permdock 0.4.0 → 0.6.0

package/dist/{fixtures-h2eG2OZV.js → fixtures-B7XrLeY7.js}

@@ -1,22 +1,23 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as configError } from "./errors-CWTY6uih.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { a as loadModule, s as pickNamed } from "./load-C3_oTHyO.js";
+import { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
 function asFixtures(value) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
-	if (list === void 0) throw new Error("PermDock CLI: fixtures must be an array or { fixtures }");
+	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
-		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw new Error(`PermDock CLI: fixture ${index} needs subject and row`);
+		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
 		if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);
 		const memberships = item["subject"]["memberships"];
-		if (memberships !== void 0 && !Array.isArray(memberships)) throw new Error(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
+		if (memberships !== void 0 && !Array.isArray(memberships)) throw configError(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
 		const tenant = item["subject"]["tenant"];
-		if (tenant !== void 0 && typeof tenant !== "string") throw new Error(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
+		if (tenant !== void 0 && typeof tenant !== "string") throw configError(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
 		const claims = item["subject"]["claims"];
-		if (claims !== void 0 && !isRecord(claims)) throw new Error(`PermDock CLI: fixture ${index} subject.claims must be an object`);
+		if (claims !== void 0 && !isRecord(claims)) throw configError(`PermDock CLI: fixture ${index} subject.claims must be an object`);
 		return item;
 	});
 }
@@ -28,7 +29,7 @@ function asCustomRoles(value) {
 /** A `.json` file or a module exporting `fixtures` (or default) and optionally `customRoles`. */
 async function loadFixtures(cwd, path) {
 	const abs = resolve(cwd, path);
-	if (!existsSync(abs)) throw new Error(`PermDock CLI: fixtures not found: ${path}`);
+	if (!existsSync(abs)) throw configError(`PermDock CLI: fixtures not found: ${path}`);
 	if (abs.endsWith(".json")) {
 		const parsed = readJsonFile(abs);
 		return {

package/dist/flags-C3DktBDY.js

@@ -0,0 +1,86 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { n as secretInput } from "./credentials-DPyHmYz5.js";
+//#region src/cli/core/flags.ts
+/** The flag vocabulary shared with better-supabase: one spelling per meaning. */
+const dbUrlFlags = { "db-url-stdin": {
+	type: "boolean",
+	description: "Read the Postgres connection string from stdin (default $DATABASE_URL, then $SUPABASE_DB_URL)"
+} };
+const outFlag = { out: {
+	type: "string",
+	description: "File to write",
+	valueHint: "file"
+} };
+const checkFlag = { check: {
+	type: "boolean",
+	description: "Exit 1 when a file on disk is stale; write nothing"
+} };
+const dryRunFlag = { "dry-run": {
+	type: "boolean",
+	description: "Print what would change; write nothing"
+} };
+const forceFlag = { force: {
+	type: "boolean",
+	description: "Overwrite files PermDock did not write or that changed by hand"
+} };
+const policyFlag = { policy: {
+	type: "string",
+	description: "Module exporting the policy (default policy in the config)",
+	valueHint: "module"
+} };
+const permissionsFlag = { permissions: {
+	type: "string",
+	description: "Module exporting the permissions (default permissions in the config)",
+	valueHint: "module"
+} };
+const failOnFlag = { "fail-on": {
+	type: "enum",
+	options: ["error", "warning"],
+	default: "error",
+	description: "Lowest finding severity that exits 1"
+} };
+const validatorFlag = { validator: {
+	type: "enum",
+	options: [
+		"zod",
+		"valibot",
+		"arktype"
+	],
+	description: "Schema library for the generated resources (default zod)"
+} };
+/**
+* The connection string from `--db-url-stdin`, or, when the leaf needs one,
+* `DATABASE_URL` then `SUPABASE_DB_URL`: the order better-supabase reads them.
+*/
+async function dbUrl(ctx, flags, options) {
+	const piped = await secretInput(ctx, {
+		flag: "db-url",
+		stdin: flags["db-url-stdin"]
+	});
+	if (piped !== void 0 || options?.required !== true) return piped;
+	for (const name of DB_URL_ENV) {
+		const value = ctx.env[name];
+		if (value !== void 0 && value !== "") {
+			ctx.addSecret(value);
+			return value;
+		}
+	}
+}
+const DB_URL_ENV = ["DATABASE_URL", "SUPABASE_DB_URL"];
+/** A string flag given with a value; a bare flag reads as `""`. */
+function given(value) {
+	return value === void 0 || value === "" ? void 0 : value;
+}
+/**
+* `--out` for a command that only writes a file: `-` is refused instead of
+* creating a file named `-`.
+*/
+function fileOut(command, value) {
+	if (value === "-") throw new CliError("usage", `${command}: --out - is not supported; name a file.`, {
+		code: "invalid_value",
+		extensions: { flag: "--out" }
+	});
+	return given(value);
+}
+//#endregion
+export { failOnFlag as a, given as c, policyFlag as d, validatorFlag as f, dryRunFlag as i, outFlag as l, dbUrl as n, fileOut as o, dbUrlFlags as r, forceFlag as s, checkFlag as t, permissionsFlag as u };

package/dist/{from-snapshot-7REQZe0H.js → from-snapshot-CTCMsFZk.js}

@@ -1,17 +1,20 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-drnfxYtm.js";
-import { n as sameId } from "./ids-DC4V4CFu.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-tvpa34ep.js";
-import { _ as evaluateCondition, a as whereFromGrants, f as rowIdOf, g as simulateArazzo, h as isArazzoSimulateInput, i as signSnapshot, p as rowValues, s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
-import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
-import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-CXY-0C87.js";
-import { i as pickVisible, r as grantCoversField, t as isActive } from "./validity-dVrUEPJt.js";
-import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DshjqY0n.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
+import { o as sameId } from "./expiry-D4_YKRKD.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DN2QAx9z.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { n as matchGrantee } from "./grantee-match-fxYp9Nmt.js";
+import { r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { n as payloadDigest, t as decisionToken } from "./token-Bx9qy30p.js";
+import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-C9vfEphl.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -81,6 +84,8 @@ function conditionOk(grant, permission, current, next, subject, now, scopes) {
 		matched: false,
 		reason: "opaque-condition"
 	};
+	const deny = grant.effect === "deny";
+	let whereMatched;
 	if (grant.where !== void 0) {
 		if (permission.kind === "collection" || current === void 0) return {
 			matched: false,
@@ -90,17 +95,22 @@ function conditionOk(grant, permission, current, next, subject, now, scopes) {
 			matched: false,
 			reason: "opaque-condition"
 		};
-		const matched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
+		whereMatched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
 		if (opaqueReached) return {
 			matched: false,
 			reason: "opaque-condition"
 		};
-		if (!matched) return {
+		if (whereMatched && deny) return { matched: true };
+		if (!whereMatched && !deny) return {
 			matched: false,
 			reason: "condition"
 		};
 	}
-	const check = grant.check;
+	const check = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (check === void 0 && whereMatched === false) return {
+		matched: false,
+		reason: "condition"
+	};
 	if (check !== void 0) {
 		if (check.op === "opaque") return {
 			matched: false,
@@ -135,7 +145,7 @@ function matchedOf(grant) {
 	});
 }
 function evaluateSnapshot(snapshot, subject, permission, data, team, options, outcomeOnly = false) {
-	let clock = options.now;
+	let clock = options.now === void 0 ? void 0 : epochSeconds(options.now);
 	const now = () => clock ??= nowSeconds();
 	const tracer = options.explain === true ? {
 		evaluated: 0,
@@ -175,6 +185,15 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		}],
 		alternatives: []
 	});
+	if (clock !== void 0 && !Number.isFinite(clock)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "validation",
+			detail: INVALID_NOW
+		}],
+		alternatives: []
+	});
 	const { current, next } = rowValues(permission, data);
 	const scopes = scopeList(snapshot.scopes);
 	const denials = [];
@@ -192,7 +211,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			continue;
 		}
 		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now(), options.scope);
-		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
+		if (scoped.ok !== (grant.effect === "deny") && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
 		if (!scoped.ok) {
 			denials.push(compact({
 				role: grant.role,
@@ -201,7 +220,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			}));
 			continue;
 		}
-		if (!isActive(grant.validity, now())) {
+		if (!isActive(readWireValidity(grant.validity, grant.effect), now())) {
 			if (grant.effect === "allow") denials.push({
 				role: grant.role,
 				reason: "inactive-grant",
@@ -278,7 +297,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			alternatives: []
 		});
 	}
-	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key)) return done({
+	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key) || readOnlyActorRefuses(subject.actor, permission)) return done({
 		outcome: "denied",
 		denials: [{
 			role: null,
@@ -301,8 +320,8 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: `snapshot:${String(snapshot.issuedAt)}`,
-		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+		fingerprint: `snapshot:${snapshot.issuedAt}`,
+		payload: tokenPayload(resourceId, next ?? current, options.args)
 	});
 	const grant = matchedOf(matched);
 	if (requiresApproval(matched.approval)) return done({
@@ -344,9 +363,9 @@ function subjectFromSnapshot(snapshot, tenant) {
 			...principal,
 			tenant: nextTenant
 		}),
-		delegation: snapshot.subject.delegation,
+		delegation: fromWireDelegation(snapshot.subject.delegation),
 		context: snapshot.subject.context,
-		expiresAt: snapshot.expiresAt
+		expiresAt: secondsOf(snapshot.expiresAt)
 	}));
 }
 /**
@@ -415,12 +434,18 @@ function fromSnapshot(snapshot, options = {}) {
 	});
 	const explain = ((permission, data, decideOptions) => run(permission, data, {
 		...decideOptions,
-		source: decideOptions?.source ?? "explain",
+		call: decideOptions?.call ?? "explain",
 		explain: true
 	}));
 	const instance = {
 		can,
 		decide,
+		decideEach(permission, rows, decideOptions) {
+			return Object.freeze(rows.map((row) => run(permission, row, decideOptions)));
+		},
+		decideFor(_principalId, permission) {
+			return Promise.resolve(deniedFor(permission, "unsupported"));
+		},
 		assert,
 		explain,
 		permissions: {},
@@ -448,7 +473,6 @@ function fromSnapshot(snapshot, options = {}) {
 		},
 		simulate: ((input, simulateOptions) => {
 			if (Array.isArray(input)) return input.map(([permission, data]) => run(permission, data, compact({ now: simulateOptions?.now })));
-			if (isArazzoSimulateInput(input)) return simulateArazzo(input, input.permissions, (permission, data) => run(permission, data));
 			const preview = input;
 			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
 			return fromSnapshot(freezeDeep({
@@ -465,7 +489,7 @@ function fromSnapshot(snapshot, options = {}) {
 				}
 			}), options);
 		}),
-		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, signing.audience)),
+		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, compact({ audience: signing.audience }))),
 		on() {
 			return () => void 0;
 		},
@@ -507,38 +531,17 @@ function fromSnapshot(snapshot, options = {}) {
 			}
 			return out;
 		},
-		loadRelations() {
+		prefetchRelations() {
 			return Promise.resolve();
 		},
-		whoCan(permission) {
-			return Promise.resolve(freezeDeep({
-				permission: permission.key,
-				holders: [],
-				complete: false
-			}));
+		mayUse(permission) {
+			return mayUse(instance, permission);
 		},
-		decideRoleChange(change) {
-			return freezeDeep({
-				outcome: "denied",
-				change,
-				denials: [{
-					role: null,
-					reason: "unsupported"
-				}]
-			});
+		permittedIds(permission, scope, query) {
+			return permittedIds(instance, permission, scope, query);
 		},
 		derive() {
-			return instance;
-		},
-		activate() {
-			return freezeDeep({
-				outcome: "denied",
-				denials: [{
-					role: null,
-					reason: "unsupported"
-				}],
-				alternatives: []
-			});
+			return Promise.resolve(instance);
 		},
 		assignableRoles(query) {
 			if (query?.scope === "global") return [];
@@ -566,7 +569,7 @@ function fromSnapshot(snapshot, options = {}) {
 function emptySnapshot() {
 	return freezeDeep({
 		v: 1,
-		issuedAt: 0,
+		issuedAt: "1970-01-01T00:00:00.000Z",
 		subject: {
 			principal: null,
 			context: {}

package/dist/{grantee-conditions-MQs5NIuX.js → grantee-conditions-CcXf8hMM.js}

@@ -1,6 +1,7 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
-import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { d as isoNow } from "./time-DkWjdL98.js";
+import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
 //#region src/core/grantee-conditions.ts
 /**
 * Where a graph relation starts on the row: its own id when the relation is
@@ -196,7 +197,7 @@ function relationCondition(grantee, resource, scopes = scopeList(void 0), option
 			field: spec.principal,
 			value: { ref: "principal.id" }
 		};
-		const period = periodConditions(spec, options.now ?? { date: (/* @__PURE__ */ new Date()).toISOString() });
+		const period = periodConditions(spec, options.now ?? { date: isoNow() });
 		return period.length === 0 ? owner : {
 			op: "and",
 			conditions: [owner, ...period]

package/dist/{grantee-CXY-0C87.js → grantee-hxrUsbpM.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { a as assertSafeKey, c as ownKeys, o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
-import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-CV8pqqMi.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-BsblpB-z.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";
 const PLAN_KIND = "plan";
@@ -133,11 +133,10 @@ function synthesiseRole(key, options) {
 	const on = options?.on;
 	const assignable = options?.assignable ?? false;
 	const meta = options?.meta;
-	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+	const leaf = on === void 0 ? makeRole(key, meta === void 0 ? { assignable } : {
 		assignable,
 		meta
-	});
-	return makeRole(key, meta === void 0 ? {
+	}) : makeRole(key, meta === void 0 ? {
 		on,
 		assignable
 	} : {
@@ -145,6 +144,17 @@ function synthesiseRole(key, options) {
 		assignable,
 		meta
 	});
+	if (options?.shared !== true) return leaf;
+	const shared = Object.defineProperty({
+		...leaf,
+		shared: true
+	}, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(shared);
 }
 function isGrantee(value) {
 	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";

package/dist/{grantee-match-fxYp9Nmt.js → grantee-match-DbENBHLB.js}

@@ -1,7 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { d as scopeList, t as activeFor } from "./scopes-tvpa34ep.js";
-import { o as flattenGrantee } from "./grantee-CXY-0C87.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { u as isoAt } from "./time-DkWjdL98.js";
+import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;
@@ -79,7 +80,7 @@ function matchOne(grantee, subject, now, resource, scopes, resources) {
 			};
 			const where = relationCondition(grantee, resource, scopes, {
 				resources,
-				now: { date: (/* @__PURE__ */ new Date(now * 1e3)).toISOString() }
+				now: { date: isoAt(now * 1e3) }
 			});
 			if (where === void 0 && resource !== void 0) return {
 				matched: false,

package/dist/h3/index.d.ts

@@ -0,0 +1,37 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
+//#region src/h3/create.d.ts
+type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;
+/** `event.context` once `middleware()` or `protect` ran: the instance and the loaded row. */
+type H3PermDockContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3EventContext & {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event `withPermDock` hands its handler. */
+type H3PermDockEvent<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3Event & {
+  readonly context: H3PermDockContext<TData, V>;
+};
+type H3PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Global or route middleware that sets `event.context.permdock`. */
+  readonly middleware: () => Middleware;
+  /** Route middleware: a refusal short-circuits with Problem Details. */
+  readonly protect: FetchProtect<H3Event, Middleware>;
+  readonly getPermDock: (event: H3Event) => Promise<PermDock<V>>;
+  readonly getSnapshot: (event: H3Event, query?: SnapshotQuery) => Promise<Snapshot>;
+  /**
+   * Types `event.context.permdock` and `permdockData` for the handler, builds
+   * the instance when no middleware set it, and answers a thrown PermDock
+   * error with Problem Details.
+   */
+  readonly withPermDock: <TData = unknown>(handler: (event: H3PermDockEvent<TData, V>) => unknown) => EventHandler;
+  readonly connection: (event: H3Event, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** The decision endpoint: `app.all('/api/permdock', permdockHandler())`. */
+  readonly permdockHandler: () => EventHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: H3PermDockOptions<TUser>): H3PermDock<V>;
+//#endregion
+export { type ContextReader, type H3PermDock, type H3PermDockContext, type H3PermDockEvent, type H3PermDockOptions, InvalidSignatureError, type ProtectTarget, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/h3/index.js

@@ -0,0 +1,35 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { i as decorate } from "../bind-CAvgUuKs.js";
+import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+//#region src/h3/create.ts
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);
+	const middleware = () => async (event, next) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, next);
+	};
+	const protect = ((target, data, protectOptions) => async (event, next) => {
+		const guard = await adapter.guard(target, data, event, protectOptions);
+		if (!guard.ok) return guard.response;
+		decorate(event.context, guard.permdock, guard.data);
+		return adapter.mapErrors(event, next);
+	});
+	const withPermDock = (handler) => async (event) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, () => handler(event));
+	};
+	return {
+		middleware,
+		protect,
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		withPermDock,
+		connection: adapter.connection,
+		permdockHandler: () => adapter.handler(),
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/headers-BIjfMaoC.js

@@ -0,0 +1,8 @@
+import { t as approvalHeaderValue } from "./approval-header-CJACtHkv.js";
+//#region src/client/headers.ts
+/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
+function approvalHeaders(token) {
+	return { "PermDock-Approval": approvalHeaderValue(token) };
+}
+//#endregion
+export { approvalHeaders as t };

package/dist/headers-CIbDTUTK.d.ts

@@ -0,0 +1,7 @@
+//#region src/client/headers.d.ts
+/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
+declare function approvalHeaders(token: string): {
+  readonly "PermDock-Approval": string;
+};
+//#endregion
+export { approvalHeaders as t };