permdock 0.6.0 → 0.8.0

package/dist/module-values-BJTBdo6y.js

@@ -0,0 +1,107 @@
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-ykV0Vm2n.js";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { parseSync } from "oxc-parser";
+//#region src/cli/project/module-values.ts
+/** The export each module key is read from, as `load.ts` reads it. */
+const EXPORT_OF = {
+	policy: "policy",
+	permissions: "permissions",
+	operations: "operations"
+};
+const EXTENSIONS = [
+	".ts",
+	".tsx",
+	".mts",
+	".js",
+	".mjs",
+	".jsx"
+];
+function isFile(path) {
+	return existsSync(path) && statSync(path).isFile();
+}
+/** A relative specifier resolved the way a TypeScript bundler resolves it. */
+function resolveRelative(from, specifier) {
+	const base = resolve(dirname(from), specifier);
+	return [
+		base,
+		base.replace(/\.js$/u, ".ts").replace(/\.mjs$/u, ".mts"),
+		...EXTENSIONS.map((extension) => `${base}${extension}`),
+		...EXTENSIONS.map((extension) => resolve(base, `index${extension}`))
+	].find(isFile);
+}
+function relativeImports(file) {
+	const parsed = parseSync(file, readFileSync(file, "utf8"));
+	return [...new Set(parsed.module.staticImports.map((entry) => entry.moduleRequest.value).filter((specifier) => specifier.startsWith(".")))];
+}
+function fieldOf(value, key) {
+	return Reflect.get(value, key);
+}
+function leafKeys(value) {
+	try {
+		return listPermissions(asPermissionTree(value)).map((leaf) => leaf.key).toSorted().join(",");
+	} catch {
+		return "";
+	}
+}
+/**
+* Whether `exported` is the value the config passed. A module evaluated twice
+* (once natively, once through jiti, or fresh under `--watch`) yields a second
+* object, so a policy compares by fingerprint and a tree by its leaf keys.
+*/
+function sameValue(key, value, exported) {
+	if (exported === value) return true;
+	if (exported === null || typeof exported !== "object") return false;
+	switch (key) {
+		case "policy": {
+			const fingerprint = fieldOf(value, "fingerprint");
+			return typeof fingerprint === "string" && fingerprint === fieldOf(exported, "fingerprint");
+		}
+		case "permissions": return leafKeys(value) !== "" && leafKeys(value) === leafKeys(exported);
+		case "operations": {
+			const names = Object.keys(value).toSorted().join(",");
+			return names !== "" && names === Object.keys(exported).toSorted().join(",");
+		}
+		default: return key;
+	}
+}
+/**
+* The module path, relative to `cwd`, of the module the config file imports
+* `value` from as its `policy`, `permissions` or `operations` export.
+*/
+async function traceModuleValue(input) {
+	const name = EXPORT_OF[input.key];
+	for (const specifier of relativeImports(input.file)) {
+		const abs = resolveRelative(input.file, specifier);
+		if (abs === void 0) continue;
+		const mod = await loadModule(abs, input.options).catch(() => void 0);
+		if (mod !== void 0 && sameValue(input.key, input.value, pickNamed(mod, [name]))) {
+			const path = relative(input.cwd, abs).replaceAll("\\", "/");
+			return path.startsWith(".") ? path : `./${path}`;
+		}
+	}
+	throw configError(`PermDock CLI: ${input.display}: ${input.key} is a value no relative import of the config exports as '${name}' or default; import it from its module, or set ${input.key} to the module path`);
+}
+/**
+* `config` with each `policy`, `permissions` or `operations` value replaced by
+* the path of the module the config file imports it from, so every command
+* reads one form.
+*/
+async function traceModuleValues(input) {
+	const traced = { ...input.config };
+	for (const key of Object.keys(MODULE_KEYS)) {
+		const value = input.config[key];
+		if (!isModuleKey(key) || value === null || typeof value !== "object") continue;
+		traced[key] = await traceModuleValue({
+			...input,
+			key,
+			value
+		});
+	}
+	return traced;
+}
+//#endregion
+export { traceModuleValues };

package/dist/nest/index.d.ts

@@ -1,15 +1,16 @@
-import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts
 /**
  * `@nestjs/platform-express` hands the guard an `IncomingMessage`;
- * `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is `raw`.
+ * `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is
+ * `raw`.
  */
 export declare function toRequest(req: NodeRequest): Request;
 //#endregion
@@ -30,18 +31,27 @@ type NestPermDockOptions<TUser = unknown> = ServerAdapterOptions<NestRequest, TU
 };
 /** A gateway client: Socket.IO (`emit`, `disconnect`) or `ws` (`close`). */
 type NestSocket = {
-  emit?(event: string, payload: unknown): unknown;
-  disconnect?(close?: boolean): unknown;
-  close?(code?: number, reason?: string): unknown;
+  emit?: (event: string, payload: unknown) => unknown;
+  disconnect?: (close?: boolean) => unknown;
+  close?: (code?: number, reason?: string) => unknown;
 };
-/** `Protect(null, data?, { oauthScopes })` needs a principal and one of the OAuth scopes, but no permission. */
+/**
+ * `Protect(null, data?, { oauthScopes })` needs a principal and one of the
+ * OAuth scopes, but no permission.
+ */
 type NestProtect = (permission: Permission | null, data?: (req: NestRequest) => unknown, protectOptions?: ProtectOptions) => ClassDecorator & MethodDecorator;
 type NestHandlerOptions = {
-  /** Controller path; may hold route params such as `:org`. Default `api/permdock`. */
+  /**
+   * Controller path; may hold route params such as `:org`. Default
+   * `api/permdock`.
+   */
   readonly path?: string;
 };
 type PermDockModuleOptions = {
-  /** `"global"` registers `PermDockGuard` as `APP_GUARD`, so every `Protect` rule runs without `UseGuards`. */
+  /**
+   * `"global"` registers `PermDockGuard` as `APP_GUARD`, so every `Protect`
+   * rule runs without `UseGuards`.
+   */
   readonly guard?: "global";
 };
 type NestPermDock = {

package/dist/nest/index.js

@@ -1,12 +1,12 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as writeReply, r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { a as socketConnection, r as bindKernel } from "../bind-CAvgUuKs.js";
-import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
-import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-ujKm0JXE.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { c as writeReply, r as hasCredentials } from "../http-DKLXrFGk.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { a as socketConnection, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
+import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-DH94eh6f.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";
 import { APP_FILTER, APP_GUARD, Reflector } from "@nestjs/core";
 //#region src/nest/decorate.ts
@@ -35,7 +35,8 @@ function isFastifyReply(value) {
 }
 /**
 * `@nestjs/platform-express` hands the guard an `IncomingMessage`;
-* `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is `raw`.
+* `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is
+* `raw`.
 */
 function toRequest(req) {
 	if (isReadable(req)) return toRequest$1(req);
@@ -75,7 +76,10 @@ function applyParameter(cls, key, index, decorator) {
 function hasEmit(value) {
 	return typeof value === "object" && value !== null && typeof value.emit === "function";
 }
-/** One call per loader for a request, so class and method rules naming the same loader share its row. */
+/**
+* One call per loader for a request, so class and method rules naming the same
+* loader share its row.
+*/
 function loadsFor(req) {
 	const loaded = /* @__PURE__ */ new Map();
 	return (loader) => {
@@ -130,7 +134,10 @@ function createPermDock(policy, options) {
 		});
 		return conn;
 	});
-	/** Decides each rule for a gateway message against the client's connection, as `protect` does for HTTP. */
+	/**
+	* Decides each rule for a gateway message against the client's connection, as
+	* `protect` does for HTTP.
+	*/
 	const checkMessage = async (rules, conn, req) => {
 		const request = req === void 0 ? void 0 : bind(req);
 		const load = loadsFor(req);

package/dist/next/client.d.ts

@@ -1,4 +1,4 @@
-import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
 import { ComponentType, ReactNode } from "react";
 //#region src/next/client.d.ts
 /** A fallback node, or a function of what was refused. */
@@ -6,7 +6,10 @@ export type PermissionBoundaryFallback = ReactNode | ((state: PermissionBoundary
 export type PermissionBoundaryProps = {
   /** Rendered in place of the children when one throws `PermDockDeniedError`. */
   readonly denied?: PermissionBoundaryFallback;
-  /** Rendered when a child throws `PermDockApprovalRequiredError`; defaults to `denied`. */
+  /**
+   * Rendered when a child throws `PermDockApprovalRequiredError`; defaults to
+   * `denied`.
+   */
   readonly approval?: PermissionBoundaryFallback;
 };
 /**

package/dist/next/client.js

@@ -1,5 +1,5 @@
 "use client";
-import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
 import { createContext, useContext } from "react";
 import { jsx } from "react/jsx-runtime";
 import * as nextError from "next/error.js";

package/dist/next/index.d.ts

@@ -1,13 +1,15 @@
-import { In as DenialReason, Nn as Decision, T as Policy, Vt as Snapshot, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
-import { n as PermDockWrap } from "../wrap-C5jC6sKI.js";
-import { o as OtelWrap } from "../types-lUlG3TVd.js";
-import { n as DescribeMessages } from "../describe-B5qgDvEW.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-PXI-vGpY.js";
+import { Bn as DenialReason, Gt as Snapshot, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock, d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
+import { m as ApprovalStore } from "../types-B_tiYvk8.js";
+import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { n as PermDockWrap } from "../wrap-DlJE3gS_.js";
+import { o as OtelWrap } from "../types-DHKPcqzr.js";
+import { n as DescribeMessages } from "../describe-ByS9LgHK.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
 import { ReactElement, ReactNode } from "react";
+import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/types.d.ts
 type NextSubjectInput = unknown;
 type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
@@ -18,12 +20,15 @@ type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
   readonly store?: ApprovalStore;
   /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
   readonly otel?: OtelWrap;
-  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  /**
+   * Wraps each instance after `otel`; build it with `wrapPermDock` to cover
+   * derived instances.
+   */
   readonly wrap?: PermDockWrap;
   /**
-   * Where `PermDockProvider` sends checks the snapshot cannot answer; default `/api/permdock`.
-   * `false` is snapshot-only: no `permdockHandler` route, and those checks are denied with
-   * reason `server-only`.
+   * Where `PermDockProvider` sends checks the snapshot cannot answer; default
+   * `/api/permdock`. `false` is snapshot-only: no `permdockHandler` route, and
+   * those checks are denied with reason `server-only`.
    */
   readonly endpoint?: string | false;
 };
@@ -35,7 +40,10 @@ type GetSnapshotQuery = GetPermDockQuery & {
     readonly [key: string]: unknown;
   })[];
   readonly tenants?: "all";
-  /** Tags added next to `snapshotTag(sub)`, such as the app's own organisation tag. */
+  /**
+   * Tags added next to `snapshotTag(sub)`, such as the app's own organisation
+   * tag.
+   */
   readonly tags?: readonly string[];
 };
 type PermissionRequirementOptions = GetPermDockQuery & {
@@ -59,7 +67,10 @@ type NextPermDockProviderProps = {
   readonly tenants?: "all";
   /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
   readonly endpoint?: string | false;
-  /** Suspends permission readers until the snapshot streams in, instead of answering `pending`. */
+  /**
+   * Suspends permission readers until the snapshot streams in, instead of
+   * answering `pending`.
+   */
   readonly suspend?: boolean;
   /**
    * What every `<Protected>` below renders for a slot it leaves out. Nodes
@@ -79,18 +90,39 @@ type PermDockHandler = {
   readonly POST: (request: Request) => Promise<Response>;
   readonly GET: (request: Request) => Promise<Response>;
 };
+type ProtectActionOptions<TInput, TRow> = {
+  /** Validates the action's argument before anything else runs. */
+  readonly input: StandardSchemaV1<unknown, TInput>;
+  /** The row to decide on; `null` or `undefined` answers `404`. */
+  readonly data?: (input: TInput) => TRow | null | undefined | Promise<TRow | null | undefined>;
+  /** The tenant to build the instance for; default the factory's `tenant`. */
+  readonly tenant?: (input: TInput) => string | undefined;
+};
+type ProtectedActionContext<TRow, V extends PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>;
+  /** The loaded row; `undefined` without a `data` loader. */
+  readonly data: TRow;
+};
+type ProtectedActionHandler<TInput, TRow, TResult, V extends PolicyVocabulary> = (input: TInput, context: ProtectedActionContext<TRow, V>) => TResult | Promise<TResult>;
+type ProtectAction<V extends PolicyVocabulary> = <TInput, TRow = undefined>(permission: Permission, options: ProtectActionOptions<TInput, TRow>) => <TResult>(handler: ProtectedActionHandler<TInput, TRow, TResult, V>) => ProtectedAction<Awaited<TResult>>;
 type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly getPermDock: (query?: GetPermDockQuery) => Promise<PermDock<V>>;
   /**
-   * `{ allowed, status: 'ready', decision }`. Any failure to build the
-   * instance denies; Next.js interrupts (`redirect()`, `notFound()`,
-   * request-time bailouts) from `subject` or `tenant` pass through.
+   * `{ allowed, status: 'ready', decision }`. Any failure to build the instance
+   * denies; Next.js interrupts (`redirect()`, `notFound()`, request-time
+   * bailouts) from `subject` or `tenant` pass through.
    */
-  readonly getPermission: (permission: Permission, data?: unknown, query?: GetPermDockQuery) => Promise<ServerPermissionState>;
+  readonly getPermission: {
+    <D>(permission: Permission, data?: UncheckedData<D>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
+    <P extends Permission>(permission: P, data?: RowData<P>, query?: GetPermDockQuery): Promise<ServerPermissionState>;
+  };
   /**
    * The session's snapshot for a `'use cache: private'` function the app owns:
-   * calls `cacheLife(cacheLifeFor(snapshot))` and `cacheTag(snapshotTag(sub), ...tags)`
-   * in that scope, and throws outside one.
+   * calls `cacheLife(cacheLifeFor(snapshot))` and `cacheTag(snapshotTag(sub),
+   * ...tags)` in that scope, and throws outside one.
    */
   readonly getSnapshot: (query?: GetSnapshotQuery) => Promise<Snapshot>;
   /**
@@ -99,15 +131,29 @@ type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
    * subject and `forbidden()` otherwise (`experimental.authInterrupts`);
    * approval-required and boundary validation throw as from `assert`.
    */
-  readonly requirePermission: (permission: Permission, data?: unknown, options?: PermissionRequirementOptions) => Promise<Extract<Decision, {
-    readonly outcome: "granted";
-  }>>;
-  /** Never awaits: passes an unawaited snapshot to the client provider, whose hooks suspend. */
+  readonly requirePermission: {
+    <D>(permission: Permission, data?: UncheckedData<D>, options?: PermissionRequirementOptions): Promise<Extract<Decision, {
+      readonly outcome: "granted";
+    }>>;
+    <P extends Permission>(permission: P, data?: RowData<P>, options?: PermissionRequirementOptions): Promise<Extract<Decision, {
+      readonly outcome: "granted";
+    }>>;
+  };
+  /**
+   * Never awaits: passes an unawaited snapshot to the client provider, whose
+   * hooks suspend.
+   */
   readonly PermDockProvider: (props: NextPermDockProviderProps) => ReactElement;
   readonly permdockHandler: () => PermDockHandler;
+  /**
+   * Wraps a server action: validates `input`, loads `data`, decides, then runs
+   * the handler. Resolves to `{ ok: true, value }` or `{ ok: false, problem }`
+   * with RFC 9457 Problem Details; only Next.js interrupts throw.
+   */
+  readonly protectAction: ProtectAction<V>;
 };
 //#endregion
 //#region src/next/create.d.ts
 export declare function createPermDock<TUser = NextSubjectInput, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: NextPermDockOptions<TUser>): NextPermDock<V>;
 //#endregion
-export { type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotTag };
+export { type ActionResult, type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type NextPermDockProviderProps, type PermDockHandler, type PermissionRequirementOptions, type ProtectAction, type ProtectActionOptions, type ProtectedAction, type ProtectedActionContext, type ProtectedActionHandler, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotTag };

package/dist/next/index.js

@@ -1,15 +1,113 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { n as wrapPermDock } from "../wrap-gX61EtpB.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DZHQ0KF6.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
-import { o as evaluationsHandler, v as NO_GRANT } from "../evaluations-beAooV0n.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { o as statusProblem, t as notFoundDetails } from "../problem-details-CLDgX1KV.js";
+import { n as isThenable } from "../thenable-BNSM1U2R.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { i as decisionProblem } from "../problem-BVLHFK33.js";
+import { s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { _ as LOAD_FAILED, o as evaluationsHandler, v as NO_GRANT } from "../evaluations-IBceAeKT.js";
 import { cache } from "react";
 import { jsx } from "react/jsx-runtime";
 import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
 import { cacheLife, cacheTag, io } from "next/cache.js";
 import { after } from "next/server.js";
 import { PermDockProvider } from "../react/provider-client.js";
+//#region src/next/action.ts
+function refused(problem) {
+	return {
+		ok: false,
+		problem
+	};
+}
+/** Issues reduced to JSON a server action can return: a symbol path is lost. */
+function plainIssues(issues) {
+	return issues.map((issue) => compact({
+		message: issue.message,
+		path: issue.path?.map((segment) => {
+			const key = typeof segment === "object" ? segment.key : segment;
+			return typeof key === "number" ? key : String(key);
+		})
+	}));
+}
+async function parseInput(schema, value) {
+	const result = schema["~standard"].validate(value);
+	const settled = isThenable(result) ? await result : result;
+	if (settled.issues === void 0) return settled;
+	return { issues: plainIssues(settled.issues) };
+}
+function invalidInput(permission, issues) {
+	return refused(new PermDockValidationError({
+		code: "invalid-data",
+		permission: permission.key,
+		resource: permission.resource,
+		issues,
+		boundary: "action-input",
+		message: `${permission.key}: ${issues.map((issue) => issue.message).join("; ")}.`
+	}).toProblemDetails());
+}
+/**
+* `protectAction(permission, { input, data?, tenant? })(handler)`: validates
+* the input, loads the row, decides, then runs the handler. Every refusal,
+* including a throw, is a Problem Details result; nothing but Next.js
+* interrupts leaves as an exception.
+*/
+function protectActionOf(deps) {
+	return (permission, options) => (handler) => async (value, call) => {
+		const parsed = await parseInput(options.input, value);
+		if (parsed.issues !== void 0) return invalidInput(permission, parsed.issues);
+		const input = parsed.value;
+		let permdock;
+		let data;
+		try {
+			permdock = await deps.getPermDock(compact({ tenant: options.tenant?.(input) }));
+		} catch (error) {
+			deps.rethrow(error);
+			return refused(decisionProblem(NO_GRANT, permission, void 0));
+		}
+		if (options.data !== void 0) {
+			try {
+				data = await options.data(input) ?? void 0;
+			} catch (error) {
+				deps.rethrow(error);
+				return refused(decisionProblem(LOAD_FAILED, permission, void 0));
+			}
+			if (data === void 0) return refused(notFoundDetails());
+		}
+		const decide = permdock.decide;
+		const decision = await resumeDecision({
+			decision: decide(permission, data, {
+				call: "adapter",
+				adapter: "next",
+				trusted: true
+			}),
+			permission,
+			subject: permdock.subject,
+			store: deps.store,
+			resource: resourceRef(permission, data),
+			adapter: "next",
+			token: call?.approval
+		});
+		if (decision.outcome !== "granted") return refused(decisionProblem(decision, permission, permdock.subject, compact({ disclosure: data === void 0 ? void 0 : deps.policy.resources.get(permission.resource)?.disclosure })));
+		try {
+			return {
+				ok: true,
+				value: await handler(input, {
+					permdock,
+					decision,
+					data
+				})
+			};
+		} catch (error) {
+			deps.rethrow(error);
+			return refused(statusProblem(500, `${permission.key}: the action failed`));
+		}
+	};
+}
+//#endregion
 //#region src/next/provider.tsx
 function renderClientProvider(options) {
 	return /* @__PURE__ */ jsx(PermDockProvider, {
@@ -171,7 +269,13 @@ function createPermDock(policy, given) {
 		getSnapshot,
 		requirePermission,
 		PermDockProvider,
-		permdockHandler
+		permdockHandler,
+		protectAction: protectActionOf({
+			policy,
+			getPermDock,
+			store: options.store,
+			rethrow: unstable_rethrow
+		})
 	};
 }
 //#endregion

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-Dfv0aTER.js";
+import { s as PermDockPluginOptions } from "../types-DC1Loeh3.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
-import { a as describeError } from "../errors-CWTY6uih.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-vea54PRw.js";
+import { a as describeError } from "../errors-Vpu6rKHl.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Cx_WciLE.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";
@@ -27,7 +27,8 @@ function createPermDockPlugin(options) {
 	};
 }
 async function runPluginCollect(cwd, options, check) {
-	return (await collectOnce(cwd, options, check, false)).message;
+	const { message } = await collectOnce(cwd, options, check, false);
+	return message;
 }
 //#endregion
 export { createPermDockPlugin };

package/dist/node/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, r as Guard, s as ScopeGuard, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { r as bindKernel } from "../bind-CAvgUuKs.js";
-import { n as sendResponse, r as toRequest, t as isServerResponse } from "../http-ujKm0JXE.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { n as sendResponse, r as toRequest, t as isServerResponse } from "../http-DH94eh6f.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;
 function createPermDock(policy, options) {

package/dist/{ocsf-BFp-PZZA.js → ocsf-TcjRBgIs.js}

@@ -19,26 +19,36 @@ function status(outcome) {
 		default: return unknownStatus(outcome);
 	}
 }
-/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
+/**
+* An outcome this build does not know, from a newer producer, is reported as
+* OCSF Unknown.
+*/
 function unknownStatus(_outcome) {
 	return {
 		status_id: 0,
 		status: "Unknown"
 	};
 }
-/** The names of a decision event's app obligations, or `undefined` when it has none. */
+/**
+* The names of a decision event's app obligations, or `undefined` when it has
+* none.
+*/
 function appObligationNames(event) {
 	const names = (event.obligations ?? []).flatMap((obligation) => obligation.kind === "app" ? [obligation.name] : []);
 	return names.length === 0 ? void 0 : names;
 }
-/** Epoch milliseconds of an RFC 3339 `at`, or `undefined` when it does not parse. */
+/**
+* Epoch milliseconds of an RFC 3339 `at`, or `undefined` when it does not
+* parse.
+*/
 function epochMillis(at) {
 	const time = Date.parse(at);
 	return Number.isNaN(time) ? void 0 : time;
 }
 /**
-* Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged.
-* An event whose `at` does not parse has no OCSF `time` and projects to `undefined`.
+* Projects a decision or approval event onto OCSF Authorize Session; the event
+* itself is unchanged. An event whose `at` does not parse has no OCSF `time`
+* and projects to `undefined`.
 */
 function toOcsf(event) {
 	const time = epochMillis(event.at);