permdock 0.1.0 → 0.2.0

package/dist/convex/index.js

@@ -1,17 +1,23 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
-import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as tenantScope, t as actorFrom } from "../adapter-context-mlWsVGGg.js";
 //#region src/convex/create.ts
+/** Convex's runtime sends `data` to the client only for an error carrying this symbol. */
+const CONVEX_ERROR = Symbol.for("ConvexError");
 var ConvexError = class extends Error {
 	name = "ConvexError";
 	data;
 	constructor(data) {
 		super(data.detail);
 		this.data = data;
+		Object.defineProperty(this, CONVEX_ERROR, { value: true });
 	}
 };
 function toConvexError(error) {
-	if (error instanceof PermDockDeniedError || error instanceof PermDockApprovalRequiredError) return new ConvexError(error.toProblemDetails());
+	if (error instanceof PermDockDeniedError || error instanceof PermDockApprovalRequiredError || error instanceof PermDockValidationError) return new ConvexError(error.toProblemDetails());
 	return error;
 }
 function createPermDock(policy, options) {
@@ -23,7 +29,11 @@ function createPermDock(policy, options) {
 			} catch {
 				user = null;
 			}
-			const permdock = await createPermDock$1(policy, user);
+			const permdock = await createPermDock$1(policy, user, compact({
+				tenant: (await tenantScope(options.tenant, ctx)).tenant,
+				...instanceOptions(options),
+				actor: await actorFrom(options.actor, ctx)
+			}));
 			const next = {
 				...ctx,
 				permdock

package/dist/create-BWyx3jua.d.ts

@@ -0,0 +1,245 @@
+import { C as Policy, Cr as Actor, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Tt as Snapshot, Yn as Decision, jr as JsonWebKeyLike, ln as PermDock, pn as SnapshotOptions } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { f as ApprovalStore } from "./types-vKyAMtcX.js";
+import { t as ApprovalHint } from "./errors-DAqevpNk.js";
+import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
+import { r as PdpFactory } from "./types-BVyImy5I.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+//#region src/server/connection.d.ts
+type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
+type ConnectionOptions<T = unknown> = {
+  /** The permission the stream or socket is opened for; re-checked after every revalidation. */
+  readonly permission?: Permission;
+  /** The row for `permission`, or a loader re-run on every revalidation. */
+  readonly data?: ConnectionData<T>;
+  /** Milliseconds between periodic revalidations; off by default. */
+  readonly revalidate?: number;
+};
+type Connection = {
+  /** The current instance; replaced, never mutated, after a revalidation. */
+  readonly permdock: PermDock;
+  /** Aborts with a `PermDockRevokedError` when the connection must end. */
+  readonly signal: AbortSignal;
+  /**
+   * Per-message decision. Data is validated against the resource schema
+   * first unless `{ trusted: true }` marks it as a row the server loaded.
+   */
+  readonly check: (permission: Permission, data?: unknown, options?: {
+    readonly trusted?: boolean;
+  }) => Decision;
+  readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
+  /** Stops timers and the feed subscription. Call it when the transport closes. */
+  readonly close: () => void;
+};
+//#endregion
+//#region src/core/adapter-context.d.ts
+/**
+ * The active tenant an adapter resolved from its own framework context.
+ * Present means "use this tenant", even when `tenant` is `undefined`.
+ */
+type TenantScope = {
+  readonly tenant: string | undefined;
+};
+type TenantOption<TContext> = string | ((context: TContext) => string | undefined | Promise<string | undefined>);
+/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+declare function tenantScope<TContext>(option: TenantOption<TContext> | undefined, context: TContext): Promise<TenantScope>;
+//#endregion
+//#region src/server/web-bot-auth.d.ts
+type WebBotAuthJwk = JsonWebKeyLike & {
+  readonly kid?: string;
+  readonly crv?: string;
+};
+type WebBotAuthKeyLookup = (input: {
+  readonly request: Request;
+  readonly keyid: string;
+  readonly agent: string | undefined;
+}) => WebBotAuthJwk | undefined | Promise<WebBotAuthJwk | undefined>;
+type WebBotAuthKeys = {
+  readonly lookup: WebBotAuthKeyLookup;
+};
+type WebBotAuthOptions = {
+  readonly verify?: boolean;
+  readonly keys: WebBotAuthKeys | WebBotAuthKeyLookup;
+  readonly required?: boolean;
+  readonly maxAge?: number;
+  /** Unix seconds; defaults to the system clock. */
+  readonly now?: () => number;
+};
+/**
+ * An adapter's `webBotAuth` option: `(request) => verifyWebBotAuth(request, options)`,
+ * so an app without it does not bundle RFC 9421 verification.
+ */
+type WebBotAuthVerifier = (request: Request) => Promise<Actor | undefined>;
+type DiscoverViaSignatureAgentOptions = {
+  readonly allow: readonly string[];
+  readonly fetch?: typeof fetch;
+};
+declare class InvalidSignatureError extends Error {
+  override readonly name: "InvalidSignatureError";
+  readonly response: Response;
+  constructor(response: Response);
+}
+declare function invalidSignatureResponse(error: unknown): Response | undefined;
+declare function invalidSignatureProblem(detail: string): Response;
+declare function discoverViaSignatureAgent(options: DiscoverViaSignatureAgentOptions): WebBotAuthKeys;
+declare function verifyWebBotAuth(request: Request, options: WebBotAuthOptions | undefined): Promise<Actor | undefined>;
+//#endregion
+//#region src/server/evaluations.d.ts
+declare function createEvaluationsHandler(options: {
+  readonly policy: Policy;
+  readonly resolve?: (request: Request) => Promise<PermDock>;
+  readonly getPermDock?: (query?: {
+    readonly tenant?: string;
+  }) => Promise<PermDock>;
+  readonly store?: ApprovalStore;
+  readonly adapter?: string;
+  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
+  readonly maxEvaluations?: number;
+}): {
+  readonly POST: (request: Request) => Promise<Response>;
+  readonly GET: (request: Request) => Promise<Response>;
+};
+//#endregion
+//#region src/server/create.d.ts
+type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
+  /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
+  readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
+  readonly actor?: (request: Request) => unknown;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+  readonly tenant?: string | ((request: Request) => string | undefined | Promise<string | undefined>);
+  readonly store?: ApprovalStore;
+  /** Ends or revalidates open connections; never a decision input. */
+  readonly revocations?: RevocationFeed;
+  /**
+   * `createPermDock` from `permdock/pdp`: `protect` then decides delegated
+   * permissions through the remote PDP. The instance handlers receive stays
+   * synchronous and keeps denying delegated permissions (`pdp-unavailable`).
+   */
+  readonly pdp?: PdpFactory;
+  /** Added as `approval` to every `approval-required` problem. */
+  readonly approval?: ApprovalHint;
+  readonly operations?: OperationScopes;
+};
+type OperationScopes = {
+  oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
+};
+type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly ok: true;
+  readonly permdock: PermDock<V>;
+  readonly decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>;
+  readonly data: T;
+} | {
+  readonly ok: false;
+  readonly response: Response;
+};
+/**
+ * What `protect(null, …)` resolves to: the route declares OAuth scopes and no
+ * permission, so there is no decision to return.
+ */
+type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly ok: true;
+  readonly permdock: PermDock<V>;
+  readonly decision?: undefined;
+  readonly data: T;
+} | {
+  readonly ok: false;
+  readonly response: Response;
+};
+type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
+/**
+ * `protect(permission, loadData?, options?)`, or `protect(null, loadData?,
+ * { oauthScopes })` for a route that needs a signed-in principal and, from a
+ * delegated token, one of the OAuth scopes it declares, but no permission.
+ */
+type Protect<V extends PolicyVocabulary = PolicyVocabulary, TArgs extends unknown[] = []> = {
+  <T = unknown>(permission: Permission, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V>>;
+  <T = unknown>(permission: null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<ScopeGuard<T, V>>;
+  <T = unknown>(permission: Permission | null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+};
+type OpenApiHooks = {
+  readonly security: (permission: Permission) => {
+    readonly security: readonly Record<string, readonly string[]>[];
+    readonly "x-permdock-permissions": readonly string[];
+  };
+  readonly securitySchemes: () => Readonly<Record<string, unknown>>;
+};
+type ProtectOptions = {
+  /**
+   * `true` when `loadData` returns a row the server loaded itself, to skip
+   * schema validation. Anything else is validated against the resource
+   * schema before the check.
+   */
+  readonly trusted?: boolean;
+  /**
+   * The OAuth scopes that reach the route: a delegated token holding none of
+   * them is refused with `insufficient_scope`. Default the `operations` entry
+   * for the request. Required, here or there, for `protect(null)`.
+   */
+  readonly oauthScopes?: readonly string[];
+};
+type ServerKernelOptions<TUser, V extends PolicyVocabulary = PolicyVocabulary> = ServerPermDockOptions<TUser> & {
+  /** Wraps each instance the kernel builds, as `withOtel` does. */
+  readonly wrap?: (permdock: PermDock<V>) => PermDock<V>;
+  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
+  readonly adapter?: string;
+};
+/**
+ * What an HTTP adapter builds on: `ServerPermDock` plus an explicit
+ * `TenantScope` on every call, so the adapter resolves the tenant from its
+ * own framework context.
+ */
+type SnapshotQuery = {
+  /** The active tenant; defaults to the `tenant` option resolved from the request. */
+  readonly tenant?: string;
+  readonly include?: SnapshotOptions["include"];
+  readonly tenants?: "all";
+};
+type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
+  /**
+   * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit, Nuxt), built from the
+   * request's cached subject. Send it with `snapshotHeaders(snapshot)`.
+   */
+  readonly getSnapshot: (request: Request, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly protect: Protect<V, [scope?: TenantScope]>;
+  /**
+   * `protect` against an instance the adapter already holds, such as a gateway
+   * connection's: the same OAuth scope check, loader, decision and approval resume.
+   */
+  readonly protectOn: <T = unknown>(instance: PermDock<V>, permission: Permission | null, load?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>, scope?: TenantScope) => Promise<Connection>;
+  /**
+   * Lets `to`, a second `Request` an adapter built for the same incoming
+   * request (to re-read a body a parser consumed), reuse the subject and
+   * actor already resolved for `from`.
+   */
+  readonly shareSubject: (from: Request, to: Request) => void;
+  readonly problem: ServerPermDock<V>["problem"];
+  readonly openapi: OpenApiHooks;
+  readonly permdockHandler: (scope?: (request: Request) => TenantScope | Promise<TenantScope>) => ReturnType<typeof createEvaluationsHandler>;
+};
+type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: (request: Request) => Promise<PermDock<V>>;
+  readonly getSnapshot: ServerKernel<V>["getSnapshot"];
+  readonly protect: Protect<V>;
+  /** A long-lived connection for a stream or socket opened by `request`. */
+  readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>) => Promise<Connection>;
+  readonly problem: (decision: Decision, init?: {
+    readonly permission?: Permission;
+    readonly instance?: string;
+  }) => Response;
+  readonly openapi: OpenApiHooks;
+  readonly permdockHandler: () => ReturnType<typeof createEvaluationsHandler>;
+};
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerPermDockOptions<TUser>): ServerPermDock<V>;
+/**
+ * The kernel behind every HTTP adapter. The subject and actor are resolved
+ * once per `Request`; one instance is cached per `(Request, tenant)`, so a
+ * global middleware and a later tenant-scoped `protect` never share a tenant.
+ */
+declare function createServerKernel<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerKernelOptions<TUser, V>): ServerKernel<V>;
+//#endregion
+export { ConnectionOptions as A, invalidSignatureResponse as C, tenantScope as D, TenantScope as E, Connection as O, invalidSignatureProblem as S, TenantOption as T, WebBotAuthKeyLookup as _, ScopeGuard as a, WebBotAuthVerifier as b, ServerPermDock as c, createPermDock as d, createServerKernel as f, WebBotAuthJwk as g, InvalidSignatureError as h, ProtectOptions as i, ConnectionData as k, ServerPermDockOptions as l, DiscoverViaSignatureAgentOptions as m, OpenApiHooks as n, ServerKernel as o, createEvaluationsHandler as p, OperationScopes as r, ServerKernelOptions as s, Guard as t, SnapshotQuery as u, WebBotAuthKeys as v, verifyWebBotAuth as w, discoverViaSignatureAgent as x, WebBotAuthOptions as y };

package/dist/create-CPhDL6qx.js

@@ -0,0 +1,253 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { n as problemDetails } from "./problem-details-_AMOYz-w.js";
+import { r as challengeScope, t as createPermDock$1 } from "./permdock-CzqXjCpU.js";
+import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
+import { n as hasCredentials } from "./http-SO7qGttf.js";
+import { a as notFoundProblem, l as unauthenticatedProblem, o as problemFromDecision, r as decisionResponse } from "./problem-B43ztKIm.js";
+import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
+//#region src/server/create.ts
+async function resolveActor(request, options) {
+	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request)) ?? actorFrom(options.actor, request);
+}
+const NO_TENANT = "\0";
+function routeScopes(value) {
+	if (value === void 0) return;
+	const scopes = Array.isArray(value) ? value : [];
+	const names = scopes.filter((scope) => typeof scope === "string" && scope !== "");
+	if (names.length === 0 || names.length !== scopes.length) throw new TypeError("PermDock: oauthScopes must be a non-empty list of scope names");
+	return names;
+}
+const NOT_DELEGATED = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "not-delegated"
+	}],
+	alternatives: []
+};
+/** The `403` `insufficient_scope` for a token that holds none of a route's OAuth scopes. */
+function scopeProblem(permission, subject, credentials, scope) {
+	return permission === null ? decisionResponse(problemDetails(compact({
+		decision: NOT_DELEGATED,
+		detail: `the token holds none of the OAuth scopes this route needs, such as ${String(scope)}`,
+		scope
+	})), NOT_DELEGATED, compact({
+		credentials,
+		scope
+	})) : problemFromDecision(NOT_DELEGATED, permission, subject, compact({
+		credentials,
+		scope
+	}));
+}
+function createPermDock(policy, options) {
+	return createServerKernel(policy, options);
+}
+function problemFor(decision, init, approval) {
+	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, void 0, compact({
+		instance: init.instance,
+		approval
+	}));
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	return decisionResponse(problemDetails(compact({
+		decision,
+		detail: decision.outcome,
+		instance: init?.instance
+	})), decision);
+}
+/**
+* The kernel behind every HTTP adapter. The subject and actor are resolved
+* once per `Request`; one instance is cached per `(Request, tenant)`, so a
+* global middleware and a later tenant-scoped `protect` never share a tenant.
+*/
+function createServerKernel(policy, options) {
+	const adapter = options.adapter ?? "server";
+	const subjects = /* @__PURE__ */ new WeakMap();
+	const instances = /* @__PURE__ */ new WeakMap();
+	const freshSubject = async (request) => {
+		const actor = await resolveActor(request, options);
+		try {
+			return {
+				user: await options.subject(request),
+				actor
+			};
+		} catch {
+			return {
+				user: null,
+				actor
+			};
+		}
+	};
+	const resolveSubject = (request) => {
+		const hit = subjects.get(request);
+		if (hit !== void 0) return hit;
+		const resolved = freshSubject(request);
+		subjects.set(request, resolved);
+		return resolved;
+	};
+	const instanceFor = async ({ user, actor }, tenant) => {
+		const coreOptions = compact({
+			tenant,
+			...instanceOptions(options),
+			actor
+		});
+		const permdock = await createPermDock$1(policy, user, coreOptions);
+		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, coreOptions);
+		return {
+			permdock: options.wrap === void 0 ? permdock : options.wrap(permdock),
+			remote
+		};
+	};
+	const build = async (request, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		let byTenant = instances.get(request);
+		if (byTenant === void 0) {
+			byTenant = /* @__PURE__ */ new Map();
+			instances.set(request, byTenant);
+		}
+		const key = tenant ?? NO_TENANT;
+		const hit = byTenant.get(key);
+		if (hit !== void 0) return hit;
+		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
+		byTenant.set(key, built);
+		return built;
+	};
+	const connection = async (request, connectionOptions = {}, scope) => {
+		const { tenant } = scope ?? await tenantScope(options.tenant, request);
+		const { openConnection } = await import("./connection-CU8MQxRi.js");
+		return openConnection({
+			open: async () => (await build(request, { tenant })).permdock,
+			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
+			tenant,
+			...options.revocations === void 0 ? {} : { feed: options.revocations },
+			adapter,
+			options: connectionOptions
+		});
+	};
+	const permdock = async (request, scope) => (await build(request, scope)).permdock;
+	const getSnapshot = async (request, query = {}) => {
+		return (await permdock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
+			include: query.include,
+			tenants: query.tenants
+		}));
+	};
+	const protectRoute = (permission, loadData, protectOptions = {}) => {
+		if (permission === null && routeScopes(protectOptions.oauthScopes) === void 0 && options.operations === void 0) throw new TypeError("PermDock: protect(null) needs oauthScopes, in its options or an operations entry");
+		return async (request, scope) => {
+			let instance;
+			let remote;
+			try {
+				({permdock: instance, remote} = await build(request, scope));
+			} catch (error) {
+				if (error instanceof InvalidSignatureError) return {
+					ok: false,
+					response: error.response
+				};
+				throw error;
+			}
+			return guardOn(instance, remote, request, permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions);
+		};
+	};
+	const guardOn = async (instance, remote, request, permission, load, protectOptions) => {
+		const declared = routeScopes(protectOptions.oauthScopes ?? (request === void 0 ? void 0 : options.operations?.oauthScopesForRequest(request.method, new URL(request.url).pathname)));
+		const credentials = request === void 0 ? false : hasCredentials(request);
+		if (permission === null) {
+			if (declared === void 0) throw new TypeError(request === void 0 ? "PermDock: protect(null) needs oauthScopes" : `PermDock: protect(null) needs oauthScopes, and no operation declares them for ${request.method} ${new URL(request.url).pathname}`);
+			if (instance.subject.principal === null) return {
+				ok: false,
+				response: unauthenticatedProblem(credentials)
+			};
+		}
+		const held = instance.subject.delegation?.scopes;
+		if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return {
+			ok: false,
+			response: scopeProblem(permission, instance.subject, credentials, declared[0])
+		};
+		let data;
+		if (load !== void 0) {
+			const loaded = await load();
+			if (loaded === null || loaded === void 0) return {
+				ok: false,
+				response: notFoundProblem()
+			};
+			data = loaded;
+		}
+		if (permission === null) return {
+			ok: true,
+			permdock: instance,
+			data
+		};
+		const decideOptions = compact({
+			source: "adapter",
+			adapter,
+			...protectOptions.trusted === true ? { trusted: true } : {
+				trusted: false,
+				boundary: "http-body"
+			}
+		});
+		const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "pdp-unavailable"
+			}],
+			alternatives: []
+		}));
+		const decision = await applyApprovalResume(raw, permission, instance, options.store, request, resourceRef(permission, data), adapter);
+		if (decision.outcome === "granted") return {
+			ok: true,
+			permdock: instance,
+			decision,
+			data
+		};
+		return {
+			ok: false,
+			response: problemFromDecision(decision, permission, instance.subject, compact({
+				approval: options.approval,
+				credentials,
+				scope: declared?.[0] ?? challengeScope(policy, permission),
+				disclosure: data === void 0 ? void 0 : policy.resources.get(permission.resource)?.disclosure
+			}))
+		};
+	};
+	const protect = protectRoute;
+	const openapi = {
+		security: (permission) => ({
+			security: [{ oauth2: [permission.scope] }],
+			"x-permdock-permissions": [permission.key]
+		}),
+		securitySchemes: () => {
+			const scopes = {};
+			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
+			return { oauth2: {
+				type: "oauth2",
+				flows: {},
+				scopes
+			} };
+		}
+	};
+	const permdockHandler = (scope) => createEvaluationsHandler(compact({
+		policy,
+		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
+		store: options.store,
+		adapter
+	}));
+	return {
+		permdock,
+		getSnapshot,
+		protect,
+		protectOn: (instance, permission, load, protectOptions = {}, request) => guardOn(instance, void 0, request, permission, load, protectOptions),
+		connection,
+		shareSubject: (from, to) => {
+			const resolved = subjects.get(from);
+			if (resolved !== void 0 && !subjects.has(to)) subjects.set(to, resolved);
+		},
+		problem: (decision, init) => problemFor(decision, init, options.approval),
+		openapi,
+		permdockHandler
+	};
+}
+//#endregion
+export { createServerKernel as n, createPermDock as t };