raffel 1.1.59-next.07e2952 → 1.1.59

package/dist/middleware/policy/bootstrap.d.ts

@@ -11,7 +11,6 @@
 import type { LoggerPort } from '../../ports/outbound/logger.js';
 import type { Context, Interceptor } from '../../types/index.js';
 import type { PolicyEnginePort } from '../../ports/outbound/policy-engine.js';
-import { type CoLocatedAccumulator } from './co-located-accumulator.js';
 import type { PolicyConfig, Principal, ProcedurePolicyConfig } from './types.js';
 export interface PolicyCoverageEntry {
     /** Operation/channel name as registered in the registry. */
@@ -53,38 +52,7 @@ export interface PolicyBootstrap {
      * audit when `defaultMode: 'deny'` is configured.
      */
     getCoverage: (registered: readonly PolicyCoverageEntry[]) => PolicyCoverageReport;
-    /**
-     * Accumulator for co-located policies (1.1.60+). Discovery calls
-     * `accumulator.add()` for every (route, policy) pair it surfaces; the
-     * application path (`applyDiscoveryResult`) calls `flush()` once at
-     * the end of a load to materialise one policy per cascade file with
-     * the union of route names in `scope.routes`, deduping the N-copy
-     * leak that earlier releases produced when a single cascade
-     * `_policy.yaml` was attached to N routes (Bug A from 1.1.58).
-     *
-     * `reset()` is called at the top of a hot reload so the next flush
-     * only contains the policies for the routes that survived the
-     * reload.
-     */
-    coLocatedAccumulator: CoLocatedAccumulator;
 }
-/**
- * Per-server state for the co-located policy pipeline (1.1.60+).
- *
- * The accumulator exists so that a single cascade `_policy.yaml` shared
- * by N routes produces ONE entry in the engine instead of N copies
- * (one per route). Each `add()` records the route name against the
- * policy's `(source, index)` key. `flush()` materialises one policy
- * per key with `scope.routes` set to the union and commits to the
- * engine. `reset()` clears the accumulator without touching the
- * engine — used on hot reload so the next flush reflects only the
- * routes that survived the reload.
- *
- * Imported from `./co-located-accumulator.js`. Re-exported here so
- * existing call sites that imported the type from `bootstrap` keep
- * working.
- */
-export type { CoLocatedAccumulator } from './co-located-accumulator.js';
 export interface CreatePolicyBootstrapOptions {
     /** Fallback logger if `policy.logger` is not provided. */
     logger: LoggerPort;

package/dist/middleware/policy/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/middleware/policy/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAK7E,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,EAAU,MAAM,YAAY,CAAA;AAExF,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,IAAI,EAAE,mBAAmB,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,MAAM,EAAE,gBAAgB,CAAA;IACxB,gEAAgE;IAChE,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,WAAW,CAAA;IACzF,kEAAkE;IAClE,uBAAuB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,WAAW,CAAA;IAC/D;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD;;;;OAIG;IACH,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,KAAK,oBAAoB,CAAA;IACjF;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;GAeG;AACH,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,MAAM,WAAW,4BAA4B;IAC3C,0DAA0D;IAC1D,MAAM,EAAE,UAAU,CAAA;IAClB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,OAAO,EAAE,4BAA4B,GACpC,eAAe,GAAG,IAAI,CAoGxB"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/middleware/policy/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAM7E,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAEhF,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,IAAI,EAAE,mBAAmB,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,MAAM,EAAE,gBAAgB,CAAA;IACxB,gEAAgE;IAChE,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,KAAK,WAAW,CAAA;IACzF,kEAAkE;IAClE,uBAAuB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,WAAW,CAAA;IAC/D;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD;;;;OAIG;IACH,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,KAAK,oBAAoB,CAAA;CAClF;AAED,MAAM,WAAW,4BAA4B;IAC3C,0DAA0D;IAC1D,MAAM,EAAE,UAAU,CAAA;IAClB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,OAAO,EAAE,4BAA4B,GACpC,eAAe,GAAG,IAAI,CAyFxB"}

package/dist/middleware/policy/bootstrap.js

@@ -12,7 +12,6 @@ import { createDefaultEngine } from './engine/index.js';
 import { createPolicyInterceptor, createNoPolicyDeclaredInterceptor } from './interceptor.js';
 import { loadPoliciesFromDir, mergePolicies } from './loader.js';
 import { createPrincipalResolver } from './principal/index.js';
-import { createCoLocatedAccumulator, } from './co-located-accumulator.js';
 import { setPolicyProvider } from '../../mcp/resources/index.js';
 /**
  * Wire the entire policy stack from a single call. Returns null if
@@ -58,15 +57,6 @@ export function createPolicyBootstrap(config, options) {
         });
     };
     const noPolicyDeclaredFactory = (procedureName) => createNoPolicyDeclaredInterceptor(procedureName, productionErrorBody);
-    // Co-located policy accumulator (1.1.60+). Collects (source, index)
-    // → Set<routeName> across the load, then flushes ONE policy per
-    // (source, index) with `scope.routes` set to the union of routes.
-    // Without this, an unscoped cascade _policy.yaml shared by N
-    // routes produced N copies in the engine (Bug A from 1.1.58).
-    const coLocatedAccumulator = createCoLocatedAccumulator({
-        engine,
-        flushLogger: policyLogger,
-    });
     const getCoverage = (registered) => {
         const gaps = [];
         let covered = 0;
@@ -105,7 +95,6 @@ export function createPolicyBootstrap(config, options) {
         noPolicyDeclaredFactory,
         resolvePrincipal: async (ctx) => principalResolver(ctx),
         getCoverage,
-        coLocatedAccumulator,
     };
 }
 //# sourceMappingURL=bootstrap.js.map

package/dist/middleware/policy/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../src/middleware/policy/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,0BAA0B,GAE3B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAyFhE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgC,EAChC,OAAqC;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAA;IAE/D,qEAAqE;IACrE,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YACrD,GAAG,EAAE,MAAM,CAAC,WAAW;YACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;QAC1D,cAAc,GAAG,MAAM,CAAC,MAAM,CAAA;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACjF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACnE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;IACjE,MAAM,WAAW,GAAqB,MAAM,CAAC,WAAW,IAAI,OAAO,CAAA;IACnE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;IAEpD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,MAAM,kBAAkB,GAAG,CAAC,aAAqB,EAAE,UAAiC,EAAe,EAAE;QACnG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC/B,IAAI,UAAU,CAAC,MAAM;YAAE,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACrD,OAAO,uBAAuB,CAAC;YAC7B,MAAM;YACN,aAAa,EAAE,aAAa;YAC5B,MAAM,EAAE,UAAU;YAClB,iBAAiB;YACjB,mBAAmB;YACnB,MAAM,EAAE,YAAY;SACrB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,uBAAuB,GAAG,CAAC,aAAqB,EAAe,EAAE,CACrE,iCAAiC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEvE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,6DAA6D;IAC7D,8DAA8D;IAC9D,MAAM,oBAAoB,GAAyB,0BAA0B,CAAC;QAC5E,MAAM;QACN,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,CAAC,UAA0C,EAAE,EAAE;QACjE,MAAM,IAAI,GAA0B,EAAE,CAAA;QACtC,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,GAAG,EAAE,CAAA;gBACL,SAAQ;YACV,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAC9E,CAAC,CAAA;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,sEAAsE;QACtE,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,CACrB,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;YAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACvB,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;YAC3B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU;YAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC,CACJ,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,WAAW;QACX,kBAAkB;QAClB,uBAAuB;QACvB,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC;QACvD,WAAW;QACX,oBAAoB;KACrB,CAAA;AACH,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../../src/middleware/policy/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAyDhE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgC,EAChC,OAAqC;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAC1C,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAA;IAE/D,qEAAqE;IACrE,IAAI,cAAc,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;YACrD,GAAG,EAAE,MAAM,CAAC,WAAW;YACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;QAC1D,cAAc,GAAG,MAAM,CAAC,MAAM,CAAA;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACjF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACnE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;IACjE,MAAM,WAAW,GAAqB,MAAM,CAAC,WAAW,IAAI,OAAO,CAAA;IACnE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;IAEpD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,MAAM,kBAAkB,GAAG,CAAC,aAAqB,EAAE,UAAiC,EAAe,EAAE;QACnG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC/B,IAAI,UAAU,CAAC,MAAM;YAAE,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACrD,OAAO,uBAAuB,CAAC;YAC7B,MAAM;YACN,aAAa,EAAE,aAAa;YAC5B,MAAM,EAAE,UAAU;YAClB,iBAAiB;YACjB,mBAAmB;YACnB,MAAM,EAAE,YAAY;SACrB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,uBAAuB,GAAG,CAAC,aAAqB,EAAe,EAAE,CACrE,iCAAiC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAEvE,MAAM,WAAW,GAAG,CAAC,UAA0C,EAAE,EAAE;QACjE,MAAM,IAAI,GAA0B,EAAE,CAAA;QACtC,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,GAAG,EAAE,CAAA;gBACL,SAAQ;YACV,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,CAAA;gBACT,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;IAC9E,CAAC,CAAA;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,sEAAsE;QACtE,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,CACrB,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;YAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACvB,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;YAC3B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU;YAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC,CACJ,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,WAAW;QACX,kBAAkB;QAClB,uBAAuB;QACvB,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC;QACvD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/server/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/server/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,OAAO,KAAK,EACV,aAAa,EASb,YAAY,EAUb,MAAM,YAAY,CAAA;AA6FnB;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAuzCjE"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/server/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,KAAK,EACV,aAAa,EASb,YAAY,EAeb,MAAM,YAAY,CAAA;AA2FnB;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CA2lDjE"}

package/dist/server/builder.js

@@ -5,12 +5,13 @@
  */
 import { createRegistry } from '../core/registry.js';
 import { createRouter } from '../core/router.js';
+import { getRouterModuleDefinition } from './router-module.js';
 import { createSchemaRegistry } from '../validation/index.js';
 import { createMarkdownDocsState, joinDocsEndpoint, normalizeDocsBasePath, } from '../docs/index.js';
-import { isDevelopment, generateResourceRoutes, } from './fs-routes/index.js';
+import { createRouteInterceptors, isDevelopment, generateResourceRoutes, } from './fs-routes/index.js';
 import { createLogger, configureLogger, getLogger } from '../utils/logger.js';
 import { createPolicyBootstrap } from '../middleware/policy/index.js';
-import { createProcedureBuilder, createStreamBuilder, createEventBuilder, createGroupBuilder, } from './handler-builders.js';
+import { createProcedureBuilder, createStreamBuilder, createEventBuilder, createGroupBuilder, joinHandlerName, } from './handler-builders.js';
 import { createResourceBuilder } from './resource-builder.js';
 import { addCoLocatedPoliciesToEngine, buildCoLocatedAuthzInterceptorsForName, registerDiscoveredHandlers, resolveHooksForProcedure, } from './discovery-utils.js';
 import { createRegistrationService } from './orchestration/registration.js';
@@ -20,8 +21,6 @@ import { createFrontDoorBootstrap } from './front-door.js';
 import { createProtocolFusionDiagnosticsStore } from './protocol-fusion-diagnostics.js';
 import { createDiscoveryBootstrap } from './discovery-bootstrap.js';
 import { createServerLifecycle } from './builder/lifecycle.js';
-import { createGraphQLPolicyBridge, createChannelCoLocatedPolicyEnforcer, } from './builder/policy-bridges.js';
-import { createProgrammaticRegistration } from './builder/programmatic-registration.js';
 import { configureMetrics, configureTracing, createTelemetryState, } from './telemetry-bootstrap.js';
 import { adaptPinoLogger } from '../adapters/outbound/logger/pino.js';
 import { createServerPlanner } from './planner.js';
@@ -29,7 +28,7 @@ import { createServerRuntimePlanBuilder } from './runtime-plan.js';
 import { createHttpNamespace, createWebSocketNamespace, createStreamsNamespace, createRpcNamespace, createTcpNamespace, createUdpNamespace, createGrpcNamespace, } from './builder/protocol-namespaces.js';
 import { applyExtendedProtocolConfig } from './builder/with-protocols.js';
 import { applyResourceMap } from './builder/resources.js';
-import { createEnvelopeInterceptorFromOptions, programmaticSource, } from './builder/metadata.js';
+import { createEnvelopeInterceptorFromOptions, policyMetadataFromRouteMeta, programmaticSource, } from './builder/metadata.js';
 import { createServerPluginRuntime } from './builder/plugin-runtime.js';
 import { createProcedureOperationRegistrar } from './builder/operation-registrar.js';
 const logger = createLogger('server');
@@ -373,29 +372,11 @@ export function createServer(options) {
     // protected from the cleanup pass.
     let discoveredRoutes = new Set();
     function applyDiscoveryResult(result, isReload = true) {
-        // Hot reload: drop the previous load's accumulation so the next
-        // flush only contains policies for routes that survived. The
-        // engine entries themselves are overwritten by the engine's
-        // replace-in-place semantics on the next flush.
-        if (isReload) {
-            policyBootstrap?.coLocatedAccumulator.reset();
-        }
         const { discoveredNames } = registrationService.applyDiscoveryResult(result, channelRegistry, restResourceRegistry, tcpHandlers, udpHandlers, isReload ? discoveredRoutes : undefined);
         discoveredRoutes = discoveredNames;
-        // GraphQL resources also accumulate their co-located policies via
-        // `registerGraphQLResource` → `addCoLocatedPoliciesToEngine`, so
-        // they must run BEFORE the flush. Otherwise their accumulated
-        // policies are dropped because the flush already happened.
         for (const resource of result.graphqlResources) {
             registerGraphQLResource(resource);
         }
-        // Once every route, channel, and GraphQL resource in the load has
-        // been registered (and its co-located policies accumulated),
-        // materialise the union into the engine. One policy per
-        // (source, index), regardless of how many routes referenced it.
-        if (policyBootstrap) {
-            policyBootstrap.coLocatedAccumulator.flush();
-        }
         advanceApiDocumentationRevision();
     }
     const previewContext = serverPlanner.createPreviewContext({
@@ -460,6 +441,53 @@ export function createServer(options) {
             })),
         })
         : undefined;
+    function createGraphQLPolicyBridge(bootstrap) {
+        if (!bootstrap)
+            return undefined;
+        return {
+            async evaluate(ctx, authz, value, args, parent) {
+                const principal = await bootstrap.resolvePrincipal(ctx);
+                const rawResource = await authz.resource(value, args, ctx, parent);
+                const resources = rawResource == null
+                    ? [{ type: '*', id: '*', tenantId: principal.tenantId }]
+                    : Array.isArray(rawResource)
+                        ? rawResource
+                        : [rawResource];
+                if (resources.length === 0) {
+                    resources.push({ type: '*', id: '*', tenantId: principal.tenantId });
+                }
+                const protocol = ctx.protocol;
+                const protocolValue = typeof protocol === 'string' ? protocol : 'graphql';
+                let lastDecision;
+                if (authz.mode === 'any') {
+                    for (const resource of resources) {
+                        const decision = await bootstrap.engine.evaluate({
+                            principal,
+                            action: authz.action,
+                            resource,
+                            protocol: protocolValue,
+                        });
+                        lastDecision = decision;
+                        if (decision.allowed)
+                            return decision;
+                    }
+                    return lastDecision;
+                }
+                for (const resource of resources) {
+                    const decision = await bootstrap.engine.evaluate({
+                        principal,
+                        action: authz.action,
+                        resource,
+                        protocol: protocolValue,
+                    });
+                    lastDecision = decision;
+                    if (!decision.allowed)
+                        return decision;
+                }
+                return lastDecision;
+            },
+        };
+    }
     const serverLifecycle = createServerLifecycle({
         logger,
         state: serverState,
@@ -495,7 +523,20 @@ export function createServer(options) {
         getWsSubscribeHandler: () => wsSubscribeHandler,
         getWsMessageHandler: () => wsMessageHandler,
         getWsUnsubscribeHandler: () => wsUnsubscribeHandler,
-        channelCoLocatedPolicyEnforcer: createChannelCoLocatedPolicyEnforcer(policyBootstrap),
+        channelCoLocatedPolicyEnforcer: policyBootstrap
+            ? async (channelName, policies, ctx) => {
+                addCoLocatedPoliciesToEngine(channelName, policies, { bootstrap: policyBootstrap }, undefined, { route: channelName });
+                const principal = await policyBootstrap.resolvePrincipal(ctx);
+                const ctxProtocol = ctx.protocol;
+                const decision = await policyBootstrap.engine.evaluate({
+                    principal,
+                    action: channelName,
+                    resource: { type: 'channel', id: channelName, tenantId: principal.tenantId },
+                    protocol: typeof ctxProtocol === 'string' ? ctxProtocol : 'websocket',
+                });
+                return decision.allowed;
+            }
+            : undefined,
         graphqlPolicyBridge: createGraphQLPolicyBridge(policyBootstrap),
     });
     /**
@@ -542,28 +583,6 @@ export function createServer(options) {
             },
         })
         : undefined;
-    // Programmatic registration methods (mount + addX + registerHandler)
-    // are produced by a factory and spread into the server object below.
-    // `getServer` is a thunk because the methods return `server` for
-    // chaining, and `server` is defined immediately after this call.
-    const programmaticRegistration = createProgrammaticRegistration({
-        registry,
-        schemaRegistry,
-        globalInterceptors,
-        normalizeInterceptors,
-        policyInterceptorFactory,
-        policyDefaultMode,
-        noPolicyDeclaredFactory,
-        recordOperationRegistration,
-        registerProcedureOperation,
-        registerChannel,
-        registerRestResource,
-        registerResource,
-        registerTcpHandler,
-        registerUdpHandler,
-        logger,
-        getServer: () => server,
-    });
     const server = {
         // === Authorization (policies) ===
         policy: policyNamespace,
@@ -928,7 +947,247 @@ export function createServer(options) {
         group(prefix) {
             return createGroupBuilder(registry, schemaRegistry, prefix, [...globalInterceptors], hooksResolver, envelopeInterceptor);
         },
-        ...programmaticRegistration,
+        mount(prefix, module, options = {}) {
+            const definition = getRouterModuleDefinition(module);
+            const mountInterceptors = options.interceptors ?? [];
+            for (const route of definition.routes) {
+                const fullName = joinHandlerName(prefix, route.name);
+                const routeSchema = route.kind === 'procedure' ? route.schema : undefined;
+                // Synthesize policy interceptor at mount-time using the host server's
+                // factory. Module routes carry `route.authz` (resolved from per-procedure
+                // .authz() or module's defaultAuthz). When defaultMode is 'deny' and
+                // no authz was declared, inject the no-policy-declared deny.
+                const authzInterceptors = [];
+                if (route.kind === 'procedure') {
+                    if (route.authz && policyInterceptorFactory) {
+                        authzInterceptors.push(policyInterceptorFactory(fullName, route.authz));
+                    }
+                    else if (!route.authz &&
+                        policyDefaultMode === 'deny' &&
+                        noPolicyDeclaredFactory) {
+                        authzInterceptors.push(noPolicyDeclaredFactory(fullName));
+                    }
+                }
+                const interceptors = normalizeInterceptors([
+                    ...globalInterceptors,
+                    ...mountInterceptors,
+                    ...route.moduleInterceptors,
+                    ...authzInterceptors,
+                    ...route.interceptors,
+                ], routeSchema);
+                if (route.schema) {
+                    schemaRegistry.register(fullName, route.schema);
+                }
+                if (route.kind === 'procedure') {
+                    registry.procedure(fullName, route.handler, {
+                        summary: route.summary,
+                        description: route.description,
+                        tags: route.tags,
+                        graphql: route.graphql,
+                        httpPath: route.httpPath,
+                        httpMethod: route.httpMethod,
+                        jsonrpc: route.jsonrpc,
+                        grpc: route.grpc,
+                        authz: route.authz,
+                        interceptors: interceptors.length > 0 ? interceptors : undefined,
+                    });
+                }
+                else if (route.kind === 'stream') {
+                    registry.stream(fullName, route.handler, {
+                        description: route.description,
+                        direction: route.streamDirection,
+                        interceptors: interceptors.length > 0 ? interceptors : undefined,
+                    });
+                }
+                else {
+                    registry.event(fullName, route.handler, {
+                        description: route.description,
+                        delivery: route.delivery,
+                        retryPolicy: route.retryPolicy,
+                        deduplicationWindow: route.deduplicationWindow,
+                        interceptors: interceptors.length > 0 ? interceptors : undefined,
+                    });
+                }
+            }
+            return server;
+        },
+        // === Programmatic Registration ===
+        addProcedure(input) {
+            // Normalize input (LoadedRoute has 'handler' directly, AddProcedureInput also has 'handler')
+            const name = input.name;
+            const handler = input.handler;
+            const inputSchema = input.inputSchema;
+            const outputSchema = input.outputSchema;
+            const summary = 'meta' in input ? input.meta?.summary : input.summary;
+            const description = 'meta' in input ? input.meta?.description : input.description;
+            const tags = 'meta' in input ? input.meta?.tags : input.tags;
+            const graphql = 'meta' in input ? input.meta?.graphql : input.graphql;
+            const httpPath = 'meta' in input ? input.meta?.httpPath : input.httpPath;
+            const httpMethod = 'meta' in input ? input.meta?.httpMethod : input.httpMethod;
+            const jsonrpc = 'meta' in input ? input.meta?.jsonrpc : input.jsonrpc;
+            const grpc = 'meta' in input ? input.meta?.grpc : input.grpc;
+            const policies = 'meta' in input
+                ? policyMetadataFromRouteMeta(input.meta)
+                : input.policies;
+            const routeInterceptors = 'middlewares' in input ? createRouteInterceptors(input) : [];
+            const inputInterceptors = 'interceptors' in input ? input.interceptors ?? [] : [];
+            registerProcedureOperation({
+                name,
+                handler,
+                inputSchema,
+                outputSchema,
+                summary,
+                description,
+                tags,
+                graphql,
+                httpPath,
+                httpMethod,
+                jsonrpc,
+                grpc,
+                policies,
+                interceptors: [...routeInterceptors, ...inputInterceptors],
+                registration: {
+                    source: 'filePath' in input
+                        ? { kind: 'discovery', location: input.filePath }
+                        : programmaticSource(),
+                },
+            });
+            logger.debug({ name }, 'Added procedure');
+            return server;
+        },
+        addStream(input) {
+            const name = input.name;
+            const handler = input.handler;
+            const inputSchema = input.inputSchema;
+            const outputSchema = input.outputSchema;
+            const description = 'meta' in input ? input.meta?.description : input.description;
+            const direction = 'meta' in input ? input.meta?.direction : input.direction;
+            const policies = 'meta' in input
+                ? policyMetadataFromRouteMeta(input.meta)
+                : input.policies;
+            const routeInterceptors = 'middlewares' in input ? createRouteInterceptors(input) : [];
+            const inputInterceptors = 'interceptors' in input ? input.interceptors ?? [] : [];
+            const interceptors = [...globalInterceptors, ...routeInterceptors, ...inputInterceptors];
+            if (inputSchema || outputSchema) {
+                const schema = {};
+                if (inputSchema)
+                    schema.input = inputSchema;
+                if (outputSchema)
+                    schema.output = outputSchema;
+                schemaRegistry.register(name, schema);
+            }
+            registry.stream(name, handler, {
+                description,
+                direction,
+                policies,
+                interceptors: interceptors.length > 0 ? interceptors : undefined,
+            });
+            recordOperationRegistration(name, {
+                source: 'filePath' in input
+                    ? { kind: 'discovery', location: input.filePath }
+                    : programmaticSource(),
+            });
+            logger.debug({ name }, 'Added stream');
+            return server;
+        },
+        addEvent(input) {
+            const name = input.name;
+            const handler = input.handler;
+            const inputSchema = input.inputSchema;
+            const description = 'meta' in input ? input.meta?.description : input.description;
+            const delivery = 'meta' in input ? input.meta?.delivery : input.delivery;
+            const retryPolicy = 'meta' in input ? input.meta?.retryPolicy : input.retryPolicy;
+            const deduplicationWindow = 'meta' in input ? input.meta?.deduplicationWindow : input.deduplicationWindow;
+            const policies = 'meta' in input
+                ? policyMetadataFromRouteMeta(input.meta)
+                : input.policies;
+            const routeInterceptors = 'middlewares' in input ? createRouteInterceptors(input) : [];
+            const inputInterceptors = 'interceptors' in input ? input.interceptors ?? [] : [];
+            const interceptors = [...globalInterceptors, ...routeInterceptors, ...inputInterceptors];
+            if (inputSchema) {
+                schemaRegistry.register(name, { input: inputSchema });
+            }
+            registry.event(name, handler, {
+                description,
+                delivery,
+                retryPolicy,
+                deduplicationWindow,
+                policies,
+                interceptors: interceptors.length > 0 ? interceptors : undefined,
+            });
+            recordOperationRegistration(name, {
+                source: 'filePath' in input
+                    ? { kind: 'discovery', location: input.filePath }
+                    : programmaticSource(),
+            });
+            logger.debug({ name }, 'Added event');
+            return server;
+        },
+        addChannel(channel) {
+            registerChannel(channel);
+            logger.debug({ name: channel.name }, 'Channel configuration registered');
+            return server;
+        },
+        addRest(resource) {
+            registerRestResource(resource);
+            return server;
+        },
+        addResource(resource) {
+            registerResource(resource);
+            return server;
+        },
+        addTcpHandler(handler) {
+            registerTcpHandler(handler);
+            return server;
+        },
+        addUdpHandler(handler) {
+            registerUdpHandler(handler);
+            return server;
+        },
+        registerHandler(name, handler, opts) {
+            const kind = opts?.kind ?? 'procedure';
+            if (kind === 'stream') {
+                return server.addStream({
+                    name,
+                    handler: handler,
+                    inputSchema: opts?.input,
+                    outputSchema: opts?.output,
+                    direction: opts?.direction,
+                    description: opts?.description,
+                    policies: opts?.policies,
+                    interceptors: opts?.interceptors,
+                });
+            }
+            if (kind === 'event') {
+                return server.addEvent({
+                    name,
+                    handler: handler,
+                    inputSchema: opts?.input,
+                    description: opts?.description,
+                    delivery: opts?.delivery,
+                    retryPolicy: opts?.retryPolicy,
+                    deduplicationWindow: opts?.deduplicationWindow,
+                    policies: opts?.policies,
+                    interceptors: opts?.interceptors,
+                });
+            }
+            return server.addProcedure({
+                name,
+                handler: handler,
+                inputSchema: opts?.input,
+                outputSchema: opts?.output,
+                summary: opts?.summary,
+                description: opts?.description,
+                tags: opts?.tags,
+                graphql: opts?.graphql,
+                httpPath: opts?.httpPath,
+                httpMethod: opts?.httpMethod,
+                jsonrpc: opts?.jsonrpc,
+                grpc: opts?.grpc,
+                policies: opts?.policies,
+                interceptors: opts?.interceptors,
+            });
+        },
         addDiscovery(result) {
             // `addDiscovery` accepts a complete view of the discovered surface.
             // Whether this is the initial load or a subsequent re-application