permdock 0.3.0 → 0.4.0

package/dist/better-supabase/index.js

@@ -1,14 +1,16 @@
+import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { _ as listPermissions, p as isPermission } from "../permissions-DVoF6dMt.js";
-import { d as scopeList } from "../scopes-CVdPrWN-.js";
+import { d as scopeList } from "../scopes-tvpa34ep.js";
+import { c as listPermissions, o as isPermission } from "../permission-registry-BsblpB-z.js";
+import { t as createPermDock } from "../permdock-L26udHSk.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { t as mayUse } from "../may-use-DndQ5tQ-.js";
-import { o as parseCredential, r as credentialSubject } from "../credential-8P81ff4u.js";
+import { t as mayUse } from "../may-use-BOn_dR_w.js";
+import { o as parseCredential, r as credentialSubject } from "../credential-kue0qpbm.js";
 import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
-import { i as quoteSqlLiteral, o as sqlIdent } from "../sql-xdg5f4Fi.js";
-import "../sources-4p0-4xQm.js";
-import { o as subjectFromSupabaseSession, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
-import { t as parseCatalog } from "../parse-BuyjxhZV.js";
+import { c as sqlIdent, o as quoteSqlLiteral } from "../sql-t8teWOfo.js";
+import "../sources-B1-b-R0t.js";
+import { o as subjectFromSupabaseSession, t as parseSupabaseManifest } from "../manifest-BngWKryL.js";
+import { t as parseCatalog } from "../parse-CVFQHk6c.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/provider.ts
 /**
@@ -314,93 +316,6 @@ function authorizationProvider(options) {
 	});
 }
 //#endregion
-//#region src/better-supabase/policies.ts
-/** PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the policies it generates. */
-const SPLIT_KEY = /#\d+$/u;
-function checkedKey(where, permission, facts, scope) {
-	const key = permission.key;
-	if (SPLIT_KEY.test(key)) throw new TypeError(`PermDock: ${where} "${key}" is one part of a permission split by row condition. Use the policies \`permdock rls generate\` writes for it.`);
-	const entry = facts(key);
-	if (!entry.known) throw new TypeError(`PermDock: ${where} "${key}" is not in permissions.catalog.json. Run \`permdock catalog\`.`);
-	if (entry.rowConditions) throw new TypeError(`PermDock: ${where} "${key}" has row conditions (rowConditions: true), which the SQL helpers don't check, so the policy would grant every object in the scope. Use the policies \`permdock rls generate\` writes for it.`);
-	const grantScope = scope === "platform" ? "global" : scope;
-	const scopes = entry.grantScopes;
-	if (scopes.length > 0 && !scopes.includes(grantScope)) throw new TypeError(`PermDock: ${where} "${key}" is granted at ${[...new Set(scopes)].join(", ")}, not at ${grantScope}. Check it at one of those scopes.`);
-	return key;
-}
-function target(options) {
-	const policy = options.policy;
-	let names;
-	let schemaName;
-	let facts;
-	if (policy === void 0) {
-		const manifest = parseSupabaseManifest(options.manifest);
-		const catalog = parseCatalog(options.catalog);
-		names = manifest.rls.scopes.map((scope) => scope.name);
-		schemaName = manifest.rls.schema;
-		facts = (key) => {
-			const entry = catalog.permissions.find((candidate) => candidate.key === key);
-			return {
-				known: entry !== void 0,
-				rowConditions: entry?.rowConditions === true,
-				grantScopes: (catalog.grants ?? []).flatMap((grant) => grant.permission === key && typeof grant.scope === "string" ? [grant.scope] : [])
-			};
-		};
-	} else {
-		names = scopeList(policy.scopes).map((scope) => scope.name);
-		schemaName = options.schema ?? "permdock";
-		const conditioned = policyRowConditionKeys(policy);
-		facts = (key) => ({
-			known: true,
-			rowConditions: conditioned.has(key),
-			grantScopes: policy.grants.flatMap((grant) => grant.hosted === void 0 && grant.permission.key === key && typeof grant.scope === "string" ? [grant.scope] : [])
-		});
-	}
-	if (options.scope !== "platform" && !names.includes(options.scope)) throw new TypeError(`PermDock: scope "${options.scope}" is not in the ${policy === void 0 ? "manifest's rls.scopes" : "policy's scopes"} (${names.join(", ")}) and is not "platform".`);
-	const schema = sqlIdent(schemaName);
-	return {
-		facts,
-		sql: {
-			idsWith: `${schema}.permitted_{scope}_ids_by_permission({permission})`,
-			isPlatform: `${schema}.permdock_has_permission({permission})`
-		}
-	};
-}
-/**
-* A better-supabase bucket `policy` that checks PermDock permissions with
-* the `rls generate` helpers at `scope`. The helpers check role and scope
-* only, so a permission with row conditions (`rowConditions: true` in the
-* catalog, or a conditioned grant in `policy`), or one not granted at
-* `scope`, throws.
-*/
-function bucketPolicy(access, options) {
-	const { facts, sql } = target(options);
-	const key = (name, permission) => checkedKey(`bucket access.${name}`, permission, facts, options.scope);
-	return freezeDeep({
-		access: {
-			read: key("read", access.read),
-			...access.list ? { list: key("list", access.list) } : {},
-			write: key("write", access.write),
-			...access.delete ? { delete: key("delete", access.delete) } : {}
-		},
-		scope: options.scope,
-		...options.segment === void 0 ? {} : { segment: options.segment },
-		sql
-	});
-}
-/** As {@link bucketPolicy}, for a better-supabase Realtime topic. */
-function topicPolicy(access, options) {
-	const { facts, sql } = target(options);
-	const key = (name, permission) => checkedKey(`topic ${name}`, permission, facts, options.scope);
-	return freezeDeep({
-		receive: key("receive", access.receive),
-		...access.send ? { send: key("send", access.send) } : {},
-		scope: options.scope,
-		...options.segment === void 0 ? {} : { segment: options.segment },
-		sql
-	});
-}
-//#endregion
 //#region src/better-supabase/api-keys.ts
 const seconds = (instant) => Math.floor(instant.epochMilliseconds / 1e3);
 /** When a key stops verifying: its expiry, or the end of a rotated key's grace period. */
@@ -508,6 +423,252 @@ function apiKeyClaimOptions(manifest) {
 	});
 }
 //#endregion
+//#region src/better-supabase/subject.ts
+/** `session` with the short codes in `claim` turned back into feature keys. */
+function decodedFeatures(session, claim, keys) {
+	const claims = session?.claims;
+	if (session === null || session === void 0 || !isRecord(claims)) return session;
+	const coded = claims[claim];
+	if (!isRecord(coded)) return session;
+	const byCode = new Map(Object.entries(keys).map(([key, code]) => [code, key]));
+	const decoded = Object.fromEntries(Object.entries(coded).map(([tenant, codes]) => [tenant, Array.isArray(codes) ? codes.flatMap((code) => {
+		const key = typeof code === "string" ? byCode.get(code) : void 0;
+		return key === void 0 ? [] : [key];
+	}) : codes]));
+	return {
+		...session,
+		claims: {
+			...claims,
+			[claim]: decoded
+		}
+	};
+}
+function isApiKeySession(session) {
+	if (typeof session !== "object" || session === null) return false;
+	const record = Object.fromEntries(Object.entries(session));
+	return record["kind"] === "apiKey" && typeof record["keyId"] === "string" && typeof record["name"] === "string" && Array.isArray(record["scopes"]) && record["scopes"].every((scope) => typeof scope === "string");
+}
+function apiKeySubject(session, options) {
+	const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(session) : options.serviceRoles ?? manifestServiceRoles(options.manifest);
+	const credential = keyCredential({
+		id: session.keyId,
+		name: session.name,
+		scopes: session.scopes,
+		...session.organizationId === void 0 ? {} : { organizationId: session.organizationId },
+		...session.userId === void 0 ? {} : { userId: session.userId },
+		...session.createdBy === void 0 ? {} : { createdBy: session.createdBy },
+		...session.createdAt === void 0 ? {} : { createdAt: session.createdAt }
+	}, roles, listPermissions(options.permissions));
+	return credential === null ? anonymousSubject() : credentialSubject(credential, { permissions: options.permissions });
+}
+/**
+* `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
+* `memberships` for the memberships and the entitlements module's `features`
+* claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
+* a verified `apiKey` session is the key's credential subject: a personal key
+* acts as its user within the key's scopes, a tenant key as a `service`
+* principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
+* `service` and `invalid` sessions, the subject is anonymous.
+*/
+function subjectFromBetterSupabase(session, options = {}) {
+	const { apiKeys, plans = "features", ...rest } = options;
+	if (isApiKeySession(session)) return apiKeys === void 0 ? anonymousSubject() : apiKeySubject(session, apiKeys);
+	const claim = typeof plans === "string" ? plans : plans.claim ?? "features";
+	const keys = typeof plans === "string" ? void 0 : plans.keys;
+	return subjectFromSupabaseSession(keys === void 0 ? session : decodedFeatures(session, claim, keys), {
+		memberships: "memberships",
+		...rest,
+		plans: claim
+	});
+}
+//#endregion
+//#region src/better-supabase/authorizer.ts
+const OPERATIONS = /* @__PURE__ */ new Set([
+	"list",
+	"get",
+	"create",
+	"update",
+	"delete"
+]);
+const denied = (reason) => ({
+	outcome: "denied",
+	reason
+});
+function outcomeOf(decision, key) {
+	switch (decision.outcome) {
+		case "granted": return { outcome: "granted" };
+		case "approval-required": return {
+			outcome: "approval-required",
+			approval: { id: decision.token }
+		};
+		case "denied": {
+			const why = decision.denials[0]?.reason;
+			return denied(why === void 0 ? `PermDock denied ${key}.` : `PermDock denied ${key}: ${why}.`);
+		}
+		default: return decision;
+	}
+}
+function decideWith(permdock, request) {
+	const { action } = request;
+	if (!isPermission(action)) return denied("Unknown permission.");
+	return outcomeOf(permdock.decide(action, request.resource.properties), action.key);
+}
+/** The verified claims better-supabase passes in `subject.properties.claims`, for a user or a delegated agent. */
+function claimsOf(request) {
+	const { subject } = request;
+	if (subject.type !== "user" && subject.type !== "agent") return void 0;
+	const claims = subject.properties?.["claims"];
+	return isRecord(claims) ? claims : void 0;
+}
+/**
+* better-supabase's `authorizer` for PermDock: every resource, action, route
+* guard and MCP tool that declares a `permission` is decided with `decide`.
+* The subject is mapped from the verified claims with
+* `subjectFromBetterSupabase`; the request's `context.tenant` selects the
+* active tenant only among the memberships the claims hold. A caller without
+* claims is anonymous, and a throw denies.
+*/
+function authorizer(options) {
+	const { operations } = options;
+	const instanceFor = async (claims, tenant) => {
+		const session = claims === void 0 ? null : {
+			kind: "user",
+			claims
+		};
+		const base = await createPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), options.options);
+		return typeof tenant === "string" ? base.tenant(tenant) : base;
+	};
+	return Object.freeze({
+		apiVersion: 1,
+		name: "PermDock",
+		key(ref) {
+			if (!isPermission(ref)) throw new TypeError("Not a PermDock permission");
+			return ref.key;
+		},
+		...operations === void 0 ? {} : { forOperation(table, operation) {
+			if (!OPERATIONS.has(operation) || !Object.hasOwn(operations, table)) return void 0;
+			return operations[table]?.[operation];
+		} },
+		async evaluate(request) {
+			try {
+				return decideWith(await instanceFor(claimsOf(request), request.context["tenant"]), request);
+			} catch {
+				return denied("The permission check failed.");
+			}
+		},
+		evaluations(requests) {
+			const cache = /* @__PURE__ */ new Map();
+			const shared = (claims, tenant) => {
+				let byTenant = cache.get(claims);
+				if (byTenant === void 0) {
+					byTenant = /* @__PURE__ */ new Map();
+					cache.set(claims, byTenant);
+				}
+				let instance = byTenant.get(tenant);
+				if (instance === void 0) {
+					instance = instanceFor(claims, tenant);
+					byTenant.set(tenant, instance);
+				}
+				return instance;
+			};
+			return Promise.all(requests.map(async (request) => {
+				try {
+					return decideWith(await shared(claimsOf(request), request.context["tenant"]), request);
+				} catch {
+					return denied("The permission check failed.");
+				}
+			}));
+		}
+	});
+}
+//#endregion
+//#region src/better-supabase/policies.ts
+/** PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the policies it generates. */
+const SPLIT_KEY = /#\d+$/u;
+function checkedKey(where, permission, facts, scope) {
+	const key = permission.key;
+	if (SPLIT_KEY.test(key)) throw new TypeError(`PermDock: ${where} "${key}" is one part of a permission split by row condition. Use the policies \`permdock rls generate\` writes for it.`);
+	const entry = facts(key);
+	if (!entry.known) throw new TypeError(`PermDock: ${where} "${key}" is not in permissions.catalog.json. Run \`permdock catalog\`.`);
+	if (entry.rowConditions) throw new TypeError(`PermDock: ${where} "${key}" has row conditions (rowConditions: true), which the SQL helpers don't check, so the policy would grant every object in the scope. Use the policies \`permdock rls generate\` writes for it.`);
+	const grantScope = scope === "platform" ? "global" : scope;
+	const scopes = entry.grantScopes;
+	if (scopes.length > 0 && !scopes.includes(grantScope)) throw new TypeError(`PermDock: ${where} "${key}" is granted at ${[...new Set(scopes)].join(", ")}, not at ${grantScope}. Check it at one of those scopes.`);
+	return key;
+}
+function target(options) {
+	const policy = options.policy;
+	let names;
+	let schemaName;
+	let facts;
+	if (policy === void 0) {
+		const manifest = parseSupabaseManifest(options.manifest);
+		const catalog = parseCatalog(options.catalog);
+		names = manifest.rls.scopes.map((scope) => scope.name);
+		schemaName = manifest.rls.schema;
+		facts = (key) => {
+			const entry = catalog.permissions.find((candidate) => candidate.key === key);
+			return {
+				known: entry !== void 0,
+				rowConditions: entry?.rowConditions === true,
+				grantScopes: (catalog.grants ?? []).flatMap((grant) => grant.permission === key && typeof grant.scope === "string" ? [grant.scope] : [])
+			};
+		};
+	} else {
+		names = scopeList(policy.scopes).map((scope) => scope.name);
+		schemaName = options.schema ?? "permdock";
+		const conditioned = policyRowConditionKeys(policy);
+		facts = (key) => ({
+			known: true,
+			rowConditions: conditioned.has(key),
+			grantScopes: policy.grants.flatMap((grant) => grant.hosted === void 0 && grant.permission.key === key && typeof grant.scope === "string" ? [grant.scope] : [])
+		});
+	}
+	if (options.scope !== "platform" && !names.includes(options.scope)) throw new TypeError(`PermDock: scope "${options.scope}" is not in the ${policy === void 0 ? "manifest's rls.scopes" : "policy's scopes"} (${names.join(", ")}) and is not "platform".`);
+	const schema = sqlIdent(schemaName);
+	return {
+		facts,
+		sql: {
+			idsWith: `${schema}.permitted_{scope}_ids_by_permission({permission})`,
+			isPlatform: `${schema}.permdock_has_permission({permission})`
+		}
+	};
+}
+/**
+* A better-supabase bucket `policy` that checks PermDock permissions with
+* the `rls generate` helpers at `scope`. The helpers check role and scope
+* only, so a permission with row conditions (`rowConditions: true` in the
+* catalog, or a conditioned grant in `policy`), or one not granted at
+* `scope`, throws.
+*/
+function bucketPolicy(access, options) {
+	const { facts, sql } = target(options);
+	const key = (name, permission) => checkedKey(`bucket access.${name}`, permission, facts, options.scope);
+	return freezeDeep({
+		access: {
+			read: key("read", access.read),
+			...access.list ? { list: key("list", access.list) } : {},
+			write: key("write", access.write),
+			...access.delete ? { delete: key("delete", access.delete) } : {}
+		},
+		scope: options.scope,
+		...options.segment === void 0 ? {} : { segment: options.segment },
+		sql
+	});
+}
+/** As {@link bucketPolicy}, for a better-supabase Realtime topic. */
+function topicPolicy(access, options) {
+	const { facts, sql } = target(options);
+	const key = (name, permission) => checkedKey(`topic ${name}`, permission, facts, options.scope);
+	return freezeDeep({
+		receive: key("receive", access.receive),
+		...access.send ? { send: key("send", access.send) } : {},
+		scope: options.scope,
+		...options.segment === void 0 ? {} : { segment: options.segment },
+		sql
+	});
+}
+//#endregion
 //#region src/better-supabase/credentials.ts
 /**
 * `provider` with every `getToken`, `startAuthorization`,
@@ -585,64 +746,4 @@ function toolPolicy(options) {
 	});
 }
 //#endregion
-//#region src/better-supabase/subject.ts
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** `session` with the short codes in `claim` turned back into feature keys. */
-function decodedFeatures(session, claim, keys) {
-	const claims = session?.claims;
-	if (session === null || session === void 0 || !isRecord(claims)) return session;
-	const coded = claims[claim];
-	if (!isRecord(coded)) return session;
-	const byCode = new Map(Object.entries(keys).map(([key, code]) => [code, key]));
-	const decoded = Object.fromEntries(Object.entries(coded).map(([tenant, codes]) => [tenant, Array.isArray(codes) ? codes.flatMap((code) => {
-		const key = typeof code === "string" ? byCode.get(code) : void 0;
-		return key === void 0 ? [] : [key];
-	}) : codes]));
-	return {
-		...session,
-		claims: {
-			...claims,
-			[claim]: decoded
-		}
-	};
-}
-function isApiKeySession(session) {
-	if (typeof session !== "object" || session === null) return false;
-	const record = Object.fromEntries(Object.entries(session));
-	return record["kind"] === "apiKey" && typeof record["keyId"] === "string" && typeof record["name"] === "string" && Array.isArray(record["scopes"]) && record["scopes"].every((scope) => typeof scope === "string");
-}
-function apiKeySubject(session, options) {
-	const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(session) : options.serviceRoles ?? manifestServiceRoles(options.manifest);
-	const credential = keyCredential({
-		id: session.keyId,
-		name: session.name,
-		scopes: session.scopes,
-		...session.organizationId === void 0 ? {} : { organizationId: session.organizationId },
-		...session.userId === void 0 ? {} : { userId: session.userId },
-		...session.createdBy === void 0 ? {} : { createdBy: session.createdBy },
-		...session.createdAt === void 0 ? {} : { createdAt: session.createdAt }
-	}, roles, listPermissions(options.permissions));
-	return credential === null ? anonymousSubject() : credentialSubject(credential, { permissions: options.permissions });
-}
-/**
-* `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
-* `memberships` for the memberships and the entitlements module's `features`
-* claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
-* a verified `apiKey` session is the key's credential subject: a personal key
-* acts as its user within the key's scopes, a tenant key as a `service`
-* principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
-* `service` and `invalid` sessions, the subject is anonymous.
-*/
-function subjectFromBetterSupabase(session, options = {}) {
-	const { apiKeys, plans = "features", ...rest } = options;
-	if (isApiKeySession(session)) return apiKeys === void 0 ? anonymousSubject() : apiKeySubject(session, apiKeys);
-	const claim = typeof plans === "string" ? plans : plans.claim ?? "features";
-	const keys = typeof plans === "string" ? void 0 : plans.keys;
-	return subjectFromSupabaseSession(keys === void 0 ? session : decodedFeatures(session, claim, keys), {
-		memberships: "memberships",
-		...rest,
-		plans: claim
-	});
-}
-//#endregion
-export { apiKeyClaimOptions, apiKeyVerifier, authorizationProvider, bucketPolicy, credentialGuard, subjectFromBetterSupabase, toolPolicy, topicPolicy };
+export { apiKeyClaimOptions, apiKeyVerifier, authorizationProvider, authorizer, bucketPolicy, credentialGuard, subjectFromBetterSupabase, toolPolicy, topicPolicy };

package/dist/{bind-C_ob3LKa.d.ts → bind-BzqG8SMb.d.ts}

@@ -1,8 +1,10 @@
-import { f as ApprovalStore } from "./types-aqOHTHcp.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
-import { r as PdpFactory } from "./types-DxiCGmmd.js";
-import { o as OtelWrap } from "./types-QCuYJh4q.js";
-import { T as TenantOption, b as WebBotAuthVerifier } from "./create-B1d519XK.js";
+import { f as ApprovalStore } from "./types-Br9IXUBG.js";
+import { t as InstanceOptions } from "./instance-options-plkrsAog.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap } from "./wrap-Cr93qqdP.js";
+import { r as PdpFactory } from "./types-CIlTojhq.js";
+import { T as TenantOption, n as OnDenied, y as WebBotAuthVerifier } from "./server-types-DdqBwZN_.js";
+import { o as OtelWrap } from "./types-CUcFZfpU.js";
 //#region src/server/bind.d.ts
 /** The options of every framework adapter; `TContext` is what its callbacks receive. */
 type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {
@@ -10,6 +12,11 @@ type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerA
   /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
   readonly actor?: (context: TContext) => unknown;
   readonly tenant?: TenantOption<TContext>;
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input.
+   */
+  readonly context?: (context: TContext) => RequestContext | undefined | Promise<RequestContext | undefined>;
 };
 /** The services an adapter hands to its kernel unchanged. */
 type ServerAdapterServices = {
@@ -20,6 +27,10 @@ type ServerAdapterServices = {
   readonly otel?: OtelWrap;
   /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
   readonly webBotAuth?: WebBotAuthVerifier;
+  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+  /** Replaces the response of a refused guard; it can never turn a refusal into a grant. */
+  readonly onDenied?: OnDenied;
 };
 //#endregion
 export { ServerAdapterServices as n, ServerAdapterOptions as t };

package/dist/{bind-CuzGytRf.js → bind-kk-uyCwH.js}

@@ -1,8 +1,9 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { o as invalidSignatureResponse } from "./evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as composeWraps } from "./wrap-DWsU_5Bd.js";
+import { r as instanceOptions } from "./build-instance-DIIV9DbC.js";
+import { o as invalidSignatureResponse } from "./evaluations-C9YJsv3H.js";
 import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { n as createServerKernel } from "./create-CMwIl-w2.js";
+import { n as createServerKernel } from "./create-BBO24vj6.js";
 //#region src/server/bind.ts
 /** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
 function adapterKernel(policy, options, adapter, contextOf) {
@@ -15,13 +16,18 @@ function adapterKernel(policy, options, adapter, contextOf) {
 			const context = contextOf(request);
 			return context === void 0 ? void 0 : options.actor?.(context);
 		},
+		context: options.context === void 0 ? void 0 : (request) => {
+			const context = contextOf(request);
+			return context === void 0 ? void 0 : options.context?.(context);
+		},
 		...instanceOptions(options),
 		store: options.store,
 		pdp: options.pdp,
 		webBotAuth: options.webBotAuth,
 		revocations: options.revocations,
 		adapter,
-		wrap: options.otel
+		wrap: composeWraps(options.otel, options.wrap),
+		onDenied: options.onDenied
 	}));
 }
 /**
@@ -53,13 +59,15 @@ function bindKernel(policy, options, adapter, toRequest) {
 		return context === void 0 ? Promise.resolve({ tenant: void 0 }) : scopeOf(context);
 	};
 	const attach = (context) => attached(async () => kernel.permdock(bind(context), await scopeOf(context)));
+	const guard = async (permission, loadData, context, protectOptions) => kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(context), protectOptions)(bind(context), await scopeOf(context));
 	return {
 		kernel,
 		bind,
 		rebind,
 		scopeOf,
 		handlerScope,
-		attach
+		attach,
+		guard
 	};
 }
 /** The instance `build` resolves; an invalid Web Bot Auth signature is its `401` response. */

package/dist/build-instance-DIIV9DbC.js

@@ -0,0 +1,51 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as createPermDock } from "./permdock-L26udHSk.js";
+//#region src/core/instance-options.ts
+const INSTANCE_KEYS = {
+	memberships: true,
+	relations: true,
+	entitlements: true,
+	customRoles: true,
+	policies: true,
+	approvalPolicies: true,
+	sink: true,
+	limits: true
+};
+/** The `InstanceOptions` set on `options`, without the adapter's own keys. */
+function instanceOptions(options) {
+	const picked = {};
+	for (const key of Object.keys(INSTANCE_KEYS)) {
+		const name = key;
+		if (options[name] !== void 0) picked[name] = options[name];
+	}
+	return picked;
+}
+//#endregion
+//#region src/core/build-instance.ts
+/**
+* `resolve()`, or `null` when it throws: a subject or delegation that cannot
+* be resolved is absent. `rethrow` sees the error first, so a framework's
+* control-flow throws (Next.js `redirect`, `notFound`) pass through.
+*/
+async function resolveOrNull(resolve, rethrow) {
+	try {
+		return await resolve();
+	} catch (error) {
+		rethrow?.(error);
+		return null;
+	}
+}
+/** The one path every server adapter creates a request's instance through. */
+async function buildInstance(input) {
+	const options = compact({
+		...instanceOptions(input.sources),
+		...input.scope
+	});
+	const created = await createPermDock(input.policy, input.user, options);
+	return {
+		permdock: input.wrap === void 0 ? created : input.wrap(created),
+		options
+	};
+}
+//#endregion
+export { resolveOrNull as n, instanceOptions as r, buildInstance as t };

package/dist/{canonical-json-DemiK4Vp.js → canonical-json-CFKyFOke.js}

@@ -1,7 +1,5 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 //#region src/core/canonical-json.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
 * JSON with sorted keys and `undefined` members dropped, so equal values hash
 * equally. Dates become ISO strings, bigints `"<n>n"`, and a repeated object

package/dist/{capability-2kYTMWDv.d.ts → capability-CksyCWDH.d.ts}

@@ -1,5 +1,5 @@
-import { Nr as Principal, Pr as Subject, Pt as TokenSigner } from "./policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
+import { Or as Principal, kr as Subject, lt as TokenSigner } from "./policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "./permission-types-Dg39z9Kv.js";
 //#region src/core/capability.d.ts
 /**
  * Who may redeem a capability: anyone holding it, any signed-in principal,

package/dist/{capability-4qPdO9gk.js → capability-txATtKV4.js}

@@ -1,8 +1,9 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { T as isForbiddenKey, _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
 import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
 import { n as sameId } from "./ids-DC4V4CFu.js";
+import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
 //#region src/core/capability.ts
 function redeemerKind(redeemer) {

package/dist/catalog/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
+import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-DpWfQdSh.js";
 //#region src/catalog/parse.d.ts
 /**
  * Reads a `permissions.catalog.json` document (parsed, or the JSON text) and

package/dist/catalog/index.js

@@ -1,2 +1,2 @@
-import { n as rowConditionKeys, t as parseCatalog } from "../parse-BuyjxhZV.js";
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-CVFQHk6c.js";
 export { parseCatalog, rowConditionKeys };

package/dist/catalog-6yWAX6Ps.js

@@ -0,0 +1,2 @@
+import { t as runCatalog } from "./catalog-tZUyOfOv.js";
+export { runCatalog };

package/dist/{catalog-dFZdWCGN.js → catalog-WHG4kBq7.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/catalog.ts
 function catalog(ctx) {
@@ -31,7 +31,7 @@ function catalog(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./catalog-CRW5Mx_B.js")).runCatalog({
+			const result = await (await import("./catalog-6yWAX6Ps.js")).runCatalog({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				format: parsed.format,