permdock 0.0.0 → 0.1.0

package/dist/eve/index.d.ts

@@ -0,0 +1,95 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, ur as Delegation, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { t as ToolMap } from "../types-CxquUByI.js";
+//#region src/eve/create.d.ts
+/** Structural `SessionAuthContext` from `eve`. */
+type EvePrincipal = {
+  readonly principalId: string;
+  readonly principalType?: string;
+  readonly authenticator?: string;
+  readonly issuer?: string;
+  readonly subject?: string;
+  readonly attributes?: Readonly<Record<string, unknown>>;
+};
+/** Structural `ApprovalContext` from `eve/tools/approval`. */
+type EveApprovalContext = {
+  readonly session?: {
+    readonly id?: string;
+    readonly auth?: {
+      readonly initiator?: EvePrincipal | null;
+      readonly current?: EvePrincipal | null;
+    };
+  };
+  readonly callId?: string;
+  readonly toolName: string;
+  readonly toolInput?: unknown;
+};
+/** Structural `ApprovalResponseContext` from `eve/tools/approval`. */
+type EveResponseContext = {
+  readonly request: {
+    readonly callId: string;
+    readonly requestId?: string;
+    readonly toolName: string;
+    readonly toolInput?: unknown;
+  };
+  /** Who answered and how; eve settles the request only on `allowed`. */
+  readonly response: {
+    readonly decision: "approve" | "cancel";
+    readonly principal: EvePrincipal;
+  };
+  readonly session: {
+    readonly id: string;
+    readonly initiator: EvePrincipal | null;
+  };
+};
+/** What `subject`, `actor` and `tenant` receive. */
+type EveContext = Pick<EveApprovalContext, "session" | "callId">;
+type EveApprovers = {
+  readonly roles: readonly string[];
+} | ((responder: EvePrincipal, request: ApprovalRequest) => boolean);
+type EvePermDockOptions<TUser = unknown> = {
+  readonly subject?: (context: EveContext) => TUser | Promise<TUser>;
+  readonly actor?: (context: EveContext) => unknown;
+  readonly delegation?: (context: EveContext) => Delegation | undefined | Promise<Delegation | undefined>;
+  readonly tenant?: string | ((context: EveContext) => string | undefined | Promise<string | undefined>);
+  readonly tools: ToolMap;
+  readonly approvers?: EveApprovers;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  readonly snapshots?: SnapshotSource;
+};
+type EveRequestResult = "not-applicable" | "user-approval" | {
+  readonly type: "denied";
+  readonly reason: string;
+};
+type EveResponseResult = {
+  readonly status: "allowed";
+} | {
+  readonly status: "rejected";
+  readonly reason: string;
+};
+/** An eve `ApprovalConfiguration`: pass it as a tool's `approval`. */
+type EveApprovalPair = {
+  readonly request: (ctx: EveApprovalContext) => Promise<EveRequestResult>;
+  readonly response: (ctx: EveResponseContext) => Promise<EveResponseResult>;
+};
+type EvePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly approval: EveApprovalPair;
+  readonly approvalFor: (permission: Permission, data?: (input: unknown) => unknown) => EveApprovalPair;
+  readonly permdock: (ctx: EveContext) => Promise<PermDock<V>>;
+};
+export declare function rolesOf(principal: EvePrincipal | null | undefined): string[];
+export declare function subjectFromSession(context: EveContext): unknown;
+export declare function actorFromSession(context: EveContext): unknown;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: EvePermDockOptions<TUser>): EvePermDock<V>;
+//#endregion
+export type { EveApprovalContext, EveApprovalPair, EveApprovers, EveContext, EvePermDock, EvePermDockOptions, EvePrincipal, EveRequestResult, EveResponseContext, EveResponseResult };

package/dist/eve/index.js

@@ -0,0 +1,181 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as isApprovalError } from "../errors-m3u9TmDu.js";
+import { o as resolveApproval, p as memoryApprovalStore } from "../helpers-DnSOrhB9.js";
+import { n as createAgentKernel } from "../kernel-YOGCWNLf.js";
+import { t as boundedMap } from "../lru-8q4WZjBV.js";
+//#region src/eve/create.ts
+const TOKENS_PER_PROCESS = 1e3;
+function rolesOf(principal) {
+	const roles = principal?.attributes?.["roles"];
+	if (typeof roles === "string") return [roles];
+	if (!Array.isArray(roles)) return [];
+	return roles.filter((role) => typeof role === "string");
+}
+function subjectFromSession(context) {
+	const initiator = context.session?.auth?.initiator;
+	if (initiator === void 0 || initiator === null) return null;
+	return {
+		id: initiator.principalId,
+		roles: rolesOf(initiator)
+	};
+}
+function actorFromSession(context) {
+	const auth = context.session?.auth;
+	const initiator = auth?.initiator;
+	const current = auth?.current;
+	if (current !== void 0 && current !== null && initiator !== void 0 && initiator !== null && current.principalId !== initiator.principalId) return {
+		id: current.principalId,
+		kind: "eve"
+	};
+	return {
+		id: "eve:app",
+		kind: "eve"
+	};
+}
+function mapVerdict(verdict) {
+	if (verdict.outcome === "granted") return "not-applicable";
+	if (verdict.outcome === "approval-required") return "user-approval";
+	return {
+		type: "denied",
+		reason: verdict.reason
+	};
+}
+function mayApprove(approvers, responder, request) {
+	if (approvers === void 0) return true;
+	if (typeof approvers === "function") return approvers(responder, request);
+	const held = new Set(rolesOf(responder));
+	return approvers.roles.some((role) => held.has(role));
+}
+function callKey(sessionId, callId) {
+	return JSON.stringify([sessionId ?? null, callId]);
+}
+function createPermDock(policy, options) {
+	const store = options.store ?? memoryApprovalStore();
+	const tokensByCall = boundedMap(TOKENS_PER_PROCESS);
+	const kernel = createAgentKernel(policy, {
+		...compact({
+			tenant: options.tenant,
+			delegation: options.delegation,
+			memberships: options.memberships,
+			relations: options.relations,
+			entitlements: options.entitlements,
+			customRoles: options.customRoles,
+			policies: options.policies,
+			sink: options.sink,
+			limits: options.limits,
+			snapshots: options.snapshots
+		}),
+		subject: options.subject ?? subjectFromSession,
+		actor: options.actor ?? actorFromSession,
+		tools: options.tools,
+		store,
+		adapter: "eve"
+	});
+	const approverOf = async (responder, sessionId) => {
+		try {
+			return (await kernel.instance({ session: {
+				id: sessionId,
+				auth: {
+					initiator: responder,
+					current: responder
+				}
+			} })).subject.principal ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const pairFor = (bindingFor) => {
+		const request = async (ctx) => {
+			const binding = bindingFor(ctx.toolName);
+			const verdict = binding === void 0 ? await kernel.decideTool(ctx.toolName, ctx.toolInput, ctx) : await kernel.evaluate(binding, ctx.toolName, ctx.toolInput, ctx, { denyPending: true });
+			if (verdict.outcome === "approval-required" && ctx.callId !== void 0) tokensByCall.set(callKey(ctx.session?.id, ctx.callId), verdict.token);
+			return mapVerdict(verdict);
+		};
+		const tokenOf = (ctx) => {
+			const cached = tokensByCall.get(callKey(ctx.session.id, ctx.request.callId));
+			if (cached !== void 0) return Promise.resolve(cached);
+			const binding = bindingFor(ctx.request.toolName);
+			if (binding === void 0) return Promise.resolve(void 0);
+			const initiator = ctx.session.initiator;
+			return kernel.tokenFor(binding, ctx.request.toolInput, {
+				session: {
+					id: ctx.session.id,
+					auth: {
+						initiator,
+						current: initiator
+					}
+				},
+				callId: ctx.request.callId
+			});
+		};
+		const response = async (ctx) => {
+			const token = await tokenOf(ctx);
+			if (token === void 0) return {
+				status: "rejected",
+				reason: "approval-not-found"
+			};
+			let current;
+			try {
+				current = await store.get(token);
+			} catch {
+				current = null;
+			}
+			if (current === null) return {
+				status: "rejected",
+				reason: "approval-not-found"
+			};
+			const responder = ctx.response.principal;
+			if (current.subject.actor?.id === responder.principalId) return {
+				status: "rejected",
+				reason: "approver is the actor of this request"
+			};
+			if (!mayApprove(options.approvers, responder, current)) return {
+				status: "rejected",
+				reason: "approver is not eligible"
+			};
+			const approver = await approverOf(responder, ctx.session.id);
+			if (approver === null) return {
+				status: "rejected",
+				reason: "approver is not eligible"
+			};
+			try {
+				await resolveApproval(store, token, {
+					status: ctx.response.decision === "approve" ? "approved" : "rejected",
+					by: {
+						principal: approver,
+						context: {}
+					}
+				});
+				return { status: "allowed" };
+			} catch (error) {
+				if (isApprovalError(error)) return {
+					status: "rejected",
+					reason: error.message
+				};
+				return {
+					status: "rejected",
+					reason: "approval-not-found"
+				};
+			}
+		};
+		return {
+			request,
+			response
+		};
+	};
+	const approval = pairFor((toolName) => Object.hasOwn(options.tools, toolName) ? options.tools[toolName] : void 0);
+	const approvalFor = (permission, data) => {
+		const binding = compact({
+			permission,
+			data
+		});
+		return pairFor(() => binding);
+	};
+	return {
+		approval,
+		approvalFor,
+		permdock: (ctx) => kernel.instance(ctx)
+	};
+}
+//#endregion
+export { actorFromSession, createPermDock, rolesOf, subjectFromSession };

package/dist/express/index.d.ts

@@ -0,0 +1,46 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { r as PdpFactory } from "../types-BvBk1wgn.js";
+import { g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { a as toRequest, i as sendResponse } from "../http-DPuDaChb.js";
+import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
+//#region src/express/create.d.ts
+type ExpressPermDockOptions<TUser = unknown> = {
+  readonly subject: (req: Request) => TUser | Promise<TUser>;
+  readonly tenant?: TenantOption<Request>;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** Accepted for adapter parity; not read by this adapter. */
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+};
+type PermDockRequest<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = Request & {
+  permdock: PermDock<V>;
+  permdockData?: T;
+};
+type ExpressPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => RequestHandler;
+  readonly protect: (permission: Permission, loadData?: (req: Request) => unknown, protectOptions?: ProtectOptions) => RequestHandler;
+  readonly errorHandler: () => ErrorRequestHandler;
+  readonly permdockHandler: () => Router;
+  readonly withPermDock: (fn: (req: PermDockRequest<unknown, V>, res: Response) => unknown) => RequestHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ExpressPermDockOptions<TUser>): ExpressPermDock<V>;
+//#endregion
+export { type ExpressPermDock, type ExpressPermDockOptions, InvalidSignatureError, type PermDockRequest, discoverViaSignatureAgent, sendResponse, toRequest, verifyWebBotAuth };

package/dist/express/index.js

@@ -0,0 +1,108 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
+import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
+import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+import { i as toRequest, r as sendResponse } from "../http-GgVApX1k.js";
+import express from "express";
+//#region src/express/create.ts
+function run(work, next) {
+	work().catch(next);
+}
+const errorHandler = () => (err, _req, res, next) => {
+	const problem = problemFromError(err);
+	if (problem === void 0) {
+		next(err);
+		return;
+	}
+	run(async () => {
+		await sendResponse(res, problem);
+	}, next);
+};
+const withPermDock = (fn) => (req, res, next) => {
+	run(async () => {
+		await fn(req, res);
+	}, next);
+};
+/** Runs `use` on the Express request bound to `request`; `fallback` for a request this adapter never bound. */
+function withBound(contexts, request, use, fallback) {
+	const req = contexts.get(request);
+	return req === void 0 ? fallback : use(req);
+}
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const bound = /* @__PURE__ */ new WeakMap();
+	const kernel = createKernel(policy, compact({
+		subject: (request) => withBound(contexts, request, options.subject, null),
+		memberships: options.memberships,
+		relations: options.relations,
+		entitlements: options.entitlements,
+		customRoles: options.customRoles,
+		policies: options.policies,
+		store: options.store,
+		sink: options.sink,
+		limits: options.limits,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		adapter: "express",
+		wrap: options.otel
+	}));
+	const bind = (req) => {
+		const hit = bound.get(req);
+		if (hit !== void 0) return hit;
+		const request = toRequest(req);
+		bound.set(req, request);
+		contexts.set(request, req);
+		return request;
+	};
+	const scopeOf = (req) => tenantScope(options.tenant, req);
+	/** The decision endpoint reads the body a parser may have consumed since `bind`. */
+	const rebind = (req) => {
+		const request = toRequest(req);
+		contexts.set(request, req);
+		return request;
+	};
+	const permdock = () => (req, _res, next) => {
+		run(async () => {
+			req.permdock = await kernel.permdock(bind(req), await scopeOf(req));
+			next();
+		}, next);
+	};
+	const protect = (permission, loadData, protectOptions) => (req, res, next) => {
+		run(async () => {
+			const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(req), protectOptions)(bind(req), await scopeOf(req));
+			if (!guard.ok) {
+				await sendResponse(res, guard.response);
+				return;
+			}
+			const scoped = req;
+			scoped.permdock = guard.permdock;
+			scoped.permdockData = guard.data;
+			next();
+		}, next);
+	};
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler((request) => withBound(contexts, request, scopeOf, { tenant: void 0 }));
+		const router = express.Router({ mergeParams: true });
+		router.post("/", (req, res, next) => {
+			run(async () => {
+				await sendResponse(res, await POST(rebind(req)));
+			}, next);
+		});
+		router.get("/", (req, res, next) => {
+			run(async () => {
+				await sendResponse(res, await GET(bind(req)));
+			}, next);
+		});
+		return router;
+	};
+	return {
+		permdock,
+		protect,
+		errorHandler,
+		permdockHandler,
+		withPermDock,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, sendResponse, toRequest, verifyWebBotAuth };

package/dist/fastify/index.d.ts

@@ -0,0 +1,56 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { r as PdpFactory } from "../types-BvBk1wgn.js";
+import { g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
+//#region src/fastify/create.d.ts
+type FastifyPermDockOptions<TUser = unknown> = {
+  readonly subject: (request: FastifyRequest) => TUser | Promise<TUser>;
+  readonly tenant?: TenantOption<FastifyRequest>;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** Accepted for adapter parity; not read by this adapter. */
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+};
+type PermDockRequest<Route extends RouteGenericInterface = RouteGenericInterface, V extends PolicyVocabulary = PolicyVocabulary> = FastifyRequest<Route> & {
+  permdock: PermDock<V>;
+  permdockData?: unknown;
+};
+/** A request typed by the route, its schema and the app's type provider. */
+type ProtectRequest<Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault> = FastifyRequest<Route, RawServerDefault, RawRequestDefaultExpression, Schema, Provider>;
+/**
+ * Generic over the route, schema and type provider so a `preHandler` slot
+ * infers them: `loadData` sees the same typed `request.body` as the handler.
+ */
+type FastifyProtect = <Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault>(permission: Permission, loadData?: (request: ProtectRequest<Route, Schema, Provider>) => unknown, protectOptions?: ProtectOptions) => (request: ProtectRequest<Route, Schema, Provider>, reply: FastifyReply) => Promise<void>;
+type FastifyPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: FastifyPluginAsync;
+  readonly protect: FastifyProtect;
+  readonly permdockHandler: FastifyPluginAsync;
+  /** Types `request.permdock` for a route registered after `permdock` or `protect`. */
+  readonly withPermDock: <Route extends RouteGenericInterface = RouteGenericInterface>(fn: (request: PermDockRequest<Route, V>, reply: FastifyReply) => unknown) => (request: FastifyRequest<Route>, reply: FastifyReply) => unknown;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: FastifyPermDockOptions<TUser>): FastifyPermDock<V>;
+//#endregion
+//#region src/fastify/http.d.ts
+export declare function toRequest(request: FastifyRequest): Request;
+export declare function sendReply(reply: FastifyReply, response: Response): Promise<void>;
+//#endregion
+export { type FastifyPermDock, type FastifyPermDockOptions, type FastifyProtect, InvalidSignatureError, type PermDockRequest, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/fastify/index.js

@@ -0,0 +1,141 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
+import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
+import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+//#region src/fastify/http.ts
+function toRequest(request) {
+	const host = headerValue(request.headers.host) ?? "localhost";
+	const url = `${request.protocol}://${host}${request.url}`;
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(request.headers)) {
+		if (typeof value === "string") {
+			headers.set(key, value);
+			continue;
+		}
+		if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+	}
+	const method = request.method;
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const body = bodyOf(request, headers);
+	if (body === void 0) return new Request(url, {
+		method,
+		headers
+	});
+	return new Request(url, {
+		method,
+		headers,
+		body
+	});
+}
+function headerValue(value) {
+	if (typeof value === "string" && value.length > 0) return value;
+	if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+}
+function bodyOf(request, headers) {
+	if (request.body === void 0) return;
+	if (typeof request.body === "string") return request.body;
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	return JSON.stringify(request.body);
+}
+async function sendReply(reply, response) {
+	reply.code(response.status);
+	for (const [key, value] of response.headers.entries()) reply.header(key, value);
+	await reply.send(await response.text());
+}
+//#endregion
+//#region src/fastify/create.ts
+const SKIP_OVERRIDE = Symbol.for("skip-override");
+function breakEncapsulation(plugin) {
+	Object.defineProperty(plugin, SKIP_OVERRIDE, { value: true });
+	return plugin;
+}
+function decorate(request, instance, data) {
+	const scoped = request;
+	scoped.permdock = instance;
+	if (data !== void 0) scoped.permdockData = data;
+}
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const bound = /* @__PURE__ */ new WeakMap();
+	const kernel = createKernel(policy, compact({
+		subject: (request) => {
+			const req = contexts.get(request);
+			return req === void 0 ? null : options.subject(req);
+		},
+		memberships: options.memberships,
+		relations: options.relations,
+		entitlements: options.entitlements,
+		customRoles: options.customRoles,
+		policies: options.policies,
+		store: options.store,
+		sink: options.sink,
+		limits: options.limits,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		adapter: "fastify",
+		wrap: options.otel
+	}));
+	const bind = (request) => {
+		const hit = bound.get(request);
+		if (hit !== void 0) return hit;
+		const next = toRequest(request);
+		bound.set(request, next);
+		contexts.set(next, request);
+		return next;
+	};
+	const scopeOf = (request) => tenantScope(options.tenant, request);
+	const permdock = breakEncapsulation((app) => {
+		app.decorateRequest("permdock", null);
+		app.decorateRequest("permdockData", null);
+		app.addHook("onRequest", async (request) => {
+			decorate(request, await kernel.permdock(bind(request), await scopeOf(request)));
+		});
+		const previous = app.errorHandler;
+		app.setErrorHandler(async function permdockErrors(err, request, reply) {
+			const problem = problemFromError(err);
+			if (problem === void 0) {
+				await previous.call(this, err, request, reply);
+				return;
+			}
+			await sendReply(reply, problem);
+		});
+		return Promise.resolve();
+	});
+	const protect = (permission, loadData, protectOptions) => async (request, reply) => {
+		const plain = request;
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions)(bind(plain), await scopeOf(plain));
+		if (!guard.ok) {
+			await sendReply(reply, guard.response);
+			return;
+		}
+		decorate(plain, guard.permdock, guard.data);
+	};
+	const permdockHandler = (app) => {
+		const { POST, GET } = kernel.permdockHandler((request) => {
+			const req = contexts.get(request);
+			return req === void 0 ? { tenant: void 0 } : scopeOf(req);
+		});
+		app.post("/", async (request, reply) => {
+			const parsed = toRequest(request);
+			contexts.set(parsed, request);
+			await sendReply(reply, await POST(parsed));
+		});
+		app.get("/", async (request, reply) => {
+			await sendReply(reply, await GET(bind(request)));
+		});
+		return Promise.resolve();
+	};
+	const withPermDock = (fn) => (request, reply) => fn(request, reply);
+	return {
+		permdock,
+		protect,
+		permdockHandler,
+		withPermDock,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, sendReply, toRequest, verifyWebBotAuth };