permdock 0.3.1 → 0.4.0

package/dist/{rls-migrate-CN4TlJTO.js → migrate-BwlB5-Wk.js}

@@ -1,12 +1,17 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as sqlFiles } from "./files-DWUN9PzI.js";
-import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { r as HELPERS } from "./rls-shared-Cewd_-zI.js";
+import { o as sqlFiles } from "./files-D_JIzUrP.js";
+import { n as escapeSqlIdent, o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
+import "./sources-B1-b-R0t.js";
+import { a as RETIRE_MARKER } from "./markers-CiwAOZtO.js";
+import { r as HELPERS } from "./shared-1uhI-e-b.js";
+import { l as writeOutputFiles, t as dataMigrationFile } from "./output-files-CgIsvdSa.js";
+import { o as sqlStatements } from "./deciding-columns-Sq12mEA6.js";
+import { i as retireSql, r as retirePlan } from "./retire-BFcxL6un.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import { parse } from "pgsql-parser";
-//#region src/cli/rls-migrate.ts
+//#region src/cli/rls/migrate.ts
 function migrateTarget(generated) {
 	const granted = /* @__PURE__ */ new Map();
 	for (const row of generated.seeds ?? []) {
@@ -27,11 +32,8 @@ function migrateTarget(generated) {
 		renamed: generated.keys?.renamed ?? {}
 	};
 }
-function isNode(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function child(node, key) {
-	return isNode(node) ? node[key] : void 0;
+	return isRecord(node) ? node[key] : void 0;
 }
 function list(value) {
 	return Array.isArray(value) ? value : [];
@@ -259,9 +261,9 @@ async function migrateSql(file, text, config, target) {
 			for (const item of node) visit(item, inPolicy);
 			return;
 		}
-		if (!isNode(node)) return;
+		if (!isRecord(node)) return;
 		for (const [kind, value] of Object.entries(node)) {
-			if (kind === "FuncCall" && isNode(value)) {
+			if (kind === "FuncCall" && isRecord(value)) {
 				const call = rewriter.call(value);
 				if (call !== void 0) {
 					const source = call.end === -1 ? call.name : text.slice(call.start, call.end);
@@ -305,7 +307,7 @@ async function migrateSql(file, text, config, target) {
 		const statement = child(raw, "stmt");
 		const offset = child(raw, "stmt_location");
 		const statementStart = at(typeof offset === "number" ? offset : 0);
-		const kind = isNode(statement) ? Object.keys(statement)[0] : void 0;
+		const kind = isRecord(statement) ? Object.keys(statement)[0] : void 0;
 		if (kind !== void 0 && BODY_STATEMENTS.has(kind)) {
 			for (const body of bodyStrings(child(statement, kind))) {
 				const bodyStart = text.indexOf(body, statementStart);
@@ -329,6 +331,12 @@ async function migrateSql(file, text, config, target) {
 		text: out
 	};
 }
+function describeRetire(plan) {
+	return plan.tables.flatMap((table) => {
+		if (!table.present) return [`retire ${table.table}: no longer created by --sql`];
+		return [`retire ${table.table}: ${String(table.refreshTriggers.length)} refresh trigger(s), ${String(table.refreshFunctions.length)} refresh function(s), ${String(table.readers.length)} reader(s)${table.readers.length === 0 ? "; --retire-out drops it" : ""}`, ...table.readers.map((reader) => `  read by ${reader.kind} ${reader.name} at ${reader.file}:${String(reader.line)}`)];
+	});
+}
 function describe(report, write) {
 	const lines = [...report.rewrites.map((item) => `${item.file}:${String(item.line)}  ${item.from}  ->  ${item.to}`), ...report.skipped.map((item) => `skipped ${item.file}:${String(item.line)}  ${item.call}: ${item.detail}`)];
 	const files = new Set(report.rewrites.map((item) => item.file)).size;
@@ -346,6 +354,7 @@ async function runRlsMigrate(input) {
 	const files = sqlFiles(root, ["."]);
 	const rewrites = [];
 	const skipped = [];
+	const statements = [];
 	for (const path of files) {
 		const file = relative(input.cwd, path);
 		const text = readFileSync(path, "utf8");
@@ -353,14 +362,65 @@ async function runRlsMigrate(input) {
 		rewrites.push(...result.rewrites);
 		skipped.push(...result.skipped);
 		if (input.write && result.text !== text) writeFileSync(path, result.text);
+		for (const statement of sqlStatements(input.write ? result.text : text)) statements.push({
+			file,
+			...statement
+		});
 	}
-	const report = {
+	if (input.retireOut !== void 0 && input.config.tables === void 0) return {
+		code: 2,
+		output: "rls migrate --retire-out needs rls.migrate.tables in permdock.config.ts"
+	};
+	const retire = input.config.tables === void 0 ? void 0 : retirePlan(statements, input.config);
+	const report = retire === void 0 ? {
 		rewrites,
 		skipped
+	} : {
+		rewrites,
+		skipped,
+		retire
+	};
+	const unknown = skipped.some((item) => item.reason === "unknown-key");
+	const output = input.json ? JSON.stringify(report, void 0, 2) : [describe(report, input.write), ...retire === void 0 ? [] : describeRetire(retire)].join("\n");
+	if (input.retireOut === void 0 || retire === void 0) return {
+		code: unknown ? 1 : 0,
+		output
+	};
+	const retired = writeRetire(input.cwd, input.retireOut, retire, input.now);
+	return {
+		code: unknown || retired.code === 1 ? 1 : 0,
+		output: `${output}\n${retired.output}`
+	};
+}
+/** `--retire-out`: nothing is written while any listed table is still read. */
+function writeRetire(cwd, out, plan, now) {
+	const read = plan.tables.filter((table) => table.present && table.readers.length > 0);
+	if (read.length > 0) return {
+		code: 1,
+		output: `rls migrate --retire-out: ${read.map((table) => table.table).join(", ")} still read; nothing written`
+	};
+	const text = retireSql(plan);
+	if (text === void 0) return {
+		code: 0,
+		output: "rls migrate --retire-out: nothing to retire"
+	};
+	const file = dataMigrationFile({
+		cwd,
+		out,
+		part: "retire",
+		marker: RETIRE_MARKER,
+		text,
+		now: now ?? /* @__PURE__ */ new Date(),
+		check: false
+	});
+	if (file === void 0) return {
+		code: 0,
+		output: "rls migrate --retire-out: up to date"
 	};
+	const written = writeOutputFiles(cwd, [file]);
 	return {
-		code: skipped.some((item) => item.reason === "unknown-key") ? 1 : 0,
-		output: input.json ? JSON.stringify(report, void 0, 2) : describe(report, input.write)
+		code: 0,
+		output: written.printed === "" ? `wrote ${written.wrote.join(", ")}` : written.printed
 	};
 }
 //#endregion

package/dist/nest/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
+import { E as Policy, Or as Principal, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { A as ConnectionOptions, C as verifyWebBotAuth, O as Connection, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { i as sendResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts

package/dist/nest/index.js

@@ -1,11 +1,12 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { a as socketConnection, r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
-import { i as toRequest$1, n as isServerResponse, r as sendResponse } from "../http-BIhmLfCc.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
+import { c as writeReply, r as hasCredentials } from "../http-BBoKefeS.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { a as socketConnection, r as bindKernel } from "../bind-kk-uyCwH.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-BMui98KK.js";
+import { i as toRequest$1, n as isServerResponse, r as sendResponse } from "../http-BEbdMZ05.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";
 import { APP_FILTER, APP_GUARD, Reflector } from "@nestjs/core";
 //#region src/nest/decorate.ts
@@ -47,9 +48,7 @@ async function sendNestResponse(res, response) {
 		return;
 	}
 	if (isFastifyReply(res)) {
-		res.code(response.status);
-		for (const [key, value] of response.headers.entries()) res.header(key, value);
-		await res.send(await response.text());
+		await writeReply(res, response);
 		return;
 	}
 	throw new TypeError("permdock/nest supports @nestjs/platform-express and @nestjs/platform-fastify responses");
@@ -174,7 +173,7 @@ function createPermDock(policy, options) {
 	class PermDockExceptionFilter {
 		send = sendNestResponse;
 		async catch(exception, host) {
-			const problem = exception instanceof PermDockHttpError ? exception.response : problemFromError(exception, { credentials: host.getType() === "http" && host.switchToHttp().getRequest().headers.authorization !== void 0 });
+			const problem = exception instanceof PermDockHttpError ? exception.response : problemFromError(exception, { credentials: host.getType() === "http" && hasCredentials(host.switchToHttp().getRequest()) });
 			if (problem === void 0) throw new TypeError("unhandled permdock exception");
 			if (host.getType() === "http") {
 				await this.send(host.switchToHttp().getResponse(), problem);

package/dist/next/index.d.ts

@@ -1,9 +1,11 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Tt as Snapshot, Yn as Decision, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { o as OtelWrap } from "../types-QCuYJh4q.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-B-LxUahj.js";
+import { E as Policy, Or as Principal, an as Snapshot, ir as Decision, j as PolicyVocabulary, jt as PermDock, sr as DenialReason } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { n as PermDockWrap } from "../wrap-Cr93qqdP.js";
+import { o as OtelWrap } from "../types-CUcFZfpU.js";
+import { n as DescribeMessages } from "../describe-C3ldA9os.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-J5T7t_vD.js";
 import { ReactElement, ReactNode } from "react";
 //#region src/next/types.d.ts
 type NextSubjectInput = unknown;
@@ -14,6 +16,8 @@ type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
   readonly store?: ApprovalStore;
   /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
   readonly otel?: OtelWrap;
+  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
   /**
    * Where `PermDockProvider` sends checks the snapshot cannot answer; default `/api/permdock`.
    * `false` is snapshot-only: no `permdockHandler` route, and those checks are denied with
@@ -38,6 +42,11 @@ type RequireAccessInput = {
   readonly data?: unknown;
   /** The active tenant, as for `getPermDock({ tenant })`; defaults to the factory's `tenant`. */
   readonly tenant?: string;
+  /**
+   * Runs before the default interrupts; throw or redirect to replace them.
+   * Defaults to the factory's `onDenied`.
+   */
+  readonly onDenied?: (decision: Decision) => never | void;
 };
 type ServerPermissionState = {
   readonly allowed: boolean;
@@ -55,6 +64,19 @@ type ServerPermDockProviderProps = {
   readonly endpoint?: string | false;
   /** Suspends permission readers until the snapshot streams in, instead of answering `pending`. */
   readonly suspend?: boolean;
+  /**
+   * What every `<Protected>` below renders for a slot it leaves out. Nodes
+   * only: a function cannot cross from a Server Component to the client.
+   */
+  readonly defaults?: {
+    readonly pending?: ReactNode;
+    readonly fallback?: ReactNode;
+    readonly approval?: ReactNode;
+  };
+  /** Localised text for `useDescribe()`; records only, for the same reason. */
+  readonly messages?: Pick<DescribeMessages, "titles" | "separator"> & {
+    readonly reasons?: Partial<Record<DenialReason, string>>;
+  };
 };
 type PermDockHandler = {
   readonly POST: (request: Request) => Promise<Response>;
@@ -75,8 +97,9 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
    */
   readonly getSnapshot: (query?: GetSnapshotQuery) => Promise<Snapshot>;
   /**
-   * Resolves to the granted `Decision`. A denial calls `unauthorized()` for an
-   * anonymous subject and `forbidden()` otherwise (`experimental.authInterrupts`);
+   * Resolves to the granted `Decision`. A denial first runs `onDenied` (the
+   * call's, else the factory's), then calls `unauthorized()` for an anonymous
+   * subject and `forbidden()` otherwise (`experimental.authInterrupts`);
    * approval-required and boundary validation throw as from `assert`.
    */
   readonly requireAccess: (input: RequireAccessInput) => Promise<Extract<Decision, {

package/dist/next/index.js

@@ -1,8 +1,8 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
-import { c as NO_GRANT, n as createEvaluationsHandler } from "../evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { n as wrapPermDock } from "../wrap-DWsU_5Bd.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Cod40D-X.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-DIIV9DbC.js";
+import { n as createEvaluationsHandler, u as NO_GRANT } from "../evaluations-C9YJsv3H.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
 import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
@@ -16,7 +16,9 @@ function renderClientProvider(options) {
 			snapshotPromise: options.snapshotPromise,
 			endpoint: options.endpoint,
 			tenant: options.tenant,
-			suspend: options.suspend
+			suspend: options.suspend,
+			defaults: options.defaults,
+			messages: options.messages
 		}),
 		children: options.children
 	});
@@ -65,44 +67,34 @@ function afterResponse(sink) {
 }
 function wrapInstance(permdock, onDenied) {
 	if (onDenied === void 0) return permdock;
-	const wrap = (next) => wrapInstance(next, onDenied);
-	const assert = ((permission, data, options) => permdock.assert(permission, data, compact({
+	return wrapPermDock(permdock, (inner) => ({ assert: ((permission, data, options) => inner.assert(permission, data, compact({
 		...options,
 		onDenied: options?.onDenied ?? onDenied
-	})));
-	return Object.freeze({
-		...permdock,
-		assert,
-		tenant: (id) => wrap(permdock.tenant(id)),
-		team: (id) => wrap(permdock.team(id)),
-		derive: (options) => {
-			const derived = permdock.derive(options);
-			return derived instanceof Promise ? derived.then(wrap) : wrap(derived);
-		}
-	});
+	}))) }));
 }
 function createPermDock(policy, options) {
 	assertServerOnly();
 	const sink = options.sink === void 0 ? void 0 : afterResponse(options.sink);
-	const resolveSubject = cache(async () => {
-		try {
-			return await options.subject();
-		} catch (error) {
-			unstable_rethrow(error);
-			return null;
-		}
-	});
+	const resolveSubject = cache(() => resolveOrNull(() => options.subject(), unstable_rethrow));
+	const decorate = (permdock) => {
+		const traced = options.otel === void 0 ? permdock : options.otel(permdock);
+		return wrapInstance(options.wrap === void 0 ? traced : options.wrap(traced), options.onDenied);
+	};
 	const resolveFallbackTenant = cache(() => readTenant(options.tenant));
 	const instantiate = cache(async (tenantKey) => {
 		const tenant = tenantKey === "" ? void 0 : tenantKey;
 		const user = await resolveSubject();
 		await io();
-		const built = await createPermDock$1(policy, user, compact({
-			tenant,
-			...instanceOptions(options),
-			sink
-		}));
-		return wrapInstance(options.otel === void 0 ? built : options.otel(built), options.onDenied);
+		return (await buildInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				tenant,
+				sink
+			},
+			wrap: decorate
+		})).permdock;
 	});
 	const getPermDock = async (query) => {
 		const tenant = query?.tenant ?? await resolveFallbackTenant();
@@ -143,7 +135,9 @@ function createPermDock(policy, options) {
 	const requireAccess = async (input) => {
 		const permdock = await getPermDock(input.tenant === void 0 ? void 0 : { tenant: input.tenant });
 		const assert = permdock.assert;
+		const handler = input.onDenied ?? options.onDenied;
 		return assert(input.permission, input.data, { onDenied: (decision) => {
+			handler?.(decision);
 			if (decision.outcome !== "denied" || decision.denials.some((denial) => denial.reason === "validation")) return;
 			if (permdock.subject.principal === null) unauthorized();
 			forbidden();
@@ -159,6 +153,8 @@ function createPermDock(policy, options) {
 			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock",
 			tenant: props.tenant,
 			suspend: props.suspend,
+			defaults: props.defaults,
+			messages: props.messages,
 			children: props.children
 		}));
 	};

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
+import { a as PermDockPluginOptions } from "../types-7rJVLWe5.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { i as describeError } from "../errors-CWfoNg9N.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DVBJ9cBq.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-zeucB7eF.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { C as verifyWebBotAuth, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions, s as ScopeGuard, t as Guard } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { a as toRequest, i as sendResponse, n as fromResponse, r as isServerResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,6 +1,6 @@
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-BIhmLfCc.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { r as bindKernel } from "../bind-kk-uyCwH.js";
+import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-BEbdMZ05.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;
 function createPermDock(policy, options) {
@@ -9,7 +9,7 @@ function createPermDock(policy, options) {
 	const bind = (req) => bound.bind(nodeRequest(req));
 	const scopeOf = (req) => bound.scopeOf(nodeRequest(req));
 	const permdock = async (req) => kernel.permdock(bind(req), await scopeOf(req));
-	const protect = ((permission, loadData, protectOptions) => async (req) => kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(nodeRequest(req)), protectOptions)(bind(req), await scopeOf(req)));
+	const protect = ((permission, loadData, protectOptions) => (req) => bound.guard(permission, loadData, nodeRequest(req), protectOptions));
 	const permdockHandler = () => {
 		const { POST, GET } = kernel.permdockHandler(handlerScope);
 		return async (req, res) => {

package/dist/ocsf-uYFXGVw2.js

@@ -0,0 +1,115 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+//#region src/core/ocsf.ts
+/** The OCSF schema version `toOcsf` emits. */
+const OCSF_VERSION = "1.3.0";
+function status(outcome) {
+	switch (outcome) {
+		case "granted": return {
+			status_id: 1,
+			status: "Success"
+		};
+		case "denied": return {
+			status_id: 2,
+			status: "Failure"
+		};
+		case "approval-required": return {
+			status_id: 99,
+			status: "Other"
+		};
+		default: return unknownStatus(outcome);
+	}
+}
+/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
+function unknownStatus(_outcome) {
+	return {
+		status_id: 0,
+		status: "Unknown"
+	};
+}
+/** The names of a decision event's app obligations, or `undefined` when it has none. */
+function appObligationNames(event) {
+	const names = (event.obligations ?? []).flatMap((obligation) => obligation.kind === "app" ? [obligation.name] : []);
+	return names.length === 0 ? void 0 : names;
+}
+/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
+function toOcsf(event) {
+	const principal = event.subject.principal;
+	const actor = event.subject.actor;
+	const breakGlass = event.matched?.breakGlass === true;
+	const detail = event.outcome === "approval-required" ? "approval-required" : event.denials?.map((denial) => denial.reason).join(",");
+	const time = Date.parse(event.at);
+	return compact({
+		class_uid: 3003,
+		category_uid: 3,
+		activity_id: 1,
+		type_uid: 300301,
+		severity_id: breakGlass ? 4 : 1,
+		time: Number.isNaN(time) ? 0 : time,
+		...status(event.outcome),
+		status_detail: detail === "" ? void 0 : detail,
+		message: `${event.permission} ${event.outcome}`,
+		privileges: [event.permission],
+		user: principal === null ? { name: "anonymous" } : { uid: principal.id },
+		actor: actor === void 0 ? void 0 : compact({
+			user: principal === null ? void 0 : { uid: principal.id },
+			app_name: actor.id
+		}),
+		metadata: compact({
+			version: OCSF_VERSION,
+			product: compact({
+				name: "PermDock",
+				vendor_name: "PermDock",
+				feature: event.adapter === void 0 ? void 0 : { name: event.adapter }
+			}),
+			tenant_uid: event.tenant,
+			correlation_uid: event.token
+		}),
+		unmapped: compact({
+			outcome: event.outcome,
+			scope: event.scope,
+			resource: event.resource,
+			source: event.source,
+			phase: event.phase,
+			role: event.matched?.role,
+			grant: event.matched?.name,
+			obligations: appObligationNames(event),
+			via: event.via,
+			breakGlass: breakGlass ? true : void 0,
+			purpose: event.purpose,
+			reason: event.reason
+		})
+	});
+}
+function accessToOcsf(event) {
+	const time = Date.parse(event.at);
+	const enable = event.operation === "started";
+	return compact({
+		class_uid: 3001,
+		category_uid: 3,
+		activity_id: enable ? 2 : 5,
+		type_uid: enable ? 300102 : 300105,
+		severity_id: 4,
+		time: Number.isNaN(time) ? 0 : time,
+		message: `support access ${event.operation}`,
+		user: { uid: event.principal.id },
+		actor: event.actor === void 0 ? void 0 : { user: { uid: event.actor.id } },
+		metadata: {
+			version: OCSF_VERSION,
+			product: {
+				name: "PermDock",
+				vendor_name: "PermDock"
+			},
+			tenant_uid: event.tenant
+		},
+		unmapped: compact({
+			operation: event.operation,
+			via: event.via,
+			roles: event.roles,
+			member: event.member,
+			grantedBy: event.grantedBy,
+			reason: event.reason
+		})
+	});
+}
+//#endregion
+export { toOcsf as i, accessToOcsf as n, appObligationNames as r, OCSF_VERSION as t };

package/dist/openai/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, wr as Delegation } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { t as ToolMap } from "../types-DvupZE0w.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */
 type OpenAiContext = {

package/dist/openai/index.js

@@ -1,7 +1,7 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { r as memoryApprovalStore } from "../store-ILkLUj_o.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-CB3LrIJM.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { a as ProblemDetails } from "../errors-DPdqI50v.js";
+import { E as Policy, Or as Principal, jr as Condition } from "../policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { a as ProblemDetails } from "../errors-OD_4c__H.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/openapi/index.js

@@ -1,3 +1,3 @@
 import { n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "../pins-8ILTftC9.js";
-import { a as operationPermissionsFromOpenApi, c as openapiVersion, i as operationPermissions, l as securitySchemesOf, n as securityFor, o as createPermDock, r as problemDetails, s as catalogOf, t as permissionsExtension } from "../openapi-BqRBvAng.js";
+import { a as operationPermissionsFromOpenApi, c as openapiVersion, i as operationPermissions, l as securitySchemesOf, n as securityFor, o as createPermDock, r as problemDetails, s as catalogOf, t as permissionsExtension } from "../openapi-DBzHQbov.js";
 export { DRAFT_PINS, GNAP_RESERVED, PROFILE_NAMES, catalogOf, createPermDock, openapiVersion, operationPermissions, operationPermissionsFromOpenApi, permissionsExtension, problemDetails, securityFor, securitySchemesOf };