permdock 0.3.1 → 0.5.0

package/dist/resend/index.js

@@ -0,0 +1,379 @@
+import { t as compact } from "../compact-CAf557ZB.js";
+import { a as ownRecord } from "../paths-DXSHAMIa.js";
+import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
+import { l as isRfc3339, p as nowSeconds } from "../time-DkWjdL98.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { t as deliveryEvent } from "../delivery-event-xX4obB8F.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
+import { a as methodNotAllowed, c as problemResponse } from "../problem-CTviyH5L.js";
+import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
+import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
+import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+//#region src/resend/approval-email.ts
+const HTML_ESCAPES = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+function escapeHtml(value) {
+	return value.replaceAll(/[&<>"']/gu, (char) => HTML_ESCAPES[char] ?? char);
+}
+function oneLine(value) {
+	return value.replaceAll(/\s+/gu, " ").trim();
+}
+function requesterLine(prompt) {
+	const principal = prompt.requester.principal?.id ?? "an anonymous caller";
+	const actor = prompt.requester.actor;
+	return actor === void 0 ? `Requested by ${principal}` : `Requested by ${principal} through ${actor.kind} ${actor.id}`;
+}
+/**
+* The default approval prompt email: an `approval`-category message whose
+* one link opens the app's approval page for the request. It carries no
+* approve or reject link; the signed-in approver decides on that page.
+* Throws a `TypeError` for an approval page that is not https. Replace it
+* with a React Email template by building the same `EmailMessage`.
+*/
+function approvalEmail(prompt, options) {
+	const url = approvalUrlFor(prompt, options.approvalUrl);
+	const title = oneLine(prompt.operation?.title ?? prompt.detail);
+	const resource = prompt.resource.id === void 0 ? prompt.resource.type : `${prompt.resource.type} ${prompt.resource.id}`;
+	const lines = [
+		prompt.detail,
+		"",
+		`${requesterLine(prompt)}.`,
+		`Permission: ${prompt.permission} on ${resource}`,
+		...prompt.operation?.risk === void 0 ? [] : [`Risk: ${prompt.operation.risk}`],
+		`Expires ${prompt.expiresAt}`,
+		"",
+		`Review the request: ${url}`,
+		"",
+		`This link opens the approval page. Nothing is approved until you decide there${options.product === void 0 ? "" : ` in ${options.product}`}.`
+	];
+	const facts = lines.slice(2, lines.indexOf("", 2)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+	const html = [
+		`<p>${escapeHtml(prompt.detail)}</p>`,
+		`<ul>${facts}</ul>`,
+		`<p><a href="${escapeHtml(url)}">Review the request</a></p>`,
+		`<p>${escapeHtml(lines.at(-1) ?? "")}</p>`
+	].join("\n");
+	return Object.freeze({
+		subject: `Approval needed: ${title}`,
+		text: lines.join("\n"),
+		html,
+		category: "approval"
+	});
+}
+//#endregion
+//#region src/resend/transport.ts
+/** Resend's tag charset, at most 256 characters. */
+const TAG = /^[A-Za-z0-9_-]{1,256}$/u;
+const DELIVERY_TAG = "permdock_delivery";
+const KEY_TAG = "permdock_key";
+const CATEGORY_TAG = "permdock_category";
+const RESERVED_TAGS = /* @__PURE__ */ new Set([
+	DELIVERY_TAG,
+	KEY_TAG,
+	CATEGORY_TAG
+]);
+const RETRYABLE = {
+	rate_limit_exceeded: "rate-limited",
+	daily_quota_exceeded: "quota-exceeded",
+	monthly_quota_exceeded: "quota-exceeded",
+	concurrent_idempotent_requests: "unavailable",
+	internal_server_error: "unavailable",
+	application_error: "unavailable"
+};
+const FINAL = {
+	invalid_api_key: "unauthorized",
+	missing_api_key: "unauthorized",
+	restricted_api_key: "unauthorized",
+	invalid_access: "unauthorized",
+	invalid_from_address: "invalid-message",
+	invalid_attachment: "invalid-message",
+	validation_error: "rejected"
+};
+/**
+* The failure a Resend error name means. Rate limits, quotas and server
+* errors are retryable with the same idempotency key; a key, sender or
+* validation error is final. An unknown name is retryable only for a 5xx or
+* a missing status.
+*/
+function resendFailure(error) {
+	const name = error.name;
+	const retryable = Object.hasOwn(RETRYABLE, name) ? RETRYABLE[name] : void 0;
+	if (retryable !== void 0) return {
+		status: "failed",
+		cause: retryable,
+		retryable: true,
+		reason: name
+	};
+	const final = Object.hasOwn(FINAL, name) ? FINAL[name] : void 0;
+	if (final !== void 0) return {
+		status: "failed",
+		cause: final,
+		retryable: false,
+		reason: name
+	};
+	const status = error.statusCode;
+	return status === null || status >= 500 ? {
+		status: "failed",
+		cause: "unavailable",
+		retryable: true,
+		reason: name
+	} : {
+		status: "failed",
+		cause: "rejected",
+		retryable: false,
+		reason: name
+	};
+}
+const UNAVAILABLE = Object.freeze({
+	status: "failed",
+	cause: "unavailable",
+	retryable: true,
+	reason: "request failed"
+});
+function checkTags(tags) {
+	return Object.entries(tags).map(([name, value]) => {
+		if (!TAG.test(name) || !TAG.test(value) || RESERVED_TAGS.has(name)) throw new TypeError(`PermDock: Resend tag ${JSON.stringify(name)} is reserved or outside [A-Za-z0-9_-]`);
+		return {
+			name,
+			value
+		};
+	});
+}
+const REFUSED = Object.freeze({
+	status: "failed",
+	cause: "invalid-recipient",
+	retryable: false
+});
+async function sendBatch(resend, items, payloadOf) {
+	const results = items.map(() => REFUSED);
+	const valid = items.flatMap((item, index) => isDeliveryTarget(item.target, "email") ? [index] : []);
+	if (valid.length === 0 || resend.batch === void 0) return results;
+	const key = `pdb_${bytesToBase64Url(sha256(JSON.stringify(valid.map((index) => items[index]?.options.idempotencyKey))))}`;
+	let answer;
+	try {
+		answer = await resend.batch.send(valid.flatMap((index) => {
+			const item = items[index];
+			return item === void 0 ? [] : [payloadOf(item.target, item.message, item.options)];
+		}), { idempotencyKey: key });
+	} catch {
+		answer = void 0;
+	}
+	for (const [offset, index] of valid.entries()) {
+		if (answer === void 0) {
+			results[index] = UNAVAILABLE;
+			continue;
+		}
+		if (answer.error !== null) {
+			results[index] = resendFailure(answer.error);
+			continue;
+		}
+		const id = answer.data.data[offset]?.id;
+		results[index] = id === void 0 ? UNAVAILABLE : {
+			status: "sent",
+			providerId: id
+		};
+	}
+	return results;
+}
+/**
+* Sends the email channel of `permdock/delivery` through Resend. The
+* idempotency key is Resend's `idempotencyKey`. The delivery id, key and
+* category travel as tags, so `resendWebhook` can join provider events to
+* the delivery. Two or more recipients go out through `batch.send`, up to
+* 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+*/
+function resendTransport(resend, options = {}) {
+	const tags = checkTags(options.tags ?? {});
+	const payloadOf = (target, email, transportOptions) => compact({
+		from: email.from,
+		to: [target.address],
+		replyTo: email.replyTo ?? options.replyTo,
+		subject: email.subject,
+		text: email.text,
+		html: email.html,
+		headers: { ...email.headers },
+		tags: [
+			...tags,
+			...TAG.test(transportOptions.delivery) ? [{
+				name: DELIVERY_TAG,
+				value: transportOptions.delivery
+			}] : [],
+			{
+				name: KEY_TAG,
+				value: transportOptions.idempotencyKey
+			},
+			{
+				name: CATEGORY_TAG,
+				value: email.category
+			}
+		]
+	});
+	return Object.freeze(compact({
+		channel: "email",
+		name: "resend",
+		from: options.from,
+		batchSize: 100,
+		async deliver(target, email, transportOptions) {
+			if (!isDeliveryTarget(target, "email")) return REFUSED;
+			try {
+				const { data, error } = await resend.emails.send(payloadOf(target, email, transportOptions), { idempotencyKey: transportOptions.idempotencyKey });
+				if (error !== null) return resendFailure(error);
+				return {
+					status: "sent",
+					providerId: data.id
+				};
+			} catch {
+				return UNAVAILABLE;
+			}
+		},
+		deliverBatch: resend.batch === void 0 ? void 0 : (items) => sendBatch(resend, items, payloadOf)
+	}));
+}
+//#endregion
+//#region src/resend/webhook.ts
+/** Resend allows 5 minutes of clock skew either way; a claim outlives both. */
+const CLAIM_SECONDS = 600;
+const MAX_BODY = 1e6;
+const CATEGORIES = /* @__PURE__ */ new Set([
+	"transactional",
+	"notification",
+	"security",
+	"approval"
+]);
+function header(request, name) {
+	return request.headers.get(`svix-${name}`) ?? request.headers.get(`webhook-${name}`);
+}
+function text(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function joined(...parts) {
+	const found = parts.map(text).filter((part) => part !== void 0);
+	return found.length === 0 ? void 0 : found.join(": ");
+}
+function outcomeOf(type, data) {
+	switch (type) {
+		case "email.delivered": return { operation: "delivered" };
+		case "email.complained": return { operation: "complained" };
+		case "email.bounced": {
+			const bounce = ownRecord(data["bounce"]);
+			return compact({
+				operation: "bounced",
+				reason: joined(bounce?.["type"], bounce?.["message"])
+			});
+		}
+		case "email.failed": return compact({
+			operation: "failed",
+			cause: "rejected",
+			retryable: false,
+			reason: text(ownRecord(data["failed"])?.["reason"])
+		});
+		case "email.suppressed": {
+			const suppressed = ownRecord(data["suppressed"]);
+			return compact({
+				operation: "failed",
+				cause: "suppressed",
+				retryable: false,
+				reason: joined(suppressed?.["type"], suppressed?.["message"])
+			});
+		}
+		default: return;
+	}
+}
+/**
+* The delivery event a verified Resend payload stands for, or `null` for
+* one that is not about a PermDock delivery: opens and clicks (tracking,
+* not delivery), sends, contact and domain events, and mail without the
+* `permdock_delivery` and `permdock_key` tags.
+*/
+function eventOf(payload, source) {
+	const record = ownRecord(payload);
+	const data = ownRecord(record?.["data"]);
+	if (record === void 0 || data === void 0) return null;
+	const outcome = outcomeOf(record["type"], data);
+	const tags = ownRecord(data["tags"]);
+	const id = text(tags?.[DELIVERY_TAG]);
+	const key = text(tags?.[KEY_TAG]);
+	if (outcome === void 0 || id === void 0 || key === void 0) return null;
+	const category = tags?.[CATEGORY_TAG];
+	const at = record["created_at"];
+	return deliveryEvent(compact({
+		at: isRfc3339(at) ? at : void 0,
+		source,
+		channel: "email",
+		delivery: {
+			id,
+			key
+		},
+		category: typeof category === "string" && CATEGORIES.has(category) ? category : void 0,
+		provider: compact({
+			name: "resend",
+			id: text(data["email_id"])
+		}),
+		...outcome
+	}));
+}
+function unsigned() {
+	return problemResponse(statusProblem(400, "webhook signature headers are missing"));
+}
+function unverified() {
+	return problemResponse(statusProblem(403, "webhook signature did not verify"));
+}
+async function claim(replay, key) {
+	const expiresAt = nowSeconds() + CLAIM_SECONDS;
+	if (replay.claim !== void 0) return replay.claim(key, expiresAt);
+	if (await replay.seen(key)) return false;
+	await replay.remember(key, expiresAt);
+	return true;
+}
+/**
+* A fetch handler for Resend webhooks. It verifies the Standard Webhooks
+* signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
+* header names both work), claims the message id, and writes one delivery
+* event for `email.delivered`, `email.bounced`, `email.complained`,
+* `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
+* failure releases the claim and answers `503`, so Resend retries.
+*/
+function resendWebhook(options) {
+	const source = options.source ?? "permdock";
+	return async (request) => {
+		if (request.method !== "POST") return methodNotAllowed("POST");
+		const id = header(request, "id");
+		const timestamp = header(request, "timestamp");
+		const signature = header(request, "signature");
+		if (id === null || timestamp === null || signature === null) return unsigned();
+		const read = await readBodyText(request, MAX_BODY);
+		if (!read.ok) return read.cause === "too-large" ? bodyTooLarge(MAX_BODY) : problemResponse(statusProblem(400, "webhook body was unreadable"));
+		const body = read.text;
+		let payload;
+		try {
+			payload = options.resend.webhooks.verify({
+				payload: body,
+				headers: {
+					id,
+					timestamp,
+					signature
+				},
+				webhookSecret: options.secret
+			});
+		} catch {
+			return unverified();
+		}
+		const replayKey = `resend:${id}`;
+		if (!await claim(options.replay, replayKey)) return new Response(null, { status: 200 });
+		const event = eventOf(payload, source);
+		if (event !== null) try {
+			await options.sink.write([event]);
+		} catch {
+			await options.replay.release?.(replayKey);
+			return problemResponse(statusProblem(503, "the event sink is unavailable"));
+		}
+		return new Response(null, { status: 200 });
+	};
+}
+//#endregion
+export { approvalEmail, resendFailure, resendTransport, resendWebhook };

package/dist/resource-relations-D_jw0BFx.js

@@ -0,0 +1,243 @@
+import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
+//#region src/core/resource-relations.ts
+/** The edge's group resources with their relation and id column. */
+function groupEntries(spec) {
+	const groups = spec.groups;
+	if (groups === void 0) return [];
+	return Object.entries(groups.resources).map(([resource, group]) => typeof group === "string" ? {
+		resource,
+		relation: group,
+		subject: spec.subject ?? "user_id",
+		typed: false
+	} : {
+		resource,
+		relation: group.relation,
+		subject: group.subject ?? spec.subject ?? "user_id",
+		typed: group.subject !== void 0
+	});
+}
+function restrictedStops(node, path) {
+	return node?.restricted !== void 0 && (node.restrictedStops === void 0 || node.restrictedStops.includes(path));
+}
+function restrictedFor(node, path) {
+	return restrictedStops(node, path) ? node?.restricted : void 0;
+}
+function isFieldRelation(relation) {
+	return relation !== void 0 && "field" in relation;
+}
+function isEdgeRelation(relation) {
+	return relation !== void 0 && "edge" in relation;
+}
+function isPrincipalRelation(relation) {
+	return relation !== void 0 && "principal" in relation;
+}
+function isComputedRelation(relation) {
+	return relation !== void 0 && !("field" in relation) && !("edge" in relation) && !("principal" in relation);
+}
+/**
+* The relations whose holders hold `name` on `node`: `name` itself when it
+* has a source, then everything it includes, transitively, each once.
+* `definePermissions` rejects cycles and unknown names, so this terminates.
+*/
+function expandRelation(node, name) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const visit = (current) => {
+		if (seen.has(current)) return;
+		seen.add(current);
+		const spec = node?.relations[current];
+		if (spec === void 0) return;
+		if (!isComputedRelation(spec)) out.push(current);
+		for (const included of spec.includes ?? []) visit(included);
+	};
+	visit(name);
+	return out;
+}
+/** Whether `node` names itself as its parent (nested folders, sub-teams, reporting lines). */
+function isSelfParented(node) {
+	return node?.parent !== void 0 && node.parent.resource === node.name;
+}
+const RESOURCE_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/u;
+/** Level names ride claims and grant keys (`key@level`), so they stay SQL- and claim-safe. */
+const LEVEL_NAME = /^[a-z][a-z0-9_]*$/u;
+const EDGE_TABLE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/u;
+function restrictedStopsOf(name, option, parent, links) {
+	if (option.stops === void 0) return;
+	if (!Array.isArray(option.stops) || option.stops.length === 0) throw new Error(`PermDock: resource "${name}" restricted.stops must list 'parent' or link names`);
+	const stops = /* @__PURE__ */ new Set();
+	for (const path of option.stops) {
+		if (typeof path !== "string") throw new TypeError(`PermDock: resource "${name}" restricted.stops must list 'parent' or link names`);
+		if (path === "parent" ? parent === void 0 : !Object.hasOwn(links, path)) throw new Error(`PermDock: resource "${name}" restricted.stops names '${path}', which it does not declare`);
+		stops.add(path);
+	}
+	return Object.freeze([...stops].toSorted());
+}
+function normaliseRelation(resourceName, relationName, spec) {
+	if (typeof spec === "string") {
+		assertSafeKey(spec, "relation field");
+		return { field: spec };
+	}
+	const label = `relation '${relationName}' on '${resourceName}'`;
+	const includes = normaliseIncludes(label, spec.includes);
+	const kinds = [
+		"field",
+		"edge",
+		"principal"
+	].filter((kind) => kind in spec);
+	if (kinds.length === 0 && includes !== void 0) return { includes };
+	if (kinds.length !== 1) throw new Error(`PermDock: ${label} needs exactly one of field, edge, principal or includes`);
+	const withIncludes = includes === void 0 ? {} : { includes };
+	if (isEdgeRelation(spec)) {
+		if (!EDGE_TABLE.test(spec.edge)) throw new Error(`PermDock: ${label} has an unsafe edge table '${spec.edge}'`);
+		for (const column of [
+			spec.object,
+			spec.subject,
+			spec.expiresAt
+		]) if (column !== void 0) assertSafeKey(column, "edge column");
+		return {
+			edge: spec.edge,
+			...spec.object === void 0 ? {} : { object: spec.object },
+			...spec.subject === void 0 ? {} : { subject: spec.subject },
+			...spec.expiresAt === void 0 ? {} : { expiresAt: spec.expiresAt },
+			...spec.match === void 0 ? {} : { match: normaliseMatch(label, spec.match) },
+			...spec.groups === void 0 ? {} : { groups: normaliseGroups(label, spec.groups) },
+			...withIncludes
+		};
+	}
+	if (isPrincipalRelation(spec)) {
+		assertSafeKey(spec.principal, "relation principal");
+		for (const column of [spec.period?.startsAt, spec.period?.expiresAt]) if (column !== void 0) assertSafeKey(column, "relation period");
+		return spec.period === void 0 ? {
+			principal: spec.principal,
+			...withIncludes
+		} : {
+			principal: spec.principal,
+			period: { ...spec.period },
+			...withIncludes
+		};
+	}
+	const field = spec;
+	assertSafeKey(field.field, "relation field");
+	if (field.memberOf !== void 0 && includes !== void 0) throw new Error(`PermDock: ${label} is a memberOf relation and cannot include others`);
+	return field.memberOf === void 0 ? {
+		field: field.field,
+		...withIncludes
+	} : {
+		field: field.field,
+		memberOf: field.memberOf
+	};
+}
+function normaliseIncludes(label, includes) {
+	if (includes === void 0) return;
+	if (!Array.isArray(includes) || includes.length === 0) throw new Error(`PermDock: ${label} includes must be a non-empty list of relation names`);
+	for (const name of includes) {
+		if (typeof name !== "string") throw new TypeError(`PermDock: ${label} includes a non-string name`);
+		assertSafeKey(name, "included relation");
+	}
+	return [...new Set(includes)];
+}
+function normaliseMatch(label, match) {
+	const out = {};
+	const columns = Object.keys(match);
+	if (columns.length === 0) throw new Error(`PermDock: ${label} match needs at least one column`);
+	for (const column of columns) {
+		assertSafeKey(column, "edge match column");
+		const value = match[column];
+		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new Error(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
+		out[column] = value;
+	}
+	return out;
+}
+function normaliseGroups(label, groups) {
+	if (groups.column !== void 0) assertSafeKey(groups.column, "edge groups column");
+	const resources = {};
+	const names = Object.keys(groups.resources);
+	if (names.length === 0) throw new Error(`PermDock: ${label} groups needs at least one resource`);
+	for (const name of names) {
+		assertSafeKey(name, "group resource");
+		const group = groups.resources[name];
+		if (typeof group === "string") {
+			assertSafeKey(group, "group relation");
+			if (groups.column === void 0) throw new Error(`PermDock: ${label} groups '${name}' needs its own subject column, or groups needs a column naming the resource`);
+			resources[name] = group;
+			continue;
+		}
+		if (group === null || typeof group !== "object") throw new TypeError(`PermDock: ${label} groups '${name}' must name a relation`);
+		const relationName = "relation" in group ? group.relation : void 0;
+		if (typeof relationName !== "string") throw new TypeError(`PermDock: ${label} groups '${name}' must name a relation`);
+		assertSafeKey(relationName, "group relation");
+		const subject = "subject" in group ? group.subject : void 0;
+		if (subject !== void 0 && typeof subject !== "string") throw new TypeError(`PermDock: ${label} groups '${name}' subject must be a column name`);
+		if (subject !== void 0) assertSafeKey(subject, "group subject column");
+		else if (groups.column === void 0) throw new Error(`PermDock: ${label} groups '${name}' needs its own subject column, or groups needs a column naming the resource`);
+		resources[name] = subject === void 0 ? { relation: relationName } : {
+			relation: relationName,
+			subject
+		};
+	}
+	if (groups.direct !== void 0 && groups.column === void 0) throw new Error(`PermDock: ${label} groups direct needs a column to compare it with`);
+	if (groups.direct !== void 0 && groups.direct in resources) throw new Error(`PermDock: ${label} groups direct '${groups.direct}' is also a group resource`);
+	return {
+		...groups.column === void 0 ? {} : { column: groups.column },
+		resources,
+		...groups.direct === void 0 ? {} : { direct: groups.direct }
+	};
+}
+/** An included relation must exist on the same resource, be tenancy-free and never include itself back. */
+function assertIncludes(node) {
+	const state = /* @__PURE__ */ new Map();
+	const visit = (name, path) => {
+		if (state.get(name) === "done") return;
+		if (state.get(name) === "visiting") throw new Error(`PermDock: relation includes on '${node.name}' form a cycle: ${[...path, name].join(" -> ")}`);
+		state.set(name, "visiting");
+		for (const included of node.relations[name]?.includes ?? []) {
+			const target = node.relations[included];
+			if (target === void 0) throw new Error(`PermDock: relation '${name}' on '${node.name}' includes '${included}', which '${node.name}' does not declare`);
+			if (isFieldRelation(target) && target.memberOf !== void 0) throw new Error(`PermDock: relation '${name}' on '${node.name}' includes the memberOf relation '${included}'; scopes are tenancy, not the object graph`);
+			visit(included, [...path, name]);
+		}
+		state.set(name, "done");
+	};
+	for (const name of Object.keys(node.relations)) visit(name, []);
+}
+function assertGroupTarget(registry, node, relationName, spec, target, targetRelation) {
+	const label = `relation '${relationName}' on '${node.name}' groups '${target}'`;
+	const targetSpec = registry.get(target)?.relations[targetRelation];
+	if (targetSpec === void 0) throw new Error(`PermDock: ${label} names '${target}#${targetRelation}', which is not declared`);
+	if (isFieldRelation(targetSpec) && targetSpec.memberOf !== void 0) throw new Error(`PermDock: ${label} names a memberOf relation; scopes are tenancy, not the object graph`);
+	if (target === node.name && (targetRelation !== relationName || spec.includes !== void 0)) throw new Error(`PermDock: ${label}: a group on its own resource must name the same relation, which includes nothing`);
+}
+/**
+* Links and group targets name declared resources and relations. Groups may
+* nest within one resource (teams in teams) through the same relation, which
+* then includes nothing, so SQL can walk it with one bounded recursive query;
+* a group cycle across resources is rejected.
+*/
+function assertGraphTargets(registry) {
+	const edges = /* @__PURE__ */ new Map();
+	for (const node of registry.values()) {
+		for (const [linkName, link] of Object.entries(node.links)) if (!registry.has(link.resource)) throw new Error(`PermDock: link '${linkName}' on '${node.name}' names the undeclared resource '${link.resource}'`);
+		for (const [relationName, spec] of Object.entries(node.relations)) {
+			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
+			for (const { resource: target, relation: targetRelation } of groupEntries(spec)) {
+				assertGroupTarget(registry, node, relationName, spec, target, targetRelation);
+				if (target !== node.name) {
+					const out = edges.get(node.name) ?? /* @__PURE__ */ new Set();
+					out.add(target);
+					edges.set(node.name, out);
+				}
+			}
+		}
+	}
+	const state = /* @__PURE__ */ new Map();
+	const visit = (name) => {
+		if (state.get(name) === "done") return;
+		if (state.get(name) === "visiting") throw new Error(`PermDock: edge groups form a cycle across resources through '${name}'`);
+		state.set(name, "visiting");
+		for (const next of edges.get(name) ?? []) visit(next);
+		state.set(name, "done");
+	};
+	for (const name of edges.keys()) visit(name);
+}
+//#endregion
+export { expandRelation as a, isEdgeRelation as c, isSelfParented as d, normaliseRelation as f, restrictedStopsOf as h, assertIncludes as i, isFieldRelation as l, restrictedStops as m, RESOURCE_NAME as n, groupEntries as o, restrictedFor as p, assertGraphTargets as r, isComputedRelation as s, LEVEL_NAME as t, isPrincipalRelation as u };