?: ApprovalStore;
+};
+type EveRequestResult = "not-applicable" | "user-approval" | {
+  readonly type: "denied";
+  readonly reason: string;
+};
+type EveResponseResult = {
+  readonly status: "allowed";
+} | {
+  readonly status: "rejected";
+  readonly reason: string;
+};
+/** An eve `ApprovalConfiguration`: pass it as a tool's `approval`. */
+type EveApprovalPair = {
+  readonly request: (ctx: EveApprovalContext) => Promise<EveRequestResult>;
+  readonly response: (ctx: EveResponseContext) => Promise<EveResponseResult>;
+};
+type EvePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly approval: EveApprovalPair;
+  readonly approvalFor: (permission: Permission, data?: (input: unknown) => unknown) => EveApprovalPair;
+  readonly permdock: (ctx: EveContext) => Promise<PermDock<V>>;
+};
+export declare function rolesOf(principal: EvePrincipal | null | undefined): string[];
+export declare function subjectFromSession(context: EveContext): unknown;
+export declare function actorFromSession(context: EveContext): unknown;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: EvePermDockOptions<TUser>): EvePermDock<V>;
+//#endregion
+export type { EveApprovalContext, EveApprovalPair, EveApprovers, EveContext, EvePermDock, EvePermDockOptions, EvePrincipal, EveRequestResult, EveResponseContext, EveResponseResult };

package/dist/eve/index.js

@@ -0,0 +1,176 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as isApprovalError } from "../errors-DRnGZHzF.js";
+import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
+import { o as resolveApproval } from "../helpers-H_KARDVC.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
+import { t as boundedMap } from "../lru-8q4WZjBV.js";
+//#region src/eve/create.ts
+const TOKENS_PER_PROCESS = 1e3;
+function rolesOf(principal) {
+	const roles = principal?.attributes?.["roles"];
+	if (typeof roles === "string") return [roles];
+	if (!Array.isArray(roles)) return [];
+	return roles.filter((role) => typeof role === "string");
+}
+function subjectFromSession(context) {
+	const initiator = context.session?.auth?.initiator;
+	if (initiator === void 0 || initiator === null) return null;
+	return {
+		id: initiator.principalId,
+		roles: rolesOf(initiator)
+	};
+}
+function actorFromSession(context) {
+	const auth = context.session?.auth;
+	const initiator = auth?.initiator;
+	const current = auth?.current;
+	if (current !== void 0 && current !== null && initiator !== void 0 && initiator !== null && current.principalId !== initiator.principalId) return {
+		id: current.principalId,
+		kind: "eve"
+	};
+	return {
+		id: "eve:app",
+		kind: "eve"
+	};
+}
+function mapVerdict(verdict) {
+	if (verdict.outcome === "granted") return "not-applicable";
+	if (verdict.outcome === "approval-required") return "user-approval";
+	return {
+		type: "denied",
+		reason: verdict.reason
+	};
+}
+function mayApprove(approvers, responder, request) {
+	if (approvers === void 0) return true;
+	if (typeof approvers === "function") return approvers(responder, request);
+	const held = new Set(rolesOf(responder));
+	return approvers.roles.some((role) => held.has(role));
+}
+function callKey(sessionId, callId) {
+	return JSON.stringify([sessionId ?? null, callId]);
+}
+function createPermDock(policy, options) {
+	const store = options.store ?? memoryApprovalStore();
+	const tokensByCall = boundedMap(TOKENS_PER_PROCESS);
+	const kernel = createAgentKernel(policy, {
+		...compact({
+			tenant: options.tenant,
+			delegation: options.delegation
+		}),
+		...instanceOptions(options),
+		subject: options.subject ?? subjectFromSession,
+		actor: options.actor ?? actorFromSession,
+		tools: options.tools,
+		store,
+		adapter: "eve"
+	});
+	const approverOf = async (responder, sessionId) => {
+		try {
+			return (await kernel.instance({ session: {
+				id: sessionId,
+				auth: {
+					initiator: responder,
+					current: responder
+				}
+			} })).subject.principal ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const pairFor = (bindingFor) => {
+		const request = async (ctx) => {
+			const binding = bindingFor(ctx.toolName);
+			const verdict = binding === void 0 ? await kernel.decideTool(ctx.toolName, ctx.toolInput, ctx) : await kernel.evaluate(binding, ctx.toolName, ctx.toolInput, ctx, { denyPending: true });
+			if (verdict.outcome === "approval-required" && ctx.callId !== void 0) tokensByCall.set(callKey(ctx.session?.id, ctx.callId), verdict.token);
+			return mapVerdict(verdict);
+		};
+		const tokenOf = (ctx) => {
+			const cached = tokensByCall.get(callKey(ctx.session.id, ctx.request.callId));
+			if (cached !== void 0) return Promise.resolve(cached);
+			const binding = bindingFor(ctx.request.toolName);
+			if (binding === void 0) return Promise.resolve(void 0);
+			const initiator = ctx.session.initiator;
+			return kernel.tokenFor(binding, ctx.request.toolInput, {
+				session: {
+					id: ctx.session.id,
+					auth: {
+						initiator,
+						current: initiator
+					}
+				},
+				callId: ctx.request.callId
+			});
+		};
+		const response = async (ctx) => {
+			const token = await tokenOf(ctx);
+			if (token === void 0) return {
+				status: "rejected",
+				reason: "approval-not-found"
+			};
+			let current;
+			try {
+				current = await store.get(token);
+			} catch {
+				current = null;
+			}
+			if (current === null) return {
+				status: "rejected",
+				reason: "approval-not-found"
+			};
+			const responder = ctx.response.principal;
+			if (current.subject.actor?.id === responder.principalId) return {
+				status: "rejected",
+				reason: "approver is the actor of this request"
+			};
+			if (!mayApprove(options.approvers, responder, current)) return {
+				status: "rejected",
+				reason: "approver is not eligible"
+			};
+			const approver = await approverOf(responder, ctx.session.id);
+			if (approver === null) return {
+				status: "rejected",
+				reason: "approver is not eligible"
+			};
+			try {
+				await resolveApproval(store, token, {
+					status: ctx.response.decision === "approve" ? "approved" : "rejected",
+					by: {
+						principal: approver,
+						context: {}
+					}
+				});
+				return { status: "allowed" };
+			} catch (error) {
+				if (isApprovalError(error)) return {
+					status: "rejected",
+					reason: error.message
+				};
+				return {
+					status: "rejected",
+					reason: "approval-not-found"
+				};
+			}
+		};
+		return {
+			request,
+			response
+		};
+	};
+	const approval = pairFor((toolName) => Object.hasOwn(options.tools, toolName) ? options.tools[toolName] : void 0);
+	const approvalFor = (permission, data) => {
+		const binding = compact({
+			permission,
+			data
+		});
+		return pairFor(() => binding);
+	};
+	return {
+		approval,
+		approvalFor,
+		permdock: (ctx) => kernel.instance(ctx)
+	};
+}
+//#endregion
+export { actorFromSession, createPermDock, rolesOf, subjectFromSession };

package/dist/expiry-BoBJ8Tvc.js

@@ -0,0 +1,7 @@
+//#region src/core/expiry.ts
+/** `expiresAt` is Unix seconds; a membership with none never expires. */
+function expiredAt(item, now) {
+	return item.expiresAt !== void 0 && item.expiresAt <= now;
+}
+//#endregion
+export { expiredAt as t };

package/dist/express/index.d.ts

@@ -0,0 +1,23 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { a as toRequest, i as sendResponse } from "../http-DPuDaChb.js";
+import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
+//#region src/express/create.d.ts
+type ExpressPermDockOptions<TUser = unknown> = ServerAdapterOptions<Request, TUser>;
+type PermDockRequest<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = Request & {
+  permdock: PermDock<V>;
+  permdockData?: T;
+};
+type ExpressPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => RequestHandler;
+  readonly protect: (permission: Permission | null, loadData?: (req: Request) => unknown, protectOptions?: ProtectOptions) => RequestHandler;
+  readonly errorHandler: () => ErrorRequestHandler;
+  readonly permdockHandler: () => Router;
+  readonly withPermDock: (fn: (req: PermDockRequest<unknown, V>, res: Response) => unknown) => RequestHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ExpressPermDockOptions<TUser>): ExpressPermDock<V>;
+//#endregion
+export { type ExpressPermDock, type ExpressPermDockOptions, InvalidSignatureError, type PermDockRequest, discoverViaSignatureAgent, sendResponse, toRequest, verifyWebBotAuth };

package/dist/express/index.js

@@ -0,0 +1,78 @@
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as toRequest, r as sendResponse } from "../http-BIhmLfCc.js";
+import express from "express";
+//#region src/express/create.ts
+function run(work, next) {
+	work().catch(next);
+}
+function sendProblem(err, req, res, next) {
+	const problem = problemFromError(err, { credentials: req.headers.authorization !== void 0 });
+	if (problem === void 0) {
+		next(err);
+		return;
+	}
+	run(async () => {
+		await sendResponse(res, problem);
+	}, next);
+}
+/** Answers a PermDock error with Problem Details; anything else reaches the app's error middleware. */
+function respond(req, res, next, work) {
+	work().catch((err) => {
+		sendProblem(err, req, res, next);
+	});
+}
+const errorHandler = () => (err, req, res, next) => {
+	sendProblem(err, req, res, next);
+};
+const withPermDock = (fn) => (req, res, next) => {
+	run(async () => {
+		await fn(req, res);
+	}, next);
+};
+function createPermDock(policy, options) {
+	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "express", toRequest);
+	const permdock = () => (req, res, next) => {
+		respond(req, res, next, async () => {
+			decorate(req, await kernel.permdock(bind(req), await scopeOf(req)));
+			next();
+		});
+	};
+	const protect = (permission, loadData, protectOptions) => (req, res, next) => {
+		respond(req, res, next, async () => {
+			const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(req), protectOptions)(bind(req), await scopeOf(req));
+			if (!guard.ok) {
+				await sendResponse(res, guard.response);
+				return;
+			}
+			decorate(req, guard.permdock, guard.data);
+			next();
+		});
+	};
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
+		const router = express.Router({ mergeParams: true });
+		router.post("/", (req, res, next) => {
+			respond(req, res, next, async () => {
+				await sendResponse(res, await POST(rebind(req)));
+			});
+		});
+		router.get("/", (req, res, next) => {
+			respond(req, res, next, async () => {
+				await sendResponse(res, await GET(bind(req)));
+			});
+		});
+		return router;
+	};
+	return {
+		permdock,
+		protect,
+		errorHandler,
+		permdockHandler,
+		withPermDock,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, sendResponse, toRequest, verifyWebBotAuth };

package/dist/fastify/index.d.ts

@@ -0,0 +1,33 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
+//#region src/fastify/create.d.ts
+type FastifyPermDockOptions<TUser = unknown> = ServerAdapterOptions<FastifyRequest, TUser>;
+type PermDockRequest<Route extends RouteGenericInterface = RouteGenericInterface, V extends PolicyVocabulary = PolicyVocabulary> = FastifyRequest<Route> & {
+  permdock: PermDock<V>;
+  permdockData?: unknown;
+};
+/** A request typed by the route, its schema and the app's type provider. */
+type ProtectRequest<Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault> = FastifyRequest<Route, RawServerDefault, RawRequestDefaultExpression, Schema, Provider>;
+/**
+ * Generic over the route, schema and type provider so a `preHandler` slot
+ * infers them: `loadData` sees the same typed `request.body` as the handler.
+ */
+type FastifyProtect = <Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault>(permission: Permission | null, loadData?: (request: ProtectRequest<Route, Schema, Provider>) => unknown, protectOptions?: ProtectOptions) => (request: ProtectRequest<Route, Schema, Provider>, reply: FastifyReply) => Promise<void>;
+type FastifyPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: FastifyPluginAsync;
+  readonly protect: FastifyProtect;
+  readonly permdockHandler: FastifyPluginAsync;
+  /** Types `request.permdock` for a route registered after `permdock` or `protect`. */
+  readonly withPermDock: <Route extends RouteGenericInterface = RouteGenericInterface>(fn: (request: PermDockRequest<Route, V>, reply: FastifyReply) => unknown) => (request: FastifyRequest<Route>, reply: FastifyReply) => unknown;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: FastifyPermDockOptions<TUser>): FastifyPermDock<V>;
+//#endregion
+//#region src/fastify/http.d.ts
+export declare function toRequest(request: FastifyRequest): Request;
+export declare function sendReply(reply: FastifyReply, response: Response): Promise<void>;
+//#endregion
+export { type FastifyPermDock, type FastifyPermDockOptions, type FastifyProtect, InvalidSignatureError, type PermDockRequest, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/fastify/index.js

@@ -0,0 +1,92 @@
+import { i as parsedBody, r as headersFrom, t as firstHeader } from "../http-SO7qGttf.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+//#region src/fastify/http.ts
+function toRequest(request) {
+	const host = firstHeader(request.headers.host) ?? "localhost";
+	const url = `${request.protocol}://${host}${request.url}`;
+	const headers = headersFrom(request.headers);
+	const method = request.method;
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const body = parsedBody(request.body, headers);
+	if (body === void 0) return new Request(url, {
+		method,
+		headers
+	});
+	return new Request(url, {
+		method,
+		headers,
+		body
+	});
+}
+async function sendReply(reply, response) {
+	reply.code(response.status);
+	for (const [key, value] of response.headers.entries()) reply.header(key, value);
+	await reply.send(await response.text());
+}
+//#endregion
+//#region src/fastify/create.ts
+const SKIP_OVERRIDE = Symbol.for("skip-override");
+function breakEncapsulation(plugin) {
+	Object.defineProperty(plugin, SKIP_OVERRIDE, { value: true });
+	return plugin;
+}
+/** A route registered with `config: { permdock: false }`, such as a health check, gets no instance. */
+function skipped(request) {
+	const config = request.routeOptions.config;
+	return typeof config === "object" && config !== null && Reflect.get(config, "permdock") === false;
+}
+function createPermDock(policy, options) {
+	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "fastify", toRequest);
+	const permdock = breakEncapsulation((app) => {
+		app.decorateRequest("permdock", null);
+		app.decorateRequest("permdockData", null);
+		app.addHook("onRequest", async (request) => {
+			if (skipped(request)) return;
+			decorate(request, await kernel.permdock(bind(request), await scopeOf(request)));
+		});
+		const previous = app.errorHandler;
+		app.setErrorHandler(async function permdockErrors(err, request, reply) {
+			const problem = problemFromError(err, { credentials: request.headers.authorization !== void 0 });
+			if (problem === void 0) {
+				await previous.call(this, err, request, reply);
+				return;
+			}
+			await sendReply(reply, problem);
+		});
+		return Promise.resolve();
+	});
+	const protect = (permission, loadData, protectOptions) => async (request, reply) => {
+		const plain = request;
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions)(bind(plain), await scopeOf(plain));
+		if (!guard.ok) {
+			await sendReply(reply, guard.response);
+			return;
+		}
+		decorate(plain, guard.permdock, guard.data);
+	};
+	const permdockHandler = (app) => {
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
+		app.post("/", async (request, reply) => {
+			await sendReply(reply, await POST(rebind(request)));
+		});
+		app.get("/", async (request, reply) => {
+			await sendReply(reply, await GET(bind(request)));
+		});
+		return Promise.resolve();
+	};
+	const withPermDock = (fn) => (request, reply) => fn(request, reply);
+	return {
+		permdock,
+		protect,
+		permdockHandler,
+		withPermDock,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, sendReply, toRequest, verifyWebBotAuth };

package/dist/fields-BMl1RxoX.js

@@ -0,0 +1,26 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { D as ownKeys, E as ownGet, T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+//#region src/core/fields.ts
+function sanitizeFields(fields) {
+	if (fields === void 0) return;
+	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
+}
+function grantCoversField(fields, field, effect) {
+	if (fields === void 0) return true;
+	if (fields.length === 0) return false;
+	if (field === void 0) return effect === "allow";
+	return fields.includes(field);
+}
+function pickVisible(row, canField) {
+	const out = {};
+	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
+	return freezeDeep(out);
+}
+function sanitizeContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+	const out = {};
+	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
+	return out;
+}
+//#endregion
+export { sanitizeFields as i, pickVisible as n, sanitizeContext as r, grantCoversField as t };

package/dist/files-DWUN9PzI.js

@@ -0,0 +1,125 @@
+import { existsSync, globSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { basename, extname, join, relative, resolve } from "node:path";
+//#region src/cli/files.ts
+const SOURCE_EXT = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".cts"
+]);
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	".next",
+	".turbo",
+	"coverage",
+	".git"
+]);
+const PACKAGE_SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function listSourceFiles(cwd, srcPath) {
+	const out = /* @__PURE__ */ new Set();
+	for (const entry of srcPath) {
+		if (/[*?[{]/u.test(entry)) {
+			collectGlob(cwd, entry, out);
+			continue;
+		}
+		collectRoot(resolve(cwd, entry), out, skipDirsFor(entry));
+	}
+	const byRealPath = /* @__PURE__ */ new Map();
+	for (const file of [...out].toSorted()) {
+		const real = realPath(file);
+		if (!byRealPath.has(real)) byRealPath.set(real, file);
+	}
+	return [...byRealPath.values()].toSorted();
+}
+function segments(path) {
+	return path.split(/[\\/]/u).filter((part) => part !== "" && part !== ".");
+}
+/** Installed packages often ship only `dist`; their own dependencies are never walked. */
+function skipDirsFor(path) {
+	return segments(path).includes("node_modules") ? PACKAGE_SKIP_DIRS : SKIP_DIRS;
+}
+function realPath(file) {
+	try {
+		return realpathSync(file);
+	} catch {
+		return file;
+	}
+}
+function collectGlob(cwd, pattern, out) {
+	const literal = segments(pattern);
+	const matches = globSync(pattern, {
+		cwd,
+		exclude: (path) => {
+			const parts = segments(path);
+			const name = basename(path);
+			return SKIP_DIRS.has(name) && literal[parts.length - 1] !== name;
+		}
+	});
+	for (const match of matches) collectRoot(resolve(cwd, match), out, skipDirsFor(match));
+}
+function collectRoot(root, out, skip) {
+	if (!existsSync(root)) return;
+	if (statSync(root).isFile()) {
+		if (SOURCE_EXT.has(extname(root))) out.add(root);
+		return;
+	}
+	walkDir(root, out, skip);
+}
+function walkDir(dir, out, skip) {
+	for (const name of readdirSync(dir)) {
+		if (name.startsWith(".") && name !== ".agents") continue;
+		if (skip.has(name)) continue;
+		const full = join(dir, name);
+		const stats = statSync(full, { throwIfNoEntry: false });
+		if (stats === void 0) continue;
+		if (stats.isDirectory()) {
+			walkDir(full, out, skip);
+			continue;
+		}
+		if (SOURCE_EXT.has(extname(name)) && !name.endsWith(".generated.ts")) out.add(full);
+	}
+}
+/**
+* The `.sql` files under each entry: a glob, a file, or a directory searched
+* recursively. `order: 'entry'` keeps each entry's matches together in entry
+* order (how `supabase db diff` reads `schema_paths`); the default sorts all paths.
+*/
+function sqlFiles(cwd, entries, options = {}) {
+	const seen = /* @__PURE__ */ new Set();
+	const ordered = [];
+	for (const entry of entries) {
+		const abs = resolve(cwd, entry);
+		const isGlob = /[*?[{]/u.test(entry);
+		if (!isGlob && statSync(abs, { throwIfNoEntry: false })?.isFile()) {
+			if (!seen.has(abs)) {
+				seen.add(abs);
+				ordered.push(abs);
+			}
+			continue;
+		}
+		const pattern = isGlob ? entry : `${entry}/**/*.sql`;
+		for (const match of globSync(pattern, { cwd }).toSorted()) {
+			const path = resolve(cwd, match);
+			if (path.endsWith(".sql") && !seen.has(path)) {
+				seen.add(path);
+				ordered.push(path);
+			}
+		}
+	}
+	return options.order === "entry" ? ordered : ordered.toSorted();
+}
+function rel(cwd, abs) {
+	return relative(cwd, abs).split("\\").join("/");
+}
+function defaultSrcPath() {
+	return ["./src"];
+}
+/** Where `doctor` reads source files: `doctor.srcPath`, else `collect.srcPath`, else `./src`. */
+function doctorSrcPath(config) {
+	return config.doctor?.srcPath ?? config.collect?.srcPath ?? defaultSrcPath();
+}
+//#endregion
+export { sqlFiles as a, rel as i, doctorSrcPath as n, listSourceFiles as r, defaultSrcPath as t };