permdock 0.7.0 → 0.9.0

package/dist/{generate-3FNO5P5Q.js → generate-CRVV5V7l.js}

@@ -1,10 +1,13 @@
-import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-BL9M_CA1.js";
-import { o as quoteSqlIdent } from "./sql-B96movIM.js";
-import { n as fileSummary, t as applyFiles } from "./files-acUbNwWt.js";
-import { r as driftOf } from "./output-files-CCMdcFWb.js";
+import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-DcyrPS-r.js";
+import { o as quoteSqlIdent } from "./sql-0WjxIp9g.js";
+import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
+import { r as driftOf } from "./output-files-BIQ_9pIs.js";
 //#region src/cli/scim/generate.ts
 const SCIM_MARKER = "-- generated by permdock scim generate";
-/** The client roles each dialect's data API connects as; none may reach the directory. */
+/**
+* The client roles each dialect's data API connects as; none may reach the
+* directory.
+*/
 function clientRoles(dialect) {
 	switch (dialect) {
 		case "supabase": return [
@@ -25,8 +28,8 @@ function clientRoles(dialect) {
 * The directory `postgresDirectoryStore` reads and writes: users, groups and
 * group members keyed on `(tenant, id)`, with `userName` and `externalId`
 * unique per tenant. Member values are SCIM `value`s, not a foreign key to
-* users, because a member may be a nested group. No client role may read
-* or write the tables.
+* users, because a member may be a nested group. No client role may read or
+* write the tables.
 */
 function scimSchemaSql(input) {
 	const schema = quoteSqlIdent(input.schema);
@@ -93,7 +96,10 @@ alter table ${members} enable row level security;
 revoke all on table ${all} from ${clientRoles(input.dialect).join(", ")};
 `;
 }
-/** `supabase/schemas/<schema>/scim.sql` for Supabase, the pg-delta per-schema layout; `permdock_scim.sql` otherwise. */
+/**
+* `supabase/schemas/<schema>/scim.sql` for Supabase, the pg-delta per-schema
+* layout; `permdock_scim.sql` otherwise.
+*/
 function scimOut(dialect, schema) {
 	return dialect === "supabase" ? `supabase/schemas/${schema}/scim.sql` : "permdock_scim.sql";
 }

package/dist/generate-CezbCaTI.js

@@ -0,0 +1,275 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+//#region src/cli/generate.ts
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
+const MAX_DEPTH = 6;
+function isSchemaKind(value) {
+	return value === "zod" || value === "valibot" || value === "arktype";
+}
+function schemaImport(kind) {
+	switch (kind) {
+		case "zod": return "import { z } from 'zod'";
+		case "valibot": return "import * as v from 'valibot'";
+		case "arktype": return "import { type } from 'arktype'";
+		default: return kind;
+	}
+}
+function emptySchema(kind) {
+	return schemaExpression(kind, { type: "object" });
+}
+function propertyKey(name) {
+	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
+}
+function literalEnum(schema) {
+	const type = schema["type"];
+	const nullable = Array.isArray(type) && type.includes("null");
+	const all = schema["enum"];
+	const values = nullable && Array.isArray(all) ? all.filter((value) => value !== null) : all;
+	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;
+	return values;
+}
+function schemaType(schema) {
+	const type = schema["type"];
+	if (typeof type === "string") return type;
+	if (Array.isArray(type)) {
+		const named = type.filter((item) => item !== "null");
+		return named.length === 1 && typeof named[0] === "string" ? named[0] : void 0;
+	}
+	return isRecord(schema["properties"]) ? "object" : void 0;
+}
+function bound(node, key) {
+	const value = node[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function isNullable(node, emit) {
+	const type = node["type"];
+	return emit.constraints && Array.isArray(type) && type.includes("null");
+}
+function formatOf(node, emit) {
+	const format = node["format"];
+	return emit.constraints && typeof format === "string" ? format : void 0;
+}
+/** `[method, value]` pairs for the bounds `keys` names, in order. */
+function bounds(node, emit, keys) {
+	if (!emit.constraints) return [];
+	return keys.flatMap(([key, method]) => {
+		const value = bound(node, key);
+		return value === void 0 ? [] : [[method, value]];
+	});
+}
+const NUMBER_BOUNDS = [
+	["minimum", "min"],
+	["exclusiveMinimum", "gt"],
+	["maximum", "max"],
+	["exclusiveMaximum", "lt"]
+];
+const LENGTH_BOUNDS = [["minLength", "min"], ["maxLength", "max"]];
+const ITEM_BOUNDS = [["minItems", "min"], ["maxItems", "max"]];
+const ZOD_FORMATS = {
+	uuid: "z.uuid()",
+	email: "z.email()",
+	uri: "z.url()",
+	"date-time": "z.iso.datetime({ offset: true })",
+	date: "z.iso.date()"
+};
+function zodChain(base, pairs) {
+	return `${base}${pairs.map(([method, value]) => `.${method}(${String(value)})`).join("")}`;
+}
+function zodOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const expression = zodNode(node, emit, depth);
+	return isNullable(node, emit) ? `${expression}.nullable()` : expression;
+}
+function zodNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return `z.enum(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "z.unknown()";
+	switch (type) {
+		case "string": return zodChain(ZOD_FORMATS[formatOf(node, emit) ?? ""] ?? "z.string()", bounds(node, emit, LENGTH_BOUNDS));
+		case "number": return zodChain("z.number()", bounds(node, emit, NUMBER_BOUNDS));
+		case "integer": return zodChain("z.number().int()", bounds(node, emit, NUMBER_BOUNDS));
+		case "boolean": return "z.boolean()";
+		case "array": return zodChain(`z.array(${isRecord(node["items"]) ? zodOf(node["items"], emit, depth + 1) : "z.unknown()"})`, bounds(node, emit, ITEM_BOUNDS));
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => {
+				const expression = zodOf(child, emit, depth + 1);
+				return `${propertyKey(name)}: ${required ? expression : `${expression}.optional()`}`;
+			});
+			return `z.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "z.unknown()";
+	}
+}
+/** Each property of an object schema with whether `required` names it. */
+function objectFields(node) {
+	const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
+	const properties = isRecord(node["properties"]) ? node["properties"] : {};
+	return Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => [
+		name,
+		child,
+		required.has(name)
+	]);
+}
+const VALIBOT_FORMATS = {
+	uuid: "v.uuid()",
+	email: "v.email()",
+	uri: "v.url()",
+	"date-time": "v.isoTimestamp()",
+	date: "v.isoDate()"
+};
+const VALIBOT_NUMBER_BOUNDS = [
+	["minimum", "minValue"],
+	["exclusiveMinimum", "gtValue"],
+	["maximum", "maxValue"],
+	["exclusiveMaximum", "ltValue"]
+];
+function valibotPipe(base, actions) {
+	return actions.length === 0 ? base : `v.pipe(${[base, ...actions].join(", ")})`;
+}
+function valibotLength(pairs) {
+	return pairs.map(([method, value]) => `v.${method === "min" ? "minLength" : "maxLength"}(${String(value)})`);
+}
+function valibotOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const expression = valibotNode(node, emit, depth);
+	return isNullable(node, emit) ? `v.nullable(${expression})` : expression;
+}
+function valibotNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return `v.picklist(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "v.unknown()";
+	const numeric = bounds(node, emit, VALIBOT_NUMBER_BOUNDS).map(([method, value]) => `v.${method}(${String(value)})`);
+	switch (type) {
+		case "string": {
+			const format = VALIBOT_FORMATS[formatOf(node, emit) ?? ""];
+			return valibotPipe("v.string()", [...format === void 0 ? [] : [format], ...valibotLength(bounds(node, emit, LENGTH_BOUNDS))]);
+		}
+		case "number": return valibotPipe("v.number()", numeric);
+		case "integer": return valibotPipe("v.number()", ["v.integer()", ...numeric]);
+		case "boolean": return "v.boolean()";
+		case "array": return valibotPipe(`v.array(${isRecord(node["items"]) ? valibotOf(node["items"], emit, depth + 1) : "v.unknown()"})`, valibotLength(bounds(node, emit, ITEM_BOUNDS)));
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => {
+				const expression = valibotOf(child, emit, depth + 1);
+				return `${propertyKey(name)}: ${required ? expression : `v.optional(${expression})`}`;
+			});
+			return `v.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "v.unknown()";
+	}
+}
+const ARKTYPE_FORMATS = {
+	uuid: "string.uuid",
+	email: "string.email",
+	uri: "string.url",
+	"date-time": "string.date.iso",
+	date: "string.date.iso"
+};
+/** `1 <= string <= 120`; arktype bounds apply to `string` and `number` only. */
+function arktypeRange(keyword, pairs) {
+	const lower = pairs.find(([method]) => method === "min" || method === "gt");
+	const upper = pairs.find(([method]) => method === "max" || method === "lt");
+	const left = lower === void 0 ? "" : `${String(lower[1])} ${lower[0] === "gt" ? "<" : "<="} `;
+	const right = upper === void 0 ? "" : ` ${upper[0] === "lt" ? "<" : "<="} ${String(upper[1])}`;
+	return lower !== void 0 && upper === void 0 ? `${keyword} ${lower[0] === "gt" ? ">" : ">="} ${String(lower[1])}` : `${left}${keyword}${right}`;
+}
+/** An arktype definition: a string keyword or an object literal. */
+function arktypeOf(schema, emit, depth) {
+	const node = emit.resolve(schema);
+	const definition = arktypeNode(node, emit, depth);
+	if (!isNullable(node, emit)) return definition;
+	return definition.startsWith("'") ? `'${definition.slice(1, -1)} | null'` : `[${definition}, '|', 'null']`;
+}
+function arktypeNode(node, emit, depth) {
+	const values = literalEnum(node);
+	if (values !== void 0) return JSON.stringify(values.map((value) => `'${value.replaceAll("'", "\\'")}'`).join(" | "));
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "'unknown'";
+	switch (type) {
+		case "string": {
+			const format = ARKTYPE_FORMATS[formatOf(node, emit) ?? ""];
+			return format === void 0 ? `'${arktypeRange("string", bounds(node, emit, LENGTH_BOUNDS))}'` : `'${format}'`;
+		}
+		case "number": return `'${arktypeRange("number", bounds(node, emit, NUMBER_BOUNDS))}'`;
+		case "integer": return "'number.integer'";
+		case "boolean": return "'boolean'";
+		case "array": {
+			if (!isRecord(node["items"])) return "'unknown[]'";
+			const item = arktypeOf(node["items"], emit, depth + 1);
+			return item.startsWith("'") && !item.includes("|") ? `'${item.slice(1, -1)}[]'` : `[${item}, '[]']`;
+		}
+		case "object": {
+			const fields = objectFields(node).map(([name, child, required]) => `${JSON.stringify(required ? name : `${name}?`)}: ${arktypeOf(child, emit, depth + 1)}`);
+			return `{${fields.length === 0 ? "" : ` ${fields.join(", ")} `}}`;
+		}
+		default: return "'unknown'";
+	}
+}
+/**
+* A validator expression for a JSON Schema object. Only the portable core
+* (primitives, enums of strings, arrays, objects with `required`) is
+* translated, plus with `constraints` the formats, bounds and nullable types;
+* anything else becomes the validator's `unknown`.
+*/
+function schemaExpression(kind, schema, resolve = (node) => node, options = {}) {
+	const emit = {
+		resolve,
+		constraints: options.constraints === true
+	};
+	switch (kind) {
+		case "zod": return zodOf(schema, emit, 0);
+		case "valibot": return valibotOf(schema, emit, 0);
+		case "arktype": return `type(${arktypeOf(schema, emit, 0)})`;
+		default: return kind;
+	}
+}
+function renderList(value, indent) {
+	if (Array.isArray(value)) return JSON.stringify(value);
+	return JSON.stringify(value, null, 2).replaceAll("\n", `\n${indent}`);
+}
+function renderResource(resource, indent) {
+	const inner = `${indent}  `;
+	const options = [
+		`${inner}id: '${(resource.id ?? "id").replaceAll("\\", "\\\\").replaceAll("'", "\\'")}',`,
+		`${inner}actions: ${renderList(resource.actions, inner)},`,
+		`${inner}collection: ${renderList(resource.collection, inner)},`
+	].join("\n");
+	return `${resource.schema === void 0 ? "resource({" : `resource(${resource.schema}, {`}\n${options}\n${indent}})`;
+}
+function insert(trie, resource) {
+	let node = trie;
+	for (const [index, segment] of resource.path.entries()) {
+		if (index === resource.path.length - 1) {
+			node.set(segment, resource);
+			return;
+		}
+		const next = node.get(segment);
+		if (next instanceof Map) node = next;
+		else {
+			const created = /* @__PURE__ */ new Map();
+			node.set(segment, created);
+			node = created;
+		}
+	}
+}
+function renderTrie(trie, indent) {
+	return [...trie.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([segment, value]) => value instanceof Map ? `${indent}${propertyKey(segment)}: {\n${renderTrie(value, `${indent}  `)}\n${indent}},` : `${indent}${propertyKey(segment)}: ${renderResource(value, indent)},`).join("\n");
+}
+/** A deterministic `definePermissions()` module with a `// @generated` header. */
+function emitPermissionsModule(input) {
+	const trie = /* @__PURE__ */ new Map();
+	for (const resource of input.resources) insert(trie, resource);
+	const imports = ["import { definePermissions, resource } from 'permdock'", ...input.schema === void 0 ? [] : [schemaImport(input.schema)]];
+	const extras = Object.entries(input.exports ?? {}).map(([name, value]) => `export const ${name} = ${JSON.stringify(value, null, 2)} as const\n\n`);
+	return `// @generated by permdock ${input.generator}
+${imports.join("\n")}
+
+${extras.join("")}export const permissions = definePermissions({
+${renderTrie(trie, "  ")}
+})
+`;
+}
+//#endregion
+export { schemaExpression as i, emptySchema as n, isSchemaKind as r, emitPermissionsModule as t };

package/dist/{grantee-BrRANrpT.js → grantee-Dke-9rd1.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
-import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";
 const PLAN_KIND = "plan";

package/dist/{grantee-conditions-C6P1Tvol.js → grantee-conditions-BrYPe-w0.js}

@@ -1,11 +1,11 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
 //#region src/core/grantee-conditions.ts
 /**
-* Where a graph relation starts on the row: its own id when the relation is
-* on the row's resource, the parent field when it is on the parent resource.
+* Where a graph relation starts on the row: its own id when the relation is on
+* the row's resource, the parent field when it is on the parent resource.
 * `undefined` when `through` cannot reach the relation's resource.
 */
 function relationStart(grantee, resource, target) {
@@ -25,10 +25,10 @@ function relationStart(grantee, resource, target) {
 	};
 }
 /**
-* A resource role held on self-parented `membershipResource` instances
-* (`ids`) reaches rows below them: the row itself when it is of that
-* resource, its parent field when its parent is, walked up to the default
-* depth. `undefined` when the row is not on such a chain.
+* A resource role held on self-parented `membershipResource` instances (`ids`)
+* reaches rows below them: the row itself when it is of that resource, its
+* parent field when its parent is, walked up to the default depth. `undefined`
+* when the row is not on such a chain.
 */
 function resourceRoleCondition(resource, membershipResource, ids, resources) {
 	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
@@ -72,9 +72,9 @@ function linkStop(resource, link) {
 	};
 }
 /**
-* The link path from the row to the grantee's resource: the row field of
-* the first link and each hop. `undefined` when a link is not declared or
-* the path ends on another resource.
+* The link path from the row to the grantee's resource: the row field of the
+* first link and each hop. `undefined` when a link is not declared or the path
+* ends on another resource.
 */
 function relationHops(grantee, resource, resources) {
 	const through = grantee.through;

package/dist/{grantee-match-0RtHWQDx.js → grantee-match-7RZZvoT_.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { u as isoAt } from "./time-DkWjdL98.js";
-import { f as scopeList, t as activeFor } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { u as isoAt } from "./time-nR1JesoH.js";
+import { f as scopeList, t as activeFor } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;
@@ -12,7 +12,10 @@ function combineWhere(left, right) {
 		conditions: [left, right]
 	};
 }
-/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
+/**
+* Seats (`Membership.entitlements`) held through memberships that apply under
+* the active tenant.
+*/
 function seatsInTenant(subject, scopes) {
 	const principal = subject.principal;
 	if (principal === null) return [];
@@ -110,7 +113,10 @@ function matchOne(grantee, subject, now, resource, scopes, resources) {
 		default: return unknownGrantee(grantee);
 	}
 }
-/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
+/**
+* A kind this build does not know, from a forged snapshot or a newer document,
+* never matches.
+*/
 function unknownGrantee(_grantee) {
 	return {
 		matched: false,

package/dist/{graph-sql-B-dsAT6j.d.ts → graph-sql-BwFC4Qjs.d.ts}

@@ -19,9 +19,9 @@ type RelationsMapping = {
   /** The table of each resource the graph reads; default the resource name. */
   readonly tables?: Readonly<Record<string, string>>;
   /**
-   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as
-   * the one `permdock rls` keeps. Without it, parent walks are a bounded
-   * recursive query over the resource's own table.
+   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as the
+   * one `permdock rls` keeps. Without it, parent walks are a bounded recursive
+   * query over the resource's own table.
    */
   readonly closure?: string;
 };

package/dist/h3/index.d.ts

@@ -1,11 +1,14 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;
-/** `event.context` once `middleware()` or `protect` ran: the instance and the loaded row. */
+/**
+ * `event.context` once `middleware()` or `protect` ran: the instance and the
+ * loaded row.
+ */
 type H3PermDockContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3EventContext & {
   readonly permdock: PermDock<V>;
   readonly permdockData: TData;
@@ -23,8 +26,8 @@ type H3PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly getSnapshot: (event: H3Event, query?: SnapshotQuery) => Promise<Snapshot>;
   /**
    * Types `event.context.permdock` and `permdockData` for the handler, builds
-   * the instance when no middleware set it, and answers a thrown PermDock
-   * error with Problem Details.
+   * the instance when no middleware set it, and answers a thrown PermDock error
+   * with Problem Details.
    */
   readonly withPermDock: <TData = unknown>(handler: (event: H3PermDockEvent<TData, V>) => unknown) => EventHandler;
   readonly connection: (event: H3Event, connectionOptions?: ConnectionOptions) => Promise<Connection>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { i as decorate } from "../bind-D1nO6fiC.js";
-import { t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { i as decorate } from "../bind-BNQA9JK9.js";
+import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/headers-B9jQxjtW.d.ts

@@ -0,0 +1,10 @@
+//#region src/client/headers.d.ts
+/**
+ * The `PermDock-Approval` header for a resume; a `TypeError` for a token that
+ * is not an RFC 9651 sf-token.
+ */
+declare function approvalHeaders(token: string): {
+  readonly "PermDock-Approval": string;
+};
+//#endregion
+export { approvalHeaders as t };

package/dist/{helpers-DY3vXuGs.js → helpers-DJicaG6f.js}

@@ -1,19 +1,22 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
-import { t as describe } from "./describe-DZlnEtLy.js";
-import { i as getRegistry, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
-import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as approverLeaves } from "./approvers-B4r0N_Uz.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { a as durationOf, i as dateAt, u as isoAt } from "./time-nR1JesoH.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK.js";
+import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { n as assertApprover, u as listAllApprovals } from "./store-DSP9oGvh.js";
-import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
+import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-RNFvaJJv.js";
+import { n as parseApprovalHeader } from "./approval-header-8QV6MU4H.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
-/** Every approver a request names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
+/**
+* Every approver a request names: `by`, each stage and its escalation, and
+* `escalation.to`, inside `anyOf` groups too.
+*/
 function requestApprovers(approvers) {
 	return [
 		...approverLeaves(approvers.by),
@@ -31,7 +34,10 @@ async function settled(read, unread, cache) {
 		await Promise.all(pending);
 	}
 }
-/** The id of `item.resource` the walk starts from, after following `through` links. */
+/**
+* The id of `item.resource` the walk starts from, after following `through`
+* links.
+*/
 async function startOf(item, resource, id, reader, cache, registry) {
 	if (!Array.isArray(item.through)) return resource === item.resource ? id : void 0;
 	let current = resource;
@@ -61,8 +67,8 @@ function depthOf(item) {
 /**
 * The relation approvers of `request` that `subject` holds on its resource,
 * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
-* through `relations` by the request's resource id; a request without an id,
-* a missing source or a read that fails holds nothing.
+* through `relations` by the request's resource id; a request without an id, a
+* missing source or a read that fails holds nothing.
 */
 async function approverRelations(request, subject, options) {
 	const approvers = request.approvers;
@@ -118,7 +124,10 @@ function approverPermissions(request, approver) {
 		}
 	});
 }
-/** The permission approvers `subject` holds on `request`, read through `permdockFor`. */
+/**
+* The permission approvers `subject` holds on `request`, read through
+* `permdockFor`.
+*/
 async function heldPermissions(request, subject, permdockFor) {
 	if (permdockFor === void 0 || request.approvers === void 0) return [];
 	try {
@@ -156,9 +165,9 @@ function summarizeSubject(subject) {
 	});
 }
 /**
-* The window (`meta.ttl`, else the store's `ttl`, else the default) capped by the grant's
-* `approval.ttl`: a grant shortens how long a request stays open, never
-* extends it.
+* The window (`meta.ttl`, else the store's `ttl`, else the default) capped by
+* the grant's `approval.ttl`: a grant shortens how long a request stays open,
+* never extends it.
 */
 function approvalTtl(storeTtl, approval) {
 	if (storeTtl !== void 0 && durationOf(storeTtl) === void 0) throw new RangeError(`PermDock: approval ttl must be a whole number of seconds above 0, got ${String(storeTtl)}`);
@@ -391,7 +400,10 @@ async function cancelApprovals(store, filter, meta) {
 		}
 	}))).filter(Boolean).length;
 }
-/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
+/**
+* The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no
+* parameters, else `undefined`.
+*/
 function readApprovalHeader(headers) {
 	return parseApprovalHeader(headers.get(APPROVAL_HEADER));
 }
@@ -405,14 +417,14 @@ function resumeFromHeader(store, headers, now) {
 }
 /**
 * The token to resume `decision` with when the caller carries none: the
-* decision's own token when the store holds an approved or rejected request
-* for it, so `resumeDecision` resumes (or denies) the call without the
-* caller passing the token back. The token already binds permission,
-* resource (or the call's data when there is no row id), subject and actor.
-* A pending request counts only with `denyPending: true`, which makes the
-* call deny with `approval-pending` instead of asking again. `undefined` when
-* the decision needs no approval, there is no store, or the store has no
-* unexpired request for the token; a store that throws counts as none.
+* decision's own token when the store holds an approved or rejected request for
+* it, so `resumeDecision` resumes (or denies) the call without the caller
+* passing the token back. The token already binds permission, resource (or the
+* call's data when there is no row id), subject and actor. A pending request
+* counts only with `denyPending: true`, which makes the call deny with
+* `approval-pending` instead of asking again. `undefined` when the decision
+* needs no approval, there is no store, or the store has no unexpired request
+* for the token; a store that throws counts as none.
 */
 async function storedApprovalToken(store, decision, options = {}) {
 	if (store === void 0 || decision.outcome !== "approval-required") return;

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";
@@ -20,19 +20,25 @@ type HonoPermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabul
   };
 };
 type HonoPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one request, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one request, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (c: Context) => Promise<PermDock<V>>;
   readonly middleware: () => MiddlewareHandler<HonoPermDockEnv<unknown, V>>;
   readonly protect: <TData = unknown>(permission: Permission | null, data?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<HonoPermDockEnv<NonNullable<TData>, V>>;
   /** A long-lived connection for the request behind `c`. */
   readonly connection: (c: Context, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  /** `upgradeWebSocket` events that close with `1008` when the connection aborts. */
+  /**
+   * `upgradeWebSocket` events that close with `1008` when the connection
+   * aborts.
+   */
   readonly socket: <T = unknown>(connection: Connection, events: WSEvents<T>) => WSEvents<T>;
   /**
    * Writes `source` to a `streamSSE` stream, dropping items the subscriber
    * cannot read, and resolves when it ends: after an `event: permdock` frame
-   * when the connection aborts, when the client disconnects, or when the
-   * source is done. Await it as the last statement of the callback.
+   * when the connection aborts, when the client disconnects, or when the source
+   * is done. Await it as the last statement of the callback.
    */
   readonly sse: <T>(connection: Connection, stream: SSEStreamingApi, source: AsyncIterable<T>, options?: SseOptions<T>) => Promise<void>;
   readonly permdockHandler: () => Hono;