@syncular/server 0.0.6-95 → 0.1.0

package/README.md

@@ -2,7 +2,7 @@
 
 Framework-agnostic server sync engine for Syncular: commit log, push/pull, scopes/subscriptions, snapshots, blobs, pruning/compaction, and proxy support.
 
-Typically used with `@syncular/server-hono` for HTTP routes, WebSocket wake-ups, and the admin console API.
+Typically used with `@syncular/server/hono` for HTTP routes, WebSocket realtime, and the admin console API.
 
 ## Install
 
@@ -22,4 +22,3 @@ npm install @syncular/server
 - Issues: https://github.com/syncular/syncular/issues
 
 > Status: Alpha. APIs and storage layouts may change between releases.
-

package/dist/auth-leases.d.ts

@@ -0,0 +1,85 @@
+import { type ScopeValues, type SyncAuthLeaseCapabilities, type SyncAuthLeaseIssueRequest, type SyncAuthLeaseIssueResponse, type SyncAuthLeasePayload, type SyncAuthLeaseProtectedHeader, type SyncOperation, type SyncOperationResult } from '@syncular/core';
+import { type Kysely } from 'kysely';
+import type { DbExecutor } from './dialect/types';
+import type { ServerHandlerCollection } from './handlers';
+import type { ServerTableHandler, SyncServerAuth } from './handlers/types';
+import type { SyncCoreDb } from './schema';
+import type { ScopeCacheBackend } from './subscriptions/cache';
+export interface AuthLeaseSignedToken {
+    ok: true;
+    token: string;
+    protectedHeader: SyncAuthLeaseProtectedHeader;
+    payload: SyncAuthLeasePayload;
+}
+export interface AuthLeaseSigningInput {
+    protectedHeader: SyncAuthLeaseProtectedHeader;
+    payload: SyncAuthLeasePayload;
+    signingInput: string;
+}
+export type AuthLeaseSigner = (input: AuthLeaseSigningInput) => Promise<Uint8Array>;
+export interface AuthLeaseIssueOptions<DB extends SyncCoreDb, Auth extends SyncServerAuth> {
+    db: Kysely<DB>;
+    auth: Auth;
+    handlers: ServerHandlerCollection<DB, Auth>;
+    request: SyncAuthLeaseIssueRequest;
+    issuer: string;
+    audience: string;
+    kid: string;
+    signer: AuthLeaseSigner;
+    capabilities?: SyncAuthLeaseCapabilities;
+    maxClockSkewMs?: number;
+    defaultTtlMs?: number;
+    maxTtlMs?: number;
+    nowMs?: () => number;
+    leaseId?: () => string;
+    scopeCache?: ScopeCacheBackend;
+    subject?: (auth: Auth) => Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+export interface AuthLeaseVerificationSuccess {
+    ok: true;
+    protectedHeader: SyncAuthLeaseProtectedHeader;
+    payload: SyncAuthLeasePayload;
+}
+export interface AuthLeaseVerificationFailure {
+    ok: false;
+    code: string;
+    message: string;
+    leaseId?: string;
+    kid?: string;
+    expiresAtMs?: number;
+}
+export type AuthLeaseVerificationResult = AuthLeaseVerificationSuccess | AuthLeaseVerificationFailure;
+export interface VerifyAuthLeaseTokenOptions {
+    token: string;
+    publicKey: CryptoKey;
+    nowMs?: number;
+    expectedIssuer?: string;
+    expectedAudience?: string;
+    expectedSchemaVersion?: number;
+}
+export interface ValidateAuthLeaseOperationOptions<DB extends SyncCoreDb, Auth extends SyncServerAuth> {
+    db: DbExecutor<DB>;
+    auth: Auth;
+    handler: ServerTableHandler<DB, Auth>;
+    payload: SyncAuthLeasePayload;
+    operation: SyncOperation;
+    opIndex: number;
+}
+export declare function issueAuthLease<DB extends SyncCoreDb, Auth extends SyncServerAuth>(options: AuthLeaseIssueOptions<DB, Auth>): Promise<SyncAuthLeaseIssueResponse | null>;
+export declare function signAuthLeaseToken(args: {
+    kid: string;
+    payload: SyncAuthLeasePayload;
+    signer: AuthLeaseSigner;
+}): Promise<AuthLeaseSignedToken>;
+export declare function createWebCryptoEs256AuthLeaseSigner(args: {
+    privateKey: CryptoKey;
+}): AuthLeaseSigner;
+export declare function verifyAuthLeaseToken(options: VerifyAuthLeaseTokenOptions): Promise<AuthLeaseVerificationResult>;
+export declare function authLeaseCoversOperation(args: {
+    payload: SyncAuthLeasePayload;
+    table: string;
+    op: string;
+    scopes: ScopeValues;
+}): AuthLeaseVerificationFailure | null;
+export declare function validateAuthLeaseOperation<DB extends SyncCoreDb, Auth extends SyncServerAuth>(options: ValidateAuthLeaseOperationOptions<DB, Auth>): Promise<SyncOperationResult | null>;
+//# sourceMappingURL=auth-leases.d.ts.map

package/dist/auth-leases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-leases.d.ts","sourceRoot":"","sources":["../src/auth-leases.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAWhB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAEzB,KAAK,4BAA4B,EACjC,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,4BAA4B,CAAC;IAC9C,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,4BAA4B,CAAC;IAC9C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB,MAAM,WAAW,qBAAqB,CACpC,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc;IAE3B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,EAAE,yBAAyB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,CACR,IAAI,EAAE,IAAI,KACP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,eAAe,EAAE,4BAA4B,CAAC;IAC9C,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,2BAA2B,GACnC,4BAA4B,GAC5B,4BAA4B,CAAC;AAEjC,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iCAAiC,CAChD,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc;IAE3B,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAClC,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc,EAE3B,OAAO,EAAE,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,GACvC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAwE5C;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqBhC;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,UAAU,EAAE,SAAS,CAAC;CACvB,GAAG,eAAe,CASlB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAoHtC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,4BAA4B,GAAG,IAAI,CAyBtC;AAED,wBAAsB,0BAA0B,CAC9C,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc,EAE3B,OAAO,EAAE,iCAAiC,CAAC,EAAE,EAAE,IAAI,CAAC,GACnD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAwErC"}

package/dist/auth-leases.js

@@ -0,0 +1,368 @@
+import { collectScopeVars, SYNC_AUTH_LEASE_ALG_ES256, SYNC_AUTH_LEASE_CODE_EXPIRED, SYNC_AUTH_LEASE_CODE_INVALID, SYNC_AUTH_LEASE_CODE_SCHEMA_MISMATCH, SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED, SYNC_AUTH_LEASE_PROTOCOL_VERSION, SYNC_AUTH_LEASE_TYP, SYNC_AUTH_LEASE_VERSION, SyncAuthLeasePayloadSchema, } from '@syncular/core';
+import { sql } from 'kysely';
+import { resolveEffectiveScopesForSubscriptions } from './subscriptions';
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+export async function issueAuthLease(options) {
+    const nowMs = options.nowMs?.() ?? Date.now();
+    const defaultTtlMs = positiveIntegerOrDefault(options.defaultTtlMs, 15 * 60 * 1000);
+    const maxTtlMs = positiveIntegerOrDefault(options.maxTtlMs, defaultTtlMs);
+    const requestedTtlMs = positiveIntegerOrDefault(options.request.ttlMs, defaultTtlMs);
+    const ttlMs = Math.min(requestedTtlMs, maxTtlMs);
+    const requestedSubscriptions = options.request.scopes.map((scope) => ({
+        id: scope.subscriptionId,
+        table: scope.table,
+        scopes: scope.values,
+        params: {},
+        cursor: -1,
+        crdtStateVectors: [],
+    }));
+    const resolved = await resolveEffectiveScopesForSubscriptions({
+        db: options.db,
+        auth: options.auth,
+        handlers: options.handlers,
+        scopeCache: options.scopeCache,
+        subscriptions: requestedSubscriptions,
+    });
+    const scopes = resolved
+        .filter((subscription) => subscription.status === 'active')
+        .map((subscription) => {
+        const requested = options.request.scopes.find((scope) => scope.subscriptionId === subscription.id);
+        return {
+            subscriptionId: subscription.id,
+            table: subscription.table,
+            values: subscription.scopes,
+            operations: requested?.operations ?? [],
+        };
+    })
+        .filter((scope) => scope.operations.length > 0);
+    if (scopes.length === 0) {
+        return null;
+    }
+    const payload = {
+        version: SYNC_AUTH_LEASE_VERSION,
+        leaseId: options.leaseId?.() ?? randomLeaseId(),
+        issuer: options.issuer,
+        audience: options.audience,
+        actorId: options.auth.actorId,
+        subject: (await options.subject?.(options.auth)) ?? {},
+        schemaVersion: options.request.schemaVersion,
+        protocolVersion: SYNC_AUTH_LEASE_PROTOCOL_VERSION,
+        issuedAtMs: nowMs,
+        notBeforeMs: nowMs,
+        expiresAtMs: nowMs + ttlMs,
+        maxClockSkewMs: Math.max(0, options.maxClockSkewMs ?? 30_000),
+        scopes,
+        capabilities: options.capabilities ?? {
+            allowBlobs: false,
+            allowCrdt: false,
+            allowEncryptedFields: false,
+        },
+    };
+    return signAuthLeaseToken({
+        kid: options.kid,
+        payload,
+        signer: options.signer,
+    });
+}
+export async function signAuthLeaseToken(args) {
+    const protectedHeader = {
+        alg: SYNC_AUTH_LEASE_ALG_ES256,
+        kid: args.kid,
+        typ: SYNC_AUTH_LEASE_TYP,
+    };
+    const payload = SyncAuthLeasePayloadSchema.parse(args.payload);
+    const signingInput = `${encodeJsonSegment(protectedHeader)}.${encodeJsonSegment(payload)}`;
+    const signature = await args.signer({
+        protectedHeader,
+        payload,
+        signingInput,
+    });
+    return {
+        ok: true,
+        token: `${signingInput}.${base64UrlEncode(signature)}`,
+        protectedHeader,
+        payload,
+    };
+}
+export function createWebCryptoEs256AuthLeaseSigner(args) {
+    return async ({ signingInput }) => new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, args.privateKey, textEncoder.encode(signingInput)));
+}
+export async function verifyAuthLeaseToken(options) {
+    const parts = options.token.split('.');
+    if (parts.length !== 3) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease token must have three JWS segments');
+    }
+    const protectedHeader = decodeJsonSegment(parts[0]);
+    if (!protectedHeader ||
+        protectedHeader.alg !== SYNC_AUTH_LEASE_ALG_ES256 ||
+        protectedHeader.typ !== SYNC_AUTH_LEASE_TYP) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease token has unsupported protected header');
+    }
+    const signature = base64UrlDecode(parts[2]);
+    if (!signature) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease signature segment is invalid');
+    }
+    const signingInput = `${parts[0]}.${parts[1]}`;
+    const verified = await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, options.publicKey, toBufferSource(signature), textEncoder.encode(signingInput));
+    if (!verified) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease signature verification failed', { kid: protectedHeader.kid });
+    }
+    const rawPayload = decodeJsonSegment(parts[1]);
+    const parsedPayload = SyncAuthLeasePayloadSchema.safeParse(rawPayload);
+    if (!parsedPayload.success) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease payload is invalid', {
+            kid: protectedHeader.kid,
+        });
+    }
+    const payload = parsedPayload.data;
+    if (options.expectedIssuer !== undefined &&
+        payload.issuer !== options.expectedIssuer) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease issuer mismatch', {
+            leaseId: payload.leaseId,
+            kid: protectedHeader.kid,
+        });
+    }
+    if (options.expectedAudience !== undefined &&
+        payload.audience !== options.expectedAudience) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease audience mismatch', {
+            leaseId: payload.leaseId,
+            kid: protectedHeader.kid,
+        });
+    }
+    if (options.expectedSchemaVersion !== undefined &&
+        payload.schemaVersion !== options.expectedSchemaVersion) {
+        return rejected(SYNC_AUTH_LEASE_CODE_SCHEMA_MISMATCH, 'auth lease schema version mismatch', { leaseId: payload.leaseId, kid: protectedHeader.kid });
+    }
+    const nowMs = options.nowMs ?? Date.now();
+    const skewMs = Math.max(0, payload.maxClockSkewMs);
+    if (nowMs + skewMs < payload.notBeforeMs) {
+        return rejected(SYNC_AUTH_LEASE_CODE_INVALID, 'auth lease is not valid yet', {
+            leaseId: payload.leaseId,
+            kid: protectedHeader.kid,
+        });
+    }
+    if (nowMs - skewMs > payload.expiresAtMs) {
+        return rejected(SYNC_AUTH_LEASE_CODE_EXPIRED, 'auth lease is expired', {
+            leaseId: payload.leaseId,
+            kid: protectedHeader.kid,
+            expiresAtMs: payload.expiresAtMs,
+        });
+    }
+    return { ok: true, protectedHeader, payload };
+}
+export function authLeaseCoversOperation(args) {
+    const leaseScope = args.payload.scopes.find((scope) => scope.table === args.table &&
+        scope.operations.some((operation) => operation === args.op));
+    if (!leaseScope) {
+        return rejected(SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, 'auth lease does not cover operation table or type', { leaseId: args.payload.leaseId });
+    }
+    for (const [key, value] of Object.entries(args.scopes)) {
+        if (!scopeValueCovers(leaseScope.values[key], value)) {
+            return rejected(SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH, 'auth lease does not cover scope', {
+                leaseId: args.payload.leaseId,
+            });
+        }
+    }
+    return null;
+}
+export async function validateAuthLeaseOperation(options) {
+    const requiredScopeKeys = Array.from(collectScopeVars(options.handler.scopePatterns));
+    const extracted = await extractOperationScopes({
+        db: options.db,
+        handler: options.handler,
+        operation: options.operation,
+    });
+    const requiresScopeValues = requiredScopeKeys.length > 0 && extracted.rowExistsOrWillBeWritten;
+    if (requiresScopeValues &&
+        requiredScopeKeys.some((key) => typeof extracted.scopes[key] !== 'string' ||
+            extracted.scopes[key].length === 0)) {
+        return authLeaseOperationError({
+            opIndex: options.opIndex,
+            code: SYNC_AUTH_LEASE_CODE_SCOPE_MISMATCH,
+            error: 'Auth lease operation scopes could not be extracted',
+        });
+    }
+    const leaseCoverage = authLeaseCoversOperation({
+        payload: options.payload,
+        table: options.operation.table,
+        op: options.operation.op,
+        scopes: extracted.scopes,
+    });
+    if (leaseCoverage) {
+        return authLeaseOperationError({
+            opIndex: options.opIndex,
+            code: leaseCoverage.code,
+            error: leaseCoverage.message,
+        });
+    }
+    if (requiresScopeValues) {
+        let currentScopes;
+        try {
+            currentScopes = await options.handler.resolveScopes({
+                db: options.db,
+                actorId: options.auth.actorId,
+                auth: options.auth,
+            });
+        }
+        catch {
+            return authLeaseOperationError({
+                opIndex: options.opIndex,
+                code: SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED,
+                error: 'Auth lease scopes could not be resolved for replay',
+            });
+        }
+        if (!storedScopesCoveredByScopeValues({
+            storedScopes: extracted.scopes,
+            allowedScopes: currentScopes,
+            requiredScopeKeys,
+        })) {
+            return authLeaseOperationError({
+                opIndex: options.opIndex,
+                code: SYNC_AUTH_LEASE_CODE_SCOPE_REVOKED,
+                error: 'Auth lease scope is no longer authorized',
+            });
+        }
+    }
+    return null;
+}
+async function extractOperationScopes(args) {
+    const existingRow = await readExistingRow({
+        db: args.db,
+        table: args.operation.table,
+        primaryKeyColumn: args.handler.primaryKeyColumn ?? 'id',
+        rowId: args.operation.row_id,
+    });
+    if (existingRow) {
+        return {
+            scopes: args.handler.extractScopes(existingRow),
+            rowExistsOrWillBeWritten: true,
+        };
+    }
+    if (args.operation.op === 'delete') {
+        return { scopes: {}, rowExistsOrWillBeWritten: false };
+    }
+    const payloadRecord = args.operation.payload &&
+        typeof args.operation.payload === 'object' &&
+        !Array.isArray(args.operation.payload)
+        ? args.operation.payload
+        : {};
+    return {
+        scopes: args.handler.extractScopes({
+            ...payloadRecord,
+            [args.handler.primaryKeyColumn ?? 'id']: args.operation.row_id,
+        }),
+        rowExistsOrWillBeWritten: true,
+    };
+}
+async function readExistingRow(args) {
+    const result = await sql `
+    SELECT *
+    FROM ${sql.table(args.table)}
+    WHERE ${sql.ref(args.primaryKeyColumn)} = ${args.rowId}
+    LIMIT 1
+  `.execute(args.db);
+    return result.rows[0] ?? null;
+}
+function storedScopesCoveredByScopeValues(args) {
+    for (const key of args.requiredScopeKeys) {
+        const storedValue = args.storedScopes[key];
+        if (typeof storedValue !== 'string' || storedValue.length === 0) {
+            return false;
+        }
+        if (!scopeValueCovers(args.allowedScopes[key], storedValue)) {
+            return false;
+        }
+    }
+    return true;
+}
+function authLeaseOperationError(args) {
+    return {
+        opIndex: args.opIndex,
+        status: 'error',
+        error: args.error,
+        code: args.code,
+        retriable: false,
+    };
+}
+function scopeValueCovers(leaseValue, requestedValue) {
+    if (leaseValue === undefined)
+        return false;
+    const leaseValues = Array.isArray(leaseValue) ? leaseValue : [leaseValue];
+    const requestedValues = Array.isArray(requestedValue)
+        ? requestedValue
+        : [requestedValue];
+    if (leaseValues.includes('*'))
+        return true;
+    return requestedValues.every((value) => leaseValues.includes(value));
+}
+function positiveIntegerOrDefault(value, defaultValue) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0
+        ? value
+        : defaultValue;
+}
+function randomLeaseId() {
+    if (typeof crypto !== 'undefined' &&
+        typeof crypto.randomUUID === 'function') {
+        return `lease_${crypto.randomUUID()}`;
+    }
+    return `lease_${Date.now().toString(36)}_${Math.random()
+        .toString(36)
+        .slice(2)}`;
+}
+function encodeJsonSegment(value) {
+    return base64UrlEncode(textEncoder.encode(JSON.stringify(value)));
+}
+function decodeJsonSegment(segment) {
+    const bytes = base64UrlDecode(segment);
+    if (!bytes)
+        return null;
+    try {
+        return JSON.parse(textDecoder.decode(bytes));
+    }
+    catch {
+        return null;
+    }
+}
+function base64UrlEncode(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+function base64UrlDecode(value) {
+    const normalized = value.replaceAll('-', '+').replaceAll('_', '/');
+    const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=');
+    try {
+        const binary = atob(padded);
+        const bytes = new Uint8Array(binary.length);
+        for (let index = 0; index < binary.length; index += 1) {
+            bytes[index] = binary.charCodeAt(index);
+        }
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+function toBufferSource(bytes) {
+    if (bytes.buffer instanceof ArrayBuffer) {
+        return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    }
+    const owned = new Uint8Array(bytes.byteLength);
+    owned.set(bytes);
+    return owned;
+}
+function rejected(code, message, details = {}) {
+    return {
+        ok: false,
+        code,
+        message,
+        ...details,
+    };
+}
+//# sourceMappingURL=auth-leases.js.map

package/dist/auth-leases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-leases.js","sourceRoot":"","sources":["../src/auth-leases.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAGhB,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,oCAAoC,EACpC,mCAAmC,EACnC,kCAAkC,EAClC,gCAAgC,EAChC,mBAAmB,EACnB,uBAAuB,EAKvB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AAK1C,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAC;AAGzE,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAmFtC,MAAM,CAAC,KAAK,UAAU,cAAc,CAIlC,OAAwC;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,CAAC,YAAY,EACpB,EAAE,GAAG,EAAE,GAAG,IAAI,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,wBAAwB,CAC7C,OAAO,CAAC,OAAO,CAAC,KAAK,EACrB,YAAY,CACb,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK,CAAC,cAAc;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,CAAC,CAAC;QACV,gBAAgB,EAAE,EAAE;KACrB,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,sCAAsC,CAAC;QAC5D,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,sBAAsB;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,QAAQ;SACpB,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QACpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,EAAE,CACpD,CAAC;QACF,OAAO;YACL,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE;SACxC,CAAC;IACJ,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAyB;QACpC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,aAAa,EAAE;QAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QAC7B,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QACtD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,eAAe,EAAE,gCAAgC;QACjD,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK,GAAG,KAAK;QAC1B,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;QAC7D,MAAM;QACN,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI;YACpC,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,KAAK;YAChB,oBAAoB,EAAE,KAAK;SAC5B;KACF,CAAC;IAEF,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,eAAe,GAAiC;QACpD,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,mBAAmB;KACzB,CAAC;IACF,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,iBAAiB,CAC7E,OAAO,CACR,EAAE,CAAC;IACJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAClC,eAAe;QACf,OAAO;QACP,YAAY;KACb,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,GAAG,YAAY,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE;QACtD,eAAe;QACf,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAEnD;IACC,OAAO,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAChC,IAAI,UAAU,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACtB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,IAAI,CAAC,UAAU,EACf,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CACF,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,QAAQ,CACb,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CACvC,KAAK,CAAC,CAAC,CAAE,CACV,CAAC;IACF,IACE,CAAC,eAAe;QAChB,eAAe,CAAC,GAAG,KAAK,yBAAyB;QACjD,eAAe,CAAC,GAAG,KAAK,mBAAmB,EAC3C,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CACb,4BAA4B,EAC5B,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,OAAO,CAAC,SAAS,EACjB,cAAc,CAAC,SAAS,CAAC,EACzB,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CACb,4BAA4B,EAC5B,0CAA0C,EAC1C,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAU,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,0BAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,QAAQ,CACb,4BAA4B,EAC5B,+BAA+B,EAC/B;YACE,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC;IACnC,IACE,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EACzC,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,4BAA4B,EAC5B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,gBAAgB,EAC7C,CAAC;QACD,OAAO,QAAQ,CACb,4BAA4B,EAC5B,8BAA8B,EAC9B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,qBAAqB,EACvD,CAAC;QACD,OAAO,QAAQ,CACb,oCAAoC,EACpC,oCAAoC,EACpC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,QAAQ,CACb,4BAA4B,EAC5B,6BAA6B,EAC7B;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;SACzB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,4BAA4B,EAAE,uBAAuB,EAAE;YACrE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,eAAe,CAAC,GAAG;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAKxC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CACzC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAC1B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC,CAC9D,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,QAAQ,CACb,mCAAmC,EACnC,mDAAmD,EACnD,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAClC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,QAAQ,CACb,mCAAmC,EACnC,iCAAiC,EACjC;gBACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;aAC9B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAI9C,OAAoD;IAEpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAChD,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;QAC7C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,MAAM,mBAAmB,GACvB,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,wBAAwB,CAAC;IACrE,IACE,mBAAmB;QACnB,iBAAiB,CAAC,IAAI,CACpB,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YACzC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CACrC,EACD,CAAC;QACD,OAAO,uBAAuB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,mCAAmC;YACzC,KAAK,EAAE,oDAAoD;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QAC9B,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACxB,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,uBAAuB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,KAAK,EAAE,aAAa,CAAC,OAAO;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,aAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;gBAClD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;gBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,oDAAoD;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IACE,CAAC,gCAAgC,CAAC;YAChC,YAAY,EAAE,SAAS,CAAC,MAAM;YAC9B,aAAa,EAAE,aAAa;YAC5B,iBAAiB;SAClB,CAAC,EACF,CAAC;YACD,OAAO,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,0CAA0C;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,sBAAsB,CAGnC,IAID;IACC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;QACxC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;QAC3B,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI;QACvD,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC;YAC/C,wBAAwB,EAAE,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,CAAC,OAAO;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO;QACxB,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YACjC,GAAG,aAAa;YAChB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;SAC/D,CAAC;QACF,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAwB,IAKrD;IACC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAyB;;WAExC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,KAAK;;GAEvD,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,gCAAgC,CAAC,IAIzC;IACC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAAC,IAIhC;IACC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA2C,EAC3C,cAAmC;IAEnC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACrB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,YAAoB;IAEpB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACtE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED,SAAS,aAAa;IACpB,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EACvC,CAAC;QACD,OAAO,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;SACrD,QAAQ,CAAC,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAI,OAAe;IAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAC9B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACvD,GAAG,CACJ,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,IAAI,KAAK,CAAC,MAAM,YAAY,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe,EACf,OAAO,GAAkE,EAAE;IAE3E,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC;AACJ,CAAC"}

package/dist/better-sqlite3.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @syncular/server/better-sqlite3 - better-sqlite3 dialect for sync
+ *
+ * Provides a Kysely dialect for better-sqlite3 (Node.js).
+ * SQLite-compatible — use with @syncular/server/sqlite.
+ */
+import type { Database as BetterSqlite3Database } from 'better-sqlite3';
+import { SqliteDialect } from 'kysely';
+export interface BetterSqlite3PathOptions {
+    /** Path to SQLite database file, or ':memory:' for in-memory */
+    path: string;
+}
+export interface BetterSqlite3InstanceOptions {
+    /** An existing better-sqlite3 Database instance */
+    database: BetterSqlite3Database;
+}
+export type BetterSqlite3Options = BetterSqlite3PathOptions | BetterSqlite3InstanceOptions;
+/**
+ * Create the better-sqlite3 dialect directly.
+ */
+export declare function createBetterSqlite3Dialect(options: BetterSqlite3Options): SqliteDialect;
+//# sourceMappingURL=better-sqlite3.d.ts.map

package/dist/better-sqlite3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-sqlite3.d.ts","sourceRoot":"","sources":["../src/better-sqlite3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,IAAI,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,mDAAmD;IACnD,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,MAAM,oBAAoB,GAC5B,wBAAwB,GACxB,4BAA4B,CAAC;AAEjC;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAIf"}

package/dist/better-sqlite3.js

@@ -0,0 +1,16 @@
+/**
+ * @syncular/server/better-sqlite3 - better-sqlite3 dialect for sync
+ *
+ * Provides a Kysely dialect for better-sqlite3 (Node.js).
+ * SQLite-compatible — use with @syncular/server/sqlite.
+ */
+import Database from 'better-sqlite3';
+import { SqliteDialect } from 'kysely';
+/**
+ * Create the better-sqlite3 dialect directly.
+ */
+export function createBetterSqlite3Dialect(options) {
+    const database = 'database' in options ? options.database : new Database(options.path);
+    return new SqliteDialect({ database });
+}
+//# sourceMappingURL=better-sqlite3.js.map

package/dist/better-sqlite3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-sqlite3.js","sourceRoot":"","sources":["../src/better-sqlite3.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAgBvC;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA6B;IAE7B,MAAM,QAAQ,GACZ,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/blobs/access.d.ts

@@ -0,0 +1,35 @@
+import { type Kysely } from 'kysely';
+import type { ServerTableHandler, SyncServerAuth } from '../handlers/types';
+import type { SyncCoreDb } from '../schema';
+export type ScopedBlobAccessDecisionReason = 'allowed' | 'handler_missing' | 'missing_reference' | 'resolve_scopes_failed' | 'scope_denied';
+export interface ScopedBlobAccessDecision {
+    actorId: string;
+    partitionId: string;
+    hash: string;
+    allowed: boolean;
+    reason: ScopedBlobAccessDecisionReason;
+    table?: string;
+    column?: string;
+    rowId?: string;
+}
+export interface ScopedBlobReferenceTable {
+    table: string;
+    blobColumns: readonly string[];
+    primaryKeyColumn?: string;
+    candidateLimit?: number;
+}
+export interface CreateScopedBlobAccessCheckerOptions<DB extends SyncCoreDb = SyncCoreDb, Auth extends SyncServerAuth = SyncServerAuth> {
+    db: Kysely<DB>;
+    handlers: readonly ServerTableHandler<DB, Auth>[];
+    references: readonly ScopedBlobReferenceTable[];
+    candidateLimit?: number;
+    onDecision?: (decision: ScopedBlobAccessDecision) => void;
+}
+export interface ScopedBlobAccessRequest<Auth extends SyncServerAuth> {
+    actorId: string;
+    partitionId: string;
+    hash: string;
+    auth?: Auth;
+}
+export declare function createScopedBlobAccessChecker<DB extends SyncCoreDb, Auth extends SyncServerAuth = SyncServerAuth>(options: CreateScopedBlobAccessCheckerOptions<DB, Auth>): (request: ScopedBlobAccessRequest<Auth>) => Promise<boolean>;
+//# sourceMappingURL=access.d.ts.map

package/dist/blobs/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/blobs/access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,cAAc,CAAC;AAEnB,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,8BAA8B,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oCAAoC,CACnD,EAAE,SAAS,UAAU,GAAG,UAAU,EAClC,IAAI,SAAS,cAAc,GAAG,cAAc;IAE5C,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACf,QAAQ,EAAE,SAAS,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IAClD,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,uBAAuB,CAAC,IAAI,SAAS,cAAc;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,wBAAgB,6BAA6B,CAC3C,EAAE,SAAS,UAAU,EACrB,IAAI,SAAS,cAAc,GAAG,cAAc,EAE5C,OAAO,EAAE,oCAAoC,CAAC,EAAE,EAAE,IAAI,CAAC,GACtD,CAAC,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CA8G9D"}