@argentic/chest-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Argentic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,206 @@
+# Chest SDK
+
+`@argentic/chest-sdk` is what a server tool (tool contract v2) embeds to talk
+with its Chest: the member the Chest asserts on a request, the address of the
+tool's own database and its private files. The SDK has no dependency: it only
+imports `node:*`.
+
+```sh
+npm install @argentic/chest-sdk
+```
+
+Node 22 or later. ESM only, compiled JavaScript with its type declarations.
+
+## Imports
+
+Each module is its own subpath and pulls in nothing else; the root gives them
+all, with the files API as the namespace `files`.
+
+| Import | Gives |
+|---|---|
+| `@argentic/chest-sdk/member` | `member(request)`, type `Member`: the member of a request on the team host of a server tool, read from the `Chest-Member` assertion and verified; `null` without a valid assertion |
+| `@argentic/chest-sdk/database` | `databaseUrl()`: the address of the tool's own PostgreSQL database (capability `database`) |
+| `@argentic/chest-sdk/files` | `put`, `get`, `list`, `delete`, `url`, types `FileObject`, `FileData`, `FilePage`: the tool's private files (capability `files`), kept by the Chest, and a 15-minute signed link to one |
+| `@argentic/chest-sdk/errors` | `ChestError` (`code`, `status`), `CapabilityNotGranted` (403), `TooLarge` (413), `QuotaExceeded` (429), `Unavailable` (503): what the SDK throws when the Chest does not give what a tool asks |
+| `@argentic/chest-sdk` | all of the above; `files` as a namespace |
+
+```ts
+import { member } from "@argentic/chest-sdk/member";
+import { databaseUrl } from "@argentic/chest-sdk/database";
+import * as files from "@argentic/chest-sdk/files";
+import { CapabilityNotGranted } from "@argentic/chest-sdk/errors";
+// or: import { member, databaseUrl, files } from "@argentic/chest-sdk";
+```
+
+Types refer to `node:http` (`IncomingMessage`): a TypeScript project needs
+`@types/node`, as any Node project does. Both `moduleResolution` `bundler` and
+`nodenext` work.
+
+### Next.js
+
+The SDK runs on the server only — it reads the tool's environment
+(`CHEST_TOKEN`, `DATABASE_URL`, `CHEST_API`) and uses Node built-ins. Import it
+in route handlers, server components or server actions, never in a
+`"use client"` module. Webpack and Turbopack resolve the
+compiled package with no configuration (no `transpilePackages`):
+
+```ts
+// app/chest/api/me/route.ts
+import { member } from "@argentic/chest-sdk/member";
+
+export function GET(request: Request) {
+  const who = member(request);
+  return who ? Response.json(who) : new Response(null, { status: 401 });
+}
+```
+
+## The contract, in short
+
+A v2 tool is an ordinary web server in a container without network, run by
+its Chest. The Chest's front is the only one to reach it; the tool reaches only
+what its launcher gives it on `127.0.0.1` (its database, the Chest's API for
+its files). Rights come from the Chest — the signed member, the capabilities
+approved for the version — and the Chest enforces them even outside the SDK:
+the SDK makes the calls easier, it is not a security boundary. The full
+contract (manifest `chest.json`, capabilities, build from source, catalogue)
+is described in the Chest repository, `docs/architecture.md`.
+
+## `member(request)` — server tool (contract v2)
+
+A v2 tool is an ordinary web server; on its team host, the Chest relays
+`/chest` and everything below it with the `Chest-Member` header of the
+signed-in member. `member(request)` accepts a Node request (`IncomingMessage`)
+or a Web `Request` and returns:
+
+```ts
+type Member = { id: string; firstName: string; lastName: string; name: string; email: string; photo?: string; role?: string; isAdmin: boolean; isBuilder: boolean };
+```
+
+or `null`: without the header, on the public host (the Chest never sends an
+assertion there and strips a client's), or for any assertion that is not
+exactly its own. Checks: compact JWS, header exactly
+`{"alg":"HS256","typ":"JWT"}`, HMAC-SHA256 signature compared in constant time
+under the key HMAC-SHA256("Chest-Member v1") of the text of `CHEST_TOKEN` —
+the Chest's derivation —, `aud` equal to `CHEST_TOOL`, `iat` and `exp` within
+5 s, the shape of each claim (an unknown claim is ignored). Without
+`CHEST_TOKEN` or `CHEST_TOOL`, nobody is a member. The function never throws
+for what a request carries.
+
+```ts
+import { member } from "@argentic/chest-sdk/member";
+const who = member(request);
+if (!who) { response.writeHead(401).end(); return; }
+```
+
+`photo` is the address of the photo on the team host, `role` the role the
+Chest gives the member among those the manifest declares. Only the Chest's
+front reaches the container: the signature is a second defence; business rules
+(who writes what) remain the tool's.
+
+## `databaseUrl()` — database of a server tool
+
+A v2 tool that declares `"capabilities": ["database"]` in its `chest.json`
+gets a PostgreSQL database of its own (the capability is shown and approved
+like a permission, « Base de données »). The container has no network: its
+launcher listens on `127.0.0.1` and relays each connection to the Chest. The
+launcher sets `DATABASE_URL` —
+`postgres://<user>:<password>@127.0.0.1:<port>/<database>?sslmode=disable`,
+the user and the database both named `t_<tool>` — and `PGHOST`, `PGPORT`,
+`PGUSER`, `PGPASSWORD`, `PGDATABASE`, which take precedence over a variable of
+the tool with the same name. `databaseUrl()` returns `DATABASE_URL` when it has
+exactly this shape, and throws `CapabilityNotGranted` otherwise (a version
+without the capability, or a `DATABASE_URL` of the tool's own). The value is a
+secret: never log it, never send it to a browser.
+
+The SDK carries no PostgreSQL client: the tool picks its own, for example
+[`postgres`](https://github.com/porsager/postgres) (porsager, no dependency) or
+[`pg`](https://node-postgres.com):
+
+```ts
+import postgres from "postgres";
+import { databaseUrl } from "@argentic/chest-sdk/database";
+const sql = postgres(databaseUrl(), { max: 5 });
+const notes = await sql`SELECT id, text FROM notes ORDER BY id`;
+```
+
+Ten connections at most per instance; a query longer than 30 s, a transaction
+idle longer than 60 s are interrupted by the Chest. **Migrations**: the
+repository's `migrations/NNNN_name.sql` files
+(`^[0-9]{4}_[a-z0-9_-]{1,64}\.sql$`, 256 at most, 1 MiB each) are run by the
+Chest, in order, each in its own transaction, at install and at every update,
+before the new version receives traffic; a failing file keeps the version in
+service. The Chest keeps the list of files run (table `chest_migrations`): a
+version that loses one or changes one is refused. A migration must leave the
+previous version working — going back to the previous version undoes nothing.
+
+## `files` — files of a server tool
+
+A v2 tool that declares `"capabilities": ["files"]` (« Fichiers » at approval)
+keeps private files **through its Chest**, never on its disk (the container's
+root is read-only): 1 GiB and 10,000 objects per tool, 32 MiB per object. The
+launcher gives the tool `CHEST_API=http://127.0.0.1:<port>` — its own port,
+relayed to the Chest; the container has no network — and the instance is the
+identity: the tool reaches its own files only.
+
+```ts
+import * as files from "@argentic/chest-sdk/files";
+await files.put("photos/cat.png", bytes, "image/png");       // Uint8Array or text
+const file = await files.get("photos/cat.png");              // {data, type, size} or null
+const { files: page, next } = await files.list({ prefix: "photos/" }); // 1000 per page
+await files.delete("photos/cat.png");                        // true, or false if it did not exist
+const { url, expiresIn } = await files.url("photos/cat.png");
+```
+
+A name: up to 8 segments of 1 to 100 letters, digits, `.`, `_` or `-`,
+separated by `/`, none starting with `.` or `-`; refused before anything is
+sent otherwise (`ChestError`, `invalid_name`). `url` signs a link to the file
+as it is, on the tool's **team host** (`/_chest/files/…`): whoever has it opens
+it without signing in for 15 minutes, or until the file changes or goes; the
+Chest serves it in a sandbox, displayed for an image, a PDF or plain text,
+downloaded otherwise. Give it to a member's browser, never to a public page.
+Errors: `CapabilityNotGranted` (a version without the capability, or no
+`CHEST_API`), `TooLarge` (413), `QuotaExceeded` (429), `Unavailable` (the
+Chest not reached, or an answer that is not its own: a write may or may not
+have happened), `ChestError` for the rest (`invalid_type`, `not_found` for
+`url`…). Removing the tool removes its files; a new version keeps them.
+
+## Retired v1 contract
+
+Tool contract v1 (a worker talking over stdout/stdin: invocations, a record)
+is retired and **not part of the package**. Its modules,
+`client/src/{channel,record,requests,worker}.ts` and
+`client/test/worker.test.ts`, stay in this repository only because the Chest
+repository vendors `client/src`, `client/test` and `template/` by exact file
+list (`scripts/sync-sdk.mjs`, copies under `tests/sdk/chest-client` and
+`tests/creator`, each with a `VENDORED.md` naming the commit); they go once the
+Chest repository drops them. They are not built into `dist/`, not exported and
+not published. `template/` (the v1 starter project) is not published either.
+
+## Version
+
+The package version is `version` in `package.json` (semver), published by a
+tag `vX.Y.Z` (see `PUBLISHING.md`).
+
+## What this repository is not
+
+This repository is public and **is not a tool**: it has no `chest.json`, and a
+Chest's catalogue — which only lists the organisation's public repositories
+that carry a manifest — never offers it.
+
+## Develop
+
+```sh
+npm ci
+npm test               # build dist/, compile all tests (v1 included) into build/, run them
+npm run check:package  # npm pack, install into a temp project, import every subpath
+                       # from Node and through esbuild, type-check a TS consumer
+```
+
+`client/src` holds the modules, `client/index.ts` the package root,
+`client/test` the tests. `npm run build` compiles `client/index.ts` and the
+four published modules (`errors`, `member`, `database`, `files`; TypeScript
+strict, ES2022, NodeNext) into `dist/`: ESM `.js`, `.d.ts` and their maps. Read `AGENTS.md` before changing anything.
+
+## Licence
+
+MIT (`LICENSE`), © 2026 Argentic.

package/client/index.ts

@@ -0,0 +1,11 @@
+// The package root: every published module of the SDK (tool contract v2).
+// Each one is also its own subpath (@argentic/chest-sdk/member, /database,
+// /files, /errors), which pulls in nothing else. The files API is a namespace
+// here, as its names (get, put, list, delete, url) are too plain to stand
+// alone. channel, record, requests and worker in client/src are the retired
+// v1 contract: kept for the Chest repository's vendored copy, never built
+// into nor published with the package.
+export * from "./src/errors.js";
+export * from "./src/member.js";
+export * from "./src/database.js";
+export * as files from "./src/files.js";

package/client/src/database.ts

@@ -0,0 +1,28 @@
+import { CapabilityNotGranted } from "./errors.js";
+
+// The address of the tool's own PostgreSQL database, as the Chest gives it
+// to a server tool whose chest.json declares "capabilities": ["database"]:
+// postgres://<user>:<password>@127.0.0.1:<port>/<database>?sslmode=disable,
+// where the port is the tool's launcher, which relays each connection to the
+// Chest (the container has no network). Hand it to a PostgreSQL client —
+// postgres (porsager) or pg; the SDK carries none. PGHOST, PGPORT, PGUSER,
+// PGPASSWORD and PGDATABASE say the same for a client that reads them.
+//
+// Throws CapabilityNotGranted when the Chest gave no database: the version
+// does not declare it, or a DATABASE_URL of the tool's own is not the
+// Chest's. The value is a secret: never log it, never send it to a browser.
+export function databaseUrl(): string {
+  const value = process.env["DATABASE_URL"];
+  if (typeof value !== "string" || value.length > 1024) throw new CapabilityNotGranted("database");
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CapabilityNotGranted("database");
+  }
+  const port = Number(url.port);
+  if (url.protocol !== "postgres:" || url.hostname !== "127.0.0.1" || !Number.isInteger(port) || port < 1 || port > 65535 || !/^t_[a-z][a-z0-9_]{0,47}$/u.test(url.username) || url.pathname !== "/" + url.username || url.password === "" || url.search !== "?sslmode=disable" || url.hash !== "") {
+    throw new CapabilityNotGranted("database");
+  }
+  return value;
+}

package/client/src/errors.ts

@@ -0,0 +1,44 @@
+// What the SDK throws when the Chest does not give what a tool asks: a code
+// the tool can test, and the HTTP status the Chest answers for it.
+export class ChestError extends Error {
+  readonly code: string;
+  readonly status: number;
+  constructor(code: string, status: number, message: string) {
+    super(message);
+    this.name = new.target.name;
+    this.code = code;
+    this.status = status;
+  }
+}
+
+// The version of the tool in service does not declare the capability in its
+// chest.json ("capabilities"), or it was not approved: the Chest gives it
+// nothing.
+export class CapabilityNotGranted extends ChestError {
+  constructor(capability: string) {
+    super("capability_not_granted", 403, `the Chest did not grant the capability "${capability}" to this version of the tool`);
+  }
+}
+
+// What the tool keeps would go beyond what its Chest gives it: its total
+// (1 GiB of files) or its count (10,000 objects).
+export class QuotaExceeded extends ChestError {
+  constructor() {
+    super("quota_exceeded", 429, "the Chest refused: the tool's quota would be exceeded");
+  }
+}
+
+// One object is beyond the bound of one (32 MiB for a file).
+export class TooLarge extends ChestError {
+  constructor() {
+    super("too_large", 413, "the Chest refused: the object is too large");
+  }
+}
+
+// The Chest did not answer, or not as it does: nothing is known of what was
+// asked — a write may or may not have happened.
+export class Unavailable extends ChestError {
+  constructor() {
+    super("unavailable", 503, "the Chest is unavailable");
+  }
+}

package/client/src/files.ts

@@ -0,0 +1,181 @@
+import { CapabilityNotGranted, ChestError, QuotaExceeded, TooLarge, Unavailable } from "./errors.js";
+
+// The private files of a server tool whose chest.json declares
+// "capabilities": ["files"]: kept by its Chest (1 GiB, 10,000 objects, 32 MiB
+// each), never on the tool's own disk. The container has no network: the
+// Chest's API is at CHEST_API (http://127.0.0.1:<port>, the tool's launcher,
+// which relays each request to the Chest). A call reaches the tool's files
+// only: its instance is its identity.
+//
+//   import * as files from "../../packages/chest-client/src/files.js";
+//   await files.put("photos/cat.png", bytes, "image/png");
+//   const { url } = await files.url("photos/cat.png");   // 15 min, team host
+//
+// Names: up to 8 segments of 1–100 letters, digits, '.', '_' or '-',
+// separated by '/', none starting with '.' or '-'. Errors: CapabilityNotGranted
+// (403), TooLarge (413), QuotaExceeded (429), Unavailable (503, or the Chest
+// not reached), ChestError otherwise (invalid_name, invalid_type 400…).
+
+export type FileObject = { name: string; type: string; size: number; updated: string };
+export type FileData = { data: Uint8Array; type: string; size: number };
+export type FilePage = { files: FileObject[]; next: string | null };
+
+const maxObject = 32 << 20;
+const maxAnswer = 4 << 20;
+const deadline = 120000;
+const namePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}(\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}){0,7}$/u;
+
+// base is the Chest's API as the launcher gives it; without, the version
+// does not keep files.
+function base(): string {
+  const value = process.env["CHEST_API"];
+  if (typeof value !== "string" || !/^http:\/\/127\.0\.0\.1:[1-9][0-9]{0,4}$/u.test(value) || Number(value.slice(17)) > 65535) throw new CapabilityNotGranted("files");
+  return value;
+}
+
+function checkName(name: unknown): string {
+  if (typeof name !== "string" || !namePattern.test(name)) throw new ChestError("invalid_name", 400, "invalid file name");
+  return name;
+}
+
+// ask sends one request to the Chest; a failure to reach it is Unavailable.
+async function ask(method: string, path: string, init: { body?: Uint8Array<ArrayBuffer> | string; type?: string } = {}): Promise<Response> {
+  const headers: Record<string, string> = {};
+  if (init.type !== undefined) headers["Content-Type"] = init.type;
+  try {
+    return await fetch(base() + path, { method, headers, ...(init.body !== undefined ? { body: init.body } : {}), redirect: "error", signal: AbortSignal.timeout(deadline) });
+  } catch (error) {
+    if (error instanceof ChestError) throw error;
+    throw new Unavailable();
+  }
+}
+
+// read takes a body of limit bytes at most; beyond, or cut, the answer is not
+// the Chest's.
+async function read(response: Response, limit: number): Promise<Uint8Array> {
+  const declared = Number(response.headers.get("content-length") ?? "0");
+  if (declared > limit) throw new Unavailable();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for await (const chunk of response.body ?? []) {
+      size += chunk.byteLength;
+      if (size > limit) throw new Unavailable();
+      chunks.push(chunk);
+    }
+  } catch {
+    throw new Unavailable();
+  }
+  const all = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    all.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return all;
+}
+
+async function json(response: Response): Promise<unknown> {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await read(response, maxAnswer)));
+  } catch (error) {
+    if (error instanceof ChestError) throw error;
+    throw new Unavailable();
+  }
+}
+
+// refusal turns an answer that is not a success into what the tool tests.
+async function refusal(response: Response): Promise<ChestError> {
+  if (response.status === 403) return new CapabilityNotGranted("files");
+  if (response.status === 413) return new TooLarge();
+  if (response.status === 429) return new QuotaExceeded();
+  if (response.status >= 500) return new Unavailable();
+  let code = "refused";
+  try {
+    const body = await json(response);
+    const given = (body as { error?: unknown } | null)?.error;
+    if (typeof given === "string" && /^[a-z_]{1,40}$/u.test(given)) code = given;
+  } catch {
+    // The code stays « refused ».
+  }
+  return new ChestError(code, response.status, `the Chest refused: ${code}`);
+}
+
+function isObject(value: unknown): value is FileObject {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value as Record<string, unknown>;
+  return typeof o["name"] === "string" && namePattern.test(o["name"]) && typeof o["type"] === "string" && o["type"].length <= 200 && typeof o["size"] === "number" && Number.isSafeInteger(o["size"]) && o["size"] >= 0 && typeof o["updated"] === "string";
+}
+function object(value: unknown): FileObject {
+  if (!isObject(value)) throw new Unavailable();
+  return { name: value.name, type: value.type, size: value.size, updated: value.updated };
+}
+
+// put keeps data as the file name, of type type (application/octet-stream
+// when none), replacing the one of that name.
+export async function put(name: string, data: Uint8Array | string, type?: string): Promise<FileObject> {
+  checkName(name);
+  if (!(data instanceof Uint8Array) && typeof data !== "string") throw new TypeError("data must be bytes or text");
+  const body = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+  if (body.byteLength > maxObject) throw new TooLarge();
+  const response = await ask("PUT", "/files/" + name, { body, type: type ?? (typeof data === "string" ? "text/plain; charset=utf-8" : "application/octet-stream") });
+  if (response.status !== 201) throw await refusal(response);
+  return object(await json(response));
+}
+
+// get reads a file; null when the tool has none of that name.
+export async function get(name: string): Promise<FileData | null> {
+  checkName(name);
+  const response = await ask("GET", "/files/" + name);
+  if (response.status === 404) {
+    await response.body?.cancel();
+    return null;
+  }
+  if (response.status !== 200) throw await refusal(response);
+  const data = await read(response, maxObject);
+  return { data, type: response.headers.get("content-type") ?? "application/octet-stream", size: data.byteLength };
+}
+
+// list says the files whose name starts with prefix, in the order of their
+// names, after the name after, 1000 at most; next is the name to ask after
+// for the following page, null once all were said.
+export async function list(options: { prefix?: string; after?: string } = {}): Promise<FilePage> {
+  const query = new URLSearchParams();
+  if (options.prefix !== undefined && options.prefix !== "") {
+    if (typeof options.prefix !== "string" || options.prefix.length > 807 || !/^[A-Za-z0-9._\/-]*$/u.test(options.prefix)) throw new ChestError("invalid_name", 400, "invalid prefix");
+    query.set("prefix", options.prefix);
+  }
+  if (options.after !== undefined && options.after !== "") query.set("after", checkName(options.after));
+  const response = await ask("GET", "/files" + (query.size ? "?" + query.toString() : ""));
+  if (response.status !== 200) throw await refusal(response);
+  const body = await json(response);
+  const page = body as { files?: unknown; next?: unknown } | null;
+  if (!page || !Array.isArray(page.files) || page.files.length > 1000 || !(page.next === null || (typeof page.next === "string" && namePattern.test(page.next)))) throw new Unavailable();
+  return { files: page.files.map(object), next: page.next };
+}
+
+// remove deletes a file; false when the tool had none of that name.
+async function remove(name: string): Promise<boolean> {
+  checkName(name);
+  const response = await ask("DELETE", "/files/" + name);
+  if (response.status === 204) return true;
+  if (response.status === 404) {
+    await response.body?.cancel();
+    return false;
+  }
+  throw await refusal(response);
+}
+export { remove as delete };
+
+// url signs a link to the file as it is now, on the tool's team host: anyone
+// who has it opens the file, without signing in, for expiresIn seconds
+// (15 minutes), or until the file changes or goes. Give it to a member's
+// browser, never to a public page.
+export async function url(name: string): Promise<{ url: string; expiresIn: number }> {
+  checkName(name);
+  const response = await ask("POST", "/files/url", { body: JSON.stringify({ name }), type: "application/json" });
+  if (response.status !== 200) throw await refusal(response);
+  const body = (await json(response)) as { url?: unknown; expires_in?: unknown } | null;
+  if (!body || typeof body.url !== "string" || !/^https:\/\/[^/?#]+\/_chest\/files\/[A-Za-z0-9_.-]{1,1536}$/u.test(body.url) || typeof body.expires_in !== "number" || !Number.isInteger(body.expires_in) || body.expires_in <= 0) throw new Unavailable();
+  return { url: body.url, expiresIn: body.expires_in };
+}

package/client/src/member.ts

@@ -0,0 +1,75 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import type { IncomingMessage } from "node:http";
+
+// The member the Chest asserts on a request of the team host of a server
+// tool (/chest and below), read from the Chest-Member header. photo and role
+// are absent when the Chest names none.
+export type Member = {
+  id: string;
+  firstName: string;
+  lastName: string;
+  name: string;
+  email: string;
+  photo?: string;
+  role?: string;
+  isAdmin: boolean;
+  isBuilder: boolean;
+};
+
+// The key of the assertions is HMAC-SHA256 of this label under the text of
+// CHEST_TOKEN, exactly as the Chest derives it (chest/toolfront).
+const label = "Chest-Member v1";
+// Clocks of the Chest and of the container may differ by this much, in seconds.
+const skew = 5;
+// An assertion is a few hundred bytes; anything longer is not one.
+const maxLength = 8192;
+const compact = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/u;
+const claims = ["iss", "aud", "iat", "exp", "sub", "given_name", "family_name", "name", "email", "picture", "role", "admin", "builder"] as const;
+
+function assertionOf(request: IncomingMessage | Request): string | null {
+  const headers = request.headers as Headers | IncomingMessage["headers"];
+  // A Web Request joins repeated headers with ", ", which no assertion
+  // contains; a Node request keeps them as an array: both are refused.
+  const value = typeof (headers as Headers).get === "function" ? (headers as Headers).get("chest-member") : (headers as IncomingMessage["headers"])["chest-member"];
+  return typeof value === "string" && value.length <= maxLength ? value : null;
+}
+
+function json(part: string): Record<string, unknown> | null {
+  try {
+    const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8")) as unknown;
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : null;
+  } catch {
+    return null;
+  }
+}
+
+// member returns who the Chest says is making this request, or null when the
+// request carries no valid assertion — absent, malformed, signed with another
+// key, for another tool, expired or not yet valid —, or when CHEST_TOKEN or
+// CHEST_TOOL is missing. It never throws for what a request carries. Only the
+// Chest's front reaches the tool; the signature is a second defence, and the
+// tool still decides what a member may do with its own rules.
+export function member(request: IncomingMessage | Request): Member | null {
+  const token = process.env["CHEST_TOKEN"];
+  const tool = process.env["CHEST_TOOL"];
+  if (!token || !/^[A-Za-z0-9_-]{43,512}$/u.test(token) || !tool) return null;
+  const assertion = assertionOf(request);
+  const parts = assertion === null ? null : compact.exec(assertion);
+  if (!parts) return null;
+  const [, encodedHeader = "", encodedPayload = "", encodedSignature = ""] = parts;
+  const header = json(encodedHeader);
+  if (!header || Object.keys(header).length !== 2 || header["alg"] !== "HS256" || header["typ"] !== "JWT") return null;
+  const key = createHmac("sha256", Buffer.from(token, "utf8")).update(label).digest();
+  const expected = createHmac("sha256", key).update(encodedHeader + "." + encodedPayload).digest();
+  const signature = Buffer.from(encodedSignature, "base64url");
+  if (signature.length !== expected.length || !timingSafeEqual(signature, expected)) return null;
+  const payload = json(encodedPayload);
+  if (!payload || !claims.every(name => Object.hasOwn(payload, name))) return null;
+  const { iss, aud, iat, exp, sub, given_name, family_name, name, email, picture, role, admin, builder } = payload;
+  if (typeof iss !== "string" || iss === "" || aud !== tool || typeof sub !== "string" || sub === "") return null;
+  if (typeof iat !== "number" || !Number.isSafeInteger(iat) || typeof exp !== "number" || !Number.isSafeInteger(exp) || exp <= iat) return null;
+  const now = Math.floor(Date.now() / 1000);
+  if (iat > now + skew || exp <= now - skew) return null;
+  if (typeof given_name !== "string" || typeof family_name !== "string" || typeof name !== "string" || typeof email !== "string" || typeof picture !== "string" || typeof role !== "string" || typeof admin !== "boolean" || typeof builder !== "boolean") return null;
+  return { id: sub, firstName: given_name, lastName: family_name, name, email, ...(picture === "" ? {} : { photo: picture }), ...(role === "" ? {} : { role }), isAdmin: admin, isBuilder: builder };
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./src/errors.js";
+export * from "./src/member.js";
+export * from "./src/database.js";
+export * as files from "./src/files.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../client/index.ts"],"names":[],"mappings":"AAOA,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+// The package root: every published module of the SDK (tool contract v2).
+// Each one is also its own subpath (@argentic/chest-sdk/member, /database,
+// /files, /errors), which pulls in nothing else. The files API is a namespace
+// here, as its names (get, put, list, delete, url) are too plain to stand
+// alone. channel, record, requests and worker in client/src are the retired
+// v1 contract: kept for the Chest repository's vendored copy, never built
+// into nor published with the package.
+export * from "./src/errors.js";
+export * from "./src/member.js";
+export * from "./src/database.js";
+export * as files from "./src/files.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../client/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,uCAAuC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC"}

package/dist/src/database.d.ts

@@ -0,0 +1,2 @@
+export declare function databaseUrl(): string;
+//# sourceMappingURL=database.d.ts.map

package/dist/src/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../client/src/database.ts"],"names":[],"mappings":"AAaA,wBAAgB,WAAW,IAAI,MAAM,CAcpC"}

package/dist/src/database.js

@@ -0,0 +1,30 @@
+import { CapabilityNotGranted } from "./errors.js";
+// The address of the tool's own PostgreSQL database, as the Chest gives it
+// to a server tool whose chest.json declares "capabilities": ["database"]:
+// postgres://<user>:<password>@127.0.0.1:<port>/<database>?sslmode=disable,
+// where the port is the tool's launcher, which relays each connection to the
+// Chest (the container has no network). Hand it to a PostgreSQL client —
+// postgres (porsager) or pg; the SDK carries none. PGHOST, PGPORT, PGUSER,
+// PGPASSWORD and PGDATABASE say the same for a client that reads them.
+//
+// Throws CapabilityNotGranted when the Chest gave no database: the version
+// does not declare it, or a DATABASE_URL of the tool's own is not the
+// Chest's. The value is a secret: never log it, never send it to a browser.
+export function databaseUrl() {
+    const value = process.env["DATABASE_URL"];
+    if (typeof value !== "string" || value.length > 1024)
+        throw new CapabilityNotGranted("database");
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CapabilityNotGranted("database");
+    }
+    const port = Number(url.port);
+    if (url.protocol !== "postgres:" || url.hostname !== "127.0.0.1" || !Number.isInteger(port) || port < 1 || port > 65535 || !/^t_[a-z][a-z0-9_]{0,47}$/u.test(url.username) || url.pathname !== "/" + url.username || url.password === "" || url.search !== "?sslmode=disable" || url.hash !== "") {
+        throw new CapabilityNotGranted("database");
+    }
+    return value;
+}
+//# sourceMappingURL=database.js.map

package/dist/src/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../client/src/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,4EAA4E;AAC5E,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjG,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjS,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/errors.d.ts

@@ -0,0 +1,18 @@
+export declare class ChestError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number, message: string);
+}
+export declare class CapabilityNotGranted extends ChestError {
+    constructor(capability: string);
+}
+export declare class QuotaExceeded extends ChestError {
+    constructor();
+}
+export declare class TooLarge extends ChestError {
+    constructor();
+}
+export declare class Unavailable extends ChestError {
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../client/src/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,YAAY,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAKxD;CACF;AAKD,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,UAAU,EAAE,MAAM,EAE7B;CACF;AAID,qBAAa,aAAc,SAAQ,UAAU;IAC3C,cAEC;CACF;AAGD,qBAAa,QAAS,SAAQ,UAAU;IACtC,cAEC;CACF;AAID,qBAAa,WAAY,SAAQ,UAAU;IACzC,cAEC;CACF"}

package/dist/src/errors.js

@@ -0,0 +1,41 @@
+// What the SDK throws when the Chest does not give what a tool asks: a code
+// the tool can test, and the HTTP status the Chest answers for it.
+export class ChestError extends Error {
+    code;
+    status;
+    constructor(code, status, message) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        this.status = status;
+    }
+}
+// The version of the tool in service does not declare the capability in its
+// chest.json ("capabilities"), or it was not approved: the Chest gives it
+// nothing.
+export class CapabilityNotGranted extends ChestError {
+    constructor(capability) {
+        super("capability_not_granted", 403, `the Chest did not grant the capability "${capability}" to this version of the tool`);
+    }
+}
+// What the tool keeps would go beyond what its Chest gives it: its total
+// (1 GiB of files) or its count (10,000 objects).
+export class QuotaExceeded extends ChestError {
+    constructor() {
+        super("quota_exceeded", 429, "the Chest refused: the tool's quota would be exceeded");
+    }
+}
+// One object is beyond the bound of one (32 MiB for a file).
+export class TooLarge extends ChestError {
+    constructor() {
+        super("too_large", 413, "the Chest refused: the object is too large");
+    }
+}
+// The Chest did not answer, or not as it does: nothing is known of what was
+// asked — a write may or may not have happened.
+export class Unavailable extends ChestError {
+    constructor() {
+        super("unavailable", 503, "the Chest is unavailable");
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../client/src/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,mEAAmE;AACnE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACb,MAAM,CAAS;IACxB,YAAY,IAAY,EAAE,MAAc,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,WAAW;AACX,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,UAAkB;QAC5B,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,2CAA2C,UAAU,+BAA+B,CAAC,CAAC;IAC7H,CAAC;CACF;AAED,yEAAyE;AACzE,kDAAkD;AAClD,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C;QACE,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;IACxF,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,QAAS,SAAQ,UAAU;IACtC;QACE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,4CAA4C,CAAC,CAAC;IACxE,CAAC;CACF;AAED,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC;QACE,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/src/files.d.ts

@@ -0,0 +1,28 @@
+export type FileObject = {
+    name: string;
+    type: string;
+    size: number;
+    updated: string;
+};
+export type FileData = {
+    data: Uint8Array;
+    type: string;
+    size: number;
+};
+export type FilePage = {
+    files: FileObject[];
+    next: string | null;
+};
+export declare function put(name: string, data: Uint8Array | string, type?: string): Promise<FileObject>;
+export declare function get(name: string): Promise<FileData | null>;
+export declare function list(options?: {
+    prefix?: string;
+    after?: string;
+}): Promise<FilePage>;
+declare function remove(name: string): Promise<boolean>;
+export { remove as delete };
+export declare function url(name: string): Promise<{
+    url: string;
+    expiresIn: number;
+}>;
+//# sourceMappingURL=files.d.ts.map

package/dist/src/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../client/src/files.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACvF,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,QAAQ,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AA+FpE,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQrG;AAGD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAUhE;AAKD,wBAAsB,IAAI,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAa/F;AAGD,iBAAe,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpD;AACD,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC;AAM5B,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAOnF"}

package/dist/src/files.js

@@ -0,0 +1,178 @@
+import { CapabilityNotGranted, ChestError, QuotaExceeded, TooLarge, Unavailable } from "./errors.js";
+const maxObject = 32 << 20;
+const maxAnswer = 4 << 20;
+const deadline = 120000;
+const namePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}(\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}){0,7}$/u;
+// base is the Chest's API as the launcher gives it; without, the version
+// does not keep files.
+function base() {
+    const value = process.env["CHEST_API"];
+    if (typeof value !== "string" || !/^http:\/\/127\.0\.0\.1:[1-9][0-9]{0,4}$/u.test(value) || Number(value.slice(17)) > 65535)
+        throw new CapabilityNotGranted("files");
+    return value;
+}
+function checkName(name) {
+    if (typeof name !== "string" || !namePattern.test(name))
+        throw new ChestError("invalid_name", 400, "invalid file name");
+    return name;
+}
+// ask sends one request to the Chest; a failure to reach it is Unavailable.
+async function ask(method, path, init = {}) {
+    const headers = {};
+    if (init.type !== undefined)
+        headers["Content-Type"] = init.type;
+    try {
+        return await fetch(base() + path, { method, headers, ...(init.body !== undefined ? { body: init.body } : {}), redirect: "error", signal: AbortSignal.timeout(deadline) });
+    }
+    catch (error) {
+        if (error instanceof ChestError)
+            throw error;
+        throw new Unavailable();
+    }
+}
+// read takes a body of limit bytes at most; beyond, or cut, the answer is not
+// the Chest's.
+async function read(response, limit) {
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (declared > limit)
+        throw new Unavailable();
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of response.body ?? []) {
+            size += chunk.byteLength;
+            if (size > limit)
+                throw new Unavailable();
+            chunks.push(chunk);
+        }
+    }
+    catch {
+        throw new Unavailable();
+    }
+    const all = new Uint8Array(size);
+    let at = 0;
+    for (const chunk of chunks) {
+        all.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return all;
+}
+async function json(response) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await read(response, maxAnswer)));
+    }
+    catch (error) {
+        if (error instanceof ChestError)
+            throw error;
+        throw new Unavailable();
+    }
+}
+// refusal turns an answer that is not a success into what the tool tests.
+async function refusal(response) {
+    if (response.status === 403)
+        return new CapabilityNotGranted("files");
+    if (response.status === 413)
+        return new TooLarge();
+    if (response.status === 429)
+        return new QuotaExceeded();
+    if (response.status >= 500)
+        return new Unavailable();
+    let code = "refused";
+    try {
+        const body = await json(response);
+        const given = body?.error;
+        if (typeof given === "string" && /^[a-z_]{1,40}$/u.test(given))
+            code = given;
+    }
+    catch {
+        // The code stays « refused ».
+    }
+    return new ChestError(code, response.status, `the Chest refused: ${code}`);
+}
+function isObject(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const o = value;
+    return typeof o["name"] === "string" && namePattern.test(o["name"]) && typeof o["type"] === "string" && o["type"].length <= 200 && typeof o["size"] === "number" && Number.isSafeInteger(o["size"]) && o["size"] >= 0 && typeof o["updated"] === "string";
+}
+function object(value) {
+    if (!isObject(value))
+        throw new Unavailable();
+    return { name: value.name, type: value.type, size: value.size, updated: value.updated };
+}
+// put keeps data as the file name, of type type (application/octet-stream
+// when none), replacing the one of that name.
+export async function put(name, data, type) {
+    checkName(name);
+    if (!(data instanceof Uint8Array) && typeof data !== "string")
+        throw new TypeError("data must be bytes or text");
+    const body = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+    if (body.byteLength > maxObject)
+        throw new TooLarge();
+    const response = await ask("PUT", "/files/" + name, { body, type: type ?? (typeof data === "string" ? "text/plain; charset=utf-8" : "application/octet-stream") });
+    if (response.status !== 201)
+        throw await refusal(response);
+    return object(await json(response));
+}
+// get reads a file; null when the tool has none of that name.
+export async function get(name) {
+    checkName(name);
+    const response = await ask("GET", "/files/" + name);
+    if (response.status === 404) {
+        await response.body?.cancel();
+        return null;
+    }
+    if (response.status !== 200)
+        throw await refusal(response);
+    const data = await read(response, maxObject);
+    return { data, type: response.headers.get("content-type") ?? "application/octet-stream", size: data.byteLength };
+}
+// list says the files whose name starts with prefix, in the order of their
+// names, after the name after, 1000 at most; next is the name to ask after
+// for the following page, null once all were said.
+export async function list(options = {}) {
+    const query = new URLSearchParams();
+    if (options.prefix !== undefined && options.prefix !== "") {
+        if (typeof options.prefix !== "string" || options.prefix.length > 807 || !/^[A-Za-z0-9._\/-]*$/u.test(options.prefix))
+            throw new ChestError("invalid_name", 400, "invalid prefix");
+        query.set("prefix", options.prefix);
+    }
+    if (options.after !== undefined && options.after !== "")
+        query.set("after", checkName(options.after));
+    const response = await ask("GET", "/files" + (query.size ? "?" + query.toString() : ""));
+    if (response.status !== 200)
+        throw await refusal(response);
+    const body = await json(response);
+    const page = body;
+    if (!page || !Array.isArray(page.files) || page.files.length > 1000 || !(page.next === null || (typeof page.next === "string" && namePattern.test(page.next))))
+        throw new Unavailable();
+    return { files: page.files.map(object), next: page.next };
+}
+// remove deletes a file; false when the tool had none of that name.
+async function remove(name) {
+    checkName(name);
+    const response = await ask("DELETE", "/files/" + name);
+    if (response.status === 204)
+        return true;
+    if (response.status === 404) {
+        await response.body?.cancel();
+        return false;
+    }
+    throw await refusal(response);
+}
+export { remove as delete };
+// url signs a link to the file as it is now, on the tool's team host: anyone
+// who has it opens the file, without signing in, for expiresIn seconds
+// (15 minutes), or until the file changes or goes. Give it to a member's
+// browser, never to a public page.
+export async function url(name) {
+    checkName(name);
+    const response = await ask("POST", "/files/url", { body: JSON.stringify({ name }), type: "application/json" });
+    if (response.status !== 200)
+        throw await refusal(response);
+    const body = (await json(response));
+    if (!body || typeof body.url !== "string" || !/^https:\/\/[^/?#]+\/_chest\/files\/[A-Za-z0-9_.-]{1,1536}$/u.test(body.url) || typeof body.expires_in !== "number" || !Number.isInteger(body.expires_in) || body.expires_in <= 0)
+        throw new Unavailable();
+    return { url: body.url, expiresIn: body.expires_in };
+}
+//# sourceMappingURL=files.js.map

package/dist/src/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../client/src/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsBrG,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,CAAC;AAC3B,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,WAAW,GAAG,4EAA4E,CAAC;AAEjG,yEAAyE;AACzE,uBAAuB;AACvB,SAAS,IAAI;IACX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;QAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACrK,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACxH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,IAAI,GAA+D,EAAE;IACpH,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5K,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,WAAW,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,KAAK,UAAU,IAAI,CAAC,QAAkB,EAAE,KAAa;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACvE,IAAI,QAAQ,GAAG,KAAK;QAAE,MAAM,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK;gBAAE,MAAM,IAAI,WAAW,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,QAAkB;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,WAAW,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,OAAO,CAAC,QAAkB;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,EAAE,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,aAAa,EAAE,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC;IACrD,IAAI,IAAI,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,KAAK,GAAI,IAAmC,EAAE,KAAK,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;AAC5P,CAAC;AACD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,EAAE,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC1F,CAAC;AAED,0EAA0E;AAC1E,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAyB,EAAE,IAAa;IAC9E,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACjH,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,UAAU,GAAG,SAAS;QAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACnK,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACnH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAO,GAAwC,EAAE;IAC1E,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnL,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAkD,CAAC;IAChE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,EAAE,CAAC;IACxL,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AACD,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,CAAC;AAE5B,6EAA6E;AAC7E,uEAAuE;AACvE,yEAAyE;AACzE,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/G,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAmD,CAAC;IACtF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;QAAE,MAAM,IAAI,WAAW,EAAE,CAAC;IACzP,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACvD,CAAC"}

package/dist/src/member.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage } from "node:http";
+export type Member = {
+    id: string;
+    firstName: string;
+    lastName: string;
+    name: string;
+    email: string;
+    photo?: string;
+    role?: string;
+    isAdmin: boolean;
+    isBuilder: boolean;
+};
+export declare function member(request: IncomingMessage | Request): Member | null;
+//# sourceMappingURL=member.d.ts.map

package/dist/src/member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member.d.ts","sourceRoot":"","sources":["../../client/src/member.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAKjD,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAmCF,wBAAgB,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAuBxE"}

package/dist/src/member.js

@@ -0,0 +1,66 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+// The key of the assertions is HMAC-SHA256 of this label under the text of
+// CHEST_TOKEN, exactly as the Chest derives it (chest/toolfront).
+const label = "Chest-Member v1";
+// Clocks of the Chest and of the container may differ by this much, in seconds.
+const skew = 5;
+// An assertion is a few hundred bytes; anything longer is not one.
+const maxLength = 8192;
+const compact = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/u;
+const claims = ["iss", "aud", "iat", "exp", "sub", "given_name", "family_name", "name", "email", "picture", "role", "admin", "builder"];
+function assertionOf(request) {
+    const headers = request.headers;
+    // A Web Request joins repeated headers with ", ", which no assertion
+    // contains; a Node request keeps them as an array: both are refused.
+    const value = typeof headers.get === "function" ? headers.get("chest-member") : headers["chest-member"];
+    return typeof value === "string" && value.length <= maxLength ? value : null;
+}
+function json(part) {
+    try {
+        const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+        return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+// member returns who the Chest says is making this request, or null when the
+// request carries no valid assertion — absent, malformed, signed with another
+// key, for another tool, expired or not yet valid —, or when CHEST_TOKEN or
+// CHEST_TOOL is missing. It never throws for what a request carries. Only the
+// Chest's front reaches the tool; the signature is a second defence, and the
+// tool still decides what a member may do with its own rules.
+export function member(request) {
+    const token = process.env["CHEST_TOKEN"];
+    const tool = process.env["CHEST_TOOL"];
+    if (!token || !/^[A-Za-z0-9_-]{43,512}$/u.test(token) || !tool)
+        return null;
+    const assertion = assertionOf(request);
+    const parts = assertion === null ? null : compact.exec(assertion);
+    if (!parts)
+        return null;
+    const [, encodedHeader = "", encodedPayload = "", encodedSignature = ""] = parts;
+    const header = json(encodedHeader);
+    if (!header || Object.keys(header).length !== 2 || header["alg"] !== "HS256" || header["typ"] !== "JWT")
+        return null;
+    const key = createHmac("sha256", Buffer.from(token, "utf8")).update(label).digest();
+    const expected = createHmac("sha256", key).update(encodedHeader + "." + encodedPayload).digest();
+    const signature = Buffer.from(encodedSignature, "base64url");
+    if (signature.length !== expected.length || !timingSafeEqual(signature, expected))
+        return null;
+    const payload = json(encodedPayload);
+    if (!payload || !claims.every(name => Object.hasOwn(payload, name)))
+        return null;
+    const { iss, aud, iat, exp, sub, given_name, family_name, name, email, picture, role, admin, builder } = payload;
+    if (typeof iss !== "string" || iss === "" || aud !== tool || typeof sub !== "string" || sub === "")
+        return null;
+    if (typeof iat !== "number" || !Number.isSafeInteger(iat) || typeof exp !== "number" || !Number.isSafeInteger(exp) || exp <= iat)
+        return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (iat > now + skew || exp <= now - skew)
+        return null;
+    if (typeof given_name !== "string" || typeof family_name !== "string" || typeof name !== "string" || typeof email !== "string" || typeof picture !== "string" || typeof role !== "string" || typeof admin !== "boolean" || typeof builder !== "boolean")
+        return null;
+    return { id: sub, firstName: given_name, lastName: family_name, name, email, ...(picture === "" ? {} : { photo: picture }), ...(role === "" ? {} : { role }), isAdmin: admin, isBuilder: builder };
+}
+//# sourceMappingURL=member.js.map

package/dist/src/member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member.js","sourceRoot":"","sources":["../../client/src/member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB1D,2EAA2E;AAC3E,kEAAkE;AAClE,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAChC,gFAAgF;AAChF,MAAM,IAAI,GAAG,CAAC,CAAC;AACf,mEAAmE;AACnE,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,OAAO,GAAG,yDAAyD,CAAC;AAC1E,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEjJ,SAAS,WAAW,CAAC,OAAkC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAA+C,CAAC;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,KAAK,GAAG,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAE,OAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAE,OAAsC,CAAC,cAAc,CAAC,CAAC;IAClK,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACrF,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,UAAU,MAAM,CAAC,OAAkC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,GAAG,EAAE,EAAE,cAAc,GAAG,EAAE,EAAE,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrH,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,GAAG,GAAG,GAAG,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACjH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9I,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrQ,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACrM,CAAC"}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@argentic/chest-sdk",
+  "version": "0.1.0",
+  "description": "The client a Chest server tool embeds: the member the Chest asserts on a request, the tool's own database and its private files.",
+  "keywords": [
+    "chest",
+    "argentic",
+    "sdk",
+    "chest-tool",
+    "member",
+    "files",
+    "database"
+  ],
+  "homepage": "https://github.com/chest-by-argentic/Chest-SDK#readme",
+  "bugs": {
+    "url": "https://github.com/chest-by-argentic/Chest-SDK/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chest-by-argentic/Chest-SDK.git"
+  },
+  "license": "MIT",
+  "author": "Argentic",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./errors": {
+      "types": "./dist/src/errors.d.ts",
+      "default": "./dist/src/errors.js"
+    },
+    "./member": {
+      "types": "./dist/src/member.d.ts",
+      "default": "./dist/src/member.js"
+    },
+    "./database": {
+      "types": "./dist/src/database.d.ts",
+      "default": "./dist/src/database.js"
+    },
+    "./files": {
+      "types": "./dist/src/files.d.ts",
+      "default": "./dist/src/files.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "client/index.ts",
+    "client/src/errors.ts",
+    "client/src/member.ts",
+    "client/src/database.ts",
+    "client/src/files.ts"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "clean": "node -e \"for (const d of ['dist', 'build']) require('node:fs').rmSync(d, {recursive: true, force: true})\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "test": "npm run build && tsc -p tsconfig.json && node --test build/client/test/*.test.js",
+    "check:package": "node scripts/check-package.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test && npm run check:package"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.5",
+    "esbuild": "0.28.2",
+    "typescript": "7.0.2"
+  }
+}