permdock 0.6.0 → 0.8.0

package/dist/generate-CRVV5V7l.js

@@ -0,0 +1,165 @@
+import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-DcyrPS-r.js";
+import { o as quoteSqlIdent } from "./sql-0WjxIp9g.js";
+import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
+import { r as driftOf } from "./output-files-BIQ_9pIs.js";
+//#region src/cli/scim/generate.ts
+const SCIM_MARKER = "-- generated by permdock scim generate";
+/**
+* The client roles each dialect's data API connects as; none may reach the
+* directory.
+*/
+function clientRoles(dialect) {
+	switch (dialect) {
+		case "supabase": return [
+			"public",
+			"anon",
+			"authenticated"
+		];
+		case "neon": return [
+			"public",
+			"anonymous",
+			"authenticated"
+		];
+		case "guc": return ["public"];
+		default: return dialect;
+	}
+}
+/**
+* The directory `postgresDirectoryStore` reads and writes: users, groups and
+* group members keyed on `(tenant, id)`, with `userName` and `externalId`
+* unique per tenant. Member values are SCIM `value`s, not a foreign key to
+* users, because a member may be a nested group. No client role may read or
+* write the tables.
+*/
+function scimSchemaSql(input) {
+	const schema = quoteSqlIdent(input.schema);
+	const table = (name) => `${schema}.${quoteSqlIdent(name)}`;
+	const users = table(SCIM_TABLES.users);
+	const groups = table(SCIM_TABLES.groups);
+	const members = table(SCIM_TABLES.members);
+	const all = [
+		users,
+		groups,
+		members
+	].join(", ");
+	return `${SCIM_MARKER} (--dialect ${input.dialect})
+-- the SCIM directory postgresDirectoryStore reads and writes for scimHandler; every row belongs to one tenant
+create schema if not exists ${schema};
+
+create table if not exists ${users} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  user_name text not null,
+  external_id text,
+  active boolean not null default true,
+  emails jsonb,
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userName)} unique (tenant, user_name),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${groups} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  display_name text not null,
+  external_id text,
+  roles text[],
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.groupExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${members} (
+  tenant text not null,
+  group_id text not null,
+  user_id text not null,
+  position integer not null default 0,
+  primary key (tenant, group_id, user_id),
+  foreign key (tenant, group_id) references ${groups} (tenant, id) on delete cascade
+);
+create index if not exists ${quoteSqlIdent(`${SCIM_TABLES.members}_user_idx`)} on ${members} (tenant, user_id);
+
+-- server only: grant select, insert, update and delete on these tables to the role postgresDirectoryStore
+-- connects as when it does not own them
+alter table ${users} enable row level security;
+alter table ${groups} enable row level security;
+alter table ${members} enable row level security;
+revoke all on table ${all} from ${clientRoles(input.dialect).join(", ")};
+`;
+}
+/**
+* `supabase/schemas/<schema>/scim.sql` for Supabase, the pg-delta per-schema
+* layout; `permdock_scim.sql` otherwise.
+*/
+function scimOut(dialect, schema) {
+	return dialect === "supabase" ? `supabase/schemas/${schema}/scim.sql` : "permdock_scim.sql";
+}
+function runScimGenerate(input) {
+	const dialect = input.dialect ?? input.config.rls?.dialect ?? "supabase";
+	const schema = input.schema ?? input.config.rls?.schema ?? "permdock";
+	const sql = scimSchemaSql({
+		schema,
+		dialect
+	});
+	const out = input.out ?? scimOut(dialect, schema);
+	const data = {
+		out,
+		dialect,
+		schema,
+		tables: Object.values(SCIM_TABLES).map((name) => `${schema}.${name}`)
+	};
+	if (out === "-") return {
+		code: 0,
+		output: sql.trimEnd(),
+		data: {
+			...data,
+			sql
+		}
+	};
+	if (input.check) {
+		const drift = driftOf(input.cwd, [{
+			part: "scim",
+			rel: out,
+			text: sql
+		}]);
+		return drift.length === 0 ? {
+			code: 0,
+			output: `${out} is current`,
+			data
+		} : {
+			code: 1,
+			output: `${drift.join("\n")}\nrun permdock scim generate`,
+			data: {
+				...data,
+				drift
+			}
+		};
+	}
+	const applied = applyFiles(input.cwd, [{
+		path: out,
+		text: sql
+	}], { dryRun: input.dryRun });
+	return {
+		code: 0,
+		output: fileSummary(applied, input.dryRun),
+		data: {
+			...data,
+			files: applied
+		},
+		next: [{
+			when: "in CI, to fail when the file is stale",
+			command: "permdock scim generate --check"
+		}]
+	};
+}
+//#endregion
+export { runScimGenerate };

package/dist/generate-CezbCaTI.js

@@ -0,0 +1,275 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+//#region src/cli/generate.ts
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
+const MAX_DEPTH = 6;
+function isSchemaKind(value) {
+	return value === "zod" || value === "valibot" || value === "arktype";
+}
+function schemaImport(kind) {
+	switch (kind) {
+		case "zod": return "import { z } from 'zod'";
+		case "valibot": return "import * as v from 'valibot'";
+		case "arktype": return "import { type } from 'arktype'";
+		default: return kind;
+	}
+}
+function emptySchema(kind) {
+	return schemaExpression(kind, { type: "object" });
+}
+function propertyKey(name) {
+	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
+}
+function literalEnum(schema) {
+	const type = schema["type"];
+	const nullable = Array.isArray(type) && type.includes("null");
+	const all = schema["enum"];
+	const values = nullable && Array.isArray(all) ? all.filter((value) => value !== null) : all;
+	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;
+	return values;
+}
+function schemaType(schema) {
+	const type = schema["type"];
+	if (typeof type === "string") return type;
+	if (Array.isArray(type)) {
+		const named = type.filter((item) => item !== "null");
+		return named.length === 1 && typeof named[0] === "string" ? named[0] : void 0;
+	}
+	return isRecord(schema["properties"]) ? "object" : void 0;
+}
+function bound(node, key) {
+	const value = node[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function isNullable(node, emit) {
+	const type = node["type"];
+	return emit.constraints && Array.isArray(type) && type.includes("null");
+}
+function formatOf(node, emit) {
+	const format = node["format"];
+	return emit.constraints && typeof format === "string" ? format : void 0;
+}
+/** `[method, value]` pairs for the bounds `keys` names, in order. */
+function bounds(node, emit, keys) {
+	if (!emit.constraints) return [];
+	return keys.flatMap(([key, method]) => {
+		const value = bound(node, key);
+		return value === void 0 ? [] : [[method, value]];
+	});
+}
+const NUMBER_BOUNDS = [
+	["minimum", "min"],
+	["exclusiveMinimum", "gt"],
+	["maximum", "max"],
+	["exclusiveMaximum", "lt"]
+];
+const LENGTH_BOUNDS = [["minLength", "min"], ["maxLength", "max"]];
+const ITEM_BOUNDS = [["minItems", "min"], ["maxItems", "max"]];
+const ZOD_FORMATS = {
+	uuid: "z.uuid()",
+	email: "z.email()",
+	uri: "z.url()",
+	"date-time": "z.iso.datetime({ offset: true })",
+	date: "z.iso.date()"
+};
+function zodChain(base, pairs) {
+	return `${base}${pairs.map(([method, value]) => `.${method}(${String(value)})`).join("")}`;
+}
+function zodOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const expression = zodNode(node, emit, depth);
+	return isNullable(node, emit) ? `${expression}.nullable()` : expression;
+}
+function zodNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return `z.enum(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "z.unknown()";
+	switch (type) {
+		case "string": return zodChain(ZOD_FORMATS[formatOf(node, emit) ?? ""] ?? "z.string()", bounds(node, emit, LENGTH_BOUNDS));
+		case "number": return zodChain("z.number()", bounds(node, emit, NUMBER_BOUNDS));
+		case "integer": return zodChain("z.number().int()", bounds(node, emit, NUMBER_BOUNDS));
+		case "boolean": return "z.boolean()";
+		case "array": return zodChain(`z.array(${isRecord(node["items"]) ? zodOf(node["items"], emit, depth + 1) : "z.unknown()"})`, bounds(node, emit, ITEM_BOUNDS));
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => {
+				const expression = zodOf(child, emit, depth + 1);
+				return `${propertyKey(name)}: ${required ? expression : `${expression}.optional()`}`;
+			});
+			return `z.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "z.unknown()";
+	}
+}
+/** Each property of an object schema with whether `required` names it. */
+function objectFields(node) {
+	const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
+	const properties = isRecord(node["properties"]) ? node["properties"] : {};
+	return Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => [
+		name,
+		child,
+		required.has(name)
+	]);
+}
+const VALIBOT_FORMATS = {
+	uuid: "v.uuid()",
+	email: "v.email()",
+	uri: "v.url()",
+	"date-time": "v.isoTimestamp()",
+	date: "v.isoDate()"
+};
+const VALIBOT_NUMBER_BOUNDS = [
+	["minimum", "minValue"],
+	["exclusiveMinimum", "gtValue"],
+	["maximum", "maxValue"],
+	["exclusiveMaximum", "ltValue"]
+];
+function valibotPipe(base, actions) {
+	return actions.length === 0 ? base : `v.pipe(${[base, ...actions].join(", ")})`;
+}
+function valibotLength(pairs) {
+	return pairs.map(([method, value]) => `v.${method === "min" ? "minLength" : "maxLength"}(${String(value)})`);
+}
+function valibotOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const expression = valibotNode(node, emit, depth);
+	return isNullable(node, emit) ? `v.nullable(${expression})` : expression;
+}
+function valibotNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return `v.picklist(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "v.unknown()";
+	const numeric = bounds(node, emit, VALIBOT_NUMBER_BOUNDS).map(([method, value]) => `v.${method}(${String(value)})`);
+	switch (type) {
+		case "string": {
+			const format = VALIBOT_FORMATS[formatOf(node, emit) ?? ""];
+			return valibotPipe("v.string()", [...format === void 0 ? [] : [format], ...valibotLength(bounds(node, emit, LENGTH_BOUNDS))]);
+		}
+		case "number": return valibotPipe("v.number()", numeric);
+		case "integer": return valibotPipe("v.number()", ["v.integer()", ...numeric]);
+		case "boolean": return "v.boolean()";
+		case "array": return valibotPipe(`v.array(${isRecord(node["items"]) ? valibotOf(node["items"], emit, depth + 1) : "v.unknown()"})`, valibotLength(bounds(node, emit, ITEM_BOUNDS)));
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => {
+				const expression = valibotOf(child, emit, depth + 1);
+				return `${propertyKey(name)}: ${required ? expression : `v.optional(${expression})`}`;
+			});
+			return `v.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "v.unknown()";
+	}
+}
+const ARKTYPE_FORMATS = {
+	uuid: "string.uuid",
+	email: "string.email",
+	uri: "string.url",
+	"date-time": "string.date.iso",
+	date: "string.date.iso"
+};
+/** `1 <= string <= 120`; arktype bounds apply to `string` and `number` only. */
+function arktypeRange(keyword, pairs) {
+	const lower = pairs.find(([method]) => method === "min" || method === "gt");
+	const upper = pairs.find(([method]) => method === "max" || method === "lt");
+	const left = lower === void 0 ? "" : `${String(lower[1])} ${lower[0] === "gt" ? "<" : "<="} `;
+	const right = upper === void 0 ? "" : ` ${upper[0] === "lt" ? "<" : "<="} ${String(upper[1])}`;
+	return lower !== void 0 && upper === void 0 ? `${keyword} ${lower[0] === "gt" ? ">" : ">="} ${String(lower[1])}` : `${left}${keyword}${right}`;
+}
+/** An arktype definition: a string keyword or an object literal. */
+function arktypeOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const definition = arktypeNode(node, emit, depth);
+	if (!isNullable(node, emit)) return definition;
+	return definition.startsWith("'") ? `'${definition.slice(1, -1)} | null'` : `[${definition}, '|', 'null']`;
+}
+function arktypeNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return JSON.stringify(values.map((value) => `'${value.replaceAll("'", "\\'")}'`).join(" | "));
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "'unknown'";
+	switch (type) {
+		case "string": {
+			const format = ARKTYPE_FORMATS[formatOf(node, emit) ?? ""];
+			return format === void 0 ? `'${arktypeRange("string", bounds(node, emit, LENGTH_BOUNDS))}'` : `'${format}'`;
+		}
+		case "number": return `'${arktypeRange("number", bounds(node, emit, NUMBER_BOUNDS))}'`;
+		case "integer": return "'number.integer'";
+		case "boolean": return "'boolean'";
+		case "array": {
+			if (!isRecord(node["items"])) return "'unknown[]'";
+			const item = arktypeOf(node["items"], emit, depth + 1);
+			return item.startsWith("'") && !item.includes("|") ? `'${item.slice(1, -1)}[]'` : `[${item}, '[]']`;
+		}
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => `${JSON.stringify(required ? name : `${name}?`)}: ${arktypeOf(child, emit, depth + 1)}`);
+			return `{${fields.length === 0 ? "" : ` ${fields.join(", ")} `}}`;
+		}
+		default: return "'unknown'";
+	}
+}
+/**
+* A validator expression for a JSON Schema object. Only the portable core
+* (primitives, enums of strings, arrays, objects with `required`) is
+* translated, plus with `constraints` the formats, bounds and nullable types;
+* anything else becomes the validator's `unknown`.
+*/
+function schemaExpression(kind, schema, resolve = (node) => node, options = {}) {
+	const emit = {
+		resolve,
+		constraints: options.constraints === true
+	};
+	switch (kind) {
+		case "zod": return zodOf(schema, emit, 0);
+		case "valibot": return valibotOf(schema, emit, 0);
+		case "arktype": return `type(${arktypeOf(schema, emit, 0)})`;
+		default: return kind;
+	}
+}
+function renderList(value, indent) {
+	if (Array.isArray(value)) return JSON.stringify(value);
+	return JSON.stringify(value, null, 2).replaceAll("\n", `\n${indent}`);
+}
+function renderResource(resource, indent) {
+	const inner = `${indent}  `;
+	const options = [
+		`${inner}id: '${(resource.id ?? "id").replaceAll("\\", "\\\\").replaceAll("'", "\\'")}',`,
+		`${inner}actions: ${renderList(resource.actions, inner)},`,
+		`${inner}collection: ${renderList(resource.collection, inner)},`
+	].join("\n");
+	return `${resource.schema === void 0 ? "resource({" : `resource(${resource.schema}, {`}\n${options}\n${indent}})`;
+}
+function insert(trie, resource) {
+	let node = trie;
+	for (const [index, segment] of resource.path.entries()) {
+		if (index === resource.path.length - 1) {
+			node.set(segment, resource);
+			return;
+		}
+		const next = node.get(segment);
+		if (next instanceof Map) node = next;
+		else {
+			const created = /* @__PURE__ */ new Map();
+			node.set(segment, created);
+			node = created;
+		}
+	}
+}
+function renderTrie(trie, indent) {
+	return [...trie.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([segment, value]) => value instanceof Map ? `${indent}${propertyKey(segment)}: {\n${renderTrie(value, `${indent}  `)}\n${indent}},` : `${indent}${propertyKey(segment)}: ${renderResource(value, indent)},`).join("\n");
+}
+/** A deterministic `definePermissions()` module with a `// @generated` header. */
+function emitPermissionsModule(input) {
+	const trie = /* @__PURE__ */ new Map();
+	for (const resource of input.resources) insert(trie, resource);
+	const imports = ["import { definePermissions, resource } from 'permdock'", ...input.schema === void 0 ? [] : [schemaImport(input.schema)]];
+	const extras = Object.entries(input.exports ?? {}).map(([name, value]) => `export const ${name} = ${JSON.stringify(value, null, 2)} as const\n\n`);
+	return `// @generated by permdock ${input.generator}
+${imports.join("\n")}
+
+${extras.join("")}export const permissions = definePermissions({
+${renderTrie(trie, "  ")}
+})
+`;
+}
+//#endregion
+export { schemaExpression as i, emptySchema as n, isSchemaKind as r, emitPermissionsModule as t };

package/dist/{grantee-hxrUsbpM.js → grantee-Dke-9rd1.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";
 const PLAN_KIND = "plan";

package/dist/{grantee-conditions-CcXf8hMM.js → grantee-conditions-BrYPe-w0.js}

@@ -1,11 +1,11 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
 //#region src/core/grantee-conditions.ts
 /**
-* Where a graph relation starts on the row: its own id when the relation is
-* on the row's resource, the parent field when it is on the parent resource.
+* Where a graph relation starts on the row: its own id when the relation is on
+* the row's resource, the parent field when it is on the parent resource.
 * `undefined` when `through` cannot reach the relation's resource.
 */
 function relationStart(grantee, resource, target) {
@@ -25,10 +25,10 @@ function relationStart(grantee, resource, target) {
 	};
 }
 /**
-* A resource role held on self-parented `membershipResource` instances
-* (`ids`) reaches rows below them: the row itself when it is of that
-* resource, its parent field when its parent is, walked up to the default
-* depth. `undefined` when the row is not on such a chain.
+* A resource role held on self-parented `membershipResource` instances (`ids`)
+* reaches rows below them: the row itself when it is of that resource, its
+* parent field when its parent is, walked up to the default depth. `undefined`
+* when the row is not on such a chain.
 */
 function resourceRoleCondition(resource, membershipResource, ids, resources) {
 	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
@@ -72,9 +72,9 @@ function linkStop(resource, link) {
 	};
 }
 /**
-* The link path from the row to the grantee's resource: the row field of
-* the first link and each hop. `undefined` when a link is not declared or
-* the path ends on another resource.
+* The link path from the row to the grantee's resource: the row field of the
+* first link and each hop. `undefined` when a link is not declared or the path
+* ends on another resource.
 */
 function relationHops(grantee, resource, resources) {
 	const through = grantee.through;

package/dist/{grantee-match-DbENBHLB.js → grantee-match-7RZZvoT_.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { u as isoAt } from "./time-DkWjdL98.js";
-import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { u as isoAt } from "./time-nR1JesoH.js";
+import { f as scopeList, t as activeFor } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;
@@ -12,7 +12,10 @@ function combineWhere(left, right) {
 		conditions: [left, right]
 	};
 }
-/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
+/**
+* Seats (`Membership.entitlements`) held through memberships that apply under
+* the active tenant.
+*/
 function seatsInTenant(subject, scopes) {
 	const principal = subject.principal;
 	if (principal === null) return [];
@@ -110,7 +113,10 @@ function matchOne(grantee, subject, now, resource, scopes, resources) {
 		default: return unknownGrantee(grantee);
 	}
 }
-/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
+/**
+* A kind this build does not know, from a forged snapshot or a newer document,
+* never matches.
+*/
 function unknownGrantee(_grantee) {
 	return {
 		matched: false,

package/dist/{graph-sql-B-dsAT6j.d.ts → graph-sql-BwFC4Qjs.d.ts}

@@ -19,9 +19,9 @@ type RelationsMapping = {
   /** The table of each resource the graph reads; default the resource name. */
   readonly tables?: Readonly<Record<string, string>>;
   /**
-   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as
-   * the one `permdock rls` keeps. Without it, parent walks are a bounded
-   * recursive query over the resource's own table.
+   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as the
+   * one `permdock rls` keeps. Without it, parent walks are a bounded recursive
+   * query over the resource's own table.
    */
   readonly closure?: string;
 };

package/dist/h3/index.d.ts

@@ -1,11 +1,14 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;
-/** `event.context` once `middleware()` or `protect` ran: the instance and the loaded row. */
+/**
+ * `event.context` once `middleware()` or `protect` ran: the instance and the
+ * loaded row.
+ */
 type H3PermDockContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3EventContext & {
   readonly permdock: PermDock<V>;
   readonly permdockData: TData;
@@ -23,8 +26,8 @@ type H3PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly getSnapshot: (event: H3Event, query?: SnapshotQuery) => Promise<Snapshot>;
   /**
    * Types `event.context.permdock` and `permdockData` for the handler, builds
-   * the instance when no middleware set it, and answers a thrown PermDock
-   * error with Problem Details.
+   * the instance when no middleware set it, and answers a thrown PermDock error
+   * with Problem Details.
    */
   readonly withPermDock: <TData = unknown>(handler: (event: H3PermDockEvent<TData, V>) => unknown) => EventHandler;
   readonly connection: (event: H3Event, connectionOptions?: ConnectionOptions) => Promise<Connection>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { i as decorate } from "../bind-CAvgUuKs.js";
-import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { i as decorate } from "../bind-D_sZSVA3.js";
+import { t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/headers-B9jQxjtW.d.ts

@@ -0,0 +1,10 @@
+//#region src/client/headers.d.ts
+/**
+ * The `PermDock-Approval` header for a resume; a `TypeError` for a token that
+ * is not an RFC 9651 sf-token.
+ */
+declare function approvalHeaders(token: string): {
+  readonly "PermDock-Approval": string;
+};
+//#endregion
+export { approvalHeaders as t };