permdock 0.4.0 → 0.5.0

package/dist/preset-DZdU0tne.js

@@ -0,0 +1,1768 @@
+//#region src/preset/catalog.ts
+const ARCHETYPES = [
+	{
+		id: "b2b",
+		title: "B2B SaaS",
+		description: "Organisations with owner, admin, member and viewer roles, custom roles and a decision log.",
+		requires: [
+			"tenancy",
+			"custom-roles",
+			"decision-log"
+		]
+	},
+	{
+		id: "agent",
+		title: "AI agent product",
+		description: "Tools an agent calls on a user's behalf, with human approval on the ones that change data.",
+		requires: [
+			"operations",
+			"approvals",
+			"decision-log"
+		]
+	},
+	{
+		id: "marketplace",
+		title: "Marketplace",
+		description: "Buyers and sellers who manage what they own, with refunds behind an approval.",
+		requires: ["ownership", "approvals"]
+	},
+	{
+		id: "api",
+		title: "API product",
+		description: "Projects reached through API keys, for developers and their integrations.",
+		requires: [
+			"tenancy",
+			"api-keys",
+			"decision-log"
+		]
+	},
+	{
+		id: "internal",
+		title: "Internal tool",
+		description: "Support staff, leads and admins working tickets, with approval on destructive actions.",
+		requires: ["approvals", "decision-log"]
+	},
+	{
+		id: "consumer",
+		title: "Consumer app",
+		description: "Users who own their data, with free and pro plans and a daily limit on the free plan.",
+		requires: [
+			"ownership",
+			"plans",
+			"limits"
+		]
+	}
+];
+const FEATURES = [
+	{
+		id: "tenancy",
+		title: "Organisations",
+		description: "Roles held per organisation; every row carries an orgId and a member sees only their organisations."
+	},
+	{
+		id: "custom-roles",
+		title: "Custom roles",
+		description: "Organisation admins compose their own roles from the permissions they hold.",
+		requires: ["tenancy"]
+	},
+	{
+		id: "approvals",
+		title: "Approvals",
+		description: "Destructive actions return approval-required until a person approves them."
+	},
+	{
+		id: "operations",
+		title: "Operations",
+		description: "Tools an agent may call, each bound to one permission, in defineOperations."
+	},
+	{
+		id: "decision-log",
+		title: "Decision log",
+		description: "Every decision goes to a DecisionSink."
+	},
+	{
+		id: "limits",
+		title: "Limits",
+		description: "A grant allows a number of calls per time window."
+	},
+	{
+		id: "plans",
+		title: "Plans",
+		description: "Free and pro plans; pro unlocks actions the free plan lacks."
+	},
+	{
+		id: "ownership",
+		title: "Ownership",
+		description: "A user updates and deletes the rows they own."
+	},
+	{
+		id: "api-keys",
+		title: "API keys",
+		description: "Keys created with decideCredential, never wider than the person who creates them."
+	},
+	{
+		id: "rls",
+		title: "Row-level security",
+		description: "Postgres RLS policies generated from the same policy, with permdock rls generate."
+	}
+];
+const AUTH = [
+	{
+		id: "custom",
+		title: "Your own session",
+		description: "currentUser() in session.ts returns your signed-in user; until it does, every check denies."
+	},
+	{
+		id: "supabase",
+		title: "Supabase Auth",
+		description: "subjectFromSupabase over the claims supabase.auth.getClaims() verified."
+	},
+	{
+		id: "better-auth",
+		title: "Better Auth",
+		description: "subjectFromBetterAuth over the session auth.api.getSession() returns."
+	},
+	{
+		id: "clerk",
+		title: "Clerk",
+		description: "subjectFromClerk over Clerk's auth object."
+	},
+	{
+		id: "jwt",
+		title: "Any OIDC provider",
+		description: "subjectFromJwt verifies the bearer token through OpenID Connect Discovery."
+	}
+];
+const BACKENDS = [
+	{
+		id: "memory",
+		title: "In memory",
+		description: "Demo rows in a Map and memory sources, for the first run."
+	},
+	{
+		id: "supabase",
+		title: "Supabase",
+		description: "Memberships read through PostgREST with postgrestSources(), from the subject_for function."
+	},
+	{
+		id: "drizzle",
+		title: "Drizzle",
+		description: "A Drizzle schema and client; rows load by id and lists filter with toWhere()."
+	},
+	{
+		id: "prisma",
+		title: "Prisma",
+		description: "A Prisma schema and client; rows load by id and lists filter with toWhere()."
+	}
+];
+const FRAMEWORKS = [
+	{
+		id: "next",
+		title: "Next.js",
+		description: "permdock/next for Server Components, actions and routes."
+	},
+	{
+		id: "hono",
+		title: "Hono",
+		description: "permdock/hono middleware and route guards."
+	},
+	{
+		id: "express",
+		title: "Express",
+		description: "permdock/express middleware and route guards."
+	},
+	{
+		id: "none",
+		title: "No HTTP framework",
+		description: "A per-request instance from core getPermDock."
+	}
+];
+/**
+* Agent runtimes and UI recipes. The preset code keeps one bitset per
+* `kind`, each in this list's order, so a new entry goes after the last
+* one of its kind.
+*/
+const INTEGRATIONS = [
+	{
+		id: "ai-sdk",
+		kind: "agent",
+		title: "Vercel AI SDK",
+		description: "toolApproval and needsApproval for AI SDK tools.",
+		requires: ["operations"]
+	},
+	{
+		id: "mcp",
+		kind: "agent",
+		title: "MCP server",
+		description: "protectServer for an MCP server's tools.",
+		requires: ["operations"]
+	},
+	{
+		id: "shadcn",
+		kind: "ui",
+		title: "shadcn/ui",
+		description: "@permdock recipes built from your shadcn components."
+	},
+	{
+		id: "react-native",
+		kind: "ui",
+		title: "React Native Reusables",
+		description: "@permdock/*-native recipes built from React Native Reusables."
+	}
+];
+const SERVICES = [
+	{
+		id: "cloud-decision-log",
+		title: "Cloud decision log",
+		description: "PermDock Cloud as the DecisionSink, with evidence exports."
+	},
+	{
+		id: "cloud-approvals",
+		title: "Cloud approvals inbox",
+		description: "PermDock Cloud as the ApprovalStore, with Slack and Teams delivery."
+	},
+	{
+		id: "cloud-snapshots",
+		title: "Cloud snapshots",
+		description: "Signed snapshots served by PermDock Cloud, through permdockCloud.snapshotsFor()."
+	},
+	{
+		id: "cloud-hosted-grants",
+		title: "Cloud hosted grants",
+		description: "Grants a Cloud admin adds to hostable permissions."
+	}
+];
+/** The choices a preset starts from, in `/create` and in `permdock init`. */
+const PRESET_DEFAULTS = Object.freeze({
+	archetype: "b2b",
+	features: [],
+	auth: "custom",
+	backend: "memory",
+	framework: "next",
+	integrations: [],
+	services: []
+});
+/** The integrations of one `kind` in `preset`, in catalogue order. */
+function integrationsOf(preset, kind) {
+	return INTEGRATIONS.filter((item) => item.kind === kind && preset.integrations.includes(item.id)).map((item) => item.id);
+}
+function requiredBy(choices, picked) {
+	return choices.filter((choice) => picked.includes(choice.id)).flatMap((choice) => choice.requires ?? []);
+}
+/**
+* The preset `input` describes, with every feature its archetype,
+* integrations and other features require turned on, and lists in
+* catalogue order. Features are only ever added, so resolving twice is a
+* no-op.
+*/
+function resolvePreset(input) {
+	const integrations = INTEGRATIONS.map((item) => item.id).filter((id) => (input.integrations ?? PRESET_DEFAULTS.integrations).includes(id));
+	const features = /* @__PURE__ */ new Set([
+		...input.features ?? PRESET_DEFAULTS.features,
+		...requiredBy(ARCHETYPES, [input.archetype]),
+		...requiredBy(INTEGRATIONS, integrations)
+	]);
+	for (let added = true; added;) {
+		added = false;
+		for (const feature of requiredBy(FEATURES, [...features])) if (!features.has(feature)) {
+			features.add(feature);
+			added = true;
+		}
+	}
+	return Object.freeze({
+		archetype: input.archetype,
+		features: FEATURES.map((feature) => feature.id).filter((id) => features.has(id)),
+		auth: input.auth ?? PRESET_DEFAULTS.auth,
+		backend: input.backend ?? PRESET_DEFAULTS.backend,
+		framework: input.framework ?? PRESET_DEFAULTS.framework,
+		integrations,
+		services: SERVICES.map((service) => service.id).filter((id) => (input.services ?? PRESET_DEFAULTS.services).includes(id))
+	});
+}
+//#endregion
+//#region src/preset/codec.ts
+/**
+* Preset codes: `p1` followed by base64url bytes. Version 1 packs, in
+* order, one byte each for the archetype, auth, backend and framework
+* index, then a bitset per multi-select list (features, agent
+* integrations, UI integrations, services), each as many bytes as the list
+* needs. A list only grows at the end, so a code keeps its meaning as the
+* catalogue grows; a new layout gets a new version prefix.
+*/
+const VERSION = "p1";
+const AGENT_INTEGRATIONS = INTEGRATIONS.filter((item) => item.kind === "agent");
+const UI_INTEGRATIONS = INTEGRATIONS.filter((item) => item.kind === "ui");
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function toBase64Url(bytes) {
+	let out = "";
+	for (let index = 0; index < bytes.length; index += 3) {
+		const a = bytes[index] ?? 0;
+		const b = bytes[index + 1] ?? 0;
+		const c = bytes[index + 2] ?? 0;
+		const chunk = a << 16 | b << 8 | c;
+		const chars = index + 1 >= bytes.length ? 2 : index + 2 >= bytes.length ? 3 : 4;
+		for (let char = 0; char < chars; char += 1) out += ALPHABET[chunk >> 18 - 6 * char & 63];
+	}
+	return out;
+}
+function fromBase64Url(text) {
+	const bytes = [];
+	for (let index = 0; index < text.length; index += 4) {
+		const group = text.slice(index, index + 4);
+		if (group.length === 1) return;
+		let chunk = 0;
+		for (let char = 0; char < 4; char += 1) {
+			const symbol = group[char];
+			const value = symbol === void 0 ? 0 : ALPHABET.indexOf(symbol);
+			if (value < 0) return;
+			chunk |= value << 18 - 6 * char;
+		}
+		bytes.push(chunk >> 16 & 255);
+		if (group.length > 2) bytes.push(chunk >> 8 & 255);
+		if (group.length > 3) bytes.push(chunk & 255);
+	}
+	return bytes;
+}
+function bitset(list, picked) {
+	const bytes = Array.from({ length: Math.ceil(list.length / 8) }, () => 0);
+	for (const [index, item] of list.entries()) if (picked.includes(item.id)) bytes[index >> 3] = (bytes[index >> 3] ?? 0) | 1 << (index & 7);
+	return bytes;
+}
+function readBitset(list, bytes) {
+	return list.filter((_, index) => (bytes[index >> 3] ?? 0) >> (index & 7) & 1).map((item) => item.id);
+}
+function indexOf(list, id) {
+	return Math.max(0, list.findIndex((item) => item.id === id));
+}
+/** The preset code for `preset`, such as `p1AQIDBAc`. */
+function encodePreset(preset) {
+	const index = indexOf;
+	return VERSION + toBase64Url([
+		index(ARCHETYPES, preset.archetype),
+		index(AUTH, preset.auth),
+		index(BACKENDS, preset.backend),
+		index(FRAMEWORKS, preset.framework),
+		...bitset(FEATURES, preset.features),
+		...bitset(AGENT_INTEGRATIONS, preset.integrations),
+		...bitset(UI_INTEGRATIONS, preset.integrations),
+		...bitset(SERVICES, preset.services)
+	]);
+}
+/**
+* The preset a code stands for, resolved, or `undefined` for a code that
+* is not a version this package reads or does not decode.
+*/
+function decodePreset(code) {
+	if (!code.startsWith(VERSION)) return;
+	const bytes = fromBase64Url(code.slice(2));
+	if (bytes === void 0) return;
+	const pick = (list, at) => list[bytes[at] ?? 0]?.id;
+	const archetype = pick(ARCHETYPES, 0);
+	const auth = pick(AUTH, 1);
+	const backend = pick(BACKENDS, 2);
+	const framework = pick(FRAMEWORKS, 3);
+	if (archetype === void 0 || auth === void 0 || backend === void 0 || framework === void 0) return;
+	let at = 4;
+	const take = (size) => {
+		const slice = bytes.slice(at, at + size);
+		at += size;
+		return slice;
+	};
+	const features = readBitset(FEATURES, take(Math.ceil(FEATURES.length / 8)));
+	const agents = readBitset(AGENT_INTEGRATIONS, take(Math.ceil(AGENT_INTEGRATIONS.length / 8)));
+	const ui = readBitset(UI_INTEGRATIONS, take(Math.ceil(UI_INTEGRATIONS.length / 8)));
+	const services = readBitset(SERVICES, take(Math.ceil(SERVICES.length / 8)));
+	return resolvePreset({
+		archetype,
+		auth,
+		backend,
+		framework,
+		features,
+		integrations: [...agents, ...ui],
+		services
+	});
+}
+//#endregion
+//#region src/preset/flags.ts
+/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+const PRESET_FLAGS = {
+	archetype: {
+		flag: "archetype",
+		choices: ARCHETYPES,
+		repeatable: false
+	},
+	features: {
+		flag: "feature",
+		choices: FEATURES,
+		repeatable: true
+	},
+	auth: {
+		flag: "auth",
+		choices: AUTH,
+		repeatable: false
+	},
+	backend: {
+		flag: "backend",
+		choices: BACKENDS,
+		repeatable: false
+	},
+	framework: {
+		flag: "framework",
+		choices: FRAMEWORKS,
+		repeatable: false
+	},
+	integrations: {
+		flag: "integration",
+		choices: INTEGRATIONS,
+		repeatable: true
+	},
+	services: {
+		flag: "service",
+		choices: SERVICES,
+		repeatable: true
+	}
+};
+/**
+* The `permdock init` flags that select `preset`, leaving out defaults and
+* the features its archetype and integrations already turn on, so
+* `permdock init <flags>` resolves to the same preset.
+*/
+function presetFlags(preset) {
+	const implied = resolvePreset({
+		archetype: preset.archetype,
+		integrations: preset.integrations
+	}).features;
+	const args = [];
+	const single = (key) => {
+		if (key === "archetype" || preset[key] !== PRESET_DEFAULTS[key]) args.push(`--${PRESET_FLAGS[key].flag}`, preset[key]);
+	};
+	const many = (key) => {
+		const values = key === "features" ? preset.features.filter((feature) => !implied.includes(feature)) : preset[key];
+		for (const value of values) args.push(`--${PRESET_FLAGS[key].flag}`, value);
+	};
+	single("archetype");
+	single("framework");
+	single("auth");
+	single("backend");
+	many("features");
+	many("integrations");
+	many("services");
+	return args;
+}
+//#endregion
+//#region src/preset/domain.ts
+function all(resource, actions) {
+	return actions.map((action) => ({
+		resource,
+		action
+	}));
+}
+const CRUD = [
+	"read",
+	"update",
+	"delete",
+	"create",
+	"list"
+];
+const READ = ["read", "list"];
+const DOMAINS = {
+	b2b: {
+		resources: [{
+			name: "project",
+			fields: {
+				name: "z.string()",
+				ownerId: "z.string()"
+			},
+			preset: "crud",
+			actions: ["archive"],
+			owner: "ownerId"
+		}, {
+			name: "invoice",
+			fields: {
+				amount: "z.number()",
+				ownerId: "z.string()"
+			},
+			preset: "readable",
+			actions: ["pay"],
+			collection: ["create"],
+			owner: "ownerId",
+			sensitive: ["pay"]
+		}],
+		roles: [
+			{
+				name: "owner",
+				top: true,
+				grants: [...all("project", [...CRUD, "archive"]), ...all("invoice", [
+					...READ,
+					"create",
+					"pay"
+				])],
+				assigns: [
+					"owner",
+					"admin",
+					"member",
+					"viewer"
+				]
+			},
+			{
+				name: "admin",
+				grants: [...all("project", [...CRUD, "archive"]), ...all("invoice", [
+					...READ,
+					"create",
+					"pay"
+				])],
+				assigns: ["member", "viewer"]
+			},
+			{
+				name: "member",
+				grants: [
+					...all("project", [
+						"read",
+						"list",
+						"create"
+					]),
+					{
+						resource: "project",
+						action: "update",
+						own: true
+					},
+					{
+						resource: "project",
+						action: "delete",
+						own: true
+					},
+					...all("invoice", READ)
+				]
+			},
+			{
+				name: "viewer",
+				grants: [...all("project", READ), ...all("invoice", READ)]
+			}
+		],
+		demoRole: "member",
+		pro: {
+			resource: "project",
+			action: "archive"
+		}
+	},
+	agent: {
+		resources: [{
+			name: "document",
+			fields: {
+				title: "z.string()",
+				ownerId: "z.string()"
+			},
+			preset: "crud",
+			owner: "ownerId"
+		}, {
+			name: "email",
+			fields: { to: "z.string()" },
+			preset: "readable",
+			collection: ["send"],
+			sensitive: ["send"]
+		}],
+		roles: [{
+			name: "member",
+			grants: [
+				...all("document", [
+					"read",
+					"list",
+					"create"
+				]),
+				{
+					resource: "document",
+					action: "update",
+					own: true
+				},
+				{
+					resource: "document",
+					action: "delete",
+					own: true
+				},
+				...all("email", [...READ, "send"])
+			]
+		}, {
+			name: "admin",
+			top: true,
+			grants: [...all("document", CRUD), ...all("email", [...READ, "send"])],
+			assigns: ["admin", "member"]
+		}],
+		demoRole: "member",
+		pro: {
+			resource: "email",
+			action: "send"
+		}
+	},
+	marketplace: {
+		resources: [{
+			name: "listing",
+			fields: {
+				title: "z.string()",
+				sellerId: "z.string()"
+			},
+			preset: "crud",
+			actions: ["publish"],
+			owner: "sellerId"
+		}, {
+			name: "order",
+			fields: {
+				listingId: "z.string()",
+				buyerId: "z.string()"
+			},
+			preset: "readable",
+			actions: ["refund"],
+			collection: ["create"],
+			owner: "buyerId",
+			sensitive: ["refund"]
+		}],
+		roles: [
+			{
+				name: "buyer",
+				grants: [
+					...all("listing", READ),
+					{
+						resource: "order",
+						action: "create"
+					},
+					{
+						resource: "order",
+						action: "list"
+					},
+					{
+						resource: "order",
+						action: "read",
+						own: true
+					}
+				]
+			},
+			{
+				name: "seller",
+				grants: [
+					...all("listing", [
+						"read",
+						"list",
+						"create"
+					]),
+					{
+						resource: "listing",
+						action: "update",
+						own: true
+					},
+					{
+						resource: "listing",
+						action: "delete",
+						own: true
+					},
+					{
+						resource: "listing",
+						action: "publish",
+						own: true
+					},
+					...all("order", READ),
+					{
+						resource: "order",
+						action: "refund"
+					}
+				]
+			},
+			{
+				name: "admin",
+				top: true,
+				grants: [...all("listing", [...CRUD, "publish"]), ...all("order", [
+					...READ,
+					"create",
+					"refund"
+				])],
+				assigns: [
+					"admin",
+					"seller",
+					"buyer"
+				]
+			}
+		],
+		demoRole: "seller",
+		pro: {
+			resource: "listing",
+			action: "publish"
+		}
+	},
+	api: {
+		resources: [{
+			name: "project",
+			fields: {
+				name: "z.string()",
+				ownerId: "z.string()"
+			},
+			preset: "crud",
+			owner: "ownerId"
+		}, {
+			name: "deployment",
+			fields: { projectId: "z.string()" },
+			preset: "readable",
+			actions: ["rollback"],
+			collection: ["create"],
+			sensitive: ["rollback"]
+		}],
+		roles: [
+			{
+				name: "owner",
+				top: true,
+				grants: [...all("project", CRUD), ...all("deployment", [
+					...READ,
+					"create",
+					"rollback"
+				])],
+				assigns: [
+					"owner",
+					"developer",
+					"viewer"
+				]
+			},
+			{
+				name: "developer",
+				grants: [...all("project", [
+					"read",
+					"list",
+					"create",
+					"update"
+				]), ...all("deployment", [
+					...READ,
+					"create",
+					"rollback"
+				])]
+			},
+			{
+				name: "viewer",
+				grants: [...all("project", READ), ...all("deployment", READ)]
+			}
+		],
+		demoRole: "developer",
+		pro: {
+			resource: "deployment",
+			action: "rollback"
+		}
+	},
+	internal: {
+		resources: [{
+			name: "ticket",
+			fields: {
+				subject: "z.string()",
+				ownerId: "z.string()"
+			},
+			preset: "crud",
+			actions: ["assign", "close"],
+			owner: "ownerId"
+		}, {
+			name: "report",
+			fields: { title: "z.string()" },
+			preset: "readable"
+		}],
+		roles: [
+			{
+				name: "agent",
+				grants: [
+					...all("ticket", [
+						"read",
+						"list",
+						"create"
+					]),
+					{
+						resource: "ticket",
+						action: "update",
+						own: true
+					},
+					{
+						resource: "ticket",
+						action: "close",
+						own: true
+					}
+				]
+			},
+			{
+				name: "lead",
+				grants: [...all("ticket", [
+					...CRUD,
+					"assign",
+					"close"
+				]), ...all("report", READ)]
+			},
+			{
+				name: "admin",
+				top: true,
+				grants: [...all("ticket", [
+					...CRUD,
+					"assign",
+					"close"
+				]), ...all("report", READ)],
+				assigns: [
+					"admin",
+					"lead",
+					"agent"
+				]
+			}
+		],
+		demoRole: "agent",
+		pro: {
+			resource: "report",
+			action: "read"
+		}
+	},
+	consumer: {
+		resources: [{
+			name: "note",
+			fields: {
+				body: "z.string()",
+				ownerId: "z.string()"
+			},
+			preset: "crud",
+			actions: ["export"],
+			owner: "ownerId"
+		}],
+		roles: [{
+			name: "user",
+			grants: [
+				{
+					resource: "note",
+					action: "create"
+				},
+				{
+					resource: "note",
+					action: "list"
+				},
+				{
+					resource: "note",
+					action: "read",
+					own: true
+				},
+				{
+					resource: "note",
+					action: "update",
+					own: true
+				},
+				{
+					resource: "note",
+					action: "delete",
+					own: true
+				}
+			]
+		}, {
+			name: "admin",
+			top: true,
+			grants: all("note", [...CRUD, "export"]),
+			assigns: ["admin", "user"]
+		}],
+		demoRole: "user",
+		pro: {
+			resource: "note",
+			action: "export"
+		}
+	}
+};
+//#endregion
+//#region src/preset/generate-shared.ts
+function pascal(name) {
+	return name.charAt(0).toUpperCase() + name.slice(1);
+}
+function quote(value) {
+	return JSON.stringify(value);
+}
+/**
+* An environment read in the generated code. Built from parts so this
+* runtime chunk carries no `process.` token, which the WinterTC check reads
+* as a Node global; the generated file has it whole.
+*/
+function env(name) {
+	return ["process", `env[${quote(name)}]`].join(".");
+}
+function ownedFile(path, contents) {
+	return {
+		path,
+		contents,
+		kind: "owned"
+	};
+}
+function fieldsOf(ctx, resource) {
+	const fields = [["id", "z.string()"], ...Object.entries(resource.fields)];
+	if (ctx.has("tenancy")) fields.push(["orgId", "z.string()"]);
+	return fields;
+}
+function firstInstance(ctx) {
+	const [resource] = ctx.domain.resources;
+	if (resource === void 0) throw new Error("PermDock: a preset domain declares at least one resource");
+	return {
+		resource,
+		action: "update"
+	};
+}
+//#endregion
+//#region src/preset/generate-auth.ts
+function sessionCall(ctx) {
+	return {
+		name: ctx.preset.auth === "custom" ? "currentUser" : "currentSubject",
+		takesRequest: ctx.preset.framework !== "next"
+	};
+}
+function headersOf(ctx) {
+	return sessionCall(ctx).takesRequest ? {
+		imports: [],
+		param: "request: Request",
+		read: "request.headers"
+	} : {
+		imports: [`import { headers } from "next/headers";`],
+		param: "",
+		read: "(await headers())"
+	};
+}
+const BEARER = `const authorization = requestHeaders.get("authorization") ?? "";
+  const token = authorization.startsWith("Bearer ")
+    ? authorization.slice("Bearer ".length)
+    : undefined;`;
+function moduleText(imports, body) {
+	return `${imports.join("\n")}\n\n${body}`;
+}
+function customSession(ctx) {
+	return `import type { User } from "./policy";
+
+/**
+ * The signed-in user, read from your session.
+ * It returns null until you wire it, so every check fails closed.
+ */
+export async function currentUser(${sessionCall(ctx).takesRequest ? "_request: Request" : ""}): Promise<User | null> {
+  return null;
+}
+`;
+}
+function supabaseSession(ctx) {
+	const h = headersOf(ctx);
+	const browser = sessionCall(ctx).takesRequest ? "" : "\n * A browser session keeps the token in cookies: read it there with\n * createServerClient from @supabase/ssr.";
+	return moduleText([
+		`import { createClient } from "@supabase/supabase-js";`,
+		...h.imports,
+		`import { subjectFromSupabase } from "permdock/supabase";`
+	], `/**
+ * The subject the Supabase access token in the Authorization header proves;
+ * anonymous without a valid one.${browser}
+ */
+export async function currentSubject(${h.param}) {
+  const requestHeaders = ${h.read};
+  ${BEARER}
+  if (token === undefined) {
+    return subjectFromSupabase(null);
+  }
+  const supabase = createClient(
+    ${env("SUPABASE_URL")} ?? "",
+    ${env("SUPABASE_PUBLISHABLE_KEY")} ?? "",
+  );
+  const { data, error } = await supabase.auth.getClaims(token);
+  return subjectFromSupabase(error ? null : (data?.claims ?? null));
+}
+`);
+}
+function betterAuthSession(ctx) {
+	const h = headersOf(ctx);
+	return moduleText([
+		...h.imports,
+		`import { subjectFromBetterAuth } from "permdock/better-auth";`,
+		"",
+		`import { auth } from "./auth";`
+	], `/** The subject of the Better Auth session on the request; anonymous without one. */
+export async function currentSubject(${h.param}) {
+  const session = await auth.api.getSession({ headers: ${h.read} });
+  return subjectFromBetterAuth(session, { auth });
+}
+`);
+}
+function betterAuthFile() {
+	return `import { betterAuth } from "better-auth";
+import { organization } from "better-auth/plugins";
+
+/**
+ * Your Better Auth instance: add the database adapter and sign-in methods here.
+ * subjectFromBetterAuth reads roles through the organization plugin.
+ */
+export const auth = betterAuth({
+  plugins: [organization()],
+});
+`;
+}
+function clerkSession(ctx) {
+	if (!sessionCall(ctx).takesRequest) return `import { auth } from "@clerk/nextjs/server";
+import { subjectFromClerk } from "permdock/clerk";
+
+/** The subject of the Clerk session; anonymous when signed out. */
+export async function currentSubject() {
+  return subjectFromClerk(await auth());
+}
+`;
+	return `import { createClerkClient } from "@clerk/backend";
+import { subjectFromClerk } from "permdock/clerk";
+
+const clerk = createClerkClient({
+  secretKey: ${env("CLERK_SECRET_KEY")} ?? "",
+  publishableKey: ${env("CLERK_PUBLISHABLE_KEY")} ?? "",
+});
+
+/** The subject of the Clerk session on the request; anonymous when signed out. */
+export async function currentSubject(request: Request) {
+  const state = await clerk.authenticateRequest(request);
+  return subjectFromClerk(state.toAuth());
+}
+`;
+}
+function jwtSession(ctx) {
+	const h = headersOf(ctx);
+	const request = sessionCall(ctx).takesRequest ? ", request" : "";
+	return moduleText([...h.imports, `import { jwtSubjectResolver } from "permdock/jwt";`], `let resolve: ReturnType<typeof jwtSubjectResolver> | undefined;
+
+/** One resolver for the process, so Discovery and the JWKS are fetched once. */
+function resolver() {
+  resolve ??= jwtSubjectResolver({
+    discovery: ${env("OIDC_ISSUER")} ?? "",
+    audience: ${env("OIDC_AUDIENCE")} ?? "",
+  });
+  return resolve;
+}
+
+/** The subject the bearer token proves; anonymous without a valid one. */
+export async function currentSubject(${h.param}) {
+  const requestHeaders = ${h.read};
+  ${BEARER}
+  return resolver()(token${request});
+}
+`);
+}
+/** `session.ts`, plus `auth.ts` for Better Auth. */
+function sessionFiles(ctx) {
+	const at = (name) => `${ctx.src}/${name}`;
+	switch (ctx.preset.auth) {
+		case "custom": return [ownedFile(at("session.ts"), customSession(ctx))];
+		case "supabase": return [ownedFile(at("session.ts"), supabaseSession(ctx))];
+		case "better-auth": return [ownedFile(at("auth.ts"), betterAuthFile()), ownedFile(at("session.ts"), betterAuthSession(ctx))];
+		case "clerk": return [ownedFile(at("session.ts"), clerkSession(ctx))];
+		case "jwt": return [ownedFile(at("session.ts"), jwtSession(ctx))];
+		default: return ctx.preset.auth;
+	}
+}
+function authDependencies(ctx) {
+	switch (ctx.preset.auth) {
+		case "custom": return [];
+		case "supabase": return ["@supabase/supabase-js"];
+		case "better-auth": return ["better-auth"];
+		case "clerk": return [sessionCall(ctx).takesRequest ? "@clerk/backend" : "@clerk/nextjs"];
+		case "jwt": return ["jose"];
+		default: return ctx.preset.auth;
+	}
+}
+function authDocs(ctx) {
+	return ctx.preset.auth === "custom" ? ["/docs/concepts/authentication"] : [`/docs/adapters/${ctx.preset.auth}`];
+}
+//#endregion
+//#region src/preset/generate-backend.ts
+function memoryData(ctx) {
+	const tenancy = ctx.has("tenancy");
+	const blocks = ctx.domain.resources.map((resource) => {
+		const type = pascal(resource.name);
+		const row = fieldsOf(ctx, resource).map(([name, kind]) => {
+			if (name === "id") return `id: "${resource.name}_1"`;
+			if (name === "orgId") return `orgId: "o1"`;
+			if (name === resource.owner) return `${name}: "u1"`;
+			return kind.startsWith("z.number") ? `${name}: 1` : `${name}: ""`;
+		}).join(", ");
+		return `const ${resource.name}Rows = new Map<string, ${type}>([
+  ["${resource.name}_1", { ${row} }],
+]);
+
+/** Replace with your database read. */
+export function find${type}(id: string): ${type} | null {
+  return ${resource.name}Rows.get(id) ?? null;
+}`;
+	});
+	return `import type { ${ctx.domain.resources.map((resource) => pascal(resource.name)).join(", ")} } from "./permissions";
+
+${tenancy ? "// Demo rows in organisation o1, owned by the demo user u1.\n" : "// Demo rows owned by the demo user u1.\n"}${blocks.join("\n\n")}
+`;
+}
+function isNumber(kind) {
+	return kind.startsWith("z.number");
+}
+function drizzleSchema(ctx) {
+	const numbers = ctx.domain.resources.some((resource) => fieldsOf(ctx, resource).some(([, kind]) => isNumber(kind)));
+	const tables = ctx.domain.resources.map((resource) => {
+		const columns = fieldsOf(ctx, resource).map(([name, kind]) => {
+			return `  ${name}: ${isNumber(kind) ? `doublePrecision("${name}")` : `text("${name}")`}${name === "id" ? ".primaryKey()" : ".notNull()"},`;
+		});
+		return `export const ${resource.name} = pgTable("${resource.name}", {\n${columns.join("\n")}\n});`;
+	});
+	return `import { ${[
+		...numbers ? ["doublePrecision"] : [],
+		"pgTable",
+		"text"
+	].join(", ")} } from "drizzle-orm/pg-core";
+
+// One table per resource, named after it, as permdock rls generate --target drizzle expects.
+${tables.join("\n\n")}
+`;
+}
+function drizzleDb() {
+	return `import { drizzle } from "drizzle-orm/node-postgres";
+
+export const db = drizzle(${env("DATABASE_URL")} ?? "");
+`;
+}
+function drizzleData(ctx) {
+	const blocks = ctx.domain.resources.map((resource) => {
+		const type = pascal(resource.name);
+		return `/** One ${resource.name} by id, or null. */
+export async function find${type}(id: string): Promise<${type} | null> {
+  const [row] = await db.select().from(${resource.name}).where(eq(${resource.name}.id, id));
+  return row ?? null;
+}
+
+/** The ${resource.name}s \`permdock\` may list, filtered in the query. */
+export function list${type}s(permdock: PermDock) {
+  return db
+    .select()
+    .from(${resource.name})
+    .where(toWhere(permdock.where(permissions.${resource.name}.list), ${resource.name}));
+}`;
+	});
+	const names = ctx.domain.resources.map((resource) => resource.name);
+	return `import type { PermDock } from "permdock";
+
+import { eq } from "drizzle-orm";
+import { toWhere } from "permdock/drizzle";
+
+import { db } from "./db";
+import { type ${names.map(pascal).join(", type ")}, permissions } from "./permissions";
+import { ${names.join(", ")} } from "./schema";
+
+${blocks.join("\n\n")}
+`;
+}
+function prismaModel(ctx, resource) {
+	const fields = fieldsOf(ctx, resource).map(([name, kind]) => `  ${name} ${isNumber(kind) ? "Float" : "String"}${name === "id" ? " @id" : ""}`);
+	return `model ${pascal(resource.name)} {\n${fields.join("\n")}\n\n  @@map("${resource.name}")\n}`;
+}
+function prismaSchema(ctx) {
+	return `generator client {
+  provider     = "prisma-client"
+  output       = "../${ctx.src}/generated"
+  moduleFormat = "esm"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+${ctx.domain.resources.map((resource) => prismaModel(ctx, resource)).join("\n\n")}
+`;
+}
+function prismaConfig() {
+	return `import { defineConfig, env } from "prisma/config";
+
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+  datasource: { url: env("DATABASE_URL") },
+});
+`;
+}
+function prismaDb() {
+	return `import { PrismaPg } from "@prisma/adapter-pg";
+
+import { PrismaClient } from "./generated/client";
+
+// prisma generate writes ./generated from prisma/schema.prisma.
+export const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: ${env("DATABASE_URL")} ?? "" }),
+});
+`;
+}
+function prismaData(ctx) {
+	const blocks = ctx.domain.resources.map((resource) => {
+		const type = pascal(resource.name);
+		return `/** One ${resource.name} by id, or null. */
+export async function find${type}(id: string): Promise<${type} | null> {
+  return prisma.${resource.name}.findUnique({ where: { id } });
+}
+
+/** The ${resource.name}s \`permdock\` may list, filtered in the query. */
+export function list${type}s(permdock: PermDock) {
+  return prisma.${resource.name}.findMany({
+    where: toWhere<Prisma.${type}WhereInput>(permdock.where(permissions.${resource.name}.list)),
+  });
+}`;
+	});
+	return `import type { PermDock } from "permdock";
+
+import { toWhere } from "permdock/prisma";
+
+import type { Prisma } from "./generated/client";
+
+import { prisma } from "./db";
+import { type ${ctx.domain.resources.map((resource) => pascal(resource.name)).join(", type ")}, permissions } from "./permissions";
+
+${blocks.join("\n\n")}
+`;
+}
+/** `data.ts` and the files the backend reads it through. */
+function backendFiles(ctx) {
+	const at = (name) => `${ctx.src}/${name}`;
+	switch (ctx.preset.backend) {
+		case "memory":
+		case "supabase": return [ownedFile(at("data.ts"), memoryData(ctx))];
+		case "drizzle": return [
+			ownedFile(at("schema.ts"), drizzleSchema(ctx)),
+			ownedFile(at("db.ts"), drizzleDb()),
+			ownedFile(at("data.ts"), drizzleData(ctx))
+		];
+		case "prisma": return [
+			ownedFile("prisma/schema.prisma", prismaSchema(ctx)),
+			ownedFile("prisma.config.ts", prismaConfig()),
+			ownedFile(at("db.ts"), prismaDb()),
+			ownedFile(at("data.ts"), prismaData(ctx))
+		];
+		default: return ctx.preset.backend;
+	}
+}
+/** What `permdock.ts` adds for the backend: imports, statements before `defineApp`, and its options. */
+function backendApp(ctx) {
+	if (ctx.preset.backend !== "supabase") return {
+		imports: [],
+		preamble: [],
+		options: []
+	};
+	return {
+		imports: [`import { createClient } from "@supabase/supabase-js";`, `import { postgrestSources } from "permdock/supabase";`],
+		preamble: [
+			`// Server-only: the secret key lets subject_for read any user's memberships.`,
+			`const sources = postgrestSources(`,
+			`  createClient(${env("SUPABASE_URL")} ?? "", ${env("SUPABASE_SECRET_KEY")} ?? ""),`,
+			`  { policy },`,
+			`);`
+		],
+		options: ["  memberships: sources.memberships,"]
+	};
+}
+function backendDependencies(ctx) {
+	switch (ctx.preset.backend) {
+		case "memory": return [];
+		case "supabase": return ["@supabase/supabase-js"];
+		case "drizzle": return ["drizzle-orm", "pg"];
+		case "prisma": return [
+			"@prisma/client",
+			"@prisma/adapter-pg",
+			"prisma"
+		];
+		default: return ctx.preset.backend;
+	}
+}
+function backendDocs(ctx) {
+	return ctx.preset.backend === "memory" ? [] : [`/docs/adapters/${ctx.preset.backend}`];
+}
+//#endregion
+//#region src/preset/generate.ts
+const LIMIT = "{ count: 100, per: 86_400 }";
+function permissionsFile(ctx) {
+	const schemas = ctx.domain.resources.map((resource) => {
+		const fields = fieldsOf(ctx, resource).map(([name, type]) => `  ${name}: ${type},`).join("\n");
+		return `export const ${pascal(resource.name)} = z.object({\n${fields}\n});\nexport type ${pascal(resource.name)} = z.infer<typeof ${pascal(resource.name)}>;`;
+	});
+	const entries = ctx.domain.resources.map((resource) => {
+		const extra = [...resource.actions === void 0 || resource.actions.length === 0 ? [] : [`actions: [${resource.actions.map(quote).join(", ")}]`], ...resource.collection === void 0 || resource.collection.length === 0 ? [] : [`collection: [${resource.collection.map(quote).join(", ")}]`]];
+		const options = [
+			`id: "id"`,
+			...ctx.has("tenancy") ? [`relations: { org: { field: "orgId", memberOf: "tenant" } }`] : [],
+			...extra
+		].join(", ");
+		return `  ${resource.name}: resource(${pascal(resource.name)}, ${resource.preset}({ ${options} })),`;
+	});
+	return `import { definePermissions, ${[...new Set(ctx.domain.resources.map((resource) => resource.preset))].toSorted().join(", ")}, resource } from "permdock";
+import { z } from "zod";
+
+${schemas.join("\n\n")}
+
+export const permissions = definePermissions({
+${entries.join("\n")}
+});
+`;
+}
+/** What a role's grant becomes under the preset's features; the matrix and the code read the same answer. */
+function grantShape(preset, role, grant) {
+	const has = (feature) => preset.features.includes(feature);
+	const resource = DOMAINS[preset.archetype].resources.find((item) => item.name === grant.resource);
+	const risky = grant.action === "delete" || (resource?.sensitive ?? []).includes(grant.action);
+	return {
+		owner: grant.own === true && has("ownership") ? resource?.owner : void 0,
+		approval: has("approvals") && risky && role.top !== true,
+		limit: has("limits") && role.name === DOMAINS[preset.archetype].demoRole && grant.action === "create"
+	};
+}
+function grantLine(ctx, role, grant) {
+	const shape = grantShape(ctx.preset, role, grant);
+	const options = [];
+	if (shape.owner !== void 0) options.push(`where: { ${shape.owner}: principal.id }`);
+	if (shape.approval) options.push(`approval: "human"`);
+	if (shape.limit) options.push(`limit: ${LIMIT}`);
+	const target = `permissions.${grant.resource}.${grant.action}`;
+	return options.length === 0 ? `allow(${target})` : `allow(${target}, { ${options.join(", ")} })`;
+}
+function isPro(ctx, grant) {
+	const pro = ctx.domain.pro;
+	return ctx.has("plans") && pro !== void 0 && grant.resource === pro.resource && grant.action === pro.action;
+}
+function policyFile(ctx) {
+	const tenancy = ctx.has("tenancy");
+	const roles = ctx.domain.roles.map((role) => {
+		const grants = role.grants.filter((grant) => role.top === true || !isPro(ctx, grant)).map((grant) => `    ${grantLine(ctx, role, grant)},`).join("\n");
+		const options = [];
+		if (tenancy) {
+			options.push(`on: "tenant"`);
+			if (role.top === true) options.push("min: 1");
+			if (role.assigns !== void 0) options.push(`assigns: [${role.assigns.map(quote).join(", ")}]`);
+		}
+		const tail = options.length === 0 ? "" : `, { ${options.join(", ")} }`;
+		return `  role("${role.name}", [\n${grants}\n  ]${tail}),`;
+	});
+	const pro = ctx.domain.pro;
+	const proGrant = ctx.has("plans") && pro !== void 0 ? `  grants: [allow(permissions.${pro.resource}.${pro.action}, { to: plan("pro") })],\n` : "";
+	const usesPrincipal = ctx.has("ownership") && ctx.domain.roles.some((role) => role.grants.some((grant) => grant.own));
+	const imports = [
+		"allow",
+		"definePolicy",
+		...ctx.has("plans") ? ["plan"] : [],
+		...usesPrincipal ? ["principal"] : [],
+		"role"
+	];
+	const userFields = [
+		"  readonly id: string;",
+		"  readonly roles: readonly string[];",
+		...tenancy ? ["  readonly orgId: string;"] : [],
+		...ctx.has("plans") ? ["  readonly plans: readonly string[];"] : []
+	];
+	const principalFields = [
+		"id: user.id",
+		...tenancy ? ["tenant: user.orgId", `memberships: [{ scope: "tenant", id: user.orgId, roles: user.roles }]`] : ["roles: user.roles"],
+		...ctx.has("plans") ? ["plans: user.plans"] : []
+	];
+	const demo = [
+		`id: "u1"`,
+		`roles: ["${ctx.domain.demoRole}"]`,
+		...tenancy ? [`orgId: "o1"`] : [],
+		...ctx.has("plans") ? [`plans: ["free"]`] : []
+	];
+	return `import { ${imports.join(", ")} } from "permdock";
+
+import { permissions } from "./permissions";
+
+/** The signed-in user as your session or auth provider returns it. */
+export type User = {
+${userFields.join("\n")}
+};
+
+export const policy = definePolicy(permissions, {
+${tenancy ? `  scopes: { tenant: { key: "orgId" } },\n` : ""}  roles: [
+${roles.join("\n")}
+  ],
+${proGrant}  subject: (user: User | null) =>
+    user === null ? null : { ${principalFields.join(", ")} },
+});
+
+/** A user for tests and local runs. */
+export const demoUser: User = { ${demo.join(", ")} };
+`;
+}
+function appFile(ctx) {
+	const valueImports = /* @__PURE__ */ new Set(["defineApp"]);
+	const lines = [];
+	const preamble = [];
+	const services = ctx.preset.services;
+	const cloudServices = services.length > 0;
+	if (cloudServices) preamble.push(`import { cloud } from "permdock/cloud";`);
+	if (services.includes("cloud-hosted-grants")) preamble.push(`import { cloudEndpoints } from "permdock/cloud";`, `import { joseTokenVerifier } from "permdock/jwt";`);
+	if (ctx.has("decision-log")) {
+		if (services.includes("cloud-decision-log")) lines.push("  sink: permdockCloud.sink,");
+		else {
+			valueImports.add("memoryDecisionSink");
+			lines.push("  // A DecisionSink: memory for now; permdock/otel, PermDock Cloud or your own in production.", "  sink: memoryDecisionSink(),");
+		}
+	}
+	if (ctx.has("custom-roles")) {
+		valueImports.add("memoryCustomRoleSource");
+		lines.push("  // Custom roles from your database; postgrestSources() reads them on Supabase.", "  customRoles: memoryCustomRoleSource([]),");
+	}
+	if (services.includes("cloud-approvals")) lines.push("  store: permdockCloud.approvals,");
+	else if (ctx.has("approvals")) lines.push("  // profile dev uses a memory ApprovalStore; set a persistent one (Postgres, PermDock Cloud) for prod.");
+	if (ctx.has("limits")) lines.push("  // profile dev uses a memory LimitStore; set limits(store) with a shared one (Redis, Postgres) for prod.");
+	if (services.includes("cloud-hosted-grants")) {
+		valueImports.add("hostedPolicies");
+		lines.push("  policies: hostedPolicies(permdockCloud.policies),");
+	}
+	const cloudCall = services.includes("cloud-hosted-grants") ? `cloud({\n  verifier: joseTokenVerifier({ jwks: cloudEndpoints().jwks }),\n})` : "cloud()";
+	const snapshots = services.includes("cloud-snapshots") ? `\n/** A client's signed snapshot, served by PermDock Cloud for the caller's token. */\nexport const snapshotsFor = (token: string) => permdockCloud.snapshotsFor(token);\n` : "";
+	const cloudLine = cloudServices ? `\n// PERMDOCK_CLOUD_URL and PERMDOCK_CLOUD_KEY come from the environment.\nexport const permdockCloud = ${cloudCall};\n${snapshots}` : "";
+	const backend = backendApp(ctx);
+	preamble.push(...backend.imports);
+	lines.unshift(...backend.options);
+	const sources = backend.preamble.length === 0 ? "" : `\n${backend.preamble.join("\n")}\n`;
+	return `import { ${[...valueImports].toSorted().join(", ")} } from "permdock";
+${preamble.length === 0 ? "" : `${preamble.join("\n")}\n`}
+import { policy } from "./policy";
+${cloudLine}${sources}
+/**
+ * The app definition every adapter reads. Your own code: change sources,
+ * features and services here; the rules stay in the permdock package.
+ */
+export const app = defineApp(policy, {
+  profile: ${env("NODE_ENV")} === "production" ? "prod" : "dev",
+${lines.join("\n")}${lines.length === 0 ? "" : "\n"}});
+`;
+}
+function frameworkFiles(ctx) {
+	const { resource, action } = firstInstance(ctx);
+	const type = pascal(resource.name);
+	const owned = ownedFile;
+	const { name: current } = sessionCall(ctx);
+	switch (ctx.preset.framework) {
+		case "next": return [owned(`${ctx.src}/permdock/server.ts`, `import { createPermDock } from "permdock/next";
+
+import { app } from "../permdock";
+import { ${current} } from "../session";
+
+// Server-only: Server Components, Server Actions and Route Handlers import
+// from here; client components import hooks from permdock/react.
+export const {
+  getPermDock,
+  getPermission,
+  getSnapshot,
+  requirePermission,
+  permdockHandler,
+} = createPermDock(app, { subject: ${current} });
+`)];
+		case "hono": return [owned(`${ctx.src}/server.ts`, `import { Hono } from "hono";
+import { createPermDock } from "permdock/hono";
+
+import { find${type} } from "./data";
+import { app as permdockApp } from "./permdock";
+import { permissions } from "./permissions";
+import { ${current} } from "./session";
+
+const { protect } = createPermDock(permdockApp, {
+  subject: (c) => ${current}(c.req.raw),
+});
+
+export const app = new Hono();
+
+app.patch(
+  "/${resource.name}s/:id",
+  protect(permissions.${resource.name}.${action}, (c) => find${type}(c.req.param("id") ?? "")),
+  (c) => c.json({ ok: true }),
+);
+`)];
+		case "express": return [owned(`${ctx.src}/server.ts`, `import express from "express";
+import { createPermDock, toRequest } from "permdock/express";
+
+import { find${type} } from "./data";
+import { app as permdockApp } from "./permdock";
+import { permissions } from "./permissions";
+import { ${current} } from "./session";
+
+const { protect } = createPermDock(permdockApp, {
+  subject: (req) => ${current}(toRequest(req)),
+});
+
+export const app = express();
+
+app.patch(
+  "/${resource.name}s/:id",
+  protect(permissions.${resource.name}.${action}, (req) => find${type}(String(req.params["id"]))),
+  (_req, res) => {
+    res.json({ ok: true });
+  },
+);
+`)];
+		case "none":
+			if (current === "currentSubject") return [owned(`${ctx.src}/server.ts`, `import { getPermDock } from "permdock";
+
+import { app } from "./permdock";
+import { currentSubject } from "./session";
+
+/** The request-scoped decision object for the caller of \`request\`; create one per request. */
+export async function permdockFor(request: Request) {
+  return getPermDock(app, await currentSubject(request));
+}
+`)];
+			return [owned(`${ctx.src}/server.ts`, `import { getPermDockSync } from "permdock";
+
+import { app } from "./permdock";
+import type { User } from "./policy";
+
+/** The request-scoped decision object for \`user\`; create one per request. */
+export function permdockFor(user: User | null) {
+  return getPermDockSync(app, user);
+}
+`)];
+		default: return ctx.preset.framework;
+	}
+}
+function operationsFile(ctx) {
+	const entries = ctx.domain.resources.flatMap((resource) => {
+		const type = pascal(resource.name);
+		const ops = [`  list_${resource.name}s: { permission: permissions.${resource.name}.list },`];
+		if (resource.preset === "crud") ops.push(`  delete_${resource.name}: {\n    permission: permissions.${resource.name}.delete,\n    data: (input: { readonly id: string }) => find${type}(input.id),\n  },`);
+		for (const action of resource.collection ?? []) ops.push(`  ${action}_${resource.name}: { permission: permissions.${resource.name}.${action} },`);
+		return ops;
+	});
+	const finds = ctx.domain.resources.filter((resource) => resource.preset === "crud").map((resource) => `find${pascal(resource.name)}`);
+	return `import { defineOperations } from "permdock";
+
+${finds.length === 0 ? "" : `import { ${finds.join(", ")} } from "./data";\n`}import { permissions } from "./permissions";
+
+/** The tools an agent may call, each bound to one permission. */
+export const operations = defineOperations(permissions, {
+${entries.join("\n")}
+});
+`;
+}
+function agentFiles(ctx) {
+	const files = [];
+	if (!ctx.has("operations")) return files;
+	files.push({
+		path: `${ctx.src}/operations.ts`,
+		contents: operationsFile(ctx),
+		kind: "owned"
+	});
+	if (ctx.preset.integrations.includes("ai-sdk")) {
+		const session = sessionCall(ctx);
+		const subject = session.takesRequest ? `// Pass the incoming Request as the AI SDK runtimeContext.
+    subject: ({ runtimeContext }) =>
+      runtimeContext instanceof Request ? ${session.name}(runtimeContext) : null,` : `subject: () => ${session.name}(),`;
+		files.push({
+			path: `${ctx.src}/agent.ts`,
+			contents: `import { createPermDock } from "permdock/ai-sdk";
+
+import { operations } from "./operations";
+import { app } from "./permdock";
+import { ${session.name} } from "./session";
+
+// Pass toolApproval to the AI SDK's tool approval hook, or needsApproval to each tool.
+export const { toolApproval, needsApproval, capabilityMiddleware } =
+  createPermDock(app, {
+    ${subject}
+    actor: () => ({ id: "assistant", kind: "ai-sdk" }),
+    operations,
+  });
+`,
+			kind: "owned"
+		});
+	}
+	if (ctx.preset.integrations.includes("mcp")) files.push({
+		path: `${ctx.src}/mcp.ts`,
+		contents: `import { createPermDock } from "permdock/mcp";
+
+import { app } from "./permdock";
+import type { User } from "./policy";
+
+/** Map the verified MCP auth info to your user; null is anonymous. */
+function userFor(_authInfo: unknown): User | null {
+  return null;
+}
+
+// protectServer(new McpServer(...)) returns a server whose registerTool takes a permission.
+export const { protectServer } = createPermDock(app, {
+  subject: (authInfo) => userFor(authInfo),
+});
+`,
+		kind: "owned"
+	});
+	return files;
+}
+function keysFile(ctx) {
+	if (!ctx.has("api-keys")) return [];
+	const { resource } = firstInstance(ctx);
+	return [{
+		path: `${ctx.src}/keys.ts`,
+		contents: `import { type PermDock, decideCredential } from "permdock";
+
+import { permissions } from "./permissions";
+
+/**
+ * Decides whether the signed-in user may create a read-only key for
+ * ${resource.name}s${ctx.has("tenancy") ? " in their organisation" : ""}. Store the granted credential's hash; show the
+ * key once.
+ */
+export function decideReadKey(permdock: PermDock, id: string) {
+  return decideCredential(permdock, {
+    kind: "service",
+    id,
+    principal: \`service:\${id}\`,
+    tenant: permdock.subject.principal?.tenant ?? "",
+    roles: ["${ctx.domain.demoRole}"],
+    permissions: [permissions.${resource.name}.read, permissions.${resource.name}.list],
+    name: "read-only key",
+  });
+}
+`,
+		kind: "owned"
+	}];
+}
+function rlsOption(ctx) {
+	if (!ctx.has("rls")) return null;
+	const table = `{\n      table: "org_members",\n      tenant: "org_id",\n      user: "user_id",\n      role: "role",\n    }`;
+	return ctx.preset.backend === "supabase" ? `supabaseRls({${ctx.has("tenancy") ? `\n    memberships: ${table},\n  ` : ""}})` : `{\n    dialect: "guc",${ctx.has("tenancy") ? `\n    memberships: { tenant: ${table} },` : ""}\n  }`;
+}
+function configFile(ctx) {
+	const rls = rlsOption(ctx);
+	const options = [
+		`  permissions: "./${ctx.src}/permissions.ts",`,
+		`  policy: "./${ctx.src}/policy.ts",`,
+		...ctx.has("operations") ? [`  operations: "./${ctx.src}/operations.ts",`] : [],
+		...rls === null ? [] : [`  rls: ${rls},`]
+	];
+	return ownedFile("permdock.config.ts", `import { defineConfig } from "permdock/cli";
+${rls !== null && ctx.preset.backend === "supabase" ? `import { supabaseRls } from "permdock/supabase";\n` : ""}
+// The files permdock doctor, check and rls generate read.
+export default defineConfig({
+${options.join("\n")}
+});
+`);
+}
+/** The `@permdock` registry recipes for the preset's UI; native has the gate and the upgrade prompt. */
+function recipesFor(ctx) {
+	const web = ["gated-button"];
+	if (ctx.has("approvals")) web.push("approval-request-dialog");
+	if (ctx.has("tenancy")) web.push("tenant-switcher", "role-picker");
+	if (ctx.has("custom-roles")) web.push("custom-role-editor");
+	if (ctx.has("plans")) web.push("upgrade-prompt");
+	const native = ["gated-button", ...ctx.has("plans") ? ["upgrade-prompt"] : []];
+	return [...ctx.preset.integrations.includes("shadcn") ? web.map((name) => `@permdock/${name}`) : [], ...ctx.preset.integrations.includes("react-native") ? native.map((name) => `@permdock/${name}-native`) : []];
+}
+function dependenciesFor(ctx) {
+	const deps = ["permdock", "zod"];
+	deps.push(...{
+		next: [
+			"next",
+			"react",
+			"react-dom"
+		],
+		hono: ["hono"],
+		express: ["express"],
+		none: []
+	}[ctx.preset.framework]);
+	if (ctx.preset.integrations.includes("ai-sdk")) deps.push("ai");
+	if (ctx.preset.integrations.includes("mcp")) deps.push("@modelcontextprotocol/server");
+	deps.push(...authDependencies(ctx), ...backendDependencies(ctx));
+	if (ctx.preset.services.includes("cloud-hosted-grants")) deps.push("jose");
+	return [...new Set(deps)];
+}
+function docsFor(ctx) {
+	const docs = ["/docs/concepts/apps", "/docs/concepts/policies"];
+	const byFeature = {
+		tenancy: "/docs/concepts/tenancy",
+		"custom-roles": "/docs/concepts/custom-roles",
+		approvals: "/docs/adapters/approvals",
+		operations: "/docs/concepts/operations",
+		"decision-log": "/docs/concepts/audit-and-observability",
+		"api-keys": "/docs/concepts/credentials",
+		rls: "/docs/adapters/rls"
+	};
+	for (const feature of ctx.preset.features) {
+		const page = byFeature[feature];
+		if (page !== void 0) docs.push(page);
+	}
+	if (ctx.preset.framework !== "none") docs.push(`/docs/adapters/${ctx.preset.framework}`);
+	docs.push(...authDocs(ctx), ...backendDocs(ctx));
+	if (ctx.preset.services.length > 0) docs.push("/docs/adapters/cloud");
+	return [...new Set(docs)];
+}
+/**
+* The files, dependencies and recipes for `preset`. Pure: no file system
+* and no network, so the same function runs in the CLI, in a registry route
+* and in the browser preview on /create.
+*/
+function generatePreset(preset, options = {}) {
+	const ctx = {
+		preset,
+		domain: DOMAINS[preset.archetype],
+		has: (feature) => preset.features.includes(feature),
+		src: options.src ?? "src"
+	};
+	const owned = (path, contents) => ownedFile(`${ctx.src}/${path}`, contents);
+	return Object.freeze({
+		code: encodePreset(preset),
+		files: Object.freeze([
+			owned("permissions.ts", permissionsFile(ctx)),
+			owned("policy.ts", policyFile(ctx)),
+			owned("permdock.ts", appFile(ctx)),
+			...backendFiles(ctx),
+			...sessionFiles(ctx),
+			...frameworkFiles(ctx),
+			...agentFiles(ctx),
+			...keysFile(ctx),
+			configFile(ctx)
+		]),
+		dependencies: Object.freeze(dependenciesFor(ctx)),
+		recipes: Object.freeze(recipesFor(ctx)),
+		docs: Object.freeze(docsFor(ctx))
+	});
+}
+//#endregion
+//#region src/preset/matrix.ts
+const NONE = {
+	access: "none",
+	approval: false,
+	limit: false
+};
+/**
+* Who may do what under `preset`, from the same model the generated policy
+* is written from, for a page that shows the policy without running it.
+*/
+function presetMatrix(preset) {
+	const domain = DOMAINS[preset.archetype];
+	const plans = preset.features.includes("plans") && domain.pro !== void 0;
+	const rows = domain.resources.flatMap((resource) => {
+		return [
+			...resource.preset === "crud" ? [
+				"read",
+				"list",
+				"create",
+				"update",
+				"delete"
+			] : ["read", "list"],
+			...resource.actions ?? [],
+			...resource.collection ?? []
+		].map((action) => ({
+			resource: resource.name,
+			action
+		}));
+	}).map(({ resource, action }) => {
+		const cells = {};
+		const isPro = plans && domain.pro?.resource === resource && domain.pro.action === action;
+		for (const role of domain.roles) {
+			const grant = role.grants.find((item) => item.resource === resource && item.action === action);
+			if (grant === void 0 || isPro && role.top !== true) {
+				cells[role.name] = isPro ? {
+					...NONE,
+					access: "pro"
+				} : NONE;
+				continue;
+			}
+			const shape = grantShape(preset, role, grant);
+			cells[role.name] = {
+				access: shape.owner === void 0 ? "allow" : "own",
+				approval: shape.approval,
+				limit: shape.limit
+			};
+		}
+		return {
+			resource,
+			action,
+			cells
+		};
+	});
+	return {
+		roles: domain.roles.map((role) => role.name),
+		rows
+	};
+}
+//#endregion
+export { decodePreset as a, AUTH as c, FRAMEWORKS as d, INTEGRATIONS as f, resolvePreset as g, integrationsOf as h, presetFlags as i, BACKENDS as l, SERVICES as m, generatePreset as n, encodePreset as o, PRESET_DEFAULTS as p, PRESET_FLAGS as r, ARCHETYPES as s, presetMatrix as t, FEATURES as u };