permdock 0.3.0 → 0.4.0

package/dist/a2a/index.d.ts

@@ -1,14 +1,16 @@
-import { C as Policy, Nr as Principal, Tr as AuthorizationDetail } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { a as ProblemDetails } from "../errors-DPdqI50v.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { E as Policy, Or as Principal, br as AuthorizationDetail } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { a as ProblemDetails } from "../errors-OD_4c__H.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;
   readonly scopes?: readonly string[];
   readonly extra?: {
     readonly authorizationDetails?: readonly AuthorizationDetail[];
+    /** The RFC 9396 claim name; read when `authorizationDetails` is absent. */
+    readonly authorization_details?: readonly AuthorizationDetail[];
     readonly approval?: string;
   };
 };

package/dist/a2a/index.js

@@ -1,13 +1,15 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as canonicalJson } from "../canonical-json-DemiK4Vp.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
+import { t as canonicalJson } from "../canonical-json-CFKyFOke.js";
 import { t as bytesToBase64Url } from "../sha256-BO0swRXL.js";
-import { i as scopesReaching, r as challengeScope } from "../permdock-CbgvLnuo.js";
+import { a as scopesReaching, i as hasScope, r as challengeScope } from "../permdock-L26udHSk.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { t as mayUse } from "../may-use-DndQ5tQ-.js";
-import { d as wwwAuthenticate, n as bearerChallenge } from "../problem-B43ztKIm.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
+import { t as mayUse } from "../may-use-BOn_dR_w.js";
+import { f as wwwAuthenticate, r as bearerChallenge } from "../problem-CnWraVhC.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createAgentKernel } from "../kernel-CB3LrIJM.js";
+import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {
 	return Object.keys(options.securitySchemes)[0];
@@ -75,29 +77,20 @@ function cardOf(options, skills) {
 	});
 }
 const DEFAULT_MODES = ["text/plain"];
-function delegationOf(auth) {
-	return compact({
-		scopes: auth.scopes,
-		authorizationDetails: auth.extra?.authorizationDetails
-	});
-}
 function actorOf(auth) {
 	return typeof auth.clientId === "string" && auth.clientId !== "" ? {
 		id: auth.clientId,
 		kind: "oauth-client"
 	} : void 0;
 }
-function hasScope(auth, scopes) {
-	return scopes.some((scope) => auth.scopes?.includes(scope) === true);
-}
-const LOAD_FAILED = {
+const LOAD_FAILED = freezeDeep({
 	outcome: "denied",
 	denials: [{
 		role: null,
 		reason: "validation"
 	}],
 	alternatives: []
-};
+});
 const NO_SUBJECT = {
 	principal: null,
 	context: {}
@@ -174,7 +167,7 @@ function createPermDock(policy, options) {
 	const kernel = createAgentKernel(policy, compact({
 		subject: options.subject,
 		actor: actorOf,
-		delegation: delegationOf,
+		delegation: (auth) => delegationFrom(auth.scopes, auth.extra),
 		tenant: options.tenant,
 		store: options.store,
 		adapter: "a2a",
@@ -207,7 +200,7 @@ function createPermDock(policy, options) {
 				detail: "unknown skill"
 			}
 		};
-		if (!hasScope(auth, scopesReaching(policy, config.permission))) return missingScope(config.permission, challengeScope(policy, config.permission));
+		if (!hasScope(auth.scopes, scopesReaching(policy, config.permission))) return missingScope(config.permission, challengeScope(policy, config.permission));
 		const checked = await kernel.check(compact({
 			permission: config.permission,
 			data: config.data

package/dist/ai-sdk/index.d.ts

@@ -1,8 +1,11 @@
-import { C as Policy, Nr as Principal, kr as Delegation } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { E as Policy, Or as Principal, wr as Delegation } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { n as OnDeniedText, t as DeniedTextEvent } from "../denied-text-DfRk15uw.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
+import { t as ToolMap } from "../types-DvupZE0w.js";
+import { n as PermDockWrap } from "../wrap-Cr93qqdP.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;
@@ -22,6 +25,15 @@ type AiSdkPermDockOptions<TUser = unknown> = InstanceOptions & {
    * pass through both, to the application's own `toolApproval`.
    */
   readonly unmapped?: "deny" | "allow";
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never model output.
+   */
+  readonly context?: (context: AiSdkContext) => RequestContext | undefined | Promise<RequestContext | undefined>;
+  /** Wraps each instance; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+  /** Replaces the denial reason or approval summary text; nothing else. */
+  readonly onDenied?: OnDeniedText;
 };
 /** What an AI SDK tool approval function may return; `undefined` is `not-applicable`. */
 type ToolApprovalResult = ToolApprovalStatus | undefined | "not-applicable" | "denied" | "user-approval" | {
@@ -92,4 +104,4 @@ type AiSdkPermDock = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: AiSdkPermDockOptions<TUser>): AiSdkPermDock;
 //#endregion
-export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, LanguageModelMiddleware, NeedsApprovalOptions, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };
+export type { AiSdkContext, AiSdkPermDock, AiSdkPermDockOptions, AppToolApproval, DeniedTextEvent, LanguageModelMiddleware, NeedsApprovalOptions, OnDeniedText, ToolApprovalCall, ToolApprovalResult, ToolApprovalStatus };

package/dist/ai-sdk/index.js

@@ -1,7 +1,7 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-CB3LrIJM.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",
@@ -67,7 +67,10 @@ function createPermDock(policy, options) {
 			actor: options.actor,
 			delegation: options.delegation,
 			tenant: options.tenant,
-			store: options.store
+			store: options.store,
+			context: options.context,
+			wrap: options.wrap,
+			onDenied: options.onDenied
 		}),
 		...instanceOptions(options),
 		subject: options.subject,

package/dist/app-data-CV8pqqMi.js

@@ -0,0 +1,59 @@
+import { a as assertSafeKey, i as validateSync } from "./thenable-QSmvt-vZ.js";
+//#region src/core/app-data.ts
+const MAX_META_DEPTH = 8;
+/** Throws unless `value` is plain, prototype-safe JSON at most eight levels deep. */
+function assertMetaValue(value, label, depth = 0) {
+	if (depth > MAX_META_DEPTH) throw new Error(`PermDock: ${label} nests deeper than ${MAX_META_DEPTH}`);
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
+	if (Array.isArray(value)) {
+		for (const item of value) assertMetaValue(item, label, depth + 1);
+		return;
+	}
+	if (typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+		for (const key of Object.keys(value)) {
+			assertSafeKey(key, "meta.x key");
+			assertMetaValue(Reflect.get(value, key), label, depth + 1);
+		}
+		return;
+	}
+	throw new Error(`PermDock: ${label} must be plain JSON`);
+}
+/** Throws unless `value` is a plain JSON object (an `x` field). */
+function assertAppData(value, label) {
+	assertMetaValue(value, label, 0);
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`PermDock: ${label} must be a JSON object`);
+}
+function runSchema(schema, value) {
+	const result = validateSync(schema, value);
+	if (result.ok) return result;
+	return {
+		ok: false,
+		message: result.issues === void 0 ? "schema must validate synchronously" : result.issues.map((issue) => issue.message).join("; ")
+	};
+}
+/**
+* Checks code-declared app data: plain JSON, then the schema when one is
+* given. Throws on failure, because a bad definition is an author error.
+*/
+function parseAppData(schema, value, label) {
+	assertAppData(value, label);
+	if (schema === void 0) return value;
+	const result = runSchema(schema, value);
+	if (!result.ok) throw new Error(`PermDock: ${label} is invalid: ${result.message}`);
+	assertAppData(result.value, label);
+	return result.value;
+}
+/**
+* Checks app data read from a source (a membership, a stored custom role).
+* Never throws: `undefined` means the value is dropped, and the caller
+* reports it.
+*/
+function readAppData(schema, value) {
+	try {
+		return parseAppData(schema, value, "x");
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { readAppData as i, assertMetaValue as n, parseAppData as r, assertAppData as t };

package/dist/approvals/index.d.ts

@@ -1,3 +1,3 @@
-import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-aqOHTHcp.js";
-import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-C7Tw7MaW.js";
+import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-Br9IXUBG.js";
+import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-Dz7didpC.js";
 export { APPROVAL_HEADER, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailure, type ApprovalSignature, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL_MS, type MemoryApprovalStore, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,5 +1,5 @@
 import { n as isApprovalError, t as ApprovalError } from "../errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, c as pageApprovals, d as approvalQuorum, f as approverRelationKey, i as approvalPageSize, l as APPROVAL_HEADER, n as assertApprover, o as encodeApprovalCursor, p as escalationOpenAt, r as memoryApprovalStore, s as listAllApprovals, t as applyApprovalVerdict, u as DEFAULT_APPROVAL_TTL_MS } from "../store-DMAWwAJV.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summariseSubject } from "../helpers-H_KARDVC.js";
-import { t as approvalsHandler } from "../approvals-DbYAuNkG.js";
+import { a as decodeApprovalCursor, c as pageApprovals, d as approvalQuorum, f as approverRelationKey, i as approvalPageSize, l as APPROVAL_HEADER, n as assertApprover, o as encodeApprovalCursor, p as escalationOpenAt, r as memoryApprovalStore, s as listAllApprovals, t as applyApprovalVerdict, u as DEFAULT_APPROVAL_TTL_MS } from "../store-ILkLUj_o.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summariseSubject } from "../helpers-C9YmyBIa.js";
+import { t as approvalsHandler } from "../approvals-DZL76lKW.js";
 export { APPROVAL_HEADER, ApprovalError, DEFAULT_APPROVAL_TTL_MS, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };

package/dist/{approvals-DbYAuNkG.js → approvals-DZL76lKW.js}

@@ -1,11 +1,11 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { s as rootMembershipId } from "./scopes-CVdPrWN-.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { s as rootMembershipId } from "./scopes-tvpa34ep.js";
 import { n as isApprovalError } from "./errors-DRnGZHzF.js";
-import { n as hasCredentials } from "./http-SO7qGttf.js";
-import { l as unauthenticatedProblem } from "./problem-B43ztKIm.js";
-import { n as assertApprover } from "./store-DMAWwAJV.js";
-import { m as approverRelations, p as heldPermissions } from "./helpers-H_KARDVC.js";
+import { r as hasCredentials } from "./http-BBoKefeS.js";
+import { u as unauthenticatedProblem } from "./problem-CnWraVhC.js";
+import { n as assertApprover } from "./store-ILkLUj_o.js";
+import { m as approverRelations, p as heldPermissions } from "./helpers-C9YmyBIa.js";
 //#region src/approvals/handler.ts
 function problem(status, title, detail, slug) {
 	const body = {
@@ -78,13 +78,18 @@ async function mayResolve(request, subject, requireDistinct, options) {
 		return false;
 	}
 }
-function canView(request, subject) {
+/**
+* The requester, a tenant member for a tenant request, and for a request
+* without a tenant only who answered it or may answer it.
+*/
+function canView(request, subject, requireDistinct, options) {
 	const principal = subject.principal;
-	if (principal === null) return false;
-	if (request.subject.principal?.id === principal.id) return true;
+	if (principal === null) return Promise.resolve(false);
+	if (request.subject.principal?.id === principal.id) return Promise.resolve(true);
 	const tenant = request.subject.principal?.tenant;
-	if (tenant !== void 0) return belongsToTenant(subject, tenant);
-	return true;
+	if (tenant !== void 0) return Promise.resolve(belongsToTenant(subject, tenant));
+	if (request.resolvedBy === principal.id || (request.approvals ?? []).some((item) => item.by === principal.id)) return Promise.resolve(true);
+	return mayResolve(request, subject, requireDistinct, options);
 }
 /**
 * The tenants whose pending requests the approver may list: the requested one,
@@ -136,16 +141,25 @@ function signedApproval(request, signer, audience) {
 		expiresAt: Math.floor(Date.parse(request.expiresAt) / 1e3)
 	}));
 }
+const MAX_BODY_BYTES = 16384;
+const MAX_NOTE_LENGTH = 2e3;
+function tooLarge() {
+	return problem(413, "Payload too large", `request body exceeds ${String(MAX_BODY_BYTES)} bytes`, "payload-too-large");
+}
+/** An unreadable body is no note; an oversized body or note is refused, never truncated. */
 async function readNote(request) {
 	const contentType = request.headers.get("content-type") ?? "";
-	if (request.method !== "POST" || contentType === "") return;
-	if (!contentType.includes("application/json")) return;
+	if (request.method !== "POST" || !contentType.includes("application/json")) return {};
+	if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) return { refusal: tooLarge() };
 	try {
-		const body = await request.json();
-		if (body !== null && typeof body === "object" && "note" in body && typeof body.note === "string") return body.note;
+		const text = await request.text();
+		if (text.length > MAX_BODY_BYTES) return { refusal: tooLarge() };
+		const body = JSON.parse(text);
+		if (body !== null && typeof body === "object" && "note" in body && typeof body.note === "string") return body.note.length > MAX_NOTE_LENGTH ? { refusal: problem(400, "Invalid request", `note exceeds ${String(MAX_NOTE_LENGTH)} characters`, "validation") } : { note: body.note };
 	} catch {
-		return;
+		return {};
 	}
+	return {};
 }
 function mapError(error, credentials) {
 	if (!isApprovalError(error)) return problem(500, "Internal error", "approval store failed", "internal");
@@ -194,7 +208,7 @@ function approvalsHandler(store, options) {
 			}
 			if (route.kind === "get") {
 				const current = await store.get(route.token);
-				if (current === null || !canView(current, subject)) return problem(404, "Not found", "approval was not found", "not-found");
+				if (current === null || !await canView(current, subject, requireDistinct, options)) return problem(404, "Not found", "approval was not found", "not-found");
 				return json(200, current);
 			}
 			const current = await store.get(route.token);
@@ -202,7 +216,9 @@ function approvalsHandler(store, options) {
 			const relations = await approverRelations(current, subject, options);
 			const permissions = await heldPermissions(current, subject, options.permdockFor);
 			assertApprover(current, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
-			const note = await readNote(request);
+			const read = await readNote(request);
+			if (read.refusal !== void 0) return read.refusal;
+			const note = read.note;
 			const resolved = await store.resolve(route.token, compact({
 				status: route.kind === "approve" ? "approved" : "rejected",
 				by: subject,

package/dist/{approvers-DT4AVyIg.js → approvers-CqPOLD-o.js}

@@ -1,4 +1,4 @@
-import { n as isReadonlyArray } from "./compact-y6vfu2_f.js";
+import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 //#region src/core/approvers.ts
 /** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
 function holder(permission) {

package/dist/{arazzo-BAgw9ap6.js → arazzo-C4BcskbX.js}

@@ -1,6 +1,7 @@
-import { u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
-import { a as loadModule, o as pickNamed, t as asPermissionTree } from "./load-DhWEB9P1.js";
-import { existsSync, readFileSync } from "node:fs";
+import { m as arazzoFindings } from "./snapshot-Dc9CHPME.js";
+import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-C3_oTHyO.js";
+import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts
 async function runArazzo(input) {
@@ -23,8 +24,8 @@ async function runArazzo(input) {
 	let arazzo;
 	let openapi;
 	try {
-		arazzo = JSON.parse(readFileSync(arazzoFile, "utf8"));
-		openapi = JSON.parse(readFileSync(openapiFile, "utf8"));
+		arazzo = readJsonFile(arazzoFile);
+		openapi = readJsonFile(openapiFile);
 	} catch {
 		return {
 			code: 2,

package/dist/{arazzo-CKwwqFWz.js → arazzo-CD8d0WLb.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/arazzo.ts
 function arazzo(ctx) {
@@ -36,7 +36,7 @@ function arazzo(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./arazzo-BAgw9ap6.js")).runArazzo({
+			const result = await (await import("./arazzo-C4BcskbX.js")).runArazzo({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/authzen/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, Nr as Principal } from "../policy-IB6yxpC3.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { E as Policy, Or as Principal } from "../policy-types-sp9P1iIV.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
 //#region src/authzen/types.d.ts
 type AuthzenResourceAdapter = {
   readonly load?: (id: string) => unknown;

package/dist/authzen/index.js

@@ -1,14 +1,153 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { E as ownGet, _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
-import { t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
-import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { s as ownGet } from "../thenable-QSmvt-vZ.js";
+import { t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-BsblpB-z.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as hasCredentials } from "../http-SO7qGttf.js";
-import { i as methodNotAllowed, l as unauthenticatedProblem, s as problemResponse, t as batchTooLarge, u as validationProblem } from "../problem-B43ztKIm.js";
-import { t as applyApprovalResume } from "../evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as permissionLookup } from "../evaluation-items-CfCCejQd.js";
-import { a as endsWithPath, c as mergeItem, d as pathnameOf, f as permissionOf, g as userFromEntity, h as tenantOf, i as delegationOf, l as pageOf, m as resourceIdOf, n as UNKNOWN, o as evaluationRow, p as resourceData, r as actorOf, s as isRecord, t as UNAVAILABLE, u as paged } from "../map-AcxK9o_D.js";
+import { r as hasCredentials } from "../http-BBoKefeS.js";
+import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CnWraVhC.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-DIIV9DbC.js";
+import { c as itemResourceData, l as permissionLookup, t as applyApprovalResume } from "../evaluations-C9YJsv3H.js";
+//#region src/authzen/map.ts
+const UNKNOWN = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "unknown-permission"
+	}],
+	alternatives: []
+};
+const UNAVAILABLE = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "resource-unavailable"
+	}],
+	alternatives: []
+};
+function actionNameOf(item) {
+	if (typeof item.action?.name === "string") return item.action.name;
+	if (!isRecord(item.action?.properties)) return;
+	const scope = item.action.properties["scope"];
+	return typeof scope === "string" ? scope : void 0;
+}
+function permissionOf(lookup, item) {
+	return lookup(actionNameOf(item), item.resource);
+}
+function resourceData(item) {
+	return itemResourceData(item.resource);
+}
+function resourceIdOf(item) {
+	const id = item.resource?.id;
+	if (typeof id === "string" || typeof id === "number") return String(id);
+}
+function userFromEntity(entity) {
+	if (entity === void 0) return null;
+	const result = {};
+	if (typeof entity.id === "string" || typeof entity.id === "number") result["id"] = String(entity.id);
+	if (isRecord(entity.properties)) for (const [key, value] of Object.entries(entity.properties)) {
+		if (key === "actor" || key === "delegation") continue;
+		result[key] = value;
+	}
+	return Object.keys(result).length === 0 ? null : result;
+}
+function actorOf(item) {
+	const context = isRecord(item.context) ? item.context : {};
+	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["actor"] : void 0;
+	const raw = context["actor"] ?? fromSubject;
+	if (!isRecord(raw) || typeof raw["id"] !== "string") return;
+	const kind = typeof raw["kind"] === "string" ? raw["kind"] : "oauth-client";
+	return {
+		id: raw["id"],
+		kind
+	};
+}
+function delegationOf(item) {
+	const context = isRecord(item.context) ? item.context : {};
+	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["delegation"] : void 0;
+	const raw = context["delegation"] ?? fromSubject;
+	if (!isRecord(raw)) return;
+	const scopes = raw["scopes"];
+	const authorizationDetails = raw["authorizationDetails"];
+	return compact({
+		scopes: Array.isArray(scopes) ? scopes.filter((scope) => typeof scope === "string") : void 0,
+		authorizationDetails: Array.isArray(authorizationDetails) ? authorizationDetails : void 0
+	});
+}
+function tenantOf(item) {
+	if (!isRecord(item.context) || typeof item.context["tenant"] !== "string") return;
+	return item.context["tenant"];
+}
+function permdockContext(decision) {
+	switch (decision.outcome) {
+		case "granted": return { outcome: "granted" };
+		case "denied": {
+			const unknown = decision.denials.some((denial) => denial.detail === "unknown-permission");
+			return compact({
+				outcome: "denied",
+				denials: decision.denials.map((denial) => ({
+					role: denial.role,
+					reason: denial.reason
+				})),
+				reason: unknown ? "unknown-permission" : void 0
+			});
+		}
+		case "approval-required": return {
+			outcome: "approval-required",
+			token: decision.token
+		};
+		default: return decision;
+	}
+}
+function evaluationContext(decision) {
+	return { permdock: permdockContext(decision) };
+}
+function evaluationRow(decision) {
+	return {
+		decision: decision.outcome === "granted",
+		context: evaluationContext(decision)
+	};
+}
+function pathnameOf(request) {
+	return new URL(request.url).pathname;
+}
+function endsWithPath(pathname, suffix) {
+	return pathname === suffix || pathname.endsWith(suffix);
+}
+function mergeItem(shared, item) {
+	if (!isRecord(item)) return shared;
+	return compact({
+		subject: isRecord(item["subject"]) ? item["subject"] : shared.subject,
+		action: isRecord(item["action"]) ? item["action"] : shared.action,
+		resource: isRecord(item["resource"]) ? item["resource"] : shared.resource,
+		context: item["context"] ?? shared.context
+	});
+}
+function pageOf(body) {
+	const page = isRecord(body["page"]) ? body["page"] : {};
+	const raw = typeof page["token"] === "string" ? page["token"] : typeof page["next_token"] === "string" ? page["next_token"] : "0";
+	const parsed = Math.trunc(Number(raw));
+	const sizeRaw = page["limit"] ?? page["size"];
+	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : 50;
+	return {
+		offset: Number.isFinite(parsed) && parsed > 0 ? parsed : 0,
+		size
+	};
+}
+function paged(items, offset, size) {
+	const slice = items.slice(offset, offset + size);
+	const next = offset + slice.length;
+	return {
+		results: slice,
+		page: {
+			next_token: next < items.length ? String(next) : "",
+			count: slice.length,
+			total: items.length
+		}
+	};
+}
+//#endregion
 //#region src/authzen/create.ts
 function notFound(detail) {
 	return problemResponse({
@@ -56,24 +195,23 @@ const createPermDock = (policy, options) => {
 	};
 	const allowAnonymous = options.anonymous === true;
 	async function authenticate(request) {
-		let pep;
-		try {
-			pep = await options.subject(request);
-		} catch {
-			pep = null;
-		}
+		const pep = await resolveOrNull(() => options.subject(request));
 		if ((pep === null || pep === void 0) && !allowAnonymous) return unauthenticatedProblem(hasCredentials(request));
 		return { pep: pep ?? null };
 	}
-	function instantiate(pep, item) {
+	async function instantiate(pep, item) {
 		const trusted = trusts(pep);
 		const user = (trusted ? userFromEntity(item.subject) : null) ?? pep;
-		return createPermDock$1(policy, user, compact({
-			actor: trusted ? actorOf(item) : void 0,
-			delegation: trusted ? delegationOf(item) : void 0,
-			tenant: tenantOf(item),
-			...instanceOptions(options)
-		}));
+		return (await buildInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				actor: trusted ? actorOf(item) : void 0,
+				delegation: trusted ? delegationOf(item) : void 0,
+				tenant: tenantOf(item)
+			}
+		})).permdock;
 	}
 	async function resourceOf(item) {
 		const properties = item.resource?.properties;

package/dist/better-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { Nr as Principal, Pr as Subject, at as DecisionSink, k as RoleBinding, xt as RoleSource } from "../policy-IB6yxpC3.js";
-import { m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { N as RoleBinding, Or as Principal, W as DecisionSink, kr as Subject, nt as RoleSource } from "../policy-types-sp9P1iIV.js";
+import { p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts
 type BetterAuthPrincipal = Principal & {