permdock 0.0.0 → 0.1.0

package/dist/scopes-cKVp_WTw.js

@@ -0,0 +1,212 @@
+import { S as isForbiddenKey } from "./permissions-DC7GROPA.js";
+//#region src/core/scopes.ts
+const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
+const NAME = /^[a-z][a-z0-9_]*$/u;
+/** A policy without `scopes` keeps the historical pair: `tenant`, and `team` inside it. */
+const IMPLICIT = Object.freeze([Object.freeze({ name: "tenant" }), Object.freeze({
+	name: "team",
+	within: "tenant"
+})]);
+function fail(message) {
+	throw new Error(`PermDock: ${message}`);
+}
+/**
+* Validates `definePolicy({ scopes })`. Declaration order is the scope order;
+* every scope after the first names an earlier one in `within`, so the scopes
+* form one tree rooted at the first and have no cycles.
+* A scope named `tenant` is the first and `team` the second, so the aliases
+* never point at two different scopes.
+*/
+function defineScopes(input) {
+	if (input === void 0) return Object.freeze([]);
+	if (input === null || typeof input !== "object" || Array.isArray(input)) fail("definePolicy({ scopes }) must be an object");
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(input)) {
+		if (isForbiddenKey(name) || RESERVED.has(name) || !NAME.test(name)) fail(`scope name '${name}' must be lower snake case and not global or resource`);
+		const declaration = input[name];
+		if (declaration === void 0 || declaration === null || typeof declaration !== "object" || typeof declaration.key !== "string" || declaration.key === "") fail(`scopes.${name} needs a key`);
+		const index = out.length;
+		if (name === "tenant" && index !== 0) fail("scope 'tenant' must be declared first");
+		if (name === "team" && index !== 1) fail("scope 'team' must be declared second");
+		const within = declaration.within;
+		if (within !== void 0 && !seen.has(within)) fail(`scopes.${name}.within names '${within}', which is not declared before it`);
+		if (name === "team" && within === void 0 && seen.has("tenant")) fail("scopes.team needs within: 'tenant'");
+		if (index > 0 && within === void 0) fail(`scopes.${name} needs within: every scope after the first sits inside an earlier one`);
+		seen.add(name);
+		out.push(Object.freeze(within === void 0 ? {
+			name,
+			key: declaration.key
+		} : {
+			name,
+			key: declaration.key,
+			within
+		}));
+	}
+	return Object.freeze(out);
+}
+/** The scopes a policy or snapshot evaluates with: the declared list, or the implicit pair. */
+function scopeList(declared) {
+	return declared === void 0 || declared.length === 0 ? IMPLICIT : declared;
+}
+/** A declared name, or an alias: `tenant` is the first scope, `team` the second. */
+function resolveScope(scopes, name) {
+	if (typeof name !== "string") return;
+	if (scopes.some((scope) => scope.name === name)) return name;
+	if (name === "tenant") return scopes[0]?.name;
+	if (name === "team") return scopes[1]?.name;
+}
+function findScope(scopes, name) {
+	return scopes.find((scope) => scope.name === name);
+}
+/** `name` and its ancestors, innermost first. */
+function scopeChain(scopes, name) {
+	const chain = [];
+	let current = findScope(scopes, name);
+	while (current !== void 0 && !chain.includes(current.name)) {
+		chain.push(current.name);
+		current = current.within === void 0 ? void 0 : findScope(scopes, current.within);
+	}
+	return chain;
+}
+/** The scope the active tenant selects an instance of: the first declared one. */
+function rootScope(scopes) {
+	return scopes[0]?.name;
+}
+/** The id a membership holds for `scope`: its own id, or the `within` entry of an ancestor. */
+function scopeIdOf(membership, scope) {
+	if (membership.scope === scope) return membership.id;
+	const within = membership.within;
+	if (within === void 0 || !Object.hasOwn(within, scope)) return;
+	return within[scope];
+}
+/**
+* A membership of the first scope itself (the only scope without a parent):
+* its id is a tenant. Needs no scope list, for code that holds only a subject.
+*/
+function rootMembershipId(membership) {
+	if (membership.scope !== void 0) return membership.within === void 0 ? membership.id : void 0;
+	return membership.team === void 0 ? membership.tenant : void 0;
+}
+/** The instance of the first scope a membership sits in; what the active tenant selects. */
+function tenantOf(membership, scopes) {
+	const root = rootScope(scopes);
+	return root === void 0 ? void 0 : scopeIdOf(membership, root);
+}
+function isId(value) {
+	return typeof value === "string" && value !== "";
+}
+function roleList(value) {
+	if (!Array.isArray(value)) return;
+	return value.filter((item) => typeof item === "string");
+}
+/**
+* The canonical form of one membership, or `undefined` when it is malformed
+* (fail-closed: it grants nothing). A named membership is
+* `{ scope, id, within }` with one `within` entry per ancestor of `scope`;
+* the `tenant` / `team` input shape and alias names normalise to it. A
+* resource membership keeps `on`. Shapes are exclusive.
+*/
+function normalizeMembership(input, scopes) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return;
+	const raw = input;
+	const roles = roleList(raw["roles"]);
+	if (roles === void 0) return;
+	const extra = {};
+	if (typeof raw["via"] === "string") extra.via = raw["via"];
+	if (typeof raw["expiresAt"] === "number") extra.expiresAt = raw["expiresAt"];
+	if (typeof raw["grantedBy"] === "string" && raw["grantedBy"] !== "") extra.grantedBy = raw["grantedBy"];
+	if (typeof raw["reason"] === "string" && raw["reason"] !== "") extra.reason = raw["reason"];
+	const eligible = roleList(raw["eligible"]);
+	if (eligible !== void 0 && eligible.length > 0) extra.eligible = Object.freeze([...eligible]);
+	const member = raw["member"] !== null && typeof raw["member"] === "object" && !Array.isArray(raw["member"]) ? raw["member"]["group"] : void 0;
+	if (typeof member === "string" && member !== "") extra.member = Object.freeze({ group: member });
+	if (raw["managedBy"] === "idp") extra.managedBy = "idp";
+	if (Array.isArray(raw["entitlements"])) {
+		const seats = raw["entitlements"].filter((item) => typeof item === "string" && item !== "");
+		if (seats.length > 0) extra.entitlements = Object.freeze(seats);
+	}
+	const named = raw["scope"] !== void 0 || raw["id"] !== void 0;
+	const legacy = raw["tenant"] !== void 0 || raw["team"] !== void 0;
+	const on = raw["on"];
+	if (on !== void 0) {
+		if (named || legacy || on === null || typeof on !== "object") return;
+		const target = on;
+		if (!isId(target["resource"]) || !isId(target["id"])) return;
+		return Object.freeze({
+			on: Object.freeze({
+				resource: target["resource"],
+				id: target["id"]
+			}),
+			roles: Object.freeze([...roles]),
+			...extra
+		});
+	}
+	let scope;
+	let id;
+	let within = {};
+	if (named) {
+		if (legacy) return;
+		scope = resolveScope(scopes, raw["scope"]);
+		id = raw["id"];
+		if (raw["within"] !== void 0) {
+			if (raw["within"] === null || typeof raw["within"] !== "object" || Array.isArray(raw["within"])) return;
+			within = raw["within"];
+		}
+	} else if (raw["team"] !== void 0) {
+		scope = resolveScope(scopes, "team");
+		id = raw["team"];
+		const parent = resolveScope(scopes, "tenant");
+		if (raw["tenant"] !== void 0 && parent !== void 0) within = { [parent]: raw["tenant"] };
+	} else if (raw["tenant"] === void 0) return;
+	else {
+		scope = resolveScope(scopes, "tenant");
+		id = raw["tenant"];
+	}
+	if (scope === void 0 || !isId(id)) return;
+	const ancestors = scopeChain(scopes, scope).slice(1);
+	const resolved = {};
+	for (const key of Object.keys(within)) {
+		if (isForbiddenKey(key)) return;
+		const name = resolveScope(scopes, key);
+		const value = within[key];
+		if (name !== void 0 && ancestors.includes(name) && isId(value)) resolved[name] = value;
+	}
+	if (ancestors.some((name) => resolved[name] === void 0)) return;
+	return Object.freeze({
+		scope,
+		id,
+		...ancestors.length === 0 ? {} : { within: Object.freeze(resolved) },
+		roles: Object.freeze([...roles]),
+		...extra
+	});
+}
+function normalizeMemberships(input, scopes) {
+	if (!Array.isArray(input)) return [];
+	const out = [];
+	for (const item of input) {
+		const membership = normalizeMembership(item, scopes);
+		if (membership !== void 0) out.push(membership);
+	}
+	return out;
+}
+/**
+* A subject's memberships in canonical form. Resolved subjects already are;
+* this accepts a hand-built subject passed straight to a condition evaluator
+* or compiler.
+*/
+function subjectMemberships(memberships, scopes) {
+	const list = memberships ?? [];
+	return list.some((membership) => membership.tenant !== void 0 || membership.team !== void 0) ? normalizeMemberships(list, scopes) : list;
+}
+/**
+* Whether a named membership applies under the active tenant: a membership
+* whose chain includes the first scope counts only inside the active tenant.
+*/
+function activeFor(membership, scopes, active) {
+	const root = rootScope(scopes);
+	if (root === void 0 || membership.scope === void 0 || !scopeChain(scopes, membership.scope).includes(root)) return true;
+	return active !== void 0 && scopeIdOf(membership, root) === active;
+}
+//#endregion
+export { resolveScope as a, scopeChain as c, subjectMemberships as d, tenantOf as f, normalizeMemberships as i, scopeIdOf as l, defineScopes as n, rootMembershipId as o, findScope as r, rootScope as s, activeFor as t, scopeList as u };

package/dist/server/index.d.ts

@@ -0,0 +1,123 @@
+import { $ as DecisionSink, Ft as Credential, Ht as CredentialPrincipal, J as AuthEvent, Mn as Decision, St as SubjectResolver, X as CredentialVerifier, hr as Subject, mr as Principal, mt as SettingsSource } from "../policy-CInmNGkM.js";
+import { d as Permission, p as PermissionTree } from "../permissions-B4apnahQ.js";
+import { a as PermDockValidationError, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as ProblemDetails, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DbZ1YOnb.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
+import { S as ConnectionOptions, _ as invalidSignatureProblem, a as ServerPermDockOptions, b as Connection, c as createEvaluationsHandler, d as WebBotAuthJwk, f as WebBotAuthKeyLookup, g as discoverViaSignatureAgent, h as WebBotAuthVerifier, i as ServerPermDock, l as DiscoverViaSignatureAgentOptions, m as WebBotAuthOptions, n as OpenApiHooks, p as WebBotAuthKeys, r as ProtectOptions, s as createPermDock, t as Guard, u as InvalidSignatureError, v as invalidSignatureResponse, x as ConnectionData, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+//#region src/server/credentials.d.ts
+/** `on('auth')` causes for an API key that resolves to the anonymous subject. */
+type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";
+/** An opaque key split at its last `_`: `pdk_<id>_<secret><checksum>`. */
+type ApiKeyParts = {
+  readonly id: string;
+  readonly secret: string;
+};
+/** What an application stores per key: the credential and the key's hash, never the key. */
+type StoredCredential = {
+  readonly credential: Credential;
+  readonly hash: string;
+};
+/**
+ * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
+ * the secret 43 base62 characters and the checksum the 6 base62 characters of
+ * the CRC-32 of everything before it. Anything else, including a checksum
+ * that does not match, is `undefined`.
+ */
+export declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
+/**
+ * A fresh `pdk_<id>_<secret><checksum>`: a 43-character base62 secret (about
+ * 256 bits) and a 6-character CRC-32 checksum, so a secret scanner can tell a
+ * real key from a lookalike without calling the issuer.
+ */
+export declare function generateApiKey(id: string): string;
+/** base64url SHA-256 of the whole key, the value to store and compare. */
+export declare function hashApiKey(key: string): Promise<string>;
+/**
+ * A `CredentialVerifier` over the application's own table: `find` looks a
+ * key up by the id in it, and the key's hash is compared in constant time.
+ * A record that is not a valid v1 credential, or whose id is not the key's,
+ * verifies to `null`. A throwing `find` propagates, so the resolver denies
+ * with `source-threw`.
+ */
+export declare function apiKeyVerifier(options: {
+  readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
+  /** Passed through as the verifier's `touch`, for a `lastUsedAt` column. */
+  readonly touch?: CredentialVerifier["touch"];
+}): CredentialVerifier;
+type MemoryCredentials = CredentialVerifier & {
+  /** Stores `credential` and returns its key; the key is never stored. */
+  issue(credential: Credential): Promise<string>;
+  /** A new secret for the same id; the old key stops verifying at once. */
+  rotate(id: string): Promise<string | undefined>;
+  /** `true` when a credential was removed. */
+  revoke(id: string): boolean;
+  list(): readonly Credential[];
+  /** When `touch` last recorded a use of `id`, in Unix seconds. */
+  lastUsedAt(id: string): number | undefined;
+};
+/**
+ * In-process credentials for tests and single-replica apps. `issue`, `rotate`
+ * and `revoke` write `credential` events to `sink` when one is given.
+ */
+export declare function memoryCredentials(options?: {
+  readonly sink?: DecisionSink;
+  readonly source?: string;
+}): MemoryCredentials;
+type ApiKeySubjectOptions = {
+  readonly verifier: CredentialVerifier;
+  /** The definitions, to turn the credential's permission keys into its delegation. */
+  readonly permissions: PermissionTree;
+  /**
+   * The live owner of a user-bound key: roles and memberships as of this
+   * request. `null` (a deleted or suspended user) is anonymous. Without it
+   * the owner is `{ id, kind: 'user' }` and its rights come from the
+   * `memberships` source passed to `createPermDock`.
+   */
+  readonly owner?: (id: string) => Principal | null | undefined | Promise<Principal | null | undefined>;
+  /** `true` when the application revoked the credential id; a throw denies. */
+  readonly revoked?: (id: string) => boolean | Promise<boolean>;
+  /**
+   * The tenant `credentials` policy, checked on every use so a tightened
+   * policy reaches existing keys: a service key's own tenant, a user key's
+   * the `tenant` the resolver is called with. A throw denies.
+   */
+  readonly settings?: SettingsSource;
+  /** Receives a `credential` event with operation `used` for sampled uses. */
+  readonly sink?: DecisionSink;
+  /** Fraction of uses reported to `sink`, in `(0, 1]`; defaults to 1. */
+  readonly sample?: number;
+  /** The `source` of `used` events; defaults to `permdock`. */
+  readonly source?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/**
+ * A `SubjectResolver` for opaque API keys (`pdk_<id>_<secret>`): each call
+ * resolves a key into the subject its credential acts as. Every failure (a
+ * malformed or unknown key, a record that is not a valid credential, expiry,
+ * a tenant policy the key breaks, a revoked id, a missing owner, a throwing
+ * verifier or callback) is the anonymous subject, never a throw.
+ */
+export declare function subjectFromApiKey(options: ApiKeySubjectOptions): SubjectResolver<string | undefined | null, CredentialPrincipal>;
+//#endregion
+//#region src/server/map-error.d.ts
+/**
+ * Turns a thrown PermDock error into its Problem Details response. Returns
+ * `undefined` for anything else so the framework's own error path takes over.
+ */
+export declare function problemFromError(error: unknown): Response | undefined;
+//#endregion
+//#region src/server/problem.d.ts
+export declare const PROBLEM_BASE = "https://permdock.dev/problems";
+export declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
+export declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
+export declare function validationProblem(detail: string): Response;
+export declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject, options?: {
+  readonly instance?: string;
+  readonly approval?: ApprovalHint;
+  /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
+  readonly disclosure?: "hide" | "reveal";
+  /** Whether the request carried credentials, which picks the `401` challenge. */
+  readonly credentials?: boolean;
+}): Response;
+//#endregion
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ServerPermDock, type ServerPermDockOptions, type StoredCredential, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, createEvaluationsHandler, createPermDock, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, verifyWebBotAuth };

package/dist/server/index.js

@@ -0,0 +1,8 @@
+import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
+import { s as memoryRevocationFeed } from "../credential-B_rkUNlY.js";
+import { a as problemFromDecision, l as validationProblem, o as problemResponse, t as PROBLEM_BASE, u as wwwAuthenticate } from "../problem-Cgp9-KZA.js";
+import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
+import { n as createPermDock } from "../create-CSkhDU9T.js";
+import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../credentials-BgRX3WEg.js";
+import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, createEvaluationsHandler, createPermDock, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, subjectFromApiKey, validationProblem, verifyWebBotAuth, wwwAuthenticate };

package/dist/sha256-BO0swRXL.js

@@ -0,0 +1,150 @@
+//#region src/core/sha256.ts
+const K = [
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+];
+function rotr(value, bits) {
+	return value >>> bits | value << 32 - bits;
+}
+/**
+* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and WinterTC-safe.
+*/
+function sha256(message) {
+	const bytes = new TextEncoder().encode(message);
+	const bitLength = bytes.length * 8;
+	const paddedLength = bytes.length + 9 + 63 >> 6 << 6;
+	const padded = new Uint8Array(paddedLength);
+	padded.set(bytes);
+	padded[bytes.length] = 128;
+	const view = new DataView(padded.buffer);
+	view.setUint32(paddedLength - 4, bitLength, false);
+	let h0 = 1779033703;
+	let h1 = 3144134277;
+	let h2 = 1013904242;
+	let h3 = 2773480762;
+	let h4 = 1359893119;
+	let h5 = 2600822924;
+	let h6 = 528734635;
+	let h7 = 1541459225;
+	const w = /* @__PURE__ */ new Int32Array(64);
+	for (let offset = 0; offset < paddedLength; offset += 64) {
+		for (let i = 0; i < 16; i += 1) w[i] = view.getInt32(offset + i * 4, false);
+		for (let i = 16; i < 64; i += 1) {
+			const w15 = w[i - 15] ?? 0;
+			const w2 = w[i - 2] ?? 0;
+			const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+			const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+			w[i] = (w[i - 16] ?? 0) + s0 + (w[i - 7] ?? 0) + s1 | 0;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		let f = h5;
+		let g = h6;
+		let h = h7;
+		for (let i = 0; i < 64; i += 1) {
+			const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const temp1 = h + S1 + ch + (K[i] ?? 0) + (w[i] ?? 0) | 0;
+			const temp2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) | 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + temp1 | 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 | 0;
+		}
+		h0 = h0 + a | 0;
+		h1 = h1 + b | 0;
+		h2 = h2 + c | 0;
+		h3 = h3 + d | 0;
+		h4 = h4 + e | 0;
+		h5 = h5 + f | 0;
+		h6 = h6 + g | 0;
+		h7 = h7 + h | 0;
+	}
+	const out = /* @__PURE__ */ new Uint8Array(32);
+	const outView = new DataView(out.buffer);
+	outView.setInt32(0, h0, false);
+	outView.setInt32(4, h1, false);
+	outView.setInt32(8, h2, false);
+	outView.setInt32(12, h3, false);
+	outView.setInt32(16, h4, false);
+	outView.setInt32(20, h5, false);
+	outView.setInt32(24, h6, false);
+	outView.setInt32(28, h7, false);
+	return out;
+}
+function bytesToBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+//#endregion
+export { sha256 as n, bytesToBase64Url as t };

package/dist/sink-Bd9PSyfq.js

@@ -0,0 +1,141 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+//#region src/core/sink.ts
+/** The closed list of CloudEvents `type` values PermDock emits. */
+const CLOUD_EVENT_TYPES = Object.freeze({
+	decision: "dev.permdock.decision",
+	approval: "dev.permdock.approval",
+	directory: "dev.permdock.directory",
+	membership: "dev.permdock.membership",
+	catalog: "dev.permdock.catalog",
+	credential: "dev.permdock.credential",
+	accessStarted: "dev.permdock.access.started",
+	accessEnded: "dev.permdock.access.ended",
+	accessRevoked: "dev.permdock.access.revoked"
+});
+function cloudEventType(event) {
+	switch (event.type) {
+		case "directory": return CLOUD_EVENT_TYPES.directory;
+		case "membership": return CLOUD_EVENT_TYPES.membership;
+		case "credential": return CLOUD_EVENT_TYPES.credential;
+		case "access": return event.operation === "started" ? CLOUD_EVENT_TYPES.accessStarted : event.operation === "ended" ? CLOUD_EVENT_TYPES.accessEnded : CLOUD_EVENT_TYPES.accessRevoked;
+		case "decision":
+			if (event.phase === "requested" || event.phase === "resolved") return CLOUD_EVENT_TYPES.approval;
+			return CLOUD_EVENT_TYPES.decision;
+		default: return event;
+	}
+}
+function cloudEventSubject(event) {
+	if (event.type === "directory") return event.resource.id;
+	if (event.type === "membership" || event.type === "access") return event.principal.id;
+	if (event.type === "credential") return event.credential.id;
+	return event.permission;
+}
+/**
+* A `credential` sink event for `credential`. `sample` belongs on `used`
+* events only and must be in `(0, 1]`.
+*/
+function credentialEvent(input) {
+	const sample = input.sample;
+	if (sample !== void 0 && (input.operation !== "used" || !Number.isFinite(sample) || sample <= 0 || sample > 1)) throw new RangeError("PermDock: sample is a number in (0, 1] on used events only");
+	const { credential } = input;
+	return compact({
+		type: "credential",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source ?? "permdock",
+		operation: input.operation,
+		credential: {
+			id: credential.id,
+			kind: credential.kind
+		},
+		principal: { id: credential.principal },
+		tenant: credential.tenant,
+		expiresAt: credential.expiresAt,
+		by: input.by,
+		sample
+	});
+}
+function membershipEvent(input) {
+	if (input.scope === void 0 !== (input.id === void 0)) throw new TypeError("PermDock: membershipEvent needs scope and id together");
+	if (input.scope === void 0 && input.within !== void 0) throw new TypeError("PermDock: membershipEvent within needs a scope");
+	return compact({
+		type: "membership",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source,
+		operation: input.operation,
+		principal: input.principal,
+		scope: input.scope,
+		id: input.id,
+		within: input.within,
+		via: input.via,
+		expiresAt: input.expiresAt,
+		roles: input.roles,
+		by: input.by
+	});
+}
+/**
+* A support-access lifecycle event. `started` on consent, `ended` when the
+* session lapses, `revoked` when the tenant pulls consent early. It never
+* decides; the app writes and revokes the membership.
+*/
+function accessEvent(input) {
+	return compact({
+		type: "access",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source,
+		operation: input.operation,
+		tenant: input.tenant,
+		principal: input.principal,
+		via: input.via ?? "support",
+		roles: input.roles,
+		member: input.member,
+		expiresAt: input.expiresAt,
+		grantedBy: input.grantedBy,
+		reason: input.reason,
+		actor: input.actor
+	});
+}
+function toCloudEvent(event, source = "permdock") {
+	return compact({
+		specversion: "1.0",
+		type: cloudEventType(event),
+		source,
+		subject: cloudEventSubject(event),
+		id: globalThis.crypto.randomUUID(),
+		time: event.at,
+		datacontenttype: "application/json",
+		data: event
+	});
+}
+function signDecisionBatch(events, signer, options = {}) {
+	const source = options.source ?? "permdock";
+	return signer.sign({ events: events.map((event) => toCloudEvent(event, source)) }, compact({
+		typ: "permdock-decisions+jwt",
+		audience: options.audience
+	}));
+}
+function memorySink(options = {}) {
+	const capacity = options.capacity ?? 1e4;
+	const buffer = [];
+	const signed = [];
+	return {
+		write(events) {
+			buffer.push(...events);
+			if (buffer.length > capacity) buffer.splice(0, buffer.length - capacity);
+			if (options.signer === void 0) return;
+			return signDecisionBatch(events, options.signer, compact({
+				audience: options.audience,
+				source: options.source
+			})).then((batch) => {
+				signed.push(batch);
+			}).catch(() => void 0);
+		},
+		events() {
+			return [...buffer];
+		},
+		batches() {
+			return [...signed];
+		}
+	};
+}
+//#endregion
+export { memorySink as a, membershipEvent as i, accessEvent as n, signDecisionBatch as o, credentialEvent as r, toCloudEvent as s, CLOUD_EVENT_TYPES as t };