permdock 0.6.0 → 0.8.0

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { $n as Delegation, Q as LimitStore, Rt as Instant, Zn as CustomRole, ar as Subject, it as RelationSource, nr as Membership, qn as Actor, rr as Principal } from "../../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../../vocabulary-CN8H_9UF.js";
-import { i as PermDockOptions } from "../../permdock-SV8ZINYT.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-u_KHg-sN.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-77FSAq_V.js";
+import { Q as LimitStore, Rt as Instant, Zn as Actor, it as RelationSource, lr as Subject, or as Membership, rr as Delegation, sr as Principal, tr as CustomRole } from "../../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../../permission-types-CAY-GU7e.js";
+import { o as PermDockOptions } from "../../permdock-B6Sf4T_S.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Ba4bDhaj.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";
@@ -53,6 +53,7 @@ type SaasSeed = {
 export declare const SAAS_EXPIRED_AT = 1e9;
 /**
  * Users, one hazard each:
+ *
  * - alice: admin in acme, viewer in globex (different role per org)
  * - bob: member in acme (owns p1, p3, p4)
  * - carol: owner in acme
@@ -62,16 +63,21 @@ export declare const SAAS_EXPIRED_AT = 1e9;
  * - mallory: no memberships at all
  * - gina: `lead` of team-a in acme
  * - hank: viewer in acme, `collaborator` on project p3 only
- * - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+ * - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one
+ *   instant
  * - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
- * - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+ * - ivan: viewer in acme who holds the team role `lead` on the tenant membership
+ *   (the wrong scope)
  *
  * Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
  * (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
  * `eng`, frank's view of `root` expired.
  */
 export declare const saasSeed: SaasSeed;
-/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+/**
+ * The seed's folder tree and shares as a `RelationSource`, for
+ * `createPermDock({ relations })`.
+ */
 export declare function saasRelations(seed?: SaasSeed): RelationSource;
 /** Every user id in the seed. */
 export declare const saasUsers: readonly string[];
@@ -81,18 +87,18 @@ export declare function saasMemberships(user: string, members?: readonly SaasMem
 /** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
 export declare const saasCustomRoles: readonly CustomRole[];
 /**
- * The principal for `user`, with the plans of the requested `tenant`'s org.
- * The tenant itself is passed to `createPermDock({ tenant })`, never trusted
- * from here.
+ * The principal for `user`, with the plans of the requested `tenant`'s org. The
+ * tenant itself is passed to `createPermDock({ tenant })`, never trusted from
+ * here.
  */
 export declare function saasPrincipal(user: string, tenant?: string): Principal;
 //#endregion
 //#region src/testing/saas/sql.d.ts
 /**
- * Postgres tables for the SaaS domain. Column names match the resource
- * fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
- * against them without a column map. RLS is enabled and forced on the row
- * tables; policies come from `permdock rls generate`.
+ * Postgres tables for the SaaS domain. Column names match the resource fields
+ * (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile against
+ * them without a column map. RLS is enabled and forced on the row tables;
+ * policies come from `permdock rls generate`.
  */
 export declare const saasSchemaSql = "\ncreate table org (\n  id text primary key,\n  name text not null,\n  plan text not null check (plan in ('free', 'pro'))\n);\ncreate table org_member (\n  user_id text not null,\n  org_id text references org (id),\n  team_id text,\n  resource text,\n  resource_id text,\n  role text not null,\n  expires_at bigint\n);\ncreate table project (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"ownerId\" text not null,\n  name text not null,\n  archived boolean not null default false\n);\nalter table project enable row level security;\nalter table project force row level security;\ncreate table doc (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"teamId\" text,\n  title text not null,\n  locked boolean not null default false\n);\nalter table doc enable row level security;\nalter table doc force row level security;\ncreate table folder (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"parentId\" text references folder (id),\n  name text not null,\n  restricted boolean not null default false\n);\nalter table folder enable row level security;\nalter table folder force row level security;\ncreate table folder_share (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null,\n  expires_at timestamptz\n);\ncreate table folder_editor (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null\n);\n";
 /** `insert` statements for a seed; the default is the full shared seed. */
@@ -119,7 +125,10 @@ export declare const saasIssuer = "https://saas.permdock.test";
 export declare const saasAudience = "permdock-saas";
 export declare const SAAS_TOKEN_TTL_SECONDS = 3600;
 type SaasTokenOptions = {
-  /** Claim memberships; `false` omits the claim (database mode). Defaults to the seed. */
+  /**
+   * Claim memberships; `false` omits the claim (database mode). Defaults to the
+   * seed.
+   */
   readonly memberships?: readonly Membership[] | false;
   readonly ttl?: number;
   /** The instant used for `iat`; defaults to the current time. */
@@ -131,9 +140,9 @@ type SaasTokenOptions = {
 /** Signs an ES256 access token for `sub` with WebCrypto; no dependency. */
 export declare function signSaasToken(sub: string, options?: SaasTokenOptions): Promise<string>;
 /**
- * Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
- * and returns its `sub`, or `null`; never throws. Identity only: memberships
- * and plans come from the seed, never from the token.
+ * Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`) and
+ * returns its `sub`, or `null`; never throws. Identity only: memberships and
+ * plans come from the seed, never from the token.
  */
 export declare function verifySaasToken(token: string | null | undefined, now?: Instant): Promise<string | null>;
 /** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
@@ -162,8 +171,8 @@ type SaasScenario = {
    */
   readonly client?: boolean;
   /**
-   * The client outcome when it is stricter than the server's: a snapshot
-   * cannot evaluate a closure deny, so it fails closed.
+   * The client outcome when it is stricter than the server's: a snapshot cannot
+   * evaluate a closure deny, so it fails closed.
    */
   readonly clientOutcome?: SaasOutcome;
   /** An agent acting for `user`; without `delegation` it reaches nothing. */
@@ -172,23 +181,30 @@ type SaasScenario = {
   /** Units of the daily api-key quota this subject already used in the tenant. */
   readonly quotaUsed?: number;
 };
-/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+/**
+ * What the policy's `subject` receives: the principal, or a `Subject` carrying
+ * the actor.
+ */
 export declare function saasUser(scenario: SaasScenario): Principal | Subject;
 /** A memory quota store in which every subject has already used `used` units. */
 export declare function saasLimitStore(used?: number): LimitStore;
-/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+/**
+ * The `createPermDock` options a scenario runs with: tenant, custom roles,
+ * quota and folder tree.
+ */
 export declare function saasScenarioOptions(scenario: SaasScenario): PermDockOptions;
 export declare function saasProject(id: string): SaasProject;
 export declare function saasDoc(id: string): SaasDoc;
 export declare function saasFolder(id: string): SaasFolder;
 /**
- * The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
- * A snapshot carries no graph, so every graph grant is server-only on a client.
+ * The folder tree, decided with `createPermDock({ relations: saasRelations()
+ * })`. A snapshot carries no graph, so every graph grant is server-only on a
+ * client.
  */
 export declare const saasFolderScenarios: readonly SaasScenario[];
 /**
- * Hand-written expectations. Never derive `expected` from the engine: the
- * list is the oracle every adapter, ORM and client suite runs against.
+ * Hand-written expectations. Never derive `expected` from the engine: the list
+ * is the oracle every adapter, ORM and client suite runs against.
  */
 export declare const saasScenarios: readonly SaasScenario[];
 //#endregion

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-BPxlwVhN.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-BCXRuXca.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-mDcTWoBs.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-iWnUdwCt.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-u_KHg-sN.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-BPxlwVhN.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-mDcTWoBs.js";

package/dist/text-diff-BtfSmdUo.js

@@ -0,0 +1,444 @@
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/base.js
+var Diff = class {
+	diff(oldStr, newStr, options = {}) {
+		let callback;
+		if (typeof options === "function") {
+			callback = options;
+			options = {};
+		} else if ("callback" in options) callback = options.callback;
+		const oldString = this.castInput(oldStr, options);
+		const newString = this.castInput(newStr, options);
+		const oldTokens = this.removeEmpty(this.tokenize(oldString, options));
+		const newTokens = this.removeEmpty(this.tokenize(newString, options));
+		return this.diffWithOptionsObj(oldTokens, newTokens, options, callback);
+	}
+	diffWithOptionsObj(oldTokens, newTokens, options, callback) {
+		var _a;
+		const done = (value) => {
+			value = this.postProcess(value, options);
+			if (callback) {
+				setTimeout(function() {
+					callback(value);
+				}, 0);
+				return;
+			} else return value;
+		};
+		const newLen = newTokens.length, oldLen = oldTokens.length;
+		let editLength = 1;
+		let maxEditLength = newLen + oldLen;
+		if (options.maxEditLength != null) maxEditLength = Math.min(maxEditLength, options.maxEditLength);
+		const maxExecutionTime = (_a = options.timeout) !== null && _a !== void 0 ? _a : Infinity;
+		const abortAfterTimestamp = Date.now() + maxExecutionTime;
+		const bestPath = [{
+			oldPos: -1,
+			lastComponent: void 0
+		}];
+		let newPos = this.extractCommon(bestPath[0], newTokens, oldTokens, 0, options);
+		if (bestPath[0].oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(bestPath[0].lastComponent, newTokens, oldTokens));
+		let minDiagonalToConsider = -Infinity, maxDiagonalToConsider = Infinity;
+		const execEditLength = () => {
+			for (let diagonalPath = Math.max(minDiagonalToConsider, -editLength); diagonalPath <= Math.min(maxDiagonalToConsider, editLength); diagonalPath += 2) {
+				let basePath;
+				const removePath = bestPath[diagonalPath - 1], addPath = bestPath[diagonalPath + 1];
+				if (removePath) bestPath[diagonalPath - 1] = void 0;
+				let canAdd = false;
+				if (addPath) {
+					const addPathNewPos = addPath.oldPos - diagonalPath;
+					canAdd = addPath && 0 <= addPathNewPos && addPathNewPos < newLen;
+				}
+				const canRemove = removePath && removePath.oldPos + 1 < oldLen;
+				if (!canAdd && !canRemove) {
+					bestPath[diagonalPath] = void 0;
+					continue;
+				}
+				if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) basePath = this.addToPath(addPath, true, false, 0, options);
+				else basePath = this.addToPath(removePath, false, true, 1, options);
+				newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);
+				if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;
+				else {
+					bestPath[diagonalPath] = basePath;
+					if (basePath.oldPos + 1 >= oldLen) maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);
+					if (newPos + 1 >= newLen) minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);
+				}
+			}
+			editLength++;
+		};
+		if (callback) (function exec() {
+			setTimeout(function() {
+				if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) return callback(void 0);
+				if (!execEditLength()) exec();
+			}, 0);
+		})();
+		else while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {
+			const ret = execEditLength();
+			if (ret) return ret;
+		}
+	}
+	addToPath(path, added, removed, oldPosInc, options) {
+		const last = path.lastComponent;
+		if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) return {
+			oldPos: path.oldPos + oldPosInc,
+			lastComponent: {
+				count: last.count + 1,
+				added,
+				removed,
+				previousComponent: last.previousComponent
+			}
+		};
+		else return {
+			oldPos: path.oldPos + oldPosInc,
+			lastComponent: {
+				count: 1,
+				added,
+				removed,
+				previousComponent: last
+			}
+		};
+	}
+	extractCommon(basePath, newTokens, oldTokens, diagonalPath, options) {
+		const newLen = newTokens.length, oldLen = oldTokens.length;
+		let oldPos = basePath.oldPos, newPos = oldPos - diagonalPath, commonCount = 0;
+		while (newPos + 1 < newLen && oldPos + 1 < oldLen && this.equals(oldTokens[oldPos + 1], newTokens[newPos + 1], options)) {
+			newPos++;
+			oldPos++;
+			commonCount++;
+			if (options.oneChangePerToken) basePath.lastComponent = {
+				count: 1,
+				previousComponent: basePath.lastComponent,
+				added: false,
+				removed: false
+			};
+		}
+		if (commonCount && !options.oneChangePerToken) basePath.lastComponent = {
+			count: commonCount,
+			previousComponent: basePath.lastComponent,
+			added: false,
+			removed: false
+		};
+		basePath.oldPos = oldPos;
+		return newPos;
+	}
+	equals(left, right, options) {
+		if (options.comparator) return options.comparator(left, right);
+		else return left === right || !!options.ignoreCase && left.toLowerCase() === right.toLowerCase();
+	}
+	removeEmpty(array) {
+		const ret = [];
+		for (let i = 0; i < array.length; i++) if (array[i]) ret.push(array[i]);
+		return ret;
+	}
+	castInput(value, options) {
+		return value;
+	}
+	tokenize(value, options) {
+		return Array.from(value);
+	}
+	join(chars) {
+		return chars.join("");
+	}
+	postProcess(changeObjects, options) {
+		return changeObjects;
+	}
+	get useLongestToken() {
+		return false;
+	}
+	buildValues(lastComponent, newTokens, oldTokens) {
+		const components = [];
+		let nextComponent;
+		while (lastComponent) {
+			components.push(lastComponent);
+			nextComponent = lastComponent.previousComponent;
+			delete lastComponent.previousComponent;
+			lastComponent = nextComponent;
+		}
+		components.reverse();
+		const componentLen = components.length;
+		let componentPos = 0, newPos = 0, oldPos = 0;
+		for (; componentPos < componentLen; componentPos++) {
+			const component = components[componentPos];
+			if (!component.removed) {
+				if (!component.added && this.useLongestToken) {
+					let value = newTokens.slice(newPos, newPos + component.count);
+					value = value.map(function(value, i) {
+						const oldValue = oldTokens[oldPos + i];
+						return oldValue.length > value.length ? oldValue : value;
+					});
+					component.value = this.join(value);
+				} else component.value = this.join(newTokens.slice(newPos, newPos + component.count));
+				newPos += component.count;
+				if (!component.added) oldPos += component.count;
+			} else {
+				component.value = this.join(oldTokens.slice(oldPos, oldPos + component.count));
+				oldPos += component.count;
+			}
+		}
+		return components;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/line.js
+var LineDiff = class extends Diff {
+	constructor() {
+		super(...arguments);
+		this.tokenize = tokenize;
+	}
+	equals(left, right, options) {
+		if (options.ignoreWhitespace) {
+			if (!options.newlineIsToken || !left.includes("\n")) left = left.trim();
+			if (!options.newlineIsToken || !right.includes("\n")) right = right.trim();
+		} else if (options.ignoreNewlineAtEof && !options.newlineIsToken) {
+			if (left.endsWith("\n")) left = left.slice(0, -1);
+			if (right.endsWith("\n")) right = right.slice(0, -1);
+		}
+		return super.equals(left, right, options);
+	}
+};
+const lineDiff = new LineDiff();
+function diffLines(oldStr, newStr, options) {
+	return lineDiff.diff(oldStr, newStr, options);
+}
+function tokenize(value, options) {
+	if (options.stripTrailingCr) value = value.replace(/\r\n/g, "\n");
+	const retLines = [], linesAndNewlines = value.split(/(\n|\r\n)/);
+	if (!linesAndNewlines[linesAndNewlines.length - 1]) linesAndNewlines.pop();
+	for (let i = 0; i < linesAndNewlines.length; i++) {
+		const line = linesAndNewlines[i];
+		if (i % 2 && !options.newlineIsToken) retLines[retLines.length - 1] += line;
+		else retLines.push(line);
+	}
+	return retLines;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/patch/create.js
+/**
+* Returns true if the filename contains characters that require C-style
+* quoting (as used by Git and GNU diffutils in diff output).
+*/
+function needsQuoting(s) {
+	for (let i = 0; i < s.length; i++) if (s[i] < " " || s[i] > "~" || s[i] === "\"" || s[i] === "\\") return true;
+	return false;
+}
+/**
+* C-style quotes a filename, encoding special characters as escape sequences
+* and non-ASCII bytes as octal escapes. This is the inverse of
+* `parseQuotedFileName` in parse.ts.
+*
+* Non-ASCII bytes are encoded as UTF-8 before being emitted as octal escapes.
+* This matches the behaviour of both Git and GNU diffutils, which always emit
+* UTF-8 octal escapes regardless of the underlying filesystem encoding (e.g.
+* Git for Windows converts from NTFS's UTF-16 to UTF-8 internally).
+*
+* If the filename doesn't need quoting, returns it as-is.
+*/
+function quoteFileNameIfNeeded(s) {
+	if (!needsQuoting(s)) return s;
+	let result = "\"";
+	const bytes = new TextEncoder().encode(s);
+	let i = 0;
+	while (i < bytes.length) {
+		const b = bytes[i];
+		if (b === 7) result += "\\a";
+		else if (b === 8) result += "\\b";
+		else if (b === 9) result += "\\t";
+		else if (b === 10) result += "\\n";
+		else if (b === 11) result += "\\v";
+		else if (b === 12) result += "\\f";
+		else if (b === 13) result += "\\r";
+		else if (b === 34) result += "\\\"";
+		else if (b === 92) result += "\\\\";
+		else if (b >= 32 && b <= 126) result += String.fromCharCode(b);
+		else result += "\\" + b.toString(8).padStart(3, "0");
+		i++;
+	}
+	result += "\"";
+	return result;
+}
+const INCLUDE_HEADERS = {
+	includeIndex: true,
+	includeUnderline: true,
+	includeFileHeaders: true
+};
+function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {
+	let optionsObj;
+	if (!options) optionsObj = {};
+	else if (typeof options === "function") optionsObj = { callback: options };
+	else optionsObj = options;
+	if (typeof optionsObj.context === "undefined") optionsObj.context = 4;
+	const context = optionsObj.context;
+	if (optionsObj.newlineIsToken) throw new Error("newlineIsToken may not be used with patch-generation functions, only with diffing functions");
+	if (!optionsObj.callback) return diffLinesResultToPatch(diffLines(oldStr, newStr, optionsObj));
+	else {
+		const { callback } = optionsObj;
+		diffLines(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
+			const patch = diffLinesResultToPatch(diff);
+			callback(patch);
+		} }));
+	}
+	function diffLinesResultToPatch(diff) {
+		if (!diff) return;
+		diff.push({
+			value: "",
+			lines: []
+		});
+		function contextLines(lines) {
+			return lines.map(function(entry) {
+				return " " + entry;
+			});
+		}
+		const hunks = [];
+		let oldRangeStart = 0, newRangeStart = 0, curRange = [], oldLine = 1, newLine = 1;
+		for (let i = 0; i < diff.length; i++) {
+			const current = diff[i], lines = current.lines || splitLines(current.value);
+			current.lines = lines;
+			if (current.added || current.removed) {
+				if (!oldRangeStart) {
+					const prev = diff[i - 1];
+					oldRangeStart = oldLine;
+					newRangeStart = newLine;
+					if (prev) {
+						curRange = context > 0 ? contextLines(prev.lines.slice(-context)) : [];
+						oldRangeStart -= curRange.length;
+						newRangeStart -= curRange.length;
+					}
+				}
+				for (const line of lines) curRange.push((current.added ? "+" : "-") + line);
+				if (current.added) newLine += lines.length;
+				else oldLine += lines.length;
+			} else {
+				if (oldRangeStart) {
+					if (lines.length <= context * 2 && i < diff.length - 2) for (const line of contextLines(lines)) curRange.push(line);
+					else {
+						const contextSize = Math.min(lines.length, context);
+						for (const line of contextLines(lines.slice(0, contextSize))) curRange.push(line);
+						const hunk = {
+							oldStart: oldRangeStart,
+							oldLines: oldLine - oldRangeStart + contextSize,
+							newStart: newRangeStart,
+							newLines: newLine - newRangeStart + contextSize,
+							lines: curRange
+						};
+						hunks.push(hunk);
+						oldRangeStart = 0;
+						newRangeStart = 0;
+						curRange = [];
+					}
+				}
+				oldLine += lines.length;
+				newLine += lines.length;
+			}
+		}
+		for (const hunk of hunks) for (let i = 0; i < hunk.lines.length; i++) if (hunk.lines[i].endsWith("\n")) hunk.lines[i] = hunk.lines[i].slice(0, -1);
+		else {
+			hunk.lines.splice(i + 1, 0, "\");
+			i++;
+		}
+		return {
+			oldFileName,
+			newFileName,
+			oldHeader,
+			newHeader,
+			hunks
+		};
+	}
+}
+/**
+* creates a unified diff patch.
+*
+* @param patch either a single structured patch object (as returned by `structuredPatch`) or an
+*   array of them (as returned by `parsePatch`).
+* @param headerOptions behaves the same as the `headerOptions` option of `createTwoFilesPatch`.
+*   Ignored for patches where `isGit` is `true`.
+*
+* When a patch has `isGit: true`, `formatPatch` output is changed to more closely match Git's
+* output: it emits a `diff --git` header, emits Git extended headers as appropriate based on
+* properties like `isRename`, `isCreate`, `newMode`, etc, and will omit `---`/`+++` file
+* headers for patches with no hunks (e.g. renames without content changes).
+*/
+function formatPatch(patch, headerOptions) {
+	var _a, _b, _c, _d, _e, _f;
+	if (!headerOptions) headerOptions = INCLUDE_HEADERS;
+	if (Array.isArray(patch)) {
+		if (patch.length > 1 && !headerOptions.includeFileHeaders && !patch.every((p) => p.isGit)) throw new Error("Cannot omit file headers on a multi-file patch. (The result would be unparseable; how would a tool trying to apply the patch know which changes are to which file?)");
+		return patch.map((p) => formatPatch(p, headerOptions)).join("\n");
+	}
+	const ret = [];
+	if (patch.isGit) {
+		headerOptions = INCLUDE_HEADERS;
+		if (!patch.oldFileName) throw new Error("oldFileName must be specified for Git patches");
+		if (!patch.newFileName) throw new Error("newFileName must be specified for Git patches");
+		let gitOldName = patch.oldFileName;
+		let gitNewName = patch.newFileName;
+		if (patch.isCreate && gitOldName === "/dev/null") gitOldName = gitNewName.replace(/^b\//, "a/");
+		else if (patch.isDelete && gitNewName === "/dev/null") gitNewName = gitOldName.replace(/^a\//, "b/");
+		ret.push("diff --git " + quoteFileNameIfNeeded(gitOldName) + " " + quoteFileNameIfNeeded(gitNewName));
+		if (patch.isDelete) ret.push("deleted file mode " + ((_a = patch.oldMode) !== null && _a !== void 0 ? _a : "100644"));
+		if (patch.isCreate) ret.push("new file mode " + ((_b = patch.newMode) !== null && _b !== void 0 ? _b : "100644"));
+		if (patch.oldMode && patch.newMode && !patch.isDelete && !patch.isCreate) {
+			ret.push("old mode " + patch.oldMode);
+			ret.push("new mode " + patch.newMode);
+		}
+		if (patch.isRename) {
+			ret.push("rename from " + quoteFileNameIfNeeded(((_c = patch.oldFileName) !== null && _c !== void 0 ? _c : "").replace(/^a\//, "")));
+			ret.push("rename to " + quoteFileNameIfNeeded(((_d = patch.newFileName) !== null && _d !== void 0 ? _d : "").replace(/^b\//, "")));
+		}
+		if (patch.isCopy) {
+			ret.push("copy from " + quoteFileNameIfNeeded(((_e = patch.oldFileName) !== null && _e !== void 0 ? _e : "").replace(/^a\//, "")));
+			ret.push("copy to " + quoteFileNameIfNeeded(((_f = patch.newFileName) !== null && _f !== void 0 ? _f : "").replace(/^b\//, "")));
+		}
+	} else {
+		if (headerOptions.includeIndex && patch.oldFileName == patch.newFileName && patch.oldFileName !== void 0) ret.push("Index: " + patch.oldFileName);
+		if (headerOptions.includeUnderline) ret.push("===================================================================");
+	}
+	const hasHunks = patch.hunks.length > 0;
+	if (headerOptions.includeFileHeaders && patch.oldFileName !== void 0 && patch.newFileName !== void 0 && (!patch.isGit || hasHunks)) {
+		ret.push("--- " + quoteFileNameIfNeeded(patch.oldFileName) + (patch.oldHeader ? "	" + patch.oldHeader : ""));
+		ret.push("+++ " + quoteFileNameIfNeeded(patch.newFileName) + (patch.newHeader ? "	" + patch.newHeader : ""));
+	}
+	for (let i = 0; i < patch.hunks.length; i++) {
+		const hunk = patch.hunks[i];
+		const oldStart = hunk.oldLines === 0 ? hunk.oldStart - 1 : hunk.oldStart;
+		const newStart = hunk.newLines === 0 ? hunk.newStart - 1 : hunk.newStart;
+		ret.push("@@ -" + oldStart + "," + hunk.oldLines + " +" + newStart + "," + hunk.newLines + " @@");
+		for (const line of hunk.lines) ret.push(line);
+	}
+	return ret.join("\n") + "\n";
+}
+function createTwoFilesPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {
+	if (typeof options === "function") options = { callback: options };
+	if (!(options === null || options === void 0 ? void 0 : options.callback)) {
+		const patchObj = structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options);
+		if (!patchObj) return;
+		return formatPatch(patchObj, options === null || options === void 0 ? void 0 : options.headerOptions);
+	} else {
+		const { callback } = options;
+		structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, Object.assign(Object.assign({}, options), { callback: (patchObj) => {
+			if (!patchObj) callback(void 0);
+			else callback(formatPatch(patchObj, options.headerOptions));
+		} }));
+	}
+}
+/**
+* Split `text` into an array of lines, including the trailing newline character (where present)
+*/
+function splitLines(text) {
+	const hasTrailingNl = text.endsWith("\n");
+	const result = text.split("\n").map((line) => line + "\n");
+	if (hasTrailingNl) result.pop();
+	else result.push(result.pop().slice(0, -1));
+	return result;
+}
+//#endregion
+//#region src/cli/core/text-diff.ts
+const MAX_LINES = 40;
+/**
+* A unified diff from the file on disk to what the command would write, cut to
+* the first {@link MAX_LINES} lines so a CI log stays readable.
+*/
+function shortDiff(file, onDisk, next) {
+	const lines = createTwoFilesPatch(`${file} (on disk)`, `${file} (generated)`, onDisk, next, void 0, void 0, { context: 2 }).split("\n").filter((line) => !line.startsWith("=====")).filter((line, index, all) => line !== "" || index < all.length - 1);
+	if (lines.length <= MAX_LINES) return lines.join("\n");
+	const rest = lines.length - MAX_LINES;
+	return [...lines.slice(0, MAX_LINES), `… ${rest} more diff line${rest === 1 ? "" : "s"}`].join("\n");
+}
+//#endregion
+export { shortDiff as t };

package/dist/{thenable-yD7SabqG.js → thenable-BNSM1U2R.js}

@@ -3,11 +3,17 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 function isThenable(value) {
 	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
 }
-/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+/**
+* Settles a promise nobody awaits, so its rejection is not reported as
+* unhandled.
+*/
 function ignoreRejection(value) {
 	Promise.resolve(value).then(void 0, () => void 0);
 }
-/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
+/**
+* Runs a Standard Schema that must answer synchronously; an asynchronous answer
+* fails.
+*/
 function validateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
 	if (isThenable(result)) {
@@ -22,7 +28,10 @@ function validateSync(schema, value) {
 		issues: result.issues
 	};
 }
-/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
+/**
+* `validateSync` for a schema whose output must be an object; anything else is
+* `undefined`.
+*/
 function validateRecord(schema, value) {
 	const validated = validateSync(schema, value);
 	return validated.ok && isRecord(validated.value) ? validated.value : void 0;