@grest-ts/http 0.0.48 → 0.0.49

package/dist/src/schema/GGHeader.d.ts

@@ -0,0 +1,23 @@
+import { type GGInbound, type GGOutbound } from "@grest-ts/context";
+import { type GGSchema } from "@grest-ts/schema";
+import { GGWireContextKey } from "./GGWireContextKey";
+/**
+ * A request header that IS its own context key.
+ *
+ *   // verified: requires .define() server-side; raw credential is ephemeral.
+ *   const USER_TOKEN_WIRE = new GGHeader("authorization", {scheme: "bearer"})
+ *
+ *   // ambient: parsed value lands in the wire and persists, no implementation needed.
+ *   const CLIENT_VERSION_WIRE = new GGHeader("x-client-version")
+ */
+export declare class GGHeader extends GGWireContextKey {
+    readonly headers: Record<string, GGSchema<string | undefined>>;
+    private readonly scheme?;
+    private readonly wireName;
+    constructor(name: string, options?: {
+        scheme?: "bearer";
+    });
+    parse(inbound: GGInbound): void;
+    update(outbound: GGOutbound): void;
+}
+//# sourceMappingURL=GGHeader.d.ts.map

package/dist/src/schema/GGHeader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGHeader.d.ts","sourceRoot":"","sources":["../../../src/schema/GGHeader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAE,KAAK,UAAU,EAAC,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAC,KAAK,QAAQ,EAAW,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAA;AAKnD;;;;;;;;GAQG;AACH,qBAAa,QAAS,SAAQ,gBAAgB;IAE1C,SAAgB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,QAAQ,CAAA;KAAE;IAQlD,KAAK,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI;IAW/B,MAAM,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;CAM5C"}

package/dist/src/schema/GGHeader.js

@@ -0,0 +1,41 @@
+import { IsString } from "@grest-ts/schema";
+import { GGWireContextKey } from "./GGWireContextKey.js";
+const BEARER = "Bearer ";
+/**
+ * A request header that IS its own context key.
+ *
+ *   // verified: requires .define() server-side; raw credential is ephemeral.
+ *   const USER_TOKEN_WIRE = new GGHeader("authorization", {scheme: "bearer"})
+ *
+ *   // ambient: parsed value lands in the wire and persists, no implementation needed.
+ *   const CLIENT_VERSION_WIRE = new GGHeader("x-client-version")
+ */
+export class GGHeader extends GGWireContextKey {
+    headers;
+    scheme;
+    wireName;
+    constructor(name, options) {
+        const WIRE_SCHEMA = IsString.orUndefined;
+        super(name, WIRE_SCHEMA);
+        this.scheme = options?.scheme;
+        this.wireName = name.toLowerCase();
+        this.headers = { [this.wireName]: WIRE_SCHEMA };
+    }
+    parse(inbound) {
+        const raw = inbound.headers[this.wireName];
+        if (raw === undefined) {
+            return undefined;
+        }
+        const value = this.scheme === "bearer" && raw.startsWith(BEARER) ? raw.slice(BEARER.length) : raw;
+        if (value !== undefined) {
+            this.set(value);
+        }
+    }
+    update(outbound) {
+        const value = this.get();
+        if (value !== undefined) {
+            outbound.headers[this.wireName] = (this.scheme === "bearer" ? `${BEARER}${value}` : value);
+        }
+    }
+}
+//# sourceMappingURL=GGHeader.js.map

package/dist/src/schema/GGHeader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGHeader.js","sourceRoot":"","sources":["../../../src/schema/GGHeader.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,QAAQ,EAAC,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAA;AAEnD,MAAM,MAAM,GAAG,SAAS,CAAA;AAGxB;;;;;;;;GAQG;AACH,MAAM,OAAO,QAAS,SAAQ,gBAAgB;IAE1B,OAAO,CAA8C;IACpD,MAAM,CAAW;IACjB,QAAQ,CAAQ;IAEjC,YAAY,IAAY,EAAE,OAA+B;QACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAA;QACxC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,OAAO,GAAG,EAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAC,CAAA;IACjD,CAAC;IAEM,KAAK,CAAC,OAAkB;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO,SAAS,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACjG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,QAAoB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9F,CAAC;IACL,CAAC;CACJ"}

package/dist/src/schema/GGHttpPermissionsChecker.d.ts

@@ -0,0 +1,9 @@
+import type { GGTransportMiddleware } from "@grest-ts/context";
+import { GGPermission } from "@grest-ts/schema";
+export declare class GGHttpPermissionsChecker {
+    private readonly middlewaresWithPermissions;
+    constructor(apiMiddlewares: readonly GGTransportMiddleware[]);
+    assert(schema: string, method: string, required: GGPermission): Promise<ReadonlyArray<ReadonlyArray<string>>>;
+    assertGrants(schema: string, method: string, granted: undefined | ReadonlyArray<ReadonlyArray<string>>, required: GGPermission): void;
+}
+//# sourceMappingURL=GGHttpPermissionsChecker.d.ts.map

package/dist/src/schema/GGHttpPermissionsChecker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGHttpPermissionsChecker.d.ts","sourceRoot":"","sources":["../../../src/schema/GGHttpPermissionsChecker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAY,YAAY,EAAsB,MAAM,kBAAkB,CAAC;AAE9E,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAyB;gBAExD,cAAc,EAAE,SAAS,qBAAqB,EAAE;IAS/C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IASnH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;CAQ/I"}

package/dist/src/schema/GGHttpPermissionsChecker.js

@@ -0,0 +1,29 @@
+import { GGWireContextKey } from "./GGWireContextKey.js";
+import { FORBIDDEN, GGPermissionChecker } from "@grest-ts/schema";
+export class GGHttpPermissionsChecker {
+    middlewaresWithPermissions = [];
+    constructor(apiMiddlewares) {
+        for (const mw of apiMiddlewares) {
+            if (mw instanceof GGWireContextKey && mw.hasPermissions()) {
+                this.middlewaresWithPermissions.push(mw);
+            }
+        }
+        Object.freeze(this.middlewaresWithPermissions);
+    }
+    async assert(schema, method, required) {
+        const scopes = [];
+        for (let i = 0; i < this.middlewaresWithPermissions.length; i++) {
+            scopes.push(await this.middlewaresWithPermissions[i].getGrantedPermissions());
+        }
+        this.assertGrants(schema, method, scopes, required);
+        return Object.freeze(scopes);
+    }
+    assertGrants(schema, method, granted, required) {
+        if (!GGPermissionChecker.satisfies(required, granted)) {
+            throw new FORBIDDEN({
+                debugMessage: `${schema + (method ? "." + method : "")} requires ${GGPermissionChecker.describePermission(required)} — caller scopes did not satisfy`
+            });
+        }
+    }
+}
+//# sourceMappingURL=GGHttpPermissionsChecker.js.map

package/dist/src/schema/GGHttpPermissionsChecker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGHttpPermissionsChecker.js","sourceRoot":"","sources":["../../../src/schema/GGHttpPermissionsChecker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAC,SAAS,EAAgB,mBAAmB,EAAC,MAAM,kBAAkB,CAAC;AAE9E,MAAM,OAAO,wBAAwB;IAEhB,0BAA0B,GAAuB,EAAE,CAAA;IAEpE,YAAY,cAAgD;QACxD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAC9B,IAAI,EAAE,YAAY,gBAAgB,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;gBACxD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7C,CAAC;QACL,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAAc,EAAE,QAAsB;QACtE,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAwB,CAAA;IACvD,CAAC;IAEM,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,OAAyD,EAAE,QAAsB;QACjI,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC;gBAChB,YAAY,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,mBAAmB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,kCAAkC;aACxJ,CAAC,CAAA;QACN,CAAC;IACL,CAAC;CAEJ"}

package/dist/src/schema/GGHttpSchema.d.ts

@@ -1,21 +1,20 @@
 import { ERROR, ERROR_JSON, GGContractApiDefinition, GGContractClass, GGContractMethod, GGSchema, GGSchemaDescription, OK } from "@grest-ts/schema";
 import type { HttpMethod } from "@grest-ts/common";
 import type http from "http";
-import type { GGHttpServerMiddleware } from "../server/GGHttpSchema.startServer";
-import type { GGContextKey } from "@grest-ts/context";
+import type { GGContextKey, GGTransportMiddleware } from "@grest-ts/context";
 import type { OpenAPIV3_1 } from "openapi-types";
 export declare class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
     readonly name: string;
     readonly pathPrefix: string;
-    readonly apiMiddlewares: readonly GGHttpTransportMiddleware[];
+    readonly apiMiddlewares: readonly GGTransportMiddleware[];
     readonly codec: Record<keyof TContract, GGHttpCodec>;
     readonly contract: GGContractClass<TContract> | null;
-    constructor(pathPrefix: string, contract: GGContractClass<TContract>, wireCodec: Record<keyof TContract, GGHttpCodec>, middlewares?: readonly GGHttpTransportMiddleware[]);
+    constructor(pathPrefix: string, contract: GGContractClass<TContract>, wireCodec: Record<keyof TContract, GGHttpCodec>, middlewares?: readonly GGTransportMiddleware[]);
 }
 export interface ClientHttpRouteToRpcTransformClientConfig {
     pathPrefix: string;
     contract: GGContractMethod;
-    middlewares: readonly GGHttpTransportMiddleware[];
+    middlewares: readonly GGTransportMiddleware[];
 }
 export interface ClientHttpRouteToRpcTransformClientCodec {
     createRequest: (data: unknown) => GGHttpFetchRequest | Promise<GGHttpFetchRequest>;
@@ -29,11 +28,12 @@ export interface GGHttpFetchRequest {
 }
 export interface ClientHttpRouteToRpcTransformServerConfig {
     contract: GGContractMethod;
-    apiMiddlewares: readonly GGHttpTransportMiddleware[];
-    serverMiddlewares: readonly GGHttpServerMiddleware[];
+    /** Schema bindings + server middlewares, already merged into one ordered server pipeline. */
+    middlewares: readonly GGTransportMiddleware[];
 }
 export interface ClientHttpRouteToRpcTransformServerCodec {
-    parseRequest: (req: http.IncomingMessage) => Promise<unknown>;
+    readRequest: (req: http.IncomingMessage) => Promise<unknown>;
+    validateInput: (rawInput: unknown) => unknown;
     sendResponse: (res: http.ServerResponse, rpcResult: ERROR<string, unknown> | OK<unknown>) => Promise<void>;
 }
 /**
@@ -92,55 +92,4 @@ export interface GGHttpCodec {
      */
     toOpenApiOperation?(config: GGHttpCodecOpenApiConfig): Partial<OpenAPIV3_1.OperationObject>;
 }
-export interface GGHttpTransportMiddleware {
-    /**
-     * Request headers this middleware reads or writes, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Allow-Headers and OpenAPI parameter docs.
-     * Use {} if the middleware touches no custom request headers.
-     *
-     * @example
-     * headers: {
-     *   "authorization": IsString.nonEmpty.docs({title: "Bearer token", example: "Bearer ..."}),
-     *   "accept-language": IsLocale.orUndefined
-     * }
-     */
-    readonly headers: Record<string, GGSchema<string | undefined>>;
-    /**
-     * Response headers this middleware sets, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Expose-Headers and OpenAPI response header docs.
-     * Use {} if the middleware sets no custom response headers.
-     */
-    readonly responseHeaders: Record<string, GGSchema<string | undefined>>;
-    /**
-     * Cookies this middleware reads, mapped to their value schemas. Emitted as `in: cookie`
-     * parameters in OpenAPI so cookie-bound inputs are documented. Absent for header/plain
-     * middlewares.
-     */
-    readonly cookieParams?: Record<string, GGSchema<string | undefined>>;
-    /**
-     * Client-side: modify outgoing request (add headers, etc.)
-     */
-    updateRequest?(req: GGHttpRequest): void;
-    /**
-     * Server-side: parse incoming request (extract context from headers, etc.)
-     */
-    parseRequest?(req: GGHttpRequest): void;
-    /**
-     * Server-side: modify outgoing response
-     */
-    updateResponse?(res: GGHttpResponse): void;
-    /**
-     * Client-side: parse incoming response
-     */
-    parseResponse?(res: GGHttpResponse): void;
-}
-export interface GGHttpRequest {
-    headers?: Record<string, string | string[]>;
-    queryArgs?: Record<string, string | string[]>;
-}
-export interface GGHttpResponse {
-    headers: Record<string, string | string[]>;
-}
 //# sourceMappingURL=GGHttpSchema.d.ts.map

package/dist/src/schema/GGHttpSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpSchema.d.ts","sourceRoot":"","sources":["../../../src/schema/GGHttpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAC,MAAM,kBAAkB,CAAC;AAClJ,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,eAAe,CAAC;AAE/C,qBAAa,YAAY,CAAC,SAAS,SAAS,uBAAuB,EAAE,QAAQ;IAEzE,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,cAAc,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACpE,SAAgB,KAAK,EAAE,MAAM,CAAC,MAAM,SAAS,EAAE,WAAW,CAAC,CAAA;IAC3D,SAAgB,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAO;gBAG9D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,EACpC,SAAS,EAAE,MAAM,CAAC,MAAM,SAAS,EAAE,WAAW,CAAC,EAC/C,WAAW,GAAE,SAAS,yBAAyB,EAAO;CAW7D;AAMD,MAAM,WAAW,yCAAyC;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,wCAAwC;IACrD,aAAa,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAClF,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC5F;AAED,MAAM,WAAW,kBAAkB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;CACvC;AAMD,MAAM,WAAW,yCAAyC;IACtD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,cAAc,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACrD,iBAAiB,EAAE,SAAS,sBAAsB,EAAE,CAAA;CACvD;AAED,MAAM,WAAW,wCAAwC;IACrD,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7G;AAMD;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,WAAW,CAAC,YAAY,GAAG,WAAW,CAAC,eAAe,CAAC;AAE5H,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAC;CACpD;AAGD,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAEvE;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAEtE,eAAe,CAAC,MAAM,EAAE,yCAAyC,GAAG,wCAAwC,CAAA;IAE5G,eAAe,CAAC,MAAM,EAAE,yCAAyC,GAAG,wCAAwC,CAAA;IAE5G;;;;;;;OAOG;IACH,kBAAkB,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;CAC9F;AAMD,MAAM,WAAW,yBAAyB;IACtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAE/D;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAEvE;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAErE;;OAEG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAAC;IAEzC;;OAEG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAAC;IAExC;;OAEG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAE3C;;OAEG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"GGHttpSchema.d.ts","sourceRoot":"","sources":["../../../src/schema/GGHttpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAC,MAAM,kBAAkB,CAAC;AAClJ,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAC,YAAY,EAAE,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,eAAe,CAAC;AAE/C,qBAAa,YAAY,CAAC,SAAS,SAAS,uBAAuB,EAAE,QAAQ;IAEzE,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,cAAc,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAChE,SAAgB,KAAK,EAAE,MAAM,CAAC,MAAM,SAAS,EAAE,WAAW,CAAC,CAAA;IAC3D,SAAgB,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI,CAAO;gBAG9D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,EACpC,SAAS,EAAE,MAAM,CAAC,MAAM,SAAS,EAAE,WAAW,CAAC,EAC/C,WAAW,GAAE,SAAS,qBAAqB,EAAO;CAWzD;AAMD,MAAM,WAAW,yCAAyC;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,wCAAwC;IACrD,aAAa,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAClF,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC5F;AAED,MAAM,WAAW,kBAAkB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;CACvC;AAMD,MAAM,WAAW,yCAAyC;IACtD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6FAA6F;IAC7F,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,wCAAwC;IACrD,WAAW,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC;IAC9C,YAAY,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7G;AAMD;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,WAAW,CAAC,YAAY,GAAG,WAAW,CAAC,eAAe,CAAC;AAE5H,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAC;CACpD;AAGD,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAEvE;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAEtE,eAAe,CAAC,MAAM,EAAE,yCAAyC,GAAG,wCAAwC,CAAA;IAE5G,eAAe,CAAC,MAAM,EAAE,yCAAyC,GAAG,wCAAwC,CAAA;IAE5G;;;;;;;OAOG;IACH,kBAAkB,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;CAC9F"}

package/dist/src/schema/GGHttpSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpSchema.js","sourceRoot":"","sources":["../../../src/schema/GGHttpSchema.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,YAAY;IAEL,IAAI,CAAQ;IACZ,UAAU,CAAQ;IAClB,cAAc,CAAsC;IACpD,KAAK,CAAsC;IAC3C,QAAQ,GAAsC,IAAI,CAAA;IAElE,YACI,UAAkB,EAClB,QAAoC,EACpC,SAA+C,EAC/C,cAAoD,EAAE;QAEtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,cAAc,GAAG,WAAW,CAAA;QACjC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;CACJ"}
+{"version":3,"file":"GGHttpSchema.js","sourceRoot":"","sources":["../../../src/schema/GGHttpSchema.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,YAAY;IAEL,IAAI,CAAQ;IACZ,UAAU,CAAQ;IAClB,cAAc,CAAkC;IAChD,KAAK,CAAsC;IAC3C,QAAQ,GAAsC,IAAI,CAAA;IAElE,YACI,UAAkB,EAClB,QAAoC,EACpC,SAA+C,EAC/C,cAAgD,EAAE;QAElD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,cAAc,GAAG,WAAW,CAAA;QACjC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;CACJ"}

package/dist/src/schema/GGWireContextKey.d.ts

@@ -0,0 +1,30 @@
+import { GGContextKey, type GGTransportMiddleware } from "@grest-ts/context";
+/** Outbound freshness gate for a smart wire. The outbound value is always the wire's own context value. */
+export interface GGWireClientHandler {
+    /** Async — true when the wire value is stale and recover() should run before the next outbound read. */
+    isStale?: () => boolean;
+    /** Async — refresh the credential into the wire (via key.set); run by the synchronizer's waitFor before the outbound read. */
+    recover?: () => Promise<void>;
+}
+/**
+ * Base for credential wires (GGHeader, GGCookie). A wire IS a GGContextKey and a transport
+ * middleware at once. Verified vs ambient is decided by whether `.define()` was called:
+ *  - verified (`.define()`d): the wire holds the raw inbound credential, which is verified
+ *    during process(), then clear()d before the handler runs — handlers read the durable key
+ *    minted by the handler, never the credential.
+ *  - ambient (never `.define()`d): the parsed value lands in the wire and persists through the
+ *    handler (read via WIRE.get()); no process, no clear, no implementation needed.
+ *
+ * The server/inbound half (define/create/process/permissions) is attached node-side via
+ * ./GGWireContextKey.node — the browser bundle never pulls @grest-ts/locator.
+ */
+export declare abstract class GGWireContextKey extends GGContextKey<string | undefined> implements GGTransportMiddleware {
+    private _clientHandler?;
+    /**
+     * Attach the outbound freshness gate. Freeze-once. The outbound value is always the wire's
+     * context value; this only registers an isStale/recover gate that refreshes it before the read.
+     * GGAuthSession calls it internally on the wires it holds.
+     */
+    defineClient(handler: GGWireClientHandler): void;
+}
+//# sourceMappingURL=GGWireContextKey.d.ts.map

package/dist/src/schema/GGWireContextKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGWireContextKey.d.ts","sourceRoot":"","sources":["../../../src/schema/GGWireContextKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,KAAK,qBAAqB,EAAC,MAAM,mBAAmB,CAAA;AAG1E,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAChC,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,OAAO,CAAA;IACvB,8HAA8H;IAC9H,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,gBAAiB,SAAQ,YAAY,CAAC,MAAM,GAAG,SAAS,CAAE,YAAW,qBAAqB;IAE5G,OAAO,CAAC,cAAc,CAAC,CAAqB;IAE5C;;;;OAIG;IACI,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;CAa1D"}

package/dist/src/schema/GGWireContextKey.js

@@ -0,0 +1,36 @@
+import { GGContextKey } from "@grest-ts/context";
+import { GGContextKeySynchronizer } from "../client/GGContextKeySynchronizer.js";
+/**
+ * Base for credential wires (GGHeader, GGCookie). A wire IS a GGContextKey and a transport
+ * middleware at once. Verified vs ambient is decided by whether `.define()` was called:
+ *  - verified (`.define()`d): the wire holds the raw inbound credential, which is verified
+ *    during process(), then clear()d before the handler runs — handlers read the durable key
+ *    minted by the handler, never the credential.
+ *  - ambient (never `.define()`d): the parsed value lands in the wire and persists through the
+ *    handler (read via WIRE.get()); no process, no clear, no implementation needed.
+ *
+ * The server/inbound half (define/create/process/permissions) is attached node-side via
+ * ./GGWireContextKey.node — the browser bundle never pulls @grest-ts/locator.
+ */
+export class GGWireContextKey extends GGContextKey {
+    _clientHandler;
+    /**
+     * Attach the outbound freshness gate. Freeze-once. The outbound value is always the wire's
+     * context value; this only registers an isStale/recover gate that refreshes it before the read.
+     * GGAuthSession calls it internally on the wires it holds.
+     */
+    defineClient(handler) {
+        if (this._clientHandler) {
+            throw new Error(`Wire "${this.name}" already has .defineClient() — it can only be defined once.`);
+        }
+        this._clientHandler = handler;
+        if (handler.isStale || handler.recover) {
+            GGContextKeySynchronizer.provide(this, {
+                isStale: handler.isStale ?? (() => false),
+                recover: handler.recover ?? (async () => {
+                }),
+            });
+        }
+    }
+}
+//# sourceMappingURL=GGWireContextKey.js.map

package/dist/src/schema/GGWireContextKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGWireContextKey.js","sourceRoot":"","sources":["../../../src/schema/GGWireContextKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAA6B,MAAM,mBAAmB,CAAA;AAC1E,OAAO,EAAC,wBAAwB,EAAC,MAAM,oCAAoC,CAAA;AAU3E;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,gBAAiB,SAAQ,YAAgC;IAEnE,cAAc,CAAsB;IAE5C;;;;OAIG;IACI,YAAY,CAAC,OAA4B;QAC5C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,8DAA8D,CAAC,CAAA;QACrG,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAA;QAC7B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,wBAAwB,CAAC,OAAO,CAAC,IAAI,EAAE;gBACnC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE;gBACxC,CAAC,CAAC;aACL,CAAC,CAAA;QACN,CAAC;IACL,CAAC;CACJ"}

package/dist/src/schema/GGWireContextKey.node.d.ts

@@ -0,0 +1,36 @@
+import { GGWireContextKey } from "./GGWireContextKey";
+export interface GGWireServerHandler {
+    /** Verify the raw credential and mint the durable principal. Throws to reject the request. */
+    process: () => Promise<void>;
+    /** The caller's grants from this wire — read off the durable principal minted in process(). */
+    permissions?: () => Promise<readonly string[]>;
+}
+/** True once .define() has run on this wire — distinguishes verified wires from ambient ones. */
+export declare function wireIsDefined(wire: GGWireContextKey): boolean;
+/**
+ * Binds the verification handler's deps into one runtime's locator scope. Returned by
+ * `.define()`; `.create(deps)` runs once per scope (a fresh worker / restart gets its own).
+ */
+export declare class GGWireHandlerRegistration<Deps> {
+    private readonly wire;
+    private readonly factory;
+    constructor(wire: GGWireContextKey, factory: (deps: Deps) => GGWireServerHandler);
+    create(deps: Deps): void;
+}
+declare module "./GGWireContextKey" {
+    interface GGWireContextKey {
+        /** Attach the server-side verification handler. Process-global, frozen once — a second call throws. */
+        define<Deps>(factory: (deps: Deps) => GGWireServerHandler): GGWireHandlerRegistration<Deps>;
+        /** @internal server pipeline hook — verify the credential and mint the durable principal. */
+        process(): Promise<void>;
+        /** @internal If wire is handling permissions **/
+        hasPermissions(): boolean;
+        /** @internal permission-gate hook — the caller's grants from this wire. */
+        getGrantedPermissions(): Promise<readonly string[]>;
+        /** @internal startup validation — true once .create() has run on the current runtime scope. */
+        hasHandler(): boolean;
+        /** Drop the ephemeral raw credential after process(); ambient wires keep their value. */
+        clear(): void;
+    }
+}
+//# sourceMappingURL=GGWireContextKey.node.d.ts.map

package/dist/src/schema/GGWireContextKey.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGWireContextKey.node.d.ts","sourceRoot":"","sources":["../../../src/schema/GGWireContextKey.node.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAA;AAEnD,MAAM,WAAW,mBAAmB;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CACjD;AAUD,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAE7D;AAmBD;;;GAGG;AACH,qBAAa,yBAAyB,CAAC,IAAI;IAEnC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,mBAAmB;IAI1D,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;CAOlC;AAED,OAAO,QAAQ,oBAAoB,CAAC;IAChC,UAAU,gBAAgB;QACtB,uGAAuG;QACvG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,mBAAmB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;QAE3F,6FAA6F;QAC7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;QAExB,iDAAiD;QACjD,cAAc,IAAI,OAAO,CAAC;QAE1B,2EAA2E;QAC3E,qBAAqB,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;QAEnD,+FAA+F;QAC/F,UAAU,IAAI,OAAO,CAAA;QAErB,yFAAyF;QACzF,KAAK,IAAI,IAAI,CAAA;KAChB;CACJ"}

package/dist/src/schema/GGWireContextKey.node.js

@@ -0,0 +1,83 @@
+/**
+ * Server/inbound half of the wire model: define/create the verification handler, run it during
+ * the request pipeline (process), and expose the caller's grants to the permission gate
+ * (permissions). Node-only — keeps @grest-ts/locator out of the browser bundle.
+ */
+import { GGLocator, GGLocatorKey } from "@grest-ts/locator";
+import { GGWireContextKey } from "./GGWireContextKey.js";
+const HANDLER_KEYS = new WeakMap();
+const FACTORIES = new WeakMap();
+// Locator keys resolve by their string name, so the handler key must be unique per wire
+// instance — two wires over the same name (e.g. a public ambient cookie and a gated one
+// over the same cookie name) must not share a handler.
+let nextWireHandlerId = 0;
+/** True once .define() has run on this wire — distinguishes verified wires from ambient ones. */
+export function wireIsDefined(wire) {
+    return FACTORIES.has(wire);
+}
+function handlerKeyFor(wire) {
+    let key = HANDLER_KEYS.get(wire);
+    if (!key) {
+        key = new GGLocatorKey(`wire:${wire.name}:${nextWireHandlerId++}`);
+        HANDLER_KEYS.set(wire, key);
+    }
+    return key;
+}
+function resolveHandler(wire) {
+    const handler = handlerKeyFor(wire).tryGet();
+    if (!handler) {
+        throw new Error(`Wire "${wire.name}" is used but not implemented — call ${wire.name}.define(...).create(deps) in compose().`);
+    }
+    return handler;
+}
+/**
+ * Binds the verification handler's deps into one runtime's locator scope. Returned by
+ * `.define()`; `.create(deps)` runs once per scope (a fresh worker / restart gets its own).
+ */
+export class GGWireHandlerRegistration {
+    wire;
+    factory;
+    constructor(wire, factory) {
+        this.wire = wire;
+        this.factory = factory;
+    }
+    create(deps) {
+        const key = handlerKeyFor(this.wire);
+        if (GGLocator.getScope().has(key)) {
+            throw new Error(`Wire "${this.wire.name}" was already created in this runtime scope — .create() runs once per runtime.`);
+        }
+        GGLocator.getScope().set(key, this.factory(deps));
+    }
+}
+GGWireContextKey.prototype.define = function (factory) {
+    if (FACTORIES.has(this)) {
+        throw new Error(`Wire "${this.name}" already has .define() — it can only be defined once.`);
+    }
+    FACTORIES.set(this, factory);
+    return new GGWireHandlerRegistration(this, factory);
+};
+GGWireContextKey.prototype.process = async function () {
+    if (!this.hasHandler())
+        return;
+    await resolveHandler(this).process();
+};
+GGWireContextKey.prototype.hasPermissions = function () {
+    if (!this.hasHandler())
+        return false;
+    const handler = resolveHandler(this);
+    return !!handler.permissions;
+};
+GGWireContextKey.prototype.getGrantedPermissions = async function () {
+    if (!this.hasHandler())
+        return [];
+    const handler = resolveHandler(this);
+    return handler.permissions ? await handler.permissions() : [];
+};
+GGWireContextKey.prototype.hasHandler = function () {
+    return handlerKeyFor(this).has();
+};
+GGWireContextKey.prototype.clear = function () {
+    if (this.hasHandler() && this.has())
+        this.delete();
+};
+//# sourceMappingURL=GGWireContextKey.node.js.map

package/dist/src/schema/GGWireContextKey.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGWireContextKey.node.js","sourceRoot":"","sources":["../../../src/schema/GGWireContextKey.node.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,SAAS,EAAE,YAAY,EAAC,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAA;AASnD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAuD,CAAA;AACvF,MAAM,SAAS,GAAG,IAAI,OAAO,EAA6B,CAAA;AAE1D,wFAAwF;AACxF,wFAAwF;AACxF,uDAAuD;AACvD,IAAI,iBAAiB,GAAG,CAAC,CAAA;AAEzB,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAsB;IAChD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB;IACzC,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,GAAG,GAAG,IAAI,YAAY,CAAsB,QAAQ,IAAI,CAAC,IAAI,IAAI,iBAAiB,EAAE,EAAE,CAAC,CAAA;QACvF,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,wCAAwC,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAA;IACjI,CAAC;IACD,OAAO,OAAO,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAEb;IACA;IAFrB,YACqB,IAAsB,EACtB,OAA4C;QAD5C,SAAI,GAAJ,IAAI,CAAkB;QACtB,YAAO,GAAP,OAAO,CAAqC;IAEjE,CAAC;IAEM,MAAM,CAAC,IAAU;QACpB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,gFAAgF,CAAC,CAAA;QAC5H,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC;CACJ;AAwBD,gBAAgB,CAAC,SAAS,CAAC,MAAM,GAAG,UAAU,OAAO;IACjD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,wDAAwD,CAAC,CAAA;IAC/F,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,OAAO,IAAI,yBAAyB,CAAC,IAAI,EAAE,OAAc,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED,gBAAgB,CAAC,SAAS,CAAC,OAAO,GAAG,KAAK;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAM;IAC9B,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;AACxC,CAAC,CAAA;AAED,gBAAgB,CAAC,SAAS,CAAC,cAAc,GAAG;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,CAAA;AAChC,CAAC,CAAA;AAED,gBAAgB,CAAC,SAAS,CAAC,qBAAqB,GAAG,KAAK;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACpC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACjE,CAAC,CAAA;AAED,gBAAgB,CAAC,SAAS,CAAC,UAAU,GAAG;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;AACpC,CAAC,CAAA;AAED,gBAAgB,CAAC,SAAS,CAAC,KAAK,GAAG;IAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AACtD,CAAC,CAAA"}

package/dist/src/schema/httpSchema.d.ts

@@ -1,6 +1,6 @@
 import { GGHttpCodec, GGHttpSchema } from "./GGHttpSchema";
-import { GGHttpTransportMiddleware } from "./GGHttpSchema";
 import { GGContractApiDefinition, GGContractClass } from "@grest-ts/schema";
+import type { GGTransportMiddleware } from "@grest-ts/context";
 /**
  * Create an HTTP API schema builder from a contract.
  *
@@ -32,7 +32,7 @@ declare class GGHttpSchemaBuilder<TContract extends GGContractApiDefinition, TCo
     private _middlewares;
     constructor(contract: GGContractClass<TContract>);
     pathPrefix(prefix: string): this;
-    use<M extends GGHttpTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M>;
+    use<M extends GGTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M>;
     routes(mapping: {
         [K in keyof TContract]: GGHttpCodec;
     }): GGHttpSchema<TContract, TContext>;

package/dist/src/schema/httpSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpSchema.d.ts","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAC,yBAAyB,EAAC,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAC,uBAAuB,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,UAAU,CAAC,SAAS,SAAS,uBAAuB,EAChE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,GACrC,mBAAmB,CAAC,SAAS,CAAC,CAEhC;AAED,cAAM,mBAAmB,CAAC,SAAS,SAAS,uBAAuB,EAAE,QAAQ,GAAG,SAAS;IAErF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,YAAY,CAAkC;gBAE1C,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC;IAIhD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKhC,GAAG,CAAC,CAAC,SAAS,yBAAyB,EAAE,UAAU,EAAE,CAAC,GAAG,mBAAmB,CAAC,SAAS,EAAE,QAAQ,GAAG,CAAC,CAAC;IAKrG,MAAM,CAAC,OAAO,EAAE;SAAG,CAAC,IAAI,MAAM,SAAS,GAAG,WAAW;KAAE,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;CAG9F"}
+{"version":3,"file":"httpSchema.d.ts","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAC,uBAAuB,EAAE,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,UAAU,CAAC,SAAS,SAAS,uBAAuB,EAChE,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,GACrC,mBAAmB,CAAC,SAAS,CAAC,CAEhC;AAED,cAAM,mBAAmB,CAAC,SAAS,SAAS,uBAAuB,EAAE,QAAQ,GAAG,SAAS;IAErF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,YAAY,CAA8B;gBAEtC,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC;IAIhD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKhC,GAAG,CAAC,CAAC,SAAS,qBAAqB,EAAE,UAAU,EAAE,CAAC,GAAG,mBAAmB,CAAC,SAAS,EAAE,QAAQ,GAAG,CAAC,CAAC;IAKjG,MAAM,CAAC,OAAO,EAAE;SAAG,CAAC,IAAI,MAAM,SAAS,GAAG,WAAW;KAAE,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;CAG9F"}

package/dist/src/schema/httpSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpSchema.js","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAIzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,UAAU,CACtB,QAAoC;IAEpC,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,mBAAmB;IAEJ,SAAS,CAA4B;IAC9C,WAAW,GAAW,EAAE,CAAA;IACxB,YAAY,GAAgC,EAAE,CAAA;IAEtD,YAAY,QAAoC;QAC5C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,MAAc;QACrB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,GAAG,CAAsC,UAAa;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,IAA+D,CAAA;IAC1E,CAAC;IAED,MAAM,CAAC,OAAgD;QACnD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACzF,CAAC;CACJ"}
+{"version":3,"file":"httpSchema.js","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAIzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,UAAU,CACtB,QAAoC;IAEpC,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,mBAAmB;IAEJ,SAAS,CAA4B;IAC9C,WAAW,GAAW,EAAE,CAAA;IACxB,YAAY,GAA4B,EAAE,CAAA;IAElD,YAAY,QAAoC;QAC5C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,MAAc;QACrB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,GAAG,CAAkC,UAAa;QAC9C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,IAA+D,CAAA;IAC1E,CAAC;IAED,MAAM,CAAC,OAAgD;QACnD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACzF,CAAC;CACJ"}

package/dist/src/server/GGHttp.d.ts

@@ -1,20 +1,7 @@
 import { GGHttpSchema } from "../schema/GGHttpSchema";
 import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
-import { GGHttpServerMiddleware } from "./GGHttpSchema.startServer";
+import type { GGTransportMiddleware } from "@grest-ts/context";
 import { GGHttpServer } from "./GGHttpServer";
-/**
- * Resolves the caller's permission scopes for the current request. The function
- * is called once between transport middleware and the handler. Sync or async —
- * both supported (the gate awaits).
- *
- * Return `null` when no caller identity is available (the gate will throw
- * NOT_AUTHORIZED for non-public methods). Return a (possibly empty) set
- * otherwise; the gate will call satisfies() against the method's permission.
- *
- * The resolver should read whatever app-defined context the upstream auth
- * middleware populated — it should NOT parse the token itself.
- */
-export type GGScopeResolver = () => ReadonlySet<string> | null | Promise<ReadonlySet<string> | null>;
 export declare class GGHttp<TContext = undefined> {
     /**
      * Protected (not private) so that plugin modules can access the underlying server
@@ -23,19 +10,8 @@ export declare class GGHttp<TContext = undefined> {
      */
     protected readonly httpServer: GGHttpServer;
     private readonly middlewares;
-    private permissionResolver?;
     constructor(httpServer: GGHttpServer);
-    use<M extends GGHttpServerMiddleware>(middleware: M): GGHttp<TContext | M>;
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    usePermissions(resolver: GGScopeResolver): this;
+    use<M extends GGTransportMiddleware>(middleware: M): GGHttp<TContext | M>;
     http<TContract extends GGContractApiDefinition, TSchemaContext>(schema: GGHttpSchema<TContract, TSchemaContext>, implementation: GGContractImplementation<TContract>): this;
 }
 //# sourceMappingURL=GGHttp.d.ts.map

package/dist/src/server/GGHttp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;AAE1E,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,kBAAkB,CAAC,CAAkB;gBAEjC,UAAU,EAAE,YAAY;IAI7B,GAAG,CAAC,CAAC,SAAS,sBAAsB,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAKjF;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAK/C,IAAI,CAAC,SAAS,SAAS,uBAAuB,EAAE,cAAc,EACjE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/C,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,GACpD,IAAI;CAQV"}
+{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;gBAE/C,UAAU,EAAE,YAAY;IAI7B,GAAG,CAAC,CAAC,SAAS,qBAAqB,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAKzE,IAAI,CAAC,SAAS,SAAS,uBAAuB,EAAE,cAAc,EACjE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/C,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,GACpD,IAAI;CAOV"}

package/dist/src/server/GGHttp.js

@@ -6,7 +6,6 @@ export class GGHttp {
      */
     httpServer;
     middlewares = [];
-    permissionResolver;
     constructor(httpServer) {
         this.httpServer = httpServer;
     }
@@ -14,24 +13,10 @@ export class GGHttp {
         this.middlewares.push(middleware);
         return this;
     }
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    usePermissions(resolver) {
-        this.permissionResolver = resolver;
-        return this;
-    }
     http(schema, implementation) {
         schema.register(implementation, {
             http: this.httpServer,
             middlewares: this.middlewares,
-            permissionResolver: this.permissionResolver,
         });
         return this;
     }

package/dist/src/server/GGHttp.js.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,MAAM;IAEf;;;;OAIG;IACgB,UAAU,CAAc;IAC1B,WAAW,GAA6B,EAAE,CAAC;IACpD,kBAAkB,CAAmB;IAE7C,YAAY,UAAwB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAEM,GAAG,CAAmC,UAAa;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAW,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAyB;QAC3C,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CACP,MAA+C,EAC/C,cAAmD;QAEnD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC9C,CAAC,CAAC;QACH,OAAO,IAAW,CAAC;IACvB,CAAC;CACJ"}
+{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,MAAM;IAEf;;;;OAIG;IACgB,UAAU,CAAc;IAC1B,WAAW,GAA4B,EAAE,CAAC;IAE3D,YAAY,UAAwB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAEM,GAAG,CAAkC,UAAa;QACrD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAW,CAAC;IACvB,CAAC;IAEM,IAAI,CACP,MAA+C,EAC/C,cAAmD;QAEnD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,OAAO,IAAW,CAAC;IACvB,CAAC;CACJ"}

package/dist/src/server/GGHttpSchema.startServer.d.ts

@@ -3,8 +3,8 @@
  * This file should only be imported in server (Node.js) context.
  */
 import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
+import { type GGTransportMiddleware } from "@grest-ts/context";
 import { GGHttpServer } from "./GGHttpServer";
-import type { GGScopeResolver } from "./GGHttp";
 export interface GGHttpSchemaConfig {
     /**
      * The HTTP request handler to register with.
@@ -13,16 +13,7 @@ export interface GGHttpSchemaConfig {
     /**
      * Additional middlewares to apply to all routes.
      */
-    middlewares?: GGHttpServerMiddleware[];
-    /**
-     * Optional scope resolver. When set, the gate calls it once per request,
-     * populates GG_PERMISSIONS, and rejects requests whose contract permission
-     * is not satisfied by the resolved scopes.
-     */
-    permissionResolver?: GGScopeResolver;
-}
-export interface GGHttpServerMiddleware {
-    process?(): Promise<void>;
+    middlewares?: GGTransportMiddleware[];
 }
 declare module "../schema/GGHttpSchema" {
     interface GGHttpSchema<TContract extends GGContractApiDefinition> {

package/dist/src/server/GGHttpSchema.startServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAA0D,uBAAuB,EAAE,wBAAwB,EAAqF,MAAM,kBAAkB,CAAC;AAUhO,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAG5C,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,eAAe,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACnC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,OAAO,QAAQ,wBAAwB,CAAC;IACpC,UAAU,YAAY,CAAC,SAAS,SAAS,uBAAuB;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;KACnG;CACJ"}
+{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAQ,uBAAuB,EAAE,wBAAwB,EAAqC,MAAM,kBAAkB,CAAC;AAG9H,OAAO,EAA4B,KAAK,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAOxF,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACzC;AAED,OAAO,QAAQ,wBAAwB,CAAC;IACpC,UAAU,YAAY,CAAC,SAAS,SAAS,uBAAuB;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;KACnG;CACJ"}