@executor-js/sdk 0.0.2 → 0.2.0

package/dist/oauth-helpers.d.ts

@@ -25,6 +25,11 @@ export type OAuth2TokenResponse = {
 export declare const OAUTH2_REFRESH_SKEW_MS = 60000;
 /** Default token-endpoint timeout. */
 export declare const OAUTH2_DEFAULT_TIMEOUT_MS = 20000;
+export interface OAuthEndpointUrlPolicy {
+    readonly allowHttp?: boolean;
+}
+export declare const isSupportedOAuthEndpointUrl: (value: string, policy?: OAuthEndpointUrlPolicy) => boolean;
+export declare const assertSupportedOAuthEndpointUrl: (value: string, label?: string, policy?: OAuthEndpointUrlPolicy) => string;
 export declare const createPkceCodeVerifier: () => string;
 export declare const createPkceCodeChallenge: (verifier: string) => Promise<string>;
 export type BuildAuthorizationUrlInput = {
@@ -37,8 +42,13 @@ export type BuildAuthorizationUrlInput = {
     readonly codeChallenge: string;
     /** Separator between scopes. RFC 6749 says space; some providers use comma. */
     readonly scopeSeparator?: string;
+    /** RFC 8707 Resource Indicator. MCP Authorization 2025-06-18 §"Resource
+     *  Parameter Implementation" requires clients to send this on every
+     *  authorization request, regardless of AS support. */
+    readonly resource?: string;
     /** Provider-specific extras (e.g. Google's `access_type=offline`). */
     readonly extraParams?: Readonly<Record<string, string>>;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 /** Build an RFC 6749 §4.1.1 authorization URL. Sync; pre-computed
  *  challenge lets this stay out of the Promise world. */
@@ -54,7 +64,12 @@ export type ExchangeAuthorizationCodeInput = {
     readonly code: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly idTokenSigningAlgValuesSupported?: readonly string[];
+    /** RFC 8707 Resource Indicator. MCP Auth spec MUST-requires this on
+     *  the token request when the client knows the resource it intends
+     *  to call. */
+    readonly resource?: string;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const exchangeAuthorizationCode: (input: ExchangeAuthorizationCodeInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export type ExchangeClientCredentialsInput = {
@@ -65,6 +80,7 @@ export type ExchangeClientCredentialsInput = {
     readonly scopeSeparator?: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const exchangeClientCredentials: (input: ExchangeClientCredentialsInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export type RefreshAccessTokenInput = {
@@ -77,7 +93,12 @@ export type RefreshAccessTokenInput = {
     readonly scopeSeparator?: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly idTokenSigningAlgValuesSupported?: readonly string[];
+    /** RFC 8707 Resource Indicator — MCP spec MUST-requires this on
+     *  refresh requests so the new access token's audience is bound to
+     *  the same resource. */
+    readonly resource?: string;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const refreshAccessToken: (input: RefreshAccessTokenInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export declare const shouldRefreshToken: (input: {

package/dist/oauth-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-helpers.d.ts","sourceRoot":"","sources":["../src/oauth-helpers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;AAOtC,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAML,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAMF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAMhD,eAAO,MAAM,sBAAsB,QAAO,MACN,CAAC;AAErC,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAC7B,CAAC;AAM7C,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF;yDACyD;AACzD,eAAO,MAAM,qBAAqB,GAAI,OAAO,0BAA0B,KAAG,MAgBzE,CAAC;AAwCF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AA2IhD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAiC7C,CAAC;AAML,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CA4B7C,CAAC;AAML,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CA0C7C,CAAC;AAML,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,OAKH,CAAC"}
+{"version":3,"file":"oauth-helpers.d.ts","sourceRoot":"","sources":["../src/oauth-helpers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAa,MAAM,QAAQ,CAAC;;;;AAOjD,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAML,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAMF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAgBD,eAAO,MAAM,2BAA2B,GACtC,OAAO,MAAM,EACb,SAAQ,sBAA2B,KAClC,OAQF,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAC1C,OAAO,MAAM,EACb,cAA4B,EAC5B,SAAQ,sBAA2B,KAClC,MAIF,CAAC;AAMF,eAAO,MAAM,sBAAsB,QAAO,MAA4C,CAAC;AAEvF,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAC7B,CAAC;AAM7C,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF;yDACyD;AACzD,eAAO,MAAM,qBAAqB,GAAI,OAAO,0BAA0B,KAAG,MA2BzE,CAAC;AA6GF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AA0GhD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D;;mBAEe;IACf,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAiCC,CAAC;AAMnD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAqBC,CAAC;AAMnD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D;;6BAEyB;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAoCC,CAAC;AAMnD,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,OAKH,CAAC"}

package/dist/oauth-popup-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-popup-types.d.ts","sourceRoot":"","sources":["../src/oauth-popup-types.ts"],"names":[],"mappings":"AAQA,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,MAAM,MAAM,gBAAgB,CAAC,KAAK,IAC9B,CAAC;IACC,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,KAAK,CAAC,GACV;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,eAAO,MAAM,kBAAkB,GAAI,KAAK,EACtC,OAAO,OAAO,KACb,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAG+B,CAAC"}
+{"version":3,"file":"oauth-popup-types.d.ts","sourceRoot":"","sources":["../src/oauth-popup-types.ts"],"names":[],"mappings":"AAQA,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,MAAM,MAAM,gBAAgB,CAAC,KAAK,IAC9B,CAAC;IACC,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,KAAK,CAAC,GACV;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,eAAO,MAAM,kBAAkB,GAAI,KAAK,EAAE,OAAO,OAAO,KAAG,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAGzB,CAAC"}

package/dist/oauth-service.d.ts

@@ -1,21 +1,29 @@
-import { Effect } from "effect";
-import type { DBAdapter, StorageFailure, TypedAdapter } from "@executor-js/storage-core";
+import { Effect, Layer } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import type { StorageFailure, TypedAdapter } from "@executor-js/storage-core";
 import { CreateConnectionInput, type ConnectionProvider, type ConnectionRef } from "./connections";
 import type { ConnectionProviderNotRegisteredError } from "./errors";
 import type { CoreSchema } from "./core-schema";
 import { SetSecretInput, type SecretRef } from "./secrets";
 import { type OAuthService } from "./oauth";
+import { type OAuthEndpointUrlPolicy } from "./oauth-helpers";
+import type { ScopedDBAdapter } from "./scoped-adapter";
 export interface OAuthServiceDeps {
     /** Typed core-schema adapter. Already scope-wrapped upstream so reads
      *  fall through the scope stack; writes stamp the scope the caller
      *  named (`tokenScope` on start input). */
     readonly adapter: TypedAdapter<CoreSchema>;
-    /** Raw adapter for opening transactions — the typed one doesn't expose
-     *  `.transaction` directly. */
-    readonly rawAdapter: DBAdapter;
+    /** Scoped adapter for opening transactions — the typed one doesn't
+     *  expose `.transaction` directly. */
+    readonly rawAdapter: ScopedDBAdapter;
     /** Resolves client-id / client-secret refs at start + refresh time.
      *  A `null` return means "secret row is gone" and aborts the flow. */
     readonly secretsGet: (id: string) => Effect.Effect<string | null, StorageFailure>;
+    readonly secretsGetResolved?: (id: string) => Effect.Effect<{
+        readonly value: string;
+        readonly scopeId: string | null;
+    } | null, StorageFailure>;
+    readonly secretsGetAtScope?: (id: string, scope: string) => Effect.Effect<string | null, StorageFailure>;
     readonly secretsSet: (input: SetSecretInput) => Effect.Effect<SecretRef, StorageFailure>;
     /** Mints the Connection row + backing secret rows. Called from
      *  `complete` (and from `start` for `client-credentials`). */
@@ -25,6 +33,9 @@ export interface OAuthServiceDeps {
     readonly newSessionId?: () => string;
     /** `Date.now()` substitute — tests override to drive TTL behavior. */
     readonly now?: () => number;
+    /** Outbound HTTP client used for OAuth metadata/DCR probes. */
+    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 }
 export declare const makeOAuth2Service: (deps: OAuthServiceDeps) => {
     readonly service: OAuthService;

package/dist/oauth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../src/oauth-service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACV,SAAS,EACT,cAAc,EACd,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEL,qBAAqB,EAErB,KAAK,kBAAkB,EAGvB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,oCAAoC,EACrC,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAgBL,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAC;AAmMjB,MAAM,WAAW,gBAAgB;IAC/B;;+CAE2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3C;mCAC+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;0EACsE;IACtE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzF;kEAC8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,oCAAoC,GAAG,cAAc,CACtD,CAAC;IACF;yBACqB;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAyCD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,gBAAgB,KACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;CAq7BnF,CAAC"}
+{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../src/oauth-service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAyB,MAAM,QAAQ,CAAC;AACxE,OAAO,EAAmB,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAEtF,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAEL,qBAAqB,EAErB,KAAK,kBAAkB,EAGvB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAgBL,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAC;AAMjB,OAAO,EAOL,KAAK,sBAAsB,EAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgFxD,MAAM,WAAW,gBAAgB;IAC/B;;+CAE2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3C;0CACsC;IACtC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC;0EACsE;IACtE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC5B,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAChB;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,EAClE,cAAc,CACf,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzF;kEAC8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACzF;yBACqB;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD;AAqCD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,gBAAgB,KACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;CAs8BnF,CAAC"}

package/dist/oauth.d.ts

@@ -115,25 +115,34 @@ export declare const OAuthProviderState: Schema.Union<readonly [Schema.Struct<{
      *  issued one) is a separate secret row. */
     readonly clientId: Schema.String;
     readonly clientSecretSecretId: Schema.NullOr<Schema.String>;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
     readonly scopes: Schema.withDecodingDefaultType<Schema.$Array<Schema.String>>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly scope: Schema.NullOr<Schema.String>;
+    /** RFC 8707 canonical resource URL. Replayed on refresh so the new
+     *  access token's audience stays bound to the same resource. */
+    readonly resource: Schema.optional<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"authorization-code">;
     readonly tokenEndpoint: Schema.String;
     readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientIdSecretId: Schema.String;
+    readonly clientIdSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientSecretSecretId: Schema.NullOr<Schema.String>;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
     readonly scopes: Schema.withDecodingDefaultType<Schema.$Array<Schema.String>>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly scope: Schema.NullOr<Schema.String>;
+    readonly resource: Schema.optional<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"client-credentials">;
     readonly tokenEndpoint: Schema.String;
     readonly clientIdSecretId: Schema.String;
+    readonly clientIdSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientSecretSecretId: Schema.String;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly scopes: Schema.$Array<Schema.String>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
@@ -142,9 +151,7 @@ export declare const OAuthProviderState: Schema.Union<readonly [Schema.Struct<{
 export type OAuthProviderState = typeof OAuthProviderState.Type;
 /** The canonical refresh handler key. Every OAuth2-minted connection
  *  registers under this single value; the handler switches on
- *  `providerState.kind`. Historical per-plugin keys (`mcp:oauth2`,
- *  `openapi:oauth2`, `google-discovery:google`) are aliased to this
- *  during migration. */
+ *  `providerState.kind`. */
 export declare const OAUTH2_PROVIDER_KEY: "oauth2";
 export interface OAuthProbeInput {
     readonly endpoint: string;
@@ -216,6 +223,9 @@ export interface OAuthStartResult {
 export interface OAuthCompleteInput {
     /** RFC 6749 `state` parameter — maps to a session row id. */
     readonly state: string;
+    /** Optional scope check for route-scoped completions. Browser callback
+     *  completions omit this because the callback URL has no scope path. */
+    readonly tokenScope?: string;
     readonly code?: string;
     /** RFC 6749 `error` parameter — set when the AS redirected back with
      *  a failure. The service surfaces this as a tagged error. */
@@ -230,17 +240,16 @@ declare const OAuthProbeError_base: Schema.Class<OAuthProbeError, Schema.TaggedS
     readonly message: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthProbeError extends OAuthProbeError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthStartError_base: Schema.Class<OAuthStartError, Schema.TaggedStruct<"OAuthStartError", {
     readonly message: Schema.String;
+    /** RFC 6749 §5.2 / RFC 7591 §3.2.2 error code propagated up from the
+     *  authorization server (e.g. `invalid_client_metadata`). UI surfaces
+     *  it as the structured "AS rejected the registration" reason. */
+    readonly error: Schema.optional<Schema.String>;
+    readonly errorDescription: Schema.optional<Schema.String>;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthStartError extends OAuthStartError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthCompleteError_base: Schema.Class<OAuthCompleteError, Schema.TaggedStruct<"OAuthCompleteError", {
     readonly message: Schema.String;
@@ -250,17 +259,11 @@ declare const OAuthCompleteError_base: Schema.Class<OAuthCompleteError, Schema.T
     readonly code: Schema.optional<Schema.String>;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthCompleteError extends OAuthCompleteError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthSessionNotFoundError_base: Schema.Class<OAuthSessionNotFoundError, Schema.TaggedStruct<"OAuthSessionNotFoundError", {
     readonly sessionId: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthSessionNotFoundError extends OAuthSessionNotFoundError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 export interface OAuthService {
     readonly probe: (input: OAuthProbeInput) => Effect.Effect<OAuthProbeResult, OAuthProbeError>;
@@ -268,7 +271,7 @@ export interface OAuthService {
     readonly complete: (input: OAuthCompleteInput) => Effect.Effect<OAuthCompleteResult, OAuthCompleteError | OAuthSessionNotFoundError | StorageFailure>;
     /** Drop an in-flight session without completing — used when the
      *  user cancels the popup or the source is deleted mid-onboarding. */
-    readonly cancel: (sessionId: string, tokenScope?: string) => Effect.Effect<void, StorageFailure>;
+    readonly cancel: (sessionId: string, tokenScope: string) => Effect.Effect<void, StorageFailure>;
 }
 export declare const OAUTH2_SESSION_TTL_MS: number;
 export { ConnectionId };

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAWrC;;;yDAGyD;AACzD,eAAO,MAAM,uBAAuB;;IAElC;mDAC+C;;EAE/C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;AAE1E;;;2EAG2E;AAC3E,eAAO,MAAM,8BAA8B;;;;IAIzC;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAI/D;oEACgE;;EAEhE,CAAC;AACH,MAAM,MAAM,8BAA8B,GACxC,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAE7C;;;sCAGsC;AACtC,eAAO,MAAM,8BAA8B;;;;;;;;EAQzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GACxC,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAE7C;;cAEc;AACd,eAAO,MAAM,aAAa;;IA5DxB;mDAC+C;;;;;;IAa/C;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAI/D;oEACgE;;;;;;;;;;IA6BhE,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;+BAE+B;AAC/B,eAAO,MAAM,kBAAkB;;;;;;;IAU3B;;gDAE4C;;;;;;;;;;;;;;;;;;;;;;;;;;IA6B9C,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE;;;;wBAIwB;AACxB,eAAO,MAAM,mBAAmB,EAAG,QAAiB,CAAC;AAMrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;wEACoE;IACpE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;;;8BAK0B;IAC1B,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C;;;;qBAIiB;IACjB,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAMD,MAAM,WAAW,eAAe;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;6CAGyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;oEACgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;0BAEsB;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;gEAE4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;;;;AAWD,qBAAa,eAAgB,SAAQ,oBAKpC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;;AAED,qBAAa,eAAgB,SAAQ,oBAKpC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;IAMG;;iDAE6C;;;AANjD,qBAAa,kBAAmB,SAAQ,uBASvC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAK9C;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;AAOD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,GAAG,cAAc,CAAC,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAChB,mBAAmB,EACnB,kBAAkB,GAAG,yBAAyB,GAAG,cAAc,CAChE,CAAC;IACF;0EACsE;IACtE,QAAQ,CAAC,MAAM,EAAE,CACf,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;CAC1C;AAOD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAIpD,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAWrC;;;yDAGyD;AACzD,eAAO,MAAM,uBAAuB;;IAElC;mDAC+C;;EAE/C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;AAE1E;;;2EAG2E;AAC3E,eAAO,MAAM,8BAA8B;;;;IAIzC;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAE/D;oEACgE;;EAEhE,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAExF;;;sCAGsC;AACtC,eAAO,MAAM,8BAA8B;;;;;;;;EAQzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAExF;;cAEc;AACd,eAAO,MAAM,aAAa;;IAxDxB;mDAC+C;;;;;;IAa/C;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAE/D;oEACgE;;;;;;;;;;IA2BhE,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;+BAE+B;AAC/B,eAAO,MAAM,kBAAkB;;;;;;;IAQ3B;;gDAE4C;;;;;;;;IAQ5C;oEACgE;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BlE,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE;;4BAE4B;AAC5B,eAAO,MAAM,mBAAmB,EAAG,QAAiB,CAAC;AAMrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;wEACoE;IACpE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;;;8BAK0B;IAC1B,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C;;;;qBAIiB;IACjB,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAMD,MAAM,WAAW,eAAe;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;6CAGyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;oEACgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;0BAEsB;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;gEAE4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;4EACwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;;;;AAWD,qBAAa,eAAgB,SAAQ,oBAMpC;CAAG;;;IAMA;;sEAEkE;;;;AANtE,qBAAa,eAAgB,SAAQ,oBAWpC;CAAG;;;IAMA;;iDAE6C;;;AANjD,qBAAa,kBAAmB,SAAQ,uBAUvC;CAAG;;;;AAEJ,qBAAa,yBAA0B,SAAQ,8BAM9C;CAAG;AAOJ,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAC7F,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,GAAG,cAAc,CAAC,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAChB,mBAAmB,EACnB,kBAAkB,GAAG,yBAAyB,GAAG,cAAc,CAChE,CAAC;IACF;0EACsE;IACtE,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;CACjG;AAOD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAIpD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/oxlint-plugin-executor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oxlint-plugin-executor.test.d.ts.map

package/dist/oxlint-plugin-executor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint-plugin-executor.test.d.ts","sourceRoot":"","sources":["../src/oxlint-plugin-executor.test.ts"],"names":[],"mappings":""}

package/dist/plugin.d.ts

@@ -1,14 +1,19 @@
-import type { Effect } from "effect";
-import type { DBAdapter, DBSchema, StorageFailure, TypedAdapter } from "@executor-js/storage-core";
+import type { Context, Effect, Layer } from "effect";
+import type { HttpClient } from "effect/unstable/http";
+import type { HttpApiGroup } from "effect/unstable/httpapi";
+import type { DBSchema, StorageFailure } from "@executor-js/storage-core";
 import type { PluginBlobStore } from "./blob";
-import type { ConnectionProvider, ConnectionRef, ConnectionRefreshError, CreateConnectionInput, UpdateConnectionTokensInput } from "./connections";
+import type { ConnectionProvider, ConnectionRef, ConnectionRefreshError, CreateConnectionInput, RemoveConnectionInput, UpdateConnectionTokensInput } from "./connections";
+import type { CredentialBindingsFacade } from "./credential-bindings";
 import type { DefinitionsInput, SourceInput, ToolAnnotations, ToolRow } from "./core-schema";
-import type { SourceDetectionResult } from "./types";
+import type { RemoveSourceInput, SourceDetectionResult } from "./types";
 import type { ElicitationDeclinedError, ElicitationHandler, ElicitationRequest, ElicitationResponse } from "./elicitation";
-import type { ConnectionNotFoundError, ConnectionProviderNotRegisteredError, ConnectionReauthRequiredError, ConnectionRefreshNotSupportedError, SecretOwnedByConnectionError } from "./errors";
+import type { ConnectionInUseError, ConnectionNotFoundError, ConnectionProviderNotRegisteredError, ConnectionReauthRequiredError, ConnectionRefreshNotSupportedError, SecretInUseError, SecretOwnedByConnectionError } from "./errors";
 import type { OAuthService } from "./oauth";
 import type { Scope } from "./scope";
-import type { SecretProvider, SecretRef, SetSecretInput } from "./secrets";
+import type { ScopedDBAdapter, ScopedTypedAdapter } from "./scoped-adapter";
+import type { RemoveSecretInput, SecretProvider, SecretRef, SetSecretInput } from "./secrets";
+import type { Usage, UsagesForConnectionInput, UsagesForSecretInput } from "./usages";
 export interface StorageDeps<TSchema extends DBSchema | undefined = undefined> {
     /**
      * Precedence-ordered scope stack visible to this executor. Innermost
@@ -25,7 +30,7 @@ export interface StorageDeps<TSchema extends DBSchema | undefined = undefined> {
      * `@executor-js/api` `withCapture`) is the one place that
      * translates it to the opaque `InternalError({ traceId })`.
      */
-    readonly adapter: TSchema extends DBSchema ? TypedAdapter<TSchema, StorageFailure> : DBAdapter;
+    readonly adapter: TSchema extends DBSchema ? ScopedTypedAdapter<TSchema> : ScopedDBAdapter;
     readonly blobs: PluginBlobStore;
 }
 export declare const defineSchema: <const S extends DBSchema>(schema: S) => S;
@@ -39,10 +44,11 @@ export interface PluginCtx<TStore = unknown> {
      */
     readonly scopes: readonly Scope[];
     readonly storage: TStore;
+    readonly httpClientLayer: Layer.Layer<HttpClient.HttpClient>;
     readonly core: {
         readonly sources: {
             readonly register: (input: SourceInput) => Effect.Effect<void, StorageFailure>;
-            readonly unregister: (sourceId: string) => Effect.Effect<void, StorageFailure>;
+            readonly unregister: (input: RemoveSourceInput) => Effect.Effect<void, StorageFailure>;
             readonly update: (input: {
                 readonly id: string;
                 readonly scope: string;
@@ -62,6 +68,7 @@ export interface PluginCtx<TStore = unknown> {
     };
     readonly secrets: {
         readonly get: (id: string) => Effect.Effect<string | null, SecretOwnedByConnectionError | StorageFailure>;
+        readonly getAtScope: (id: string, scope: string) => Effect.Effect<string | null, SecretOwnedByConnectionError | StorageFailure>;
         /** List user-visible secrets. Connection-owned secrets (rows with
          *  `owned_by_connection_id` set) are filtered out so they don't
          *  clutter the UI — users see the Connection instead. */
@@ -80,8 +87,10 @@ export interface PluginCtx<TStore = unknown> {
         /** Delete a secret from its pinned provider and the core table.
          *  Rejects with `SecretOwnedByConnectionError` if the row is owned
          *  by a connection — callers must go through `connections.remove`
-         *  to drop the whole sign-in. */
-        readonly remove: (id: string) => Effect.Effect<void, SecretOwnedByConnectionError | StorageFailure>;
+         *  to drop the whole sign-in. Rejects with `SecretInUseError` if
+         *  any plugin reports the secret as in use; the caller should ask
+         *  the user to detach the listed sources first. */
+        readonly remove: (input: RemoveSecretInput) => Effect.Effect<void, SecretOwnedByConnectionError | SecretInUseError | StorageFailure>;
     };
     /** Connections — product-level sign-in state. Owns backing secret
      *  rows via `secret.owned_by_connection_id`. Plugins call
@@ -90,6 +99,7 @@ export interface PluginCtx<TStore = unknown> {
      *  keyed by `connection.provider`). */
     readonly connections: {
         readonly get: (id: string) => Effect.Effect<ConnectionRef | null, StorageFailure>;
+        readonly getAtScope: (id: string, scope: string) => Effect.Effect<ConnectionRef | null, StorageFailure>;
         readonly list: () => Effect.Effect<readonly ConnectionRef[], StorageFailure>;
         readonly create: (input: CreateConnectionInput) => Effect.Effect<ConnectionRef, ConnectionProviderNotRegisteredError | StorageFailure>;
         readonly updateTokens: (input: UpdateConnectionTokensInput) => Effect.Effect<ConnectionRef, ConnectionNotFoundError | StorageFailure>;
@@ -98,8 +108,13 @@ export interface PluginCtx<TStore = unknown> {
          *  `refresh` handler if `expires_at` is in the past / within the
          *  refresh skew window. */
         readonly accessToken: (id: string) => Effect.Effect<string, ConnectionNotFoundError | ConnectionProviderNotRegisteredError | ConnectionRefreshNotSupportedError | ConnectionReauthRequiredError | ConnectionRefreshError | StorageFailure>;
-        readonly remove: (id: string) => Effect.Effect<void, StorageFailure>;
+        readonly accessTokenAtScope: (id: string, scope: string) => Effect.Effect<string, ConnectionNotFoundError | ConnectionProviderNotRegisteredError | ConnectionRefreshNotSupportedError | ConnectionReauthRequiredError | ConnectionRefreshError | StorageFailure>;
+        /** Refuses with `ConnectionInUseError` if any plugin reports the
+         *  connection as in use. Caller surfaces the `usages` list to the
+         *  user. */
+        readonly remove: (input: RemoveConnectionInput) => Effect.Effect<void, ConnectionInUseError | StorageFailure>;
     };
+    readonly credentialBindings: CredentialBindingsFacade;
     /** Shared OAuth service. Plugins use this to probe/start/complete OAuth
      *  flows; invocation should still resolve tokens via `connections.accessToken`. */
     readonly oauth: OAuthService;
@@ -166,8 +181,16 @@ export interface SourceLifecycleInput<TStore = unknown> {
      */
     readonly scope: string;
 }
-export interface PluginSpec<TId extends string = string, TExtension extends object = Record<string, never>, TStore = unknown, TSchema extends DBSchema | undefined = DBSchema | undefined> {
+export interface PluginSpec<TId extends string = string, TExtension extends object = any, TStore = any, TSchema extends DBSchema | undefined = any, TExtensionService extends Context.Service<any, any> | undefined = any, THandlersLayer extends Layer.Layer<any, any, any> = any, TGroup extends HttpApiGroup.Any = HttpApiGroup.Any> {
     readonly id: TId;
+    /** npm package name. The Vite plugin uses this to derive the
+     *  `./client` import path for the frontend bundle (so the same
+     *  `executor.config.ts` drives both server and client) — `${packageName}/client`
+     *  is what gets bundled. The author writes the same string they
+     *  publish to npm; no transforms, no scope conventions. Required for
+     *  plugins that ship a `./client` entry; can be omitted for SDK-only
+     *  plugins (no client bundle = nothing to resolve). */
+    readonly packageName?: string;
     /** Plugin-declared schema. Merged with coreSchema and other plugins'
      *  schemas at executor startup via `collectSchemas`. The type flows
      *  into the `storage` factory's `deps.adapter` as a `TypedAdapter<TSchema>`
@@ -178,6 +201,19 @@ export interface PluginSpec<TId extends string = string, TExtension extends obje
      *  scoped to the plugin id so key collisions across plugins are
      *  structurally impossible. */
     readonly storage: (deps: StorageDeps<TSchema>) => TStore;
+    /** JSON-serializable config the plugin wants its `./client` bundle to
+     *  see. The Vite plugin reads this off each `executor.config.ts` spec
+     *  at build time and bakes it into the virtual `plugins-client`
+     *  module by calling the plugin's default `./client` export as a
+     *  factory: `__p(<JSON.stringify(clientConfig)>)`. Plugins that don't
+     *  set this stay as bare-value default exports — no churn.
+     *
+     *  Use this when a server-side option (e.g. `dangerouslyAllowStdioMCP`)
+     *  needs to drive client UI behaviour: declaring it once in
+     *  `executor.config.ts` flows through to the bundle automatically,
+     *  with no runtime fetch and no parallel client-side flag to keep in
+     *  sync. */
+    readonly clientConfig?: unknown;
     /** Build the plugin's extension API. The returned object becomes
      *  `executor[plugin.id]` and is also the `self` passed to
      *  `staticSources`. Field order matters: `extension` MUST appear
@@ -190,6 +226,53 @@ export interface PluginSpec<TId extends string = string, TExtension extends obje
      *  that delegates to the plugin's real API is a one-liner:
      *  `({ args }) => self.addSpec(args)`. */
     readonly staticSources?: (self: NoInfer<TExtension>) => readonly StaticSourceDecl<TStore>[];
+    /** HttpApiGroup contributed by this plugin. Composed into the host's
+     *  `HttpApi` via the `addGroup` helper at runtime. The host mounts
+     *  the group at `/_executor/plugins/{id}/...` (or wherever the
+     *  plugin declares its base path) with the host's auth + scope
+     *  middleware applied. Endpoints automatically appear in the
+     *  executor OpenAPI doc and the typed reactive client.
+     *
+     *  TGroup is inferred from the plugin's own group declaration so the
+     *  precise group identity flows through `composePluginApi(plugins)` —
+     *  the host's typed `HttpApi<"executor", CoreGroups | PluginGroups>`
+     *  is derived from the plugin tuple alone, with no per-plugin Group
+     *  imports at the host. Per-endpoint typing already lives inside the
+     *  plugin — its `handlers` Layer is built against its own bundled
+     *  `HttpApi.make("foo").add(FooApi)` for full `.handle("name", ...)`
+     *  inference, and its client imports the same group directly. */
+    readonly routes?: () => TGroup;
+    /** Handlers Layer for this plugin's group. Built by the plugin against
+     *  its own bundled API for full type safety on `.handle("name", ...)`,
+     *  composes into the host's runtime `FullApi` because
+     *  `HttpApiBuilder.group` keys the layer by group identity, not by the
+     *  surrounding API.
+     *
+     *  Late-binding: the layer leaves the plugin's extension as a Service
+     *  Tag requirement (see `extensionService` below). The host satisfies
+     *  it however its runtime wants:
+     *    - local: at boot via `Layer.succeed(extensionService)(executor[id])`
+     *      (see `composePluginHandlers`)
+     *    - cloud: per-request via `Effect.provideService(extensionService,
+     *      requestExecutor[id])` in the auth middleware
+     *
+     *  The Layer's channels are typed `any` because `Layer<RIn, E, ROut>`'s
+     *  `ROut` is contravariant — the host accepts any layer here and merges
+     *  them; per-plugin requirements flow through the merge. */
+    readonly handlers?: () => THandlersLayer;
+    /** Service tag the plugin's `handlers` layer requires. Set by plugins
+     *  whose handlers consume their extension via a `Context.Service` tag
+     *  (the established pattern: `*Handlers` reads `*ExtensionService`).
+     *  The host binds the tag to the live extension — at boot for local,
+     *  per request for cloud. Pairs with `handlers`; either both fields
+     *  are set or neither.
+     *
+     *  Inferred via the `TExtensionService` generic so the per-plugin
+     *  Service class identity propagates through `composePluginHandlers`,
+     *  `composePluginHandlerLayer`, and `providePluginExtensions` —
+     *  cloud's per-request middleware needs the precise tag for layer
+     *  satisfaction. */
+    readonly extensionService?: TExtensionService;
     /** Invoke a dynamic tool. Called when the executor's static-handler
      *  map doesn't have the toolId. The plugin reads its own enrichment
      *  via `ctx.storage` and returns the result. Optional — plugins with
@@ -217,10 +300,28 @@ export interface PluginSpec<TId extends string = string, TExtension extends obje
         readonly sourceId: string;
         readonly toolRows: readonly ToolRow[];
     }) => Effect.Effect<Record<string, ToolAnnotations>, unknown>;
-    /** Called when `executor.sources.remove(id)` targets a source owned
-     *  by this plugin. Plugin-side cleanup only; the executor deletes
-     *  the core source/tool rows after this callback returns, inside
-     *  the same transaction. */
+    /** Find every place a secret id is referenced by this plugin's stored
+     *  rows. Implementations query their normalized columns (e.g.
+     *  `WHERE secret_id = $1`) and return one `Usage` per hit, with
+     *  `ownerKind` / `slot` tagging the location. The executor fans out
+     *  across all plugins and the result powers the Secrets-tab "Used
+     *  by" list and the deletion-blocking check in `secrets.remove`.
+     *
+     *  Plugins that never store secret refs (secret-provider-only
+     *  plugins like keychain / file-secrets / 1password) omit this. */
+    readonly usagesForSecret?: (input: {
+        readonly ctx: PluginCtx<TStore>;
+        readonly args: UsagesForSecretInput;
+    }) => Effect.Effect<readonly Usage[], unknown>;
+    /** Same shape as `usagesForSecret`, but for connection refs. */
+    readonly usagesForConnection?: (input: {
+        readonly ctx: PluginCtx<TStore>;
+        readonly args: UsagesForConnectionInput;
+    }) => Effect.Effect<readonly Usage[], unknown>;
+    /** Called when `executor.sources.remove({ id, targetScope })` targets
+     *  a source owned by this plugin. Plugin-side cleanup only; the
+     *  executor deletes the core source/tool rows after this callback
+     *  returns, inside the same transaction. */
     readonly removeSource?: (input: SourceLifecycleInput<TStore>) => Effect.Effect<void, unknown>;
     readonly refreshSource?: (input: SourceLifecycleInput<TStore>) => Effect.Effect<void, unknown>;
     /** URL autodetection hook. When the user pastes a URL in the
@@ -249,15 +350,15 @@ export interface PluginSpec<TId extends string = string, TExtension extends obje
     readonly connectionProviders?: readonly ConnectionProvider[] | ((ctx: PluginCtx<TStore>) => readonly ConnectionProvider[]) | ((ctx: PluginCtx<TStore>) => Effect.Effect<readonly ConnectionProvider[]>);
     readonly close?: () => Effect.Effect<void, unknown>;
 }
-export interface Plugin<TId extends string = string, TExtension extends object = Record<string, never>, TStore = unknown, TSchema extends DBSchema | undefined = DBSchema | undefined> extends PluginSpec<TId, TExtension, TStore, TSchema> {
+export interface Plugin<TId extends string = string, TExtension extends object = any, TStore = any, TSchema extends DBSchema | undefined = any, TExtensionService extends Context.Service<any, any> | undefined = any, THandlersLayer extends Layer.Layer<any, any, any> = any, TGroup extends HttpApiGroup.Any = HttpApiGroup.Any> extends PluginSpec<TId, TExtension, TStore, TSchema, TExtensionService, THandlersLayer, TGroup> {
 }
-export type ConfiguredPlugin<TId extends string, TExtension extends object, TStore, TOptions extends object, TSchema extends DBSchema | undefined> = (options?: TOptions & {
+export type ConfiguredPlugin<TId extends string, TExtension extends object, TStore, TOptions extends object, TSchema extends DBSchema | undefined, TExtensionService extends Context.Service<any, any> | undefined = undefined, THandlersLayer extends Layer.Layer<any, any, any> = Layer.Layer<unknown, never, never>, TGroup extends HttpApiGroup.Any = HttpApiGroup.Any> = (options?: TOptions & {
     readonly storage?: (deps: StorageDeps<TSchema>) => TStore;
-}) => Plugin<TId, TExtension, TStore, TSchema>;
-export declare function definePlugin<TId extends string, TExtension extends object, TStore, TSchema extends DBSchema | undefined = undefined, TOptions extends object = {}>(authorFactory: (options?: TOptions) => PluginSpec<TId, TExtension, TStore, TSchema>): ConfiguredPlugin<TId, TExtension, TStore, TOptions, TSchema>;
-export type AnyPlugin = Plugin<string, any, any, any>;
+}) => Plugin<TId, TExtension, TStore, TSchema, TExtensionService, THandlersLayer, TGroup>;
+export declare function definePlugin<TId extends string, TExtension extends object, TStore, TSchema extends DBSchema | undefined = undefined, TOptions extends object = {}, TExtensionService extends Context.Service<any, any> | undefined = undefined, THandlersLayer extends Layer.Layer<any, any, any> = Layer.Layer<unknown, never, never>, TGroup extends HttpApiGroup.Any = HttpApiGroup.Any>(authorFactory: (options?: TOptions) => PluginSpec<TId, TExtension, TStore, TSchema, TExtensionService, THandlersLayer, TGroup>): ConfiguredPlugin<TId, TExtension, TStore, TOptions, TSchema, TExtensionService, THandlersLayer, TGroup>;
+export type AnyPlugin = Plugin<string>;
 export type PluginExtensions<TPlugins extends readonly AnyPlugin[]> = {
-    readonly [P in TPlugins[number] as P["id"]]: P extends Plugin<string, infer TExt, any, any> ? TExt : never;
+    readonly [P in TPlugins[number] as P["id"]]: P extends Plugin<string, infer TExt> ? TExt : never;
 };
 /** Lightweight projection of a secret entry as returned by `ctx.secrets.list`. */
 export interface SecretListEntry {

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EACV,SAAS,EACT,QAAQ,EACR,cAAc,EACd,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,OAAO,EACR,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,EAC7B,kCAAkC,EAClC,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAc3E,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,SAAS,QAAQ,GACtC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,GACrC,SAAS,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AASD,eAAO,MAAM,YAAY,GAAI,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,CAAC,KAAG,CAAW,CAAC;AAS/E,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;AAQlE,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,OAAO;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,WAAW,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,QAAQ,CAAC,UAAU,EAAE,CACnB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;gBACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;aAC9B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC3C,CAAC;QACF;;;;;iEAKyD;QACzD,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,gBAAgB,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC1C,CAAC;KACH,CAAC;IAEF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;QACjF;;iEAEyD;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAChC,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,EACpF,cAAc,CACf,CAAC;QACF;;;;;gEAKwD;QACxD,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,cAAc,KAClB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC9C;;;yCAGiC;QACjC,QAAQ,CAAC,MAAM,EAAE,CACf,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;KACzE,CAAC;IAEF;;;;2CAIuC;IACvC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7E,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,oCAAoC,GAAG,cAAc,CACtD,CAAC;QACF,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,uBAAuB,GAAG,cAAc,CACzC,CAAC;QACF,QAAQ,CAAC,gBAAgB,EAAE,CACzB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GAAG,IAAI,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAAC,CAAC;QACnE;;mCAE2B;QAC3B,QAAQ,CAAC,WAAW,EAAE,CACpB,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAChB,MAAM,EACJ,uBAAuB,GACvB,oCAAoC,GACpC,kCAAkC,GAClC,6BAA6B,GAC7B,sBAAsB,GACtB,cAAc,CACjB,CAAC;QACF,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;KACtE,CAAC;IAEF;uFACmF;IACnF,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;wBAGoB;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KACxB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC;CAC3C;AAcD,MAAM,WAAW,sBAAsB,CAAC,MAAM,GAAG,OAAO;IACtD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;yDACqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAClC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,OAAO;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;CACnD;AAMD,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC;;uBAEmB;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,OAAO;IACpD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,UAAU,CACzB,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,UAAU,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACjD,MAAM,GAAG,OAAO,EAChB,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAE3D,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACjB;;;qEAGiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;mCAG+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;IAEzD;;;;6EAIyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IAE5D;;;;8CAI0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,KACtB,SAAS,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;IAEzC;;;yCAGqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErC;;;;;;;;;;;;;;;;uBAgBmB;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;KACvC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9D;;;gCAG4B;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElC,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAElC;;;;;sDAKkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,KAAK,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAE3D;;;;;;iBAMa;IACb,QAAQ,CAAC,eAAe,CAAC,EACrB,SAAS,cAAc,EAAE,GACzB,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,cAAc,EAAE,CAAC,GACvD,CAAC,CACC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KACnB,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAEnD;;;;6DAIyD;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,kBAAkB,EAAE,GAC7B,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,kBAAkB,EAAE,CAAC,GAC3D,CAAC,CACC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KACnB,MAAM,CAAC,MAAM,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,MAAM,CACrB,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,UAAU,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACjD,MAAM,GAAG,OAAO,EAChB,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAC3D,SAAQ,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;CAAG;AAQzD,MAAM,MAAM,gBAAgB,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,QAAQ,SAAS,MAAM,EACvB,OAAO,SAAS,QAAQ,GAAG,SAAS,IAClC,CACF,OAAO,CAAC,EAAE,QAAQ,GAAG;IACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;CAC3D,KACE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAG9C,wBAAgB,YAAY,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EAChD,QAAQ,SAAS,MAAM,GAAG,EAAE,EAE5B,aAAa,EAAE,CACb,OAAO,CAAC,EAAE,QAAQ,KACf,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAChD,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAoB9D;AAOD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEtD,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,CAC3D,MAAM,EACN,MAAM,IAAI,EAEV,GAAG,EAEH,GAAG,CACJ,GACG,IAAI,GACJ,KAAK;CACV,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,YAAY,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,EAC7B,kCAAkC,EAClC,gBAAgB,EAChB,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AActF,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,SAAS,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC;IAC3F,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AASD,eAAO,MAAM,YAAY,GAAI,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,CAAC,KAAG,CAAW,CAAC;AAS/E,MAAM,MAAM,MAAM,GAAG,CACnB,OAAO,EAAE,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;AAQlE,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,OAAO;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE7D,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE;YAChB,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACvF,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;gBACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;aAC9B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC3C,CAAC;QACF;;;;;iEAKyD;QACzD,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SACrF,CAAC;KACH,CAAC;IAEF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;QACjF,QAAQ,CAAC,UAAU,EAAE,CACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;QACjF;;iEAEyD;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAChC,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,EAAE,EACpF,cAAc,CACf,CAAC;QACF;;;;;gEAKwD;QACxD,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAClF;;;;;2DAKmD;QACnD,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,iBAAiB,KACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,GAAG,gBAAgB,GAAG,cAAc,CAAC,CAAC;KAC5F,CAAC;IAEF;;;;2CAIuC;IACvC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;QAClF,QAAQ,CAAC,UAAU,EAAE,CACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7E,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oCAAoC,GAAG,cAAc,CAAC,CAAC;QACzF,QAAQ,CAAC,YAAY,EAAE,CACrB,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,GAAG,cAAc,CAAC,CAAC;QAC5E,QAAQ,CAAC,gBAAgB,EAAE,CACzB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GAAG,IAAI,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAAC,CAAC;QACnE;;mCAE2B;QAC3B,QAAQ,CAAC,WAAW,EAAE,CACpB,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAChB,MAAM,EACJ,uBAAuB,GACvB,oCAAoC,GACpC,kCAAkC,GAClC,6BAA6B,GAC7B,sBAAsB,GACtB,cAAc,CACjB,CAAC;QACF,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAChB,MAAM,EACJ,uBAAuB,GACvB,oCAAoC,GACpC,kCAAkC,GAClC,6BAA6B,GAC7B,sBAAsB,GACtB,cAAc,CACjB,CAAC;QACF;;oBAEY;QACZ,QAAQ,CAAC,MAAM,EAAE,CACf,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,cAAc,CAAC,CAAC;KACjE,CAAC;IAEF,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAEtD;uFACmF;IACnF,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;;wBAGoB;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC;CACnG;AAcD,MAAM,WAAW,sBAAsB,CAAC,MAAM,GAAG,OAAO;IACtD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;yDACqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,OAAO;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;CACnD;AAMD,MAAM,WAAW,eAAe,CAAC,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC;;uBAEmB;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,OAAO;IACpD,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAeD,MAAM,WAAW,UAAU,CACzB,GAAG,SAAS,MAAM,GAAG,MAAM,EAE3B,UAAU,SAAS,MAAM,GAAG,GAAG,EAE/B,MAAM,GAAG,GAAG,EAEZ,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,GAAG,EAE1C,iBAAiB,SAAS,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,GAAG,EAErE,cAAc,SAAS,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,EACvD,MAAM,SAAS,YAAY,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG;IAElD,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACjB;;;;;;2DAMuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;qEAGiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;mCAG+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;IAEzD;;;;;;;;;;;gBAWY;IACZ,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;6EAIyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IAE5D;;;;8CAI0C;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;IAE5F;;;;;;;;;;;;;;qEAciE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;gEAgB4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,cAAc,CAAC;IAEzC;;;;;;;;;;;wBAWoB;IACpB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE9C;;;yCAGqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE1F;;;;;;;;;;;;;;;;uBAgBmB;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;KACvC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9D;;;;;;;;uEAQmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;KACrC,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAE/C,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE;QACrC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;KACzC,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAE/C;;;gDAG4C;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE9F,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE/F;;;;;sDAKkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,KAAK,MAAM,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAE3D;;;;;;iBAMa;IACb,QAAQ,CAAC,eAAe,CAAC,EACrB,SAAS,cAAc,EAAE,GACzB,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,cAAc,EAAE,CAAC,GACvD,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAE3E;;;;6DAIyD;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,kBAAkB,EAAE,GAC7B,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,kBAAkB,EAAE,CAAC,GAC3D,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE/E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,MAAM,CACrB,GAAG,SAAS,MAAM,GAAG,MAAM,EAE3B,UAAU,SAAS,MAAM,GAAG,GAAG,EAE/B,MAAM,GAAG,GAAG,EAEZ,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,GAAG,EAE1C,iBAAiB,SAAS,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,GAAG,EAErE,cAAc,SAAS,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,EACvD,MAAM,SAAS,YAAY,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,CAClD,SAAQ,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,CAAC;CAAG;AAQpG,MAAM,MAAM,gBAAgB,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,QAAQ,SAAS,MAAM,EACvB,OAAO,SAAS,QAAQ,GAAG,SAAS,EAEpC,iBAAiB,SAAS,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,SAAS,EAE3E,cAAc,SAAS,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACtF,MAAM,SAAS,YAAY,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,IAChD,CACF,OAAO,CAAC,EAAE,QAAQ,GAAG;IACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;CAC3D,KACE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAGzF,wBAAgB,YAAY,CAC1B,GAAG,SAAS,MAAM,EAClB,UAAU,SAAS,MAAM,EACzB,MAAM,EACN,OAAO,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EAChD,QAAQ,SAAS,MAAM,GAAG,EAAE,EAE5B,iBAAiB,SAAS,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,GAAG,SAAS,EAE3E,cAAc,SAAS,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACtF,MAAM,SAAS,YAAY,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,EAElD,aAAa,EAAE,CACb,OAAO,CAAC,EAAE,QAAQ,KACf,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,CAAC,GAC3F,gBAAgB,CACjB,GAAG,EACH,UAAU,EACV,MAAM,EACN,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,cAAc,EACd,MAAM,CACP,CAkBA;AASD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAEvC,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK;CACjG,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/policies.d.ts

@@ -14,7 +14,7 @@ export interface ToolPolicy {
     readonly updatedAt: Date;
 }
 export interface CreateToolPolicyInput {
-    readonly scope: string;
+    readonly targetScope: string;
     readonly pattern: string;
     readonly action: ToolPolicyAction;
     /** Optional explicit position. Defaults to a key above the current
@@ -23,10 +23,15 @@ export interface CreateToolPolicyInput {
 }
 export interface UpdateToolPolicyInput {
     readonly id: string;
+    readonly targetScope: string;
     readonly pattern?: string;
     readonly action?: ToolPolicyAction;
     readonly position?: string;
 }
+export interface RemoveToolPolicyInput {
+    readonly id: string;
+    readonly targetScope: string;
+}
 export interface PolicyMatch {
     readonly action: ToolPolicyAction;
     readonly pattern: string;
@@ -43,20 +48,10 @@ export interface EffectivePolicy {
 }
 export declare const matchPattern: (pattern: string, toolId: string) => boolean;
 export declare const isValidPattern: (pattern: string) => boolean;
-export declare const comparePolicyRow: (a: {
-    position: unknown;
-    id: unknown;
-}, b: {
-    position: unknown;
-    id: unknown;
-}) => number;
-export declare const resolveToolPolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: {
-    scope_id: unknown;
-}) => number) => PolicyMatch | undefined;
-export declare const resolveEffectivePolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: {
-    scope_id: unknown;
-}) => number, defaultRequiresApproval?: boolean) => EffectivePolicy;
-export declare const effectivePolicyFromSorted: (toolId: string, sortedPolicies: readonly Pick<ToolPolicy, "pattern" | "action" | "id">[], defaultRequiresApproval?: boolean) => EffectivePolicy;
+export declare const comparePolicyRow: (a: Pick<ToolPolicyRow, "position" | "id">, b: Pick<ToolPolicyRow, "position" | "id">) => number;
+export declare const resolveToolPolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: Pick<ToolPolicyRow, "scope_id">) => number) => PolicyMatch | undefined;
+export declare const resolveEffectivePolicy: (toolId: string, policies: readonly ToolPolicyRow[], scopeRank: (row: Pick<ToolPolicyRow, "scope_id">) => number, defaultRequiresApproval?: boolean) => EffectivePolicy;
+export declare const effectivePolicyFromSorted: (toolId: string, sortedPolicies: readonly (Pick<ToolPolicy, "pattern" | "action" | "id"> & Partial<Pick<ToolPolicy, "scopeId">>)[], defaultRequiresApproval?: boolean) => EffectivePolicy;
 export declare const rowToToolPolicy: (row: ToolPolicyRow) => ToolPolicy;
 export declare const ToolPolicyActionSchema: Schema.Literals<readonly ["approve", "require_approval", "block"]>;
 //# sourceMappingURL=policies.d.ts.map