@harperfast/harper 5.2.10 → 5.3.0-alpha.1

package/dist/security/certificateVerification/types.d.ts

@@ -12,6 +12,7 @@ export interface PeerCertificate {
         [key: string]: any;
     };
     raw?: Buffer;
+    fingerprint256?: string;
     issuerCertificate?: PeerCertificate;
 }
 export interface CertificateVerificationResult {

package/dist/security/credentialProvenance.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Provenance for a credential minted from a workload identity exchange (#2171) rather than from a
+ * password.
+ *
+ * The exchange's whole guarantee is that CI holds nothing durable: a one-hour operation token, no
+ * refresh token, nothing on disk to leak. That guarantee is only as strong as the paths that turn
+ * one credential into another. `create_authentication_tokens` is such a path and does not look like
+ * one: it is in `NO_AUTH_OPERATIONS`, but `serverHandlers.js` special-cases it so a call with no
+ * username/password authenticates by Bearer token instead — so an exchanged token is accepted there
+ * as if it were a password, honors a caller-supplied `expires_in` verbatim, and returns a 30-day
+ * refresh token. That converts a minutes-long leak into a month-long one, which is the exact
+ * exposure this feature exists to remove.
+ *
+ * A scope (operationScope.ts) cannot carry this weight. A trust policy names `operations` only when
+ * the operator opts in, so the ordinary exchanged token is UNSCOPED and a scope check finds nothing
+ * to deny — the common case would sail through a scope-only guard. Provenance is therefore recorded
+ * independently of scope, on every exchanged token.
+ *
+ * Like the scope, it lives under two names depending on the carrier: the claim `workload_identity`
+ * on a JWT payload, and `fromWorkloadIdentity` on an in-memory principal (validateToken lifts the
+ * claim across). And like the scope, every path that produces a credential or a principal has to
+ * carry it forward — impersonation included, or a workload token launders its provenance by
+ * impersonating and then mints freely.
+ */
+/** The JWT claim name. Signed with the rest of the payload, so it cannot be stripped in transit. */
+export declare const WORKLOAD_IDENTITY_CLAIM = "workload_identity";
+/** Stamps a token payload as workload-identity provenance. Returns the payload. */
+export declare function markTokenAsWorkloadIdentity<T extends object>(payload: T): T;
+/** Lifts the claim from a verified token onto a user principal. Returns the user. */
+export declare function attachWorkloadIdentityToUser<T extends object>(user: T, claim: unknown): T;
+/**
+ * True when this principal authenticated with a workload-identity token. Checked strictly against
+ * `true` so a forged string or object on a user record cannot widen it.
+ */
+export declare function isWorkloadIdentityPrincipal(user: unknown): boolean;

package/dist/security/credentialProvenance.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * Provenance for a credential minted from a workload identity exchange (#2171) rather than from a
+ * password.
+ *
+ * The exchange's whole guarantee is that CI holds nothing durable: a one-hour operation token, no
+ * refresh token, nothing on disk to leak. That guarantee is only as strong as the paths that turn
+ * one credential into another. `create_authentication_tokens` is such a path and does not look like
+ * one: it is in `NO_AUTH_OPERATIONS`, but `serverHandlers.js` special-cases it so a call with no
+ * username/password authenticates by Bearer token instead — so an exchanged token is accepted there
+ * as if it were a password, honors a caller-supplied `expires_in` verbatim, and returns a 30-day
+ * refresh token. That converts a minutes-long leak into a month-long one, which is the exact
+ * exposure this feature exists to remove.
+ *
+ * A scope (operationScope.ts) cannot carry this weight. A trust policy names `operations` only when
+ * the operator opts in, so the ordinary exchanged token is UNSCOPED and a scope check finds nothing
+ * to deny — the common case would sail through a scope-only guard. Provenance is therefore recorded
+ * independently of scope, on every exchanged token.
+ *
+ * Like the scope, it lives under two names depending on the carrier: the claim `workload_identity`
+ * on a JWT payload, and `fromWorkloadIdentity` on an in-memory principal (validateToken lifts the
+ * claim across). And like the scope, every path that produces a credential or a principal has to
+ * carry it forward — impersonation included, or a workload token launders its provenance by
+ * impersonating and then mints freely.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKLOAD_IDENTITY_CLAIM = void 0;
+exports.markTokenAsWorkloadIdentity = markTokenAsWorkloadIdentity;
+exports.attachWorkloadIdentityToUser = attachWorkloadIdentityToUser;
+exports.isWorkloadIdentityPrincipal = isWorkloadIdentityPrincipal;
+/** The JWT claim name. Signed with the rest of the payload, so it cannot be stripped in transit. */
+exports.WORKLOAD_IDENTITY_CLAIM = 'workload_identity';
+/** Stamps a token payload as workload-identity provenance. Returns the payload. */
+function markTokenAsWorkloadIdentity(payload) {
+    payload[exports.WORKLOAD_IDENTITY_CLAIM] = true;
+    return payload;
+}
+/** Lifts the claim from a verified token onto a user principal. Returns the user. */
+function attachWorkloadIdentityToUser(user, claim) {
+    if (claim === true)
+        user.fromWorkloadIdentity = true;
+    return user;
+}
+/**
+ * True when this principal authenticated with a workload-identity token. Checked strictly against
+ * `true` so a forged string or object on a user record cannot widen it.
+ */
+function isWorkloadIdentityPrincipal(user) {
+    return user?.fromWorkloadIdentity === true;
+}
+//# sourceMappingURL=credentialProvenance.js.map

package/dist/security/credentialProvenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialProvenance.js","sourceRoot":"","sources":["../../security/credentialProvenance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAMH,kEAGC;AAGD,oEAGC;AAMD,kEAEC;AArBD,oGAAoG;AACvF,QAAA,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,mFAAmF;AACnF,SAAgB,2BAA2B,CAAmB,OAAU;IACtE,OAAe,CAAC,+BAAuB,CAAC,GAAG,IAAI,CAAC;IACjD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,SAAgB,4BAA4B,CAAmB,IAAO,EAAE,KAAc;IACrF,IAAI,KAAK,KAAK,IAAI;QAAG,IAAY,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC9D,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,IAAa;IACxD,OAAQ,IAAY,EAAE,oBAAoB,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/dist/security/credentialRejection.d.ts

@@ -0,0 +1,4 @@
+import { ClientError } from '../utility/errors/hdbError.ts';
+export declare function markCredentialRejection<E extends object>(error: E): E;
+export declare function credentialRejectionError(message: string, statusCode: number): ClientError;
+export declare function isCredentialRejection(error: unknown): boolean;

package/dist/security/credentialRejection.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markCredentialRejection = markCredentialRejection;
+exports.credentialRejectionError = credentialRejectionError;
+exports.isCredentialRejection = isCredentialRejection;
+const hdbError_ts_1 = require("../utility/errors/hdbError.js");
+// Explicit provenance prevents internal faults with a 4xx status from being deferred as rejected credentials.
+const CREDENTIAL_REJECTION = Symbol('harper.credentialRejection');
+function markCredentialRejection(error) {
+    Object.defineProperty(error, CREDENTIAL_REJECTION, {
+        value: true,
+        enumerable: false,
+        configurable: true,
+        writable: false,
+    });
+    return error;
+}
+function credentialRejectionError(message, statusCode) {
+    return markCredentialRejection(new hdbError_ts_1.ClientError(message, statusCode));
+}
+function isCredentialRejection(error) {
+    return error?.[CREDENTIAL_REJECTION] === true;
+}
+//# sourceMappingURL=credentialRejection.js.map

package/dist/security/credentialRejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialRejection.js","sourceRoot":"","sources":["../../security/credentialRejection.ts"],"names":[],"mappings":";;AAKA,0DAQC;AAED,4DAEC;AAED,sDAEC;AArBD,+DAA4D;AAE5D,8GAA8G;AAC9G,MAAM,oBAAoB,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,SAAgB,uBAAuB,CAAmB,KAAQ;IACjE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,oBAAoB,EAAE;QAClD,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,KAAK;KACf,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAAe,EAAE,UAAkB;IAC3E,OAAO,uBAAuB,CAAC,IAAI,yBAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAc;IACnD,OAAQ,KAAoD,EAAE,CAAC,oBAAoB,CAAC,KAAK,IAAI,CAAC;AAC/F,CAAC"}

package/dist/security/deferredAuthentication.d.ts

@@ -0,0 +1,36 @@
+import { Headers } from '../server/serverHelpers/Headers.ts';
+export { isCredentialRejection, markCredentialRejection, credentialRejectionError } from './credentialRejection.ts';
+export type DeferredCredentialRejection = {
+    readonly status: number;
+    readonly message: string;
+    readonly strategy: string;
+};
+/**
+ * Records that this request presented a credential Harper rejected, without deciding the request.
+ * The caller leaves `request.user` unset and the inbound `Authorization` header untouched.
+ *
+ * The immutable, non-enumerable descriptor prevents downstream middleware from clearing it and
+ * keeps it out of request copies and serialization.
+ */
+export declare function deferCredentialRejection(request: any, error: {
+    message?: string;
+}, strategy: string): void;
+export declare function getDeferredCredentialRejection(request: any): DeferredCredentialRejection | undefined;
+/**
+ * The response an owning layer returns once it has established Harper owns the route: exactly the
+ * descriptor `security/auth.ts` returns in-line, so immediate and deferred rejection share a wire
+ * contract.
+ *
+ * Owner-specific error mapping must not run first. REST renders a thrown error as an RFC 9457
+ * Problem Details document and GraphQL as `{errors:[…]}` rather than authentication's negotiated
+ * `{error: message}` response. `security/auth.ts` likewise leaves a settled rejection's status and
+ * challenge headers alone, so it stays byte-identical to the in-line 401 it replaced.
+ *
+ * Returns `undefined` when nothing was deferred, so a caller can `return settled ?? …` inline.
+ */
+export declare function settleDeferredCredentialRejection(request: any): {
+    status: number;
+    headers: Headers;
+    body: string | Buffer;
+} | undefined;
+export declare function assertNoDeferredCredentialRejection(request: any): void;

package/dist/security/deferredAuthentication.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialRejectionError = exports.markCredentialRejection = exports.isCredentialRejection = void 0;
+exports.deferCredentialRejection = deferCredentialRejection;
+exports.getDeferredCredentialRejection = getDeferredCredentialRejection;
+exports.settleDeferredCredentialRejection = settleDeferredCredentialRejection;
+exports.assertNoDeferredCredentialRejection = assertNoDeferredCredentialRejection;
+const hdbError_ts_1 = require("../utility/errors/hdbError.js");
+const contentTypes_ts_1 = require("../server/serverHelpers/contentTypes.js");
+const Headers_ts_1 = require("../server/serverHelpers/Headers.js");
+var credentialRejection_ts_1 = require("./credentialRejection.js");
+Object.defineProperty(exports, "isCredentialRejection", { enumerable: true, get: function () { return credentialRejection_ts_1.isCredentialRejection; } });
+Object.defineProperty(exports, "markCredentialRejection", { enumerable: true, get: function () { return credentialRejection_ts_1.markCredentialRejection; } });
+Object.defineProperty(exports, "credentialRejectionError", { enumerable: true, get: function () { return credentialRejection_ts_1.credentialRejectionError; } });
+const DEFERRED_CREDENTIAL_REJECTION = Symbol('harper.deferredCredentialRejection');
+const CREDENTIAL_REJECTION_STATUS = 401;
+/**
+ * Records that this request presented a credential Harper rejected, without deciding the request.
+ * The caller leaves `request.user` unset and the inbound `Authorization` header untouched.
+ *
+ * The immutable, non-enumerable descriptor prevents downstream middleware from clearing it and
+ * keeps it out of request copies and serialization.
+ */
+function deferCredentialRejection(request, error, strategy) {
+    if (getDeferredCredentialRejection(request))
+        return;
+    const deferred = Object.freeze({
+        status: CREDENTIAL_REJECTION_STATUS,
+        message: error?.message ?? 'Unauthorized',
+        strategy,
+    });
+    Object.defineProperty(request, DEFERRED_CREDENTIAL_REJECTION, {
+        value: deferred,
+        enumerable: false,
+        configurable: false,
+        writable: false,
+    });
+}
+function getDeferredCredentialRejection(request) {
+    return request?.[DEFERRED_CREDENTIAL_REJECTION];
+}
+/**
+ * The response an owning layer returns once it has established Harper owns the route: exactly the
+ * descriptor `security/auth.ts` returns in-line, so immediate and deferred rejection share a wire
+ * contract.
+ *
+ * Owner-specific error mapping must not run first. REST renders a thrown error as an RFC 9457
+ * Problem Details document and GraphQL as `{errors:[…]}` rather than authentication's negotiated
+ * `{error: message}` response. `security/auth.ts` likewise leaves a settled rejection's status and
+ * challenge headers alone, so it stays byte-identical to the in-line 401 it replaced.
+ *
+ * Returns `undefined` when nothing was deferred, so a caller can `return settled ?? …` inline.
+ */
+function settleDeferredCredentialRejection(request) {
+    const deferred = getDeferredCredentialRejection(request);
+    if (!deferred)
+        return undefined;
+    const contentType = (request?.headers ? (0, contentTypes_ts_1.findBestSerializer)(request).type : undefined) ?? 'application/json';
+    return {
+        status: deferred.status,
+        headers: new Headers_ts_1.Headers({ 'Content-Type': contentType }),
+        body: (0, contentTypes_ts_1.serializeMessage)({ error: deferred.message }, request),
+    };
+}
+function assertNoDeferredCredentialRejection(request) {
+    const deferred = getDeferredCredentialRejection(request);
+    if (deferred)
+        throw new hdbError_ts_1.ClientError(deferred.message, deferred.status);
+}
+//# sourceMappingURL=deferredAuthentication.js.map

package/dist/security/deferredAuthentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferredAuthentication.js","sourceRoot":"","sources":["../../security/deferredAuthentication.ts"],"names":[],"mappings":";;;AAuBA,4DAaC;AAED,wEAEC;AAcD,8EAWC;AAED,kFAGC;AAtED,+DAA4D;AAC5D,6EAA+F;AAC/F,mEAA6D;AAE7D,mEAAoH;AAA3G,+HAAA,qBAAqB,OAAA;AAAE,iIAAA,uBAAuB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AAEjF,MAAM,6BAA6B,GAAG,MAAM,CAAC,oCAAoC,CAAC,CAAC;AAQnF,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,OAAY,EAAE,KAA2B,EAAE,QAAgB;IACnG,IAAI,8BAA8B,CAAC,OAAO,CAAC;QAAE,OAAO;IACpD,MAAM,QAAQ,GAAgC,MAAM,CAAC,MAAM,CAAC;QAC3D,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,cAAc;QACzC,QAAQ;KACR,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,6BAA6B,EAAE;QAC7D,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,KAAK;KACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAAC,OAAY;IAC1D,OAAO,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,iCAAiC,CAChD,OAAY;IAEZ,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oCAAkB,EAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC;IAC5G,OAAO;QACN,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,IAAI,oBAAO,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,OAAO,CAAoB;KAC/E,CAAC;AACH,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAY;IAC/D,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,MAAM,IAAI,yBAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/dist/security/impersonation.d.ts

@@ -1,5 +1,19 @@
 import type { User } from './user.ts';
 import type { ImpersonatePayload } from '../server/operationsServer.ts';
+/**
+ * Content-derived identity for synthetic (inline) roles. getRolePermissions memoizes translated
+ * permissions by role name, so synthetic roles must never share a constant name: two inline roles
+ * with different permissions would alias in that cache and leak permissions across principals.
+ * Hashing the (already downgraded) permission content isolates distinct permission sets while
+ * letting identical ones share a cache entry. The paired __updatedtime__ of 0 keeps the memo key
+ * stable across requests; the content hash in the name is what invalidates on permission change.
+ *
+ * Object keys are canonicalized before hashing so two structurally-identical permission sets that
+ * differ only in key order (e.g. from different client request shapes) map to the same name and
+ * share one cache slot — otherwise they would each consume a distinct slot (never an aliasing bug,
+ * but it worsens the bounded synthetic-role cache pressure).
+ */
+export declare function syntheticRoleName(prefix: string, permission: object): string;
 /**
  * Applies impersonation to a request. The authenticated user must be a super_user.
  * Returns a new User object with downgraded permissions based on the impersonate payload.
@@ -9,3 +23,10 @@ import type { ImpersonatePayload } from '../server/operationsServer.ts';
  * Mode C (existing role): `impersonate.role_name` is present (no role) — looks up the role by name and builds a synthetic user.
  */
 export declare function applyImpersonation(authenticatedUser: User, payload: ImpersonatePayload): Promise<User>;
+/**
+ * Builds the synthetic user embedded in a scoped authentication token
+ * (create_authentication_tokens with an inline `role` object). Same gate and downgrade rules as
+ * impersonation Mode A. `trusted` marks internal dispatch (operation authorization bypassed),
+ * where no authenticated minter exists.
+ */
+export declare function buildScopedTokenUser(minter: User | undefined, payload: ImpersonatePayload, trusted?: boolean): Promise<User>;

package/dist/security/impersonation.js

@@ -3,12 +3,46 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.syntheticRoleName = syntheticRoleName;
 exports.applyImpersonation = applyImpersonation;
+exports.buildScopedTokenUser = buildScopedTokenUser;
+const node_crypto_1 = require("node:crypto");
 const user_ts_1 = require("./user.js");
 const operationPermissions_ts_1 = require("../utility/operationPermissions.js");
+const role_validation_ts_1 = require("../validation/role_validation.js");
 const hdbError_ts_1 = require("../utility/errors/hdbError.js");
 const harper_logger_ts_1 = __importDefault(require("../utility/logging/harper_logger.js"));
 const role_ts_1 = require("./role.js");
+const operationScope_ts_1 = require("./operationScope.js");
+const credentialProvenance_ts_1 = require("./credentialProvenance.js");
+/**
+ * Content-derived identity for synthetic (inline) roles. getRolePermissions memoizes translated
+ * permissions by role name, so synthetic roles must never share a constant name: two inline roles
+ * with different permissions would alias in that cache and leak permissions across principals.
+ * Hashing the (already downgraded) permission content isolates distinct permission sets while
+ * letting identical ones share a cache entry. The paired __updatedtime__ of 0 keeps the memo key
+ * stable across requests; the content hash in the name is what invalidates on permission change.
+ *
+ * Object keys are canonicalized before hashing so two structurally-identical permission sets that
+ * differ only in key order (e.g. from different client request shapes) map to the same name and
+ * share one cache slot — otherwise they would each consume a distinct slot (never an aliasing bug,
+ * but it worsens the bounded synthetic-role cache pressure).
+ */
+function syntheticRoleName(prefix, permission) {
+    return `${prefix}_${(0, node_crypto_1.createHash)('sha256').update(canonicalJSON(permission)).digest('hex').slice(0, 24)}`;
+}
+// Array order is intentionally preserved: operations is order-insensitive semantically, but
+// canonicalizing it too would be a broader behavior change than this cache-sharing fix needs.
+function canonicalJSON(value) {
+    return JSON.stringify(value, (_key, v) => v && typeof v === 'object' && !Array.isArray(v)
+        ? Object.keys(v)
+            .sort()
+            .reduce((acc, k) => {
+            acc[k] = v[k];
+            return acc;
+        }, {})
+        : v);
+}
 /**
  * Applies impersonation to a request. The authenticated user must be a super_user.
  * Returns a new User object with downgraded permissions based on the impersonate payload.
@@ -38,42 +72,107 @@ async function applyImpersonation(authenticatedUser, payload) {
     }
     // Enforce downgrade: never allow escalation
     enforceDowngrade(impersonatedUser);
+    // A token's operation scope (#2174) constrains the credential regardless of which principal it
+    // acts as, so it survives impersonation. enforceDowngrade only bounds the impersonated role's
+    // permissions; without carrying the scope, a scoped super_user token would shed it by impersonating.
+    (0, operationScope_ts_1.attachScopeToUser)(impersonatedUser, authenticatedUser.tokenOperations);
+    // Same reasoning for provenance (#2171), and the omission would be worse: impersonation returns a
+    // NEW principal, so dropping the marker here would let a workload token impersonate — even down to
+    // a lesser role — and then mint a 30-day credential that createTokens would no longer refuse.
+    (0, credentialProvenance_ts_1.attachWorkloadIdentityToUser)(impersonatedUser, authenticatedUser.fromWorkloadIdentity);
+    // Re-key the synthetic role by its effective (post-downgrade) content so it can never alias
+    // another impersonation's permissions or poison a persisted role's memoized translation —
+    // getRolePermissions caches by role name (see syntheticRoleName).
+    if (impersonatedUser.role) {
+        impersonatedUser.role = {
+            ...impersonatedUser.role,
+            role: syntheticRoleName('_impersonated', impersonatedUser.role.permission),
+            __updatedtime__: 0,
+        };
+    }
     // Tag for audit trail
     impersonatedUser._impersonated = true;
     impersonatedUser._impersonatedBy = authenticatedUser.username;
     harper_logger_ts_1.default.info(`Impersonation applied: "${authenticatedUser.username}" impersonating as "${impersonatedUser.username}"`);
     return impersonatedUser;
 }
-function validatePayload(payload) {
+/**
+ * Builds the synthetic user embedded in a scoped authentication token
+ * (create_authentication_tokens with an inline `role` object). Same gate and downgrade rules as
+ * impersonation Mode A. `trusted` marks internal dispatch (operation authorization bypassed),
+ * where no authenticated minter exists.
+ */
+async function buildScopedTokenUser(minter, payload, trusted = false) {
+    if (!trusted && !minter?.role?.permission?.super_user) {
+        throw new hdbError_ts_1.ClientError('Only super_user can create a token with an inline role', 403);
+    }
+    validatePayload(payload, 'scoped token role');
+    if (!payload.role) {
+        throw new hdbError_ts_1.ClientError("A scoped token requires 'role' with 'permission'");
+    }
+    const username = payload.username || (minter?.username && `scoped:${minter.username}`);
+    if (!username || typeof username !== 'string') {
+        throw new hdbError_ts_1.ClientError("A scoped token requires a 'username'");
+    }
+    // The attribution name must never collide with a real principal: paths that rehydrate a user
+    // by name (e.g. MQTT last-will replay) would resolve the token's bearer to that user's full
+    // permissions. This also keeps scoped-token activity distinguishable in audit logs.
+    if ((await (0, user_ts_1.getUsersWithRolesCache)())?.has(username)) {
+        throw new hdbError_ts_1.ClientError(`'username' must not name an existing user; scoped-token attribution is a label`);
+    }
+    // Downgrade first so validation and the content hash see the effective permission set.
+    const permission = {
+        ...payload.role.permission,
+        super_user: false,
+        cluster_user: false,
+    };
+    // Full persisted-role validation: a malformed shape must fail at mint (400), not at every use.
+    const deepValidation = (0, role_validation_ts_1.addRoleValidation)({ role: 'scoped_token', permission });
+    if (deepValidation)
+        throw deepValidation;
+    const roleName = syntheticRoleName('_scoped_token', permission);
+    return {
+        username,
+        active: true,
+        role: {
+            permission,
+            role: roleName,
+            id: roleName,
+            __updatedtime__: 0,
+            __createdtime__: 0,
+        },
+    };
+}
+function validatePayload(payload, context = 'impersonate payload') {
     if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
-        throw new hdbError_ts_1.ClientError('Invalid impersonate payload: must be an object');
+        throw new hdbError_ts_1.ClientError(`Invalid ${context}: must be an object`);
     }
     const hasRole = payload.role !== undefined;
     const hasUsername = typeof payload.username === 'string' && payload.username.length > 0;
     const hasRoleName = typeof payload.role_name === 'string' && payload.role_name.length > 0;
     if (!hasRole && !hasUsername && !hasRoleName) {
-        throw new hdbError_ts_1.ClientError("Invalid impersonate payload: must include 'username', 'role_name', or 'role' with 'permission'");
+        throw new hdbError_ts_1.ClientError(`Invalid ${context}: must include 'username', 'role_name', or 'role' with 'permission'`);
     }
     if (hasRole) {
         if (typeof payload.role !== 'object' || payload.role === null) {
-            throw new hdbError_ts_1.ClientError("Invalid impersonate payload: 'role' must be an object");
+            throw new hdbError_ts_1.ClientError(`Invalid ${context}: 'role' must be an object`);
         }
         if (typeof payload.role.permission !== 'object' || payload.role.permission === null) {
-            throw new hdbError_ts_1.ClientError("Invalid impersonate payload: 'role.permission' must be an object");
+            throw new hdbError_ts_1.ClientError(`Invalid ${context}: 'role.permission' must be an object`);
         }
-        validateOperationsField(payload.role.permission);
+        validateOperationsField(payload.role.permission, context);
     }
 }
-function validateOperationsField(permission) {
+function validateOperationsField(permission, context = 'impersonate payload') {
     const operations = permission.operations;
     if (operations === undefined)
         return;
     if (!Array.isArray(operations)) {
-        throw new hdbError_ts_1.ClientError("Invalid impersonate payload: 'operations' must be an array");
+        throw new hdbError_ts_1.ClientError(`Invalid ${context}: 'operations' must be an array`);
     }
     const invalidOp = (0, operationPermissions_ts_1.validateOperations)(operations);
     if (invalidOp !== null) {
-        throw new hdbError_ts_1.ClientError(`Invalid impersonate payload: unknown operation '${invalidOp}'`);
+        throw new hdbError_ts_1.ClientError(`Invalid ${context}: unknown operation '${invalidOp}'`);
     }
 }
 function buildInlineUser(authenticatedUser, payload) {

package/dist/security/impersonation.js.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../../security/impersonation.ts"],"names":[],"mappings":";;;;;AAgBA,gDAiCC;AA/CD,uCAAmD;AACnD,gFAAwE;AACxE,+DAA4D;AAC5D,2FAA+D;AAC/D,uCAA0C;AAE1C;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CAAC,iBAAuB,EAAE,OAA2B;IAC5F,wCAAwC;IACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,yBAAW,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,IAAI,gBAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,6BAA6B;QAC7B,gBAAgB,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9B,wCAAwC;QACxC,gBAAgB,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACP,4CAA4C;QAC5C,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAEnC,sBAAsB;IACtB,gBAAgB,CAAC,aAAa,GAAG,IAAI,CAAC;IACtC,gBAAgB,CAAC,eAAe,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE9D,0BAAY,CAAC,IAAI,CAChB,2BAA2B,iBAAiB,CAAC,QAAQ,uBAAuB,gBAAgB,CAAC,QAAQ,GAAG,CACxG,CAAC;IAEF,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,yBAAW,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAE1F,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,yBAAW,CACpB,gGAAgG,CAChG,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAW,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACrF,MAAM,IAAI,yBAAW,CAAC,kEAAkE,CAAC,CAAC;QAC3F,CAAC;QACD,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC;IACnE,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAW,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,4CAAkB,EAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,yBAAW,CAAC,mDAAmD,SAAS,GAAG,CAAC,CAAC;IACxF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,iBAAuB,EAAE,OAA2B;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAK,CAAC,UAAU,EAAE;YAC3C,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAsB,GAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,eAAe,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,kEAAkE;IAClE,MAAM,MAAM,GAAS;QACpB,GAAG,UAAU;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;YACpB,CAAC,CAAC;gBACA,GAAG,UAAU,CAAC,IAAI;gBAClB,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC7C,EAAE,EAAE,iBAAiB,QAAQ,EAAE;aAC/B;YACF,CAAC,CAAC,UAAU,CAAC,IAAI;KAClB,CAAC;IACF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,iBAAuB,EAAE,OAA2B;IAC7E,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,yBAAW,CAAC,8BAA8B,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../../security/impersonation.ts"],"names":[],"mappings":";;;;;AAyBA,8CAEC;AAyBD,gDAqDC;AAQD,oDA2CC;AA5JD,6CAAyC;AAGzC,uCAAmD;AACnD,gFAAwE;AACxE,yEAAqE;AACrE,+DAA4D;AAC5D,2FAA+D;AAC/D,uCAA0C;AAC1C,2DAAwD;AACxD,uEAAyE;AAEzE;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAAC,MAAc,EAAE,UAAkB;IACnE,OAAO,GAAG,MAAM,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,4FAA4F;AAC5F,8FAA8F;AAC9F,SAAS,aAAa,CAAC,KAAU;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aACb,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,GAAQ,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACd,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC;QACR,CAAC,CAAC,CAAC,CACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CAAC,iBAAuB,EAAE,OAA2B;IAC5F,wCAAwC;IACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,yBAAW,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,IAAI,gBAAsB,CAAC;IAE3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,6BAA6B;QAC7B,gBAAgB,GAAG,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9B,wCAAwC;QACxC,gBAAgB,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACP,4CAA4C;QAC5C,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAEnC,+FAA+F;IAC/F,8FAA8F;IAC9F,qGAAqG;IACrG,IAAA,qCAAiB,EAAC,gBAAgB,EAAG,iBAAyB,CAAC,eAAe,CAAC,CAAC;IAChF,kGAAkG;IAClG,mGAAmG;IACnG,8FAA8F;IAC9F,IAAA,sDAA4B,EAAC,gBAAgB,EAAG,iBAAyB,CAAC,oBAAoB,CAAC,CAAC;IAEhG,4FAA4F;IAC5F,0FAA0F;IAC1F,kEAAkE;IAClE,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3B,gBAAgB,CAAC,IAAI,GAAG;YACvB,GAAG,gBAAgB,CAAC,IAAI;YACxB,IAAI,EAAE,iBAAiB,CAAC,eAAe,EAAE,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1E,eAAe,EAAE,CAAC;SAClB,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,gBAAgB,CAAC,aAAa,GAAG,IAAI,CAAC;IACtC,gBAAgB,CAAC,eAAe,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE9D,0BAAY,CAAC,IAAI,CAChB,2BAA2B,iBAAiB,CAAC,QAAQ,uBAAuB,gBAAgB,CAAC,QAAQ,GAAG,CACxG,CAAC;IAEF,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB,CACzC,MAAwB,EACxB,OAA2B,EAC3B,OAAO,GAAG,KAAK;IAEf,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAW,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,eAAe,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAW,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,UAAU,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,yBAAW,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;IACD,6FAA6F;IAC7F,4FAA4F;IAC5F,oFAAoF;IACpF,IAAI,CAAC,MAAM,IAAA,gCAAsB,GAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,yBAAW,CAAC,gFAAgF,CAAC,CAAC;IACzG,CAAC;IACD,uFAAuF;IACvF,MAAM,UAAU,GAAG;QAClB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU;QAC1B,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;KACO,CAAC;IAC5B,+FAA+F;IAC/F,MAAM,cAAc,GAAG,IAAA,sCAAiB,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/E,IAAI,cAAc;QAAE,MAAM,cAAc,CAAC;IACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU;YACV,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,QAAQ;YACZ,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SAClB;KACD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B,EAAE,OAAO,GAAG,qBAAqB;IACpF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,qBAAqB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAE1F,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,qEAAqE,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,4BAA4B,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACrF,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,uCAAuC,CAAC,CAAC;QAClF,CAAC;QACD,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC,EAAE,OAAO,GAAG,qBAAqB;IACpG,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,iCAAiC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,4CAAkB,EAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,wBAAwB,SAAS,GAAG,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,iBAAuB,EAAE,OAA2B;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAK,CAAC,UAAU,EAAE;YAC3C,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAsB,GAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,yBAAW,CAAC,8BAA8B,QAAQ,eAAe,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,kEAAkE;IAClE,MAAM,MAAM,GAAS;QACpB,GAAG,UAAU;QACb,IAAI,EAAE,UAAU,CAAC,IAAI;YACpB,CAAC,CAAC;gBACA,GAAG,UAAU,CAAC,IAAI;gBAClB,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC7C,EAAE,EAAE,iBAAiB,QAAQ,EAAE;aAC/B;YACF,CAAC,CAAC,UAAU,CAAC,IAAI;KAClB,CAAC;IACF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,iBAAuB,EAAE,OAA2B;IAC7E,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,yBAAW,CAAC,8BAA8B,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IAEhE,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE;YACL,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,iBAAiB,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3B,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE;SAC3B;KACD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO;IACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC;AAC3C,CAAC"}

package/dist/security/jsLoader.d.ts

@@ -6,6 +6,12 @@ import { ApplicationScope } from '../components/ApplicationScope.ts';
  * @param scope
  */
 export declare function scopedImport(filePath: string | URL, scope?: ApplicationScope): Promise<any>;
+/** Everything an application sees differently because of what it declared. Built once, at load. */
+export declare function scopedBindings(scope: ApplicationScope): {
+    databases: any;
+    tables: any;
+    defineTable: any;
+};
 export declare function getContext(): import("../index.ts").Context;
 export declare function getUser(): import("./user.ts").User;
 export declare function getResponse(): any;