permdock 0.1.0 → 0.2.0

package/dist/{row-check-BajTgQZ-.d.ts → row-check-Dt35czLy.d.ts}

@@ -1,22 +1,9 @@
-//#region src/conditions/graph-sql.d.ts
-/** Where the graph lives in the database, as the `toWhere` compilers take it. */
-type RelationsMapping = {
-  /** The table of each resource the graph reads; default the resource name. */
-  readonly tables?: Readonly<Record<string, string>>;
-  /**
-   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as
-   * the one `permdock rls` keeps. Without it, parent walks are a bounded
-   * recursive query over the resource's own table.
-   */
-  readonly closure?: string;
-};
-//#endregion
 //#region src/conditions/subject-settings.d.ts
 type WithSubjectOptions = {
   /** Which settings the generated policies read; match `rls.dialect`. Default `supabase`. */
   readonly dialect?: "supabase" | "guc" | "neon";
   /**
-   * `set local role` before the settings: `authenticated` with a principal, `anon` without.
+   * The local `role` setting before the claims: `authenticated` with a principal, `anon` without.
    * `false` keeps the connection's role, for a login role that RLS already applies to.
    */
   readonly role?: "authenticated" | "anon" | false;
@@ -29,6 +16,16 @@ type WithSubjectOptions = {
    * helpers. `sub`, `role` and the tenant claim always come from the subject.
    */
   readonly claims?: Readonly<Record<string, unknown>>;
+  /**
+   * Field names of the API-key claim written for a principal that acts through a credential
+   * (`rls.apiKeys`). Default `{ claim: 'api_key', scopes: 'scopes', tenant: 'tenant', roles: 'roles' }`.
+   */
+  readonly apiKeys?: {
+    readonly claim?: string;
+    readonly scopes?: string;
+    readonly tenant?: string;
+    readonly roles?: string;
+  };
 };
 //#endregion
 //#region src/conditions/row-check.d.ts
@@ -40,4 +37,4 @@ type RowCheck = {
   readonly granted: boolean;
 };
 //#endregion
-export { WithSubjectOptions as n, RelationsMapping as r, RowCheck as t };
+export { WithSubjectOptions as n, RowCheck as t };

package/dist/rpc-DOK54_CS.js

@@ -0,0 +1,89 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { o as requestFromContext } from "./http-SO7qGttf.js";
+import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
+import { t as adapterKernel } from "./bind-VnYn2HKq.js";
+import { n as guardIterable } from "./stream-DDpvynSB.js";
+//#region src/server/rpc.ts
+/** The tRPC and oRPC error code for a Problem Details status. */
+function rpcCode(status) {
+	switch (status) {
+		case 400: return "BAD_REQUEST";
+		case 401: return "UNAUTHORIZED";
+		case 404: return "NOT_FOUND";
+		case 429: return "TOO_MANY_REQUESTS";
+		case 503: return "SERVICE_UNAVAILABLE";
+		default: return "FORBIDDEN";
+	}
+}
+/**
+* The Problem Details body of a PermDock response, or `{ status }` when it has
+* none. An RPC error carries only this body; the response headers are dropped.
+*/
+async function problemBody(response) {
+	try {
+		return await response.json();
+	} catch {
+		return { status: response.status };
+	}
+}
+/**
+* The kernel of an RPC adapter. `contextOf` reads the procedure context from
+* its opts; `path` names the fallback `Request` for a context without one.
+*/
+function bindRpcKernel(policy, options, adapter, contextOf, path) {
+	const optsByRequest = /* @__PURE__ */ new WeakMap();
+	const requestByCtx = /* @__PURE__ */ new WeakMap();
+	const kernel = adapterKernel(policy, options, adapter, (request) => optsByRequest.get(request));
+	const requestOf = (ctx) => {
+		if (options.request !== void 0) try {
+			return options.request(ctx) ?? void 0;
+		} catch {
+			return;
+		}
+		return requestFromContext(ctx);
+	};
+	const bind = (opts) => {
+		const ctx = contextOf(opts);
+		const key = ctx;
+		const hit = requestByCtx.get(key);
+		if (hit !== void 0) return hit;
+		const request = requestOf(ctx) ?? new Request(`http://localhost/${adapter}/${path(opts)}`, { method: "POST" });
+		requestByCtx.set(key, request);
+		if (!optsByRequest.has(request)) optsByRequest.set(request, opts);
+		return request;
+	};
+	const scopeOf = (opts) => tenantScope(options.tenant, opts);
+	const connection = async (opts, connectionOptions) => kernel.connection(bind(opts), connectionOptions, await scopeOf(opts));
+	const evaluations = kernel.permdockHandler((request) => {
+		const opts = optsByRequest.get(request);
+		return opts === void 0 ? { tenant: void 0 } : scopeOf(opts);
+	});
+	const evaluate = (request, opts) => {
+		bind(opts);
+		return request.method === "GET" ? evaluations.GET(request) : evaluations.POST(request);
+	};
+	return {
+		kernel,
+		bind,
+		attach: (ctx, request) => {
+			requestByCtx.set(ctx, request);
+		},
+		scopeOf,
+		connection,
+		evaluate
+	};
+}
+/** Wraps a streamed result so revocation ends it and items the subscriber cannot read drop. */
+async function guardStream(source, open, permission, loadData, protectOptions, guard) {
+	const conn = await open(permission === null ? {} : compact({
+		permission,
+		data: loadData
+	}));
+	return guardIterable(source, conn, compact({
+		items: protectOptions?.items,
+		unwrap: guard.unwrap,
+		onRevoked: guard.onRevoked
+	}));
+}
+//#endregion
+export { rpcCode as i, guardStream as n, problemBody as r, bindRpcKernel as t };

package/dist/{run-CJ6UvS3a.js → run-YXCJDNYk.js}

@@ -1,11 +1,16 @@
-import { a as cliVersion } from "./version-CnSh33Fj.js";
-import { n as loadConfig, r as resolveCwd } from "./config-BPYmjTOp.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
-import { i as exitCodeOf, n as cliErrorKind, r as cliProblem } from "./errors-DSMnAVNa.js";
-import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
+import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
+import { o as cliVersion } from "./version-BvacVTZR.js";
+import { a as resolveCwd, i as readConfig } from "./config-BJiM-xAm.js";
+import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { stripVTControlCharacters } from "node:util";
+import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
 //#region src/cli/run.ts
 const NAMES = Object.keys(commands).filter(isCommand);
+const NO_CONFIG = {
+	config: {},
+	warnings: [],
+	file: void 0
+};
 async function run(argv, options) {
 	const stdoutChunks = [];
 	const stderrChunks = [];
@@ -41,9 +46,13 @@ async function run(argv, options) {
 	const first = globals._[0];
 	const name = first === "help" ? globals._[1] : first;
 	let result;
-	const contextFor = (cwd, config) => ({
+	const configFile = stringArg(globals.config);
+	const contextFor = (cwd, loaded = NO_CONFIG) => ({
 		cwd,
-		config,
+		config: loaded.config,
+		...configFile === void 0 ? {} : { configFile },
+		...loaded.file === void 0 ? {} : { configPath: loaded.file },
+		configWarnings: loaded.warnings,
 		io,
 		now: io.now?.() ?? /* @__PURE__ */ new Date(),
 		json,
@@ -66,7 +75,7 @@ async function run(argv, options) {
 	}
 	if (askedHelp || first === "help" || name === void 0) {
 		const root = rootCommand();
-		const usage = name === void 0 ? await renderUsage(root) : await renderUsage(await load(name, contextFor(options?.cwd ?? process.cwd(), {})), root);
+		const usage = name === void 0 ? await renderUsage(root) : await renderUsage(await load(name, contextFor(options?.cwd ?? process.cwd())), root);
 		if (name === void 0 && !askedHelp && first !== "help") {
 			writeErr(plain(usage));
 			return done(2);
@@ -75,14 +84,15 @@ async function run(argv, options) {
 		return done(0);
 	}
 	const cwd = resolveCwd(stringArg(globals.cwd), options?.cwd ?? process.cwd());
-	let config;
+	let loaded;
 	try {
-		config = await loadConfig(cwd, stringArg(globals.config));
+		loaded = await readConfig(cwd, configFile);
 	} catch (error) {
-		return fail(cliErrorKind(error), error instanceof Error ? error.message : String(error));
+		return fail(cliErrorKind(error), describeError(error));
 	}
+	if (name !== "config") for (const warning of loaded.warnings) writeErr(`permdock: warning: ${warning}`);
 	try {
-		const command = await load(name, contextFor(cwd, config));
+		const command = await load(name, contextFor(cwd, loaded));
 		const rawArgs = withoutCommand(argv, name);
 		await runCommand(command, { rawArgs: normaliseValues(rawArgs, await resolveArgs(command)) });
 	} catch (error) {
@@ -91,6 +101,7 @@ async function run(argv, options) {
 		return fail(cliErrorKind(error), error.message, name);
 	}
 	if (result === void 0) return done(0);
+	if (json && result.code !== 0 && !isJson(result.output)) return fail(result.code === 2 ? "usage" : "failed", result.output, name);
 	writeOut(result.output);
 	return done(result.code);
 }
@@ -118,6 +129,14 @@ function rootCommand() {
 async function load(name, ctx) {
 	return (await commands[name]())(ctx);
 }
+function isJson(text) {
+	try {
+		JSON.parse(text);
+		return true;
+	} catch {
+		return false;
+	}
+}
 function lined(text) {
 	return text.endsWith("\n") ? text : `${text}\n`;
 }

package/dist/runtime-CB8gQFvS.js

@@ -0,0 +1,11 @@
+import { a as protectedView, s as scopedTenant } from "./views-Soe7bGSC.js";
+//#region src/svelte/protected.ts
+/** The instance for `tenant`, built once per store change rather than once per check. */
+function scopedFor(store, tenant, _generation) {
+	return scopedTenant(store.get(), tenant);
+}
+function viewFor(store, reference, data, scoped, _generation) {
+	return protectedView(store.permissionState(reference, data), store.get(), reference, data, scoped);
+}
+//#endregion
+export { viewFor as n, scopedFor as t };

package/dist/{saas-BRrZzJkM.js → saas-Bj_FFkjN.js}

@@ -1,10 +1,10 @@
-import { r as principal } from "./refs-ChLSxbST.js";
-import { a as definePolicy, d as role, m as memoryLimitStore, o as deny, t as allow } from "./policy-ANp36PnI.js";
-import { m as memoryRoleSource } from "./src-CTNT-PBW.js";
-import { d as relation, n as anyone } from "./grantee-Bv04_Vzf.js";
-import { t as memoryRelations } from "./relations-r4soIFZB.js";
-import { i as quoteSqlLiteral } from "./sql-Bll1d7y0.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CofRqesP.js";
+import { r as principal } from "./refs-KYb4ntaz.js";
+import { _ as memoryLimitStore, a as definePolicy, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
+import { _ as memoryRoleSource } from "./src-CSbUiozF.js";
+import { n as anyone, p as relation } from "./grantee-Cv5Sogfv.js";
+import { t as memoryRelations } from "./relations-cjOL01hZ.js";
+import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CpZrivYv.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -979,6 +979,16 @@ const saasScenarios = Object.freeze([
 		expected: { outcome: "granted" },
 		clientOutcome: "denied"
 	},
+	{
+		name: "team lead does not pass a tenant-level doc check without a row",
+		user: "gina",
+		tenant: "acme",
+		permission: saasPermissions.doc.update,
+		expected: {
+			outcome: "denied",
+			reason: "scope"
+		}
+	},
 	{
 		name: "team lead cannot update a locked doc",
 		user: "gina",

package/dist/{schema-P8yoma__.js → schema-D3MnDMxa.js}

@@ -1,4 +1,4 @@
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 //#region src/catalog/schema.ts
 const name = {
 	type: "string",
@@ -58,7 +58,7 @@ const approval = { oneOf: [{ const: "human" }, {
 /** `schemas/catalog-v1.json`; a test keeps the two equal. */
 const catalogSchema = freezeDeep({
 	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.dev/schemas/catalog-v1.json",
+	$id: "https://permdock.com/schemas/catalog-v1.json",
 	type: "object",
 	required: [
 		"$schema",
@@ -85,7 +85,8 @@ const catalogSchema = freezeDeep({
 					definedIn: { type: "string" },
 					relations: { type: "object" },
 					version: { type: "string" },
-					restricted: { type: "string" }
+					restricted: { type: "string" },
+					restrictedStops: strings
 				}
 			}
 		},
@@ -198,6 +199,7 @@ const catalogSchema = freezeDeep({
 						}
 					},
 					renamedFrom: strings,
+					levels: strings,
 					hostable: { const: true },
 					rowConditions: { type: "boolean" },
 					approvals: {
@@ -250,6 +252,7 @@ const catalogSchema = freezeDeep({
 					validity,
 					name: { type: "string" },
 					purpose: strings,
+					requires: { oneOf: [{ type: "string" }, strings] },
 					limit: {
 						type: "object",
 						required: ["count", "per"],
@@ -282,7 +285,8 @@ const catalogSchema = freezeDeep({
 						required: ["kind"],
 						properties: {
 							kind: { type: "string" },
-							id: { type: "string" }
+							id: { type: "string" },
+							client: { type: "string" }
 						}
 					},
 					permissions: strings,

package/dist/scim/index.d.ts

@@ -1,2 +1,2 @@
-import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-LF_hS-yn.js";
+import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-A0YNL8jZ.js";
 export { type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,2 +1,2 @@
-import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-9NFa0XVZ.js";
+import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-BFGBBAqR.js";
 export { DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/{scim-9NFa0XVZ.js → scim-BFGBBAqR.js}

@@ -1,5 +1,5 @@
 import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as sha256 } from "./sha256-BO0swRXL.js";
 import { a as memorySink, i as membershipEvent } from "./sink-Bd9PSyfq.js";
 //#region src/scim/auth.ts

package/dist/{scopes-cKVp_WTw.js → scopes-CVdPrWN-.js}

@@ -1,4 +1,5 @@
-import { S as isForbiddenKey } from "./permissions-DC7GROPA.js";
+import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+import { t as idText } from "./ids-DC4V4CFu.js";
 //#region src/core/scopes.ts
 const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
 const NAME = /^[a-z][a-z0-9_]*$/u;
@@ -126,17 +127,22 @@ function normalizeMembership(input, scopes) {
 		const seats = raw["entitlements"].filter((item) => typeof item === "string" && item !== "");
 		if (seats.length > 0) extra.entitlements = Object.freeze(seats);
 	}
+	if (raw["keep"] !== void 0) {
+		if (!Array.isArray(raw["keep"]) || !raw["keep"].every((key) => typeof key === "string" && key !== "")) return;
+		extra.keep = Object.freeze([...raw["keep"]]);
+	}
 	const named = raw["scope"] !== void 0 || raw["id"] !== void 0;
 	const legacy = raw["tenant"] !== void 0 || raw["team"] !== void 0;
 	const on = raw["on"];
 	if (on !== void 0) {
 		if (named || legacy || on === null || typeof on !== "object") return;
 		const target = on;
-		if (!isId(target["resource"]) || !isId(target["id"])) return;
+		const targetId = idText(target["id"]);
+		if (!isId(target["resource"]) || targetId === void 0) return;
 		return Object.freeze({
 			on: Object.freeze({
 				resource: target["resource"],
-				id: target["id"]
+				id: targetId
 			}),
 			roles: Object.freeze([...roles]),
 			...extra
@@ -163,19 +169,20 @@ function normalizeMembership(input, scopes) {
 		scope = resolveScope(scopes, "tenant");
 		id = raw["tenant"];
 	}
-	if (scope === void 0 || !isId(id)) return;
+	const text = idText(id);
+	if (scope === void 0 || text === void 0) return;
 	const ancestors = scopeChain(scopes, scope).slice(1);
 	const resolved = {};
 	for (const key of Object.keys(within)) {
 		if (isForbiddenKey(key)) return;
 		const name = resolveScope(scopes, key);
-		const value = within[key];
-		if (name !== void 0 && ancestors.includes(name) && isId(value)) resolved[name] = value;
+		const value = idText(within[key]);
+		if (name !== void 0 && ancestors.includes(name) && value !== void 0) resolved[name] = value;
 	}
 	if (ancestors.some((name) => resolved[name] === void 0)) return;
 	return Object.freeze({
 		scope,
-		id,
+		id: text,
 		...ancestors.length === 0 ? {} : { within: Object.freeze(resolved) },
 		roles: Object.freeze([...roles]),
 		...extra
@@ -208,5 +215,25 @@ function activeFor(membership, scopes, active) {
 	if (root === void 0 || membership.scope === void 0 || !scopeChain(scopes, membership.scope).includes(root)) return true;
 	return active !== void 0 && scopeIdOf(membership, root) === active;
 }
+/** Whether `membership` counts for `key`: always, unless a suspension limits it to `keep`. */
+function keepsPermission(membership, key) {
+	return membership.keep === void 0 || membership.keep.includes(key);
+}
+/**
+* The subject as it stands for one permission: memberships a suspension
+* limits to other permissions are left out. The same object when none is.
+*/
+function subjectForPermission(subject, key) {
+	const principal = subject.principal;
+	const memberships = principal?.memberships;
+	if (principal === null || memberships === void 0 || memberships.every((membership) => keepsPermission(membership, key))) return subject;
+	return {
+		...subject,
+		principal: {
+			...principal,
+			memberships: memberships.filter((membership) => keepsPermission(membership, key))
+		}
+	};
+}
 //#endregion
-export { resolveScope as a, scopeChain as c, subjectMemberships as d, tenantOf as f, normalizeMemberships as i, scopeIdOf as l, defineScopes as n, rootMembershipId as o, findScope as r, rootScope as s, activeFor as t, scopeList as u };
+export { normalizeMemberships as a, rootScope as c, scopeList as d, subjectForPermission as f, keepsPermission as i, scopeChain as l, tenantOf as m, defineScopes as n, resolveScope as o, subjectMemberships as p, findScope as r, rootMembershipId as s, activeFor as t, scopeIdOf as u };

package/dist/server/index.d.ts

@@ -1,8 +1,11 @@
-import { $ as DecisionSink, Ft as Credential, Ht as CredentialPrincipal, J as AuthEvent, Mn as Decision, St as SubjectResolver, X as CredentialVerifier, hr as Subject, mr as Principal, mt as SettingsSource } from "../policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "../permissions-B4apnahQ.js";
-import { a as PermDockValidationError, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as ProblemDetails, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DbZ1YOnb.js";
+import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CtF23SrC.js";
+import { t as Disclosure } from "../problem-details-CkL50EEf.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DAqevpNk.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
-import { S as ConnectionOptions, _ as invalidSignatureProblem, a as ServerPermDockOptions, b as Connection, c as createEvaluationsHandler, d as WebBotAuthJwk, f as WebBotAuthKeyLookup, g as discoverViaSignatureAgent, h as WebBotAuthVerifier, i as ServerPermDock, l as DiscoverViaSignatureAgentOptions, m as WebBotAuthOptions, n as OpenApiHooks, p as WebBotAuthKeys, r as ProtectOptions, s as createPermDock, t as Guard, u as InvalidSignatureError, v as invalidSignatureResponse, x as ConnectionData, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-BWyx3jua.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DwQH8ufx.js";
 //#region src/server/credentials.d.ts
 /** `on('auth')` causes for an API key that resolves to the anonymous subject. */
 type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";
@@ -100,24 +103,32 @@ type ApiKeySubjectOptions = {
 export declare function subjectFromApiKey(options: ApiKeySubjectOptions): SubjectResolver<string | undefined | null, CredentialPrincipal>;
 //#endregion
 //#region src/server/map-error.d.ts
+type ProblemFromErrorOptions = {
+  readonly instance?: string;
+  /** Whether the request carried credentials, which picks the `401` challenge. */
+  readonly credentials?: boolean;
+};
 /**
- * Turns a thrown PermDock error into its Problem Details response. Returns
- * `undefined` for anything else so the framework's own error path takes over.
+ * Turns a thrown PermDock error into its Problem Details response, with the
+ * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
+ * same decision. Returns `undefined` for anything else so the framework's own
+ * error path takes over.
  */
-export declare function problemFromError(error: unknown): Response | undefined;
+export declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
 //#endregion
 //#region src/server/problem.d.ts
-export declare const PROBLEM_BASE = "https://permdock.dev/problems";
 export declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
 export declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
 export declare function validationProblem(detail: string): Response;
-export declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject, options?: {
+export declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
   readonly instance?: string;
   readonly approval?: ApprovalHint;
   /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
-  readonly disclosure?: "hide" | "reveal";
+  readonly disclosure?: Disclosure;
   /** Whether the request carried credentials, which picks the `401` challenge. */
   readonly credentials?: boolean;
+  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
+  readonly scope?: string;
 }): Response;
 //#endregion
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ServerPermDock, type ServerPermDockOptions, type StoredCredential, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, createEvaluationsHandler, createPermDock, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, verifyWebBotAuth };
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ScopeGuard, type ServerKernel, type ServerKernelOptions, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type TenantOption, type TenantScope, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, snapshotHeaders, snapshotTag, tenantScope, verifyWebBotAuth };

package/dist/server/index.js

@@ -1,8 +1,11 @@
-import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
-import { s as memoryRevocationFeed } from "../credential-B_rkUNlY.js";
-import { a as problemFromDecision, l as validationProblem, o as problemResponse, t as PROBLEM_BASE, u as wwwAuthenticate } from "../problem-Cgp9-KZA.js";
-import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
-import { n as createPermDock } from "../create-CSkhDU9T.js";
-import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../credentials-BgRX3WEg.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
-export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, createEvaluationsHandler, createPermDock, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, subjectFromApiKey, validationProblem, verifyWebBotAuth, wwwAuthenticate };
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
+import { d as wwwAuthenticate, o as problemFromDecision, s as problemResponse, u as validationProblem } from "../problem-B43ztKIm.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
+import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { n as tenantScope } from "../adapter-context-mlWsVGGg.js";
+import { n as createServerKernel, t as createPermDock } from "../create-CPhDL6qx.js";
+import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-DlZ28Oz5.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, snapshotHeaders, snapshotTag, subjectFromApiKey, tenantScope, validationProblem, verifyWebBotAuth, wwwAuthenticate };

package/dist/{credentials-BgRX3WEg.js → server-DlZ28Oz5.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-B_rkUNlY.js";
 import { t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
 import { n as isThenable } from "./thenable-okc2xDsj.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
 import { r as credentialEvent } from "./sink-Bd9PSyfq.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-8P81ff4u.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;