permdock 0.3.1 → 0.5.0

package/dist/operation-findings-DgATDpvh.js

@@ -0,0 +1,36 @@
+import { n as OPERATION_RISKS } from "./permissions-B-wCP5ZC.js";
+//#region src/catalog/operation-findings.ts
+function rank(risk) {
+	return OPERATION_RISKS.indexOf(risk ?? "low");
+}
+function requiresApproval(catalog, permission) {
+	return (catalog.permissions.find((entry) => entry.key === permission)?.approvals?.length ?? 0) > 0;
+}
+/**
+* Operations, matched by name, whose `meta.risk` rose or whose permission
+* stopped requiring approval between two catalogs. A new or removed
+* operation is not a finding.
+*/
+function operationFindings(previous, next) {
+	const before = new Map((previous.operations ?? []).map((operation) => [operation.name, operation]));
+	const findings = [];
+	for (const operation of next.operations ?? []) {
+		const old = before.get(operation.name);
+		if (old === void 0) continue;
+		if (rank(operation.meta.risk) > rank(old.meta.risk)) findings.push({
+			code: "operation-risk-raised",
+			operation: operation.name,
+			permission: operation.permission,
+			previous: old.meta.risk ?? "low",
+			risk: operation.meta.risk ?? "low"
+		});
+		if (requiresApproval(previous, old.permission) && !requiresApproval(next, operation.permission)) findings.push({
+			code: "operation-approval-removed",
+			operation: operation.name,
+			permission: operation.permission
+		});
+	}
+	return findings;
+}
+//#endregion
+export { operationFindings as t };

package/dist/operations-CxybZErY.d.ts

@@ -0,0 +1,59 @@
+import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+//#region src/core/operation-risks.d.ts
+type OperationRisk = "low" | "medium" | "high" | "critical";
+/** Every `meta.risk` level, lowest first. */
+declare const OPERATION_RISKS: readonly OperationRisk[];
+declare function isOperationRisk(value: unknown): value is OperationRisk;
+//#endregion
+//#region src/core/operations.d.ts
+type OperationEffect = "read" | "write" | "delete" | "send" | "spend" | "external";
+/** Plain JSON a host reads to label, confirm or gate an operation; PermDock never decides on it. */
+type OperationMeta = {
+  readonly risk?: OperationRisk;
+  /** What running the operation does, each effect at most once. */
+  readonly effects?: readonly OperationEffect[];
+  readonly title?: string;
+};
+/**
+ * Loads the row the check runs on from the operation's input, the binding
+ * every surface shares. The row is validated against the permission's
+ * resource schema like any request-derived data (invariant 9).
+ */
+type OperationData<TInput = never> = {
+  load(input: TInput): unknown;
+}["load"];
+/** One entry of the object passed to `defineOperations`. */
+type OperationDefinition = {
+  readonly permission: Permission;
+  readonly data?: OperationData<unknown>;
+  /** The permission each result row is filtered by. */
+  readonly results?: Permission;
+  readonly meta?: OperationMeta;
+};
+/**
+ * A permission-bound action that agent tools, workflow nodes, MCP operations,
+ * HTTP routes and chat commands read by name. `TInput` is the parameter type
+ * of `data`; an operation without `data` takes `undefined`.
+ */
+type Operation<TInput = unknown, TName extends string = string, TPermission extends Permission = Permission> = {
+  readonly name: TName;
+  readonly permission: TPermission;
+  readonly data?: OperationData<TInput>;
+  readonly results?: Permission;
+  readonly meta: OperationMeta;
+};
+/** The input type of an operation: the parameter type of its `data` loader. */
+type OperationInput<TOperation> = TOperation extends Operation<infer TInput> ? TInput : never;
+type InputOf<TDefinition> = TDefinition extends {
+  readonly data: (input: infer TInput) => unknown;
+} ? TInput : undefined;
+type OperationMap<TDefinitions extends Record<string, OperationDefinition> = Record<string, OperationDefinition>> = { readonly [TName in keyof TDefinitions & string]: Operation<InputOf<TDefinitions[TName]>, TName, TDefinitions[TName]["permission"]>; };
+/**
+ * Binds each named operation to a permission of `permissions`. Throws at
+ * definition time for a permission or `results` outside the tree, a name that
+ * is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
+ * a `data` that is not a function, or meta outside the closed lists.
+ */
+declare function defineOperations<const TDefinitions extends Record<string, OperationDefinition>>(permissions: PermissionTree, definitions: TDefinitions): OperationMap<TDefinitions>;
+//#endregion
+export { OperationInput as a, defineOperations as c, isOperationRisk as d, OperationEffect as i, OPERATION_RISKS as l, OperationData as n, OperationMap as o, OperationDefinition as r, OperationMeta as s, Operation as t, OperationRisk as u };

package/dist/orpc/index.d.ts

@@ -1,9 +1,10 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
-import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { t as StreamProtectOptions } from "../stream-7-xmnf3U.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
@@ -25,7 +26,7 @@ type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = Server
   readonly revocations?: RevocationFeed;
 };
 type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, data?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   readonly security: (permission: Permission) => {
     readonly security: readonly Record<string, readonly string[]>[];
     readonly "x-permdock-permissions": readonly string[];
@@ -33,11 +34,13 @@ type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary =
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => OrpcMiddleware<TCtx, unknown, V>;
-  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  readonly getPermDock: (opts: OrpcMiddlewareOpts<TCtx>) => Promise<PermDock<V>>;
+  readonly middleware: () => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, data?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   /** A long-lived connection for the request behind `context`. */
   readonly connection: (opts: OrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly permdockHandler: () => (request: Request) => Promise<Response>;
   readonly openapi: OrpcOpenApiHooks<TCtx, V>;
 };
 /**

package/dist/orpc/index.js

@@ -1,10 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { p as isPermission } from "../permissions-DVoF6dMt.js";
-import { a as problemMessage } from "../http-SO7qGttf.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-CuzGytRf.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { o as isPermission } from "../permission-registry-Br4jSNVi.js";
+import { o as problemMessage } from "../http-BBoKefeS.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { n as attached } from "../bind-CZzhx-Vj.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-aPyNi6tA.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {
@@ -71,7 +71,7 @@ function permissionOf(procedure) {
 	}
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
+	const { kernel, bind, attach, scopeOf, connection, evaluate, guard: runGuard } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
 	/** Instances this factory built, with the tenant each was built for. */
 	const issued = /* @__PURE__ */ new WeakMap();
 	const issue = (instance, scope) => {
@@ -83,10 +83,14 @@ function createPermDock(policy, options) {
 		if (typeof bound !== "object" || bound === null || !issued.has(bound) || issued.get(bound) !== scope.tenant) return;
 		return bound;
 	};
-	const permdock = () => ((mwOptions, input) => {
+	const getPermDock = async (opts) => {
+		const scope = await scopeOf(opts);
+		return boundFor(opts.context, scope) ?? issue(await kernel.getPermDock(bind(opts), scope), scope);
+	};
+	const middleware = () => ((mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
 		const request = bind(opts);
-		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.permdock(request, scope), scope))).then((instance) => {
+		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.getPermDock(request, scope), scope))).then((instance) => {
 			if (!instance.ok) return throwOrpcError(instance.response, mwOptions.errors);
 			const nextCtx = {
 				...opts.context,
@@ -97,19 +101,17 @@ function createPermDock(policy, options) {
 		});
 	});
 	/** Wraps an event iterator so revocation ends it and unreadable items drop. */
-	const guardOutput = async (result, opts, permission, loadData, protectOptions, errors) => {
+	const guardOutput = async (result, opts, permission, data, protectOptions, errors) => {
 		const output = result !== null && typeof result === "object" && "output" in result ? result.output : void 0;
 		if (!isAsyncIterable(output)) return result;
 		return {
 			...result,
-			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
+			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, data, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
 		};
 	};
-	const protect = (permission, loadData, protectOptions) => tagged(permission, (async (mwOptions, input) => {
+	const protect = (permission, data, protectOptions) => tagged(permission, (async (mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
-		const request = bind(opts);
-		const scope = await scopeOf(opts);
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope);
+		const { request, scope, guard } = await runGuard(permission, data, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.context,
@@ -117,11 +119,11 @@ function createPermDock(policy, options) {
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions, mwOptions.errors);
+			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, data === void 0 ? void 0 : reloadAfter(guard.data, () => data(opts)), protectOptions, mwOptions.errors);
 		}
 		return throwOrpcError(guard.response, mwOptions.errors);
 	}));
-	const permdockHandler = (request) => {
+	const handler = (request) => {
 		return evaluate(request, {
 			context: { req: request },
 			path: ["permdock"],
@@ -130,10 +132,11 @@ function createPermDock(policy, options) {
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
-		permdockHandler,
+		permdockHandler: () => handler,
 		openapi: {
 			protect,
 			security: kernelOpenApi.security,

package/dist/otel/index.d.ts

@@ -1,5 +1,6 @@
-import { D as PolicyVocabulary, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-QCuYJh4q.js";
+import { j as PolicyVocabulary } from "../policy-types-DzwivBgR.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-BqAKcRNW.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/otel/index.js

@@ -1,8 +1,15 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as wrapPermDock } from "../wrap-gX61EtpB.js";
+import { r as appObligationNames } from "../ocsf-BFp-PZZA.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";
 const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
 const GEN_AI_TOOL_CALL_ID = "gen_ai.tool.call.id";
+const GEN_AI_AGENT_ID = "gen_ai.agent.id";
+const GEN_AI_REQUEST_MODEL = "gen_ai.request.model";
+const USER_ID = "user.id";
+const USER_ROLES = "user.roles";
+const ERROR_TYPE = "error.type";
 //#endregion
 //#region src/otel/instrument.ts
 const FORBIDDEN = /* @__PURE__ */ new Set([
@@ -78,9 +85,26 @@ function omitPath(attributes, path) {
 		matched: true
 	};
 }
+/**
+* `error.type` for a decision that failed: a boundary validation failure
+* always, and the first denial reason when `errorOnDeny` marks every denial
+* an error.
+*/
+function errorType(event, options) {
+	if (event.outcome !== "denied") return;
+	if (event.denials?.some((denial) => denial.reason === "validation") === true) return "validation";
+	return options.errorOnDeny === true ? event.denials?.[0]?.reason : void 0;
+}
 function attributesOf(event, options, parent) {
 	const extra = options.attributes === void 0 ? {} : options.attributes(event);
+	const actor = event.subject.actor;
+	const scopes = event.subject.delegation?.scope?.split(" ").filter((scope) => scope !== "");
 	let redacted = compact({
+		[USER_ID]: event.subject.principal?.id,
+		[USER_ROLES]: event.subject.principal?.roles,
+		[GEN_AI_AGENT_ID]: actor?.kind === "agent" ? actor.id : void 0,
+		[GEN_AI_REQUEST_MODEL]: event.model ?? parent?.attributes?.["gen_ai.request.model"],
+		[ERROR_TYPE]: errorType(event, options),
 		"permdock.outcome": event.outcome,
 		"permdock.permission": event.permission,
 		"permdock.scope": event.scope,
@@ -89,8 +113,11 @@ function attributesOf(event, options, parent) {
 		"permdock.subject.id": event.subject.principal?.id,
 		"permdock.actor.id": event.subject.actor?.id,
 		"permdock.actor.kind": event.subject.actor?.kind,
-		"permdock.delegation.scopes": event.subject.delegation?.scopes?.join(","),
+		"permdock.support_session.id": event.subject.supportSession?.id,
+		"permdock.delegation.scopes": scopes,
 		"permdock.matched.role": event.matched?.role,
+		"permdock.matched.name": event.matched?.name,
+		"permdock.obligations": appObligationNames(event),
 		"permdock.denials.count": event.denials?.length,
 		"permdock.token": event.token,
 		"permdock.validate": event.trusted ? "trusted" : "boundary",
@@ -131,9 +158,9 @@ function recordSignals(event, options, api, timing) {
 	span.setAttributes?.(attributes);
 	if (event.outcome === "denied") {
 		span.addEvent?.("permdock.denied", compact({
-			role: event.denials?.map((denial) => denial.role).join(","),
-			reason: event.denials?.map((denial) => denial.reason).join(","),
-			alternatives: event.alternatives?.join(",")
+			role: event.denials?.map((denial) => denial.role ?? ""),
+			reason: event.denials?.map((denial) => denial.reason),
+			alternatives: event.alternatives
 		}));
 		if (event.denials?.some((denial) => denial.reason === "validation") === true) span.recordException?.(/* @__PURE__ */ new Error("validation"));
 		if (options.errorOnDeny === true) span.setStatus?.({ code: SPAN_STATUS_ERROR });
@@ -170,28 +197,27 @@ function instrument(permdock, options = {}) {
 	return listen(permdock, options, resolveApi(options.api), () => void 0);
 }
 function instrumented(permdock, options, api) {
-	let started;
-	listen(permdock, options, api, () => started);
-	const timed = (fn) => (...args) => {
-		const outer = started === void 0;
-		if (outer) started = now();
-		try {
-			return fn(...args);
-		} finally {
-			if (outer) started = void 0;
-		}
-	};
-	return Object.freeze({
-		...permdock,
-		can: timed(permdock.can),
-		decide: timed(permdock.decide),
-		assert: timed(permdock.assert),
-		explain: timed(permdock.explain),
-		filter: timed(permdock.filter),
-		pick: timed(permdock.pick),
-		actions: timed(permdock.actions),
-		tenant: (id) => instrumented(permdock.tenant(id), options, api),
-		team: (id) => instrumented(permdock.team(id), options, api)
+	return wrapPermDock(permdock, (inner) => {
+		let started;
+		listen(inner, options, api, () => started);
+		const timed = (fn) => (...args) => {
+			const outer = started === void 0;
+			if (outer) started = now();
+			try {
+				return fn(...args);
+			} finally {
+				if (outer) started = void 0;
+			}
+		};
+		return {
+			can: timed(inner.can),
+			decide: timed(inner.decide),
+			assert: timed(inner.assert),
+			explain: timed(inner.explain),
+			filter: timed(inner.filter),
+			pick: timed(inner.pick),
+			actions: timed(inner.actions)
+		};
 	});
 }
 /** Returns an instrumented instance: timed spans and histogram, derived instances included. */

package/dist/output-Dyw8fyPF.js

@@ -0,0 +1,88 @@
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+//#region src/cli/core/output.ts
+const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
+function envelope(input) {
+	return {
+		$schema: CLI_RESULT_SCHEMA,
+		status: input.status,
+		...input.data === void 0 ? {} : { data: input.data },
+		...input.error === void 0 ? {} : { error: input.error },
+		...input.next === void 0 || input.next.length === 0 ? {} : { next: input.next }
+	};
+}
+/** A command's JSON report as data; text that is not JSON becomes `{ message }`. */
+function dataOf(output) {
+	const text = output.trim();
+	if (text === "") return;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return { message: text };
+	}
+}
+const LOCATION = /^([^\s:]+\.[A-Za-z0-9]+):(\d+)\b/u;
+/**
+* A finding whose `file` and `line` default to the `path:line` a message
+* opens with, the form doctor, usage and scan already print.
+*/
+function findingOf(input) {
+	if (input.file !== void 0) return input;
+	const match = LOCATION.exec(input.message);
+	if (match?.[1] === void 0 || match[2] === void 0) return input;
+	return {
+		...input,
+		file: match[1],
+		line: Number(match[2])
+	};
+}
+function escapeData(value) {
+	return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function escapeProperty(value) {
+	return escapeData(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+}
+/** GitHub Actions workflow commands, one per finding. */
+function githubAnnotations(findings) {
+	return findings.map((finding) => {
+		return `::${finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "notice"} ${[
+			...finding.file === void 0 ? [] : [`file=${escapeProperty(finding.file)}`],
+			...finding.line === void 0 ? [] : [`line=${String(finding.line)}`],
+			`title=${escapeProperty(finding.code)}`
+		].join(",")}::${escapeData(finding.fix === void 0 ? finding.message : `${finding.message}\nFix: ${finding.fix}`)}`;
+	}).join("\n");
+}
+/** A SARIF 2.1.0 log with one run, one rule per finding code. */
+function sarifLog(command, findings) {
+	const rules = [...new Set(findings.map((finding) => finding.code))].map((code) => {
+		const sample = findings.find((finding) => finding.code === code);
+		const rule = { id: code };
+		if (sample?.docs !== void 0) rule.helpUri = sample.docs;
+		if (sample?.fix !== void 0) rule.help = { text: sample.fix };
+		return rule;
+	});
+	const results = findings.map((finding) => ({
+		ruleId: finding.code,
+		level: finding.severity === "error" ? "error" : finding.severity === "warning" ? "warning" : "note",
+		message: { text: finding.message },
+		...finding.file === void 0 ? {} : { locations: [{ physicalLocation: {
+			artifactLocation: { uri: finding.file },
+			...finding.line === void 0 ? {} : { region: { startLine: finding.line } }
+		} }] }
+	}));
+	return `${JSON.stringify({
+		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
+		version: "2.1.0",
+		runs: [{
+			tool: { driver: {
+				name: `permdock ${command}`,
+				version: cliVersion(),
+				informationUri: DOCS_BASE,
+				rules
+			} },
+			results
+		}]
+	}, null, 2)}\n`;
+}
+//#endregion
+export { sarifLog as a, githubAnnotations as i, envelope as n, findingOf as r, dataOf as t };

package/dist/output-files-B3IZJksC.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-DhRBBE4n.js";

package/dist/output-files-DhRBBE4n.js

@@ -0,0 +1,138 @@
+import { i as dateAt } from "./time-DkWjdL98.js";
+import { t as shortDiff } from "./text-diff-BQcUapOb.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+/** How `path` on disk differs from `expected`; `undefined` when `same` holds. */
+function fileDrift(path, expected, same = (a, b) => a === b) {
+	if (!existsSync(path)) return { kind: "missing" };
+	const onDisk = readFileSync(path, "utf8");
+	return same(onDisk, expected) ? void 0 : {
+		kind: "differs",
+		onDisk
+	};
+}
+/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+function driftOf(cwd, files) {
+	const drift = [];
+	for (const file of files) {
+		if (file.rel === "-") continue;
+		const found = fileDrift(resolve(cwd, file.rel), file.text);
+		if (found?.kind === "missing") drift.push(`${file.part}: missing ${file.rel}`);
+		else if (found?.kind === "differs") drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, found.onDisk, file.text)}`);
+	}
+	return drift;
+}
+/** Writes every file but the stdout ones, all or nothing, and returns the stdout text for printing. */
+function writeOutputFiles(cwd, files) {
+	const onDisk = files.filter((file) => file.rel !== "-");
+	applyFiles(cwd, onDisk.map((file) => ({
+		path: file.rel,
+		text: file.text
+	})));
+	return {
+		wrote: onDisk.map((file) => file.rel),
+		printed: files.filter((file) => file.rel === "-").map((file) => file.text.trimEnd()).join("\n")
+	};
+}
+const SPLIT_PARTS = [
+	"helpers",
+	"seeds",
+	"indexes",
+	"policies",
+	"hook"
+];
+/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+function parseSplit(raw) {
+	if (raw === void 0) return;
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.filter((name) => !SPLIT_PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return SPLIT_PARTS.filter((part) => names.includes(part));
+}
+/** The path of one split part: `{part}` in `out` replaced by the part name. */
+function partPath(out, part) {
+	return out.replaceAll("{part}", part);
+}
+/**
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
+* their dependencies, so no file needs a number to apply first.
+*/
+function pgDeltaPath(root, part, schema) {
+	switch (part) {
+		case "helpers":
+		case "indexes":
+		case "seeds": return `${root}/${schema}/${part}.sql`;
+		case "policies": return `${root}/public/policies/permdock.sql`;
+		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
+		default: return part;
+	}
+}
+/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+function isSeedsDirectory(cwd, out) {
+	if (out === "-") return false;
+	if (out.endsWith("/")) return true;
+	const path = resolve(cwd, out);
+	return existsSync(path) && statSync(path).isDirectory();
+}
+/**
+* A generated data migration at `out`: a file, `-` for stdout, or a
+* migrations directory that gets a new versioned file only when the newest
+* one starting with `marker` differs. With `check`, the planned file is
+* always returned, so drift names it. `reserved` lists the files this run
+* already plans, so two data migrations never share a version.
+*/
+function dataMigrationFile(input) {
+	if (!isSeedsDirectory(input.cwd, input.out)) return {
+		part: input.part,
+		rel: input.out,
+		text: input.text
+	};
+	const planned = seedsMigration(input.cwd, input.out, input.marker, input.text, input.now, input.part, input.reserved);
+	return !planned.current || input.check ? {
+		part: input.part,
+		rel: planned.rel,
+		text: input.text
+	} : void 0;
+}
+/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
+}
+const VERSION_PREFIX = /^\d{14}(?=_)/u;
+/**
+* The version of a new migration that sorts after every migration in
+* `names`: one second past the newest, so the same directory always gives the
+* same name. Only a directory with no versioned migration falls back to `now`.
+*/
+function nextMigrationVersion(names, now) {
+	const times = names.flatMap((name) => {
+		const stamp = VERSION_PREFIX.exec(name)?.[0];
+		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
+	});
+	return times.length === 0 ? migrationVersion(now) : migrationVersion(dateAt({ epochMilliseconds: Math.max(...times) + 1e3 }));
+}
+/**
+* The seeds part in a migrations directory: the newest migration there that
+* starts with \`marker\` when its text is \`text\` already, otherwise a new
+* \`<version>_permdock_seeds.sql\` one second after the newest migration
+* (\`nextMigrationVersion\`), so a regeneration of the same directory names it
+* the same. \`current\` is false when a new one is due. \`label\` replaces
+* \`seeds\` in the file name for the other generated data migrations.
+* \`reserved\` holds paths, relative to \`cwd\`, that this run writes; the ones
+* in \`dir\` count as migrations already there.
+*/
+function seedsMigration(cwd, dir, marker, text, now, label = "seeds", reserved = []) {
+	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
+	const path = resolve(cwd, base);
+	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
+	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
+		rel: `${base}/${latest}`,
+		current: true
+	};
+	return {
+		rel: `${base}/${nextMigrationVersion([...existsSync(path) ? readdirSync(path) : [], ...reserved.filter((rel) => resolve(cwd, dirname(rel)) === path).map((rel) => basename(rel))], now)}_permdock_${label}.sql`,
+		current: false
+	};
+}
+//#endregion
+export { isSeedsDirectory as a, parseSplit as c, seedsMigration as d, writeOutputFiles as f, fileDrift as i, partPath as l, dataMigrationFile as n, migrationVersion as o, driftOf as r, nextMigrationVersion as s, SPLIT_PARTS as t, pgDeltaPath as u };