@procedures/client 0.8.0 → 0.9.0

package/dist/server/host-policy.d.ts

@@ -12,6 +12,8 @@
  *   procedures (a host for an outside caller sets it).
  * - `timeout`: the time limit of each call from a caller (not of its nested calls).
  * - `token`, `browser`: the checks of the network transports (`client-server` applies them).
+ * - `principalOf`: the request hook. It reads the credentials of a network request (a cookie, a
+ *   header, the query) and gives a bearer token, a principal and a narrowing.
  * - `capability`, `readOnly`, `clearanceOrder`, `resources`, `admitItem`: the capability of each
  *   call and what the host gives for it (CAPABILITIES-2026-10).
  * - `events`: the remote events of the host (`documentation/EVENTS.md`). The server pins
@@ -19,7 +21,7 @@
  */
 import type { Capability, ClearanceOrder, ProcedurePath, ResourcesOf } from "../procedures/types.js";
 import type { AdmitItem, Interceptor, Invocation } from "../procedures/invoke.js";
-import type { ServerRequest } from "./types.js";
+import type { PrincipalOf, ServerRequest } from "./types.js";
 import type { BrowserGuardOptions } from "./browser-guard.js";
 import type { ProcedureRegistry } from "../procedures/registry.js";
 import type { ProcedureServerOptions } from "./procedure-server.js";
@@ -48,6 +50,11 @@ export interface HostPolicyOptions {
     interceptors?: readonly Interceptor[] | undefined;
     /** The token that each network request must send (HTTP and WebSocket transports). */
     token?: string | undefined;
+    /**
+     * The request hook: it reads the credentials of each network request (a cookie, a header, the
+     * query) and gives a bearer token, a principal and a narrowing (`ProcedureServerOptions`).
+     */
+    principalOf?: PrincipalOf | undefined;
     /** The browser checks of the network transports (`allowedOrigins`, `allowedHosts`, `allowGet`). */
     browser?: BrowserGuardOptions | undefined;
     /**
@@ -77,6 +84,8 @@ export interface HostPolicy {
     readonly strictCalls: boolean;
     readonly interceptors: readonly Interceptor[];
     readonly token: string | undefined;
+    /** The request hook of the network requests, or undefined for none. */
+    readonly principalOf?: PrincipalOf | undefined;
     readonly browser: BrowserGuardOptions;
     /** The capability of a call from a caller, or undefined for no limits. */
     readonly capabilityOf: ((request?: ServerRequest<unknown>) => Capability | undefined) | undefined;

package/dist/server/host-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-policy.d.ts","sourceRoot":"","sources":["../../src/server/host-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAElF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAErD,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzC;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAc5F;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAIlF;AAED,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1F,uEAAuE;IACvE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qGAAqG;IACrG,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,oEAAoE;IACpE,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAClD,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mGAAmG;IACnG,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpG,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,yCAAyC;IACzC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAClE,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC5C;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAClG,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IAC1C,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACpD;AA4BD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAkBtE;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,sBAAsB,CAgB/G"}
+{"version":3,"file":"host-policy.d.ts","sourceRoot":"","sources":["../../src/server/host-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAElF,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAErD,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACzC;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAc5F;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAIlF;AAED,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1F,uEAAuE;IACvE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,qGAAqG;IACrG,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,oEAAoE;IACpE,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAClD,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,mGAAmG;IACnG,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpG,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,yCAAyC;IACzC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAClE,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC5C;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAClG,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IAC1C,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACpD;AA4BD,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAmBtE;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,sBAAsB,CAkB/G"}

package/dist/server/host-policy.js

@@ -12,6 +12,8 @@
  *   procedures (a host for an outside caller sets it).
  * - `timeout`: the time limit of each call from a caller (not of its nested calls).
  * - `token`, `browser`: the checks of the network transports (`client-server` applies them).
+ * - `principalOf`: the request hook. It reads the credentials of a network request (a cookie, a
+ *   header, the query) and gives a bearer token, a principal and a narrowing.
  * - `capability`, `readOnly`, `clearanceOrder`, `resources`, `admitItem`: the capability of each
  *   call and what the host gives for it (CAPABILITIES-2026-10).
  * - `events`: the remote events of the host (`documentation/EVENTS.md`). The server pins
@@ -83,6 +85,7 @@ export function hostPolicy(options = {}) {
         strictCalls: options.strictCalls ?? false,
         interceptors,
         token: options.token,
+        ...(options.principalOf ? { principalOf: options.principalOf } : {}),
         browser: options.browser ?? {},
         capabilityOf: capabilityOfOptions(options),
         clearanceOrder: options.clearanceOrder,
@@ -100,6 +103,8 @@ export function procedureServerOptions(policy, registry) {
         strictCalls: policy.strictCalls,
         // The token of the policy: ProcedureServer examines it for each network request (R18)
         ...(policy.token !== undefined ? { token: policy.token } : {}),
+        // The request hook of the policy: the credentials of a cookie, a header or the query (CLI-2a)
+        ...(policy.principalOf ? { principalOf: policy.principalOf } : {}),
         ...(policy.interceptors.length > 0 ? { interceptors: policy.interceptors } : {}),
         ...(policy.capabilityOf ? { capability: policy.capabilityOf } : {}),
         ...(policy.clearanceOrder ? { clearanceOrder: policy.clearanceOrder } : {}),

package/dist/server/host-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-policy.js","sourceRoot":"","sources":["../../src/server/host-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAKnE,OAAO,EAAE,IAAI,EAAiB,MAAM,gBAAgB,CAAC;AAQrD,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,QAA2B;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,GAAG;YAAE,GAAG,GAAG,IAAI,CAAC;aAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;;YAChE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAwDD,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,OAA0B;IACrD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,IAAI,GAAG,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACzG,OAAO,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,IAAI,GACR,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,MAAM,KAAK,UAAU;YAC5B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACrB,CAAC,CAAC,cAAc,CAAC,MAA2B,CAAC;gBAC7C,CAAC,CAAC,WAAW,CAAC,MAAqB,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,MAAkB,EAAE,QAA4B;IACrF,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,sFAAsF;QACtF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,0FAA0F;QAC1F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"host-policy.js","sourceRoot":"","sources":["../../src/server/host-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAKnE,OAAO,EAAE,IAAI,EAAiB,MAAM,gBAAgB,CAAC;AAQrD,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,QAA2B;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,GAAG;YAAE,GAAG,GAAG,IAAI,CAAC;aAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;;YAChE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AA+DD,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,OAA0B;IACrD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,IAAI,GAAG,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACzG,OAAO,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,IAAI,GACR,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,MAAM,KAAK,UAAU;YAC5B,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACrB,CAAC,CAAC,cAAc,CAAC,MAA2B,CAAC;gBAC7C,CAAC,CAAC,WAAW,CAAC,MAAqB,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,MAAkB,EAAE,QAA4B;IACrF,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,sFAAsF;QACtF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,8FAA8F;QAC9F,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,0FAA0F;QAC1F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/server/index.d.ts

@@ -38,7 +38,7 @@ export type { ServerOptions } from "./server.js";
 export { ProcedureServer, createProcedureServer, STREAM_METADATA_KEY, isUnboundedStream } from "./procedure-server.js";
 export type { ProcedureServerOptions, StorageConfig, StopOptions, UseStorageOptions } from "./procedure-server.js";
 export { pathToMethod, methodToPath } from "./method.js";
-export { HandlerNotFoundError, ServerError, type ServerRequest, type ServerResponse, type RequestHandler, type Credentials, type Principal, type ServerHandler, type ServerMiddleware, type ServerContext, type ServerRunner, type ServerTransport, } from "./types.js";
+export { HandlerNotFoundError, ServerError, type ServerRequest, type ServerResponse, type RequestHandler, type Credentials, type Principal, type PrincipalOf, type RequestIdentity, type AmbientCredentials, type ServerHandler, type ServerMiddleware, type ServerContext, type ServerRunner, type ServerTransport, } from "./types.js";
 export { HttpServerTransport, defaultServerUrlStrategy, rpcServerUrlStrategy, } from "../adapters/http/server/index.js";
 export type { HttpServerTransportOptions, HttpUrlStrategy, } from "../adapters/http/server/index.js";
 export { WebSocketServerTransport } from "../adapters/websocket/server/index.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvH,YAAY,EAAE,sBAAsB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,0BAA0B,EAC1B,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,YAAY,EACV,+BAA+B,EAC/B,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACvH,YAAY,EAAE,sBAAsB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,0BAA0B,EAC1B,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,YAAY,EACV,+BAA+B,EAC/B,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,uCAAuC,CAAC"}

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,WAAW,GAWZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,WAAW,GAcZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/server/procedure-server.d.ts

@@ -5,16 +5,18 @@
  * Integrates with ProcedureRegistry and CollectionStorage backends.
  */
 import { Server, type ServerOptions } from "./server.js";
-import type { Method, Principal, ServerHandler, ServerRequest, ServerResponse } from "./types.js";
+import type { AmbientCredentials, Method, Principal, PrincipalOf, ServerHandler, ServerRequest, ServerResponse } from "./types.js";
 import type { AnyProcedure, ProcedurePath, RepositoryProvider, ProcedureModule } from "../procedures/types.js";
 import { ProcedureRegistry } from "../procedures/registry.js";
 import { type AdmitItem, type Interceptor, type Invocation } from "../procedures/invoke.js";
-import type { Capability, ClearanceOrder, ResourcesOf } from "../procedures/types.js";
+import type { Capability, ClearanceOrder, ProcedureContext, ResourcesOf } from "../procedures/types.js";
+import type { CollectionPartitions } from "../procedures/collection/partition.js";
 import { type IdempotencyOptions } from "../procedures/idempotency.js";
 import { type Duration } from "../duration.js";
 import type { CollectionStorage } from "../procedures/collection/storage.js";
 import { type Clock } from "../clock.js";
 import { EventPublisher, type EventPublisherOptions } from "../events/publisher.js";
+import type { CollectionProceduresOptions } from "../procedures/collection/procedures.js";
 /**
  * Storage configuration for a collection.
  */
@@ -108,6 +110,22 @@ export interface ProcedureServerOptions extends ServerOptions {
      * `request.principal`.
      */
     authenticate?: ((request: ServerRequest<unknown>) => Principal | undefined | Promise<Principal | undefined>) | undefined;
+    /**
+     * The request hook of the server: it reads the credentials of each network request (a cookie, a
+     * header, the query) and gives a bearer token, a principal and a narrowing. It runs before the
+     * token check: its bearer token replaces the bearer token of the credentials. Its principal
+     * replaces the principal of the token check. `authenticate` runs after it and can read
+     * `request.principal`. Undefined or an error refuses the request with `UNAUTHORIZED`. A request
+     * without credentials (from this process) does not go through the hook.
+     */
+    principalOf?: PrincipalOf | undefined;
+    /**
+     * How the server can authenticate a request with ambient credentials (cookies), for the CSRF
+     * checks of the network faces. The default is `"always"` with `principalOf`, `"cookies"` with
+     * `authenticate`, and none without them. `false`: the server reads no cookies, for example an
+     * `authenticate` function that reads only the bearer token.
+     */
+    ambientCredentials?: AmbientCredentials | false | undefined;
     /**
      * The remote events of the server (`documentation/EVENTS.md`): a bus and its topic rule, or an
      * `EventPublisher`. The server pins the procedure `events.subscribe`, outside its registry, so a
@@ -177,6 +195,8 @@ export declare function errorResponse(id: string, error: unknown): ServerRespons
 export declare class ProcedureServer extends Server implements RepositoryProvider {
     private readonly procedureRegistry;
     private readonly storages;
+    /** The partitions of each partitioned collection: their storages and their resolver (roadmap CLI-17) */
+    private readonly partitions;
     /** For each storage: the calls in flight that took it, and the closes that wait for them */
     private readonly storageUses;
     /** The clock of the wait of `useStorage` */
@@ -206,13 +226,19 @@ export declare class ProcedureServer extends Server implements RepositoryProvide
     private draining;
     /** The calls in flight, a stream until its end */
     private inFlight;
-    /** The token of the server, and its authenticate function (R18) */
+    /** The token of the server, its request hook and its authenticate function (R18) */
     private readonly token;
+    private readonly principalOf;
     private readonly authenticate;
     /** The functions that `stop()` waits on: each one runs when no call is in flight */
     private idleWaiters;
     /** The publisher of the remote events, from the option `events`, or undefined. */
     readonly publisher: EventPublisher | undefined;
+    /**
+     * How the server can authenticate a request with ambient credentials (cookies). The network faces
+     * read it: they trust such a request only from a named origin (CSRF).
+     */
+    readonly ambientCredentials: AmbientCredentials | undefined;
     constructor(options?: ProcedureServerOptions);
     /**
      * Get storage for a collection.
@@ -228,6 +254,32 @@ export declare class ProcedureServer extends Server implements RepositoryProvide
      * @param collection - Collection name
      */
     hasCollection(collection: string): boolean;
+    /**
+     * The storage of one partition of a collection (roadmap CLI-17).
+     *
+     * @throws Error if the collection has no partitions
+     */
+    getPartitionStorage<T>(collection: string, partition: string): CollectionStorage<T>;
+    /** True when the collection has partitions (roadmap CLI-17). */
+    hasPartitions(collection: string): boolean;
+    /**
+     * The partition of a call to a partitioned collection (roadmap CLI-17), from the resolver of
+     * `usePartitions`. `null` refuses the call.
+     *
+     * @throws Error if the collection has no partitions
+     */
+    resolvePartition(collection: string, ctx: ProcedureContext, requested: string | undefined): string | undefined | null | Promise<string | undefined | null>;
+    /**
+     * Configure the partitions of a collection (roadmap CLI-17). `resolve` gives the partition of
+     * each call from its context (the tenant of `ctx.principal`) and the partition that the call asks
+     * for: the collection procedures and the subscriptions of `EventPublisher` use it. `storageOf`
+     * gives the storage of a partition: give the same storage for the same partition each time.
+     *
+     * @param name - Collection name
+     * @param partitions - The storage of each partition, and the resolver
+     * @returns this (for chaining)
+     */
+    usePartitions<T>(name: string, partitions: CollectionPartitions<T>): this;
     /**
      * Configure storage for a collection.
      *
@@ -316,9 +368,11 @@ export declare class ProcedureServer extends Server implements RepositoryProvide
      */
     private invoke;
     /**
-     * The token check and the principal of a request (roadmap R18). A network request (with
-     * credentials) must present the token. The authenticate function gives the principal. The
-     * function gives an UNAUTHORIZED response, or undefined when the request passes.
+     * The token check and the principal of a request (roadmap R18). The request hook reads the
+     * credentials of a network request first: a bearer token, a principal and a narrowing. A
+     * network request (with credentials) must present the token. The authenticate function gives
+     * the principal. The function gives an UNAUTHORIZED response, or undefined when the request
+     * passes.
      */
     private admit;
     /** One call in flight ended: `stop()` can go on when it was the last one. */
@@ -333,6 +387,12 @@ export declare class ProcedureServer extends Server implements RepositoryProvide
      * still stops with its caller, because nobody can read it again.
      */
     private runKeyed;
+    /**
+     * The capability of a request. It comes from the server, never from the request. The remaining
+     * time of the caller and the narrowing of the request can only make it narrower
+     * (CAPABILITIES-2026-10, decision 9). Two different clearances without an order throw.
+     */
+    private capabilityOf;
     /** Run a procedure for a request with a signal. */
     private run;
     /**
@@ -340,8 +400,9 @@ export declare class ProcedureServer extends Server implements RepositoryProvide
      * Creates standard CRUD procedures using the configured storage.
      *
      * @param collectionName - Collection name
+     * @param options - The query policy of `find`. `$regex` is off unless the policy permits it.
      */
-    registerCollectionProcedures(collectionName: string): void;
+    registerCollectionProcedures(collectionName: string, options?: CollectionProceduresOptions): void;
     /** The paths that the server serves now. */
     private servedKeys;
     /**

package/dist/server/procedure-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"procedure-server.d.ts","sourceRoot":"","sources":["../../src/server/procedure-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAElG,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC9H,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEtF,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACzH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAOpF;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,+BAA+B;IAC/B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC9B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,qDAAqD;IACrD,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAExD;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAElC;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAElD;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpG,yCAAyC;IACzC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAClE,uDAAuD;IACvD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAElC;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,KAAK,GAAG,SAAS,CAAC;IAErD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAEzH;;;;;OAKG;IACH,MAAM,CAAC,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,CAAC;CAC7D;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAEvG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMrF;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAuDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAoBjF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,eAAgB,SAAQ,MAAO,YAAW,kBAAkB;IACvE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwF;IACpH,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IACpE;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4F;IAC9H,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwD;IACpF;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAyB;IACzC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAS;IACzB,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAK;IACrB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,oFAAoF;IACpF,OAAO,CAAC,WAAW,CAAyB;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;IAE/C,YAAY,OAAO,GAAE,sBAA2B,EAgC/C;IAMD;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAMtD;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEzC;IAMD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAStG;;;OAGG;YACW,cAAc;IAiB5B,qFAAqF;IACrF,OAAO,CAAC,mBAAmB;IAe3B;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6BtB;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAKtE;IAED;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE,CAE7B;IAMD;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI,CAQ/C;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,IAAI,CAInD;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAE5C;IAED;;;;;OAKG;IACH,oBAAoB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,UAAmB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAKnE;IAED;;;OAGG;YACW,MAAM;IAwCpB;;;;OAIG;YACW,KAAK;IAuBnB,6EAA6E;IAC7E,OAAO,CAAC,SAAS;IASjB,uDAAuD;IACvD,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,uFAAuF;IACvF,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;OAIG;YACW,QAAQ;IAwCtB,mDAAmD;YACrC,GAAG;IA4CjB;;;;;OAKG;IACH,4BAA4B,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAUzD;IAMD,4CAA4C;IAC5C,OAAO,CAAC,UAAU;IAYlB;;OAEG;IACH,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;;;;OAIG;IACH;;;;OAIG;IACH,WAAW,IAAI,iBAAiB,CAE/B;IAED,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAEzC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAEvC;IAED;;;;OAIG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnC;IAED;;;;OAIG;IACY,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB5D;CACF;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}
+{"version":3,"file":"procedure-server.d.ts","sourceRoot":"","sources":["../../src/server/procedure-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAmB,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpJ,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC9H,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACxG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAElF,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACzH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAM1F;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,+BAA+B;IAC/B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC9B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,qDAAqD;IACrD,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IAExD;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAElC;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAElD;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpG,yCAAyC;IACzC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,WAAW,CAAC,GAAG,SAAS,CAAC;IAClE,uDAAuD;IACvD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAElC;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,GAAG,KAAK,GAAG,SAAS,CAAC;IAErD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAEzH;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAEtC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,KAAK,GAAG,SAAS,CAAC;IAE5D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,CAAC;CAC7D;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG,OAAO,CAEvG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMrF;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAuDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAoBjF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,eAAgB,SAAQ,MAAO,YAAW,kBAAkB;IACvE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoD;IAC/E,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwF;IACpH,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IACpE;;;;;OAKG;IACH,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4F;IAC9H,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwD;IACpF;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAyB;IACzC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAS;IACzB,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAK;IACrB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,oFAAoF;IACpF,OAAO,CAAC,WAAW,CAAyB;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAE5D,YAAY,OAAO,GAAE,sBAA2B,EAmC/C;IAMD;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAMtD;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEzC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAMlF;IAED,gEAAgE;IAChE,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEzC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,CAMzJ;IAED;;;;;;;;;OASG;IACH,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,IAAI,CAGxE;IAMD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAStG;;;OAGG;YACW,cAAc;IAiB5B,qFAAqF;IACrF,OAAO,CAAC,mBAAmB;IAe3B;;;OAGG;IACH,OAAO,CAAC,cAAc;IAgCtB;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAKtE;IAED;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE,CAE7B;IAMD;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI,CAQ/C;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,IAAI,CAInD;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAE5C;IAED;;;;;OAKG;IACH,oBAAoB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,UAAmB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAKnE;IAED;;;OAGG;YACW,MAAM;IAwCpB;;;;;;OAMG;YACW,KAAK;IAuCnB,6EAA6E;IAC7E,OAAO,CAAC,SAAS;IASjB,uDAAuD;IACvD,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,uFAAuF;IACvF,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;OAIG;YACW,QAAQ;IAwCtB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAMpB,mDAAmD;YACrC,GAAG;IAsDjB;;;;;;OAMG;IACH,4BAA4B,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAUhG;IAMD,4CAA4C;IAC5C,OAAO,CAAC,UAAU;IAYlB;;OAEG;IACH,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;;;;OAIG;IACH;;;;OAIG;IACH,WAAW,IAAI,iBAAiB,CAE/B;IAED,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAEzC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAEvC;IAED;;;;OAIG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnC;IAED;;;;OAIG;IACY,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB5D;CACF;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}

package/dist/server/procedure-server.js

@@ -10,7 +10,7 @@ import { pathToKey } from "../procedures/types.js";
 import { ProcedureRegistry, PROCEDURE_REGISTRY } from "../procedures/registry.js";
 import { createCollectionProcedures } from "../procedures/collection/procedures.js";
 import { InvocationError, invokeProcedure } from "../procedures/invoke.js";
-import { TIMEOUT_METADATA_KEY, effectsOf, narrowCapability } from "../procedures/capability.js";
+import { TIMEOUT_METADATA_KEY, effectsOf, joinNarrowing, narrowCapability } from "../procedures/capability.js";
 import { IdempotencyCache, idempotencyKeyOf, isRepeatable } from "../procedures/idempotency.js";
 import { optionalMs } from "../duration.js";
 import { TIMER_DEFAULTS } from "../timers.js";
@@ -151,6 +151,8 @@ export function errorResponse(id, error) {
 export class ProcedureServer extends Server {
     procedureRegistry;
     storages = new Map();
+    /** The partitions of each partitioned collection: their storages and their resolver (roadmap CLI-17) */
+    partitions = new Map();
     /** For each storage: the calls in flight that took it, and the closes that wait for them */
     storageUses = new Map();
     /** The clock of the wait of `useStorage` */
@@ -180,13 +182,19 @@ export class ProcedureServer extends Server {
     draining = false;
     /** The calls in flight, a stream until its end */
     inFlight = 0;
-    /** The token of the server, and its authenticate function (R18) */
+    /** The token of the server, its request hook and its authenticate function (R18) */
     token;
+    principalOf;
     authenticate;
     /** The functions that `stop()` waits on: each one runs when no call is in flight */
     idleWaiters = [];
     /** The publisher of the remote events, from the option `events`, or undefined. */
     publisher;
+    /**
+     * How the server can authenticate a request with ambient credentials (cookies). The network faces
+     * read it: they trust such a request only from a named origin (CSRF).
+     */
+    ambientCredentials;
     constructor(options = {}) {
         super(options);
         this.procedureRegistry = options.registry ?? PROCEDURE_REGISTRY;
@@ -202,7 +210,10 @@ export class ProcedureServer extends Server {
         };
         this.idempotency = options.idempotency === false ? undefined : new IdempotencyCache(options.idempotency ?? {});
         this.token = options.token;
+        this.principalOf = options.principalOf;
         this.authenticate = options.authenticate;
+        const ambient = options.ambientCredentials ?? (this.principalOf ? "always" : this.authenticate ? "cookies" : undefined);
+        this.ambientCredentials = ambient === false ? undefined : ambient;
         // The remote events: the server pins events.subscribe, as it pins host.health (EVENTS.md)
         this.publisher = options.events instanceof EventPublisher ? options.events : options.events ? new EventPublisher(options.events) : undefined;
         if (this.publisher)
@@ -241,7 +252,50 @@ export class ProcedureServer extends Server {
      * @param collection - Collection name
      */
     hasCollection(collection) {
-        return this.storages.has(collection);
+        return this.storages.has(collection) || this.partitions.has(collection);
+    }
+    /**
+     * The storage of one partition of a collection (roadmap CLI-17).
+     *
+     * @throws Error if the collection has no partitions
+     */
+    getPartitionStorage(collection, partition) {
+        const partitions = this.partitions.get(collection);
+        if (!partitions) {
+            throw new Error(`Collection has no partitions: ${collection}`);
+        }
+        return partitions.storageOf(partition);
+    }
+    /** True when the collection has partitions (roadmap CLI-17). */
+    hasPartitions(collection) {
+        return this.partitions.has(collection);
+    }
+    /**
+     * The partition of a call to a partitioned collection (roadmap CLI-17), from the resolver of
+     * `usePartitions`. `null` refuses the call.
+     *
+     * @throws Error if the collection has no partitions
+     */
+    resolvePartition(collection, ctx, requested) {
+        const partitions = this.partitions.get(collection);
+        if (!partitions) {
+            throw new Error(`Collection has no partitions: ${collection}`);
+        }
+        return partitions.resolve(ctx, requested);
+    }
+    /**
+     * Configure the partitions of a collection (roadmap CLI-17). `resolve` gives the partition of
+     * each call from its context (the tenant of `ctx.principal`) and the partition that the call asks
+     * for: the collection procedures and the subscriptions of `EventPublisher` use it. `storageOf`
+     * gives the storage of a partition: give the same storage for the same partition each time.
+     *
+     * @param name - Collection name
+     * @param partitions - The storage of each partition, and the resolver
+     * @returns this (for chaining)
+     */
+    usePartitions(name, partitions) {
+        this.partitions.set(name, partitions);
+        return this;
     }
     useStorage(name, storage, options) {
         if (options === undefined) {
@@ -294,17 +348,20 @@ export class ProcedureServer extends Server {
     callRepository() {
         const taken = new Set();
         let released = false;
+        const take = (storage) => {
+            if (!released && !taken.has(storage)) {
+                taken.add(storage);
+                const use = this.storageUses.get(storage) ?? { calls: 0, waiters: [] };
+                use.calls++;
+                this.storageUses.set(storage, use);
+            }
+            return storage;
+        };
         const repository = {
-            getStorage: (collection) => {
-                const storage = this.getStorage(collection);
-                if (!released && !taken.has(storage)) {
-                    taken.add(storage);
-                    const use = this.storageUses.get(storage) ?? { calls: 0, waiters: [] };
-                    use.calls++;
-                    this.storageUses.set(storage, use);
-                }
-                return storage;
-            },
+            getStorage: (collection) => take(this.getStorage(collection)),
+            getPartitionStorage: (collection, partition) => take(this.getPartitionStorage(collection, partition)),
+            hasPartitions: (collection) => this.hasPartitions(collection),
+            resolvePartition: (collection, ctx, requested) => this.resolvePartition(collection, ctx, requested),
             hasCollection: (collection) => this.hasCollection(collection),
         };
         const release = () => {
@@ -458,9 +515,11 @@ export class ProcedureServer extends Server {
         return response;
     }
     /**
-     * The token check and the principal of a request (roadmap R18). A network request (with
-     * credentials) must present the token. The authenticate function gives the principal. The
-     * function gives an UNAUTHORIZED response, or undefined when the request passes.
+     * The token check and the principal of a request (roadmap R18). The request hook reads the
+     * credentials of a network request first: a bearer token, a principal and a narrowing. A
+     * network request (with credentials) must present the token. The authenticate function gives
+     * the principal. The function gives an UNAUTHORIZED response, or undefined when the request
+     * passes.
      */
     async admit(request) {
         const unauthorized = (message) => ({
@@ -468,11 +527,30 @@ export class ProcedureServer extends Server {
             status: { type: "error", code: "UNAUTHORIZED", message, retryable: false },
             metadata: {},
         });
-        if (this.token !== undefined && request.credentials !== undefined) {
-            if (!tokenMatches(this.token, request.credentials.bearer))
+        const credentials = request.credentials;
+        let identity;
+        if (this.principalOf && credentials !== undefined) {
+            try {
+                identity = await this.principalOf(credentials, request);
+            }
+            catch {
+                identity = undefined;
+            }
+            if (!identity)
+                return unauthorized("Unauthorized: the server did not accept the credentials");
+        }
+        if (this.token !== undefined && credentials !== undefined) {
+            const bearer = identity?.bearer ?? credentials.bearer;
+            if (!tokenMatches(this.token, bearer))
                 return unauthorized("Unauthorized: this server requires its token");
             request.principal = { id: "token", via: "token" };
         }
+        if (identity?.principal)
+            request.principal = identity.principal;
+        if (identity?.narrowing) {
+            const order = this.capabilityOptions.clearanceOrder;
+            request.narrowing = request.narrowing ? joinNarrowing(request.narrowing, identity.narrowing, order) : identity.narrowing;
+        }
         if (this.authenticate) {
             let principal;
             try {
@@ -551,6 +629,16 @@ export class ProcedureServer extends Server {
         }
         return { ...response, id: request.id };
     }
+    /**
+     * The capability of a request. It comes from the server, never from the request. The remaining
+     * time of the caller and the narrowing of the request can only make it narrower
+     * (CAPABILITIES-2026-10, decision 9). Two different clearances without an order throw.
+     */
+    capabilityOf(request) {
+        const { capability, clearanceOrder } = this.capabilityOptions;
+        const base = withRequestTimeout(typeof capability === "function" ? capability(request) : capability, request, clearanceOrder);
+        return request.narrowing ? narrowCapability(base, request.narrowing, clearanceOrder) : base;
+    }
     /** Run a procedure for a request with a signal. */
     async run(procedure, request, signal) {
         // The call uses the storages that it takes until its end: the end of a stream, for a stream
@@ -559,21 +647,32 @@ export class ProcedureServer extends Server {
         try {
             // One invocation path for every host (ARCHITECTURE-PROPOSALS P1): input validation, the
             // context, the expose rule for nested calls (BUGS-2026-07 H18) and output validation
-            const { capability, clearanceOrder, resources, admitItem } = this.capabilityOptions;
+            const { clearanceOrder, resources, admitItem } = this.capabilityOptions;
+            let capability;
+            try {
+                capability = this.capabilityOf(request);
+            }
+            catch (error) {
+                const message = `The server cannot narrow the capability of the request: ${error instanceof Error ? error.message : String(error)}`;
+                return errorResponse(request.id, Object.assign(new Error(message), { code: "INTERNAL_ERROR" }));
+            }
             const output = await invokeProcedure(procedure, request.payload, {
                 registry: this.procedureRegistry,
                 metadata: request.metadata,
                 signal,
+                // What the face of the call offers: it asks the person, and it shows the progress (CLI-12)
+                ...(request.elicit ? { elicit: request.elicit } : {}),
+                ...(request.progress ? { progress: request.progress } : {}),
                 repository,
                 expose: this.expose,
                 strictCalls: this.strictCalls,
                 interceptors: this.interceptors,
-                // The capability comes from the server, never from the request. The remaining time of
-                // the caller can only make the deadline earlier (CAPABILITIES-2026-10, decision 9).
-                capability: withRequestTimeout(typeof capability === "function" ? capability(request) : capability, request, clearanceOrder),
+                capability,
                 clearanceOrder,
                 resources,
                 admitItem,
+                // The principal of the authentication: ctx.principal, and the nested calls (R18)
+                ...(request.principal !== undefined ? { principal: request.principal } : {}),
                 // The bus of the remote events is the bus of the procedures (EVENTS.md)
                 ...(this.publisher ? { bus: this.publisher.bus } : {}),
             });
@@ -603,11 +702,12 @@ export class ProcedureServer extends Server {
      * Creates standard CRUD procedures using the configured storage.
      *
      * @param collectionName - Collection name
+     * @param options - The query policy of `find`. `$regex` is off unless the policy permits it.
      */
-    registerCollectionProcedures(collectionName) {
+    registerCollectionProcedures(collectionName, options) {
         // Uses a top-level import; require() is not available in this ESM package and
         // previously threw "Cannot find module" on every call. See BUGS-2026-07 H13.
-        const procedures = createCollectionProcedures(collectionName);
+        const procedures = createCollectionProcedures(collectionName, options);
         // Register with the procedure registry first
         this.procedureRegistry.registerAll(procedures);
         // Then register as server handlers