permdock 0.1.0 → 0.2.0

package/dist/{credential-B_rkUNlY.js → credential-8P81ff4u.js}

@@ -1,38 +1,11 @@
 import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { a as formerKeys, g as listPermissions } from "./permissions-DC7GROPA.js";
-import { u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { _ as listPermissions, a as formerKeys } from "./permissions-DVoF6dMt.js";
 import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { a as ownRecord, n as idList, r as isId } from "./capability-B68OFnZx.js";
-//#region src/core/revocations.ts
-function isRevocationEvent(value) {
-	if (value === null || typeof value !== "object") return false;
-	const event = value;
-	return typeof event["principal"] === "string" && event["principal"].length > 0 && (event["kind"] === "session-revoked" || event["kind"] === "changed") && (event["session"] === void 0 || typeof event["session"] === "string") && (event["tenant"] === void 0 || typeof event["tenant"] === "string");
-}
-/** In-process feed; a multi-replica app bridges `revoke` to its own pub/sub. */
-function memoryRevocationFeed() {
-	const listeners = /* @__PURE__ */ new Set();
-	return Object.freeze({
-		subscribe(listener) {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
-			};
-		},
-		revoke(event) {
-			if (!isRevocationEvent(event)) throw new TypeError("PermDock: invalid revocation event.");
-			const frozen = Object.freeze({ ...event });
-			for (const listener of listeners) try {
-				listener(frozen);
-			} catch {}
-		}
-	});
-}
-//#endregion
+import { a as ownRecord, n as idList, r as isId } from "./capability-4qPdO9gk.js";
 //#region src/core/credential.ts
-const MAX_ENTRIES = 64;
 const MAX_NAME = 256;
 function policies(policy) {
 	return isReadonlyArray(policy) ? policy : [policy];
@@ -52,7 +25,7 @@ function credentialPolicyViolation(credential, policy) {
 	}
 }
 function parsePermissions(value) {
-	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ENTRIES) return;
+	if (!Array.isArray(value) || value.length === 0) return;
 	const out = [];
 	for (const item of value) {
 		const entry = ownRecord(item);
@@ -73,7 +46,7 @@ function isTime(value) {
 * Validates an untrusted credential record and returns a frozen copy with
 * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
 * type in a known field, a service credential without `tenant` and `roles`,
-* or a user credential with either, rejects the whole record.
+* or a user credential with `roles`, rejects the whole record.
 */
 function parseCredential(input) {
 	const value = ownRecord(input);
@@ -90,7 +63,8 @@ function parseCredential(input) {
 		roles = idList(value["roles"]);
 		if (!isId(value["tenant"]) || roles === void 0) return;
 		tenant = value["tenant"];
-	} else if (value["tenant"] !== void 0 || value["roles"] !== void 0) return;
+	} else if (value["roles"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+	else tenant = value["tenant"];
 	return freezeDeep(compact({
 		v: 1,
 		id: value["id"],
@@ -145,7 +119,9 @@ function credentialDelegation(credential, permissions) {
 * The subject a verified credential acts as. A `user` credential is its
 * owner, passed live as `owner` (roles and memberships as of this request),
 * with the credential's delegation: every check is the owner's rights
-* intersected with the key's. A `service` credential is a `service`
+* intersected with the key's. One that names a `tenant` makes it the active
+* tenant, and `createPermDock` then keeps only the owner's memberships
+* inside it and no global role. A `service` credential is a `service`
 * principal whose only membership is `roles` in `tenant`. An owner whose id
 * is not the credential's `principal`, or who is not a user, is anonymous.
 */
@@ -158,11 +134,12 @@ function credentialSubject(credential, options) {
 			kind: "user"
 		};
 		if (owner.id !== credential.principal || owner.kind !== void 0 && owner.kind !== "user") return anonymousSubject();
-		principal = {
+		principal = compact({
 			...owner,
 			kind: "user",
+			tenant: credential.tenant ?? owner.tenant,
 			credential
-		};
+		});
 	} else {
 		const membership = compact({
 			tenant: credential.tenant,
@@ -210,7 +187,7 @@ function denied(reason, detail) {
 	});
 }
 function permissionEntries(request, declared) {
-	if (!isReadonlyArray(request.permissions) || request.permissions.length === 0 || request.permissions.length > MAX_ENTRIES) return;
+	if (!isReadonlyArray(request.permissions) || request.permissions.length === 0) return;
 	const out = [];
 	for (const item of request.permissions) {
 		const entry = permissionEntry(item);
@@ -249,7 +226,7 @@ function checkRequest(permdock, request, now) {
 		id: request.id,
 		kind: request.kind,
 		principal: request.kind === "service" ? request.principal ?? request.id : creator.id,
-		tenant: request.kind === "service" ? request.tenant : void 0,
+		tenant: request.tenant,
 		roles: request.kind === "service" ? request.roles : void 0,
 		permissions: entries.map((entry) => compact({
 			permission: entry.leaf.key,
@@ -264,6 +241,9 @@ function checkRequest(permdock, request, now) {
 	if (credential.tenant !== void 0) {
 		const tenant = credential.tenant;
 		if (!permdock.tenants().includes(tenant)) return refuse("exceeds-creator", { tenant });
+	}
+	if (credential.kind === "service" && credential.tenant !== void 0) {
+		const tenant = credential.tenant;
 		const roles = new Set(permdock.assignableRoles({ tenant }).map((role) => role.key));
 		for (const name of credential.roles ?? []) if (!roles.has(name)) return refuse("exceeds-creator", { role: name });
 		const ceiling = new Set(permdock.assignablePermissions({ tenant }).map((leaf) => leaf.key));
@@ -275,8 +255,8 @@ function checkRequest(permdock, request, now) {
 	};
 }
 /**
-* The tenant whose `credentials` policy governs a credential: a service
-* key's own tenant, otherwise `active` (the creator's or the request's).
+* The tenant whose `credentials` policy governs a credential: the key's own
+* tenant, otherwise `active` (the creator's or the request's).
 */
 function credentialTenant(credential, active) {
 	return credential.tenant ?? active;
@@ -285,11 +265,11 @@ function credentialTenant(credential, active) {
 * Decides whether the subject of `permdock` may create the credential in
 * `request`. The creator must be a signed-in user or service that is not
 * itself a link or a credential; a delegated creator hands out only what its
-* delegation covers. A service key's tenant must be one the creator is a
-* member of, its roles among the creator's `assignableRoles` there and its
+* delegation covers. A key's tenant must be one the creator is a member of;
+* a service key's roles among the creator's `assignableRoles` there and its
 * permissions within `assignablePermissions` there (`exceeds-creator`). The
-* `credentials` policy of the key's tenant (a service key's own, a user
-* key's the creator's active tenant) then applies (`credential-policy`; a
+* `credentials` policy of the key's tenant (its own, or for a user key
+* without one the creator's active tenant) then applies (`credential-policy`; a
 * settings source that throws denies with `rule: 'unavailable'`), and
 * `approval` makes the result `approval-required` until `approved` carries
 * its token. PermDock never stores the credential; the application does,
@@ -323,4 +303,4 @@ async function decideCredential(permdock, request, options = {}) {
 	});
 }
 //#endregion
-export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, memoryRevocationFeed as s, credentialDelegation as t };
+export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, credentialDelegation as t };

package/dist/delegation-D8pUEuce.js

@@ -0,0 +1,103 @@
+import { i as findPermission, o as formerScopes, t as annotationsFor } from "./permissions-DVoF6dMt.js";
+import { d as matchGrantee, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
+import { t as isActive } from "./validity-uOp8UpYn.js";
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
+	return (requires ?? []).every((key) => {
+		const leaf = findPermission(tree, key);
+		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
+	});
+}
+function requiresStandIn(grant) {
+	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
+export { requiresStandIn as i, coversRequirements as n, delegatedPermissions as r, coveredByDelegation as t };

package/dist/{describe-Bt1YD5uS.js → describe-B_gVZEVi.js}

@@ -1,5 +1,5 @@
-import { t as flattenApprovers } from "./approvers-aH0PJkmf.js";
-import { s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
+import { i as flattenApprovers } from "./approvers-DT4AVyIg.js";
+import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
 //#region src/core/describe.ts
 const TENANT_REASONS = /* @__PURE__ */ new Set([
 	"tenant-mismatch",
@@ -16,6 +16,7 @@ function labelGrantee(grantee) {
 		case "authenticated": return "an authenticated user";
 		case "anyone": return "anyone";
 		case "relation": return grantee.relation;
+		case "inherit": return grantee.permission;
 		case "assurance": {
 			const parts = [];
 			if (grantee.acr !== void 0 && grantee.acr.length > 0) parts.push(`acr ${grantee.acr.join("/")}`);
@@ -25,16 +26,6 @@ function labelGrantee(grantee) {
 		default: return grantee;
 	}
 }
-/**
-* The plans named by the `not-entitled` denials of a decision, when every
-* denial is `not-entitled`; otherwise empty, since a plan alone would not grant.
-*/
-function requiredPlans(decision) {
-	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => denial.reason !== "not-entitled")) return [];
-	const plans = /* @__PURE__ */ new Set();
-	for (const denial of decision.denials) for (const item of flattenGrantee(denial.to)) if (item.kind === "plan") plans.add(item.plan);
-	return [...plans];
-}
 const TITLES = {
 	granted: "Granted",
 	denied: "Denied",
@@ -45,7 +36,10 @@ const TITLES = {
 	upgrade: "Upgrade required"
 };
 function labelApprover(approver) {
-	return approver.kind === "user" ? `user ${approver.id}` : labelGrantee(approver);
+	if (approver.kind === "user") return `user ${approver.id}`;
+	if (approver.kind === "permission") return `a holder of ${approver.permission}`;
+	if (approver.kind === "any-of") return `one of (${approver.of.map((entry) => flattenApprovers(entry).map(labelApprover).join(" and ")).join(", ")})`;
+	return labelGrantee(approver);
 }
 function approvers(approval) {
 	if (approval === void 0 || approval === "human") return [];
@@ -87,7 +81,8 @@ function describe(decision, options) {
 	};
 	const reasons = decision.denials.map((denial) => denial.reason);
 	const kind = reasons.some((reason) => TENANT_REASONS.has(reason)) ? "tenant" : reasons.some((reason) => DELEGATION_REASONS.has(reason)) ? "delegation" : reasons.includes("opaque-condition") || reasons.includes("server-only") ? "server-only" : "denied";
-	const detail = reasons.map((reason) => messages?.reasons?.[reason] ?? reason).join(messages?.separator ?? ", ");
+	const texts = messages?.reasons;
+	const detail = reasons.map((reason) => (typeof texts === "function" ? texts(reason, decision) : texts?.[reason]) ?? reason).join(messages?.separator ?? ", ");
 	return {
 		kind,
 		title: titleOf(kind),
@@ -96,4 +91,4 @@ function describe(decision, options) {
 	};
 }
 //#endregion
-export { requiredPlans as n, describe as t };
+export { describe as t };

package/dist/{describe-DernyItf.d.ts → describe-PdoqESvg.d.ts}

@@ -1,5 +1,5 @@
-import { Mn as Decision, Pn as DenialReason } from "./policy-CInmNGkM.js";
-import { d as Permission } from "./permissions-B4apnahQ.js";
+import { Qn as DeniedDecision, Yn as Decision, Zn as DenialReason } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {
   readonly kind: "granted" | "denied" | "approval" | "tenant" | "delegation" | "server-only" | "upgrade";
@@ -9,19 +9,18 @@ type DecisionDescription = {
   /** On `upgrade`: the plans any of which would grant the permission. */
   readonly plans?: readonly string[];
 };
-/**
- * The plans named by the `not-entitled` denials of a decision, when every
- * denial is `not-entitled`; otherwise empty, since a plan alone would not grant.
- */
-declare function requiredPlans(decision: Decision): readonly string[];
 /**
  * Localised text for `describe`. Every entry is optional and falls back to the
  * English default; `kind` and `alternatives` never change.
  */
 type DescribeMessages = {
   readonly titles?: Partial<Record<DecisionDescription["kind"], string>>;
-  /** Text per denial reason; a denied detail joins the texts of its reasons with `separator`. */
-  readonly reasons?: Partial<Record<DenialReason, string>>;
+  /**
+   * Text per denial reason; a denied detail joins the texts of its reasons
+   * with `separator`. The function form also sees the decision; `undefined`
+   * keeps the reason code, as a missing record entry does.
+   */
+  readonly reasons?: Partial<Record<DenialReason, string>> | ((reason: DenialReason, decision: DeniedDecision) => string | undefined);
   /** Joins denial reason texts. Default `', '`. */
   readonly separator?: string;
   readonly granted?: (permission: string) => string;
@@ -34,4 +33,4 @@ type DescribeOptions = {
 };
 declare function describe(decision: Decision, options?: DescribeOptions): DecisionDescription;
 //#endregion
-export { requiredPlans as a, describe as i, DescribeMessages as n, DescribeOptions as r, DecisionDescription as t };
+export { describe as i, DescribeMessages as n, DescribeOptions as r, DecisionDescription as t };

package/dist/{diff-x5Il8LVa.js → diff-B8Tunc3o.js}

@@ -1,12 +1,12 @@
-import { i as findPermission } from "./permissions-DC7GROPA.js";
-import { m as memoryRoleSource } from "./src-CTNT-PBW.js";
-import { l as canonicalJson } from "./snapshot-DE8dE_hz.js";
-import { t as createPermDock } from "./permdock-yoZ7EjxX.js";
-import { t as buildCatalog } from "./catalog-doc-BSo_Q_-6.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
-import { t as parseCatalog } from "./parse-DPfIvFMU.js";
-import { a as usageResult } from "./errors-DSMnAVNa.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cvaw0gDG.js";
+import { i as findPermission } from "./permissions-DVoF6dMt.js";
+import { _ as memoryRoleSource } from "./src-CSbUiozF.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { t as parseCatalog } from "./parse-BuyjxhZV.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff.ts
@@ -19,7 +19,8 @@ const EMPTY_SCAN = {
 	roleNames: [],
 	planNames: [],
 	allowKeys: [],
-	snapshots: []
+	snapshots: [],
+	unparsed: []
 };
 async function loadSide(cwd, source, now) {
 	const abs = resolve(cwd, source);
@@ -109,7 +110,8 @@ function delegationIdentity(delegation) {
 	});
 }
 function describeDelegation(delegation) {
-	const to = delegation.to.id === void 0 ? delegation.to.kind : `${delegation.to.kind} ${delegation.to.id}`;
+	const narrowed = delegation.to.id ?? delegation.to.client;
+	const to = narrowed === void 0 ? delegation.to.kind : `${delegation.to.kind} ${narrowed}`;
 	return `delegation ${canonicalJson(delegation.from)} → ${to} (${delegation.permissions.join(", ")})`;
 }
 function delegationChanges(before, after) {
@@ -187,6 +189,29 @@ function underNames(a, aliases) {
 		}
 	};
 }
+/** Levels of permissions on both sides, with `a`'s keys under `b`'s names. */
+function diffLevels(a, b, aliases) {
+	const after = new Map(b.permissions.map((item) => [item.key, new Set(item.levels ?? [])]));
+	const before = new Map(a.permissions.map((item) => [aliases.get(item.key) ?? item.key, new Set(item.levels ?? [])]));
+	const added = [];
+	const removed = [];
+	for (const [permission, levels] of before) {
+		const kept = after.get(permission);
+		if (kept === void 0) continue;
+		for (const level of levels) if (!kept.has(level)) removed.push({
+			permission,
+			level
+		});
+		for (const level of kept) if (!levels.has(level)) added.push({
+			permission,
+			level
+		});
+	}
+	return {
+		added,
+		removed
+	};
+}
 function diffCatalogs(original, b) {
 	const breaking = [];
 	const aliasesA = aliasesOf(original.catalog);
@@ -219,6 +244,12 @@ function diffCatalogs(original, b) {
 		permission: to,
 		detail: `${old} no longer resolves to ${to}: stored custom roles, tokens and SQL that still name it now deny`
 	});
+	const levels = diffLevels(a.catalog, b.catalog, aliasesB);
+	for (const item of levels.removed) breaking.push({
+		kind: "level-removed",
+		permission: item.permission,
+		detail: `level ${item.level} of ${item.permission} no longer exists: stored custom roles that pick it now deny the permission`
+	});
 	const scopes = setDiff((a.catalog.scopes ?? []).map((scope) => scope.name), (b.catalog.scopes ?? []).map((scope) => scope.name));
 	for (const name of scopes.removed) breaking.push({
 		kind: "scope-removed",
@@ -301,6 +332,7 @@ function diffCatalogs(original, b) {
 		a: sideRef(a),
 		b: sideRef(b),
 		permissions,
+		levels,
 		scopes,
 		roles: {
 			...roleNames,
@@ -353,6 +385,7 @@ function formatText(diff) {
 		for (const item of changed) lines.push(`  ~ ${item}`);
 	};
 	section("permissions", diff.permissions.added, diff.permissions.removed, diff.permissions.renamed.map((rename) => `${rename.from} → ${rename.to} (renamed)`));
+	section("levels", diff.levels.added.map((item) => `${item.permission}@${item.level}`), diff.levels.removed.map((item) => `${item.permission}@${item.level}`));
 	section("scopes", diff.scopes.added, diff.scopes.removed);
 	section("roles", diff.roles.added, diff.roles.removed, diff.roles.changed.map((name) => `${name}: declaration changed`));
 	if (diff.grants === void 0) lines.push("grants: not compared (a catalog was built without its policy; run `permdock collect` with `policy` configured)");

package/dist/{diff-BUzf5Poi.js → diff-CzqLxZ77.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/diff.ts
 function diff(ctx) {
@@ -30,7 +30,7 @@ function diff(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./diff-x5Il8LVa.js")).runDiff({
+			const result = await (await import("./diff-B8Tunc3o.js")).runDiff({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				sources: parsed._,