permdock 0.1.0 → 0.3.0

package/dist/{openapi-DcqM8nU7.js → openapi-BqRBvAng.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { f as isPermission, g as listPermissions } from "./permissions-DC7GROPA.js";
+import { _ as listPermissions, i as findPermission, p as isPermission } from "./permissions-DVoF6dMt.js";
 import { n as sha256 } from "./sha256-BO0swRXL.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as PROFILE_PARAMETERS, n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "./pins-CqE1jZuF.js";
+import { i as PROFILE_PARAMETERS, n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "./pins-8ILTftC9.js";
 //#region src/openapi/emit.ts
 function assertScheme(options) {
 	if (options.scheme.type === "gnap") throw new TypeError(GNAP_RESERVED);
@@ -28,7 +28,7 @@ function mergeRecord(base, extra) {
 	for (const [key, value] of Object.entries(extra)) result[key] = value;
 	return result;
 }
-function scopesOf(policy) {
+function scopesOf$1(policy) {
 	const scopes = {};
 	for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.description ?? leaf.meta.title ?? leaf.key;
 	return scopes;
@@ -39,7 +39,7 @@ function flowWithScopes(flow, scopes) {
 function securitySchemesOf(policy, options) {
 	assertScheme(options);
 	const target = options.target ?? "3.2";
-	const scopes = scopesOf(policy);
+	const scopes = scopesOf$1(policy);
 	const name = options.scheme.name;
 	if (options.scheme.ref !== void 0 && target !== "3.1") return { [name]: { $ref: options.scheme.ref } };
 	const flowsIn = options.scheme.flows ?? { authorizationCode: {} };
@@ -303,4 +303,236 @@ const createPermDock = (policy, options) => {
 	};
 };
 //#endregion
-export { securitySchemesOf as i, catalogOf as n, openapiVersion as r, createPermDock as t };
+//#region src/openapi/operations.ts
+const METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"PUT",
+	"POST",
+	"DELETE",
+	"OPTIONS",
+	"HEAD",
+	"PATCH",
+	"TRACE",
+	"QUERY"
+]);
+function segmentsOf(path) {
+	return path.split("/").filter((segment) => segment !== "");
+}
+function isParam(segment) {
+	return segment.startsWith("{") && segment.endsWith("}");
+}
+/** The number of literal segments that match, or -1 when the template does not match. */
+function score(route, segments) {
+	if (route.segments.length !== segments.length) return -1;
+	let literal = 0;
+	for (const [index, segment] of route.segments.entries()) {
+		if (isParam(segment)) continue;
+		if (segment !== segments[index]) return -1;
+		literal += 1;
+	}
+	return literal;
+}
+function isEntryObject(entry) {
+	return !isPermission(entry);
+}
+function scopesOf(key, entry) {
+	if (!isEntryObject(entry) || entry.oauthScopes === void 0) return;
+	const scopes = entry.oauthScopes;
+	if (scopes.length === 0 || !scopes.every((scope) => typeof scope === "string" && scope !== "")) throw new TypeError(`PermDock: operation '${key}' sets oauthScopes, which must be a non-empty list of scope names`);
+	return Object.freeze([...entry.oauthScopes]);
+}
+/**
+* Operations as `"METHOD /path/{param}"` keys, the OpenAPI path template, to
+* a permission. `base` is a prefix requests carry and the keys do not
+* (`/api/v1`). A key that is not a method and a path throws.
+*/
+function operationPermissions(operations, options = {}) {
+	const routes = [];
+	const byId = /* @__PURE__ */ new Map();
+	for (const [key, entry] of Object.entries(operations)) {
+		const space = key.indexOf(" ");
+		const method = key.slice(0, space).toUpperCase();
+		const path = key.slice(space + 1).trim();
+		if (space <= 0 || !METHODS.has(method) || !path.startsWith("/")) throw new TypeError(`PermDock: operation '${key}' must be a method and a path, such as 'GET /customers/{id}'`);
+		const oauthScopes = scopesOf(key, entry);
+		if (isEntryObject(entry) && (entry.permission === void 0 ? oauthScopes === void 0 : !isPermission(entry.permission))) throw new TypeError(`PermDock: operation '${key}' needs a permission, oauthScopes or both`);
+		const route = {
+			method,
+			segments: segmentsOf(path),
+			permission: isEntryObject(entry) ? entry.permission : entry,
+			...oauthScopes === void 0 ? {} : { oauthScopes }
+		};
+		routes.push(route);
+		if (isEntryObject(entry) && entry.operationId !== void 0) byId.set(entry.operationId, route);
+	}
+	const base = segmentsOf(options.base ?? "");
+	const matchMethod = (upper, path) => {
+		const full = segmentsOf(path.split("?")[0] ?? "");
+		if (base.some((segment, index) => full[index] !== segment)) return;
+		const segments = full.slice(base.length);
+		let best;
+		let bestScore = -1;
+		for (const route of routes) {
+			if (route.method !== upper) continue;
+			const value = score(route, segments);
+			if (value > bestScore) {
+				best = route;
+				bestScore = value;
+			}
+		}
+		return best;
+	};
+	const match = (method, path) => {
+		const upper = method.toUpperCase();
+		const route = matchMethod(upper, path);
+		return route === void 0 && upper === "HEAD" ? matchMethod("GET", path) : route;
+	};
+	return {
+		forRequest(method, path) {
+			return match(method, path)?.permission;
+		},
+		forOperation(id) {
+			return byId.get(id)?.permission;
+		},
+		oauthScopesForRequest(method, path) {
+			return match(method, path)?.oauthScopes;
+		},
+		oauthScopesForOperation(id) {
+			return byId.get(id)?.oauthScopes;
+		}
+	};
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* The operation permissions an OpenAPI document declares: every operation
+* whose `x-permdock-permissions` names exactly one permission of `tree`, keyed
+* by its method, path and `operationId`. An operation naming none, several or
+* an unknown key is left out, so a gate denies it.
+*/
+function operationPermissionsFromOpenApi(document, tree, options = {}) {
+	const operations = {};
+	const paths = isRecord(document) && isRecord(document["paths"]) ? document["paths"] : {};
+	for (const [path, item] of Object.entries(paths)) {
+		if (!isRecord(item)) continue;
+		for (const [method, operation] of Object.entries(item)) {
+			if (!METHODS.has(method.toUpperCase()) || !isRecord(operation)) continue;
+			const keys = operation["x-permdock-permissions"];
+			if (!Array.isArray(keys) || keys.length !== 1 || typeof keys[0] !== "string") continue;
+			const permission = findPermission(tree, keys[0]);
+			if (permission === void 0) continue;
+			const operationId = operation["operationId"];
+			operations[`${method.toUpperCase()} ${path}`] = typeof operationId === "string" ? {
+				permission,
+				operationId
+			} : permission;
+		}
+	}
+	return operationPermissions(operations, options);
+}
+//#endregion
+//#region src/openapi/problem-details.ts
+const TARGETS = /* @__PURE__ */ new Set([
+	"draft-2020-12",
+	"draft-07",
+	"openapi-3.0"
+]);
+const JSON_SCHEMA = Object.freeze({
+	type: "object",
+	description: "RFC 9457 Problem Details for a PermDock denial",
+	required: [
+		"type",
+		"title",
+		"status",
+		"detail"
+	],
+	properties: {
+		type: {
+			type: "string",
+			format: "uri-reference"
+		},
+		title: { type: "string" },
+		status: {
+			type: "integer",
+			minimum: 400,
+			maximum: 599
+		},
+		detail: { type: "string" },
+		instance: { type: "string" },
+		permission: { type: "string" },
+		scope: { type: "string" },
+		reason: { type: "string" }
+	},
+	additionalProperties: true
+});
+const REQUIRED_STRINGS = [
+	"type",
+	"title",
+	"detail"
+];
+function issuesOf(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return [{ message: "Expected a Problem Details object" }];
+	const issues = [];
+	const fields = new Map(Object.entries(value));
+	for (const key of REQUIRED_STRINGS) if (typeof fields.get(key) !== "string") issues.push({
+		message: `Expected a string`,
+		path: [key]
+	});
+	const status = fields.get("status");
+	if (typeof status !== "number" || !Number.isInteger(status) || status < 400 || status > 599) issues.push({
+		message: "Expected an HTTP error status",
+		path: ["status"]
+	});
+	return issues;
+}
+function isProblem(value) {
+	return issuesOf(value).length === 0;
+}
+function jsonSchema(options) {
+	if (!TARGETS.has(options.target)) throw new TypeError(`PermDock: problemDetails has no JSON Schema for target ${options.target}`);
+	return structuredClone(JSON_SCHEMA);
+}
+/**
+* The Problem Details body the adapters send on a denial, as a Standard
+* Schema with a JSON Schema, for `oc.errors({ FORBIDDEN: { data: problemDetails } })`.
+* Extension members pass through: RFC 9457 lets a problem type add them.
+*/
+const problemDetails = Object.freeze({ "~standard": Object.freeze({
+	version: 1,
+	vendor: "permdock",
+	validate: (value) => isProblem(value) ? { value } : { issues: issuesOf(value) },
+	jsonSchema: Object.freeze({
+		input: jsonSchema,
+		output: jsonSchema
+	})
+}) });
+//#endregion
+//#region src/openapi/security.ts
+function isList(permission) {
+	return Array.isArray(permission);
+}
+function listOf(permission) {
+	return isList(permission) ? permission : [permission];
+}
+/** The `x-permdock-permissions` value: the permission keys an operation enforces. */
+function permissionsExtension(permissions) {
+	return Object.freeze(listOf(permissions).map((leaf) => leaf.key));
+}
+/**
+* An operation's `security` and `x-permdock-permissions`, from permission
+* references alone. Needs no policy, so a contract package can import it.
+* Unlike `permdock openapi emit`, it never drops `security` for a public
+* permission: that needs the policy.
+*/
+function securityFor(permission, options = {}) {
+	const leaves = listOf(permission);
+	const scheme = options.scheme ?? "oauth2";
+	const security = options.anyOf === true && leaves.length > 0 ? leaves.map((leaf) => ({ [scheme]: [leaf.scope] })) : [{ [scheme]: leaves.map((leaf) => leaf.scope) }];
+	return Object.freeze({
+		security,
+		"x-permdock-permissions": permissionsExtension(leaves)
+	});
+}
+//#endregion
+export { operationPermissionsFromOpenApi as a, openapiVersion as c, operationPermissions as i, securitySchemesOf as l, securityFor as n, createPermDock as o, problemDetails as r, catalogOf as s, permissionsExtension as t };

package/dist/{openapi-DWD0Uc_4.js → openapi-CqqEbHsL.js}

@@ -1,9 +1,9 @@
-import { n as validateOverlay, t as validateOpenapi } from "./openapi-schema-D8j_T9tO.js";
-import { c as getResource, i as findPermission } from "./permissions-DC7GROPA.js";
-import { a as definePolicy } from "./policy-ANp36PnI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed, t as asPermissionTree } from "./load-BZ24CpZP.js";
+import { n as validateOverlay, t as validateOpenapi } from "./openapi-schema--ARjyfQr.js";
+import { c as getResource, i as findPermission } from "./permissions-DVoF6dMt.js";
+import { a as definePolicy } from "./policy-xyWg7QdR.js";
+import { a as loadModule, n as asPolicy, o as pickNamed, t as asPermissionTree } from "./load-DhWEB9P1.js";
 import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { r as openapiVersion, t as createPermDock } from "./openapi-DcqM8nU7.js";
+import { c as openapiVersion, o as createPermDock } from "./openapi-BqRBvAng.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 //#region src/cli/openapi.ts

package/dist/{openapi-import-BWRUNNeW.js → openapi-import-cmwetbzw.js}

@@ -1,4 +1,4 @@
-import { t as validateOpenapi } from "./openapi-schema-D8j_T9tO.js";
+import { t as validateOpenapi } from "./openapi-schema--ARjyfQr.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

package/dist/{openapi-CwePaF7C.js → openapi-l0xYHkcv.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {
@@ -122,7 +122,7 @@ function openapi(ctx) {
 			const doc = listArg(rawArgs, "doc")[0];
 			if (parsed._[0] === "import") {
 				if (doc === void 0) throw new Error("openapi --doc is required");
-				const { runOpenapiImport } = await import("./openapi-import-BWRUNNeW.js");
+				const { runOpenapiImport } = await import("./openapi-import-cmwetbzw.js");
 				ctx.report(await runOpenapiImport({
 					cwd: ctx.cwd,
 					doc,
@@ -134,7 +134,7 @@ function openapi(ctx) {
 				}));
 				return;
 			}
-			const result = await (await import("./openapi-DWD0Uc_4.js")).runOpenapi({
+			const result = await (await import("./openapi-CqqEbHsL.js")).runOpenapi({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/{openapi-schema-D8j_T9tO.js → openapi-schema--ARjyfQr.js}

@@ -1,5 +1,5 @@
 import { t as packageRoot } from "./package-root-zGkxO3oN.js";
-import { t as DRAFT_PINS } from "./pins-CqE1jZuF.js";
+import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region \0rolldown/runtime.js
@@ -6810,7 +6810,7 @@ const STRINGS = {
 * `components.securityProfileRequirements`). Mutates and returns `schema`.
 */
 function patchOas33(schema) {
-	schema["$id"] = `https://permdock.dev/schemas/openapi/oas-3.3/${DRAFT_PINS.oas}`;
+	schema["$id"] = `https://permdock.com/schemas/openapi/oas-3.3/${DRAFT_PINS.oas}`;
 	child(schema, "properties", "openapi")["pattern"] = String.raw`^3\.3\.\d+(-.+)?$`;
 	const defs = child(schema, "$defs");
 	const scheme = child(defs, "security-scheme");

package/dist/orpc/index.d.ts

@@ -1,10 +1,9 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { S as ConnectionOptions, b as Connection, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption } from "../create-BKF3dgFk.js";
-import { t as StreamProtectOptions } from "../stream-BhMfZOwr.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
@@ -18,33 +17,15 @@ type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
 type OrpcMiddleware<TCtx extends object = object, TInput = unknown, V extends PolicyVocabulary = PolicyVocabulary> = Middleware<TCtx, TCtx & {
   readonly permdock: PermDock<V>;
   readonly permdockData?: unknown;
-}, TInput, unknown, Record<never, never>>;
-type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = {
-  readonly subject: (opts: OrpcMiddlewareOpts<TCtx>) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<OrpcMiddlewareOpts<TCtx>>;
+}, TInput, any, Record<never, never>>;
+type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = ServerAdapterOptions<OrpcMiddlewareOpts<TCtx>, TUser> & {
   /** The Web `Request` behind a context; defaults to `context.request` or `context.req`. */
   readonly request?: (context: TCtx) => Request | null | undefined;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
   /** Ends or revalidates open event iterators. */
   readonly revocations?: RevocationFeed;
 };
 type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly protect: (permission: Permission, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   readonly security: (permission: Permission) => {
     readonly security: readonly Record<string, readonly string[]>[];
     readonly "x-permdock-permissions": readonly string[];
@@ -53,12 +34,18 @@ type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary =
 };
 type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly permdock: () => OrpcMiddleware<TCtx, unknown, V>;
-  readonly protect: (permission: Permission, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
   /** A long-lived connection for the request behind `context`. */
   readonly connection: (opts: OrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   readonly permdockHandler: (request: Request) => Promise<Response>;
   readonly openapi: OrpcOpenApiHooks<TCtx, V>;
 };
+/**
+ * The permission the procedure's first `protect` decides, or `undefined`
+ * when no `protect` is attached. Reads the procedure definition only and
+ * never decides.
+ */
+export declare function permissionOf(procedure: unknown): Permission | undefined;
 export declare function createPermDock<TCtx extends object = object, TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: OrpcPermDockOptions<TCtx, TUser>): OrpcPermDock<TCtx, V>;
 //#endregion
 export type { OrpcMiddleware, OrpcMiddlewareOpts, OrpcOpenApiHooks, OrpcPermDock, OrpcPermDockOptions };

package/dist/orpc/index.js

@@ -1,17 +1,12 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { o as invalidSignatureResponse } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
-import { n as guardIterable, r as isAsyncIterable } from "../stream-Q_xlB6Ko.js";
+import { p as isPermission } from "../permissions-DVoF6dMt.js";
+import { a as problemMessage } from "../http-SO7qGttf.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { n as attached } from "../bind-CuzGytRf.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
-function hasBoundPermDock(context) {
-	return context !== null && typeof context === "object" && "permdock" in context && context.permdock !== void 0;
-}
-function requestFromCtx(ctx) {
-	if ("request" in ctx && ctx.request instanceof Request) return ctx.request;
-	if ("req" in ctx && ctx.req instanceof Request) return ctx.req;
-}
 function toOpts(mw, input, next) {
 	return compact({
 		context: mw.context,
@@ -20,156 +15,118 @@ function toOpts(mw, input, next) {
 		next
 	});
 }
-function problemMessage(cause, fallback) {
-	if (cause !== null && typeof cause === "object" && "detail" in cause && typeof cause.detail === "string" && cause.detail.length > 0) return cause.detail;
-	return fallback;
+function isErrorConstructor(value) {
+	return typeof value === "function";
 }
-function orpcCode(status) {
-	switch (status) {
-		case 400: return "BAD_REQUEST";
-		case 401: return "UNAUTHORIZED";
-		case 404: return "NOT_FOUND";
-		case 429: return "TOO_MANY_REQUESTS";
-		case 503: return "SERVICE_UNAVAILABLE";
-		default: return "FORBIDDEN";
-	}
+/** Uses the procedure's own constructor when it declares the code, so the declared status and `defined` apply. */
+function orpcError(code, message, data, errors) {
+	const declared = errors !== void 0 && Object.hasOwn(errors, code) ? errors[code] : void 0;
+	return isErrorConstructor(declared) ? declared({
+		message,
+		data
+	}) : new ORPCError(code, {
+		message,
+		data
+	});
 }
-function orpcErrorFrom(error) {
+function orpcErrorFrom(error, errors) {
 	const problem = error.toProblemDetails();
-	return new ORPCError(orpcCode(problem.status), {
-		message: error.code,
-		data: problem
-	});
+	return orpcError(rpcCode(problem.status), error.code, problem, errors);
 }
-async function throwOrpcError(response) {
-	let data;
-	try {
-		data = await response.json();
-	} catch {
-		data = { status: response.status };
-	}
-	const code = orpcCode(response.status);
-	throw new ORPCError(code, {
-		message: problemMessage(data, code),
-		data
-	});
+async function throwOrpcError(response, errors) {
+	const data = await problemBody(response);
+	const code = rpcCode(response.status);
+	throw orpcError(code, problemMessage(data, code), data, errors);
 }
 /** A PermDock error thrown further down (an `assert` in a handler) becomes the ORPCError `protect` throws. */
-function mapDownstream(run) {
+function mapDownstream(run, errors) {
 	return new Promise((resolve) => {
 		resolve(run());
 	}).catch((error) => {
 		const mapped = problemFromError(error);
 		if (mapped === void 0) throw error;
-		return throwOrpcError(mapped);
+		return throwOrpcError(mapped, errors);
 	});
 }
+/** Registered, so a second copy of `permdock` in the bundle reads the same tag. */
+const PERMISSION = Symbol.for("permdock.orpc.permission");
+function tagged(permission, middleware) {
+	if (permission !== null) Object.defineProperty(middleware, PERMISSION, { value: permission });
+	return middleware;
+}
+function readOwn(value, key) {
+	return (typeof value === "object" || typeof value === "function") && value !== null && Object.hasOwn(value, key) ? Reflect.get(value, key) : void 0;
+}
+/**
+* The permission the procedure's first `protect` decides, or `undefined`
+* when no `protect` is attached. Reads the procedure definition only and
+* never decides.
+*/
+function permissionOf(procedure) {
+	const ordered = readOwn(readOwn(procedure, "~orpc"), "orderedMiddlewares");
+	if (!Array.isArray(ordered)) return;
+	for (const entry of ordered) {
+		const permission = readOwn(readOwn(entry, "middleware"), PERMISSION);
+		if (isPermission(permission)) return permission;
+	}
+}
 function createPermDock(policy, options) {
-	const optsByRequest = /* @__PURE__ */ new WeakMap();
-	const requestByCtx = /* @__PURE__ */ new WeakMap();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => {
-			const opts = optsByRequest.get(request);
-			return opts === void 0 ? null : options.subject(opts);
-		},
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		revocations: options.revocations,
-		adapter: "orpc"
-	}));
-	const requestOf = (ctx) => {
-		if (options.request !== void 0) try {
-			return options.request(ctx) ?? void 0;
-		} catch {
-			return;
-		}
-		return requestFromCtx(ctx);
+	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
+	/** Instances this factory built, with the tenant each was built for. */
+	const issued = /* @__PURE__ */ new WeakMap();
+	const issue = (instance, scope) => {
+		issued.set(instance, scope.tenant);
+		return instance;
 	};
-	/**
-	* One `Request` per HTTP request, shared by every procedure in a batch. The
-	* subject reads the first procedure's opts; the tenant is resolved from each
-	* procedure's own opts in `scopeOf`, never through the shared `Request`.
-	*/
-	const bind = (opts) => {
-		const ctx = opts.context;
-		const hit = requestByCtx.get(ctx);
-		if (hit !== void 0) return hit;
-		const path = opts.path?.join(".") ?? "orpc";
-		const request = requestOf(opts.context) ?? new Request(`http://localhost/orpc/${path}`, { method: "POST" });
-		requestByCtx.set(ctx, request);
-		if (!optsByRequest.has(request)) optsByRequest.set(request, opts);
-		return request;
-	};
-	const scopeOf = (opts) => tenantScope(options.tenant, opts);
-	const attach = (ctx, request) => {
-		requestByCtx.set(ctx, request);
+	const boundFor = (context, scope) => {
+		const bound = Reflect.get(context, "permdock");
+		if (typeof bound !== "object" || bound === null || !issued.has(bound) || issued.get(bound) !== scope.tenant) return;
+		return bound;
 	};
 	const permdock = () => ((mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
-		if (hasBoundPermDock(opts.context)) return mwOptions.next({ context: opts.context });
 		const request = bind(opts);
-		return scopeOf(opts).then((scope) => kernel.permdock(request, scope)).then((instance) => {
+		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.permdock(request, scope), scope))).then((instance) => {
+			if (!instance.ok) return throwOrpcError(instance.response, mwOptions.errors);
 			const nextCtx = {
 				...opts.context,
-				permdock: instance
+				permdock: instance.permdock
 			};
 			attach(nextCtx, request);
-			return mapDownstream(() => mwOptions.next({ context: nextCtx }));
-		}, (error) => {
-			const response = invalidSignatureResponse(error);
-			if (response !== void 0) return throwOrpcError(response);
-			throw error;
+			return mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors);
 		});
 	});
-	const connection = async (opts, connectionOptions) => kernel.connection(bind(opts), connectionOptions, await scopeOf(opts));
 	/** Wraps an event iterator so revocation ends it and unreadable items drop. */
-	const guardOutput = async (result, opts, permission, loadData, protectOptions) => {
+	const guardOutput = async (result, opts, permission, loadData, protectOptions, errors) => {
 		const output = result !== null && typeof result === "object" && "output" in result ? result.output : void 0;
 		if (!isAsyncIterable(output)) return result;
-		const conn = await connection(opts, compact({
-			permission,
-			data: loadData
-		}));
 		return {
 			...result,
-			output: guardIterable(output, conn, compact({
-				items: protectOptions?.items,
-				onRevoked: orpcErrorFrom
-			}))
+			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
 		};
 	};
-	const protect = (permission, loadData, protectOptions) => (async (mwOptions, input) => {
+	const protect = (permission, loadData, protectOptions) => tagged(permission, (async (mwOptions, input) => {
 		const opts = toOpts(mwOptions, input, mwOptions.next);
 		const request = bind(opts);
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, await scopeOf(opts));
+		const scope = await scopeOf(opts);
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.context,
-				permdock: guard.permdock,
+				permdock: issue(guard.permdock, scope),
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx })), opts, permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions);
+			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions, mwOptions.errors);
 		}
-		return throwOrpcError(guard.response);
-	});
+		return throwOrpcError(guard.response, mwOptions.errors);
+	}));
 	const permdockHandler = (request) => {
-		const opts = {
+		return evaluate(request, {
 			context: { req: request },
 			path: ["permdock"],
 			next: (nextOpts) => Promise.resolve(nextOpts ?? { context: { req: request } })
-		};
-		bind(opts);
-		const { POST, GET } = kernel.permdockHandler(() => scopeOf(opts));
-		return Promise.resolve(request.method === "GET" ? GET(request) : POST(request));
+		});
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {
@@ -185,4 +142,4 @@ function createPermDock(policy, options) {
 	};
 }
 //#endregion
-export { createPermDock };
+export { createPermDock, permissionOf };