permdock 0.1.0 → 0.2.0

package/dist/next/index.js

@@ -1,53 +1,28 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
-import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
-import { n as createEvaluationsHandler } from "../evaluations-DsAU9ppl.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
+import { c as NO_GRANT, n as createEvaluationsHandler } from "../evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
-import { io } from "next/cache";
-import { forbidden, unauthorized, unstable_rethrow } from "next/navigation";
-import { after } from "next/server";
+import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
+import { cacheLife, cacheTag, io } from "next/cache.js";
+import { after } from "next/server.js";
 import { PermDockProvider } from "../react/provider-client.js";
-//#region src/next/cache-life.ts
-/**
-* `{ stale }` for `cacheLife()` inside an app-owned `'use cache: private'` function: `max` when the
-* value never expires, otherwise the seconds left, clamped to `[min, max]`. A value with less than
-* `min` seconds left gets its real remainder, so Next.js leaves it out of prefetches instead of
-* serving it past `expiresAt`.
-*/
-function cacheLifeFor(value, options = {}) {
-	const min = options.min ?? 30;
-	const max = Math.max(options.max ?? 300, min);
-	const expiresAt = value?.expiresAt;
-	if (expiresAt === void 0 || expiresAt === null) return { stale: max };
-	const issuedAt = value?.issuedAt !== void 0 && value.issuedAt > 0 ? value.issuedAt : void 0;
-	const now = options.now ?? issuedAt ?? Math.floor(Date.now() / 1e3);
-	const remaining = Math.floor(expiresAt - now);
-	if (remaining < min) return { stale: Math.max(0, remaining) };
-	return { stale: Math.min(max, remaining) };
-}
-//#endregion
 //#region src/next/provider.tsx
 function renderClientProvider(options) {
 	return /* @__PURE__ */ jsx(PermDockProvider, {
 		...compact({
 			snapshotPromise: options.snapshotPromise,
 			endpoint: options.endpoint,
-			tenant: options.tenant
+			tenant: options.tenant,
+			suspend: options.suspend
 		}),
 		children: options.children
 	});
 }
 //#endregion
 //#region src/next/create.ts
-const DENIED = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "no-grant"
-	}],
-	alternatives: []
-};
 function assertServerOnly() {
 	if (globalThis.document !== void 0) throw new TypeError("permdock/next is server-only. Import hooks and Protected from permdock/react.");
 }
@@ -90,14 +65,21 @@ function afterResponse(sink) {
 }
 function wrapInstance(permdock, onDenied) {
 	if (onDenied === void 0) return permdock;
+	const wrap = (next) => wrapInstance(next, onDenied);
 	const assert = ((permission, data, options) => permdock.assert(permission, data, compact({
 		...options,
 		onDenied: options?.onDenied ?? onDenied
 	})));
-	return {
+	return Object.freeze({
 		...permdock,
-		assert
-	};
+		assert,
+		tenant: (id) => wrap(permdock.tenant(id)),
+		team: (id) => wrap(permdock.team(id)),
+		derive: (options) => {
+			const derived = permdock.derive(options);
+			return derived instanceof Promise ? derived.then(wrap) : wrap(derived);
+		}
+	});
 }
 function createPermDock(policy, options) {
 	assertServerOnly();
@@ -117,13 +99,8 @@ function createPermDock(policy, options) {
 		await io();
 		const built = await createPermDock$1(policy, user, compact({
 			tenant,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			sink,
-			limits: options.limits
+			...instanceOptions(options),
+			sink
 		}));
 		return wrapInstance(options.otel === void 0 ? built : options.otel(built), options.onDenied);
 	});
@@ -131,22 +108,38 @@ function createPermDock(policy, options) {
 		const tenant = query?.tenant ?? await resolveFallbackTenant();
 		return instantiate(tenant ?? "");
 	};
-	const getPermission = async (permission, data) => {
+	const getPermission = async (permission, data, query) => {
 		try {
-			const decision = (await getPermDock()).decide(permission, data);
+			const decision = (await getPermDock(query)).decide(permission, data);
 			return {
 				allowed: decision.outcome === "granted",
 				status: "ready",
 				decision
 			};
-		} catch {
+		} catch (error) {
+			unstable_rethrow(error);
 			return {
 				allowed: false,
 				status: "ready",
-				decision: DENIED
+				decision: NO_GRANT
 			};
 		}
 	};
+	const getSnapshot = async (query = {}) => {
+		const permdock = await getPermDock(compact({ tenant: query.tenant }));
+		const snapshot = permdock.snapshot(compact({
+			include: query.include,
+			tenants: query.tenants
+		}));
+		try {
+			cacheLife(cacheLifeFor(snapshot));
+			cacheTag(snapshotTag(permdock.subject.principal?.id), ...query.tags ?? []);
+		} catch (error) {
+			unstable_rethrow(error);
+			throw new Error("PermDock: getSnapshot() sets cacheLife() and cacheTag(), so call it inside a 'use cache: private' function with cacheComponents enabled.", { cause: error });
+		}
+		return snapshot;
+	};
 	const requireAccess = async (input) => {
 		const permdock = await getPermDock(input.tenant === void 0 ? void 0 : { tenant: input.tenant });
 		const assert = permdock.assert;
@@ -160,11 +153,12 @@ function createPermDock(policy, options) {
 		const snapshotPromise = getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
 			include: props.include,
 			tenants: props.tenants
-		}))).catch(() => emptySnapshot());
+		})));
 		return renderClientProvider(compact({
 			snapshotPromise,
 			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock",
 			tenant: props.tenant,
+			suspend: props.suspend,
 			children: props.children
 		}));
 	};
@@ -176,20 +170,11 @@ function createPermDock(policy, options) {
 	return {
 		getPermDock,
 		getPermission,
+		getSnapshot,
 		requireAccess,
 		PermDockProvider,
 		permdockHandler
 	};
 }
 //#endregion
-//#region src/next/snapshot-tag.ts
-/**
-* The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or `permdock:anon`
-* without a subject. Tag the private cache with it and pass it to `updateTag` or
-* `revalidateTag` on every write that changes the subject's snapshot.
-*/
-function snapshotTag(sub) {
-	return `permdock:${sub === void 0 || sub === null || sub === "" ? "anon" : sub}`;
-}
-//#endregion
-export { cacheLifeFor, createPermDock, snapshotTag };
+export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotTag };

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-D6Z6-rKJ.js";
+import { a as PermDockPluginOptions } from "../types-BPxgszlT.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,2 +1,33 @@
-import { t as createPermDockPlugin } from "../plugin-4gr7IxFJ.js";
+import { i as describeError } from "../errors-CWfoNg9N.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-UihESpsJ.js";
+//#region src/cli/plugin.ts
+const PHASE_BUILD = "phase-production-build";
+const PHASE_DEV = "phase-development-server";
+function createPermDockPlugin(options) {
+	const schedulers = /* @__PURE__ */ new Map();
+	return function permdockPlugin(nextConfig) {
+		return async (phase, context) => {
+			const resolved = typeof nextConfig === "function" ? await nextConfig(phase, context) : nextConfig;
+			const cwd = process.cwd();
+			if (phase === PHASE_BUILD) {
+				const check = process.env["PERMDOCK_COLLECT"] !== "write";
+				report(await runPluginCollect(cwd, options, check));
+			} else if (phase === PHASE_DEV) {
+				const scheduler = schedulers.get(cwd) ?? createCollectScheduler(cwd, options);
+				schedulers.set(cwd, scheduler);
+				try {
+					report(await scheduler.run(false));
+				} catch (error) {
+					report(describeError(error));
+				}
+				scheduler.watch();
+			}
+			return resolved;
+		};
+	};
+}
+async function runPluginCollect(cwd, options, check) {
+	return (await collectOnce(cwd, options, check, false)).message;
+}
+//#endregion
 export { createPermDockPlugin };

package/dist/node/index.d.ts

@@ -1,37 +1,18 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { o as OtelWrap } from "../types-B9dmiiab.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, t as Guard, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
 import { a as toRequest, i as sendResponse, n as fromResponse, r as isServerResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts
-type NodePermDockOptions<TUser = unknown> = {
-  readonly subject: (req: NodeRequest) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<NodeRequest>;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
+type NodePermDockOptions<TUser = unknown> = ServerAdapterOptions<NodeRequest, TUser>;
+type NodeProtect = {
+  (permission: Permission, loadData?: (req: NodeRequest) => unknown, protectOptions?: ProtectOptions): (req: IncomingMessage) => Promise<Guard>;
+  (permission: null, loadData?: (req: NodeRequest) => unknown, protectOptions?: ProtectOptions): (req: IncomingMessage) => Promise<ScopeGuard>;
 };
 type NodePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly permdock: (req: IncomingMessage) => Promise<PermDock<V>>;
-  readonly protect: (permission: Permission, loadData?: (req: NodeRequest) => unknown, protectOptions?: ProtectOptions) => (req: IncomingMessage) => Promise<Guard>;
+  readonly protect: NodeProtect;
   readonly send: typeof sendResponse;
   readonly permdockHandler: () => (req: IncomingMessage, res: ServerResponse) => Promise<void>;
   readonly toRequest: typeof toRequest;

package/dist/node/index.js

@@ -1,55 +1,23 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-GgVApX1k.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-BIhmLfCc.js";
 //#region src/node/create.ts
+const nodeRequest = (req) => req;
 function createPermDock(policy, options) {
-	const contexts = /* @__PURE__ */ new WeakMap();
-	const bound = /* @__PURE__ */ new WeakMap();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => {
-			const req = contexts.get(request);
-			return req === void 0 ? null : options.subject(req);
-		},
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		adapter: "node",
-		wrap: options.otel
-	}));
-	const bind = (req) => {
-		const hit = bound.get(req);
-		if (hit !== void 0) return hit;
-		const nodeReq = req;
-		const request = toRequest(nodeReq);
-		bound.set(req, request);
-		contexts.set(request, nodeReq);
-		return request;
-	};
-	const scopeOf = (req) => tenantScope(options.tenant, req);
+	const bound = bindKernel(policy, options, "node", toRequest);
+	const { kernel, handlerScope } = bound;
+	const bind = (req) => bound.bind(nodeRequest(req));
+	const scopeOf = (req) => bound.scopeOf(nodeRequest(req));
 	const permdock = async (req) => kernel.permdock(bind(req), await scopeOf(req));
-	const protect = (permission, loadData, protectOptions) => async (req) => kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(req), protectOptions)(bind(req), await scopeOf(req));
+	const protect = ((permission, loadData, protectOptions) => async (req) => kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(nodeRequest(req)), protectOptions)(bind(req), await scopeOf(req)));
 	const permdockHandler = () => {
-		const { POST, GET } = kernel.permdockHandler((request) => {
-			const req = contexts.get(request);
-			return req === void 0 ? { tenant: void 0 } : scopeOf(req);
-		});
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
 		return async (req, res) => {
 			if (req.method === "GET" || req.method === "HEAD") {
 				await sendResponse(res, await GET(bind(req)));
 				return;
 			}
-			const nodeReq = req;
-			const request = toRequest(nodeReq);
-			contexts.set(request, nodeReq);
-			await sendResponse(res, await POST(request));
+			await sendResponse(res, await POST(bound.rebind(nodeRequest(req))));
 		};
 	};
 	return {

package/dist/openai/index.d.ts

@@ -1,7 +1,8 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, ur as Delegation, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { t as ToolMap } from "../types-CxquUByI.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */
 type OpenAiContext = {
@@ -14,23 +15,13 @@ type OpenAiContext = {
 type OpenAiRunContext = {
   readonly context?: unknown;
 };
-type OpenAiPermDockOptions<TUser = unknown> = {
+type OpenAiPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject: (context: OpenAiContext) => TUser | Promise<TUser>;
   readonly actor?: (context: OpenAiContext) => unknown;
   readonly delegation?: (context: OpenAiContext) => Delegation | undefined | Promise<Delegation | undefined>;
   readonly tenant?: string | ((context: OpenAiContext) => string | undefined | Promise<string | undefined>);
   readonly tools: ToolMap;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
   readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly snapshots?: SnapshotSource;
 };
 type OpenAiTool = {
   readonly name: string;

package/dist/openai/index.js

@@ -1,6 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { p as memoryApprovalStore } from "../helpers-DnSOrhB9.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-YOGCWNLf.js";
+import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-GSQnMz3O.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;
@@ -31,16 +32,9 @@ function createPermDock(policy, options) {
 		...compact({
 			actor: options.actor,
 			delegation: options.delegation,
-			tenant: options.tenant,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			sink: options.sink,
-			limits: options.limits,
-			snapshots: options.snapshots
+			tenant: options.tenant
 		}),
+		...instanceOptions(options),
 		subject: options.subject,
 		tools: options.tools,
 		store,
@@ -54,15 +48,8 @@ function createPermDock(policy, options) {
 		const context = appContext(runContext);
 		const binding = options.tools[toolName];
 		if (binding === void 0) return true;
-		try {
-			const can = (await kernel.instance(context)).can;
-			if (binding.data === void 0) return !can(permission);
-			const data = await binding.data(input);
-			if (data === null || data === void 0) return true;
-			return !can(permission, data);
-		} catch {
-			return true;
-		}
+		const checked = await kernel.check(binding, input, context, { simulate: true });
+		return !checked.ok || checked.raw.outcome !== "granted";
 	};
 	const guardTools = async (tools, context) => {
 		const allowed = await kernel.allowedToolNames(context);

package/dist/openapi/index.d.ts

@@ -1,5 +1,7 @@
-import { C as Policy, _r as Condition, mr as Principal } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
+import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { a as ProblemDetails } from "../errors-DAqevpNk.js";
+import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";
 type OverlayVersion = "1.1" | "1.2";
@@ -83,11 +85,92 @@ export declare const DRAFT_PINS: {
 export declare const PROFILE_NAMES: {
   readonly fapi2: "fapi-20-security-profile";
 };
-export declare const GNAP_RESERVED = "scheme.type 'gnap' is reserved and emits nothing. See https://permdock.dev/docs/standards/watch-list#gnap";
+export declare const GNAP_RESERVED = "scheme.type 'gnap' is reserved and emits nothing. See https://permdock.com/docs/standards/watch-list#gnap";
 //#endregion
 //#region src/openapi/emit.d.ts
 export declare function securitySchemesOf(policy: Policy, options: OpenApiPermDockOptions): Record<string, unknown>;
 export declare function catalogOf(options: OpenApiPermDockOptions, extraDrafts?: Readonly<Record<string, string>>): Record<string, unknown>;
 export declare function openapiVersion(target: OpenApiTarget): string;
 //#endregion
-export type { OpenApiDescribe, OpenApiDocsHints, OpenApiFactory, OpenApiOverlayOptions, OpenApiPermDock, OpenApiPermDockOptions, OpenApiSchemeOptions, OpenApiSecurityRequirement, OpenApiTarget, OverlayOperation, OverlayVersion, SchemeType, SecurityProfileName };
+//#region src/openapi/operations.d.ts
+/**
+ * One declared operation: a permission, or a permission with the operation id
+ * a tool name uses and the OAuth scopes that reach it, or only OAuth scopes
+ * for a route that checks no permission (`protect(null)`).
+ */
+type OperationEntry = Permission | {
+  readonly permission: Permission;
+  readonly operationId?: string;
+  readonly oauthScopes?: readonly string[];
+} | {
+  readonly permission?: undefined;
+  readonly operationId?: string;
+  readonly oauthScopes: readonly string[];
+};
+/**
+ * The permission of each operation of an API, declared once and read by the
+ * HTTP gate and by `permdock/mcp`'s `permissionFor`, so a REST route and the
+ * MCP tool that calls it can never disagree.
+ */
+type OperationPermissions = {
+  /**
+   * The permission of a request: the declared operation whose method and
+   * path template match, a literal segment winning over a `{param}`.
+   * `undefined` for an undeclared operation, which a gate denies, and for an
+   * operation that declares only OAuth scopes. A `HEAD` request matches the
+   * `GET` entry of its path when no `HEAD` entry matches.
+   */
+  forRequest(method: string, path: string): Permission | undefined;
+  /** The permission of an operation id; pass it as `permissionFor` when tool names are operation ids. */
+  forOperation(id: string): Permission | undefined;
+  oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
+  oauthScopesForOperation(id: string): readonly string[] | undefined;
+};
+/**
+ * Operations as `"METHOD /path/{param}"` keys, the OpenAPI path template, to
+ * a permission. `base` is a prefix requests carry and the keys do not
+ * (`/api/v1`). A key that is not a method and a path throws.
+ */
+export declare function operationPermissions(operations: Readonly<Record<string, OperationEntry>>, options?: {
+  readonly base?: string;
+}): OperationPermissions;
+/**
+ * The operation permissions an OpenAPI document declares: every operation
+ * whose `x-permdock-permissions` names exactly one permission of `tree`, keyed
+ * by its method, path and `operationId`. An operation naming none, several or
+ * an unknown key is left out, so a gate denies it.
+ */
+export declare function operationPermissionsFromOpenApi(document: unknown, tree: PermissionTree, options?: {
+  readonly base?: string;
+}): OperationPermissions;
+//#endregion
+//#region src/openapi/problem-details.d.ts
+/**
+ * The Problem Details body the adapters send on a denial, as a Standard
+ * Schema with a JSON Schema, for `oc.errors({ FORBIDDEN: { data: problemDetails } })`.
+ * Extension members pass through: RFC 9457 lets a problem type add them.
+ */
+export declare const problemDetails: StandardSchemaV1<ProblemDetails> & StandardJSONSchemaV1<ProblemDetails>;
+//#endregion
+//#region src/openapi/security.d.ts
+type SecurityForOptions = {
+  /** The security scheme name; defaults to `oauth2`, the name the adapters' `openapi.securitySchemes()` declares. */
+  readonly scheme?: string;
+  /** Any one of the permissions suffices: one requirement per scope instead of one with every scope. */
+  readonly anyOf?: boolean;
+};
+type SecurityFor = {
+  readonly security: readonly OpenApiSecurityRequirement[];
+  readonly "x-permdock-permissions": readonly string[];
+};
+/** The `x-permdock-permissions` value: the permission keys an operation enforces. */
+export declare function permissionsExtension(permissions: Permission | readonly Permission[]): readonly string[];
+/**
+ * An operation's `security` and `x-permdock-permissions`, from permission
+ * references alone. Needs no policy, so a contract package can import it.
+ * Unlike `permdock openapi emit`, it never drops `security` for a public
+ * permission: that needs the policy.
+ */
+export declare function securityFor(permission: Permission | readonly Permission[], options?: SecurityForOptions): SecurityFor;
+//#endregion
+export type { OpenApiDescribe, OpenApiDocsHints, OpenApiFactory, OpenApiOverlayOptions, OpenApiPermDock, OpenApiPermDockOptions, OpenApiSchemeOptions, OpenApiSecurityRequirement, OpenApiTarget, OperationEntry, OperationPermissions, OverlayOperation, OverlayVersion, SchemeType, SecurityFor, SecurityForOptions, SecurityProfileName };

package/dist/openapi/index.js

@@ -1,3 +1,3 @@
-import { n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "../pins-CqE1jZuF.js";
-import { i as securitySchemesOf, n as catalogOf, r as openapiVersion, t as createPermDock } from "../openapi-DcqM8nU7.js";
-export { DRAFT_PINS, GNAP_RESERVED, PROFILE_NAMES, catalogOf, createPermDock, openapiVersion, securitySchemesOf };
+import { n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "../pins-8ILTftC9.js";
+import { a as operationPermissionsFromOpenApi, c as openapiVersion, i as operationPermissions, l as securitySchemesOf, n as securityFor, o as createPermDock, r as problemDetails, s as catalogOf, t as permissionsExtension } from "../openapi-BqRBvAng.js";
+export { DRAFT_PINS, GNAP_RESERVED, PROFILE_NAMES, catalogOf, createPermDock, openapiVersion, operationPermissions, operationPermissionsFromOpenApi, permissionsExtension, problemDetails, securityFor, securitySchemesOf };

package/dist/{openapi-CwePaF7C.js → openapi-Bbg4wGVL.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {
@@ -122,7 +122,7 @@ function openapi(ctx) {
 			const doc = listArg(rawArgs, "doc")[0];
 			if (parsed._[0] === "import") {
 				if (doc === void 0) throw new Error("openapi --doc is required");
-				const { runOpenapiImport } = await import("./openapi-import-BWRUNNeW.js");
+				const { runOpenapiImport } = await import("./openapi-import-cmwetbzw.js");
 				ctx.report(await runOpenapiImport({
 					cwd: ctx.cwd,
 					doc,
@@ -134,7 +134,7 @@ function openapi(ctx) {
 				}));
 				return;
 			}
-			const result = await (await import("./openapi-DWD0Uc_4.js")).runOpenapi({
+			const result = await (await import("./openapi-CqqEbHsL.js")).runOpenapi({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,