@alxia/janus 0.1.2 → 0.3.0

package/README.md

@@ -3,7 +3,7 @@
 Identities, sessions and permissions for [alxia](https://www.npmjs.com/package/@alxia/core),
 on [`@nxgt/janus`](https://www.npmjs.com/package/@nxgt/janus): your process,
 your database. The user typed in the context, the session cookie kept and
-renewed, janus's refusals answered — every one typed for the client. No
+renewed, janus's refusals answered with their status and a safe body. No
 dependency.
 
 ```sh
@@ -17,7 +17,7 @@ the same cookie, the same rules, the same bodies.
 ## Usage
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -32,22 +32,27 @@ const accounts = janus({
 const SignIn = z.object({ email: z.string(), password: z.string() });
 
 const app = alxia()
-	.use(janusErrors())                                   // janus's refusals, typed
-	.use(session(accounts))                               // not required: anonymous may sign in
-	.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.use(janusErrors(), session(accounts))                // errors first, then the session: anonymous may sign in
+	.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.signIn(body);
 		return reply.ok({ id: auth.send(signedIn).id });  // the token in the cookie
 	})
 	.post('/signout', async ({ auth, reply }) => reply.ok(await auth.signOut()))
-	.use(session(accounts, { required: true }))           // every route after it
+	.use(session(accounts, { required: true }))           // the routes after it, and any unmatched request
 	.get('/me', ({ user, reply }) => reply.ok(user));     // user typed by the schema
 ```
 
+`janusErrors()` and `session()` are middlewares. `janusErrors()` answers
+what is thrown behind it, so give it to `use` **before** `session()`.
+
 ## `session(accounts, options?)`
 
 The routes after it read `user`, `session` and `auth`. With
 `required: true`, an anonymous request is a 401
-`{ error: 'unauthenticated' }` and `user` is never `null`; without, it is
+`{ error: 'unauthenticated' }` and `user` is never `null`. On the app, a
+required session also runs on a request no route matches: an anonymous
+request to a missing path gets the 401, not the 404. Put it in a `group` to
+guard only some routes; without, it is
 `null` for an anonymous request. A `boolean` known only at run time types
 both: the 401, and a `user` that may be `null`. `type` narrows to one user
 type of a multi-type `janus()`; `device` names the device cookie.
@@ -77,11 +82,20 @@ behind `required: true`, an anonymous request — anyone signing in — is a
 
 ## `janusErrors(options?)`
 
-Every `JanusError` a route after it throws is answered with janus's status
+A try/catch middleware: every `JanusError` thrown behind it — by
+`session()`, `permission()` or a route — is answered with janus's status
 and a body holding its `code` and only what a client can act on — the
 issues, a minimum length, attempts left, seconds to wait (with
 `Retry-After`). Never a login, a reason or a cause. `report(error, ctx)` is
-called for the 5xx.
+called for the 5xx. Anything else goes on, thrown, to the middlewares before
+it. On an app with `alxia({ errors: 'problem' })`, it answers an RFC 9457
+problem instead, the `code` and the rest of that body its extensions; a
+required `session()`'s 401 and `permission()`'s 401, 404 and 403 follow
+the app's format too. Declared after `session()`, it would not see the session's
+`STORE_FAILED`: it goes first, and after the observers (`logger()`,
+`secureHeaders()`), so that they see its reply. An observer settles
+`next()` without swallowing the error, so `janusErrors()` before one, or
+before `createI18n()`, still answers it.
 
 | status | codes |
 | --- | --- |
@@ -145,7 +159,7 @@ types exactly then.
 ### Reading the app's context
 
 Annotate `load`, `subject` or `ctx`'s parameter to read what an earlier
-plugin added. The guard then requires it: an app that does not give it
+middleware added. The guard then requires it: an app that does not give it
 before the guard cannot use it.
 
 ```ts
@@ -159,7 +173,7 @@ const byTenant = permission(
 		tenant.records.get(pathParams['id'] ?? '') ?? null,
 );
 
-alxia().use(tenancy).use(session(accounts)).use(byTenant); // tenancy derives tenant
+alxia().plugin(tenancy).use(session(accounts)).use(byTenant); // tenancy derives tenant
 alxia().use(session(accounts)).use(byTenant); // a compile error: this app gives no `tenant`
 ```
 
@@ -170,22 +184,25 @@ on every app: annotate what it reads, or leave it unannotated.
 
 | export | |
 | --- | --- |
-| `session(accounts, options?)` | the plugin: `user`, `session`, `auth` |
+| `session(accounts, options?)` | the middleware: `user`, `session`, `auth` |
 | `SessionOptions` | its options: `type`, `required`, `device` |
 | `RequestAuth`, `SessionOpened` | the type of `ctx.auth`: `send`, `signOut`, `device`; and what `send` takes: `token`, `session` and `user` from `@nxgt/janus`'s `SignedIn`, and `deviceToken?` |
 | `sendSession`, `signOut`, `deviceOf`, `sendDevice` | the cookies, outside a route |
 | `DEVICE_COOKIE` | the device cookie's name, `janus-device`: the one `@nxgt/janus-hono` uses, so a device one remembers the other does too |
 | `SendSessionOptions`, `DeviceCookieOptions` | their options: `device`; `name`, `domain`, `path`, `sameSite`, `secure`, `maxAge` |
-| `janusErrors(options?)` | the plugin: janus's refusals answered |
+| `janusErrors(options?)` | the middleware: janus's refusals answered; `use` it before `session()` |
+| `JanusErrors`, `SessionMiddleware` | the types of what `janusErrors()` and `session()` make |
 | `JanusErrorsOptions` | its options: `report`, called with every error answered 5xx |
 | `permission(…)`, `byParam(…)` | the guard |
 | `PermissionOptions`, `OptionsArgs` | its options: `subject`, `ctx`; and the rest of its arguments, the options required exactly when the permission has a condition; both take what `subject` and `ctx` read beyond `BaseContext` as their last two, defaulted, parameters |
 | `bodyOf`, `statusOf` | a refusal's body and status |
 | `UnauthenticatedBody`, `JanusErrorBody`, `PermissionRefusedBody` | their types |
+| `UnauthenticatedProblem`, `JanusErrorProblem`, `PermissionRefusedProblem` | the same answers under `@alxia/core`'s `alxia({ errors: 'problem' })`: RFC 9457 problems, `janusErrors()`'s with its `code` and body as extensions |
 | `Auth`, `UserOfAuth`, `ObjectData`, `Awaitable` | the part of `janus()` this package calls, the users it knows, an object as the application loads it, a value or its promise |
 
 ## Documentation
 
-- [Guide](https://github.com/softistx/alxia/tree/develop/packages/janus/docs): a page per area — sessions, signing in and out with `ctx.auth` and the device cookie, janus's errors and their statuses, and the permission guard, reading what an earlier plugin added included.
+- [Guide](https://github.com/softistx/alxia/tree/develop/packages/janus/docs): a page per area — sessions, signing in and out with `ctx.auth` and the device cookie, janus's errors and their statuses, and the permission guard, reading what an earlier middleware added included.
 - [Troubleshooting](https://github.com/softistx/alxia/blob/develop/packages/janus/docs/troubleshooting.md): an error message, or a request anonymous, refused or a 404 when it should not be, and what to do about it.
 - [Roadmap](https://github.com/softistx/alxia/blob/develop/packages/janus/docs/roadmap.md): what is coming, and what is not planned.
+- [Recipes](https://github.com/softistx/alxia/blob/develop/docs/recipes/README.md): [Authenticate requests](https://github.com/softistx/alxia/blob/develop/docs/recipes/authentication.md), [Answer errors consistently](https://github.com/softistx/alxia/blob/develop/docs/recipes/errors.md).

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-import { type BaseContext } from '@alxia/core';
+import { type BaseContext, type Middleware, type Next, type Problem, type Reply } from '@alxia/core';
 import { JanusError, type JanusErrorCode, type JanusErrorStatus, statusOf } from '@nxgt/janus';
 /**
  * The body a refusal is answered with: its `code`, and only what the client
@@ -23,15 +23,32 @@ export interface JanusErrorsOptions {
     readonly report?: (error: JanusError, ctx: BaseContext) => unknown;
 }
 /**
- * Janus's errors answered, as a plugin: every `JanusError` a route declared
- * after it throws — a sign-in refused, a login taken, a store down — is
- * answered with janus's status and `bodyOf(error)`, typed on those routes.
- * A throttled sign-in carries `Retry-After`. Anything else goes on to the
- * app's next `onError`, or its 500.
+ * A `JanusError` answered under `alxia({ errors: 'problem' })`: an RFC
+ * 9457 problem, its `code` and the members of `JanusErrorBody` its
+ * extensions.
+ */
+export type JanusErrorProblem = Problem<JanusErrorStatus, JanusErrorBody>;
+/** What `janusErrors()` makes: a middleware that answers what janus throws behind it. */
+export type JanusErrors = Middleware<object, Promise<Next | Reply<JanusErrorStatus, JanusErrorBody | JanusErrorProblem>>>;
+/**
+ * Janus's errors answered, as a middleware: every `JanusError` thrown
+ * behind it — by `session()`, `permission()`, a route — a sign-in
+ * refused, a login taken, a store down — is answered with janus's status
+ * and `bodyOf(error)` — under `alxia({ errors: 'problem' })`, a problem
+ * whose extensions are that body — typed on the routes declared after it. A throttled
+ * sign-in carries `Retry-After`. Anything else goes on, thrown, to the
+ * middlewares before it, or to the route boundary's 500.
+ *
+ * Give it to `use` before `session()`, so that a store down while the
+ * session is read is answered too:
+ *
+ * ```ts
+ * app.use(janusErrors(), session(accounts)).post('/sign-in', ...);
+ * ```
  *
  * **`STORE_FAILED` is a 503**, never a 401 or a 404: an outage is not an
  * answer.
  */
-export declare function janusErrors(options?: JanusErrorsOptions): import("@alxia/core").Alxia<import("@alxia/core").Empty, import("@alxia/core").Empty, "", import("@alxia/core").Reply<JanusErrorStatus, JanusErrorBody>>;
+export declare function janusErrors(options?: JanusErrorsOptions): JanusErrors;
 export { statusOf };
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACN,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,QAAQ,EACR,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAmBxD;AAED,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;CACnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,4JAsB3D;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,WAAW,EAGhB,KAAK,UAAU,EAEf,KAAK,IAAI,EACT,KAAK,OAAO,EAGZ,KAAK,KAAK,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,QAAQ,EACR,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAmBxD;AAED,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC;CACnE;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAE1E,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG,UAAU,CACnC,MAAM,EACN,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,gBAAgB,EAAE,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAC3E,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CASzE;AA2BD,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { DEVICE_COOKIE, type DeviceCookieOptions, deviceOf, sendDevice, } from './device';
-export { bodyOf, type JanusErrorBody, type JanusErrorsOptions, janusErrors, statusOf, } from './errors';
-export { byParam, type PermissionRefusedBody, permission, } from './permission';
+export { bodyOf, type JanusErrorBody, type JanusErrorProblem, type JanusErrors, type JanusErrorsOptions, janusErrors, statusOf, } from './errors';
+export { byParam, type PermissionRefusedBody, type PermissionRefusedProblem, permission, } from './permission';
 export type { Awaitable, ObjectData, OptionsArgs, PermissionOptions, } from './permission-options';
 export { type SendSessionOptions, sendSession, signOut } from './send';
-export { type SessionOptions, session, type UnauthenticatedBody, } from './session';
+export { type SessionMiddleware, type SessionOptions, session, type UnauthenticatedBody, type UnauthenticatedProblem, } from './session';
 export type { Auth, RequestAuth, SessionOpened, UserOfAuth } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,KAAK,mBAAmB,EACxB,QAAQ,EACR,UAAU,GACV,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,WAAW,EACX,QAAQ,GACR,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,OAAO,EACP,KAAK,qBAAqB,EAC1B,UAAU,GACV,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EACN,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,mBAAmB,GACxB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,KAAK,mBAAmB,EACxB,QAAQ,EACR,UAAU,GACV,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,WAAW,EACX,QAAQ,GACR,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,OAAO,EACP,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,UAAU,GACV,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -17,7 +17,13 @@ function sendDevice(ctx, token, options = {}) {
   });
 }
 // src/errors.ts
-import { alxia } from "@alxia/core";
+import {
+  defineMiddleware,
+  errorFormat,
+  markFactory,
+  problem,
+  problemOf
+} from "@alxia/core";
 import {
   JanusError,
   statusOf
@@ -37,39 +43,69 @@ function bodyOf(error) {
   }
 }
 function janusErrors(options = {}) {
-  return alxia().onError((error, ctx) => {
-    if (!(error instanceof JanusError))
-      return;
-    const status = statusOf(error.code);
-    if (status >= 500 && options.report !== undefined) {
-      Promise.resolve().then(() => options.report?.(error, ctx)).catch((failure) => process.emitWarning(`janusErrors(): report failed: ${String(failure)}`));
+  return defineMiddleware(async function janusErrors(ctx, next) {
+    try {
+      return await next();
+    } catch (error) {
+      if (!(error instanceof JanusError))
+        throw error;
+      return answer(error, ctx, options);
     }
-    const body = bodyOf(error);
-    return ctx.reply(status, body, error.retryAfter === undefined ? {} : { headers: { "retry-after": String(error.retryAfter) } });
   });
 }
+function answer(error, ctx, options) {
+  const status = statusOf(error.code);
+  if (status >= 500 && options.report !== undefined) {
+    Promise.resolve().then(() => options.report?.(error, ctx)).catch((failure) => process.emitWarning(`janusErrors(): report failed: ${String(failure)}`));
+  }
+  const body = bodyOf(error);
+  const init = error.retryAfter === undefined ? {} : { headers: { "retry-after": String(error.retryAfter) } };
+  if (errorFormat(ctx) === "problem") {
+    return problem(problemOf(ctx, { status, ...body }), init);
+  }
+  return ctx.reply(status, body, init);
+}
+markFactory(janusErrors);
+// src/permission.ts
+import {
+  defineMiddleware as defineMiddleware2,
+  markFactory as markFactory2
+} from "@alxia/core";
+
+// src/refused.ts
+import {
+  errorFormat as errorFormat2,
+  problem as problem2,
+  problemOf as problemOf2
+} from "@alxia/core";
+function refused(ctx, status, body, detail) {
+  if (errorFormat2(ctx) === "problem") {
+    return problem2(problemOf2(ctx, { status, detail }));
+  }
+  return ctx.reply(status, body);
+}
+
 // src/permission.ts
-import { definePlugin } from "@alxia/core";
 function permission(access, permission, type, load, ...options) {
   const loadOf = load;
   const { subject, ctx: ctxOf } = options[0] ?? {};
   const can = access.can;
-  const refuse = (error) => {
-    const body = { error };
-    return body;
-  };
-  return definePlugin()((app) => app.derive(async (ctx) => {
+  const refuse = (ctx, status, error, detail) => refused(ctx, status, { error }, detail);
+  return defineMiddleware2()(async function permissionGuard(ctx, next) {
     const who = subject === undefined ? userOf(ctx) : await subject(ctx);
-    if (who === null)
-      return ctx.reply(401, refuse("unauthenticated"));
+    if (who === null) {
+      return refuse(ctx, 401, "unauthenticated", "The request has no session");
+    }
     const object = await loadOf(ctx);
-    if (object === null)
-      return ctx.reply(404, refuse("not_found"));
+    if (object === null) {
+      return refuse(ctx, 404, "not_found", `No ${type} is found here`);
+    }
     const allowed = await can(who, permission, view(object, type), ctxOf === undefined ? undefined : { ctx: await ctxOf(ctx, object) });
-    if (!allowed)
-      return ctx.reply(403, refuse("forbidden"));
-    return { object };
-  }));
+    if (!allowed) {
+      return refuse(ctx, 403, "forbidden", `The ${permission} permission on this ${type} is not granted`);
+    }
+    return next({ object });
+  });
 }
 function byParam(name, find) {
   return (ctx) => {
@@ -90,6 +126,7 @@ function userOf(ctx) {
   }
   return user;
 }
+markFactory2(permission);
 // src/send.ts
 function sendSession(ctx, auth, signedIn, options = {}) {
   ctx.set.headers.append("set-cookie", auth.cookie.serialize(signedIn.token, signedIn.session));
@@ -105,7 +142,9 @@ async function signOut(ctx, auth) {
 }
 // src/session.ts
 import {
-  alxia as alxia2,
+  defineMiddleware as defineMiddleware3,
+  markFactory as markFactory3,
+  settle,
   withHeaders
 } from "@alxia/core";
 
@@ -138,38 +177,35 @@ function authenticateOnce(auth, request, type) {
 
 // src/session.ts
 function session(auth, options = {}) {
-  const current = new WeakMap;
   const unauthenticated = { error: "unauthenticated" };
-  return alxia2().derive(async (ctx) => {
-    const { request, reply } = ctx;
+  return defineMiddleware3(async function session(ctx, next) {
+    const { request } = ctx;
     const found = await authenticateOnce(auth, request, options.type);
-    current.set(request, found);
     if (found === null && options.required === true) {
-      return reply(401, unauthenticated);
+      return refused(ctx, 401, unauthenticated, "The request has no session");
     }
     const bound = {
       device: deviceOf(ctx, options.device),
       send: (signedIn) => sendSession(ctx, auth, signedIn, options),
       signOut: () => signOut(ctx, auth)
     };
-    return {
+    const response = await settle(ctx, next({
       user: found?.user ?? null,
       session: found?.session ?? null,
       auth: bound
-    };
-  }).wrap(async ({ request }, next) => {
-    const response = await next();
-    const found = current.get(request);
-    if (found?.renewed !== true)
-      return response;
-    const name = `${auth.cookie.name}=`;
-    const presented = new Bun.CookieMap(request.headers.get("cookie") ?? "").get(auth.cookie.name);
-    if (presented !== found.token || response.headers.getSetCookie().some((value) => value.startsWith(name))) {
-      return response;
-    }
-    return withHeaders(response, (headers) => headers.append("set-cookie", auth.cookie.serialize(found.token, found.session)));
+    }));
+    return found?.renewed === true ? renewed(auth, request, found, response) : response;
   });
 }
+function renewed(auth, request, found, response) {
+  const name = `${auth.cookie.name}=`;
+  const presented = new Bun.CookieMap(request.headers.get("cookie") ?? "").get(auth.cookie.name);
+  if (presented !== found.token || response.headers.getSetCookie().some((value) => value.startsWith(name))) {
+    return response;
+  }
+  return withHeaders(response, (headers) => headers.append("set-cookie", auth.cookie.serialize(found.token, found.session)));
+}
+markFactory3(session);
 export {
   DEVICE_COOKIE,
   bodyOf,
@@ -184,5 +220,5 @@ export {
   statusOf
 };
 
-//# debugId=229D182CFDBE7A6B64756E2164756E21
+//# debugId=E839E5A61B58A76164756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,15 +1,16 @@
 {
   "version": 3,
-  "sources": ["../src/device.ts", "../src/errors.ts", "../src/permission.ts", "../src/send.ts", "../src/session.ts", "../src/lookup.ts"],
+  "sources": ["../src/device.ts", "../src/errors.ts", "../src/permission.ts", "../src/refused.ts", "../src/send.ts", "../src/session.ts", "../src/lookup.ts"],
   "sourcesContent": [
     "import type { ResponseSettings } from '@alxia/core';\n\n/** `@nxgt/janus-hono`'s name for it, so a device remembered by one is by the other. */\nexport const DEVICE_COOKIE = 'janus-device';\n\nconst MAX_AGE = 400 * 24 * 60 * 60;\n\nexport interface DeviceCookieOptions {\n\treadonly name?: string;\n\treadonly domain?: string;\n\treadonly path?: string;\n\treadonly sameSite?: 'lax' | 'strict' | 'none';\n\treadonly secure?: boolean;\n\t/** Seconds. Four hundred days, the most a browser keeps, by default. */\n\treadonly maxAge?: number;\n}\n\n/** The device token the request carries, for `signIn(…, { device })`: `null` when none. */\nexport function deviceOf(\n\tctx: { readonly request: Request },\n\toptions: Pick<DeviceCookieOptions, 'name'> = {},\n): string | null {\n\tconst cookies = new Bun.CookieMap(ctx.request.headers.get('cookie') ?? '');\n\tconst value = cookies.get(options.name ?? DEVICE_COOKIE);\n\treturn value === null || value === '' ? null : value;\n}\n\n/** Sets the device cookie, or sets it again so it lasts another `maxAge`. */\nexport function sendDevice(\n\tctx: { readonly set: ResponseSettings },\n\ttoken: string,\n\toptions: DeviceCookieOptions = {},\n): void {\n\tctx.set.cookies.set(options.name ?? DEVICE_COOKIE, token, {\n\t\thttpOnly: true,\n\t\tpath: options.path ?? '/',\n\t\tsameSite: options.sameSite ?? 'lax',\n\t\tsecure: options.secure ?? true,\n\t\tmaxAge: options.maxAge ?? MAX_AGE,\n\t\t...(options.domain === undefined ? {} : { domain: options.domain }),\n\t});\n}\n",
-    "import { alxia, type BaseContext } from '@alxia/core';\nimport {\n\tJanusError,\n\ttype JanusErrorCode,\n\ttype JanusErrorStatus,\n\tstatusOf,\n} from '@nxgt/janus';\n\n/**\n * The body a refusal is answered with: its `code`, and only what the client\n * can act on. Never `reason`, `login`, a hash prefix or a cause: those are\n * for your logs. `@nxgt/janus-hono`'s `bodyOf`, kept twice on purpose.\n */\nexport interface JanusErrorBody {\n\treadonly code: JanusErrorCode;\n\treadonly issues?: JanusError['issues'];\n\treadonly minLength?: number;\n\treadonly attemptsLeft?: number;\n\treadonly retryAfter?: number;\n}\n\nexport function bodyOf(error: JanusError): JanusErrorBody {\n\tswitch (error.code) {\n\t\tcase 'USER_INVALID':\n\t\t\treturn { code: error.code, issues: error.issues ?? [] };\n\t\tcase 'PASSWORD_TOO_SHORT':\n\t\t\treturn error.minLength === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, minLength: error.minLength };\n\t\tcase 'CODE_INVALID':\n\t\t\treturn error.attemptsLeft === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, attemptsLeft: error.attemptsLeft };\n\t\tcase 'CREDENTIALS_INVALID':\n\t\t\treturn error.retryAfter === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, retryAfter: error.retryAfter };\n\t\tdefault:\n\t\t\treturn { code: error.code };\n\t}\n}\n\nexport interface JanusErrorsOptions {\n\t/**\n\t * Called with every `JanusError` answered 5xx — `STORE_FAILED` and the\n\t * like, the server's to fix — as it is answered: started, not awaited,\n\t * so a slow report never holds the response. It cannot change the\n\t * answer: one that throws or rejects is a warning.\n\t */\n\treadonly report?: (error: JanusError, ctx: BaseContext) => unknown;\n}\n\n/**\n * Janus's errors answered, as a plugin: every `JanusError` a route declared\n * after it throws — a sign-in refused, a login taken, a store down — is\n * answered with janus's status and `bodyOf(error)`, typed on those routes.\n * A throttled sign-in carries `Retry-After`. Anything else goes on to the\n * app's next `onError`, or its 500.\n *\n * **`STORE_FAILED` is a 503**, never a 401 or a 404: an outage is not an\n * answer.\n */\nexport function janusErrors(options: JanusErrorsOptions = {}) {\n\treturn alxia().onError((error, ctx) => {\n\t\tif (!(error instanceof JanusError)) return undefined;\n\t\tconst status: JanusErrorStatus = statusOf(error.code);\n\t\tif (status >= 500 && options.report !== undefined) {\n\t\t\tPromise.resolve()\n\t\t\t\t.then(() => options.report?.(error, ctx))\n\t\t\t\t.catch((failure: unknown) =>\n\t\t\t\t\tprocess.emitWarning(\n\t\t\t\t\t\t`janusErrors(): report failed: ${String(failure)}`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t\tconst body = bodyOf(error);\n\t\treturn ctx.reply(\n\t\t\tstatus,\n\t\t\tbody,\n\t\t\terror.retryAfter === undefined\n\t\t\t\t? {}\n\t\t\t\t: { headers: { 'retry-after': String(error.retryAfter) } },\n\t\t);\n\t});\n}\n\nexport { statusOf };\n",
-    "import { type BaseContext, definePlugin, type RequiresOf } from '@alxia/core';\nimport type {\n\tCheckableOf,\n\tModelConfig,\n\tObjectTypeOf,\n\tPermissions,\n\tSubjectRef,\n} from '@nxgt/janus/permissions';\nimport type { Awaitable, ObjectData, OptionsArgs } from './permission-options';\n\n/** The body of each refusal. */\nexport interface PermissionRefusedBody {\n\treadonly error: 'unauthenticated' | 'not_found' | 'forbidden';\n}\n\ntype LooseCan = (\n\tsubject: SubjectRef<ModelConfig> | null,\n\tpermission: string,\n\tobject: { readonly type: string; readonly id: string },\n\toptions?: { readonly ctx: unknown },\n) => Promise<boolean>;\n\n/**\n * A guard, as a plugin: the routes declared after it run only if the\n * subject holds `permission` on an object of `type`. It loads the object\n * once, checks it with `access.can`, and hands it to them as `object`.\n *\n * | the request | answered |\n * | --- | --- |\n * | anonymous | 401 — before the object is loaded |\n * | `load` answers `null` | 404 |\n * | a denial | 403 |\n * | allowed | the route runs, `object` set |\n *\n * Each refusal is typed on those routes. **A failure throws**: a store that\n * cannot answer is `STORE_FAILED`, never a 403 — `janusErrors()` answers\n * it 503. Scope it with `group`, so it guards only its routes:\n *\n * ```ts\n * app.use(session(accounts)).group('/records/:id', (records) =>\n *   records.use(permission(access, 'view', 'record', byParam('id', findRecord)))\n *     .get('/', ({ object, reply }) => reply(200, object)));\n * ```\n */\nexport function permission<\n\tC extends ModelConfig,\n\tconst T extends ObjectTypeOf<C>,\n\tconst P extends CheckableOf<C, T>,\n\tO extends ObjectData<C, T>,\n\tLoadCtx extends object = BaseContext,\n\tSubjectCtx extends object = BaseContext,\n\tCheckCtx extends object = BaseContext,\n>(\n\taccess: Pick<Permissions<C>, 'can'>,\n\tpermission: P,\n\ttype: T,\n\tload: (ctx: BaseContext & LoadCtx) => Awaitable<O | null>,\n\t...options: OptionsArgs<C, T, P, O, SubjectCtx, CheckCtx>\n) {\n\t// `use` has checked that the app gives what `load`, `subject` and `ctx` read.\n\tconst loadOf = load as (ctx: BaseContext) => Awaitable<O | null>;\n\tconst { subject, ctx: ctxOf } = (options[0] ?? {}) as {\n\t\treadonly subject?: (\n\t\t\tctx: BaseContext,\n\t\t) => Awaitable<SubjectRef<ModelConfig> | null>;\n\t\treadonly ctx?: (ctx: BaseContext, object: unknown) => Awaitable<unknown>;\n\t};\n\tconst can = access.can as LooseCan;\n\tconst refuse = (error: PermissionRefusedBody['error']) => {\n\t\tconst body: PermissionRefusedBody = { error };\n\t\treturn body;\n\t};\n\treturn definePlugin<\n\t\tRequiresOf<\n\t\t\tLoadCtx & SubjectCtx & CheckCtx,\n\t\t\tAnnotatedAny<LoadCtx, SubjectCtx>\n\t\t>\n\t>()((app) =>\n\t\tapp.derive(async (ctx) => {\n\t\t\tconst who = subject === undefined ? userOf(ctx) : await subject(ctx);\n\t\t\tif (who === null) return ctx.reply(401, refuse('unauthenticated'));\n\t\t\tconst object = await loadOf(ctx);\n\t\t\tif (object === null) return ctx.reply(404, refuse('not_found'));\n\t\t\tconst allowed = await can(\n\t\t\t\twho,\n\t\t\t\tpermission,\n\t\t\t\tview(object, type),\n\t\t\t\tctxOf === undefined ? undefined : { ctx: await ctxOf(ctx, object) },\n\t\t\t);\n\t\t\tif (!allowed) return ctx.reply(403, refuse('forbidden'));\n\t\t\treturn { object };\n\t\t}),\n\t);\n}\n\n/**\n * The callback to name when `RequiresOf` refuses one annotated `any`: `load`\n * or `subject` when it is that one, `ctx` otherwise. An `any` in any of the\n * three makes their intersection `any`, so `RequiresOf` cannot tell which;\n * a `Record<string, any>` passes the same test.\n */\ntype AnnotatedAny<LoadCtx, SubjectCtx> = [LoadCtx] extends [\n\t{ readonly '~any': 1 },\n]\n\t? 'load'\n\t: [SubjectCtx] extends [{ readonly '~any': 1 }]\n\t\t? 'subject'\n\t\t: 'ctx';\n\n/**\n * A `load` reading one path parameter, as it arrived: `find(id)`, or `null`\n * — a 404 — when the route has no such parameter.\n */\nexport function byParam<O>(\n\tname: string,\n\tfind: (id: string) => Awaitable<O | null>,\n): (ctx: BaseContext) => Awaitable<O | null> {\n\treturn (ctx) => {\n\t\tconst id = ctx.pathParams[name];\n\t\treturn id === undefined ? null : find(id);\n\t};\n}\n\n/** The object as `can()` reads it: `type` added, every other field read from the object itself. */\nfunction view(\n\tobject: object,\n\ttype: string,\n): { readonly type: string; readonly id: string } {\n\treturn new Proxy(object, {\n\t\tget: (target, key) => (key === 'type' ? type : Reflect.get(target, key)),\n\t\thas: (target, key) => key === 'type' || Reflect.has(target, key),\n\t}) as { readonly type: string; readonly id: string };\n}\n\n/** The `user` `session()` derived — or a wiring error when nothing did. */\nfunction userOf(ctx: BaseContext): SubjectRef<ModelConfig> | null {\n\tconst user = (ctx as { readonly user?: unknown }).user;\n\tif (user === undefined) {\n\t\tthrow new TypeError(\n\t\t\t'permission(): no user in the context — use session(auth) before it, or pass { subject }',\n\t\t);\n\t}\n\treturn user as SubjectRef<ModelConfig> | null;\n}\n",
+    "import {\n\ttype BaseContext,\n\tdefineMiddleware,\n\terrorFormat,\n\ttype Middleware,\n\tmarkFactory,\n\ttype Next,\n\ttype Problem,\n\tproblem,\n\tproblemOf,\n\ttype Reply,\n} from '@alxia/core';\nimport {\n\tJanusError,\n\ttype JanusErrorCode,\n\ttype JanusErrorStatus,\n\tstatusOf,\n} from '@nxgt/janus';\n\n/**\n * The body a refusal is answered with: its `code`, and only what the client\n * can act on. Never `reason`, `login`, a hash prefix or a cause: those are\n * for your logs. `@nxgt/janus-hono`'s `bodyOf`, kept twice on purpose.\n */\nexport interface JanusErrorBody {\n\treadonly code: JanusErrorCode;\n\treadonly issues?: JanusError['issues'];\n\treadonly minLength?: number;\n\treadonly attemptsLeft?: number;\n\treadonly retryAfter?: number;\n}\n\nexport function bodyOf(error: JanusError): JanusErrorBody {\n\tswitch (error.code) {\n\t\tcase 'USER_INVALID':\n\t\t\treturn { code: error.code, issues: error.issues ?? [] };\n\t\tcase 'PASSWORD_TOO_SHORT':\n\t\t\treturn error.minLength === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, minLength: error.minLength };\n\t\tcase 'CODE_INVALID':\n\t\t\treturn error.attemptsLeft === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, attemptsLeft: error.attemptsLeft };\n\t\tcase 'CREDENTIALS_INVALID':\n\t\t\treturn error.retryAfter === undefined\n\t\t\t\t? { code: error.code }\n\t\t\t\t: { code: error.code, retryAfter: error.retryAfter };\n\t\tdefault:\n\t\t\treturn { code: error.code };\n\t}\n}\n\nexport interface JanusErrorsOptions {\n\t/**\n\t * Called with every `JanusError` answered 5xx — `STORE_FAILED` and the\n\t * like, the server's to fix — as it is answered: started, not awaited,\n\t * so a slow report never holds the response. It cannot change the\n\t * answer: one that throws or rejects is a warning.\n\t */\n\treadonly report?: (error: JanusError, ctx: BaseContext) => unknown;\n}\n\n/**\n * A `JanusError` answered under `alxia({ errors: 'problem' })`: an RFC\n * 9457 problem, its `code` and the members of `JanusErrorBody` its\n * extensions.\n */\nexport type JanusErrorProblem = Problem<JanusErrorStatus, JanusErrorBody>;\n\n/** What `janusErrors()` makes: a middleware that answers what janus throws behind it. */\nexport type JanusErrors = Middleware<\n\tobject,\n\tPromise<Next | Reply<JanusErrorStatus, JanusErrorBody | JanusErrorProblem>>\n>;\n\n/**\n * Janus's errors answered, as a middleware: every `JanusError` thrown\n * behind it — by `session()`, `permission()`, a route — a sign-in\n * refused, a login taken, a store down — is answered with janus's status\n * and `bodyOf(error)` — under `alxia({ errors: 'problem' })`, a problem\n * whose extensions are that body — typed on the routes declared after it. A throttled\n * sign-in carries `Retry-After`. Anything else goes on, thrown, to the\n * middlewares before it, or to the route boundary's 500.\n *\n * Give it to `use` before `session()`, so that a store down while the\n * session is read is answered too:\n *\n * ```ts\n * app.use(janusErrors(), session(accounts)).post('/sign-in', ...);\n * ```\n *\n * **`STORE_FAILED` is a 503**, never a 401 or a 404: an outage is not an\n * answer.\n */\nexport function janusErrors(options: JanusErrorsOptions = {}): JanusErrors {\n\treturn defineMiddleware(async function janusErrors(ctx, next) {\n\t\ttry {\n\t\t\treturn await next();\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof JanusError)) throw error;\n\t\t\treturn answer(error, ctx, options);\n\t\t}\n\t});\n}\n\n/** A `JanusError`, answered: its status, its body, reported when a 5xx. */\nfunction answer(\n\terror: JanusError,\n\tctx: BaseContext,\n\toptions: JanusErrorsOptions,\n): Reply<JanusErrorStatus, JanusErrorBody | JanusErrorProblem> {\n\tconst status: JanusErrorStatus = statusOf(error.code);\n\tif (status >= 500 && options.report !== undefined) {\n\t\tPromise.resolve()\n\t\t\t.then(() => options.report?.(error, ctx))\n\t\t\t.catch((failure: unknown) =>\n\t\t\t\tprocess.emitWarning(`janusErrors(): report failed: ${String(failure)}`),\n\t\t\t);\n\t}\n\tconst body = bodyOf(error);\n\tconst init =\n\t\terror.retryAfter === undefined\n\t\t\t? {}\n\t\t\t: { headers: { 'retry-after': String(error.retryAfter) } };\n\tif (errorFormat(ctx) === 'problem') {\n\t\treturn problem(problemOf(ctx, { status, ...body }), init);\n\t}\n\treturn ctx.reply(status, body, init);\n}\n\nexport { statusOf };\n\nmarkFactory(janusErrors);\n",
+    "import {\n\ttype BaseContext,\n\tdefineMiddleware,\n\tmarkFactory,\n\ttype Problem,\n\ttype RequiresOf,\n} from '@alxia/core';\nimport type {\n\tCheckableOf,\n\tModelConfig,\n\tObjectTypeOf,\n\tPermissions,\n\tSubjectRef,\n} from '@nxgt/janus/permissions';\nimport type { Awaitable, ObjectData, OptionsArgs } from './permission-options';\nimport { refused } from './refused';\n\n/** The body of each refusal. */\nexport interface PermissionRefusedBody {\n\treadonly error: 'unauthenticated' | 'not_found' | 'forbidden';\n}\n\n/** A refusal under `alxia({ errors: 'problem' })`: its 401, 404 or 403 as a problem. */\nexport type PermissionRefusedProblem = Problem<401 | 403 | 404>;\n\ntype LooseCan = (\n\tsubject: SubjectRef<ModelConfig> | null,\n\tpermission: string,\n\tobject: { readonly type: string; readonly id: string },\n\toptions?: { readonly ctx: unknown },\n) => Promise<boolean>;\n\n/**\n * A guard, as a middleware: the routes declared after it run only if the\n * subject holds `permission` on an object of `type`. It loads the object\n * once, checks it with `access.can`, and hands it to them as `object`.\n *\n * | the request | answered |\n * | --- | --- |\n * | anonymous | 401 — before the object is loaded |\n * | `load` answers `null` | 404 |\n * | a denial | 403 |\n * | allowed | the route runs, `object` set |\n *\n * Each refusal is typed on those routes. **A failure throws**: a store that\n * cannot answer is `STORE_FAILED`, never a 403 — `janusErrors()` answers\n * it 503. Scope it with `group`, so it guards only its routes — given to\n * the app's `use`, it would refuse a request no route matches too:\n *\n * ```ts\n * app.use(janusErrors(), session(accounts)).group('/records/:id', (records) =>\n *   records.use(permission(access, 'view', 'record', byParam('id', findRecord)))\n *     .get('/', ({ object, reply }) => reply(200, object)));\n * ```\n */\nexport function permission<\n\tC extends ModelConfig,\n\tconst T extends ObjectTypeOf<C>,\n\tconst P extends CheckableOf<C, T>,\n\tO extends ObjectData<C, T>,\n\tLoadCtx extends object = BaseContext,\n\tSubjectCtx extends object = BaseContext,\n\tCheckCtx extends object = BaseContext,\n>(\n\taccess: Pick<Permissions<C>, 'can'>,\n\tpermission: P,\n\ttype: T,\n\tload: (ctx: BaseContext & LoadCtx) => Awaitable<O | null>,\n\t...options: OptionsArgs<C, T, P, O, SubjectCtx, CheckCtx>\n) {\n\t// `app.use` has checked that the app gives what `load`, `subject` and `ctx` read.\n\tconst loadOf = load as (ctx: BaseContext) => Awaitable<O | null>;\n\tconst { subject, ctx: ctxOf } = (options[0] ?? {}) as {\n\t\treadonly subject?: (\n\t\t\tctx: BaseContext,\n\t\t) => Awaitable<SubjectRef<ModelConfig> | null>;\n\t\treadonly ctx?: (ctx: BaseContext, object: unknown) => Awaitable<unknown>;\n\t};\n\tconst can = access.can as LooseCan;\n\tconst refuse = <Status extends 401 | 403 | 404>(\n\t\tctx: BaseContext,\n\t\tstatus: Status,\n\t\terror: PermissionRefusedBody['error'],\n\t\tdetail: string,\n\t) => refused(ctx, status, { error } as PermissionRefusedBody, detail);\n\treturn defineMiddleware<\n\t\tRequiresOf<\n\t\t\tLoadCtx & SubjectCtx & CheckCtx,\n\t\t\tAnnotatedAny<LoadCtx, SubjectCtx>\n\t\t>\n\t>()(async function permissionGuard(ctx, next) {\n\t\tconst who = subject === undefined ? userOf(ctx) : await subject(ctx);\n\t\tif (who === null) {\n\t\t\treturn refuse(ctx, 401, 'unauthenticated', 'The request has no session');\n\t\t}\n\t\tconst object = await loadOf(ctx);\n\t\tif (object === null) {\n\t\t\treturn refuse(ctx, 404, 'not_found', `No ${type} is found here`);\n\t\t}\n\t\tconst allowed = await can(\n\t\t\twho,\n\t\t\tpermission,\n\t\t\tview(object, type),\n\t\t\tctxOf === undefined ? undefined : { ctx: await ctxOf(ctx, object) },\n\t\t);\n\t\tif (!allowed) {\n\t\t\treturn refuse(\n\t\t\t\tctx,\n\t\t\t\t403,\n\t\t\t\t'forbidden',\n\t\t\t\t`The ${permission} permission on this ${type} is not granted`,\n\t\t\t);\n\t\t}\n\t\treturn next({ object });\n\t});\n}\n\n/**\n * The callback to name when `RequiresOf` refuses one annotated `any`: `load`\n * or `subject` when it is that one, `ctx` otherwise. An `any` in any of the\n * three makes their intersection `any`, so `RequiresOf` cannot tell which;\n * a `Record<string, any>` passes the same test.\n */\ntype AnnotatedAny<LoadCtx, SubjectCtx> = [LoadCtx] extends [\n\t{ readonly '~any': 1 },\n]\n\t? 'load'\n\t: [SubjectCtx] extends [{ readonly '~any': 1 }]\n\t\t? 'subject'\n\t\t: 'ctx';\n\n/**\n * A `load` reading one path parameter, as it arrived: `find(id)`, or `null`\n * — a 404 — when the route has no such parameter.\n */\nexport function byParam<O>(\n\tname: string,\n\tfind: (id: string) => Awaitable<O | null>,\n): (ctx: BaseContext) => Awaitable<O | null> {\n\treturn (ctx) => {\n\t\tconst id = ctx.pathParams[name];\n\t\treturn id === undefined ? null : find(id);\n\t};\n}\n\n/** The object as `can()` reads it: `type` added, every other field read from the object itself. */\nfunction view(\n\tobject: object,\n\ttype: string,\n): { readonly type: string; readonly id: string } {\n\treturn new Proxy(object, {\n\t\tget: (target, key) => (key === 'type' ? type : Reflect.get(target, key)),\n\t\thas: (target, key) => key === 'type' || Reflect.has(target, key),\n\t}) as { readonly type: string; readonly id: string };\n}\n\n/** The `user` `session()` derived — or a wiring error when nothing did. */\nfunction userOf(ctx: BaseContext): SubjectRef<ModelConfig> | null {\n\tconst user = (ctx as { readonly user?: unknown }).user;\n\tif (user === undefined) {\n\t\tthrow new TypeError(\n\t\t\t'permission(): no user in the context — use session(auth) before it, or pass { subject }',\n\t\t);\n\t}\n\treturn user as SubjectRef<ModelConfig> | null;\n}\n\nmarkFactory(permission);\n",
+    "/**\n * A refusal of `session()` or `permission()`, in the format of the app\n * that serves the request: its `{ error }` body by default, an RFC 9457\n * problem under `alxia({ errors: 'problem' })`.\n */\nimport {\n\ttype BaseContext,\n\terrorFormat,\n\ttype Problem,\n\tproblem,\n\tproblemOf,\n\ttype Reply,\n} from '@alxia/core';\n\n/** `body` with `status`, or the problem of `status` saying `detail`. */\nexport function refused<Status extends 401 | 403 | 404, Body>(\n\tctx: BaseContext,\n\tstatus: Status,\n\tbody: Body,\n\tdetail: string,\n): Reply<Status, Body | Problem<Status>> {\n\tif (errorFormat(ctx) === 'problem') {\n\t\treturn problem(problemOf(ctx, { status, detail }));\n\t}\n\treturn ctx.reply(status, body);\n}\n",
     "import type { ResponseSettings } from '@alxia/core';\nimport { type DeviceCookieOptions, sendDevice } from './device';\nimport type { Auth, SessionOpened } from './types';\n\n/** What `sendSession` takes besides: the device cookie's options. */\nexport interface SendSessionOptions {\n\treadonly device?: DeviceCookieOptions;\n}\n\n/**\n * Sends the session cookie — after `signUp`, `signIn`, anything that\n * answered a token and its session — and answers the user. The token is in\n * the cookie, never in the body. With a `deviceToken`, the device cookie\n * too.\n *\n * ```ts\n * const signedIn = await auth.signIn(body, { device: deviceOf(ctx) });\n * return reply(200, { id: sendSession(ctx, auth, signedIn).id });\n * ```\n */\nexport function sendSession<U>(\n\tctx: { readonly set: ResponseSettings },\n\tauth: Pick<Auth<{ readonly type: string }>, 'cookie'>,\n\tsignedIn: SessionOpened<U>,\n\toptions: SendSessionOptions = {},\n): U {\n\tctx.set.headers.append(\n\t\t'set-cookie',\n\t\tauth.cookie.serialize(signedIn.token, signedIn.session),\n\t);\n\tif (typeof signedIn.deviceToken === 'string') {\n\t\tsendDevice(ctx, signedIn.deviceToken, options.device);\n\t}\n\treturn signedIn.user;\n}\n\n/**\n * Revokes the session the request presents and clears the cookie — cleared\n * whatever the answer, so a browser holding a stale cookie drops it too.\n */\nexport async function signOut(\n\tctx: { readonly request: Request; readonly set: ResponseSettings },\n\tauth: Pick<Auth<{ readonly type: string }>, 'signOut' | 'cookie'>,\n): Promise<boolean> {\n\tconst revoked = await auth.signOut(ctx.request);\n\tctx.set.headers.append('set-cookie', auth.cookie.clear());\n\treturn revoked;\n}\n",
-    "import {\n\ttype Alxia,\n\talxia,\n\ttype Empty,\n\ttype Reply,\n\twithHeaders,\n} from '@alxia/core';\nimport type { Session } from '@nxgt/janus';\nimport { type DeviceCookieOptions, deviceOf } from './device';\nimport { authenticateOnce, type Found } from './lookup';\nimport { sendSession, signOut } from './send';\nimport type { Auth, RequestAuth, UserOfAuth } from './types';\n\nexport interface SessionOptions<T extends string> {\n\t/** Only a user of this type is authenticated here; any other is anonymous. */\n\treadonly type?: T;\n\t/**\n\t * `true`: an anonymous request is answered 401 and the route never runs,\n\t * so `user` is never `null` in it — and the 401 is in its type. A\n\t * `boolean` known only at runtime keeps the 401 in the type, and `user`\n\t * may be `null`.\n\t */\n\treadonly required?: boolean;\n\t/** The device cookie `auth.device` reads and `auth.send` sets. */\n\treadonly device?: DeviceCookieOptions;\n}\n\n/** The body of the 401 a required session answers. */\nexport interface UnauthenticatedBody {\n\treadonly error: 'unauthenticated';\n}\n\ntype UserOf<A, T> = Extract<UserOfAuth<A>, { readonly type: T }>;\n\n/**\n * Who a request belongs to, as a plugin: `auth.authenticate(request)`, and\n * the routes declared after it read `user` and `session` — typed by the\n * user schema, narrowed by `type`.\n *\n * **An outage is not anonymous**: a store that cannot answer throws\n * `STORE_FAILED`, which `janusErrors()` answers 503, never 401.\n *\n * A session renewed in passing is sent again as a cookie, after the route —\n * only to a request that presented it as one (a `Bearer` client is never\n * handed a cookie), and never over a session cookie the route set itself.\n *\n * ```ts\n * app.use(session(accounts, { required: true })).get('/me', ({ user, reply }) => reply.ok(user));\n * ```\n */\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions: SessionOptions<T> & { readonly required: true },\n): Alxia<\n\t{\n\t\treadonly user: UserOf<A, T>;\n\t\treadonly session: Session;\n\t\treadonly auth: RequestAuth;\n\t},\n\tEmpty,\n\t'',\n\tReply<401, UnauthenticatedBody>\n>;\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions?: SessionOptions<T> & { readonly required?: false },\n): Alxia<\n\t{\n\t\treadonly user: UserOf<A, T> | null;\n\t\treadonly session: Session | null;\n\t\treadonly auth: RequestAuth;\n\t},\n\tEmpty,\n\t'',\n\tnever\n>;\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions?: SessionOptions<T>,\n): Alxia<\n\t{\n\t\treadonly user: UserOf<A, T> | null;\n\t\treadonly session: Session | null;\n\t\treadonly auth: RequestAuth;\n\t},\n\tEmpty,\n\t'',\n\tReply<401, UnauthenticatedBody>\n>;\nexport function session(\n\tauth: Auth<{ readonly type: string }>,\n\toptions: SessionOptions<string> = {},\n): unknown {\n\tconst current = new WeakMap<Request, Found>();\n\tconst unauthenticated: UnauthenticatedBody = { error: 'unauthenticated' };\n\treturn alxia()\n\t\t.derive(async (ctx) => {\n\t\t\tconst { request, reply } = ctx;\n\t\t\tconst found = await authenticateOnce(auth, request, options.type);\n\t\t\tcurrent.set(request, found);\n\t\t\tif (found === null && options.required === true) {\n\t\t\t\treturn reply(401, unauthenticated);\n\t\t\t}\n\t\t\tconst bound: RequestAuth = {\n\t\t\t\tdevice: deviceOf(ctx, options.device),\n\t\t\t\tsend: (signedIn) => sendSession(ctx, auth, signedIn, options),\n\t\t\t\tsignOut: () => signOut(ctx, auth),\n\t\t\t};\n\t\t\treturn {\n\t\t\t\tuser: found?.user ?? null,\n\t\t\t\tsession: found?.session ?? null,\n\t\t\t\tauth: bound,\n\t\t\t};\n\t\t})\n\t\t.wrap(async ({ request }, next) => {\n\t\t\tconst response = await next();\n\t\t\tconst found = current.get(request);\n\t\t\tif (found?.renewed !== true) return response;\n\t\t\t// The route's own cookie wins: a sign-in or a sign-out behind this\n\t\t\t// plugin must not be undone by the session it replaced.\n\t\t\tconst name = `${auth.cookie.name}=`;\n\t\t\tconst presented = new Bun.CookieMap(\n\t\t\t\trequest.headers.get('cookie') ?? '',\n\t\t\t).get(auth.cookie.name);\n\t\t\tif (\n\t\t\t\tpresented !== found.token ||\n\t\t\t\tresponse.headers.getSetCookie().some((value) => value.startsWith(name))\n\t\t\t) {\n\t\t\t\treturn response;\n\t\t\t}\n\t\t\treturn withHeaders(response, (headers) =>\n\t\t\t\theaders.append(\n\t\t\t\t\t'set-cookie',\n\t\t\t\t\tauth.cookie.serialize(found.token, found.session),\n\t\t\t\t),\n\t\t\t);\n\t\t});\n}\n",
+    "import {\n\tdefineMiddleware,\n\ttype Empty,\n\ttype Middleware,\n\tmarkFactory,\n\ttype Next,\n\ttype Problem,\n\ttype Reply,\n\tsettle,\n\twithHeaders,\n} from '@alxia/core';\nimport type { Session } from '@nxgt/janus';\nimport { type DeviceCookieOptions, deviceOf } from './device';\nimport { authenticateOnce, type Found } from './lookup';\nimport { refused } from './refused';\nimport { sendSession, signOut } from './send';\nimport type { Auth, RequestAuth, UserOfAuth } from './types';\n\nexport interface SessionOptions<T extends string> {\n\t/** Only a user of this type is authenticated here; any other is anonymous. */\n\treadonly type?: T;\n\t/**\n\t * `true`: an anonymous request is answered 401 and the route never runs,\n\t * so `user` is never `null` in it — and the 401 is in its type. A\n\t * `boolean` known only at runtime keeps the 401 in the type, and `user`\n\t * may be `null`.\n\t */\n\treadonly required?: boolean;\n\t/** The device cookie `auth.device` reads and `auth.send` sets. */\n\treadonly device?: DeviceCookieOptions;\n}\n\n/** The body of the 401 a required session answers. */\nexport interface UnauthenticatedBody {\n\treadonly error: 'unauthenticated';\n}\n\n/** The 401 a required session answers under `alxia({ errors: 'problem' })`. */\nexport type UnauthenticatedProblem = Problem<401>;\n\ntype UserOf<A, T> = Extract<UserOfAuth<A>, { readonly type: T }>;\n\n/** What a session gives the routes after it. */\ntype Given<User, S> = {\n\treadonly user: User;\n\treadonly session: S;\n\treadonly auth: RequestAuth;\n};\n\n/** What `session()` makes: a middleware that gives `Added`, or answers `Refused`. */\nexport type SessionMiddleware<\n\tAdded extends object,\n\tRefused = never,\n> = Middleware<Empty, Promise<Refused | Next<Added>>>;\n\n/**\n * Who a request belongs to, as a middleware: `auth.authenticate(request)`,\n * and the routes declared after it read `user` and `session` — typed by\n * the user schema, narrowed by `type`. Given to `app.use`, it runs on a\n * request no route matches too: a required session answers it 401 before\n * its 404.\n *\n * **An outage is not anonymous**: a store that cannot answer throws\n * `STORE_FAILED`, which `janusErrors()` — given to `use` before it —\n * answers 503, never 401.\n *\n * A session renewed in passing is sent again as a cookie, after the route —\n * only to a request that presented it as one (a `Bearer` client is never\n * handed a cookie), and never over a session cookie the route set itself.\n *\n * ```ts\n * app.use(janusErrors(), session(accounts, { required: true }))\n *    .get('/me', ({ user, reply }) => reply.ok(user));\n * ```\n */\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions: SessionOptions<T> & { readonly required: true },\n): SessionMiddleware<\n\tGiven<UserOf<A, T>, Session>,\n\tReply<401, UnauthenticatedBody | UnauthenticatedProblem>\n>;\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions?: SessionOptions<T> & { readonly required?: false },\n): SessionMiddleware<Given<UserOf<A, T> | null, Session | null>>;\nexport function session<\n\tA extends Auth<{ readonly type: string }>,\n\tconst T extends UserOfAuth<A>['type'] = UserOfAuth<A>['type'],\n>(\n\tauth: A,\n\toptions?: SessionOptions<T>,\n): SessionMiddleware<\n\tGiven<UserOf<A, T> | null, Session | null>,\n\tReply<401, UnauthenticatedBody | UnauthenticatedProblem>\n>;\nexport function session(\n\tauth: Auth<{ readonly type: string }>,\n\toptions: SessionOptions<string> = {},\n): unknown {\n\tconst unauthenticated: UnauthenticatedBody = { error: 'unauthenticated' };\n\treturn defineMiddleware(async function session(ctx, next) {\n\t\tconst { request } = ctx;\n\t\tconst found = await authenticateOnce(auth, request, options.type);\n\t\tif (found === null && options.required === true) {\n\t\t\treturn refused(ctx, 401, unauthenticated, 'The request has no session');\n\t\t}\n\t\tconst bound: RequestAuth = {\n\t\t\tdevice: deviceOf(ctx, options.device),\n\t\t\tsend: (signedIn) => sendSession(ctx, auth, signedIn, options),\n\t\t\tsignOut: () => signOut(ctx, auth),\n\t\t};\n\t\t// Settled: a refusal's 400, an error's answer, still carry the renewal.\n\t\tconst response = await settle(\n\t\t\tctx,\n\t\t\tnext({\n\t\t\t\tuser: found?.user ?? null,\n\t\t\t\tsession: found?.session ?? null,\n\t\t\t\tauth: bound,\n\t\t\t}),\n\t\t);\n\t\treturn found?.renewed === true\n\t\t\t? renewed(auth, request, found, response)\n\t\t\t: response;\n\t});\n}\n\n/**\n * A session renewed in passing, sent again as a cookie: only to a request\n * that presented it as one, and never over a cookie the route set itself —\n * a sign-in or a sign-out behind it must not be undone by the session it\n * replaced.\n */\nfunction renewed<R extends Response>(\n\tauth: Auth<{ readonly type: string }>,\n\trequest: Request,\n\tfound: NonNullable<Found>,\n\tresponse: R,\n): R {\n\tconst name = `${auth.cookie.name}=`;\n\tconst presented = new Bun.CookieMap(request.headers.get('cookie') ?? '').get(\n\t\tauth.cookie.name,\n\t);\n\tif (\n\t\tpresented !== found.token ||\n\t\tresponse.headers.getSetCookie().some((value) => value.startsWith(name))\n\t) {\n\t\treturn response;\n\t}\n\treturn withHeaders(response, (headers) =>\n\t\theaders.append(\n\t\t\t'set-cookie',\n\t\t\tauth.cookie.serialize(found.token, found.session),\n\t\t),\n\t) as R;\n}\n\nmarkFactory(session);\n",
     "import type { Authenticated } from '@nxgt/janus';\nimport type { Auth } from './types';\n\nexport type Found = Authenticated<{ readonly type: string }> | null;\n\n/**\n * Each request's lookups, by instance and by `type`: an open `session()`\n * and a required one behind it, of the same `type`, look the session up\n * once. They live as long as the `Request` object; a lookup that failed is\n * forgotten, so the next dispatch of that object asks again.\n */\nconst lookups = new WeakMap<\n\tobject,\n\tWeakMap<Request, Map<string, Promise<Found>>>\n>();\n\nexport function authenticateOnce(\n\tauth: Auth<{ readonly type: string }>,\n\trequest: Request,\n\ttype: string | undefined,\n): Promise<Found> {\n\tlet byRequest = lookups.get(auth);\n\tif (byRequest === undefined) {\n\t\tbyRequest = new WeakMap();\n\t\tlookups.set(auth, byRequest);\n\t}\n\tlet byType = byRequest.get(request);\n\tif (byType === undefined) {\n\t\tbyType = new Map();\n\t\tbyRequest.set(request, byType);\n\t}\n\tconst key = type ?? '';\n\tlet found = byType.get(key);\n\tif (found === undefined) {\n\t\tfound = auth.authenticate(\n\t\t\trequest,\n\t\t\ttype === undefined ? undefined : { type },\n\t\t);\n\t\tbyType.set(key, found);\n\t\tconst asked = found;\n\t\tasked.catch(() => {\n\t\t\tif (byType.get(key) === asked) byType.delete(key);\n\t\t});\n\t}\n\treturn found;\n}\n"
   ],
-  "mappings": ";AAGO,IAAM,gBAAgB;AAE7B,IAAM,UAAU,MAAM,KAAK,KAAK;AAazB,SAAS,QAAQ,CACvB,KACA,UAA6C,CAAC,GAC9B;AAAA,EAChB,MAAM,UAAU,IAAI,IAAI,UAAU,IAAI,QAAQ,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAAA,EACzE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,aAAa;AAAA,EACvD,OAAO,UAAU,QAAQ,UAAU,KAAK,OAAO;AAAA;AAIzC,SAAS,UAAU,CACzB,KACA,OACA,UAA+B,CAAC,GACzB;AAAA,EACP,IAAI,IAAI,QAAQ,IAAI,QAAQ,QAAQ,eAAe,OAAO;AAAA,IACzD,UAAU;AAAA,IACV,MAAM,QAAQ,QAAQ;AAAA,IACtB,UAAU,QAAQ,YAAY;AAAA,IAC9B,QAAQ,QAAQ,UAAU;AAAA,IAC1B,QAAQ,QAAQ,UAAU;AAAA,OACtB,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,EAClE,CAAC;AAAA;;ACxCF;AACA;AAAA;AAAA;AAAA;AAoBO,SAAS,MAAM,CAAC,OAAmC;AAAA,EACzD,QAAQ,MAAM;AAAA,SACR;AAAA,MACJ,OAAO,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,CAAC,EAAE;AAAA,SAClD;AAAA,MACJ,OAAO,MAAM,cAAc,YACxB,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,UAAU;AAAA,SAC9C;AAAA,MACJ,OAAO,MAAM,iBAAiB,YAC3B,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,cAAc,MAAM,aAAa;AAAA,SACpD;AAAA,MACJ,OAAO,MAAM,eAAe,YACzB,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,YAAY,MAAM,WAAW;AAAA;AAAA,MAEpD,OAAO,EAAE,MAAM,MAAM,KAAK;AAAA;AAAA;AAwBtB,SAAS,WAAW,CAAC,UAA8B,CAAC,GAAG;AAAA,EAC7D,OAAO,MAAM,EAAE,QAAQ,CAAC,OAAO,QAAQ;AAAA,IACtC,IAAI,EAAE,iBAAiB;AAAA,MAAa;AAAA,IACpC,MAAM,SAA2B,SAAS,MAAM,IAAI;AAAA,IACpD,IAAI,UAAU,OAAO,QAAQ,WAAW,WAAW;AAAA,MAClD,QAAQ,QAAQ,EACd,KAAK,MAAM,QAAQ,SAAS,OAAO,GAAG,CAAC,EACvC,MAAM,CAAC,YACP,QAAQ,YACP,iCAAiC,OAAO,OAAO,GAChD,CACD;AAAA,IACF;AAAA,IACA,MAAM,OAAO,OAAO,KAAK;AAAA,IACzB,OAAO,IAAI,MACV,QACA,MACA,MAAM,eAAe,YAClB,CAAC,IACD,EAAE,SAAS,EAAE,eAAe,OAAO,MAAM,UAAU,EAAE,EAAE,CAC3D;AAAA,GACA;AAAA;;ACnFF;AA4CO,SAAS,UAQf,CACA,QACA,YACA,MACA,SACG,SACF;AAAA,EAED,MAAM,SAAS;AAAA,EACf,QAAQ,SAAS,KAAK,UAAW,QAAQ,MAAM,CAAC;AAAA,EAMhD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,SAAS,CAAC,UAA0C;AAAA,IACzD,MAAM,OAA8B,EAAE,MAAM;AAAA,IAC5C,OAAO;AAAA;AAAA,EAER,OAAO,aAKL,EAAE,CAAC,QACJ,IAAI,OAAO,OAAO,QAAQ;AAAA,IACzB,MAAM,MAAM,YAAY,YAAY,OAAO,GAAG,IAAI,MAAM,QAAQ,GAAG;AAAA,IACnE,IAAI,QAAQ;AAAA,MAAM,OAAO,IAAI,MAAM,KAAK,OAAO,iBAAiB,CAAC;AAAA,IACjE,MAAM,SAAS,MAAM,OAAO,GAAG;AAAA,IAC/B,IAAI,WAAW;AAAA,MAAM,OAAO,IAAI,MAAM,KAAK,OAAO,WAAW,CAAC;AAAA,IAC9D,MAAM,UAAU,MAAM,IACrB,KACA,YACA,KAAK,QAAQ,IAAI,GACjB,UAAU,YAAY,YAAY,EAAE,KAAK,MAAM,MAAM,KAAK,MAAM,EAAE,CACnE;AAAA,IACA,IAAI,CAAC;AAAA,MAAS,OAAO,IAAI,MAAM,KAAK,OAAO,WAAW,CAAC;AAAA,IACvD,OAAO,EAAE,OAAO;AAAA,GAChB,CACF;AAAA;AAqBM,SAAS,OAAU,CACzB,MACA,MAC4C;AAAA,EAC5C,OAAO,CAAC,QAAQ;AAAA,IACf,MAAM,KAAK,IAAI,WAAW;AAAA,IAC1B,OAAO,OAAO,YAAY,OAAO,KAAK,EAAE;AAAA;AAAA;AAK1C,SAAS,IAAI,CACZ,QACA,MACiD;AAAA,EACjD,OAAO,IAAI,MAAM,QAAQ;AAAA,IACxB,KAAK,CAAC,QAAQ,QAAS,QAAQ,SAAS,OAAO,QAAQ,IAAI,QAAQ,GAAG;AAAA,IACtE,KAAK,CAAC,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChE,CAAC;AAAA;AAIF,SAAS,MAAM,CAAC,KAAkD;AAAA,EACjE,MAAM,OAAQ,IAAoC;AAAA,EAClD,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,UACT,yFACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;AC1HD,SAAS,WAAc,CAC7B,KACA,MACA,UACA,UAA8B,CAAC,GAC3B;AAAA,EACJ,IAAI,IAAI,QAAQ,OACf,cACA,KAAK,OAAO,UAAU,SAAS,OAAO,SAAS,OAAO,CACvD;AAAA,EACA,IAAI,OAAO,SAAS,gBAAgB,UAAU;AAAA,IAC7C,WAAW,KAAK,SAAS,aAAa,QAAQ,MAAM;AAAA,EACrD;AAAA,EACA,OAAO,SAAS;AAAA;AAOjB,eAAsB,OAAO,CAC5B,KACA,MACmB;AAAA,EACnB,MAAM,UAAU,MAAM,KAAK,QAAQ,IAAI,OAAO;AAAA,EAC9C,IAAI,IAAI,QAAQ,OAAO,cAAc,KAAK,OAAO,MAAM,CAAC;AAAA,EACxD,OAAO;AAAA;;AC9CR;AAAA,WAEC;AAAA;AAAA;;;ACSD,IAAM,UAAU,IAAI;AAKb,SAAS,gBAAgB,CAC/B,MACA,SACA,MACiB;AAAA,EACjB,IAAI,YAAY,QAAQ,IAAI,IAAI;AAAA,EAChC,IAAI,cAAc,WAAW;AAAA,IAC5B,YAAY,IAAI;AAAA,IAChB,QAAQ,IAAI,MAAM,SAAS;AAAA,EAC5B;AAAA,EACA,IAAI,SAAS,UAAU,IAAI,OAAO;AAAA,EAClC,IAAI,WAAW,WAAW;AAAA,IACzB,SAAS,IAAI;AAAA,IACb,UAAU,IAAI,SAAS,MAAM;AAAA,EAC9B;AAAA,EACA,MAAM,MAAM,QAAQ;AAAA,EACpB,IAAI,QAAQ,OAAO,IAAI,GAAG;AAAA,EAC1B,IAAI,UAAU,WAAW;AAAA,IACxB,QAAQ,KAAK,aACZ,SACA,SAAS,YAAY,YAAY,EAAE,KAAK,CACzC;AAAA,IACA,OAAO,IAAI,KAAK,KAAK;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,MAAM,MAAM,MAAM;AAAA,MACjB,IAAI,OAAO,IAAI,GAAG,MAAM;AAAA,QAAO,OAAO,OAAO,GAAG;AAAA,KAChD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ADsDD,SAAS,OAAO,CACtB,MACA,UAAkC,CAAC,GACzB;AAAA,EACV,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,kBAAuC,EAAE,OAAO,kBAAkB;AAAA,EACxE,OAAO,OAAM,EACX,OAAO,OAAO,QAAQ;AAAA,IACtB,QAAQ,SAAS,UAAU;AAAA,IAC3B,MAAM,QAAQ,MAAM,iBAAiB,MAAM,SAAS,QAAQ,IAAI;AAAA,IAChE,QAAQ,IAAI,SAAS,KAAK;AAAA,IAC1B,IAAI,UAAU,QAAQ,QAAQ,aAAa,MAAM;AAAA,MAChD,OAAO,MAAM,KAAK,eAAe;AAAA,IAClC;AAAA,IACA,MAAM,QAAqB;AAAA,MAC1B,QAAQ,SAAS,KAAK,QAAQ,MAAM;AAAA,MACpC,MAAM,CAAC,aAAa,YAAY,KAAK,MAAM,UAAU,OAAO;AAAA,MAC5D,SAAS,MAAM,QAAQ,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,OAAO;AAAA,MACN,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,MAAM;AAAA,IACP;AAAA,GACA,EACA,KAAK,SAAS,WAAW,SAAS;AAAA,IAClC,MAAM,WAAW,MAAM,KAAK;AAAA,IAC5B,MAAM,QAAQ,QAAQ,IAAI,OAAO;AAAA,IACjC,IAAI,OAAO,YAAY;AAAA,MAAM,OAAO;AAAA,IAGpC,MAAM,OAAO,GAAG,KAAK,OAAO;AAAA,IAC5B,MAAM,YAAY,IAAI,IAAI,UACzB,QAAQ,QAAQ,IAAI,QAAQ,KAAK,EAClC,EAAE,IAAI,KAAK,OAAO,IAAI;AAAA,IACtB,IACC,cAAc,MAAM,SACpB,SAAS,QAAQ,aAAa,EAAE,KAAK,CAAC,UAAU,MAAM,WAAW,IAAI,CAAC,GACrE;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IACA,OAAO,YAAY,UAAU,CAAC,YAC7B,QAAQ,OACP,cACA,KAAK,OAAO,UAAU,MAAM,OAAO,MAAM,OAAO,CACjD,CACD;AAAA,GACA;AAAA;",
-  "debugId": "229D182CFDBE7A6B64756E2164756E21",
+  "mappings": ";AAGO,IAAM,gBAAgB;AAE7B,IAAM,UAAU,MAAM,KAAK,KAAK;AAazB,SAAS,QAAQ,CACvB,KACA,UAA6C,CAAC,GAC9B;AAAA,EAChB,MAAM,UAAU,IAAI,IAAI,UAAU,IAAI,QAAQ,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAAA,EACzE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,aAAa;AAAA,EACvD,OAAO,UAAU,QAAQ,UAAU,KAAK,OAAO;AAAA;AAIzC,SAAS,UAAU,CACzB,KACA,OACA,UAA+B,CAAC,GACzB;AAAA,EACP,IAAI,IAAI,QAAQ,IAAI,QAAQ,QAAQ,eAAe,OAAO;AAAA,IACzD,UAAU;AAAA,IACV,MAAM,QAAQ,QAAQ;AAAA,IACtB,UAAU,QAAQ,YAAY;AAAA,IAC9B,QAAQ,QAAQ,UAAU;AAAA,IAC1B,QAAQ,QAAQ,UAAU;AAAA,OACtB,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,EAClE,CAAC;AAAA;;ACxCF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA;AAAA;AAAA;AAAA;AAoBO,SAAS,MAAM,CAAC,OAAmC;AAAA,EACzD,QAAQ,MAAM;AAAA,SACR;AAAA,MACJ,OAAO,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,UAAU,CAAC,EAAE;AAAA,SAClD;AAAA,MACJ,OAAO,MAAM,cAAc,YACxB,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,UAAU;AAAA,SAC9C;AAAA,MACJ,OAAO,MAAM,iBAAiB,YAC3B,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,cAAc,MAAM,aAAa;AAAA,SACpD;AAAA,MACJ,OAAO,MAAM,eAAe,YACzB,EAAE,MAAM,MAAM,KAAK,IACnB,EAAE,MAAM,MAAM,MAAM,YAAY,MAAM,WAAW;AAAA;AAAA,MAEpD,OAAO,EAAE,MAAM,MAAM,KAAK;AAAA;AAAA;AA8CtB,SAAS,WAAW,CAAC,UAA8B,CAAC,GAAgB;AAAA,EAC1E,OAAO,iBAAiB,eAAe,WAAW,CAAC,KAAK,MAAM;AAAA,IAC7D,IAAI;AAAA,MACH,OAAO,MAAM,KAAK;AAAA,MACjB,OAAO,OAAO;AAAA,MACf,IAAI,EAAE,iBAAiB;AAAA,QAAa,MAAM;AAAA,MAC1C,OAAO,OAAO,OAAO,KAAK,OAAO;AAAA;AAAA,GAElC;AAAA;AAIF,SAAS,MAAM,CACd,OACA,KACA,SAC8D;AAAA,EAC9D,MAAM,SAA2B,SAAS,MAAM,IAAI;AAAA,EACpD,IAAI,UAAU,OAAO,QAAQ,WAAW,WAAW;AAAA,IAClD,QAAQ,QAAQ,EACd,KAAK,MAAM,QAAQ,SAAS,OAAO,GAAG,CAAC,EACvC,MAAM,CAAC,YACP,QAAQ,YAAY,iCAAiC,OAAO,OAAO,GAAG,CACvE;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,KAAK;AAAA,EACzB,MAAM,OACL,MAAM,eAAe,YAClB,CAAC,IACD,EAAE,SAAS,EAAE,eAAe,OAAO,MAAM,UAAU,EAAE,EAAE;AAAA,EAC3D,IAAI,YAAY,GAAG,MAAM,WAAW;AAAA,IACnC,OAAO,QAAQ,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC,GAAG,IAAI;AAAA,EACzD;AAAA,EACA,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI;AAAA;AAKpC,YAAY,WAAW;;ACrIvB;AAAA,sBAEC;AAAA,iBACA;AAAA;;;ACED;AAAA,iBAEC;AAAA,aAEA;AAAA,eACA;AAAA;AAKM,SAAS,OAA6C,CAC5D,KACA,QACA,MACA,QACwC;AAAA,EACxC,IAAI,aAAY,GAAG,MAAM,WAAW;AAAA,IACnC,OAAO,SAAQ,WAAU,KAAK,EAAE,QAAQ,OAAO,CAAC,CAAC;AAAA,EAClD;AAAA,EACA,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA;;;AD+BvB,SAAS,UAQf,CACA,QACA,YACA,MACA,SACG,SACF;AAAA,EAED,MAAM,SAAS;AAAA,EACf,QAAQ,SAAS,KAAK,UAAW,QAAQ,MAAM,CAAC;AAAA,EAMhD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,SAAS,CACd,KACA,QACA,OACA,WACI,QAAQ,KAAK,QAAQ,EAAE,MAAM,GAA4B,MAAM;AAAA,EACpE,OAAO,kBAKL,EAAE,eAAe,eAAe,CAAC,KAAK,MAAM;AAAA,IAC7C,MAAM,MAAM,YAAY,YAAY,OAAO,GAAG,IAAI,MAAM,QAAQ,GAAG;AAAA,IACnE,IAAI,QAAQ,MAAM;AAAA,MACjB,OAAO,OAAO,KAAK,KAAK,mBAAmB,4BAA4B;AAAA,IACxE;AAAA,IACA,MAAM,SAAS,MAAM,OAAO,GAAG;AAAA,IAC/B,IAAI,WAAW,MAAM;AAAA,MACpB,OAAO,OAAO,KAAK,KAAK,aAAa,MAAM,oBAAoB;AAAA,IAChE;AAAA,IACA,MAAM,UAAU,MAAM,IACrB,KACA,YACA,KAAK,QAAQ,IAAI,GACjB,UAAU,YAAY,YAAY,EAAE,KAAK,MAAM,MAAM,KAAK,MAAM,EAAE,CACnE;AAAA,IACA,IAAI,CAAC,SAAS;AAAA,MACb,OAAO,OACN,KACA,KACA,aACA,OAAO,iCAAiC,qBACzC;AAAA,IACD;AAAA,IACA,OAAO,KAAK,EAAE,OAAO,CAAC;AAAA,GACtB;AAAA;AAqBK,SAAS,OAAU,CACzB,MACA,MAC4C;AAAA,EAC5C,OAAO,CAAC,QAAQ;AAAA,IACf,MAAM,KAAK,IAAI,WAAW;AAAA,IAC1B,OAAO,OAAO,YAAY,OAAO,KAAK,EAAE;AAAA;AAAA;AAK1C,SAAS,IAAI,CACZ,QACA,MACiD;AAAA,EACjD,OAAO,IAAI,MAAM,QAAQ;AAAA,IACxB,KAAK,CAAC,QAAQ,QAAS,QAAQ,SAAS,OAAO,QAAQ,IAAI,QAAQ,GAAG;AAAA,IACtE,KAAK,CAAC,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChE,CAAC;AAAA;AAIF,SAAS,MAAM,CAAC,KAAkD;AAAA,EACjE,MAAM,OAAQ,IAAoC;AAAA,EAClD,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,UACT,yFACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAGR,aAAY,UAAU;;AEnJf,SAAS,WAAc,CAC7B,KACA,MACA,UACA,UAA8B,CAAC,GAC3B;AAAA,EACJ,IAAI,IAAI,QAAQ,OACf,cACA,KAAK,OAAO,UAAU,SAAS,OAAO,SAAS,OAAO,CACvD;AAAA,EACA,IAAI,OAAO,SAAS,gBAAgB,UAAU;AAAA,IAC7C,WAAW,KAAK,SAAS,aAAa,QAAQ,MAAM;AAAA,EACrD;AAAA,EACA,OAAO,SAAS;AAAA;AAOjB,eAAsB,OAAO,CAC5B,KACA,MACmB;AAAA,EACnB,MAAM,UAAU,MAAM,KAAK,QAAQ,IAAI,OAAO;AAAA,EAC9C,IAAI,IAAI,QAAQ,OAAO,cAAc,KAAK,OAAO,MAAM,CAAC;AAAA,EACxD,OAAO;AAAA;;AC9CR;AAAA,sBACC;AAAA,iBAGA;AAAA;AAAA;AAAA;;;ACOD,IAAM,UAAU,IAAI;AAKb,SAAS,gBAAgB,CAC/B,MACA,SACA,MACiB;AAAA,EACjB,IAAI,YAAY,QAAQ,IAAI,IAAI;AAAA,EAChC,IAAI,cAAc,WAAW;AAAA,IAC5B,YAAY,IAAI;AAAA,IAChB,QAAQ,IAAI,MAAM,SAAS;AAAA,EAC5B;AAAA,EACA,IAAI,SAAS,UAAU,IAAI,OAAO;AAAA,EAClC,IAAI,WAAW,WAAW;AAAA,IACzB,SAAS,IAAI;AAAA,IACb,UAAU,IAAI,SAAS,MAAM;AAAA,EAC9B;AAAA,EACA,MAAM,MAAM,QAAQ;AAAA,EACpB,IAAI,QAAQ,OAAO,IAAI,GAAG;AAAA,EAC1B,IAAI,UAAU,WAAW;AAAA,IACxB,QAAQ,KAAK,aACZ,SACA,SAAS,YAAY,YAAY,EAAE,KAAK,CACzC;AAAA,IACA,OAAO,IAAI,KAAK,KAAK;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,MAAM,MAAM,MAAM;AAAA,MACjB,IAAI,OAAO,IAAI,GAAG,MAAM;AAAA,QAAO,OAAO,OAAO,GAAG;AAAA,KAChD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;AD0DD,SAAS,OAAO,CACtB,MACA,UAAkC,CAAC,GACzB;AAAA,EACV,MAAM,kBAAuC,EAAE,OAAO,kBAAkB;AAAA,EACxE,OAAO,kBAAiB,eAAe,OAAO,CAAC,KAAK,MAAM;AAAA,IACzD,QAAQ,YAAY;AAAA,IACpB,MAAM,QAAQ,MAAM,iBAAiB,MAAM,SAAS,QAAQ,IAAI;AAAA,IAChE,IAAI,UAAU,QAAQ,QAAQ,aAAa,MAAM;AAAA,MAChD,OAAO,QAAQ,KAAK,KAAK,iBAAiB,4BAA4B;AAAA,IACvE;AAAA,IACA,MAAM,QAAqB;AAAA,MAC1B,QAAQ,SAAS,KAAK,QAAQ,MAAM;AAAA,MACpC,MAAM,CAAC,aAAa,YAAY,KAAK,MAAM,UAAU,OAAO;AAAA,MAC5D,SAAS,MAAM,QAAQ,KAAK,IAAI;AAAA,IACjC;AAAA,IAEA,MAAM,WAAW,MAAM,OACtB,KACA,KAAK;AAAA,MACJ,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,MAAM;AAAA,IACP,CAAC,CACF;AAAA,IACA,OAAO,OAAO,YAAY,OACvB,QAAQ,MAAM,SAAS,OAAO,QAAQ,IACtC;AAAA,GACH;AAAA;AASF,SAAS,OAA2B,CACnC,MACA,SACA,OACA,UACI;AAAA,EACJ,MAAM,OAAO,GAAG,KAAK,OAAO;AAAA,EAC5B,MAAM,YAAY,IAAI,IAAI,UAAU,QAAQ,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,IACxE,KAAK,OAAO,IACb;AAAA,EACA,IACC,cAAc,MAAM,SACpB,SAAS,QAAQ,aAAa,EAAE,KAAK,CAAC,UAAU,MAAM,WAAW,IAAI,CAAC,GACrE;AAAA,IACD,OAAO;AAAA,EACR;AAAA,EACA,OAAO,YAAY,UAAU,CAAC,YAC7B,QAAQ,OACP,cACA,KAAK,OAAO,UAAU,MAAM,OAAO,MAAM,OAAO,CACjD,CACD;AAAA;AAGD,aAAY,OAAO;",
+  "debugId": "E839E5A61B58A76164756E2164756E21",
   "names": []
 }

package/dist/permission.d.ts

@@ -1,12 +1,14 @@
-import { type BaseContext, type RequiresOf } from '@alxia/core';
+import { type BaseContext, type Problem, type RequiresOf } from '@alxia/core';
 import type { CheckableOf, ModelConfig, ObjectTypeOf, Permissions } from '@nxgt/janus/permissions';
 import type { Awaitable, ObjectData, OptionsArgs } from './permission-options';
 /** The body of each refusal. */
 export interface PermissionRefusedBody {
     readonly error: 'unauthenticated' | 'not_found' | 'forbidden';
 }
+/** A refusal under `alxia({ errors: 'problem' })`: its 401, 404 or 403 as a problem. */
+export type PermissionRefusedProblem = Problem<401 | 403 | 404>;
 /**
- * A guard, as a plugin: the routes declared after it run only if the
+ * A guard, as a middleware: the routes declared after it run only if the
  * subject holds `permission` on an object of `type`. It loads the object
  * once, checks it with `access.can`, and hands it to them as `object`.
  *
@@ -19,17 +21,18 @@ export interface PermissionRefusedBody {
  *
  * Each refusal is typed on those routes. **A failure throws**: a store that
  * cannot answer is `STORE_FAILED`, never a 403 — `janusErrors()` answers
- * it 503. Scope it with `group`, so it guards only its routes:
+ * it 503. Scope it with `group`, so it guards only its routes — given to
+ * the app's `use`, it would refuse a request no route matches too:
  *
  * ```ts
- * app.use(session(accounts)).group('/records/:id', (records) =>
+ * app.use(janusErrors(), session(accounts)).group('/records/:id', (records) =>
  *   records.use(permission(access, 'view', 'record', byParam('id', findRecord)))
  *     .get('/', ({ object, reply }) => reply(200, object)));
  * ```
  */
-export declare function permission<C extends ModelConfig, const T extends ObjectTypeOf<C>, const P extends CheckableOf<C, T>, O extends ObjectData<C, T>, LoadCtx extends object = BaseContext, SubjectCtx extends object = BaseContext, CheckCtx extends object = BaseContext>(access: Pick<Permissions<C>, 'can'>, permission: P, type: T, load: (ctx: BaseContext & LoadCtx) => Awaitable<O | null>, ...options: OptionsArgs<C, T, P, O, SubjectCtx, CheckCtx>): import("@alxia/core").Alxia<RequiresOf<LoadCtx & SubjectCtx & CheckCtx, AnnotatedAny<LoadCtx, SubjectCtx>> & {
+export declare function permission<C extends ModelConfig, const T extends ObjectTypeOf<C>, const P extends CheckableOf<C, T>, O extends ObjectData<C, T>, LoadCtx extends object = BaseContext, SubjectCtx extends object = BaseContext, CheckCtx extends object = BaseContext>(access: Pick<Permissions<C>, 'can'>, permission: P, type: T, load: (ctx: BaseContext & LoadCtx) => Awaitable<O | null>, ...options: OptionsArgs<C, T, P, O, SubjectCtx, CheckCtx>): import("@alxia/core").Middleware<RequiresOf<LoadCtx & SubjectCtx & CheckCtx, AnnotatedAny<LoadCtx, SubjectCtx>>, Promise<import("@alxia/core").Reply<401, PermissionRefusedBody | Problem<401>> | import("@alxia/core").Reply<404, PermissionRefusedBody | Problem<404>> | import("@alxia/core").Reply<403, PermissionRefusedBody | Problem<403>> | import("@alxia/core").Next<{
     object: O;
-}, import("@alxia/core").Empty, "", import("@alxia/core").Reply<401, PermissionRefusedBody> | import("@alxia/core").Reply<404, PermissionRefusedBody> | import("@alxia/core").Reply<403, PermissionRefusedBody>> & import("@alxia/core").Requiring<RequiresOf<LoadCtx & SubjectCtx & CheckCtx, AnnotatedAny<LoadCtx, SubjectCtx>>>;
+}, import("@alxia/core").Empty>>>;
 /**
  * The callback to name when `RequiresOf` refuses one annotated `any`: `load`
  * or `subject` when it is that one, `ctx` otherwise. An `any` in any of the

package/dist/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAgB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,WAAW,EAEX,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE/E,gCAAgC;AAChC,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,WAAW,GAAG,WAAW,CAAC;CAC9D;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CACzB,CAAC,SAAS,WAAW,EACrB,KAAK,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EAC/B,KAAK,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACjC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,SAAS,MAAM,GAAG,WAAW,EACpC,UAAU,SAAS,MAAM,GAAG,WAAW,EACvC,QAAQ,SAAS,MAAM,GAAG,WAAW,EAErC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EACnC,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,EACzD,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;;mUAoCzD;AAED;;;;;GAKG;AACH,KAAK,YAAY,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS;IAC1D;QAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;KAAE;CACtB,GACE,MAAM,GACN,CAAC,UAAU,CAAC,SAAS,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,GAC5C,SAAS,GACT,KAAK,CAAC;AAEV;;;GAGG;AACH,wBAAgB,OAAO,CAAC,CAAC,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,GACvC,CAAC,GAAG,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAK3C"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,WAAW,EAGhB,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,WAAW,EAEX,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAG/E,gCAAgC;AAChC,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,WAAW,GAAG,WAAW,CAAC;CAC9D;AAED,wFAAwF;AACxF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,UAAU,CACzB,CAAC,SAAS,WAAW,EACrB,KAAK,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EAC/B,KAAK,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EACjC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,SAAS,MAAM,GAAG,WAAW,EACpC,UAAU,SAAS,MAAM,GAAG,WAAW,EACvC,QAAQ,SAAS,MAAM,GAAG,WAAW,EAErC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EACnC,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,EACzD,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;;kCA+CzD;AAED;;;;;GAKG;AACH,KAAK,YAAY,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS;IAC1D;QAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;KAAE;CACtB,GACE,MAAM,GACN,CAAC,UAAU,CAAC,SAAS,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,GAC5C,SAAS,GACT,KAAK,CAAC;AAEV;;;GAGG;AACH,wBAAgB,OAAO,CAAC,CAAC,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,GACvC,CAAC,GAAG,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,CAK3C"}

package/dist/refused.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A refusal of `session()` or `permission()`, in the format of the app
+ * that serves the request: its `{ error }` body by default, an RFC 9457
+ * problem under `alxia({ errors: 'problem' })`.
+ */
+import { type BaseContext, type Problem, type Reply } from '@alxia/core';
+/** `body` with `status`, or the problem of `status` saying `detail`. */
+export declare function refused<Status extends 401 | 403 | 404, Body>(ctx: BaseContext, status: Status, body: Body, detail: string): Reply<Status, Body | Problem<Status>>;
+//# sourceMappingURL=refused.d.ts.map

package/dist/refused.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refused.d.ts","sourceRoot":"","sources":["../src/refused.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACN,KAAK,WAAW,EAEhB,KAAK,OAAO,EAGZ,KAAK,KAAK,EACV,MAAM,aAAa,CAAC;AAErB,wEAAwE;AACxE,wBAAgB,OAAO,CAAC,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI,EAC3D,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,GACZ,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAKvC"}