@kindgi/api 0.1.4-rc.5 → 0.1.5-rc.0

package/dist/routes/gate-policies.js

@@ -21,7 +21,10 @@ const ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
  *   POST /:policyId/versions/:version/unregister|reinstate
  *
  * Writes need `admin` on the tenant: whoever may promote mustn't be able
- * to loosen the gate on their own promotion.
+ * to loosen the gate on their own promotion. Reads need `read` on the
+ * policy's scope (a segment's: its project), as judge classes do: one the
+ * caller can't read answers 404, as if it weren't there, and the list
+ * shows only those they can.
  */
 export function gatePoliciesRouter(binding, authorizer) {
     const r = new Hono();
@@ -33,6 +36,9 @@ export function gatePoliciesRouter(binding, authorizer) {
             return authorizer.authorize('admin', () => ref('tenant', tenantId))(c, next);
         });
     }
+    /** Whether the caller may read a policy: `read` on its scope. */
+    const canRead = async (c, policy) => authorizer === undefined ||
+        authorizer.can(c, 'read', scopeRef(c.get('tenantId'), policy.scope));
     r.get('/', async (c) => {
         const requestId = c.get('requestId');
         const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
@@ -47,8 +53,11 @@ export function gatePoliciesRouter(binding, authorizer) {
             ...(scope.scope !== undefined && { scope: scope.scope }),
             ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor }),
         });
+        const visible = authorizer === undefined
+            ? page.data
+            : await authorizer.filterByCan(c, 'read', page.data, (p) => scopeRef(c.get('tenantId'), p.scope));
         return c.json({
-            data: page.data.map(serializeGatePolicy),
+            data: visible.map(serializeGatePolicy),
             hasMore: page.nextCursor !== undefined,
             ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
         });
@@ -58,7 +67,7 @@ export function gatePoliciesRouter(binding, authorizer) {
             tenantId: c.get('tenantId'),
             id: c.req.param('policyId'),
         });
-        if (found === null)
+        if (found === null || !(await canRead(c, found)))
             return notFound(c, c.req.param('policyId'));
         return c.json(serializeGatePolicy(found));
     });
@@ -67,8 +76,11 @@ export function gatePoliciesRouter(binding, authorizer) {
             tenantId: c.get('tenantId'),
             id: c.req.param('policyId'),
         });
-        if (versions.length === 0)
+        // A policy's versions share its scope (`gate-policy-scope-changed`).
+        const first = versions[0];
+        if (first === undefined || !(await canRead(c, first))) {
             return notFound(c, c.req.param('policyId'));
+        }
         return c.json({ data: versions.map(serializeGatePolicy), hasMore: false });
     });
     r.get('/:policyId/versions/:version', async (c) => {
@@ -77,7 +89,7 @@ export function gatePoliciesRouter(binding, authorizer) {
             id: c.req.param('policyId'),
             version: c.req.param('version'),
         });
-        if (found === null) {
+        if (found === null || !(await canRead(c, found))) {
             return notFound(c, c.req.param('policyId'), c.req.param('version'));
         }
         return c.json(serializeGatePolicy(found));
@@ -123,6 +135,18 @@ export function gatePoliciesRouter(binding, authorizer) {
     }
     return r;
 }
+/** The resource a gate policy's scope is: what reading it needs `read` on. */
+function scopeRef(tenantId, scope) {
+    switch (scope.kind) {
+        case 'tenant':
+            return ref('tenant', tenantId);
+        case 'org':
+            return ref('org', scope.orgId);
+        case 'project':
+        case 'segment':
+            return ref('project', scope.projectId);
+    }
+}
 function badInput(c, requestId, message) {
     c.status(statusFor('bad-input'));
     return c.json(toWireError({ code: 'bad-input', message }, requestId));

package/dist/routes/gate-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-policies.js","sourceRoot":"","sources":["../../src/routes/gate-policies.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0B,EAC1B,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YACxD,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACzG,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,GAAG,MAAM,CAAC,KAAK;SAChB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,EAAE,WAAW,CAAU,EAAE,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,gCAAgC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;gBACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAID,SAAS,QAAQ,CAAC,CAAM,EAAE,SAAiB,EAAE,OAAe;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,QAAgB,EAAE,OAAgB;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,0BAA0B,QAAQ,GAAG;YACvC,CAAC,CAAC,gBAAgB,QAAQ,oBAAoB,OAAO,EAAE;QAC3D,QAAQ;KACT,EACD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAM,EAAE,SAAiB,EAAE,KAAsB;IAC/D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACtD,CAAC;AAID,SAAS,gBAAgB,CAAC,IAAa;IAMrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,8BAA8B,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gate-policies.js","sourceRoot":"","sources":["../../src/routes/gate-policies.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0B,EAC1B,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YACxD,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,CAAM,EAAE,MAAqC,EAAoB,EAAE,CACxF,UAAU,KAAK,SAAS;QACxB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAEnF,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,OAAO,GACX,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACvD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CACjD,CAAC;QACR,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YAC1C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,gCAAgC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACzG,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;YACvC,GAAG,MAAM,CAAC,KAAK;SAChB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,EAAE,WAAW,CAAU,EAAE,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,gCAAgC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;gBACvC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAID,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,QAAkB,EAAE,KAAgB;IACpD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;QACtD,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAA0B,CAAC,CAAC;QACtD,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,SAA8B,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,SAAiB,EAAE,OAAe;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAM,EAAE,QAAgB,EAAE,OAAgB;IAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,0BAA0B,QAAQ,GAAG;YACvC,CAAC,CAAC,gBAAgB,QAAQ,oBAAoB,OAAO,EAAE;QAC3D,QAAQ;KACT,EACD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAM,EAAE,SAAiB,EAAE,KAAsB;IAC/D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AACtD,CAAC;AAID,SAAS,gBAAgB,CAAC,IAAa;IAMrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,GAAG,8BAA8B,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,EAAE,EAAE,CAAC,CAAC,EAAY;YAClB,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAiB;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;SACzE;KACF,CAAC;AACJ,CAAC"}

package/dist/routes/guardrails.d.ts

@@ -1,21 +1,9 @@
 import { Hono } from 'hono';
+import { type Guardrail, type GuardrailConfigProblem } from '@kindgi/guardrails';
 import type { GuardrailId, TenantId } from '@kindgi/types';
 import type { GuardrailRegistryBinding } from '../guardrail-binding.js';
 import type { Authorizer } from '../middleware/authorize.js';
 import type { AppEnv } from '../types.js';
-/**
- * Guardrails resource routes, paired with tools.
- *
- * Registry storage is caller-plugged via `GuardrailRegistryBinding`.
- * The API package does not own persistence — deployments wire a durable
- * store; tests can wrap an in-memory one.
- *
- * Registration is metadata-only: the body is a full `Guardrail` shape
- * (id + kind + check-id + action). The actual `check` implementation
- * must already be registered with the runtime — deployments publish
- * guardrails whose check code is already bundled server-side. Check
- * code is not uploaded over this surface.
- */
 /**
  * Optional side-effect callback fired after a successful write
  * (register, unregister) to a guardrail. Lets an in-process
@@ -29,5 +17,19 @@ export type GuardrailWriteHook = (params: {
     readonly guardrailId: GuardrailId;
     readonly kind: 'register' | 'unregister';
 }) => void | Promise<void>;
-export declare function guardrailsRouter(binding: GuardrailRegistryBinding, authorizer?: Authorizer, onWrite?: GuardrailWriteHook): Hono<AppEnv>;
+/**
+ * Checks a guardrail being registered against the check it names: every
+ * way its `config` breaks that check's `configSchema` (a pack check's,
+ * from its deployment), via `guardrailConfigProblems`. Any problem
+ * refuses the registration with `422 guardrail-config-invalid`
+ * (`details.issues`). Absent, or nothing to check against (an unknown
+ * check, a check without a schema): no problems. A guardrail naming a
+ * built-in check is checked by the route itself, against the built-in's
+ * schema, whatever the runtime passes here.
+ */
+export type GuardrailConfigCheck = (input: {
+    readonly tenantId: TenantId;
+    readonly guardrail: Guardrail;
+}) => Promise<readonly GuardrailConfigProblem[]>;
+export declare function guardrailsRouter(binding: GuardrailRegistryBinding, authorizer?: Authorizer, onWrite?: GuardrailWriteHook, checkConfig?: GuardrailConfigCheck): Hono<AppEnv>;
 //# sourceMappingURL=guardrails.d.ts.map

package/dist/routes/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAU,WAAW,EAAa,QAAQ,EAAU,MAAM,eAAe,CAAC;AAGtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;;;;;;;;;GAYG;AACH;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CAAC,MAAM,CAAC,CAsQd"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,sBAAsB,EAI5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAU,WAAW,EAAa,QAAQ,EAAU,MAAM,eAAe,CAAC;AAGtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAoB1C;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,KAAK,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC;AAEjD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,WAAW,CAAC,EAAE,oBAAoB,GACjC,IAAI,CAAC,MAAM,CAAC,CAwSd"}

package/dist/routes/guardrails.js

@@ -2,12 +2,27 @@
 // Copyright (C) 2026 Kindgi Inc.
 import { Hono } from 'hono';
 import { ref, tuplesForCreate } from '@kindgi/authz';
-import { validateGuardrailSpec } from '@kindgi/guardrails';
+import { createCheckRegistry, describeGuardrailConfigProblems, validateGuardrailSpec, } from '@kindgi/guardrails';
 import { statusFor, toWireError } from '../errors.js';
 import { refuseWritesWhenReadOnly } from '../registry-read-only.js';
 import { clampLimit } from './pagination.js';
 import { parseScopeParams } from './scope-params.js';
-export function guardrailsRouter(binding, authorizer, onWrite) {
+/**
+ * Guardrails resource routes, paired with tools.
+ *
+ * Registry storage is caller-plugged via `GuardrailRegistryBinding`.
+ * The API package does not own persistence — deployments wire a durable
+ * store; tests can wrap an in-memory one.
+ *
+ * Registration is metadata-only: the body is a full `Guardrail` shape
+ * (id + kind + check-id + action). The actual `check` implementation
+ * must already be registered with the runtime — deployments publish
+ * guardrails whose check code is already bundled server-side. Check
+ * code is not uploaded over this surface.
+ */
+/** The built-in checks, for the config of a guardrail naming one. */
+const builtInChecks = createCheckRegistry();
+export function guardrailsRouter(binding, authorizer, onWrite, checkConfig) {
     const r = new Hono();
     // A read-only registry (under `kindgi dev`, the pack's files) refuses
     // every write before anything else runs.
@@ -83,8 +98,12 @@ export function guardrailsRouter(binding, authorizer, onWrite) {
             ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
             ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
         });
+        // Only what the caller may read (T243 A), as `GET …/:id` asks.
+        const visible = authorizer === undefined
+            ? page.data
+            : await authorizer.filterByCan(c, 'read', page.data, (a) => ref('guardrail', a.id));
         return c.json({
-            data: page.data.map(serializeGuardrail),
+            data: visible.map(serializeGuardrail),
             hasMore: page.nextCursor !== undefined,
             ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
         });
@@ -144,6 +163,23 @@ export function guardrailsRouter(binding, authorizer, onWrite) {
                 issues: validated.error.issues,
             }, requestId));
         }
+        // A built-in check's config is the route's to check (its schema ships with
+        // `@kindgi/guardrails`); any other check's, the runtime's.
+        const builtIn = builtInChecks.get(validated.value.check);
+        const problems = builtIn?.configProblems !== undefined
+            ? builtIn.configProblems(validated.value.config)
+            : await checkConfig?.({ tenantId, guardrail: validated.value });
+        if (problems !== undefined && problems.length > 0) {
+            c.status(statusFor('guardrail-config-invalid'));
+            return c.json(toWireError({
+                code: 'guardrail-config-invalid',
+                message: describeGuardrailConfigProblems({
+                    guardrailId: validated.value.id,
+                    check: validated.value.check,
+                }, problems),
+                issues: problems,
+            }, requestId));
+        }
         const principal = c.get('principal');
         const creatorUserId = principal?.actor.kind === 'user' ? principal.actor.id : undefined;
         const outcome = await binding.register({

package/dist/routes/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAkB,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA6BrD,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,UAAuB,EACvB,OAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,sEAAsE;IACtE,yCAAyC;IACzC,CAAC,CAAC,GAAG,CACH,GAAG,EACH,wBAAwB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjD,CAAC;IAEF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC,WAAgC,GAAG;gBAChF,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO;gBAChC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAA8C;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,KAAK;YAC1B,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAC1E,aAAa,CACd;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,cAAc,OAAO,CAAC,WAAgC,yBAAyB;gBACxF,WAAW,EAAE,OAAO,CAAC,WAAgC;aACtD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,mDAAmD;YACnD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,OAAO,CAAC,WAAgC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,WAAgC,iBAAiB;gBAC3E,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,WAAgC;YAC7C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY;IACtC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAGL,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,qEAAqE;AACrE,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;AA+B5C,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,UAAuB,EACvB,OAA4B,EAC5B,WAAkC;IAElC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,sEAAsE;IACtE,yCAAyC;IACzC,CAAC,CAAC,GAAG,CACH,GAAG,EACH,wBAAwB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CACjD,CAAC;IAEF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,+DAA+D;QAC/D,MAAM,OAAO,GACX,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACvD,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAuB,CAAC,CAC5C,CAAC;QACR,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC,WAAgC,GAAG;gBAChF,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO;gBAChC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAA8C;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,QAAQ,GACZ,OAAO,EAAE,cAAc,KAAK,SAAS;YACnC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,0BAA0B,CAAU,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,+BAA+B,CACtC;oBACE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAuB;oBACpD,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK;iBAC7B,EACD,QAAQ,CACT;gBACD,MAAM,EAAE,QAAgD;aACzD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,KAAK;YAC1B,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAC1E,aAAa,CACd;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,cAAc,OAAO,CAAC,WAAgC,yBAAyB;gBACxF,WAAW,EAAE,OAAO,CAAC,WAAgC;aACtD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,mDAAmD;YACnD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,OAAO,CAAC,WAAgC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,WAAgC,iBAAiB;gBAC3E,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,WAAgC;YAC7C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY;IACtC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/routes/identity.d.ts

@@ -1,5 +1,7 @@
 import { Hono } from 'hono';
 import type { IdentityDirectoryBinding } from '../identity-directory-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { PersonGrantsBinding } from '../person-grants-binding.js';
 import type { ReviewerBinding } from '../reviewer-binding.js';
 import type { SessionStoreBinding } from '../session-store-binding.js';
 import type { AppEnv } from '../types.js';
@@ -10,12 +12,16 @@ import type { AppEnv } from '../types.js';
  * `whoami` endpoint, so clients have exactly one whoami endpoint to
  * consume.
  *
- * Five routes:
+ * Six routes:
  *   - `GET  /v1/identity/whoami`                        (self — always mounted)
- *   - `GET  /v1/identity/users`                         (cursor-paginated list)
- *   - `GET  /v1/identity/users/:userId`                 (get)
- *   - `GET  /v1/identity/users/:userId/sessions`        (active sessions)
+ *   - `GET  /v1/identity/users`                         (cursor-paginated list; tenant admins)
+ *   - `POST /v1/identity/users`                         (add a person; admin, when the directory can)
+ *   - `GET  /v1/identity/users/:userId`                 (get; a tenant admin, or your own)
+ *   - `GET  /v1/identity/users/:userId/sessions`        (active sessions; a tenant admin, or your own)
  *   - `POST /v1/identity/users/:userId/revoke-sessions` (admin op)
+ *   - `GET  /v1/identity/users/:userId/grants`          (admin, or your own)
+ *   - `POST /v1/identity/users/:userId/grant|ungrant`   (tenant admin, tenant admins only)
+ *   - `POST /v1/identity/users/:userId/unregister`      (remove a person; tenant admins, when the directory can)
  *
  * `directory` is optional: deployments without an `IdentityDirectoryBinding`
  * still get `whoami` (returning the minimal `{ tenantId, scopes, ... }` shape
@@ -41,6 +47,16 @@ export interface IdentityRouterOptions {
      * routes resolve it.
      */
     readonly reviewerBinding?: ReviewerBinding;
+    /**
+     * Optional. Decides who is a tenant admin for `POST /users`; without
+     * one, the `tenant-admin` scope does.
+     */
+    readonly authorizer?: Authorizer;
+    /**
+     * Optional. A person's grants: the read, and tenant admin given or
+     * taken. Without it, those routes answer `501 person-grants-unsupported`.
+     */
+    readonly personGrants?: PersonGrantsBinding;
 }
 export declare function identityRouter(options?: IdentityRouterOptions): Hono<AppEnv>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/routes/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/routes/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC5C;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,IAAI,CAAC,MAAM,CAAC,CA+HhF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/routes/identity.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAIV,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,IAAI,CAAC,MAAM,CAAC,CA2QhF"}