permdock 0.7.0 → 0.8.0

package/dist/{usage-Bybmck7f.js → usage-CxEzS4ey.js}

@@ -1,13 +1,13 @@
-import { a as getResource } from "./permission-registry-DpPtSKNZ.js";
-import { u as usageResult } from "./errors-DpP_U6Bf.js";
-import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
-import { r as runCollect } from "./collect-BaWeMjwV.js";
+import { a as getResource } from "./permission-registry-B8tYxPIt.js";
+import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { r as runCollect } from "./collect-B7ZFAJU3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
-import { r as findingOf } from "./output-DgSDLrta.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { r as findingOf } from "./output-tkju6U7R.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -15,7 +15,10 @@ import { createJiti } from "jiti";
 import { Visitor, parseSync } from "oxc-parser";
 import { isBuiltin } from "node:module";
 //#region src/cli/doctor/source.ts
-/** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
+/**
+* Entries a client file must not import; `tests/cli/doctor-entries.test.ts`
+* keeps it in step with `exports`.
+*/
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",
 	"permdock/agent",
@@ -112,7 +115,10 @@ function withoutComments(source) {
 function isClientSource(source, clientEntries) {
 	return clientEntries.has(source.file) || source.text.includes("'use client'") || source.text.includes("\"use client\"") || source.file.includes(".client.");
 }
-/** Specifiers a module loads at runtime: value imports, re-exports and literal dynamic imports. */
+/**
+* Specifiers a module loads at runtime: value imports, re-exports and literal
+* dynamic imports.
+*/
 function runtimeSpecifiers(source) {
 	const { module } = parseSync(source.file, source.text);
 	const out = /* @__PURE__ */ new Set();
@@ -132,10 +138,10 @@ function realFile(path) {
 	}
 }
 /**
-* A resolver for imports of `file`, the way the bundler resolves them:
-* relative paths with or without an extension, the `paths` of the nearest
-* `tsconfig.json`, and package names through `node_modules` and each
-* package's `exports`. An unresolvable specifier gives `undefined`.
+* A resolver for imports of `file`, the way the bundler resolves them: relative
+* paths with or without an extension, the `paths` of the nearest
+* `tsconfig.json`, and package names through `node_modules` and each package's
+* `exports`. An unresolvable specifier gives `undefined`.
 */
 function resolverFor(file) {
 	const jiti = createJiti(file, { tsconfigPaths: dirname(file) });
@@ -222,7 +228,7 @@ function pd010(sources) {
 }
 function pd011(sources) {
 	const findings = [];
-	for (const source of sources) if (/tenant['"]?\s*:\s*['"]hd['"]/u.test(source.text) || /accounts\.google\.com/u.test(source.text) && /tenant/.test(source.text)) findings.push({
+	for (const source of sources) if (/tenant['"]?\s*:\s*['"]hd['"]/u.test(source.text) || /accounts\.google\.com/u.test(source.text) && source.text.includes("tenant")) findings.push({
 		code: "PD011",
 		severity: "warning",
 		message: `${source.file} reads tenant from an optional issuer claim`,
@@ -355,7 +361,10 @@ function pd015(sources) {
 	return findings;
 }
 const SUPABASE_SUBJECT_CALL = /\bsubjectFromSupabase(?:Session)?\s*\(/gu;
-/** Top-level arguments of the call whose `(` ends at `open`, or undefined when unbalanced. */
+/**
+* Top-level arguments of the call whose `(` ends at `open`, or undefined when
+* unbalanced.
+*/
 function callArguments(text, open) {
 	const args = [];
 	let depth = 0;
@@ -382,7 +391,10 @@ function callArguments(text, open) {
 		}
 	}
 }
-/** The claim a `subjectFromSupabase` call reads the tenant from, or undefined when the options are not a literal. */
+/**
+* The claim a `subjectFromSupabase` call reads the tenant from, or undefined
+* when the options are not a literal.
+*/
 function readTenantClaim(options, fallback) {
 	if (options === void 0) return fallback;
 	if (!options.startsWith("{")) return;
@@ -409,9 +421,9 @@ function pd038(sources, tenantClaim, fallback) {
 	return findings;
 }
 /**
-* PD057: `rls.anonymousSignIns` is `'deny'`, so RLS refuses `signInAnonymously()` users, but a
-* `subjectFromSupabase(Session)` call maps them as signed-in users. Options that are not a
-* literal object are not read.
+* PD057: `rls.anonymousSignIns` is `'deny'`, so RLS refuses
+* `signInAnonymously()` users, but a `subjectFromSupabase(Session)` call maps
+* them as signed-in users. Options that are not a literal object are not read.
 */
 function pd057(sources) {
 	const findings = [];
@@ -433,7 +445,10 @@ function pd057(sources) {
 	return findings;
 }
 const EXCHANGE_CALL = /\bexchangeCapability\s*\(/gu;
-/** PD041: `exchangeCapability` signing link tokens with the project's shared JWT secret. */
+/**
+* PD041: `exchangeCapability` signing link tokens with the project's shared JWT
+* secret.
+*/
 function pd041(sources) {
 	const findings = [];
 	for (const source of sources) for (const match of source.text.matchAll(EXCHANGE_CALL)) {
@@ -453,7 +468,10 @@ function pd041(sources) {
 const PROTECT_CALL = /\bprotect\s*\(/gu;
 const ID_ROUTE = /['"`](\/[^'"`\s]*(?::[A-Za-z_$][\w$]*|\{[A-Za-z_$][\w$]*\})[^'"`\s]*)['"`]/gu;
 const DYNAMIC_SEGMENT = /(?:^|[\\/])(\[[^\]/\\]+\])(?=[\\/])/u;
-/** The id-bearing route a `protect` call at `index` sits in: the file's dynamic segment, or a route literal earlier in the same statement. */
+/**
+* The id-bearing route a `protect` call at `index` sits in: the file's dynamic
+* segment, or a route literal earlier in the same statement.
+*/
 function idRouteOf(source, index) {
 	const segment = DYNAMIC_SEGMENT.exec(source.file);
 	if (segment !== null) return segment[1];
@@ -461,7 +479,10 @@ function idRouteOf(source, index) {
 	const start = Math.max(window.lastIndexOf(";"), window.lastIndexOf("\n\n"));
 	return [...window.slice(start + 1).matchAll(ID_ROUTE)].at(-1)?.[1];
 }
-/** PD036: a `protect(permission)` with no row loader on a route whose path names an object id (BOLA, OWASP API1). */
+/**
+* PD036: a `protect(permission)` with no row loader on a route whose path names
+* an object id (BOLA, OWASP API1).
+*/
 function pd036(sources) {
 	const findings = [];
 	for (const source of sources) {
@@ -709,8 +730,11 @@ function ignored(key, patterns) {
 	});
 }
 function formatUsage(report) {
-	const lines = ["permdock usage", ""];
-	lines.push(`  defined but unused (${String(report.unused.length)})`);
+	const lines = [
+		"permdock usage",
+		"",
+		`  defined but unused (${String(report.unused.length)})`
+	];
 	for (const finding of report.unused) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
 	lines.push("");
 	lines.push(`  used but ungranted (${String(report.ungranted.length)})`);

package/dist/{usage-CDaLXCfL.js → usage-ab0PdusX.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-aaeRAdiD.js";
+import { a as failOnFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-y-kBNdqs.js")).runUsage({
+		return (await import("./usage-CYeXek0p.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{validation-error-ZfUHbKvf.js → validation-error-CYg2kJEw.js}

@@ -1,6 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 //#region src/core/validation-error.ts
-/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+/**
+* The base of every Problem Details `type` URI; defined here so a validation
+* error does not pull in the Problem Details builders.
+*/
 const PROBLEM_BASE = "https://permdock.com/problems";
 var PermDockValidationError = class extends Error {
 	name = "PermDockValidationError";

package/dist/{validation-error-CQpoquwj.d.ts → validation-error-YGg2mXyH.d.ts}

@@ -1,7 +1,10 @@
-import { a as ProblemDetails } from "./errors-B_Qg9D3e.js";
+import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
-/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+/**
+ * The base of every Problem Details `type` URI; defined here so a validation
+ * error does not pull in the Problem Details builders.
+ */
 declare const PROBLEM_BASE = "https://permdock.com/problems";
 declare class PermDockValidationError extends Error {
   override readonly name: "PermDockValidationError";

package/dist/{validity-CZ7-y0Cj.js → validity-Buc7w8E9.js}

@@ -1,6 +1,6 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
+import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
 //#region src/core/fields.ts
 function sanitizeFields(fields) {
 	if (fields === void 0) return;
@@ -26,9 +26,9 @@ function sanitizeContext(value) {
 //#endregion
 //#region src/core/validity.ts
 /**
-* The normalised validity of a grant, or `undefined` when neither bound is
-* set. Fail-closed at definition time: a bound that does not parse, or a
-* window that ends before it starts, throws so a typo never widens a grant.
+* The normalised validity of a grant, or `undefined` when neither bound is set.
+* Fail-closed at definition time: a bound that does not parse, or a window that
+* ends before it starts, throws so a typo never widens a grant.
 */
 function normalizeValidity(options, permissionKey) {
 	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
@@ -42,7 +42,10 @@ function normalizeValidity(options, permissionKey) {
 		...until === void 0 ? {} : { until }
 	});
 }
-/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
+/**
+* Whether a grant with this validity applies at `now` (Unix seconds); no
+* validity always applies.
+*/
 function isActive(validity, now) {
 	if (validity === void 0) return true;
 	if (validity.from !== void 0 && now < validity.from) return false;
@@ -56,9 +59,9 @@ function wireValidity(validity) {
 	});
 }
 /**
-* The validity of a wire grant. A malformed window fails closed for the
-* grant's effect: an allow never applies (`{ from: +∞ }`), a deny always
-* does (no window), so a corrupt bound can never lift a deny.
+* The validity of a wire grant. A malformed window fails closed for the grant's
+* effect: an allow never applies (`{ from: +∞ }`), a deny always does (no
+* window), so a corrupt bound can never lift a deny.
 */
 function readWireValidity(value, effect = "allow") {
 	if (value === void 0) return;

package/dist/{verifier-DHuh-okk.js → verifier-DUV6pLqZ.js}

@@ -1,6 +1,6 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
+import { p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
@@ -145,7 +145,10 @@ function secretBytes(secret) {
 	if (typeof secret === "string") return new TextEncoder().encode(secret);
 	return secret;
 }
-/** The verifier options of a subject config: `audience: false` means none is checked. */
+/**
+* The verifier options of a subject config: `audience: false` means none is
+* checked.
+*/
 function verifierOptions(options) {
 	const { audience, ...rest } = options;
 	return audience === false || audience === void 0 ? rest : {
@@ -348,7 +351,10 @@ function configuredKeys(listed) {
 function isObject(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/** Whether `key` may decrypt a token with this header: encryption use, matching `alg` and `kid`, and private material. */
+/**
+* Whether `key` may decrypt a token with this header: encryption use, matching
+* `alg` and `kid`, and private material.
+*/
 function mayDecrypt(key, header) {
 	if (!isObject(key)) return false;
 	if (key["use"] !== void 0 && key["use"] !== "enc") return false;