permdock 0.0.0 → 0.2.0

package/dist/testing/saas/index.d.ts

@@ -0,0 +1,194 @@
+import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-CFZAr_Al.js";
+import { f as Permission } from "../../permissions-DttnqqxC.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D8UFyERw.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/testing/saas/schema.d.ts
+type FieldKind = "string" | "boolean" | "nullable-string";
+type FieldValue<K extends FieldKind> = K extends "string" ? string : K extends "boolean" ? boolean : string | null;
+type Shape = {
+  readonly [field: string]: FieldKind;
+};
+type Infer<S extends Shape> = { [K in keyof S]: FieldValue<S[K]>; };
+/** A dependency-free Standard Schema for flat fixture rows. */
+export declare function rowSchema<const S extends Shape>(shape: S): StandardSchemaV1<Infer<S>>;
+//#endregion
+//#region src/testing/saas/seed.d.ts
+type SaasPlan = "free" | "pro";
+type SaasOrg = {
+  readonly id: string;
+  readonly name: string;
+  readonly plan: SaasPlan;
+  readonly customRoles: readonly CustomRole[];
+};
+type SaasMember = {
+  readonly user: string;
+  /** Absent on a resource-scoped membership, which carries only `on`. */
+  readonly tenant?: string;
+  readonly team?: string;
+  readonly on?: {
+    readonly resource: string;
+    readonly id: string;
+  };
+  readonly roles: readonly string[];
+  readonly expiresAt?: number;
+};
+/** One edge-table row: `user` holds `relation` on `folder`. */
+type SaasShare = {
+  readonly folder: string;
+  readonly user: string;
+  readonly relation: "viewer" | "editor";
+  readonly expiresAt?: number;
+};
+type SaasSeed = {
+  readonly orgs: readonly SaasOrg[];
+  readonly members: readonly SaasMember[];
+  readonly projects: readonly SaasProject[];
+  readonly docs: readonly SaasDoc[];
+  readonly folders: readonly SaasFolder[];
+  readonly shares: readonly SaasShare[];
+};
+/** Epoch seconds in the past, so the membership is expired for any clock. */
+export declare const SAAS_EXPIRED_AT = 1e9;
+/**
+ * Users, one hazard each:
+ * - alice: admin in acme, viewer in globex (different role per org)
+ * - bob: member in acme (owns p1, p3, p4)
+ * - carol: owner in acme
+ * - dave: custom `contractor` role in acme (includes member)
+ * - erin: admin in acme AND globex (same role in two orgs)
+ * - frank: expired acme membership
+ * - mallory: no memberships at all
+ * - gina: `lead` of team-a in acme
+ * - hank: viewer in acme, `collaborator` on project p3 only
+ * - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+ * - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
+ * - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+ *
+ * Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
+ * (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
+ * `eng`, frank's view of `root` expired.
+ */
+export declare const saasSeed: SaasSeed;
+/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+export declare function saasRelations(seed?: SaasSeed): RelationSource;
+/** Every user id in the seed. */
+export declare const saasUsers: readonly string[];
+export declare function saasOrg(id: string): SaasOrg | undefined;
+/** Memberships of `user` as the PermDock `Membership` shape. */
+export declare function saasMemberships(user: string, members?: readonly SaasMember[]): Membership[];
+/** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
+export declare const saasCustomRoles: readonly CustomRole[];
+/**
+ * The principal for `user`, with the plans of the requested `tenant`'s org.
+ * The tenant itself is passed to `createPermDock({ tenant })`, never trusted
+ * from here.
+ */
+export declare function saasPrincipal(user: string, tenant?: string): Principal;
+//#endregion
+//#region src/testing/saas/sql.d.ts
+/**
+ * Postgres tables for the SaaS domain. Column names match the resource
+ * fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
+ * against them without a column map. RLS is enabled and forced on the row
+ * tables; policies come from `permdock rls generate`.
+ */
+export declare const saasSchemaSql = "\ncreate table org (\n  id text primary key,\n  name text not null,\n  plan text not null check (plan in ('free', 'pro'))\n);\ncreate table org_member (\n  user_id text not null,\n  org_id text references org (id),\n  team_id text,\n  resource text,\n  resource_id text,\n  role text not null,\n  expires_at bigint\n);\ncreate table project (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"ownerId\" text not null,\n  name text not null,\n  archived boolean not null default false\n);\nalter table project enable row level security;\nalter table project force row level security;\ncreate table doc (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"teamId\" text,\n  title text not null,\n  locked boolean not null default false\n);\nalter table doc enable row level security;\nalter table doc force row level security;\ncreate table folder (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"parentId\" text references folder (id),\n  name text not null,\n  restricted boolean not null default false\n);\nalter table folder enable row level security;\nalter table folder force row level security;\ncreate table folder_share (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null,\n  expires_at timestamptz\n);\ncreate table folder_editor (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null\n);\n";
+/** `insert` statements for a seed; the default is the full shared seed. */
+export declare function saasSeedSql(seed?: SaasSeed): string;
+//#endregion
+//#region src/testing/saas/tokens.d.ts
+type EcJwk = {
+  readonly kty: "EC";
+  readonly crv: "P-256";
+  readonly x: string;
+  readonly y: string;
+  readonly kid: string;
+  readonly alg: "ES256";
+  readonly use: "sig";
+};
+export declare const saasPublicJwk: EcJwk;
+export declare const saasPrivateJwk: EcJwk & {
+  readonly d: string;
+};
+export declare const saasJwks: Readonly<{
+  keys: EcJwk[];
+}>;
+export declare const saasIssuer = "https://saas.permdock.test";
+export declare const saasAudience = "permdock-saas";
+export declare const SAAS_TOKEN_TTL_SECONDS = 3600;
+type SaasTokenOptions = {
+  /** Claim memberships; `false` omits the claim (database mode). Defaults to the seed. */
+  readonly memberships?: readonly Membership[] | false;
+  readonly ttl?: number;
+  /** Epoch seconds used for `iat`. */
+  readonly now?: number;
+  readonly issuer?: string;
+  readonly audience?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+/** Signs an ES256 access token for `sub` with WebCrypto; no dependency. */
+export declare function signSaasToken(sub: string, options?: SaasTokenOptions): Promise<string>;
+/**
+ * Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
+ * and returns its `sub`, or `null`; never throws. Identity only: memberships
+ * and plans come from the seed, never from the token.
+ */
+export declare function verifySaasToken(token: string | null | undefined, now?: number): Promise<string | null>;
+/** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
+export declare function verifySaasSession(token: string | null | undefined, now?: number): Promise<{
+  readonly sub: string;
+  readonly expiresAt: number;
+} | null>;
+//#endregion
+//#region src/testing/saas/scenarios.d.ts
+type SaasOutcome = "granted" | "denied" | "approval-required";
+type SaasScenario = {
+  readonly name: string;
+  readonly user: string;
+  /** The requested tenant, as a route or header would pass it. */
+  readonly tenant?: string;
+  readonly permission: Permission;
+  readonly row?: SaasProject | SaasDoc | SaasFolder;
+  readonly expected: {
+    readonly outcome: SaasOutcome;
+    /** One reason that must appear among the denials. */
+    readonly reason?: string;
+  };
+  /**
+   * `false` when the outcome depends on server-only inputs (a quota store,
+   * approvals), so a snapshot client is not expected to match.
+   */
+  readonly client?: boolean;
+  /**
+   * The client outcome when it is stricter than the server's: a snapshot
+   * cannot evaluate a closure deny, so it fails closed.
+   */
+  readonly clientOutcome?: SaasOutcome;
+  /** An agent acting for `user`; without `delegation` it reaches nothing. */
+  readonly actor?: Actor;
+  readonly delegation?: Delegation;
+  /** Units of the daily api-key quota this subject already used in the tenant. */
+  readonly quotaUsed?: number;
+};
+/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+export declare function saasUser(scenario: SaasScenario): Principal | Subject;
+/** A memory quota store in which every subject has already used `used` units. */
+export declare function saasLimitStore(used?: number): LimitStore;
+/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+export declare function saasScenarioOptions(scenario: SaasScenario): PermDockOptions;
+export declare function saasProject(id: string): SaasProject;
+export declare function saasDoc(id: string): SaasDoc;
+export declare function saasFolder(id: string): SaasFolder;
+/**
+ * The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
+ * A snapshot carries no graph, so every graph grant is server-only on a client.
+ */
+export declare const saasFolderScenarios: readonly SaasScenario[];
+/**
+ * Hand-written expectations. Never derive `expected` from the engine: the
+ * list is the oracle every adapter, ORM and client suite runs against.
+ */
+export declare const saasScenarios: readonly SaasScenario[];
+//#endregion
+export { SAAS_API_KEY_LIMIT, type SaasDoc, SaasDocSchema, type SaasFolder, SaasFolderSchema, type SaasMember, type SaasOrg, type SaasOutcome, type SaasPlan, type SaasProject, SaasProjectSchema, type SaasScenario, type SaasSeed, type SaasShare, type SaasTokenOptions, saasPermissions, saasPlans, saasPolicy, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/index.js

@@ -0,0 +1,3 @@
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-Bj_FFkjN.js";
+export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -0,0 +1,2 @@
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
+export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -0,0 +1,2 @@
+import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
+export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/text-diff-BdkkYSbi.js

@@ -0,0 +1,15 @@
+import { createTwoFilesPatch } from "diff";
+//#region src/cli/text-diff.ts
+const MAX_LINES = 40;
+/**
+* A unified diff from the file on disk to what the command would write,
+* cut to the first {@link MAX_LINES} lines so a CI log stays readable.
+*/
+function shortDiff(file, onDisk, next) {
+	const lines = createTwoFilesPatch(`${file} (on disk)`, `${file} (generated)`, onDisk, next, void 0, void 0, { context: 2 }).split("\n").filter((line) => !line.startsWith("=====")).filter((line, index, all) => line !== "" || index < all.length - 1);
+	if (lines.length <= MAX_LINES) return lines.join("\n");
+	const rest = lines.length - MAX_LINES;
+	return [...lines.slice(0, MAX_LINES), `… ${rest} more diff line${rest === 1 ? "" : "s"}`].join("\n");
+}
+//#endregion
+export { shortDiff as t };

package/dist/thenable-okc2xDsj.js

@@ -0,0 +1,10 @@
+//#region src/core/thenable.ts
+function isThenable(value) {
+	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+function ignoreRejection(value) {
+	Promise.resolve(value).then(void 0, () => void 0);
+}
+//#endregion
+export { isThenable as n, ignoreRejection as t };

package/dist/timeout-D51niuQP.js

@@ -0,0 +1,8 @@
+//#region src/core/timeout.ts
+/** Aborts after `ms`, or earlier when `signal` aborts. */
+function timeoutSignal(ms, signal) {
+	const deadline = AbortSignal.timeout(ms);
+	return signal === void 0 || signal === null ? deadline : AbortSignal.any([signal, deadline]);
+}
+//#endregion
+export { timeoutSignal as t };

package/dist/token-CIWxJOCh.js

@@ -0,0 +1,50 @@
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/core/token.ts
+/**
+* Only stable identity goes into the token, so refreshing a session (new
+* roles, assurance or claims) does not orphan an outstanding approval.
+*/
+function principalIdentity(principal) {
+	if (principal === null) return null;
+	return {
+		id: principal.id,
+		tenant: principal.tenant ?? null,
+		issuer: principal.issuer ?? null
+	};
+}
+/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
+function versionOf(row, field) {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
+	const value = row[field];
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
+	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
+}
+/** The digest that binds a token to the call's data when no row id does. */
+function payloadDigest(data) {
+	return bytesToBase64Url(sha256(canonicalJson(data)));
+}
+/**
+* `version` is set only for an approval that goes stale on a resource
+* change; without it the payload, and so every other token, is unchanged.
+* `payload` is set when `resourceId` is `*` (a collection action or a row
+* without an id), so an approval covers the arguments it was given and no
+* others.
+*/
+function decisionToken(input) {
+	const payload = JSON.stringify({
+		key: input.key,
+		resourceId: input.resourceId,
+		principal: principalIdentity(input.principal),
+		actor: input.actor === void 0 ? null : {
+			id: input.actor.id,
+			kind: input.actor.kind
+		},
+		fingerprint: input.fingerprint,
+		...input.version === void 0 ? {} : { version: input.version },
+		...input.payload === void 0 ? {} : { payload: input.payload }
+	});
+	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+}
+//#endregion
+export { payloadDigest as n, versionOf as r, decisionToken as t };

package/dist/trpc/index.d.ts

@@ -0,0 +1,61 @@
+import { C as Policy, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
+import { AnyTRPCMiddlewareFunction } from "@trpc/server";
+//#region src/trpc/create.d.ts
+type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
+  readonly ctx: TCtx;
+  readonly input?: TInput;
+  readonly path: string;
+  readonly type: string;
+  readonly next: (opts?: {
+    readonly ctx: TCtx;
+  }) => Promise<unknown>;
+};
+type TrpcMiddleware = AnyTRPCMiddlewareFunction;
+type TrpcPermDockOptions<TCtx = object, TUser = unknown> = ServerAdapterOptions<TrpcMiddlewareOpts<TCtx>, TUser> & {
+  /** The Web `Request` behind a context; defaults to `ctx.request` or `ctx.req`. */
+  readonly request?: (ctx: TCtx) => Request | null | undefined;
+  /** Ends or revalidates open subscriptions. */
+  readonly revocations?: RevocationFeed;
+};
+type TrpcOpenApiHooks = {
+  readonly security: (permission: Permission) => {
+    readonly openapi: {
+      readonly protect: true;
+      readonly security: readonly Record<string, readonly string[]>[];
+      readonly "x-permdock-permissions": readonly string[];
+    };
+  };
+  readonly securitySchemes: OpenApiHooks["securitySchemes"];
+};
+type TrpcPermDock<TCtx = object> = {
+  readonly permdock: () => TrpcMiddleware;
+  readonly protect: (permission: Permission | null, loadData?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
+  /** A long-lived connection for the request behind `ctx`. */
+  readonly connection: (opts: TrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly openapi: TrpcOpenApiHooks;
+  readonly errorFormatter: <TShape extends {
+    readonly data: object;
+  }>(opts: {
+    readonly shape: TShape;
+    readonly error: {
+      readonly cause?: unknown;
+    };
+  }) => TShape;
+};
+export declare function errorFormatter<TShape extends {
+  readonly data: object;
+}>(opts: {
+  readonly shape: TShape;
+  readonly error: {
+    readonly cause?: unknown;
+  };
+}): TShape;
+export declare function createPermDock<TCtx = object, TUser = unknown, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: TrpcPermDockOptions<TCtx, TUser>): TrpcPermDock<TCtx>;
+//#endregion
+export type { TrpcMiddleware, TrpcMiddlewareOpts, TrpcOpenApiHooks, TrpcPermDock, TrpcPermDockOptions };

package/dist/trpc/index.js

@@ -0,0 +1,122 @@
+import { a as problemMessage } from "../http-SO7qGttf.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { n as attached } from "../bind-VnYn2HKq.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
+import { TRPCError, isTrackedEnvelope } from "@trpc/server";
+//#region src/trpc/create.ts
+const PROBLEM = Symbol.for("permdock.problem");
+/** A `TRPCError` for a revoked subscription; the Problem Details body rides on `cause`. */
+function trpcErrorFrom(error) {
+	const problem = error.toProblemDetails();
+	const cause = { ...problem };
+	Object.defineProperty(cause, PROBLEM, {
+		value: true,
+		enumerable: true
+	});
+	return new TRPCError({
+		code: rpcCode(problem.status),
+		message: error.code,
+		cause
+	});
+}
+async function throwTrpcError(response) {
+	const cause = await problemBody(response);
+	if (cause !== null && typeof cause === "object") Object.defineProperty(cause, PROBLEM, {
+		value: true,
+		enumerable: true
+	});
+	const code = rpcCode(response.status);
+	throw new TRPCError({
+		code,
+		message: problemMessage(cause, code),
+		cause
+	});
+}
+/**
+* A PermDock error thrown further down (an `assert` in a resolver) arrives as
+* a failed middleware result; it becomes the same TRPCError `protect` throws.
+*/
+function mapDownstream(result) {
+	if (result === null || typeof result !== "object" || result.ok !== false) return Promise.resolve(result);
+	const error = result.error;
+	const cause = error instanceof TRPCError && error.code === "INTERNAL_SERVER_ERROR" ? error.cause : void 0;
+	const mapped = problemFromError(cause);
+	return mapped === void 0 ? Promise.resolve(result) : throwTrpcError(mapped);
+}
+function errorFormatter(opts) {
+	const cause = opts.error.cause;
+	if (cause === null || typeof cause !== "object" || !(PROBLEM in cause)) return opts.shape;
+	const { [PROBLEM]: _brand, ...problem } = cause;
+	return {
+		...opts.shape,
+		data: {
+			...opts.shape.data,
+			...problem
+		}
+	};
+}
+function createPermDock(policy, options) {
+	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
+	const permdock = () => (async (opts) => {
+		const request = bind(opts);
+		const instance = await attached(async () => kernel.permdock(request, await scopeOf(opts)));
+		if (!instance.ok) return throwTrpcError(instance.response);
+		const nextCtx = {
+			...opts.ctx,
+			permdock: instance.permdock
+		};
+		attach(nextCtx, request);
+		return mapDownstream(await opts.next({ ctx: nextCtx }));
+	});
+	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
+	const guardSubscription = async (result, opts, permission, loadData, protectOptions) => {
+		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
+		return {
+			...result,
+			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, {
+				unwrap: (item) => isTrackedEnvelope(item) ? item[1] : item,
+				onRevoked: trpcErrorFrom
+			})
+		};
+	};
+	const protect = (permission, loadData, protectOptions) => (async (opts) => {
+		const request = bind(opts);
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, await scopeOf(opts));
+		if (guard.ok) {
+			const nextCtx = {
+				...opts.ctx,
+				permdock: guard.permdock,
+				permdockData: guard.data
+			};
+			attach(nextCtx, request);
+			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions);
+		}
+		return throwTrpcError(guard.response);
+	});
+	const permdockHandler = (request) => {
+		return evaluate(request, {
+			ctx: { req: request },
+			path: "permdock",
+			type: "unknown",
+			next: (nextOpts) => Promise.resolve(nextOpts ?? { ctx: { req: request } })
+		});
+	};
+	const kernelOpenApi = kernel.openapi;
+	return {
+		permdock,
+		protect,
+		connection,
+		permdockHandler,
+		openapi: {
+			security: (permission) => ({ openapi: {
+				protect: true,
+				...kernelOpenApi.security(permission)
+			} }),
+			securitySchemes: kernelOpenApi.securitySchemes
+		},
+		errorFormatter
+	};
+}
+//#endregion
+export { createPermDock, errorFormatter };