permdock 0.6.0 → 0.8.0

package/dist/{approvals-p1PGoVjb.js → approvals-DnIBTuXE.js}

@@ -1,23 +1,26 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as problemType, o as statusProblem } from "./problem-details-cn5X30gZ.js";
-import { a as isId } from "./expiry-D4_YKRKD.js";
-import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { c as isApprovalError, s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, n as assertApprover, o as decodeApprovalCursor, r as matchesApprovers } from "./store-BDutJkDL.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
-import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { a as methodNotAllowed, c as problemResponse, d as validationProblem, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-CBYVMjwh.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as problemType, o as statusProblem } from "./problem-details-CLDgX1KV.js";
+import { a as isId } from "./expiry-6XByK0dm.js";
+import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { c as rootMembershipId } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { c as isApprovalError, s as ApprovalError } from "./types-CcUXciSj.js";
+import { a as belongsToTenant, c as decodeApprovalCursor, n as assertApprover, o as membershipTenants, r as matchesApprovers, s as approvalPageSize, u as listAllApprovals } from "./store-RNFvaJJv.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
+import { r as hasCredentials } from "./http-DKLXrFGk.js";
+import { d as unauthenticatedProblem, f as validationProblem, l as problemResponse, o as methodNotAllowed } from "./problem-BVLHFK33.js";
+import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DJicaG6f.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "./errors-BDUwg2qC.js";
-import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
+import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 //#region src/approvals/access-reviews/decide.ts
-/** Whether `by` is named as a reviewer. A link, a feed or a contact is never a reviewer. */
+/**
+* Whether `by` is named as a reviewer. A link, a feed or a contact is never a
+* reviewer.
+*/
 function accessReviewerEligible(review, by, permissions = [], now) {
 	const principal = by.principal;
 	if (principal === null || principal.kind === "link" || principal.kind === "feed" || principal.kind === "contact") return false;
@@ -27,8 +30,8 @@ function accessReviewerEligible(review, by, permissions = [], now) {
 	});
 }
 /**
-* The decision to persist, or throws. A reviewer cannot decide a holding
-* of their own principal. `holder()` matches only through `permissions`.
+* The decision to persist, or throws. A reviewer cannot decide a holding of
+* their own principal. `holder()` matches only through `permissions`.
 */
 function decideAccessReviewItem(review, item, verdict, at) {
 	const now = dateAt(at);
@@ -57,7 +60,10 @@ function json$1(status, body) {
 		headers: { "content-type": "application/json" }
 	});
 }
-/** The route a path names, the methods it allows, or `undefined` for an unknown path. */
+/**
+* The route a path names, the methods it allows, or `undefined` for an unknown
+* path.
+*/
 function parseRoute$1(url, method) {
 	const parts = url.pathname.replace(/\/+$/u, "").split("/").filter(Boolean);
 	const last = parts.at(-1);
@@ -132,8 +138,8 @@ function mapError$1(error, credentials) {
 }
 /**
 * HTTP for one access-review store: `GET` a review and its items, `POST`
-* `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is
-* not a reviewer and did not open the review gets 404.
+* `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is not
+* a reviewer and did not open the review gets 404.
 */
 function accessReviewsHandler(store, options) {
 	return async (request) => {
@@ -275,9 +281,9 @@ function itemsFrom(reviewId, holders, keys) {
 	return items;
 }
 /**
-* Opens a review of who holds `permissions` in the caller's active tenant.
-* The caller must be signed in. PermDock stores the population and does not
-* revoke anything: the application changes the source, then `markApplied`.
+* Opens a review of who holds `permissions` in the caller's active tenant. The
+* caller must be signed in. PermDock stores the population and does not revoke
+* anything: the application changes the source, then `markApplied`.
 */
 async function startAccessReview(permdock, input, options) {
 	const principal = permdock.subject.principal;
@@ -415,9 +421,9 @@ function stringList(value) {
 	return [...new Set(value)];
 }
 /**
-* A frozen copy of a delegation with only the known fields, or `undefined`
-* when a known field has the wrong type, `until` is not after `from`, or
-* the delegate and the delegator are the same principal.
+* A frozen copy of a delegation with only the known fields, or `undefined` when
+* a known field has the wrong type, `until` is not after `from`, or the
+* delegate and the delegator are the same principal.
 */
 function parseApprovalDelegation(input) {
 	const value = ownRecord(input);
@@ -475,8 +481,8 @@ function covers(entry, request, delegate, tenant, at) {
 	return entry.resources === void 0 || entry.resources.includes(request.resource.type);
 }
 /**
-* The first active delegation under which `delegate` may approve `request`,
-* or `undefined`. The delegator is resolved by `subjectFor` and checked with
+* The first active delegation under which `delegate` may approve `request`, or
+* `undefined`. The delegator is resolved by `subjectFor` and checked with
 * `assertApprover`, so relation and permission approvers use the delegator's
 * facts. A throw, a missing option or a delegator the source does not name
 * matches nobody. The delegator's own delegations are never read.
@@ -521,7 +527,61 @@ async function matchDelegation(request, delegate, options) {
 	}))).find((match) => match !== void 0);
 }
 //#endregion
+//#region src/approvals/entity-tag.ts
+/** The request without its resume `token`; every other field stays. */
+function approvalView(request) {
+	const { token: _token, ...view } = request;
+	return view;
+}
+/**
+* A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
+* `approvalView(request)` as RFC 8785 JSON. A field outside `ApprovalRequest`
+* changes the tag, so hash the stored request as is.
+*/
+function approvalEntityTag(request) {
+	return `"${sha256Digest(canonicalJson(approvalView(request)))}"`;
+}
+//#endregion
 //#region src/approvals/idempotency.ts
+/**
+* How long `approvalsHandler` keeps a response for a repeated
+* `Idempotency-Key`.
+*/
+const IDEMPOTENCY_TTL_MS = 864e5;
+/**
+* The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never
+* cross approvers.
+*/
+function idempotencyRecordKey(principalId, key) {
+	return `${principalId}\n${key}`;
+}
+function fingerprintOf(call) {
+	return `${call.action} ${call.id} ${sha256Digest(call.body)}`;
+}
+/**
+* The record `approvalsHandler` stores after `call` answered `response`: the
+* status, headers and body text, the call's fingerprint, and an expiry 24 hours
+* after `now` (epoch milliseconds, default the clock).
+*/
+async function idempotencyRecord(input) {
+	return {
+		key: idempotencyRecordKey(input.principalId, input.key),
+		response: {
+			fingerprint: fingerprintOf(input.call),
+			status: input.response.status,
+			headers: [...input.response.headers.entries()],
+			body: await input.response.clone().text()
+		},
+		expiresAt: (input.now ?? nowMillis()) + IDEMPOTENCY_TTL_MS
+	};
+}
+/**
+* Whether a stored response came from the same call: a reused key with another
+* call is refused with `422`.
+*/
+function matchesIdempotencyRecord(response, call) {
+	return response.fingerprint === fingerprintOf(call);
+}
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 function memoryIdempotencyStore() {
 	const entries = /* @__PURE__ */ new Map();
@@ -588,7 +648,6 @@ function signApproval(request, signer, options = {}) {
 }
 //#endregion
 //#region src/approvals/handler.ts
-const IDEMPOTENCY_TTL_MS = 864e5;
 const MAX_IDEMPOTENCY_KEY_LENGTH = 256;
 function problem(status, detail) {
 	return problemResponse(statusProblem(status, detail));
@@ -602,14 +661,6 @@ function json(status, body, headers = {}) {
 		}
 	});
 }
-function viewOf(request) {
-	const { token: _token, ...view } = request;
-	return view;
-}
-/** A strong RFC 9110 entity tag: the `sha-256:` digest of the view's RFC 8785 JSON. */
-function entityTag(request) {
-	return `"${sha256Digest(canonicalJson(viewOf(request)))}"`;
-}
 function entityTags(field) {
 	return field.split(",").map((tag) => tag.trim()).filter((tag) => tag !== "");
 }
@@ -619,7 +670,7 @@ function ifMatchFails(request, current) {
 	if (field === null) return false;
 	const tags = entityTags(field);
 	if (tags.includes("*")) return false;
-	return !tags.includes(entityTag(current));
+	return !tags.includes(approvalEntityTag(current));
 }
 /** RFC 9110 section 13.1.2: weak comparison. */
 function ifNoneMatchHolds(request, etag) {
@@ -635,8 +686,8 @@ function decodeSegment(segment) {
 	}
 }
 /**
-* The route the path names and the methods it allows. The handler mounts at
-* any prefix, so a path reads from its last segments; a path naming none is
+* The route the path names and the methods it allows. The handler mounts at any
+* prefix, so a path reads from its last segments; a path naming none is
 * `undefined` (`404`).
 */
 function parseRoute(url) {
@@ -702,27 +753,16 @@ async function resolveSubject(request, resolve) {
 		return null;
 	}
 }
-function membershipTenants(subject) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const tenants = /* @__PURE__ */ new Set();
-	if (principal.tenant !== void 0) tenants.add(principal.tenant);
-	for (const membership of principal.memberships ?? []) {
-		const tenant = rootMembershipId(membership);
-		if (tenant !== void 0) tenants.add(tenant);
-	}
-	return [...tenants];
-}
-function belongsToTenant(subject, tenant) {
-	return membershipTenants(subject).includes(tenant);
-}
 async function factsFor(request, subject, options) {
 	return {
 		relations: await approverRelations(request, subject, options),
 		permissions: await heldPermissions(request, subject, options.permdockFor)
 	};
 }
-/** The caller as themselves, or the first delegation that makes them an approver. */
+/**
+* The caller as themselves, or the first delegation that makes them an
+* approver.
+*/
 async function actingApprover(request, subject, requireDistinct, options) {
 	const facts = await factsFor(request, subject, options);
 	try {
@@ -770,7 +810,10 @@ function canView(request, subject, requireDistinct, options) {
 	if (request.resolvedBy === principal.id || (request.approvals ?? []).some((item) => item.by === principal.id)) return Promise.resolve(true);
 	return mayResolve(request, subject, requireDistinct, options);
 }
-/** The requester and who answered: the signed approval carries the resume token, so only they read it. */
+/**
+* The requester and who answered: the signed approval carries the resume token,
+* so only they read it.
+*/
 function party(request, principalId) {
 	return request.subject.principal?.id === principalId || request.resolvedBy === principalId || (request.approvals ?? []).some((item) => item.by === principalId);
 }
@@ -811,7 +854,10 @@ function inboxScope(url, subject) {
 }
 const MAX_BODY_BYTES = 16384;
 const MAX_NOTE_LENGTH = 2e3;
-/** An unreadable body is no note; an oversized body or note is refused, never truncated. */
+/**
+* An unreadable body is no note; an oversized body or note is refused, never
+* truncated.
+*/
 async function readNote(request) {
 	if (!(request.headers.get("content-type") ?? "").includes("application/json")) return { text: "" };
 	const read = await readBodyText(request, MAX_BODY_BYTES);
@@ -865,14 +911,6 @@ function idempotencyKey(request) {
 	if (key === void 0 || key === "" || key.length > MAX_IDEMPOTENCY_KEY_LENGTH || /["\\]/u.test(key)) return { refusal: validationProblem("Idempotency-Key must be a quoted string of 1 to 256 characters") };
 	return { key };
 }
-async function stored(response, fingerprint) {
-	return {
-		fingerprint,
-		status: response.status,
-		headers: [...response.headers.entries()],
-		body: await response.clone().text()
-	};
-}
 function approvalsHandler(store, options) {
 	const requireDistinct = options.requireDistinctApprover === true;
 	const idempotency = options.idempotency ?? memoryIdempotencyStore();
@@ -898,8 +936,8 @@ function approvalsHandler(store, options) {
 				permissions: acting.permissions
 			} : void 0
 		}));
-		return json(200, viewOf(resolved), {
-			ETag: entityTag(resolved),
+		return json(200, approvalView(resolved), {
+			ETag: approvalEntityTag(resolved),
 			...options.signer !== void 0 && resolved.status === "approved" ? signatureLink(url) : {}
 		});
 	};
@@ -933,7 +971,7 @@ function approvalsHandler(store, options) {
 						return (tenant === void 0 ? scoped.tenantless : tenants.has(tenant)) && await mayResolve(item, subject, requireDistinct, options);
 					}));
 					return json(200, compact({
-						items: page.items.filter((_, index) => eligible[index] === true).map(viewOf),
+						items: page.items.filter((_, index) => eligible[index] === true).map(approvalView),
 						next: page.next
 					}), nextLink(url, page.next));
 				}
@@ -943,19 +981,19 @@ function approvalsHandler(store, options) {
 						principalId: principal.id
 					});
 					return json(200, compact({
-						items: page.items.map(viewOf),
+						items: page.items.map(approvalView),
 						next: page.next
 					}), nextLink(url, page.next));
 				}
 				case "get": {
 					const current = await visible(route.id, subject);
 					if (current === null) return problem(404, "approval was not found");
-					const etag = entityTag(current);
+					const etag = approvalEntityTag(current);
 					if (ifNoneMatchHolds(request, etag)) return new Response(null, {
 						status: 304,
 						headers: { ETag: etag }
 					});
-					return json(200, viewOf(current), { ETag: etag });
+					return json(200, approvalView(current), { ETag: etag });
 				}
 				case "signature": {
 					const current = await findById(store, route.id);
@@ -973,15 +1011,27 @@ function approvalsHandler(store, options) {
 					const read = await readNote(request);
 					if (read.refusal !== void 0) return read.refusal;
 					if (keyed.key === void 0) return await resolve(request, url, route, subject, read);
-					const key = `${principal.id}\n${keyed.key}`;
-					const fingerprint = `${route.kind} ${route.id} ${sha256Digest(read.text)}`;
+					const call = {
+						action: route.kind,
+						id: route.id,
+						body: read.text
+					};
+					const key = idempotencyRecordKey(principal.id, keyed.key);
 					const replay = await idempotency.get(key);
-					if (replay !== void 0) return replay.fingerprint === fingerprint ? new Response(replay.body, {
+					if (replay !== void 0) return matchesIdempotencyRecord(replay, call) ? new Response(replay.body, {
 						status: replay.status,
 						headers: replay.headers.map(([name, value]) => [name, value])
 					}) : problem(422, "Idempotency-Key was used for another request");
 					const response = await resolve(request, url, route, subject, read);
-					if (response.ok) await idempotency.set(key, await stored(response, fingerprint), nowMillis() + IDEMPOTENCY_TTL_MS);
+					if (response.ok) {
+						const record = await idempotencyRecord({
+							principalId: principal.id,
+							key: keyed.key,
+							call,
+							response
+						});
+						await idempotency.set(record.key, record.response, record.expiresAt);
+					}
 					return response;
 				}
 				default: return problem(404, `unknown approvals route ${String(route)}`);
@@ -992,4 +1042,4 @@ function approvalsHandler(store, options) {
 	};
 }
 //#endregion
-export { matchDelegation as a, memoryAccessReviewStore as c, accessReviewsHandler as d, accessReviewerEligible as f, memoryIdempotencyStore as i, pageAccessReviewItems as l, approvalSignatureClaims as n, memoryApprovalDelegationSource as o, decideAccessReviewItem as p, signApproval as r, parseApprovalDelegation as s, approvalsHandler as t, startAccessReview as u };
+export { accessReviewerEligible as _, idempotencyRecordKey as a, approvalEntityTag as c, memoryApprovalDelegationSource as d, parseApprovalDelegation as f, accessReviewsHandler as g, startAccessReview as h, idempotencyRecord as i, approvalView as l, pageAccessReviewItems as m, approvalSignatureClaims as n, matchesIdempotencyRecord as o, memoryAccessReviewStore as p, signApproval as r, memoryIdempotencyStore as s, approvalsHandler as t, matchDelegation as u, decideAccessReviewItem as v };

package/dist/{approvers-CqPOLD-o.js → approvers-B4r0N_Uz.js}

@@ -1,6 +1,9 @@
 import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 //#region src/core/approvers.ts
-/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+/**
+* Approves when the approver holds `permission` in the request's tenant (any
+* role, custom roles included).
+*/
 function holder(permission) {
 	const key = permission?.key;
 	if (typeof key !== "string" || key === "") throw new Error("PermDock: holder() needs a permission");
@@ -38,7 +41,10 @@ function flattenApprovers(input) {
 	if (isReadonlyArray(input)) return input;
 	return [input];
 }
-/** Every approver `input` names, inside `anyOf` groups too, for reading facts and labels. */
+/**
+* Every approver `input` names, inside `anyOf` groups too, for reading facts
+* and labels.
+*/
 function approverLeaves(input) {
 	return flattenApprovers(input).flatMap((item) => item.kind === "any-of" ? item.of.flatMap((entry) => approverLeaves(entry)) : [item]);
 }

package/dist/{arazzo-41WuzHou.js → arazzo-3RhGfkAK.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, u as permissionsFlag } from "./flags-C3DktBDY.js";
+import { c as given, u as permissionsFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/arazzo.ts
 const check = defineLeaf({
 	flags: {
@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-CaUVBn7D.js")).runArazzo({
+		return (await import("./arazzo-B5-ulWif.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-CaUVBn7D.js → arazzo-B5-ulWif.js}

@@ -1,9 +1,9 @@
-import { p as arazzoFindings } from "./src-Cu2m75uo.js";
-import { c as missingInput } from "./errors-CWTY6uih.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as ARAZZO_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
-import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+import { _ as arazzoFindings } from "./src-DZ0l9UAg.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{args-IIolxxKA.js → args-0FrVs5EH.js}

@@ -1,5 +1,115 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { closest, distance } from "fastest-levenshtein";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+//#region ../../node_modules/.pnpm/fastest-levenshtein@1.0.16/node_modules/fastest-levenshtein/esm/mod.js
+const peq = /* @__PURE__ */ new Uint32Array(65536);
+const myers_32 = (a, b) => {
+	const n = a.length;
+	const m = b.length;
+	const lst = 1 << n - 1;
+	let pv = -1;
+	let mv = 0;
+	let sc = n;
+	let i = n;
+	while (i--) peq[a.charCodeAt(i)] |= 1 << i;
+	for (i = 0; i < m; i++) {
+		let eq = peq[b.charCodeAt(i)];
+		const xv = eq | mv;
+		eq |= (eq & pv) + pv ^ pv;
+		mv |= ~(eq | pv);
+		pv &= eq;
+		if (mv & lst) sc++;
+		if (pv & lst) sc--;
+		mv = mv << 1 | 1;
+		pv = pv << 1 | ~(xv | mv);
+		mv &= xv;
+	}
+	i = n;
+	while (i--) peq[a.charCodeAt(i)] = 0;
+	return sc;
+};
+const myers_x = (b, a) => {
+	const n = a.length;
+	const m = b.length;
+	const mhc = [];
+	const phc = [];
+	const hsize = Math.ceil(n / 32);
+	const vsize = Math.ceil(m / 32);
+	for (let i = 0; i < hsize; i++) {
+		phc[i] = -1;
+		mhc[i] = 0;
+	}
+	let j = 0;
+	for (; j < vsize - 1; j++) {
+		let mv = 0;
+		let pv = -1;
+		const start = j * 32;
+		const vlen = Math.min(32, m) + start;
+		for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] |= 1 << k;
+		for (let i = 0; i < n; i++) {
+			const eq = peq[a.charCodeAt(i)];
+			const pb = phc[i / 32 | 0] >>> i & 1;
+			const mb = mhc[i / 32 | 0] >>> i & 1;
+			const xv = eq | mv;
+			const xh = ((eq | mb) & pv) + pv ^ pv | eq | mb;
+			let ph = mv | ~(xh | pv);
+			let mh = pv & xh;
+			if (ph >>> 31 ^ pb) phc[i / 32 | 0] ^= 1 << i;
+			if (mh >>> 31 ^ mb) mhc[i / 32 | 0] ^= 1 << i;
+			ph = ph << 1 | pb;
+			mh = mh << 1 | mb;
+			pv = mh | ~(xv | ph);
+			mv = ph & xv;
+		}
+		for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] = 0;
+	}
+	let mv = 0;
+	let pv = -1;
+	const start = j * 32;
+	const vlen = Math.min(32, m - start) + start;
+	for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] |= 1 << k;
+	let score = m;
+	for (let i = 0; i < n; i++) {
+		const eq = peq[a.charCodeAt(i)];
+		const pb = phc[i / 32 | 0] >>> i & 1;
+		const mb = mhc[i / 32 | 0] >>> i & 1;
+		const xv = eq | mv;
+		const xh = ((eq | mb) & pv) + pv ^ pv | eq | mb;
+		let ph = mv | ~(xh | pv);
+		let mh = pv & xh;
+		score += ph >>> m - 1 & 1;
+		score -= mh >>> m - 1 & 1;
+		if (ph >>> 31 ^ pb) phc[i / 32 | 0] ^= 1 << i;
+		if (mh >>> 31 ^ mb) mhc[i / 32 | 0] ^= 1 << i;
+		ph = ph << 1 | pb;
+		mh = mh << 1 | mb;
+		pv = mh | ~(xv | ph);
+		mv = ph & xv;
+	}
+	for (let k = start; k < vlen; k++) peq[b.charCodeAt(k)] = 0;
+	return score;
+};
+const distance = (a, b) => {
+	if (a.length < b.length) {
+		const tmp = b;
+		b = a;
+		a = tmp;
+	}
+	if (b.length === 0) return a.length;
+	if (a.length <= 32) return myers_32(a, b);
+	return myers_x(a, b);
+};
+const closest = (str, arr) => {
+	let min_distance = Infinity;
+	let min_index = 0;
+	for (let i = 0; i < arr.length; i++) {
+		const dist = distance(str, arr[i]);
+		if (dist < min_distance) {
+			min_distance = dist;
+			min_index = i;
+		}
+	}
+	return arr[min_index];
+};
+//#endregion
 //#region src/cli/core/context.ts
 /** Flags every command accepts, read from anywhere before `--`. */
 const GLOBAL_FLAGS = {
@@ -75,7 +185,10 @@ function suggestion(given, names) {
 	const best = didYouMean(given, names);
 	return best === void 0 ? "" : ` Did you mean ${best}?`;
 }
-/** Every spelling a flag set accepts: `--name`, `--no-name` for booleans, `-x` aliases. */
+/**
+* Every spelling a flag set accepts: `--name`, `--no-name` for booleans, `-x`
+* aliases.
+*/
 function lookupOf(flags) {
 	const lookup = /* @__PURE__ */ new Map();
 	for (const [name, flag] of Object.entries(flags)) {
@@ -97,7 +210,10 @@ function lookupOf(flags) {
 function flagSpellings(flags) {
 	return [...lookupOf(flags).keys()];
 }
-/** A value never starts with `-`, bar `-` itself: `--out --check` is a bare `--out`. */
+/**
+* A value never starts with `-`, bar `-` itself: `--out --check` is a bare
+* `--out`.
+*/
 function isValue(token) {
 	return token !== void 0 && (token === "-" || !token.startsWith("-"));
 }
@@ -108,8 +224,8 @@ function checkEnum(command, name, flag, value) {
 	if (flag.type === "enum" && !flag.options.includes(value)) throw new CliError("usage", `${command}: --${name} ${value === "" ? "needs a value" : `'${value}' is not one of ${flag.options.join(", ")}`}.${suggestion(value, flag.options)}`, { code: "invalid_value" });
 }
 /**
-* Splits argv into the flags `flags` declares, positionals and the tokens
-* after `--`. An undeclared flag is a usage error naming the nearest one.
+* Splits argv into the flags `flags` declares, positionals and the tokens after
+* `--`. An undeclared flag is a usage error naming the nearest one.
 * `--name=value`, `--name value`, `--no-name` and `-x` aliases all read.
 */
 function parseFlags(command, argv, flags) {
@@ -134,11 +250,12 @@ function parseFlags(command, argv, flags) {
 		const flag = flags[found.name];
 		if (flag === void 0) continue;
 		if (flag.type === "boolean") {
-			if (eq !== -1) {
+			if (eq === -1) values.set(found.name, !found.negated);
+			else {
 				const raw = token.slice(eq + 1);
 				if (raw !== "true" && raw !== "false") throw new CliError("usage", `${command}: ${spelling} takes true or false, got '${raw}'`, { code: "invalid_value" });
 				values.set(found.name, raw === "true" !== found.negated);
-			} else values.set(found.name, !found.negated);
+			}
 			continue;
 		}
 		let value;

package/dist/astro/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
 import { APIContext, MiddlewareHandler } from "astro";
 //#region src/astro/create.d.ts
 type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;
@@ -12,7 +12,10 @@ type AstroPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVoc
   readonly permdock: PermDock<V>;
   readonly permdockData: TData;
 };
-/** The context a wrapped endpoint receives: its own `APIContext` with typed `locals`. */
+/**
+ * The context a wrapped endpoint receives: its own `APIContext` with typed
+ * `locals`.
+ */
 type AstroPermDockContext<TContext extends APIContext = APIContext, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TContext & {
   readonly locals: AstroPermDockLocals<TData, V>;
 };
@@ -23,18 +26,33 @@ type AstroProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
   <TOperation extends Operation>(operation: TOperation, input?: ContextReader<APIContext, OperationInput<TOperation>>, protectOptions?: ProtectOptions): AstroGuarded<unknown, V>;
 };
 type AstroPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** `onRequest` in `src/middleware.ts`: sets `context.locals.permdock`; a bad Web Bot Auth signature is a `401`. */
+  /**
+   * `onRequest` in `src/middleware.ts`: sets `context.locals.permdock`; a bad
+   * Web Bot Auth signature is a `401`.
+   */
   readonly middleware: () => MiddlewareHandler;
-  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  /**
+   * `export const DELETE = protect(permissions.post.delete,
+   * loadPost)(handler)`.
+   */
   readonly protect: AstroProtect<V>;
-  /** Types `context.locals.permdock` for an endpoint and answers a thrown PermDock error with Problem Details. */
+  /**
+   * Types `context.locals.permdock` for an endpoint and answers a thrown
+   * PermDock error with Problem Details.
+   */
   readonly withPermDock: AstroGuarded<unknown, V>;
-  /** The instance for an endpoint, an action or a page's frontmatter (`Astro` is an `APIContext`). */
+  /**
+   * The instance for an endpoint, an action or a page's frontmatter (`Astro` is
+   * an `APIContext`).
+   */
   readonly getPermDock: (context: APIContext) => Promise<PermDock<V>>;
   /** The snapshot a page passes to a `permdock/react` island. */
   readonly getSnapshot: (context: APIContext, query?: SnapshotQuery) => Promise<Snapshot>;
   readonly connection: (context: APIContext, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  /** `export const { GET, POST } = permdockHandler()` in `src/pages/api/permdock.ts`. */
+  /**
+   * `export const { GET, POST } = permdockHandler()` in
+   * `src/pages/api/permdock.ts`.
+   */
   readonly permdockHandler: () => PermDockHandlers<APIContext>;
   readonly openapi: OpenApiHooks;
 };

package/dist/astro/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
 //#region src/astro/create.ts
 const route = {
 	context: (context) => context,