permdock 0.7.0 → 0.8.0

package/dist/{openapi-Ddb4628T.js → openapi-BOsx0xn9.js}

@@ -1,8 +1,8 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { c as listPermissions, n as findPermission, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { c as listPermissions, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as PROFILE_PARAMETERS, n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { i as PROFILE_PARAMETERS, n as GNAP_RESERVED, r as PROFILE_NAMES, t as DRAFT_PINS } from "./pins-nqarl3oE.js";
 //#region src/openapi/emit.ts
 function assertScheme(options) {
 	if (options.scheme.type === "gnap") throw new TypeError(GNAP_RESERVED);
@@ -17,7 +17,10 @@ function grantsOf(policy, permissions) {
 function grantsAnyone(grant) {
 	return (Array.isArray(grant.to) ? grant.to : [grant.to]).some((grantee) => grantee.kind === "anyone");
 }
-/** Every subject is granted it: an unconditional allow to `anyone()` and no deny. */
+/**
+* Every subject is granted it: an unconditional allow to `anyone()` and no
+* deny.
+*/
 function isPublic(policy, permission) {
 	const grants = grantsOf(policy, [permission]);
 	return grants.every((grant) => grant.effect === "allow") && grants.some((grant) => grantsAnyone(grant) && grant.where === void 0 && grant.check === void 0 && grant.approval === void 0 && grant.closure === void 0 && grant.limit === void 0 && grant.purpose === void 0 && grant.viaOnly === void 0);
@@ -137,14 +140,17 @@ const FLOWS = [
 	"clientCredentials",
 	"deviceAuthorization"
 ];
-/** The client authentication methods FAPI 2.0 section 5.3.2.1 allows: sender-constrained, no shared secret. */
+/**
+* The client authentication methods FAPI 2.0 section 5.3.2.1 allows:
+* sender-constrained, no shared secret.
+*/
 const FAPI2_AUTH_METHODS = ["private_key_jwt", "tls_client_auth"];
 function pascal(value) {
 	return value.split(/[^A-Za-z0-9]+/u).filter((part) => part.length > 0).map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`).join("");
 }
 /**
-* One Security Profile Requirement per distinct scope set: `scopeSets` from
-* the operations, else one per permission.
+* One Security Profile Requirement per distinct scope set: `scopeSets` from the
+* operations, else one per permission.
 */
 function securityProfileRequirementsOf(policy, options, scopeSets) {
 	if ((options.target ?? "3.2") !== "3.3" || options.securityProfile === void 0) return;
@@ -188,7 +194,10 @@ function jsonPathString(value) {
 function operationTarget(operationId) {
 	return `$.paths.*[?@.operationId == ${jsonPathString(operationId)}]`;
 }
-/** The `sha-256:` digest of the sorted permission keys and scopes, so the same catalog gives the same Overlay. */
+/**
+* The `sha-256:` digest of the sorted permission keys and scopes, so the same
+* catalog gives the same Overlay.
+*/
 function fingerprint(policy) {
 	const lines = listPermissions(policy.permissions).map((leaf) => `${leaf.key} ${leaf.scope}`).toSorted();
 	return sha256Digest(lines.join("\n"));
@@ -318,7 +327,10 @@ function segmentsOf(path) {
 function isParam(segment) {
 	return segment.startsWith("{") && segment.endsWith("}");
 }
-/** The number of literal segments that match, or -1 when the template does not match. */
+/**
+* The number of literal segments that match, or -1 when the template does not
+* match.
+*/
 function score(route, segments) {
 	if (route.segments.length !== segments.length) return -1;
 	let literal = 0;
@@ -339,8 +351,8 @@ function scopesOf(key, entry) {
 	return Object.freeze([...entry.oauthScopes]);
 }
 /**
-* Operations as `"METHOD /path/{param}"` keys, the OpenAPI path template, to
-* a permission. `base` is a prefix requests carry and the keys do not
+* Operations as `"METHOD /path/{param}"` keys, the OpenAPI path template, to a
+* permission. `base` is a prefix requests carry and the keys do not
 * (`/api/v1`). A key that is not a method and a path throws.
 */
 function operationPermissions(operations, options = {}) {
@@ -400,10 +412,10 @@ function operationPermissions(operations, options = {}) {
 	};
 }
 /**
-* The operation permissions an OpenAPI document declares: every operation
-* whose `x-permdock-permissions` names exactly one permission of `tree`, keyed
-* by its method, path and `operationId`. An operation naming none, several or
-* an unknown key is left out, so a gate denies it.
+* The operation permissions an OpenAPI document declares: every operation whose
+* `x-permdock-permissions` names exactly one permission of `tree`, keyed by its
+* method, path and `operationId`. An operation naming none, several or an
+* unknown key is left out, so a gate denies it.
 */
 function operationPermissionsFromOpenApi(document, tree, options = {}) {
 	const operations = {};
@@ -491,8 +503,8 @@ function jsonSchema(options) {
 	return structuredClone(JSON_SCHEMA);
 }
 /**
-* The Problem Details body the adapters send on a denial, as a Standard
-* Schema with a JSON Schema, for `oc.errors({ FORBIDDEN: { data: problemDetails } })`.
+* The Problem Details body the adapters send on a denial, as a Standard Schema
+* with a JSON Schema, for `oc.errors({ FORBIDDEN: { data: problemDetails } })`.
 * Extension members pass through: RFC 9457 lets a problem type add them.
 */
 const problemDetails = Object.freeze({ "~standard": Object.freeze({
@@ -512,7 +524,10 @@ function isList(permission) {
 function listOf(permission) {
 	return isList(permission) ? permission : [permission];
 }
-/** The `x-permdock-permissions` value: the permission keys an operation enforces. */
+/**
+* The `x-permdock-permissions` value: the permission keys an operation
+* enforces.
+*/
 function permissionsExtension(permissions) {
 	return Object.freeze(listOf(permissions).map((leaf) => leaf.key));
 }

package/dist/{openapi-DMocl1bh.js → openapi-CBZUhA3l.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-DpP_U6Bf.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { c as given, d as policyFlag, f as validatorFlag, l as outFlag, o as fileOut, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/openapi.ts
 const docFlag = { doc: {
 	type: "string",
@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-ztVaux6j.js")).runOpenapi({
+		return (await import("./openapi-VeHHU2l9.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,8 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		const { runOpenapiImport } = await import("./import-DB2EG_iy.js");
-		return runOpenapiImport({
+		return (await import("./import-_YqhhwvX.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-ztVaux6j.js → openapi-VeHHU2l9.js}

@@ -1,13 +1,13 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as getResource, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { n as definePolicy } from "./policy-DaJy4nK4.js";
-import { i as configError } from "./errors-DpP_U6Bf.js";
-import { i as readJsonFile, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
-import { t as shortDiff } from "./text-diff-DhITNCnD.js";
-import { c as openapiVersion, o as createPermDock } from "./openapi-Ddb4628T.js";
-import { i as fileDrift } from "./output-files-CCMdcFWb.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-gIcCx7zM.js";
+import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { r as definePolicy } from "./policy-CLQ8__GF.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
+import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
+import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-Dst9I9Gs.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts
@@ -17,7 +17,10 @@ function mergeRecord(base, extra) {
 	for (const [key, value] of Object.entries(extra)) result[key] = value;
 	return result;
 }
-/** Keeps what the document already says about a scheme (flow URLs, other flows, description); PermDock owns the scopes. */
+/**
+* Keeps what the document already says about a scheme (flow URLs, other flows,
+* description); PermDock owns the scopes.
+*/
 function mergeSchemes(existing, emitted) {
 	const result = {};
 	for (const [name, scheme] of Object.entries(emitted)) {
@@ -68,7 +71,10 @@ function leavesOf(policy, keys) {
 		return leaf;
 	});
 }
-/** Operations carrying `x-permdock-permissions`, joined by `operationId`; those without one are findings. */
+/**
+* Operations carrying `x-permdock-permissions`, joined by `operationId`; those
+* without one are findings.
+*/
 function overlayOperations(document, policy) {
 	const operations = [];
 	const unnamed = [];
@@ -94,7 +100,10 @@ function overlayOperations(document, policy) {
 		secured
 	};
 }
-/** `instance` when any listed permission acts on one row; the id is the last path template parameter. */
+/**
+* `instance` when any listed permission acts on one row; the id is the last
+* path template parameter.
+*/
 function arityOf(policy, leaves, path) {
 	if (!leaves.some((leaf) => getResource(policy.permissions, leaf.resource)?.instanceActions.has(leaf.action) === true)) return { kind: "collection" };
 	const parameter = [...path.matchAll(/\{([^}]+)\}/gu)].at(-1)?.[1];
@@ -213,11 +222,11 @@ async function runOpenapi(input) {
 		code: 1,
 		output: `openapi drift: the source already sets security the Overlay replaces on ${covered.secured.join(", ")}`
 	};
-	const result = covered !== void 0 ? openapi.overlay({
+	const result = covered === void 0 ? applyDocument(parsed, policy, openapi, input.arity === true, input.target) : openapi.overlay({
 		extends: input.doc,
 		version: input.overlay,
 		operations: covered.operations
-	}) : applyDocument(parsed, policy, openapi, input.arity === true, input.target);
+	});
 	const conformance = outputConformance(parsed, result, input.format, input.overlay);
 	if (conformance !== void 0) return {
 		code: 1,

package/dist/{operation-findings-kRcEp8lE.js → operation-findings-CXtFzlKJ.js}

@@ -1,4 +1,4 @@
-import { n as OPERATION_RISKS } from "./permissions-CyH2MV_B.js";
+import { n as OPERATION_RISKS } from "./permissions-CVXmRILq.js";
 //#region src/catalog/operation-findings.ts
 function rank(risk) {
 	return OPERATION_RISKS.indexOf(risk ?? "low");
@@ -8,8 +8,8 @@ function requiresApproval(catalog, permission) {
 }
 /**
 * Operations, matched by name, whose `meta.risk` rose or whose permission
-* stopped requiring approval between two catalogs. A new or removed
-* operation is not a finding.
+* stopped requiring approval between two catalogs. A new or removed operation
+* is not a finding.
 */
 function operationFindings(previous, next) {
 	const before = new Map((previous.operations ?? []).map((operation) => [operation.name, operation]));

package/dist/{operations-BNLes61x.d.ts → operations-Ci_rT6Uo.d.ts}

@@ -1,4 +1,4 @@
-import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/operation-risks.d.ts
 type OperationRisk = "low" | "medium" | "high" | "critical";
 /** Every `meta.risk` level, lowest first. */
@@ -7,7 +7,10 @@ declare function isOperationRisk(value: unknown): value is OperationRisk;
 //#endregion
 //#region src/core/operations.d.ts
 type OperationEffect = "read" | "write" | "delete" | "send" | "spend" | "external";
-/** Plain JSON a host reads to label, confirm or gate an operation; PermDock never decides on it. */
+/**
+ * Plain JSON a host reads to label, confirm or gate an operation; PermDock
+ * never decides on it.
+ */
 type OperationMeta = {
   readonly risk?: OperationRisk;
   /** What running the operation does, each effect at most once. */
@@ -15,9 +18,9 @@ type OperationMeta = {
   readonly title?: string;
 };
 /**
- * Loads the row the check runs on from the operation's input, the binding
- * every surface shares. The row is validated against the permission's
- * resource schema like any request-derived data (invariant 9).
+ * Loads the row the check runs on from the operation's input, the binding every
+ * surface shares. The row is validated against the permission's resource schema
+ * like any request-derived data (invariant 9).
  */
 type OperationData<TInput = never> = {
   load(input: TInput): unknown;
@@ -32,8 +35,8 @@ type OperationDefinition = {
 };
 /**
  * A permission-bound action that agent tools, workflow nodes, MCP operations,
- * HTTP routes and chat commands read by name. `TInput` is the parameter type
- * of `data`; an operation without `data` takes `undefined`.
+ * HTTP routes and chat commands read by name. `TInput` is the parameter type of
+ * `data`; an operation without `data` takes `undefined`.
  */
 type Operation<TInput = unknown, TName extends string = string, TPermission extends Permission = Permission> = {
   readonly name: TName;

package/dist/orpc/index.d.ts

@@ -1,11 +1,44 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-C4gZUEZy.js";
-import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
-import { t as StreamProtectOptions } from "../stream-2Vwhl7Er.js";
-import { Middleware } from "@orpc/server";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { t as StreamProtectOptions } from "../stream-ltuLdtTG.js";
+import { AnySchema, MetaPlugin, Middleware, Procedure, Schema } from "@orpc/server";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/orpc/operations.d.ts
+type OperationProcedureContext<TCtx extends object, V extends PolicyVocabulary = PolicyVocabulary> = TCtx & {
+  readonly permdock: PermDock<V>;
+  /** The row the operation's `data` loader read; `undefined` without one. */
+  readonly permdockData?: unknown;
+};
+type OperationRoute<TCtx extends object, TInput, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly handler: (opts: {
+    readonly input: TInput;
+    readonly context: OperationProcedureContext<TCtx, V>;
+  }) => unknown;
+} & ([TInput] extends [undefined] ? {
+  readonly input?: StandardSchemaV1<unknown, TInput>;
+} : {
+  /** Required: the operation's `data` loader never sees raw input. */
+  readonly input: StandardSchemaV1<unknown, TInput>;
+});
+type OperationRoutes<TOperations extends Readonly<Record<string, Operation>>, TCtx extends object, V extends PolicyVocabulary = PolicyVocabulary> = { readonly [TName in keyof TOperations]: OperationRoute<TCtx, OperationInput<TOperations[TName]>, V>; };
+type OperationsRouterOptions = {
+  /** oRPC meta plugins per operation, such as `openapi()` from `@orpc/openapi`. */
+  readonly meta?: (operation: Operation) => readonly MetaPlugin<AnySchema, AnySchema, Record<never, never>>[];
+};
+type InputSchemaOf<TRoute> = TRoute extends {
+  readonly input: infer TSchema extends AnySchema;
+} ? TSchema : Schema<undefined>;
+type OutputOf<TRoute> = TRoute extends {
+  readonly handler: (...args: never[]) => infer TResult;
+} ? Awaited<TResult> : never;
+type OperationsRouter<TCtx extends object, TRoutes> = { readonly [TName in keyof TRoutes]: Procedure<TCtx, any, InputSchemaOf<TRoutes[TName]>, Schema<OutputOf<TRoutes[TName]>>, Record<never, never>>; };
+type OperationsRouterOf<TCtx extends object, V extends PolicyVocabulary> = <TOperations extends Readonly<Record<string, Operation>>, const TRoutes extends OperationRoutes<TOperations, TCtx, V>>(operations: TOperations, routes: TRoutes, options?: OperationsRouterOptions) => OperationsRouter<TCtx, TRoutes>;
+//#endregion
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
   readonly context: TCtx;
@@ -20,7 +53,10 @@ type OrpcMiddleware<TCtx extends object = object, TInput = unknown, V extends Po
   readonly permdockData?: unknown;
 }, TInput, any, Record<never, never>>;
 type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = ServerAdapterOptions<OrpcMiddlewareOpts<TCtx>, TUser> & {
-  /** The Web `Request` behind a context; defaults to `context.request` or `context.req`. */
+  /**
+   * The Web `Request` behind a context; defaults to `context.request` or
+   * `context.req`.
+   */
   readonly request?: (context: TCtx) => Request | null | undefined;
   /** Ends or revalidates open event iterators. */
   readonly revocations?: RevocationFeed;
@@ -31,10 +67,22 @@ type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary =
     readonly security: readonly Record<string, readonly string[]>[];
     readonly "x-permdock-permissions": readonly string[];
   };
+  /**
+   * `security` as the merge function oRPC 2's `openapi({ spec })` takes, with
+   * mutable arrays so it type-checks against oRPC's `OperationObject`.
+   */
+  readonly spec: (permission: Permission) => <TSpec extends object>(current: TSpec) => TSpec & OrpcSecuritySpec;
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
+type OrpcSecuritySpec = {
+  security: Record<string, string[]>[];
+  "x-permdock-permissions": string[];
+};
 type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one procedure call, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (opts: OrpcMiddlewareOpts<TCtx>) => Promise<PermDock<V>>;
   readonly middleware: () => OrpcMiddleware<TCtx, unknown, V>;
   readonly protect: (permission: Permission | null, data?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
@@ -42,13 +90,19 @@ type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = Pol
   readonly connection: (opts: OrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   readonly permdockHandler: () => (request: Request) => Promise<Response>;
   readonly openapi: OrpcOpenApiHooks<TCtx, V>;
+  /**
+   * One procedure per `defineOperations` entry, guarded by the operation's
+   * permission and `data` loader; `meta` attaches oRPC meta such as
+   * `openapi()`.
+   */
+  readonly operationsRouter: OperationsRouterOf<TCtx, V>;
 };
 /**
- * The permission the procedure's first `protect` decides, or `undefined`
- * when no `protect` is attached. Reads the procedure definition only and
- * never decides.
+ * The permission the procedure's first `protect` decides, or `undefined` when
+ * no `protect` is attached. Reads the procedure definition only and never
+ * decides.
  */
 export declare function permissionOf(procedure: unknown): Permission | undefined;
 export declare function createPermDock<TCtx extends object = object, TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: OrpcPermDockOptions<TCtx, TUser>): OrpcPermDock<TCtx, V>;
 //#endregion
-export type { OrpcMiddleware, OrpcMiddlewareOpts, OrpcOpenApiHooks, OrpcPermDock, OrpcPermDockOptions };
+export type { OperationProcedureContext, OperationRoute, OperationRoutes, OperationsRouter, OperationsRouterOf, OperationsRouterOptions, OrpcMiddleware, OrpcMiddlewareOpts, OrpcOpenApiHooks, OrpcPermDock, OrpcPermDockOptions, OrpcSecuritySpec };

package/dist/orpc/index.js

@@ -1,11 +1,42 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { o as isPermission } from "../permission-registry-DpPtSKNZ.js";
-import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { n as attached } from "../bind-D1nO6fiC.js";
-import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-Bk1bE-ch.js";
-import { ORPCError } from "@orpc/server";
+import { o as isPermission } from "../permission-registry-B8tYxPIt.js";
+import { o as problemMessage } from "../http-DKLXrFGk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as attached } from "../bind-D_sZSVA3.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
+import { ORPCError, os } from "@orpc/server";
+//#region src/orpc/operations.ts
+const root = os;
+function routeOf(name, value) {
+	if (typeof (value !== null && typeof value === "object" ? Reflect.get(value, "handler") : void 0) !== "function") throw new TypeError(`operationsRouter: the route for operation "${name}" needs a handler function.`);
+	return value;
+}
+/**
+* Builds one oRPC procedure per operation: `middleware()`, the route's `input`
+* schema, then `protect(operation.permission, operation.data)`. Throws at
+* definition time when a route names no operation, an operation has no route,
+* or an operation with `data` has no `input` schema.
+*/
+function operationsRouterOf(deps) {
+	return (operations, routes, options = {}) => {
+		for (const name of Object.keys(routes)) if (!Object.hasOwn(operations, name)) throw new TypeError(`operationsRouter: "${name}" is not an operation passed to operationsRouter.`);
+		const router = {};
+		for (const [name, operation] of Object.entries(operations)) {
+			if (!Object.hasOwn(routes, name)) throw new TypeError(`operationsRouter: operation "${name}" has no route.`);
+			const route = routeOf(name, Reflect.get(routes, name));
+			const load = operation.data;
+			if (load !== void 0 && route.input === void 0) throw new TypeError(`operationsRouter: operation "${name}" loads a row from its input, so its route needs an input schema.`);
+			const base = root.meta(...options.meta?.(operation) ?? []).use(deps.middleware());
+			router[name] = (route.input === void 0 ? base : base.input(route.input)).use(deps.protect(operation.permission, load === void 0 ? void 0 : (opts) => load(opts.input))).handler(({ input, context }) => route.handler({
+				input,
+				context
+			}));
+		}
+		return router;
+	};
+}
+//#endregion
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {
 	return compact({
@@ -18,7 +49,10 @@ function toOpts(mw, input, next) {
 function isErrorConstructor(value) {
 	return typeof value === "function";
 }
-/** Uses the procedure's own constructor when it declares the code, so the declared status and `defined` apply. */
+/**
+* Uses the procedure's own constructor when it declares the code, so the
+* declared status and `defined` apply.
+*/
 function orpcError(code, message, data, errors) {
 	const declared = errors !== void 0 && Object.hasOwn(errors, code) ? errors[code] : void 0;
 	return isErrorConstructor(declared) ? declared({
@@ -38,7 +72,10 @@ async function throwOrpcError(response, errors) {
 	const code = rpcCode(response.status);
 	throw orpcError(code, problemMessage(data, code), data, errors);
 }
-/** A PermDock error thrown further down (an `assert` in a handler) becomes the ORPCError `protect` throws. */
+/**
+* A PermDock error thrown further down (an `assert` in a handler) becomes the
+* ORPCError `protect` throws.
+*/
 function mapDownstream(run, errors) {
 	return new Promise((resolve) => {
 		resolve(run());
@@ -58,9 +95,9 @@ function readOwn(value, key) {
 	return (typeof value === "object" || typeof value === "function") && value !== null && Object.hasOwn(value, key) ? Reflect.get(value, key) : void 0;
 }
 /**
-* The permission the procedure's first `protect` decides, or `undefined`
-* when no `protect` is attached. Reads the procedure definition only and
-* never decides.
+* The permission the procedure's first `protect` decides, or `undefined` when
+* no `protect` is attached. Reads the procedure definition only and never
+* decides.
 */
 function permissionOf(procedure) {
 	const ordered = readOwn(readOwn(procedure, "~orpc"), "orderedMiddlewares");
@@ -140,8 +177,20 @@ function createPermDock(policy, options) {
 		openapi: {
 			protect,
 			security: kernelOpenApi.security,
+			spec: (permission) => {
+				const fragment = kernelOpenApi.security(permission);
+				return (current) => ({
+					...current,
+					security: fragment.security.map((requirement) => Object.fromEntries(Object.entries(requirement).map(([scheme, scopes]) => [scheme, [...scopes]]))),
+					"x-permdock-permissions": [...fragment["x-permdock-permissions"]]
+				});
+			},
 			securitySchemes: kernelOpenApi.securitySchemes
-		}
+		},
+		operationsRouter: operationsRouterOf({
+			middleware,
+			protect
+		})
 	};
 }
 //#endregion

package/dist/otel/index.d.ts

@@ -1,6 +1,6 @@
-import { j as PolicyVocabulary } from "../policy-types-B-F-qAZk.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-CIeZcG8v.js";
+import { j as PolicyVocabulary } from "../policy-types-CCiDRZBH.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-DHKPcqzr.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is
@@ -8,7 +8,10 @@ import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap
  * `withOtel` for timings and for `tenant()` / `team()` derived instances.
  */
 export declare function instrument(permdock: PermDock, options?: OtelOptions): () => void;
-/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+/**
+ * Returns an instrumented instance: timed spans and histogram, derived
+ * instances included.
+ */
 export declare function withOtel<V extends PolicyVocabulary = PolicyVocabulary>(permdock: PermDock<V>, options?: OtelOptions): PermDock<V>;
 //#endregion
 export { GENAI_SEMCONV_PIN, GEN_AI_TOOL_CALL_ID, GEN_AI_TOOL_NAME, type OtelApi, type OtelOptions, type OtelWrap, type StructuralLogger };

package/dist/otel/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as wrapPermDock } from "../wrap-CiSc_KCq.js";
-import { r as appObligationNames } from "../ocsf-BFp-PZZA.js";
+import { n as wrapPermDock } from "../wrap-B2wziJI_.js";
+import { r as appObligationNames } from "../ocsf-TcjRBgIs.js";
 //#region src/otel/types.ts
 const GENAI_SEMCONV_PIN = "1.37.0";
 const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
@@ -87,8 +87,8 @@ function omitPath(attributes, path) {
 }
 /**
 * `error.type` for a decision that failed: a boundary validation failure
-* always, and the first denial reason when `errorOnDeny` marks every denial
-* an error.
+* always, and the first denial reason when `errorOnDeny` marks every denial an
+* error.
 */
 function errorType(event, options) {
 	if (event.outcome !== "denied") return;
@@ -220,7 +220,10 @@ function instrumented(permdock, options, api) {
 		};
 	});
 }
-/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+/**
+* Returns an instrumented instance: timed spans and histogram, derived
+* instances included.
+*/
 function withOtel(permdock, options = {}) {
 	return instrumented(permdock, options, resolveApi(options.api));
 }

package/dist/output-files-BHOIlrfD.js

@@ -0,0 +1 @@
+export { t as SPLIT_PARTS } from "./output-files-BIQ_9pIs.js";

package/dist/{output-files-CCMdcFWb.js → output-files-BIQ_9pIs.js}

@@ -1,6 +1,6 @@
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { t as shortDiff } from "./text-diff-DhITNCnD.js";
-import { t as applyFiles } from "./files-acUbNwWt.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 /** How `path` on disk differs from `expected`; `undefined` when `same` holds. */
@@ -12,7 +12,10 @@ function fileDrift(path, expected, same = (a, b) => a === b) {
 		onDisk
 	};
 }
-/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+/**
+* `--check`: one entry per file that is missing or differs, naming its part; a
+* differing file carries a short diff.
+*/
 function driftOf(cwd, files) {
 	const drift = [];
 	for (const file of files) {
@@ -23,7 +26,10 @@ function driftOf(cwd, files) {
 	}
 	return drift;
 }
-/** Writes every file but the stdout ones, all or nothing, and returns the stdout text for printing. */
+/**
+* Writes every file but the stdout ones, all or nothing, and returns the stdout
+* text for printing.
+*/
 function writeOutputFiles(cwd, files) {
 	const onDisk = files.filter((file) => file.rel !== "-");
 	applyFiles(cwd, onDisk.map((file) => ({
@@ -42,7 +48,10 @@ const SPLIT_PARTS = [
 	"policies",
 	"hook"
 ];
-/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+/**
+* `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order,
+* or an error.
+*/
 function parseSplit(raw) {
 	if (raw === void 0) return;
 	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
@@ -54,8 +63,8 @@ function partPath(out, part) {
 	return out.replaceAll("{part}", part);
 }
 /**
-* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
-* their dependencies, so no file needs a number to apply first.
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by their
+* dependencies, so no file needs a number to apply first.
 */
 function pgDeltaPath(root, part, schema) {
 	switch (part) {
@@ -67,7 +76,10 @@ function pgDeltaPath(root, part, schema) {
 		default: return part;
 	}
 }
-/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+/**
+* Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is
+* an existing directory.
+*/
 function isSeedsDirectory(cwd, out) {
 	if (out === "-") return false;
 	if (out.endsWith("/")) return true;
@@ -75,11 +87,11 @@ function isSeedsDirectory(cwd, out) {
 	return existsSync(path) && statSync(path).isDirectory();
 }
 /**
-* A generated data migration at `out`: a file, `-` for stdout, or a
-* migrations directory that gets a new versioned file only when the newest
-* one starting with `marker` differs. With `check`, the planned file is
-* always returned, so drift names it. `reserved` lists the files this run
-* already plans, so two data migrations never share a version.
+* A generated data migration at `out`: a file, `-` for stdout, or a migrations
+* directory that gets a new versioned file only when the newest one starting
+* with `marker` differs. With `check`, the planned file is always returned, so
+* drift names it. `reserved` lists the files this run already plans, so two
+* data migrations never share a version.
 */
 function dataMigrationFile(input) {
 	if (!isSeedsDirectory(input.cwd, input.out)) return {
@@ -100,9 +112,9 @@ function migrationVersion(now) {
 }
 const VERSION_PREFIX = /^\d{14}(?=_)/u;
 /**
-* The version of a new migration that sorts after every migration in
-* `names`: one second past the newest, so the same directory always gives the
-* same name. Only a directory with no versioned migration falls back to `now`.
+* The version of a new migration that sorts after every migration in `names`:
+* one second past the newest, so the same directory always gives the same name.
+* Only a directory with no versioned migration falls back to `now`.
 */
 function nextMigrationVersion(names, now) {
 	const times = names.flatMap((name) => {