permdock 0.0.0 → 0.2.0

package/dist/usage-DG1oeCca.js

@@ -0,0 +1,693 @@
+import { c as getResource } from "./permissions-DVoF6dMt.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { o as jsonSchemaOf } from "./catalog-doc-Dsc9y7sd.js";
+import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+import { Visitor, parseSync } from "oxc-parser";
+import { isBuiltin } from "node:module";
+//#region src/cli/doctor-source.ts
+/** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
+const SERVER_SPECIFIERS = [
+	"permdock/a2a",
+	"permdock/ai-sdk",
+	"permdock/approvals",
+	"permdock/authzen",
+	"permdock/better-auth",
+	"permdock/better-supabase",
+	"permdock/claude-agent",
+	"permdock/clerk",
+	"permdock/cloud",
+	"permdock/convex",
+	"permdock/drizzle",
+	"permdock/elysia",
+	"permdock/eve",
+	"permdock/express",
+	"permdock/fastify",
+	"permdock/hono",
+	"permdock/jwt",
+	"permdock/kysely",
+	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/openapi",
+	"permdock/orpc",
+	"permdock/otel",
+	"permdock/pdp",
+	"permdock/prisma",
+	"permdock/scim",
+	"permdock/server",
+	"permdock/ssf",
+	"permdock/supabase",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc"
+];
+/** Entries that feed request, tool or model data into a check. */
+const ADAPTER_SPECIFIERS = [
+	"permdock/a2a",
+	"permdock/ai-sdk",
+	"permdock/authzen",
+	"permdock/claude-agent",
+	"permdock/elysia",
+	"permdock/eve",
+	"permdock/express",
+	"permdock/fastify",
+	"permdock/hono",
+	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/orpc",
+	"permdock/server",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc",
+	"permdock/webmcp"
+];
+const UNTRUSTED_CLAIMS = [
+	"user_metadata",
+	"unsafeMetadata",
+	"untrusted_metadata",
+	"clientMetadata",
+	"preferred_username"
+];
+function withoutComments(source) {
+	const { comments } = parseSync(source.file, source.text);
+	let text = source.text;
+	for (const comment of comments) text = text.slice(0, comment.start) + " ".repeat(comment.end - comment.start) + text.slice(comment.end);
+	return text;
+}
+function isClientSource(source, clientEntries) {
+	return clientEntries.has(source.file) || source.text.includes("'use client'") || source.text.includes("\"use client\"") || source.file.includes(".client.");
+}
+/** Specifiers a module loads at runtime: value imports, re-exports and literal dynamic imports. */
+function runtimeSpecifiers(source) {
+	const { module } = parseSync(source.file, source.text);
+	const out = /* @__PURE__ */ new Set();
+	for (const item of module.staticImports) if (item.entries.length === 0 || item.entries.some((entry) => !entry.isType)) out.add(item.moduleRequest.value);
+	for (const item of module.staticExports) for (const entry of item.entries) if (entry.moduleRequest !== null && !entry.isType) out.add(entry.moduleRequest.value);
+	for (const item of module.dynamicImports) {
+		const literal = /^\s*(['"`])([^'"`$]+)\1\s*$/u.exec(source.text.slice(item.moduleRequest.start, item.moduleRequest.end));
+		if (literal?.[2] !== void 0) out.add(literal[2]);
+	}
+	return [...out];
+}
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* A resolver for imports of `file`, the way the bundler resolves them:
+* relative paths with or without an extension, the `paths` of the nearest
+* `tsconfig.json`, and package names through `node_modules` and each
+* package's `exports`. An unresolvable specifier gives `undefined`.
+*/
+function resolverFor(file) {
+	const jiti = createJiti(file, { tsconfigPaths: dirname(file) });
+	const parentURL = pathToFileURL(file);
+	return (specifier) => {
+		if (specifier === "" || isBuiltin(specifier)) return;
+		try {
+			const url = jiti.esmResolve(specifier, {
+				parentURL,
+				try: true
+			});
+			const path = url?.startsWith("file:") === true ? fileURLToPath(url) : void 0;
+			return path !== void 0 && existsSync(path) ? realFile(path) : void 0;
+		} catch {
+			return;
+		}
+	};
+}
+function pd001(sources, clientEntries = /* @__PURE__ */ new Set(), policy) {
+	const findings = [];
+	const policyFile = policy === void 0 ? void 0 : realFile(resolve(policy.cwd, policy.path));
+	for (const source of sources) {
+		if (!isClientSource(source, clientEntries)) continue;
+		if (policy !== void 0 && policyFile !== void 0) {
+			const resolveImport = resolverFor(resolve(policy.cwd, source.file));
+			for (const specifier of runtimeSpecifiers(source)) if (specifier !== "permdock" && !specifier.startsWith("permdock/") && resolveImport(specifier) === policyFile) findings.push({
+				code: "PD001",
+				severity: "error",
+				message: `${source.file} imports the policy module through ${specifier}`,
+				fix: "decide on the server and pass a snapshot to the client ('permdock/react'); never import the policy into a client entry"
+			});
+		}
+		for (const spec of SERVER_SPECIFIERS) if (source.text.includes(`'${spec}'`) || source.text.includes(`"${spec}"`)) findings.push({
+			code: "PD001",
+			severity: "error",
+			message: `${source.file} imports ${spec}`,
+			fix: "move the check into a Server Component or import from 'permdock/react'"
+		});
+	}
+	return findings;
+}
+function pd007(sources) {
+	const hasNever = sources.some((source) => /validate\s*:\s*['"]never['"]/u.test(source.text));
+	const hasAdapter = sources.some((source) => ADAPTER_SPECIFIERS.some((spec) => source.text.includes(spec)));
+	if (hasNever && hasAdapter) return [{
+		code: "PD007",
+		severity: "warning",
+		message: "policy sets validate: 'never' while an HTTP, MCP or agent adapter is imported",
+		fix: "use validate: 'boundary' for untrusted input"
+	}];
+	return [];
+}
+function pd008(sources) {
+	const findings = [];
+	for (const source of sources) {
+		if (!source.text.includes("permdock")) continue;
+		if (/export\s+(?:const|function|class)\s+(?:dock|ability)\b/u.test(source.text)) findings.push({
+			code: "PD008",
+			severity: "warning",
+			message: `${source.file} exports a reserved name (dock or ability)`,
+			fix: "use createPermDock and permdock"
+		});
+		if (/export\s+(?:const|function|type|interface)\s+\$/u.test(source.text)) findings.push({
+			code: "PD008",
+			severity: "warning",
+			message: `${source.file} exports a $ prefixed member`,
+			fix: "drop the $ prefix"
+		});
+	}
+	return findings;
+}
+function pd010(sources) {
+	const findings = [];
+	for (const source of sources) {
+		const text = withoutComments(source);
+		for (const claim of UNTRUSTED_CLAIMS) if (text.includes(claim) && /roles|tenant/u.test(text)) findings.push({
+			code: "PD010",
+			severity: "error",
+			message: `${source.file} reads roles or tenant from ${claim}`,
+			fix: "use a server-set claim or a MembershipSource"
+		});
+	}
+	return findings;
+}
+function pd011(sources) {
+	const findings = [];
+	for (const source of sources) if (/tenant['"]?\s*:\s*['"]hd['"]/u.test(source.text) || /accounts\.google\.com/u.test(source.text) && /tenant/.test(source.text)) findings.push({
+		code: "PD011",
+		severity: "warning",
+		message: `${source.file} reads tenant from an optional issuer claim`,
+		fix: "compare the claim to onboarded tenants; do not default a tenant"
+	});
+	return findings;
+}
+function pd013(sources) {
+	const findings = [];
+	for (const source of sources) {
+		if (/algorithms[\s\S]{0,120}EdDSA/u.test(source.text)) findings.push({
+			code: "PD013",
+			severity: "warning",
+			message: `${source.file} lists polymorphic EdDSA`,
+			fix: "write Ed25519"
+		});
+		if (/algorithms[\s\S]{0,120}['"]none['"]/u.test(source.text)) findings.push({
+			code: "PD013",
+			severity: "error",
+			message: `${source.file} allows alg none`,
+			fix: "remove none and RSA1_5 from algorithms"
+		});
+	}
+	return findings;
+}
+function unwrapped(node) {
+	let current = node ?? void 0;
+	while (current?.type === "TSAsExpression" || current?.type === "TSSatisfiesExpression" || current?.type === "ParenthesizedExpression") current = current.expression;
+	return current;
+}
+function propertyName(property) {
+	if (property.computed) return;
+	const key = property.key;
+	if (key.type === "Identifier") return key.name;
+	return key.type === "Literal" && typeof key.value === "string" ? key.value : void 0;
+}
+function stringValue(node) {
+	const value = unwrapped(node);
+	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
+	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
+}
+function isPermDockSpecifier(value) {
+	return value === "permdock" || value.startsWith("permdock/");
+}
+function permdockOptionObjects(source) {
+	const { program } = parseSync(source.file, source.text);
+	const functions = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const constants = /* @__PURE__ */ new Map();
+	const calls = [];
+	new Visitor({
+		ImportDeclaration(node) {
+			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
+			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+		},
+		VariableDeclarator(node) {
+			const init = unwrapped(node.init);
+			if (node.id.type === "Identifier" && init?.type === "ObjectExpression") constants.set(node.id.name, init);
+		},
+		CallExpression(node) {
+			calls.push(node);
+		}
+	}).visit(program);
+	const objects = [];
+	const collect = (node) => {
+		const value = unwrapped(node);
+		const target = value?.type === "Identifier" ? constants.get(value.name) : value;
+		if (target?.type !== "ObjectExpression" || objects.includes(target)) return;
+		objects.push(target);
+		for (const property of target.properties) if (property.type === "Property") collect(property.value);
+	};
+	for (const call of calls) {
+		const callee = call.callee;
+		if (callee.type === "Identifier" && functions.has(callee.name) || callee.type === "MemberExpression" && callee.object.type === "Identifier" && namespaces.has(callee.object.name)) for (const argument of call.arguments) collect(argument);
+	}
+	return objects;
+}
+function pd014(sources) {
+	const findings = [];
+	for (const source of sources) {
+		if (!source.text.includes("permdock")) continue;
+		for (const object of permdockOptionObjects(source)) {
+			const keys = /* @__PURE__ */ new Map();
+			for (const property of object.properties) {
+				if (property.type !== "Property") continue;
+				const name = propertyName(property);
+				if (name !== void 0) keys.set(name, property.value);
+			}
+			const discovery = keys.get("discovery");
+			const setsDiscovery = keys.has("discovery");
+			const setsJwks = keys.has("jwks");
+			if (stringValue(discovery)?.startsWith("http:") === true) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} uses a plain-HTTP discovery URL`,
+				fix: "use an https: issuer"
+			});
+			if (setsDiscovery && (setsJwks || keys.has("issuer"))) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets discovery together with jwks or issuer`,
+				fix: "use discovery alone, or jwks plus issuer"
+			});
+			if (setsJwks && !setsDiscovery && !keys.has("issuer")) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets jwks without issuer`,
+				fix: "set issuer with jwks, or switch to discovery"
+			});
+		}
+	}
+	return findings;
+}
+function pd015(sources) {
+	const findings = [];
+	for (const source of sources) if (/accept:\s*['"]id-token['"]/u.test(source.text)) findings.push({
+		code: "PD015",
+		severity: "warning",
+		message: `${source.file} accepts id-token on what looks like an API resolver`,
+		fix: "leave accept as 'access-token' for API routes"
+	});
+	return findings;
+}
+const SUPABASE_SUBJECT_CALL = /\bsubjectFromSupabase(?:Session)?\s*\(/gu;
+/** Top-level arguments of the call whose `(` ends at `open`, or undefined when unbalanced. */
+function callArguments(text, open) {
+	const args = [];
+	let depth = 0;
+	let quote;
+	let start = open + 1;
+	for (let index = open + 1; index < text.length; index += 1) {
+		const char = text[index];
+		if (quote !== void 0) {
+			if (char === "\\") index += 1;
+			else if (char === quote) quote = void 0;
+			continue;
+		}
+		if (char === "'" || char === "\"" || char === "`") quote = char;
+		else if (char === "(" || char === "{" || char === "[") depth += 1;
+		else if (char === ")" || char === "}" || char === "]") {
+			if (depth === 0) {
+				args.push(text.slice(start, index).trim());
+				return args.filter((arg) => arg !== "");
+			}
+			depth -= 1;
+		} else if (char === "," && depth === 0) {
+			args.push(text.slice(start, index).trim());
+			start = index + 1;
+		}
+	}
+}
+/** The claim a `subjectFromSupabase` call reads the tenant from, or undefined when the options are not a literal. */
+function readTenantClaim(options, fallback) {
+	if (options === void 0) return fallback;
+	if (!options.startsWith("{")) return;
+	const tenant = /(?:^|[{,\s])tenant\s*:\s*(?:'([^']*)'|"([^"]*)"|([^,}\s]+))/u.exec(options);
+	if (tenant === null) return fallback;
+	return tenant[1] ?? tenant[2];
+}
+function pd038(sources, tenantClaim, fallback) {
+	const findings = [];
+	for (const source of sources) for (const match of source.text.matchAll(SUPABASE_SUBJECT_CALL)) {
+		const open = match.index + match[0].length - 1;
+		const args = callArguments(source.text, open);
+		if (args === void 0) continue;
+		const read = readTenantClaim(args[1], fallback);
+		if (read === void 0 || read === tenantClaim) continue;
+		const line = source.text.slice(0, match.index).split("\n").length;
+		findings.push({
+			code: "PD038",
+			severity: "warning",
+			message: `${source.file}:${line} reads the tenant from '${read}', but rls.tenantClaim is '${tenantClaim}'`,
+			fix: `pass tenant: '${tenantClaim}' or set rls.tenantClaim to '${read}'`
+		});
+	}
+	return findings;
+}
+/**
+* PD057: `rls.anonymousSignIns` is `'deny'`, so RLS refuses `signInAnonymously()` users, but a
+* `subjectFromSupabase(Session)` call maps them as signed-in users. Options that are not a
+* literal object are not read.
+*/
+function pd057(sources) {
+	const findings = [];
+	for (const source of sources) for (const match of source.text.matchAll(SUPABASE_SUBJECT_CALL)) {
+		const open = match.index + match[0].length - 1;
+		const args = callArguments(source.text, open);
+		if (args === void 0) continue;
+		const options = args[1];
+		if (options !== void 0 && !options.startsWith("{")) continue;
+		if (options !== void 0 && /(?:^|[{,\s])anonymousSignIns\s*:\s*['"]deny['"]/u.test(options)) continue;
+		const line = source.text.slice(0, match.index).split("\n").length;
+		findings.push({
+			code: "PD057",
+			severity: "warning",
+			message: `${source.file}:${line} maps anonymous sign-ins as users, but rls.anonymousSignIns is 'deny'`,
+			fix: "pass anonymousSignIns: 'deny' so the subject agrees with RLS"
+		});
+	}
+	return findings;
+}
+const EXCHANGE_CALL = /\bexchangeCapability\s*\(/gu;
+/** PD041: `exchangeCapability` signing link tokens with the project's shared JWT secret. */
+function pd041(sources) {
+	const findings = [];
+	for (const source of sources) for (const match of source.text.matchAll(EXCHANGE_CALL)) {
+		const open = match.index + match[0].length - 1;
+		const options = callArguments(source.text, open)?.[1];
+		if (options === void 0 || !/(?:^|[{,\s])alg\s*:\s*['"]HS256['"]/u.test(options)) continue;
+		const line = source.text.slice(0, match.index).split("\n").length;
+		findings.push({
+			code: "PD041",
+			severity: "warning",
+			message: `${source.file}:${String(line)} signs capability tokens with HS256, the project's shared JWT secret: whoever holds it can mint any user's token`,
+			fix: "sign with alg: 'ES256' and the private JWK of an asymmetric Supabase signing key; keep HS256 for the local stack only"
+		});
+	}
+	return findings;
+}
+const PROTECT_CALL = /\bprotect\s*\(/gu;
+const ID_ROUTE = /['"`](\/[^'"`\s]*(?::[A-Za-z_$][\w$]*|\{[A-Za-z_$][\w$]*\})[^'"`\s]*)['"`]/gu;
+const DYNAMIC_SEGMENT = /(?:^|[\\/])(\[[^\]/\\]+\])(?=[\\/])/u;
+/** The id-bearing route a `protect` call at `index` sits in: the file's dynamic segment, or a route literal earlier in the same statement. */
+function idRouteOf(source, index) {
+	const segment = DYNAMIC_SEGMENT.exec(source.file);
+	if (segment !== null) return segment[1];
+	const window = source.text.slice(Math.max(0, index - 400), index);
+	const start = Math.max(window.lastIndexOf(";"), window.lastIndexOf("\n\n"));
+	return [...window.slice(start + 1).matchAll(ID_ROUTE)].at(-1)?.[1];
+}
+/** PD036: a `protect(permission)` with no row loader on a route whose path names an object id (BOLA, OWASP API1). */
+function pd036(sources) {
+	const findings = [];
+	for (const source of sources) {
+		if (!source.text.includes("permdock")) continue;
+		for (const match of source.text.matchAll(PROTECT_CALL)) {
+			const open = match.index + match[0].length - 1;
+			const args = callArguments(source.text, open);
+			if (args?.length !== 1 || args[0]?.trim() === "null") continue;
+			const route = idRouteOf(source, match.index);
+			if (route === void 0) continue;
+			const line = source.text.slice(0, match.index).split("\n").length;
+			findings.push({
+				code: "PD036",
+				severity: "warning",
+				message: `${source.file}:${String(line)} protects ${route} with ${args[0] ?? ""} and no row loader, so the check never sees the row the id names (BOLA, OWASP API1)`,
+				fix: "pass a loader that fetches the row by the id: protect(permission, (request) => load(request))"
+			});
+		}
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/usage.ts
+async function runUsage(input) {
+	const collected = input.collected === void 0 ? await runCollect({
+		cwd: input.cwd,
+		config: input.config,
+		collect: input.config.collect ?? {},
+		check: true,
+		now: input.now,
+		io: input.io
+	}) : await input.collected();
+	if (collected.document === void 0 || collected.scan === void 0) return {
+		code: 2,
+		output: collected.message
+	};
+	const policyRel = input.config.policy;
+	if (policyRel === void 0) return {
+		code: 2,
+		output: "usage: set policy in permdock.config.ts"
+	};
+	const policy = await usagePolicy(input.cwd, policyRel, input.policy);
+	if (!("roles" in policy)) return policy;
+	const granted = /* @__PURE__ */ new Set();
+	const mergedRoles = /* @__PURE__ */ new Set();
+	for (const role of policy.roles) {
+		mergedRoles.add(role.name);
+		for (const grant of role.grants) if (grant.effect === "allow") granted.add(grant.permission.key);
+	}
+	for (const grant of policy.grants ?? []) if (grant.effect === "allow") granted.add(grant.permission.key);
+	const used = /* @__PURE__ */ new Set();
+	const usedAt = {};
+	for (const permission of collected.document.permissions) if (permission.usages.some((usage) => usage.call !== "allow")) {
+		used.add(permission.key);
+		usedAt[permission.key] = permission.usages;
+	}
+	const unused = [];
+	const ungranted = [];
+	const noRole = [];
+	const dynamic = [];
+	for (const permission of collected.document.permissions) {
+		const key = permission.key;
+		if (ignored(key, input.ignore)) continue;
+		if (!used.has(key) && !input.dynamicAsUsed) unused.push({
+			kind: "unused",
+			key,
+			detail: permission.usages[0]?.file ?? "defined"
+		});
+		if (used.has(key) && !granted.has(key)) {
+			const site = usedAt[key]?.[0];
+			ungranted.push({
+				kind: "ungranted",
+				key,
+				detail: site === void 0 ? "checked" : `${site.file}:${String(site.line)} (${site.call})`
+			});
+		}
+	}
+	for (const name of collected.scan.roleNames) if (!mergedRoles.has(name)) noRole.push({
+		kind: "no-role",
+		key: name,
+		detail: `role '${name}' not passed to definePolicy`
+	});
+	for (const site of collected.scan.dynamic) dynamic.push({
+		kind: "dynamic",
+		key: "*",
+		detail: `${site.file}:${String(site.line)} (${site.call})`
+	});
+	const undeclared = undeclaredFields(policy).filter((finding) => !ignored(finding.key, input.ignore));
+	const outsideInclude = outsideSnapshotInclude(input.cwd, input.config, collected.scan, usedAt).filter((finding) => !ignored(finding.key, input.ignore));
+	const report = {
+		$schema: USAGE_REPORT_SCHEMA,
+		unused,
+		ungranted,
+		noRole,
+		dynamic,
+		undeclared,
+		outsideInclude,
+		warnings: unused.length + ungranted.length + dynamic.length + undeclared.length + outsideInclude.length,
+		errors: noRole.length
+	};
+	return {
+		code: report.errors > 0 || input.strict && report.warnings > 0 ? 1 : 0,
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
+	};
+}
+async function usagePolicy(cwd, policyRel, loaded) {
+	if (loaded !== void 0) return await loaded() ?? {
+		code: 2,
+		output: `PermDock CLI: policy module failed to load: ${policyRel}`
+	};
+	const policyAbs = resolve(cwd, policyRel);
+	if (!existsSync(policyAbs)) return {
+		code: 2,
+		output: `PermDock CLI: policy module not found: ${policyRel}`
+	};
+	try {
+		return asPolicy(pickNamed(await loadModule(policyAbs), ["policy"]));
+	} catch (error) {
+		return usageResult(error);
+	}
+}
+const CLIENT_CALLS = /* @__PURE__ */ new Set([
+	"usePermission",
+	"can",
+	"decide",
+	"filter",
+	"actions"
+]);
+function undeclaredFields(policy) {
+	const findings = [];
+	for (const grant of policy.grants) {
+		const declared = declaredFields(policy, grant.permission.resource);
+		if (declared === void 0) continue;
+		const fields = /* @__PURE__ */ new Set();
+		conditionFields(grant.where, fields);
+		conditionFields(grant.check, fields);
+		for (const field of fields) if (!declared.has(field)) findings.push({
+			kind: "undeclared-field",
+			key: grant.permission.key,
+			detail: `${grant.role === null ? "policy grant" : `role '${grant.role}'`} reads '${field}', which the ${grant.permission.resource} schema does not declare`
+		});
+	}
+	return findings;
+}
+function declaredFields(policy, resource) {
+	const node = getResource(policy.permissions, resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	if (schema === null || typeof schema !== "object") return;
+	const properties = schema.properties;
+	if (properties === null || typeof properties !== "object") return;
+	return new Set(Object.keys(properties));
+}
+function conditionFields(condition, out) {
+	if (condition === void 0) return;
+	const add = (field) => {
+		out.add(field.split(".")[0] ?? field);
+	};
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+			add(condition.field);
+			break;
+		case "and":
+		case "or":
+			for (const child of condition.conditions) conditionFields(child, out);
+			break;
+		case "not":
+			conditionFields(condition.condition, out);
+			break;
+		case "memberOf":
+			add(condition.field);
+			for (const parent of condition.parents ?? []) add(typeof parent === "string" ? parent : parent.field);
+			break;
+		case "sqlFunction":
+			for (const arg of condition.args) if (arg !== null && typeof arg === "object" && !Array.isArray(arg) && "field" in arg) add(arg.field);
+			conditionFields(condition.twin, out);
+			break;
+		case "related":
+			add(condition.field);
+			if (condition.restricted !== void 0) add(condition.restricted);
+			if (condition.restrictedAncestors !== void 0) {
+				add(condition.restrictedAncestors.id);
+				add(condition.restrictedAncestors.parent);
+			}
+			break;
+		case "opaque":
+		case "liveSession": break;
+		default: throw new Error(`unknown condition ${String(condition)}`);
+	}
+}
+function outsideSnapshotInclude(cwd, config, scan, usedAt) {
+	if (scan.snapshots.length === 0 || scan.snapshots.some((site) => site.include === void 0 || site.include === null)) return [];
+	const include = scan.snapshots.flatMap((site) => site.include ?? []);
+	const clientEntries = new Set(listSourceFiles(cwd, config.doctor?.clientEntries ?? []).map((file) => rel(cwd, file)));
+	const client = /* @__PURE__ */ new Map();
+	const isClient = (file) => {
+		let known = client.get(file);
+		if (known === void 0) {
+			const path = resolve(cwd, file);
+			known = existsSync(path) && isClientSource({
+				file,
+				text: readFileSync(path, "utf8")
+			}, clientEntries);
+			client.set(file, known);
+		}
+		return known;
+	};
+	const findings = [];
+	for (const [key, sites] of Object.entries(usedAt)) {
+		if (include.some((item) => key === item || key.startsWith(`${item}.`))) continue;
+		const site = sites.find((usage) => CLIENT_CALLS.has(usage.call) && isClient(usage.file));
+		if (site !== void 0) findings.push({
+			kind: "outside-include",
+			key,
+			detail: `${site.file}:${String(site.line)} (${site.call}) is outside every snapshot include`
+		});
+	}
+	return findings;
+}
+function ignored(key, patterns) {
+	return patterns.some((pattern) => {
+		if (pattern.endsWith(".*")) return key.startsWith(pattern.slice(0, -2));
+		return key === pattern;
+	});
+}
+function formatUsage(report) {
+	const lines = ["permdock usage", ""];
+	lines.push(`  defined but unused (${String(report.unused.length)})`);
+	for (const finding of report.unused) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
+	lines.push("");
+	lines.push(`  used but ungranted (${String(report.ungranted.length)})`);
+	for (const finding of report.ungranted) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
+	lines.push("");
+	lines.push(`  granted by no role (${String(report.noRole.length)})`);
+	for (const finding of report.noRole) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
+	for (const [title, list] of [["conditions on undeclared fields", report.undeclared], ["client checks outside include", report.outsideInclude]]) if (list.length > 0) {
+		lines.push("");
+		lines.push(`  ${title} (${String(list.length)})`);
+		for (const finding of list) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
+	}
+	if (report.dynamic.length > 0) {
+		lines.push("");
+		lines.push(`  dynamic (${String(report.dynamic.length)})`);
+		for (const finding of report.dynamic) lines.push(`    ${finding.detail}`);
+	}
+	lines.push("");
+	lines.push(`  ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}, ${String(report.errors)} error${report.errors === 1 ? "" : "s"}`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+export { pd010 as a, pd014 as c, pd038 as d, pd041 as f, pd008 as i, pd015 as l, pd001 as n, pd011 as o, pd057 as p, pd007 as r, pd013 as s, runUsage as t, pd036 as u };