@owlmeans/iam 0.1.18-rc.49 → 0.1.18-rc.50

package/README.md

@@ -15,7 +15,7 @@ Provider-agnostic IAM abstraction for the OwlMeans framework — `IamService` in
 ## Installation
 
 ```bash
-bun add @owlmeans/iam@^0.1.18-rc.49
+bun add @owlmeans/iam@^0.1.18-rc.50
 ```
 
 ## Usage
@@ -38,7 +38,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.49
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/iam",
-  "version": "0.1.18-rc.49",
-  "generatedAt": "2026-10-05T08:32:19.105Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-10-05T21:03:06.386Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/iam/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 
 # Using `@owlmeans/iam`
 
-**Install:** `"@owlmeans/iam": "^0.1.18-rc.49"` in `dependencies`
+**Install:** `"@owlmeans/iam": "^0.1.18-rc.50"` in `dependencies`
 
 Provider-agnostic IAM abstraction: the `IamService` interface, the permission and grant shapes, the
 gate-param grammar, `hasPermission`, and the declarations of the provider's runtime IAM API. It

package/build/consts.d.ts

@@ -1,4 +1,4 @@
-import type { IamRuntimeAck, IamRuntimeGrantQuery, IamRuntimeMemberInvite, IamRuntimeMemberParams, IamRuntimeOrganizationCreate, IamRuntimeOrganizationParams, IamRuntimeOrganizationUpdate } from './types.js';
+import type { IamRuntimeAck, IamRuntimeGrantQuery, IamRuntimeMemberInvite, IamRuntimeMemberParams, IamRuntimeOrganizationCreate, IamRuntimeOrganizationParams, IamRuntimeOrganizationUpdate } from './runtime/types.js';
 import type { JSONSchemaType } from 'ajv';
 export declare const DEFAULT_ALIAS = "iam-service";
 export declare const IAM_MODE_KEYCLOAK = "keycloak";

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AAC/M,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AAGzC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAE/C;;;;;;;;GAQG;AACH,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAED,4DAA4D;AAC5D,oBAAY,cAAc;IACxB,wCAAwC;IACxC,MAAM,WAAW;IACjB,0DAA0D;IAC1D,OAAO,YAAY;IACnB,gFAAgF;IAChF,KAAK,UAAU;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;aAC7B,aAAa,EAAE,gBAAgB;aAC/B,YAAY,EAAE,4BAA4B;aAC1C,OAAO,EAAE,oCAAoC;aAC7C,MAAM,EAAE,+CAA+C;aACvD,YAAY,EAAE,sDAAsD;aACpE,WAAW,EAAE,wCAAwC;aACrD,MAAM,EAAE,mCAAmC;aAC3C,YAAY,EAAE,0CAA0C;CAChD,CAAA;AAEV,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAS/E,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAQ/E,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAK3E,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,aAAa,CAK7D,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AACvN,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AAGzC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAE/C;;;;;;;;GAQG;AACH,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAED,4DAA4D;AAC5D,oBAAY,cAAc;IACxB,wCAAwC;IACxC,MAAM,WAAW;IACjB,0DAA0D;IAC1D,OAAO,YAAY;IACnB,gFAAgF;IAChF,KAAK,UAAU;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;aAC7B,aAAa,EAAE,gBAAgB;aAC/B,YAAY,EAAE,4BAA4B;aAC1C,OAAO,EAAE,oCAAoC;aAC7C,MAAM,EAAE,+CAA+C;aACvD,YAAY,EAAE,sDAAsD;aACpE,WAAW,EAAE,wCAAwC;aACrD,MAAM,EAAE,mCAAmC;aAC3C,YAAY,EAAE,0CAA0C;CAChD,CAAA;AAEV,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,kCAAkC,EAAE,cAAc,CAAC,4BAA4B,CAK3F,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAS/E,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAQ/E,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAK3E,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,aAAa,CAK7D,CAAA"}

package/build/facet.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A facet a backend cannot provide: every method throws `IamUnsupported(what)`.
+ *
+ * It throws SYNCHRONOUSLY, because a facet may carry synchronous methods (`subjects.identify`) and a
+ * rejected promise would hand those a value of the wrong type; an awaited call rejects the same way
+ * either way. Caller code turns the refusal into a fallback, exactly as for any other unsupported
+ * operation.
+ */
+export declare const unsupportedFacet: <T extends object>(what: string) => T;
+//# sourceMappingURL=facet.d.ts.map

package/build/facet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facet.d.ts","sourceRoot":"","sources":["../src/facet.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAG,CAK9D,CAAA"}

package/build/facet.js

@@ -0,0 +1,16 @@
+import { IamUnsupported } from './errors.js';
+import { INERT_KEYS } from './consts.local.js';
+/**
+ * A facet a backend cannot provide: every method throws `IamUnsupported(what)`.
+ *
+ * It throws SYNCHRONOUSLY, because a facet may carry synchronous methods (`subjects.identify`) and a
+ * rejected promise would hand those a value of the wrong type; an awaited call rejects the same way
+ * either way. Caller code turns the refusal into a fallback, exactly as for any other unsupported
+ * operation.
+ */
+export const unsupportedFacet = (what) => new Proxy(Object.freeze({}), {
+    get: (_, key) => typeof key === 'symbol' || INERT_KEYS.has(key)
+        ? undefined
+        : () => { throw new IamUnsupported(what); },
+});
+//# sourceMappingURL=facet.js.map

package/build/facet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facet.js","sourceRoot":"","sources":["../src/facet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAmB,IAAY,EAAK,EAAE,CACpE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAM,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;CAC7C,CAAC,CAAA"}

package/build/gate/param.d.ts

@@ -1,31 +1,6 @@
-import { GateParamSource } from '../consts.js';
-import type { GateResourceSelector, GateParamProblem, ParsedGateParam } from '../types.js';
-/**
- * Read the `@…` half of a gate param.
- *
- * Two forms, and the difference between them is deliberate:
- *
- *   `@enquiryId`        — bare. A FLAT key, searched in `params` then `query`. It is never split on
- *                         a dot, because a query key legally contains one and splitting it would
- *                         change the meaning of selectors already deployed.
- *   `@body:order.id`    — qualified. An explicit source and a nested path.
- *
- * The rule worth remembering: the bare form is lenient and flat, the qualified form is strict and
- * nested.
- */
-export declare const parseGateSelector: (selector: string) => GateResourceSelector | GateParamProblem;
-/**
- * Split a gate param into the permission it checks and where the resource id comes from.
- *
- * Splits at the FIRST `@`. Everything before it is the permission name looked up in the subject's
- * grants; everything after says where to read the resource id at request time. The suffix is the
- * gate's syntax and nothing else's — a permission stored or granted under a name containing one is a
- * key nothing ever looks up.
- */
+import type { GateParamHelper, ParsedGateParam } from './types.js';
+export declare const createGateParamHelper: () => GateParamHelper;
+export declare const gateParamHelper: GateParamHelper;
+/** @deprecated compat:factory-refactor — use `gateParamHelper.parseGateParam(…)` */
 export declare const parseGateParam: (param: string) => ParsedGateParam;
-/** Compose a gate param. The inverse of `parseGateParam` for every selector it accepts. */
-export declare const formatGateParam: (permission: string, selector?: string | {
-    source?: GateParamSource;
-    path: string[];
-}) => string;
 //# sourceMappingURL=param.d.ts.map

package/build/gate/param.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAG1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,aAAc,MAAM,KAAG,oBAAoB,GAAG,gBA6C3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAoB9C,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,eACd,MAAM,aACP,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,KAC/D,MAmBF,CAAA"}
+{"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAA0C,eAAe,EAAE,MAAM,YAAY,CAAA;AAG1G,eAAO,MAAM,qBAAqB,QAAO,eA+FxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,oFAAoF;AACpF,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAAwD,CAAA"}

package/build/gate/param.js

@@ -1,99 +1,83 @@
 import { RESOURCE_PARAM_SEPARATOR, RESOURCE_SOURCE_SEPARATOR, RESOURCE_PATH_SEPARATOR, GateParamErrorCode, DEFAULT_GATE_PARAM_SOURCES } from '../consts.js';
 import { SOURCES } from './consts.local.js';
-/**
- * Read the `@…` half of a gate param.
- *
- * Two forms, and the difference between them is deliberate:
- *
- *   `@enquiryId`        — bare. A FLAT key, searched in `params` then `query`. It is never split on
- *                         a dot, because a query key legally contains one and splitting it would
- *                         change the meaning of selectors already deployed.
- *   `@body:order.id`    — qualified. An explicit source and a nested path.
- *
- * The rule worth remembering: the bare form is lenient and flat, the qualified form is strict and
- * nested.
- */
-export const parseGateSelector = (selector) => {
-    if (selector === '') {
-        return { code: GateParamErrorCode.EmptySelector, detail: 'the selector after "@" is empty' };
-    }
-    const idx = selector.indexOf(RESOURCE_SOURCE_SEPARATOR);
-    if (idx < 0) {
+export const createGateParamHelper = () => {
+    const parseGateSelector = (selector) => {
+        if (selector === '') {
+            return { code: GateParamErrorCode.EmptySelector, detail: 'the selector after "@" is empty' };
+        }
+        const idx = selector.indexOf(RESOURCE_SOURCE_SEPARATOR);
+        if (idx < 0) {
+            return {
+                selector,
+                path: [selector],
+                sources: DEFAULT_GATE_PARAM_SOURCES
+            };
+        }
+        const source = selector.slice(0, idx);
+        const rest = selector.slice(idx + 1);
+        if (!SOURCES.includes(source)) {
+            return {
+                code: GateParamErrorCode.UnknownSource,
+                detail: `"${source}" is not one of ${SOURCES.join(', ')}`
+            };
+        }
+        if (rest === '') {
+            return {
+                code: GateParamErrorCode.EmptySelector,
+                detail: `"${source}:" names no path`
+            };
+        }
+        const path = rest.split(RESOURCE_PATH_SEPARATOR);
+        if (path.some(segment => segment === '')) {
+            return {
+                code: GateParamErrorCode.EmptySegment,
+                detail: `"${rest}" has an empty path segment`
+            };
+        }
         return {
             selector,
-            path: [selector],
-            sources: DEFAULT_GATE_PARAM_SOURCES
+            source: source,
+            path,
+            sources: [source]
         };
-    }
-    const source = selector.slice(0, idx);
-    const rest = selector.slice(idx + 1);
-    if (!SOURCES.includes(source)) {
-        return {
-            code: GateParamErrorCode.UnknownSource,
-            detail: `"${source}" is not one of ${SOURCES.join(', ')}`
-        };
-    }
-    if (rest === '') {
-        return {
-            code: GateParamErrorCode.EmptySelector,
-            detail: `"${source}:" names no path`
-        };
-    }
-    const path = rest.split(RESOURCE_PATH_SEPARATOR);
-    if (path.some(segment => segment === '')) {
+    };
+    const parseGateParam = (param) => {
+        const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR);
+        if (idx < 0) {
+            return { permission: param };
+        }
+        const permission = param.slice(0, idx);
+        const selector = param.slice(idx + 1);
+        const parsed = parseGateSelector(selector);
+        if ('code' in parsed) {
+            return { permission, resourceParam: selector, error: parsed };
+        }
         return {
-            code: GateParamErrorCode.EmptySegment,
-            detail: `"${rest}" has an empty path segment`
+            permission,
+            // Kept for readers written against the flat form. Only meaningful when the form IS flat.
+            ...(parsed.source == null ? { resourceParam: selector } : {}),
+            resource: parsed
         };
-    }
-    return {
-        selector,
-        source: source,
-        path,
-        sources: [source]
     };
-};
-/**
- * Split a gate param into the permission it checks and where the resource id comes from.
- *
- * Splits at the FIRST `@`. Everything before it is the permission name looked up in the subject's
- * grants; everything after says where to read the resource id at request time. The suffix is the
- * gate's syntax and nothing else's — a permission stored or granted under a name containing one is a
- * key nothing ever looks up.
- */
-export const parseGateParam = (param) => {
-    const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR);
-    if (idx < 0) {
-        return { permission: param };
-    }
-    const permission = param.slice(0, idx);
-    const selector = param.slice(idx + 1);
-    const parsed = parseGateSelector(selector);
-    if ('code' in parsed) {
-        return { permission, resourceParam: selector, error: parsed };
-    }
-    return {
-        permission,
-        // Kept for readers written against the flat form. Only meaningful when the form IS flat.
-        ...(parsed.source == null ? { resourceParam: selector } : {}),
-        resource: parsed
+    const formatGateParam = (permission, selector) => {
+        if (selector == null) {
+            return permission;
+        }
+        if (typeof selector === 'string') {
+            return selector === '' ? permission : `${permission}${RESOURCE_PARAM_SEPARATOR}${selector}`;
+        }
+        if (selector.path.length < 1) {
+            return permission;
+        }
+        const path = selector.path.join(RESOURCE_PATH_SEPARATOR);
+        const tail = selector.source == null
+            ? path
+            : `${selector.source}${RESOURCE_SOURCE_SEPARATOR}${path}`;
+        return `${permission}${RESOURCE_PARAM_SEPARATOR}${tail}`;
     };
+    return { parseGateSelector, parseGateParam, formatGateParam };
 };
-/** Compose a gate param. The inverse of `parseGateParam` for every selector it accepts. */
-export const formatGateParam = (permission, selector) => {
-    if (selector == null) {
-        return permission;
-    }
-    if (typeof selector === 'string') {
-        return selector === '' ? permission : `${permission}${RESOURCE_PARAM_SEPARATOR}${selector}`;
-    }
-    if (selector.path.length < 1) {
-        return permission;
-    }
-    const path = selector.path.join(RESOURCE_PATH_SEPARATOR);
-    const tail = selector.source == null
-        ? path
-        : `${selector.source}${RESOURCE_SOURCE_SEPARATOR}${path}`;
-    return `${permission}${RESOURCE_PARAM_SEPARATOR}${tail}`;
-};
+export const gateParamHelper = createGateParamHelper();
+/** @deprecated compat:factory-refactor — use `gateParamHelper.parseGateParam(…)` */
+export const parseGateParam = (param) => gateParamHelper.parseGateParam(param);
 //# sourceMappingURL=param.js.map

package/build/gate/param.js.map

@@ -1 +1 @@
-{"version":3,"file":"param.js","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC3D,kBAAkB,EAAE,0BAA0B,EAChE,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAA2C,EAAE;IAC7F,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACvD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ;YACR,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,0BAA0B;SACpC,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAEpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;YACtC,MAAM,EAAE,IAAI,MAAM,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1D,CAAA;IACH,CAAC;IAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;YACtC,MAAM,EAAE,IAAI,MAAM,kBAAkB;SACrC,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAChD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;YACrC,MAAM,EAAE,IAAI,IAAI,6BAA6B;SAC9C,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAyB;QACjC,IAAI;QACJ,OAAO,EAAE,CAAC,MAAyB,CAAC;KACrC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACnD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAE1C,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC/D,CAAC;IAED,OAAO;QACL,UAAU;QACV,yFAAyF;QACzF,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,QAAQ,EAAE,MAAM;KACjB,CAAA;AACH,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAkB,EAClB,QAAgE,EACxD,EAAE;IACV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,wBAAwB,GAAG,QAAQ,EAAE,CAAA;IAC7F,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI;QAClC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,yBAAyB,GAAG,IAAI,EAAE,CAAA;IAE3D,OAAO,GAAG,UAAU,GAAG,wBAAwB,GAAG,IAAI,EAAE,CAAA;AAC1D,CAAC,CAAA"}
+{"version":3,"file":"param.js","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC3D,kBAAkB,EAAE,0BAA0B,EAChE,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAA2C,EAAE;QACtF,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;QAC9F,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;QACvD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ;gBACR,IAAI,EAAE,CAAC,QAAQ,CAAC;gBAChB,OAAO,EAAE,0BAA0B;aACpC,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAEpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;gBACtC,MAAM,EAAE,IAAI,MAAM,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC1D,CAAA;QACH,CAAC;QAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;gBACtC,MAAM,EAAE,IAAI,MAAM,kBAAkB;aACrC,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;gBACrC,MAAM,EAAE,IAAI,IAAI,6BAA6B;aAC9C,CAAA;QACH,CAAC;QAED,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,MAAyB;YACjC,IAAI;YACJ,OAAO,EAAE,CAAC,MAAyB,CAAC;SACrC,CAAA;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QACnD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAE1C,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC/D,CAAC;QAED,OAAO;YACL,UAAU;YACV,yFAAyF;YACzF,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,MAAM;SACjB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,CACtB,UAAkB,EAClB,QAAgE,EACxD,EAAE;QACV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,wBAAwB,GAAG,QAAQ,EAAE,CAAA;QAC7F,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,yBAAyB,GAAG,IAAI,EAAE,CAAA;QAE3D,OAAO,GAAG,UAAU,GAAG,wBAAwB,GAAG,IAAI,EAAE,CAAA;IAC1D,CAAC,CAAA;IAED,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;AAC/D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAA;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA"}

package/build/gate/resolve.d.ts

@@ -1,4 +1,4 @@
-import type { GateRequestLike, GateResourceSelector, GateResourceResolution } from '../types.js';
+import type { GateRequestLike, GateResourceSelector, GateResourceResolution } from './types.js';
 /**
  * Resolve the resource id a selector points at.
  *

package/build/gate/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA4EhG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QACzB,eAAe,YAAY,oBAAoB,KACnD,sBA2BF,CAAA"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AA4E/F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QACzB,eAAe,YAAY,oBAAoB,KACnD,sBA2BF,CAAA"}

package/build/gate/types.d.ts

@@ -0,0 +1,109 @@
+import type { GateParamSource, GateParamErrorCode, GateResolutionFailure } from '../consts.js';
+/**
+ * The parts of a request a gate selector may read.
+ *
+ * Structural on purpose: `AbstractRequest` is assignable to it, so `@owlmeans/server-iam` passes its
+ * request straight through, while tooling outside the server stack can resolve a selector against a
+ * plain object without taking a dependency on `@owlmeans/entrypoint`.
+ */
+export interface GateRequestLike {
+    params?: unknown;
+    query?: unknown;
+    body?: unknown;
+    headers?: unknown;
+    auth?: unknown;
+}
+/** Where one gate param reads its resource id from. */
+export interface GateResourceSelector {
+    /** The selector text exactly as written, for diagnostics. */
+    readonly selector: string;
+    /** Undefined for the bare form, which searches `sources` in order. */
+    readonly source?: GateParamSource;
+    /** Length 1 and UNSPLIT for the bare form — a bare key may legally contain dots. */
+    readonly path: string[];
+    /** The explicit source, or `DEFAULT_GATE_PARAM_SOURCES`. */
+    readonly sources: GateParamSource[];
+}
+export interface GateParamProblem {
+    code: GateParamErrorCode;
+    detail: string;
+}
+export interface ParsedGateParam {
+    permission: string;
+    /**
+     * @deprecated The bare-form flat key, kept so existing readers keep compiling. Read `resource`,
+     * which carries the source and the path for both forms.
+     */
+    resourceParam?: string;
+    resource?: GateResourceSelector;
+    error?: GateParamProblem;
+}
+export interface GateResourceResolution {
+    id?: string;
+    from?: GateParamSource;
+    reason?: GateResolutionFailure;
+}
+/** What an entrypoint declares, so a selector can be checked against it before it is ever deployed. */
+export interface GateParamAudit {
+    routePath?: string;
+    routeParams?: string[];
+    filter?: {
+        query?: object;
+        params?: object;
+        body?: object;
+        headers?: object;
+    };
+}
+export interface GateParamIssue {
+    param: string;
+    code: GateParamErrorCode;
+    detail: string;
+}
+/** The gate-param grammar: `<permission>@<selector>` read, written and taken apart. */
+export interface GateParamHelper {
+    /**
+     * Read the `@…` half of a gate param.
+     *
+     * Two forms, and the difference between them is deliberate:
+     *
+     *   `@enquiryId`        — bare. A FLAT key, searched in `params` then `query`. It is never split on
+     *                         a dot, because a query key legally contains one and splitting it would
+     *                         change the meaning of selectors already deployed.
+     *   `@body:order.id`    — qualified. An explicit source and a nested path.
+     *
+     * The rule worth remembering: the bare form is lenient and flat, the qualified form is strict and
+     * nested.
+     */
+    parseGateSelector: (selector: string) => GateResourceSelector | GateParamProblem;
+    /**
+     * Split a gate param into the permission it checks and where the resource id comes from.
+     *
+     * Splits at the FIRST `@`. Everything before it is the permission name looked up in the subject's
+     * grants; everything after says where to read the resource id at request time. The suffix is the
+     * gate's syntax and nothing else's — a permission stored or granted under a name containing one is a
+     * key nothing ever looks up.
+     */
+    parseGateParam: (param: string) => ParsedGateParam;
+    /** Compose a gate param. The inverse of `parseGateParam` for every selector it accepts. */
+    formatGateParam: (permission: string, selector?: string | {
+        source?: GateParamSource;
+        path: string[];
+    }) => string;
+}
+/** Gate params checked against the entrypoint that declares them. */
+export interface GateValidationHelper {
+    /** The `:name` segments of a route template. */
+    routeParamsOf: (path: string) => string[];
+    /**
+     * Check gate params against what their entrypoint declares.
+     *
+     * Reports only what is provable from the declaration itself. Anything that would need a guess is
+     * left alone: a check that fires on correct code stops being read.
+     *
+     * Meant to run where a mistake can still be fixed — while code is being generated, or once per alias
+     * as a diagnostic. It must never decide a request: with `some()` semantics across params, one
+     * malformed sibling must not be able to refuse a legitimately passing one.
+     */
+    validateGateParams: (params: string[], audit?: GateParamAudit) => GateParamIssue[];
+}
+//# sourceMappingURL=types.d.ts.map

package/build/gate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/gate/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAE9F;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAC/B;AAED,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,oBAAoB,GAAG,gBAAgB,CAAA;IAChF;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,eAAe,CAAA;IAClD,2FAA2F;IAC3F,eAAe,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,KAC7D,MAAM,CAAA;CACZ;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;IACzC;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,cAAc,KAAK,cAAc,EAAE,CAAA;CACnF"}

package/build/gate/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/gate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/gate/types.ts"],"names":[],"mappings":""}

package/build/gate/validate.d.ts

@@ -1,15 +1,4 @@
-import type { GateParamAudit, GateParamIssue } from '../types.js';
-/** The `:name` segments of a route template. */
-export declare const routeParamsOf: (path: string) => string[];
-/**
- * Check gate params against what their entrypoint declares.
- *
- * Reports only what is provable from the declaration itself. Anything that would need a guess is
- * left alone: a check that fires on correct code stops being read.
- *
- * Meant to run where a mistake can still be fixed — while code is being generated, or once per alias
- * as a diagnostic. It must never decide a request: with `some()` semantics across params, one
- * malformed sibling must not be able to refuse a legitimately passing one.
- */
-export declare const validateGateParams: (params: string[], audit?: GateParamAudit) => GateParamIssue[];
+import type { GateValidationHelper } from './types.js';
+export declare const createGateValidationHelper: () => GateValidationHelper;
+export declare const gateValidationHelper: GateValidationHelper;
 //# sourceMappingURL=validate.d.ts.map

package/build/gate/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAA;AAIvF,gDAAgD;AAChD,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,EAGH,CAAA;AAqFhD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,EAAE,UAAU,cAAc,KAAG,cAAc,EAsB3F,CAAA"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAwD,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAI5G,eAAO,MAAM,0BAA0B,QAAO,oBAkH7C,CAAA;AAED,eAAO,MAAM,oBAAoB,sBAA+B,CAAA"}