permdock 0.3.1 → 0.4.0

package/dist/{rpc-DL9Sqvb1.js → rpc-nYC3cR_u.js}

@@ -1,8 +1,8 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { o as requestFromContext } from "./http-SO7qGttf.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { s as requestFromContext } from "./http-BBoKefeS.js";
 import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { t as adapterKernel } from "./bind-CuzGytRf.js";
-import { n as guardIterable } from "./stream-DDpvynSB.js";
+import { t as adapterKernel } from "./bind-kk-uyCwH.js";
+import { n as guardIterable } from "./stream-BMui98KK.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */
 function rpcCode(status) {
@@ -58,6 +58,15 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 		const opts = optsByRequest.get(request);
 		return opts === void 0 ? { tenant: void 0 } : scopeOf(opts);
 	});
+	const guard = async (permission, loadData, opts, protectOptions) => {
+		const request = bind(opts);
+		const scope = await scopeOf(opts);
+		return {
+			request,
+			scope,
+			guard: await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope)
+		};
+	};
 	const evaluate = (request, opts) => {
 		bind(opts);
 		return request.method === "GET" ? evaluations.GET(request) : evaluations.POST(request);
@@ -70,7 +79,8 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 		},
 		scopeOf,
 		connection,
-		evaluate
+		evaluate,
+		guard
 	};
 }
 /** Wraps a streamed result so revocation ends it and items the subscriber cannot read drop. */

package/dist/{run-BWc9qqvE.js → run-DMcNW_8T.js}

@@ -1,7 +1,7 @@
 import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
-import { o as cliVersion } from "./version-BvacVTZR.js";
-import { a as resolveCwd, i as readConfig } from "./config-BJiM-xAm.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { o as cliVersion } from "./version-BEogC-rB.js";
+import { a as resolveCwd, i as readConfig } from "./config-BIjREpyE.js";
+import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { stripVTControlCharacters } from "node:util";
 import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
 //#region src/cli/run.ts

package/dist/{runtime-CB8gQFvS.js → runtime-D_tMXnsq.js}

@@ -1,4 +1,4 @@
-import { a as protectedView, s as scopedTenant } from "./views-Soe7bGSC.js";
+import { c as scopedTenant, o as protectedView } from "./views-CJsrBS1f.js";
 //#region src/svelte/protected.ts
 /** The instance for `tenant`, built once per store change rather than once per check. */
 function scopedFor(store, tenant, _generation) {

package/dist/{saas-DhpJjnBA.js → saas-DtaA4JuW.js}

@@ -1,10 +1,11 @@
-import { r as principal } from "./refs-KYb4ntaz.js";
-import { _ as memoryLimitStore, a as definePolicy, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
-import { _ as memoryRoleSource } from "./src-BDwEZWrZ.js";
-import { n as anyone, p as relation } from "./grantee-Cv5Sogfv.js";
-import { t as memoryRelations } from "./relations-cjOL01hZ.js";
-import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-RJrovw98.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { r as principal } from "./refs-f3imMjNW.js";
+import { a as deny, n as role, r as allow, u as memoryLimitStore } from "./role-builder-B4GbKM-i.js";
+import { f as memoryRelations, g as memoryRoleSource } from "./src-Bb7no-hS.js";
+import { l as relation, n as anyone } from "./grantee-CXY-0C87.js";
+import { o as definePolicy } from "./hosted-CBHgkzDl.js";
+import { o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CCJ6lmxB.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -632,7 +633,7 @@ function decodeSegment(segment) {
 function parseSegment(segment) {
 	try {
 		const parsed = JSON.parse(new TextDecoder().decode(decodeSegment(segment)));
-		return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+		return isRecord(parsed) ? parsed : null;
 	} catch {
 		return null;
 	}

package/dist/{openapi-schema--ARjyfQr.js → schema-Bol6gqXA.js}

@@ -1,4 +1,5 @@
-import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as packageRoot } from "./package-root-DtNnpmUd.js";
 import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -6677,7 +6678,7 @@ var require_json_schema_2020_12 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.default = addMetaSchema2020;
 }));
 //#endregion
-//#region src/cli/openapi-schema.ts
+//#region src/cli/openapi/schema.ts
 var import__2020 = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.MissingRefError = exports.ValidationError = exports.CodeGen = exports.Name = exports.nil = exports.stringify = exports.str = exports._ = exports.KeywordCxt = exports.Ajv2020 = void 0;
@@ -6778,9 +6779,6 @@ var import__2020 = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 function schemaDir() {
 	return join(packageRoot(), "schemas", "openapi");
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 const validators = /* @__PURE__ */ new Map();
 /** Parses a bundled schema file; throws on anything but a JSON object. */
 function parseSchema(text, file) {

package/dist/{schema-D3MnDMxa.js → schema-DjQBcAP9.js}

@@ -86,7 +86,8 @@ const catalogSchema = freezeDeep({
 					relations: { type: "object" },
 					version: { type: "string" },
 					restricted: { type: "string" },
-					restrictedStops: strings
+					restrictedStops: strings,
+					meta: { type: "object" }
 				}
 			}
 		},
@@ -265,7 +266,8 @@ const catalogSchema = freezeDeep({
 							mode: { enum: ["hard", "soft"] }
 						}
 					},
-					portable: { const: false }
+					portable: { const: false },
+					meta: { type: "object" }
 				}
 			}
 		},

package/dist/scim/index.d.ts

@@ -1,2 +1,2 @@
-import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-C8z4RjQV.js";
+import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-BwMe94Xq.js";
 export { type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,2 +1,2 @@
-import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-BFGBBAqR.js";
+import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-vFR1O5oG.js";
 export { DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/{scim-BFGBBAqR.js → scim-vFR1O5oG.js}

@@ -1,7 +1,7 @@
-import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
+import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as sha256 } from "./sha256-BO0swRXL.js";
-import { a as memorySink, i as membershipEvent } from "./sink-Bd9PSyfq.js";
+import { a as memorySink, i as membershipEvent } from "./sink-BTtmfPnE.js";
 //#region src/scim/auth.ts
 function hexToBytes(hex) {
 	if (hex.length % 2 !== 0) return;
@@ -445,9 +445,6 @@ function filterSupported(filter) {
 }
 //#endregion
 //#region src/scim/body.ts
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 async function readJson(request) {
 	const text = await request.text();
 	if (text === "") return;
@@ -460,13 +457,13 @@ function schemasOk(body, required) {
 }
 function readRoles(body) {
 	const extension = body[ROLES_EXTENSION];
-	if (!isRecord$1(extension) || !Array.isArray(extension["roles"])) return;
+	if (!isRecord(extension) || !Array.isArray(extension["roles"])) return;
 	return extension["roles"].filter((item) => typeof item === "string");
 }
 function userFromBody(body, id) {
 	if (typeof body["userName"] !== "string" || body["userName"] === "") return;
 	const emails = Array.isArray(body["emails"]) ? body["emails"].flatMap((item) => {
-		if (!isRecord$1(item) || typeof item["value"] !== "string") return [];
+		if (!isRecord(item) || typeof item["value"] !== "string") return [];
 		return [compact({
 			value: item["value"],
 			primary: typeof item["primary"] === "boolean" ? item["primary"] : void 0,
@@ -489,7 +486,7 @@ function userFromBody(body, id) {
 function groupFromBody(body, id, fallbackRoles) {
 	if (typeof body["displayName"] !== "string" || body["displayName"] === "") return;
 	const members = Array.isArray(body["members"]) ? body["members"].flatMap((item) => {
-		if (!isRecord$1(item) || typeof item["value"] !== "string") return [];
+		if (!isRecord(item) || typeof item["value"] !== "string") return [];
 		return [{ value: item["value"] }];
 	}) : [];
 	return compact({
@@ -620,9 +617,6 @@ function groupRolesFor(groupRoles, id) {
 //#endregion
 //#region src/scim/patch.ts
 const FILTER_PATH = /^(?<attribute>[A-Za-z0-9._]+)\[(?<field>[A-Za-z0-9._]+)\s+eq\s+"(?<value>[^"]+)"\](?<rest>\.[A-Za-z0-9._]+)?$/u;
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function coerceActive(value) {
 	if (typeof value === "boolean") return value;
 	if (typeof value === "string") {
@@ -963,7 +957,7 @@ function scimHandler(options) {
 				return new Response(null, { status: 204 });
 			}
 			const body = await readJson(request);
-			if (!isRecord$1(body)) return scimError(400, "invalidSyntax", "malformed body");
+			if (!isRecord(body)) return scimError(400, "invalidSyntax", "malformed body");
 			if (request.method === "POST" && route.id === void 0) {
 				if (route.kind === "Users") {
 					if (!schemasOk(body, "urn:ietf:params:scim:schemas:core:2.0:User")) return scimError(400, "invalidSyntax", "unsupported schema");

package/dist/{scopes-CVdPrWN-.js → scopes-tvpa34ep.js}

@@ -1,5 +1,8 @@
-import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
 import { t as idText } from "./ids-DC4V4CFu.js";
+import { i as readAppData } from "./app-data-CV8pqqMi.js";
 //#region src/core/scopes.ts
 const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
 const NAME = /^[a-z][a-z0-9_]*$/u;
@@ -114,13 +117,18 @@ function normalizeMembership(input, scopes) {
 	const roles = roleList(raw["roles"]);
 	if (roles === void 0) return;
 	const extra = {};
+	if (raw["x"] !== void 0) {
+		const x = readAppData(void 0, raw["x"]);
+		if (x !== void 0) extra.x = freezeCopy(x);
+	}
 	if (typeof raw["via"] === "string") extra.via = raw["via"];
 	if (typeof raw["expiresAt"] === "number") extra.expiresAt = raw["expiresAt"];
 	if (typeof raw["grantedBy"] === "string" && raw["grantedBy"] !== "") extra.grantedBy = raw["grantedBy"];
 	if (typeof raw["reason"] === "string" && raw["reason"] !== "") extra.reason = raw["reason"];
 	const eligible = roleList(raw["eligible"]);
 	if (eligible !== void 0 && eligible.length > 0) extra.eligible = Object.freeze([...eligible]);
-	const member = raw["member"] !== null && typeof raw["member"] === "object" && !Array.isArray(raw["member"]) ? raw["member"]["group"] : void 0;
+	const rawMember = raw["member"];
+	const member = isRecord(rawMember) ? rawMember["group"] : void 0;
 	if (typeof member === "string" && member !== "") extra.member = Object.freeze({ group: member });
 	if (raw["managedBy"] === "idp") extra.managedBy = "idp";
 	if (Array.isArray(raw["entitlements"])) {

package/dist/server/index.d.ts

@@ -1,11 +1,21 @@
-import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Ba264OaJ.js";
-import { t as Disclosure } from "../problem-details-DX075l9V.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DPdqI50v.js";
+import { E as Policy, H as CredentialVerifier, Or as Principal, W as DecisionSink, ir as Decision, it as SettingsSource, j as PolicyVocabulary, kr as Subject, mt as Credential, ot as SubjectResolver, xt as CredentialPrincipal, yn as AuthEvent } from "../policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-BSSw0l_8.js";
+import { t as Disclosure } from "../problem-details-rIIo8B2C.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-OD_4c__H.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-B1d519XK.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-B-LxUahj.js";
+import { A as ConnectionOptions, C as verifyWebBotAuth, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureResponse, T as TenantOption, _ as WebBotAuthKeys, a as OperationScopes, b as discoverViaSignatureAgent, c as ServerKernel, d as ServerPermDockOptions, f as SnapshotQuery, g as WebBotAuthKeyLookup, h as WebBotAuthJwk, i as OpenApiHooks, k as ConnectionData, l as ServerKernelOptions, m as InvalidSignatureError, n as OnDenied, o as ProtectOptions, p as DiscoverViaSignatureAgentOptions, r as OnDeniedEvent, s as ScopeGuard, t as Guard, u as ServerPermDock, v as WebBotAuthOptions, w as createEvaluationsHandler, x as invalidSignatureProblem, y as WebBotAuthVerifier } from "../server-types-DdqBwZN_.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-J5T7t_vD.js";
+//#region src/server/create.d.ts
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerPermDockOptions<TUser>): ServerPermDock<V>;
+/**
+ * The kernel behind every HTTP adapter. The subject and actor are resolved
+ * once per `Request`; one instance is cached per `(Request, tenant)`, so a
+ * global middleware and a later tenant-scoped `protect` never share a tenant.
+ */
+export declare function createServerKernel<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerKernelOptions<TUser, V>): ServerKernel<V>;
+//#endregion
 //#region src/server/credentials.d.ts
 /** `on('auth')` causes for an API key that resolves to the anonymous subject. */
 type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";
@@ -131,4 +141,4 @@ export declare function problemFromDecision(decision: Decision, permission: Perm
   readonly scope?: string;
 }): Response;
 //#endregion
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ScopeGuard, type ServerKernel, type ServerKernelOptions, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type TenantOption, type TenantScope, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, snapshotHeaders, snapshotTag, tenantScope, verifyWebBotAuth };
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OnDenied, type OnDeniedEvent, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type RequestContext, type RevocationEvent, type RevocationFeed, type ScopeGuard, type ServerKernel, type ServerKernelOptions, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type TenantOption, type TenantScope, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, cacheLifeFor, createEvaluationsHandler, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, snapshotHeaders, snapshotTag, tenantScope, verifyWebBotAuth };

package/dist/server/index.js

@@ -1,11 +1,11 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { d as wwwAuthenticate, o as problemFromDecision, s as problemResponse, u as validationProblem } from "../problem-B43ztKIm.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
-import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CnWraVhC.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Cod40D-X.js";
+import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
 import { n as tenantScope } from "../adapter-context-mlWsVGGg.js";
-import { n as createServerKernel, t as createPermDock } from "../create-CMwIl-w2.js";
-import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-DlZ28Oz5.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { n as createServerKernel, t as createPermDock } from "../create-BBO24vj6.js";
+import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-ZYEHtNHS.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, snapshotHeaders, snapshotTag, subjectFromApiKey, tenantScope, validationProblem, verifyWebBotAuth, wwwAuthenticate };

package/dist/{server-DlZ28Oz5.js → server-ZYEHtNHS.js}

@@ -1,9 +1,9 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as isThenable } from "./thenable-QSmvt-vZ.js";
 import { t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { n as isThenable } from "./thenable-okc2xDsj.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { r as credentialEvent } from "./sink-Bd9PSyfq.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-8P81ff4u.js";
+import { r as credentialEvent } from "./sink-BTtmfPnE.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-kue0qpbm.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;

package/dist/{create-B1d519XK.d.ts → server-types-DdqBwZN_.d.ts}

@@ -1,9 +1,11 @@
-import { C as Policy, Cr as Actor, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Tt as Snapshot, Yn as Decision, jr as JsonWebKeyLike, ln as PermDock, pn as SnapshotOptions } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "./types-aqOHTHcp.js";
-import { t as ApprovalHint } from "./errors-DPdqI50v.js";
-import { t as InstanceOptions } from "./instance-options-jARdwfPN.js";
-import { r as PdpFactory } from "./types-DxiCGmmd.js";
+import { E as Policy, Er as JsonWebKeyLike, Ft as SnapshotOptions, an as Snapshot, ir as Decision, j as PolicyVocabulary, jt as PermDock, kr as Subject, vr as Actor } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "./types-Br9IXUBG.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-OD_4c__H.js";
+import { t as InstanceOptions } from "./instance-options-plkrsAog.js";
+import { t as RequestContext } from "./request-context-C2_1lchh.js";
+import { n as PermDockWrap } from "./wrap-Cr93qqdP.js";
+import { r as PdpFactory } from "./types-CIlTojhq.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
@@ -28,6 +30,11 @@ type Connection = {
     readonly trusted?: boolean;
   }) => Decision;
   readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
+  /**
+   * Resolves once every revalidation queued so far has finished, so a message
+   * checked after a revocation event is checked against the rebuilt instance.
+   */
+  readonly settled: () => Promise<void>;
   /** Stops timers and the feed subscription. Call it when the transport closes. */
   readonly close: () => void;
 };
@@ -44,6 +51,22 @@ type TenantOption<TContext> = string | ((context: TContext) => string | undefine
 /** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
 declare function tenantScope<TContext>(option: TenantOption<TContext> | undefined, context: TContext): Promise<TenantScope>;
 //#endregion
+//#region src/server/evaluations.d.ts
+declare function createEvaluationsHandler(options: {
+  readonly policy: Policy;
+  readonly resolve?: (request: Request) => Promise<PermDock>;
+  readonly getPermDock?: (query?: {
+    readonly tenant?: string;
+  }) => Promise<PermDock>;
+  readonly store?: ApprovalStore;
+  readonly adapter?: string;
+  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
+  readonly maxEvaluations?: number;
+}): {
+  readonly POST: (request: Request) => Promise<Response>;
+  readonly GET: (request: Request) => Promise<Response>;
+};
+//#endregion
 //#region src/server/web-bot-auth.d.ts
 type WebBotAuthJwk = JsonWebKeyLike & {
   readonly kid?: string;
@@ -84,23 +107,7 @@ declare function invalidSignatureProblem(detail: string): Response;
 declare function discoverViaSignatureAgent(options: DiscoverViaSignatureAgentOptions): WebBotAuthKeys;
 declare function verifyWebBotAuth(request: Request, options: WebBotAuthOptions | undefined): Promise<Actor | undefined>;
 //#endregion
-//#region src/server/evaluations.d.ts
-declare function createEvaluationsHandler(options: {
-  readonly policy: Policy;
-  readonly resolve?: (request: Request) => Promise<PermDock>;
-  readonly getPermDock?: (query?: {
-    readonly tenant?: string;
-  }) => Promise<PermDock>;
-  readonly store?: ApprovalStore;
-  readonly adapter?: string;
-  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
-  readonly maxEvaluations?: number;
-}): {
-  readonly POST: (request: Request) => Promise<Response>;
-  readonly GET: (request: Request) => Promise<Response>;
-};
-//#endregion
-//#region src/server/create.d.ts
+//#region src/server/server-types.d.ts
 type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
   readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
@@ -120,7 +127,31 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   /** Added as `approval` to every `approval-required` problem. */
   readonly approval?: ApprovalHint;
   readonly operations?: OperationScopes;
+  /**
+   * Replaces the response of a refused guard. A status below 300, or a
+   * throw, keeps the default response and reports through `on('error')`.
+   */
+  readonly onDenied?: OnDenied;
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input. A throw
+   * or a value that is not a JSON object adds nothing and reports through
+   * `on('error')`.
+   */
+  readonly context?: (request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
+  /** Wraps each instance the kernel builds; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+};
+/** What `onDenied` receives: the refusal and the default Problem Details for it. */
+type OnDeniedEvent = {
+  readonly decision: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
+  readonly problem: ProblemDetails;
+  readonly request: Request | undefined;
 };
+/** Returns Problem Details with extra members, a `Response`, or nothing for the default. */
+type OnDenied = (event: OnDeniedEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
 type OperationScopes = {
   oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
 };
@@ -134,6 +165,10 @@ type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
+  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
 };
 /**
  * What `protect(null, …)` resolves to: the route declares OAuth scopes and no
@@ -147,6 +182,10 @@ type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
+  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
 };
 type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
 /**
@@ -179,9 +218,13 @@ type ProtectOptions = {
    * for the request. Required, here or there, for `protect(null)`.
    */
   readonly oauthScopes?: readonly string[];
+  /** The field being read or written; only grants whose `fields` cover it match. */
+  readonly field?: string;
+  /** Adds the evaluation `trace` to the guard's decision. */
+  readonly explain?: boolean;
 };
-type ServerKernelOptions<TUser, V extends PolicyVocabulary = PolicyVocabulary> = ServerPermDockOptions<TUser> & {
-  /** Wraps each instance the kernel builds, as `withOtel` does. */
+type ServerKernelOptions<TUser, V extends PolicyVocabulary = PolicyVocabulary> = Omit<ServerPermDockOptions<TUser>, "wrap"> & {
+  /** Wraps each instance the kernel builds: `otel`, then the adapter's `wrap`. */
   readonly wrap?: (permdock: PermDock<V>) => PermDock<V>;
   /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
   readonly adapter?: string;
@@ -234,12 +277,5 @@ type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly openapi: OpenApiHooks;
   readonly permdockHandler: () => ReturnType<typeof createEvaluationsHandler>;
 };
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerPermDockOptions<TUser>): ServerPermDock<V>;
-/**
- * The kernel behind every HTTP adapter. The subject and actor are resolved
- * once per `Request`; one instance is cached per `(Request, tenant)`, so a
- * global middleware and a later tenant-scoped `protect` never share a tenant.
- */
-declare function createServerKernel<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerKernelOptions<TUser, V>): ServerKernel<V>;
 //#endregion
-export { ConnectionOptions as A, invalidSignatureResponse as C, tenantScope as D, TenantScope as E, Connection as O, invalidSignatureProblem as S, TenantOption as T, WebBotAuthKeyLookup as _, ScopeGuard as a, WebBotAuthVerifier as b, ServerPermDock as c, createPermDock as d, createServerKernel as f, WebBotAuthJwk as g, InvalidSignatureError as h, ProtectOptions as i, ConnectionData as k, ServerPermDockOptions as l, DiscoverViaSignatureAgentOptions as m, OpenApiHooks as n, ServerKernel as o, createEvaluationsHandler as p, OperationScopes as r, ServerKernelOptions as s, Guard as t, SnapshotQuery as u, WebBotAuthKeys as v, verifyWebBotAuth as w, discoverViaSignatureAgent as x, WebBotAuthOptions as y };
+export { ConnectionOptions as A, verifyWebBotAuth as C, tenantScope as D, TenantScope as E, Connection as O, invalidSignatureResponse as S, TenantOption as T, WebBotAuthKeys as _, OperationScopes as a, discoverViaSignatureAgent as b, ServerKernel as c, ServerPermDockOptions as d, SnapshotQuery as f, WebBotAuthKeyLookup as g, WebBotAuthJwk as h, OpenApiHooks as i, ConnectionData as k, ServerKernelOptions as l, InvalidSignatureError as m, OnDenied as n, ProtectOptions as o, DiscoverViaSignatureAgentOptions as p, OnDeniedEvent as r, ScopeGuard as s, Guard as t, ServerPermDock as u, WebBotAuthOptions as v, createEvaluationsHandler as w, invalidSignatureProblem as x, WebBotAuthVerifier as y };