permdock 0.3.1 → 0.5.0

package/dist/collect-CHB22Sx4.js

@@ -1,83 +0,0 @@
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/collect.ts
-function collect(ctx) {
-	return defineCommand({
-		meta: {
-			name: "collect",
-			description: COMMAND_DESCRIPTIONS.collect
-		},
-		args: {
-			...globalArgs,
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the catalog on disk is stale; write nothing"
-			},
-			src: {
-				type: "string",
-				description: "Source roots or globs, repeatable or comma-separated",
-				valueHint: "path"
-			},
-			out: {
-				type: "string",
-				description: "Catalog file to write",
-				valueHint: "file"
-			},
-			watch: {
-				type: "boolean",
-				description: "Collect again when a source, config or policy file changes"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const src = listArg(rawArgs, "src");
-			const out = stringArg(parsed.out);
-			const overrides = {
-				...src.length > 0 ? { srcPath: src } : {},
-				...out === void 0 ? {} : { out }
-			};
-			if (parsed.watch === true) {
-				if (parsed.check === true) {
-					ctx.report({
-						code: 2,
-						output: "collect: --watch writes the catalog; drop --check"
-					});
-					return;
-				}
-				const { createCollectScheduler } = await import("./watch-BwxLTYMZ.js");
-				const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
-					...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
-					report: (message) => {
-						ctx.io.stderr(message ?? "catalog updated");
-					}
-				});
-				let message;
-				try {
-					message = await scheduler.run(false);
-				} catch (error) {
-					message = describeError(error);
-				}
-				scheduler.watch();
-				ctx.report({
-					code: 0,
-					output: message ?? "watching for changes; Ctrl-C to stop"
-				});
-				return;
-			}
-			const result = await (await import("./collect-DSWOk19R.js")).runCollect({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				collect: overrides,
-				check: parsed.check === true,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report({
-				code: result.code,
-				output: result.message
-			});
-		}
-	});
-}
-//#endregion
-export { collect };

package/dist/collect-DSWOk19R.js

@@ -1,2 +0,0 @@
-import { r as runCollect } from "./collect-DSTE3ml9.js";
-export { runCollect };

package/dist/commands-BeaGNj_o.js

@@ -1,97 +0,0 @@
-//#region src/cli/commands/context.ts
-/** Flags every command accepts. `run()` reads them from anywhere in argv. */
-const globalArgs = {
-	cwd: {
-		type: "string",
-		description: "Run as if started in this directory",
-		valueHint: "dir"
-	},
-	config: {
-		type: "string",
-		description: "Config file (default permdock.config.{ts,mts,js,mjs})",
-		valueHint: "file"
-	},
-	json: {
-		type: "boolean",
-		description: "Machine-readable output"
-	},
-	yes: {
-		type: "boolean",
-		alias: "y",
-		description: "Never prompt; take the answer the flags give"
-	},
-	color: {
-		type: "boolean",
-		description: "Styled output on a colour terminal",
-		default: true,
-		negativeDescription: "Plain output"
-	}
-};
-/**
-* A list flag: every `--name a,b` and `--name=c` occurrence, comma-split and
-* trimmed, in order. citty keeps only the last occurrence of a string flag.
-*/
-function listArg(rawArgs, name) {
-	const values = [];
-	const flag = `--${name}`;
-	for (const [i, token] of rawArgs.entries()) {
-		if (token === "--") break;
-		let value;
-		if (token.startsWith(`${flag}=`)) value = token.slice(flag.length + 1);
-		else if (token === flag) {
-			const next = rawArgs[i + 1];
-			if (next !== void 0 && (next === "-" || !next.startsWith("-"))) value = next;
-		}
-		if (value !== void 0) values.push(...value.split(",").map((item) => item.trim()));
-	}
-	return values;
-}
-/** A command's flag and positional definitions, whatever form it declared them in. */
-function resolveArgs(command) {
-	const args = command.args;
-	if (args === void 0) return {};
-	return typeof args === "function" ? args() : args;
-}
-/** A string flag, `undefined` when absent or given without a value. */
-function stringArg(value) {
-	return typeof value === "string" && value !== "" ? value : void 0;
-}
-//#endregion
-//#region src/cli/commands/index.ts
-/** What `permdock --help` lists, without loading any command module. */
-const COMMAND_DESCRIPTIONS = {
-	collect: "Scan the sources for definePermissions() and permission references; write the catalog and barrel",
-	catalog: "Export the catalog as JSON, JSON Schema or Markdown",
-	diff: "Compare two policies or catalogs; exit 1 on a breaking change",
-	usage: "Report unused, ungranted and role-less permissions and conditions on undeclared fields",
-	doctor: "Check a PermDock installation and print a fix for each finding",
-	config: "Check permdock.config.ts for unknown keys, or print the effective config",
-	skills: "Install, update or list the PermDock Agent Skills",
-	openapi: "Emit security into an OpenAPI document, or import one into a generated definition",
-	rls: "Generate, import, verify or migrate Postgres RLS policies from the policy",
-	arazzo: "Resolve every Arazzo step to x-permdock-permissions",
-	cloud: "Publish the catalog, hostable flags and role assignability to a PermDock Cloud environment",
-	supabase: "Generate the Supabase Custom Access Token Hook, or inspect its manifest",
-	powersync: "Generate PowerSync Sync Streams from the policy, or verify them against the fixtures"
-};
-/** Every top-level command, loaded only when it runs or its own `--help` is asked for. */
-const commands = {
-	collect: async () => (await import("./collect-CHB22Sx4.js")).collect,
-	catalog: async () => (await import("./catalog-CYj-mX2O.js")).catalog,
-	diff: async () => (await import("./diff-C9RDjjhs.js")).diff,
-	usage: async () => (await import("./usage-B0YuTQRO.js")).usage,
-	doctor: async () => (await import("./doctor-Djh6JDEk.js")).doctor,
-	config: async () => (await import("./config-ir40y8m0.js")).config,
-	skills: async () => (await import("./skills-C5CbhhpG.js")).skills,
-	openapi: async () => (await import("./openapi-CQTsgKoB.js")).openapi,
-	rls: async () => (await import("./rls-P-BeBx0n.js")).rls,
-	arazzo: async () => (await import("./arazzo-C9chp3ST.js")).arazzo,
-	cloud: async () => (await import("./cloud-CfwZ39Rl.js")).cloud,
-	supabase: async () => (await import("./supabase-s4o9s1O1.js")).supabase,
-	powersync: async () => (await import("./powersync-DE19b9dT.js")).powersync
-};
-function isCommand(name) {
-	return Object.hasOwn(commands, name);
-}
-//#endregion
-export { listArg as a, globalArgs as i, commands as n, resolveArgs as o, isCommand as r, stringArg as s, COMMAND_DESCRIPTIONS as t };

package/dist/config-ir40y8m0.js

@@ -1,36 +0,0 @@
-import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/config.ts
-function config(ctx) {
-	return defineCommand({
-		meta: {
-			name: "config",
-			description: COMMAND_DESCRIPTIONS.config
-		},
-		args: {
-			...globalArgs,
-			print: {
-				type: "boolean",
-				description: "Print the effective config as JSON: the file, as written, and each default"
-			},
-			strict: {
-				type: "boolean",
-				description: "Exit 1 on warnings"
-			}
-		},
-		async run({ args: parsed }) {
-			const { runConfig } = await import("./config-report-CdCgbRnV.js");
-			ctx.report(runConfig({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				file: ctx.configPath,
-				warnings: ctx.configWarnings,
-				print: parsed.print === true,
-				json: ctx.json,
-				strict: parsed.strict === true
-			}));
-		}
-	});
-}
-//#endregion
-export { config };

package/dist/create-CMwIl-w2.js

@@ -1,253 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
-import { n as problemDetails } from "./problem-details-_AMOYz-w.js";
-import { r as challengeScope, t as createPermDock$1 } from "./permdock-CbgvLnuo.js";
-import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as hasCredentials } from "./http-SO7qGttf.js";
-import { a as notFoundProblem, l as unauthenticatedProblem, o as problemFromDecision, r as decisionResponse } from "./problem-B43ztKIm.js";
-import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
-//#region src/server/create.ts
-async function resolveActor(request, options) {
-	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request)) ?? actorFrom(options.actor, request);
-}
-const NO_TENANT = "\0";
-function routeScopes(value) {
-	if (value === void 0) return;
-	const scopes = Array.isArray(value) ? value : [];
-	const names = scopes.filter((scope) => typeof scope === "string" && scope !== "");
-	if (names.length === 0 || names.length !== scopes.length) throw new TypeError("PermDock: oauthScopes must be a non-empty list of scope names");
-	return names;
-}
-const NOT_DELEGATED = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "not-delegated"
-	}],
-	alternatives: []
-};
-/** The `403` `insufficient_scope` for a token that holds none of a route's OAuth scopes. */
-function scopeProblem(permission, subject, credentials, scope) {
-	return permission === null ? decisionResponse(problemDetails(compact({
-		decision: NOT_DELEGATED,
-		detail: `the token holds none of the OAuth scopes this route needs, such as ${String(scope)}`,
-		scope
-	})), NOT_DELEGATED, compact({
-		credentials,
-		scope
-	})) : problemFromDecision(NOT_DELEGATED, permission, subject, compact({
-		credentials,
-		scope
-	}));
-}
-function createPermDock(policy, options) {
-	return createServerKernel(policy, options);
-}
-function problemFor(decision, init, approval) {
-	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, void 0, compact({
-		instance: init.instance,
-		approval
-	}));
-	if (decision.outcome === "granted") return new Response(null, { status: 204 });
-	return decisionResponse(problemDetails(compact({
-		decision,
-		detail: decision.outcome,
-		instance: init?.instance
-	})), decision);
-}
-/**
-* The kernel behind every HTTP adapter. The subject and actor are resolved
-* once per `Request`; one instance is cached per `(Request, tenant)`, so a
-* global middleware and a later tenant-scoped `protect` never share a tenant.
-*/
-function createServerKernel(policy, options) {
-	const adapter = options.adapter ?? "server";
-	const subjects = /* @__PURE__ */ new WeakMap();
-	const instances = /* @__PURE__ */ new WeakMap();
-	const freshSubject = async (request) => {
-		const actor = await resolveActor(request, options);
-		try {
-			return {
-				user: await options.subject(request),
-				actor
-			};
-		} catch {
-			return {
-				user: null,
-				actor
-			};
-		}
-	};
-	const resolveSubject = (request) => {
-		const hit = subjects.get(request);
-		if (hit !== void 0) return hit;
-		const resolved = freshSubject(request);
-		subjects.set(request, resolved);
-		return resolved;
-	};
-	const instanceFor = async ({ user, actor }, tenant) => {
-		const coreOptions = compact({
-			tenant,
-			...instanceOptions(options),
-			actor
-		});
-		const permdock = await createPermDock$1(policy, user, coreOptions);
-		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, coreOptions);
-		return {
-			permdock: options.wrap === void 0 ? permdock : options.wrap(permdock),
-			remote
-		};
-	};
-	const build = async (request, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		let byTenant = instances.get(request);
-		if (byTenant === void 0) {
-			byTenant = /* @__PURE__ */ new Map();
-			instances.set(request, byTenant);
-		}
-		const key = tenant ?? NO_TENANT;
-		const hit = byTenant.get(key);
-		if (hit !== void 0) return hit;
-		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
-		byTenant.set(key, built);
-		return built;
-	};
-	const connection = async (request, connectionOptions = {}, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		const { openConnection } = await import("./connection-CU8MQxRi.js");
-		return openConnection({
-			open: async () => (await build(request, { tenant })).permdock,
-			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
-			tenant,
-			...options.revocations === void 0 ? {} : { feed: options.revocations },
-			adapter,
-			options: connectionOptions
-		});
-	};
-	const permdock = async (request, scope) => (await build(request, scope)).permdock;
-	const getSnapshot = async (request, query = {}) => {
-		return (await permdock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
-			include: query.include,
-			tenants: query.tenants
-		}));
-	};
-	const protectRoute = (permission, loadData, protectOptions = {}) => {
-		if (permission === null && routeScopes(protectOptions.oauthScopes) === void 0 && options.operations === void 0) throw new TypeError("PermDock: protect(null) needs oauthScopes, in its options or an operations entry");
-		return async (request, scope) => {
-			let instance;
-			let remote;
-			try {
-				({permdock: instance, remote} = await build(request, scope));
-			} catch (error) {
-				if (error instanceof InvalidSignatureError) return {
-					ok: false,
-					response: error.response
-				};
-				throw error;
-			}
-			return guardOn(instance, remote, request, permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions);
-		};
-	};
-	const guardOn = async (instance, remote, request, permission, load, protectOptions) => {
-		const declared = routeScopes(protectOptions.oauthScopes ?? (request === void 0 ? void 0 : options.operations?.oauthScopesForRequest(request.method, new URL(request.url).pathname)));
-		const credentials = request === void 0 ? false : hasCredentials(request);
-		if (permission === null) {
-			if (declared === void 0) throw new TypeError(request === void 0 ? "PermDock: protect(null) needs oauthScopes" : `PermDock: protect(null) needs oauthScopes, and no operation declares them for ${request.method} ${new URL(request.url).pathname}`);
-			if (instance.subject.principal === null) return {
-				ok: false,
-				response: unauthenticatedProblem(credentials)
-			};
-		}
-		const held = instance.subject.delegation?.scopes;
-		if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return {
-			ok: false,
-			response: scopeProblem(permission, instance.subject, credentials, declared[0])
-		};
-		let data;
-		if (load !== void 0) {
-			const loaded = await load();
-			if (loaded === null || loaded === void 0) return {
-				ok: false,
-				response: notFoundProblem()
-			};
-			data = loaded;
-		}
-		if (permission === null) return {
-			ok: true,
-			permdock: instance,
-			data
-		};
-		const decideOptions = compact({
-			source: "adapter",
-			adapter,
-			...protectOptions.trusted === true ? { trusted: true } : {
-				trusted: false,
-				boundary: "http-body"
-			}
-		});
-		const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
-			outcome: "denied",
-			denials: [{
-				role: null,
-				reason: "pdp-unavailable"
-			}],
-			alternatives: []
-		}));
-		const decision = await applyApprovalResume(raw, permission, instance, options.store, request, resourceRef(permission, data), adapter);
-		if (decision.outcome === "granted") return {
-			ok: true,
-			permdock: instance,
-			decision,
-			data
-		};
-		return {
-			ok: false,
-			response: problemFromDecision(decision, permission, instance.subject, compact({
-				approval: options.approval,
-				credentials,
-				scope: declared?.[0] ?? challengeScope(policy, permission),
-				disclosure: data === void 0 ? void 0 : policy.resources.get(permission.resource)?.disclosure
-			}))
-		};
-	};
-	const protect = protectRoute;
-	const openapi = {
-		security: (permission) => ({
-			security: [{ oauth2: [permission.scope] }],
-			"x-permdock-permissions": [permission.key]
-		}),
-		securitySchemes: () => {
-			const scopes = {};
-			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
-			return { oauth2: {
-				type: "oauth2",
-				flows: {},
-				scopes
-			} };
-		}
-	};
-	const permdockHandler = (scope) => createEvaluationsHandler(compact({
-		policy,
-		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
-		store: options.store,
-		adapter
-	}));
-	return {
-		permdock,
-		getSnapshot,
-		protect,
-		protectOn: (instance, permission, load, protectOptions = {}, request) => guardOn(instance, void 0, request, permission, load, protectOptions),
-		connection,
-		shareSubject: (from, to) => {
-			const resolved = subjects.get(from);
-			if (resolved !== void 0 && !subjects.has(to)) subjects.set(to, resolved);
-		},
-		problem: (decision, init) => problemFor(decision, init, options.approval),
-		openapi,
-		permdockHandler
-	};
-}
-//#endregion
-export { createServerKernel as n, createPermDock as t };

package/dist/delegation-D8pUEuce.js

@@ -1,103 +0,0 @@
-import { i as findPermission, o as formerScopes, t as annotationsFor } from "./permissions-DVoF6dMt.js";
-import { d as matchGrantee, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { t as isActive } from "./validity-uOp8UpYn.js";
-//#region src/core/delegation.ts
-/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
-function scopeNames(permission) {
-	return [permission.scope, ...formerScopes(permission)];
-}
-/**
-* Whether a delegated caller may use a permission its principal holds, through
-* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
-* `undefined` means covered; otherwise the denial reason `decide` would add.
-*/
-function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
-	const unscoped = hasActor ? "no-delegation" : void 0;
-	if (delegation === void 0) return unscoped;
-	const hasScopes = delegation.scopes !== void 0;
-	const hasDetails = delegation.authorizationDetails !== void 0;
-	const hasAccess = delegation.access !== void 0;
-	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
-	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
-	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
-	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
-	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
-	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
-	const scopes = scopeNames(permission);
-	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
-	const detailOk = delegation.authorizationDetails?.some((detail) => {
-		if (detail.type !== permission.resource) return false;
-		const identifier = detail["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		const actions = detail.actions;
-		if (actions === void 0) return true;
-		return Array.isArray(actions) && actions.includes(permission.action);
-	}) ?? false;
-	const accessOk = accessCovers(permission, delegation.access, resourceId);
-	if (scopeOk || detailOk || accessOk) return;
-	return "not-delegated";
-}
-function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
-	return (requires ?? []).every((key) => {
-		const leaf = findPermission(tree, key);
-		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
-	});
-}
-function requiresStandIn(grant) {
-	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
-}
-function accessCovers(permission, access, resourceId) {
-	if (access === void 0) return false;
-	return access.some((entry) => {
-		if (typeof entry === "string") return scopeNames(permission).includes(entry);
-		if (entry === null || typeof entry !== "object") return false;
-		const type = entry["type"];
-		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
-		const actions = entry["actions"];
-		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
-		const identifier = entry["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		return true;
-	});
-}
-function typeMatches(type, resource) {
-	if (type === resource) return true;
-	return type.endsWith(`/${resource}`);
-}
-/**
-* Whether the subject's principal is a `from` of the delegation: every item
-* matches, with roles checked against the roles the principal holds here
-* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
-* row.
-*/
-function handsOver(delegation, subject, heldRoles, now) {
-	const items = flattenGrantee(delegation.from);
-	if (items.length === 0 || subject.principal === null) return false;
-	return items.every((item) => {
-		if (item.kind === "role") return heldRoles.has(item.role);
-		if (item.kind === "relation") return false;
-		const match = matchGrantee(item, subject, now, void 0);
-		return match.matched && match.where === void 0;
-	});
-}
-/**
-* The permission keys the policy's delegations let `subject.actor` use for
-* `subject.principal` right now: the union over every active delegation whose
-* `to` matches the actor and whose `from` the principal holds. `undefined`
-* when none applies, so the call falls back to the token delegation alone.
-* An actor with `readOnly: true` gets only each delegation's read-only keys.
-* Attenuation only: a key here still needs a matching allow and no deny.
-*/
-function delegatedPermissions(delegations, subject, heldRoles, now) {
-	const actor = subject.actor;
-	if (actor === void 0 || delegations === void 0) return;
-	let keys;
-	for (const delegation of delegations) {
-		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
-		keys ??= /* @__PURE__ */ new Set();
-		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
-	}
-	return keys;
-}
-//#endregion
-export { requiresStandIn as i, coversRequirements as n, delegatedPermissions as r, coveredByDelegation as t };

package/dist/diff-C9RDjjhs.js

@@ -1,48 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/diff.ts
-function diff(ctx) {
-	return defineCommand({
-		meta: {
-			name: "diff",
-			description: COMMAND_DESCRIPTIONS.diff
-		},
-		args: {
-			...globalArgs,
-			before: {
-				type: "positional",
-				required: false,
-				description: "A permissions.catalog.json or a module exporting policy"
-			},
-			after: {
-				type: "positional",
-				required: false,
-				description: "The same, for the new side"
-			},
-			impact: {
-				type: "boolean",
-				description: "Run the fixtures through both sides and report changed outcomes"
-			},
-			fixtures: {
-				type: "string",
-				description: "Fixtures file for --impact",
-				valueHint: "file"
-			}
-		},
-		async run({ args: parsed }) {
-			const result = await (await import("./diff-2VaeChzX.js")).runDiff({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				sources: parsed._,
-				impact: parsed.impact === true,
-				fixtures: stringArg(parsed.fixtures),
-				json: ctx.json,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { diff };

package/dist/doctor-Djh6JDEk.js

@@ -1,53 +0,0 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { n as ask, t as CANCELLED } from "./prompt-CXYhLfsS.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/doctor.ts
-function doctor(ctx) {
-	return defineCommand({
-		meta: {
-			name: "doctor",
-			description: COMMAND_DESCRIPTIONS.doctor
-		},
-		args: {
-			...globalArgs,
-			only: {
-				type: "string",
-				description: "Check codes or groups to run, repeatable",
-				valueHint: "codes"
-			},
-			fix: {
-				type: "boolean",
-				description: "Apply safe fixes: install skills, regenerate the catalog"
-			},
-			strict: {
-				type: "boolean",
-				description: "Exit 1 on warnings too"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			let fix = parsed.fix === true;
-			if (fix && ctx.interactive) {
-				const answer = await ask(`Install the Agent Skills and regenerate the catalog in ${ctx.cwd}?`);
-				if (answer === void 0) {
-					ctx.report(CANCELLED);
-					return;
-				}
-				fix = answer;
-			}
-			const result = await (await import("./doctor-DvH0IQff.js")).runDoctor({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				only: listArg(rawArgs, "only"),
-				json: ctx.json,
-				fix,
-				strict: parsed.strict === true,
-				color: ctx.color,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { doctor };