permdock 0.0.0 → 0.2.0

package/dist/scopes-CVdPrWN-.js

@@ -0,0 +1,239 @@
+import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+import { t as idText } from "./ids-DC4V4CFu.js";
+//#region src/core/scopes.ts
+const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
+const NAME = /^[a-z][a-z0-9_]*$/u;
+/** A policy without `scopes` keeps the historical pair: `tenant`, and `team` inside it. */
+const IMPLICIT = Object.freeze([Object.freeze({ name: "tenant" }), Object.freeze({
+	name: "team",
+	within: "tenant"
+})]);
+function fail(message) {
+	throw new Error(`PermDock: ${message}`);
+}
+/**
+* Validates `definePolicy({ scopes })`. Declaration order is the scope order;
+* every scope after the first names an earlier one in `within`, so the scopes
+* form one tree rooted at the first and have no cycles.
+* A scope named `tenant` is the first and `team` the second, so the aliases
+* never point at two different scopes.
+*/
+function defineScopes(input) {
+	if (input === void 0) return Object.freeze([]);
+	if (input === null || typeof input !== "object" || Array.isArray(input)) fail("definePolicy({ scopes }) must be an object");
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(input)) {
+		if (isForbiddenKey(name) || RESERVED.has(name) || !NAME.test(name)) fail(`scope name '${name}' must be lower snake case and not global or resource`);
+		const declaration = input[name];
+		if (declaration === void 0 || declaration === null || typeof declaration !== "object" || typeof declaration.key !== "string" || declaration.key === "") fail(`scopes.${name} needs a key`);
+		const index = out.length;
+		if (name === "tenant" && index !== 0) fail("scope 'tenant' must be declared first");
+		if (name === "team" && index !== 1) fail("scope 'team' must be declared second");
+		const within = declaration.within;
+		if (within !== void 0 && !seen.has(within)) fail(`scopes.${name}.within names '${within}', which is not declared before it`);
+		if (name === "team" && within === void 0 && seen.has("tenant")) fail("scopes.team needs within: 'tenant'");
+		if (index > 0 && within === void 0) fail(`scopes.${name} needs within: every scope after the first sits inside an earlier one`);
+		seen.add(name);
+		out.push(Object.freeze(within === void 0 ? {
+			name,
+			key: declaration.key
+		} : {
+			name,
+			key: declaration.key,
+			within
+		}));
+	}
+	return Object.freeze(out);
+}
+/** The scopes a policy or snapshot evaluates with: the declared list, or the implicit pair. */
+function scopeList(declared) {
+	return declared === void 0 || declared.length === 0 ? IMPLICIT : declared;
+}
+/** A declared name, or an alias: `tenant` is the first scope, `team` the second. */
+function resolveScope(scopes, name) {
+	if (typeof name !== "string") return;
+	if (scopes.some((scope) => scope.name === name)) return name;
+	if (name === "tenant") return scopes[0]?.name;
+	if (name === "team") return scopes[1]?.name;
+}
+function findScope(scopes, name) {
+	return scopes.find((scope) => scope.name === name);
+}
+/** `name` and its ancestors, innermost first. */
+function scopeChain(scopes, name) {
+	const chain = [];
+	let current = findScope(scopes, name);
+	while (current !== void 0 && !chain.includes(current.name)) {
+		chain.push(current.name);
+		current = current.within === void 0 ? void 0 : findScope(scopes, current.within);
+	}
+	return chain;
+}
+/** The scope the active tenant selects an instance of: the first declared one. */
+function rootScope(scopes) {
+	return scopes[0]?.name;
+}
+/** The id a membership holds for `scope`: its own id, or the `within` entry of an ancestor. */
+function scopeIdOf(membership, scope) {
+	if (membership.scope === scope) return membership.id;
+	const within = membership.within;
+	if (within === void 0 || !Object.hasOwn(within, scope)) return;
+	return within[scope];
+}
+/**
+* A membership of the first scope itself (the only scope without a parent):
+* its id is a tenant. Needs no scope list, for code that holds only a subject.
+*/
+function rootMembershipId(membership) {
+	if (membership.scope !== void 0) return membership.within === void 0 ? membership.id : void 0;
+	return membership.team === void 0 ? membership.tenant : void 0;
+}
+/** The instance of the first scope a membership sits in; what the active tenant selects. */
+function tenantOf(membership, scopes) {
+	const root = rootScope(scopes);
+	return root === void 0 ? void 0 : scopeIdOf(membership, root);
+}
+function isId(value) {
+	return typeof value === "string" && value !== "";
+}
+function roleList(value) {
+	if (!Array.isArray(value)) return;
+	return value.filter((item) => typeof item === "string");
+}
+/**
+* The canonical form of one membership, or `undefined` when it is malformed
+* (fail-closed: it grants nothing). A named membership is
+* `{ scope, id, within }` with one `within` entry per ancestor of `scope`;
+* the `tenant` / `team` input shape and alias names normalise to it. A
+* resource membership keeps `on`. Shapes are exclusive.
+*/
+function normalizeMembership(input, scopes) {
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return;
+	const raw = input;
+	const roles = roleList(raw["roles"]);
+	if (roles === void 0) return;
+	const extra = {};
+	if (typeof raw["via"] === "string") extra.via = raw["via"];
+	if (typeof raw["expiresAt"] === "number") extra.expiresAt = raw["expiresAt"];
+	if (typeof raw["grantedBy"] === "string" && raw["grantedBy"] !== "") extra.grantedBy = raw["grantedBy"];
+	if (typeof raw["reason"] === "string" && raw["reason"] !== "") extra.reason = raw["reason"];
+	const eligible = roleList(raw["eligible"]);
+	if (eligible !== void 0 && eligible.length > 0) extra.eligible = Object.freeze([...eligible]);
+	const member = raw["member"] !== null && typeof raw["member"] === "object" && !Array.isArray(raw["member"]) ? raw["member"]["group"] : void 0;
+	if (typeof member === "string" && member !== "") extra.member = Object.freeze({ group: member });
+	if (raw["managedBy"] === "idp") extra.managedBy = "idp";
+	if (Array.isArray(raw["entitlements"])) {
+		const seats = raw["entitlements"].filter((item) => typeof item === "string" && item !== "");
+		if (seats.length > 0) extra.entitlements = Object.freeze(seats);
+	}
+	if (raw["keep"] !== void 0) {
+		if (!Array.isArray(raw["keep"]) || !raw["keep"].every((key) => typeof key === "string" && key !== "")) return;
+		extra.keep = Object.freeze([...raw["keep"]]);
+	}
+	const named = raw["scope"] !== void 0 || raw["id"] !== void 0;
+	const legacy = raw["tenant"] !== void 0 || raw["team"] !== void 0;
+	const on = raw["on"];
+	if (on !== void 0) {
+		if (named || legacy || on === null || typeof on !== "object") return;
+		const target = on;
+		const targetId = idText(target["id"]);
+		if (!isId(target["resource"]) || targetId === void 0) return;
+		return Object.freeze({
+			on: Object.freeze({
+				resource: target["resource"],
+				id: targetId
+			}),
+			roles: Object.freeze([...roles]),
+			...extra
+		});
+	}
+	let scope;
+	let id;
+	let within = {};
+	if (named) {
+		if (legacy) return;
+		scope = resolveScope(scopes, raw["scope"]);
+		id = raw["id"];
+		if (raw["within"] !== void 0) {
+			if (raw["within"] === null || typeof raw["within"] !== "object" || Array.isArray(raw["within"])) return;
+			within = raw["within"];
+		}
+	} else if (raw["team"] !== void 0) {
+		scope = resolveScope(scopes, "team");
+		id = raw["team"];
+		const parent = resolveScope(scopes, "tenant");
+		if (raw["tenant"] !== void 0 && parent !== void 0) within = { [parent]: raw["tenant"] };
+	} else if (raw["tenant"] === void 0) return;
+	else {
+		scope = resolveScope(scopes, "tenant");
+		id = raw["tenant"];
+	}
+	const text = idText(id);
+	if (scope === void 0 || text === void 0) return;
+	const ancestors = scopeChain(scopes, scope).slice(1);
+	const resolved = {};
+	for (const key of Object.keys(within)) {
+		if (isForbiddenKey(key)) return;
+		const name = resolveScope(scopes, key);
+		const value = idText(within[key]);
+		if (name !== void 0 && ancestors.includes(name) && value !== void 0) resolved[name] = value;
+	}
+	if (ancestors.some((name) => resolved[name] === void 0)) return;
+	return Object.freeze({
+		scope,
+		id: text,
+		...ancestors.length === 0 ? {} : { within: Object.freeze(resolved) },
+		roles: Object.freeze([...roles]),
+		...extra
+	});
+}
+function normalizeMemberships(input, scopes) {
+	if (!Array.isArray(input)) return [];
+	const out = [];
+	for (const item of input) {
+		const membership = normalizeMembership(item, scopes);
+		if (membership !== void 0) out.push(membership);
+	}
+	return out;
+}
+/**
+* A subject's memberships in canonical form. Resolved subjects already are;
+* this accepts a hand-built subject passed straight to a condition evaluator
+* or compiler.
+*/
+function subjectMemberships(memberships, scopes) {
+	const list = memberships ?? [];
+	return list.some((membership) => membership.tenant !== void 0 || membership.team !== void 0) ? normalizeMemberships(list, scopes) : list;
+}
+/**
+* Whether a named membership applies under the active tenant: a membership
+* whose chain includes the first scope counts only inside the active tenant.
+*/
+function activeFor(membership, scopes, active) {
+	const root = rootScope(scopes);
+	if (root === void 0 || membership.scope === void 0 || !scopeChain(scopes, membership.scope).includes(root)) return true;
+	return active !== void 0 && scopeIdOf(membership, root) === active;
+}
+/** Whether `membership` counts for `key`: always, unless a suspension limits it to `keep`. */
+function keepsPermission(membership, key) {
+	return membership.keep === void 0 || membership.keep.includes(key);
+}
+/**
+* The subject as it stands for one permission: memberships a suspension
+* limits to other permissions are left out. The same object when none is.
+*/
+function subjectForPermission(subject, key) {
+	const principal = subject.principal;
+	const memberships = principal?.memberships;
+	if (principal === null || memberships === void 0 || memberships.every((membership) => keepsPermission(membership, key))) return subject;
+	return {
+		...subject,
+		principal: {
+			...principal,
+			memberships: memberships.filter((membership) => keepsPermission(membership, key))
+		}
+	};
+}
+//#endregion
+export { normalizeMemberships as a, rootScope as c, scopeList as d, subjectForPermission as f, keepsPermission as i, scopeChain as l, tenantOf as m, defineScopes as n, resolveScope as o, subjectMemberships as p, findScope as r, rootMembershipId as s, activeFor as t, scopeIdOf as u };

package/dist/server/index.d.ts

@@ -0,0 +1,134 @@
+import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CtF23SrC.js";
+import { t as Disclosure } from "../problem-details-CkL50EEf.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DAqevpNk.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
+import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-BWyx3jua.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DwQH8ufx.js";
+//#region src/server/credentials.d.ts
+/** `on('auth')` causes for an API key that resolves to the anonymous subject. */
+type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";
+/** An opaque key split at its last `_`: `pdk_<id>_<secret><checksum>`. */
+type ApiKeyParts = {
+  readonly id: string;
+  readonly secret: string;
+};
+/** What an application stores per key: the credential and the key's hash, never the key. */
+type StoredCredential = {
+  readonly credential: Credential;
+  readonly hash: string;
+};
+/**
+ * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
+ * the secret 43 base62 characters and the checksum the 6 base62 characters of
+ * the CRC-32 of everything before it. Anything else, including a checksum
+ * that does not match, is `undefined`.
+ */
+export declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
+/**
+ * A fresh `pdk_<id>_<secret><checksum>`: a 43-character base62 secret (about
+ * 256 bits) and a 6-character CRC-32 checksum, so a secret scanner can tell a
+ * real key from a lookalike without calling the issuer.
+ */
+export declare function generateApiKey(id: string): string;
+/** base64url SHA-256 of the whole key, the value to store and compare. */
+export declare function hashApiKey(key: string): Promise<string>;
+/**
+ * A `CredentialVerifier` over the application's own table: `find` looks a
+ * key up by the id in it, and the key's hash is compared in constant time.
+ * A record that is not a valid v1 credential, or whose id is not the key's,
+ * verifies to `null`. A throwing `find` propagates, so the resolver denies
+ * with `source-threw`.
+ */
+export declare function apiKeyVerifier(options: {
+  readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
+  /** Passed through as the verifier's `touch`, for a `lastUsedAt` column. */
+  readonly touch?: CredentialVerifier["touch"];
+}): CredentialVerifier;
+type MemoryCredentials = CredentialVerifier & {
+  /** Stores `credential` and returns its key; the key is never stored. */
+  issue(credential: Credential): Promise<string>;
+  /** A new secret for the same id; the old key stops verifying at once. */
+  rotate(id: string): Promise<string | undefined>;
+  /** `true` when a credential was removed. */
+  revoke(id: string): boolean;
+  list(): readonly Credential[];
+  /** When `touch` last recorded a use of `id`, in Unix seconds. */
+  lastUsedAt(id: string): number | undefined;
+};
+/**
+ * In-process credentials for tests and single-replica apps. `issue`, `rotate`
+ * and `revoke` write `credential` events to `sink` when one is given.
+ */
+export declare function memoryCredentials(options?: {
+  readonly sink?: DecisionSink;
+  readonly source?: string;
+}): MemoryCredentials;
+type ApiKeySubjectOptions = {
+  readonly verifier: CredentialVerifier;
+  /** The definitions, to turn the credential's permission keys into its delegation. */
+  readonly permissions: PermissionTree;
+  /**
+   * The live owner of a user-bound key: roles and memberships as of this
+   * request. `null` (a deleted or suspended user) is anonymous. Without it
+   * the owner is `{ id, kind: 'user' }` and its rights come from the
+   * `memberships` source passed to `createPermDock`.
+   */
+  readonly owner?: (id: string) => Principal | null | undefined | Promise<Principal | null | undefined>;
+  /** `true` when the application revoked the credential id; a throw denies. */
+  readonly revoked?: (id: string) => boolean | Promise<boolean>;
+  /**
+   * The tenant `credentials` policy, checked on every use so a tightened
+   * policy reaches existing keys: a service key's own tenant, a user key's
+   * the `tenant` the resolver is called with. A throw denies.
+   */
+  readonly settings?: SettingsSource;
+  /** Receives a `credential` event with operation `used` for sampled uses. */
+  readonly sink?: DecisionSink;
+  /** Fraction of uses reported to `sink`, in `(0, 1]`; defaults to 1. */
+  readonly sample?: number;
+  /** The `source` of `used` events; defaults to `permdock`. */
+  readonly source?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/**
+ * A `SubjectResolver` for opaque API keys (`pdk_<id>_<secret>`): each call
+ * resolves a key into the subject its credential acts as. Every failure (a
+ * malformed or unknown key, a record that is not a valid credential, expiry,
+ * a tenant policy the key breaks, a revoked id, a missing owner, a throwing
+ * verifier or callback) is the anonymous subject, never a throw.
+ */
+export declare function subjectFromApiKey(options: ApiKeySubjectOptions): SubjectResolver<string | undefined | null, CredentialPrincipal>;
+//#endregion
+//#region src/server/map-error.d.ts
+type ProblemFromErrorOptions = {
+  readonly instance?: string;
+  /** Whether the request carried credentials, which picks the `401` challenge. */
+  readonly credentials?: boolean;
+};
+/**
+ * Turns a thrown PermDock error into its Problem Details response, with the
+ * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
+ * same decision. Returns `undefined` for anything else so the framework's own
+ * error path takes over.
+ */
+export declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
+//#endregion
+//#region src/server/problem.d.ts
+export declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
+export declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
+export declare function validationProblem(detail: string): Response;
+export declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
+  readonly instance?: string;
+  readonly approval?: ApprovalHint;
+  /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
+  readonly disclosure?: Disclosure;
+  /** Whether the request carried credentials, which picks the `401` challenge. */
+  readonly credentials?: boolean;
+  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
+  readonly scope?: string;
+}): Response;
+//#endregion
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ScopeGuard, type ServerKernel, type ServerKernelOptions, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type TenantOption, type TenantScope, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, snapshotHeaders, snapshotTag, tenantScope, verifyWebBotAuth };

package/dist/server/index.js

@@ -0,0 +1,11 @@
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
+import { d as wwwAuthenticate, o as problemFromDecision, s as problemResponse, u as validationProblem } from "../problem-B43ztKIm.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
+import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { n as tenantScope } from "../adapter-context-mlWsVGGg.js";
+import { n as createServerKernel, t as createPermDock } from "../create-CPhDL6qx.js";
+import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-DlZ28Oz5.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, snapshotHeaders, snapshotTag, subjectFromApiKey, tenantScope, validationProblem, verifyWebBotAuth, wwwAuthenticate };

package/dist/server-DlZ28Oz5.js

@@ -0,0 +1,268 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { n as isThenable } from "./thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { r as credentialEvent } from "./sink-Bd9PSyfq.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-8P81ff4u.js";
+//#region src/server/credentials.ts
+const PREFIX = "pdk_";
+const ID = /^[\w-]{1,128}$/u;
+const TAIL = /^[A-Za-z\d]{49}$/u;
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+const SECRET_LENGTH = 43;
+const CHECKSUM_LENGTH = 6;
+const MAX_KEY = 182;
+const CRC_TABLE = (() => {
+	const table = /* @__PURE__ */ new Uint32Array(256);
+	for (let index = 0; index < 256; index += 1) {
+		let value = index;
+		for (let bit = 0; bit < 8; bit += 1) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
+		table[index] = value >>> 0;
+	}
+	return table;
+})();
+/** CRC-32 (IEEE 802.3) of the key's ASCII bytes, as 6 base62 characters. */
+function checksum(text) {
+	let crc = 4294967295;
+	for (let index = 0; index < text.length; index += 1) crc = (CRC_TABLE[(crc ^ (text.codePointAt(index) ?? 0)) & 255] ?? 0) ^ crc >>> 8;
+	let value = (crc ^ 4294967295) >>> 0;
+	let out = "";
+	for (let index = 0; index < CHECKSUM_LENGTH; index += 1) {
+		out = (ALPHABET[value % 62] ?? "") + out;
+		value = Math.floor(value / 62);
+	}
+	return out;
+}
+/**
+* Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
+* the secret 43 base62 characters and the checksum the 6 base62 characters of
+* the CRC-32 of everything before it. Anything else, including a checksum
+* that does not match, is `undefined`.
+*/
+function parseApiKey(key) {
+	if (typeof key !== "string" || key.length > MAX_KEY || !key.startsWith(PREFIX)) return;
+	const body = key.slice(4);
+	const cut = body.lastIndexOf("_");
+	if (cut <= 0) return;
+	const id = body.slice(0, cut);
+	const tail = body.slice(cut + 1);
+	if (!ID.test(id) || !TAIL.test(tail)) return;
+	const secret = tail.slice(0, SECRET_LENGTH);
+	return tail.slice(SECRET_LENGTH) === checksum(`${PREFIX}${id}_${secret}`) ? {
+		id,
+		secret
+	} : void 0;
+}
+/**
+* A fresh `pdk_<id>_<secret><checksum>`: a 43-character base62 secret (about
+* 256 bits) and a 6-character CRC-32 checksum, so a secret scanner can tell a
+* real key from a lookalike without calling the issuer.
+*/
+function generateApiKey(id) {
+	if (!ID.test(id)) throw new TypeError("PermDock: an API key id is 1 to 128 of A-Z, a-z, 0-9, _ and -");
+	let secret = "";
+	const bytes = /* @__PURE__ */ new Uint8Array(64);
+	while (secret.length < SECRET_LENGTH) {
+		globalThis.crypto.getRandomValues(bytes);
+		for (const byte of bytes) if (byte < 248 && secret.length < SECRET_LENGTH) secret += ALPHABET[byte % 62];
+	}
+	const key = `${PREFIX}${id}_${secret}`;
+	return `${key}${checksum(key)}`;
+}
+/** base64url SHA-256 of the whole key, the value to store and compare. */
+async function hashApiKey(key) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(key));
+	return bytesToBase64Url(new Uint8Array(digest));
+}
+function sameHash(left, right) {
+	if (left.length !== right.length) return false;
+	let difference = 0;
+	for (let index = 0; index < left.length; index += 1) difference |= (left.codePointAt(index) ?? 0) ^ (right.codePointAt(index) ?? 0);
+	return difference === 0;
+}
+/**
+* A `CredentialVerifier` over the application's own table: `find` looks a
+* key up by the id in it, and the key's hash is compared in constant time.
+* A record that is not a valid v1 credential, or whose id is not the key's,
+* verifies to `null`. A throwing `find` propagates, so the resolver denies
+* with `source-threw`.
+*/
+function apiKeyVerifier(options) {
+	return Object.freeze({
+		...options.touch === void 0 ? {} : { touch: options.touch },
+		async verify(secret) {
+			const parts = parseApiKey(secret);
+			if (parts === void 0) return null;
+			const stored = await options.find(parts.id);
+			if (stored === null || stored === void 0) return null;
+			const credential = parseCredential(stored.credential);
+			if (credential === void 0 || credential.id !== parts.id || typeof stored.hash !== "string" || !sameHash(await hashApiKey(secret), stored.hash)) return null;
+			return credential;
+		}
+	});
+}
+function write(sink, event) {
+	try {
+		const written = sink.write(event);
+		if (isThenable(written)) Promise.resolve(written).catch(() => void 0);
+	} catch {}
+}
+/**
+* In-process credentials for tests and single-replica apps. `issue`, `rotate`
+* and `revoke` write `credential` events to `sink` when one is given.
+*/
+function memoryCredentials(options = {}) {
+	const records = /* @__PURE__ */ new Map();
+	const used = /* @__PURE__ */ new Map();
+	const verifier = apiKeyVerifier({ find: (id) => records.get(id) });
+	const emit = (operation, credential) => {
+		if (options.sink !== void 0) write(options.sink, [credentialEvent(compact({
+			operation,
+			credential,
+			source: options.source
+		}))]);
+	};
+	const store = async (credential) => {
+		const key = generateApiKey(credential.id);
+		records.set(credential.id, {
+			credential,
+			hash: await hashApiKey(key)
+		});
+		return key;
+	};
+	return Object.freeze({
+		verify: (secret) => verifier.verify(secret),
+		touch(id, at) {
+			if (records.has(id)) used.set(id, at);
+		},
+		lastUsedAt(id) {
+			return used.get(id);
+		},
+		async issue(input) {
+			const credential = parseCredential(input);
+			if (credential === void 0) throw new TypeError("PermDock: not a valid v1 credential");
+			if (records.has(credential.id)) throw new Error(`PermDock: credential '${credential.id}' exists`);
+			const key = await store(credential);
+			emit("created", credential);
+			return key;
+		},
+		async rotate(id) {
+			const current = records.get(id);
+			if (current === void 0) return;
+			const key = await store(current.credential);
+			emit("rotated", current.credential);
+			return key;
+		},
+		revoke(id) {
+			const current = records.get(id);
+			if (current === void 0) return false;
+			records.delete(id);
+			used.delete(id);
+			emit("revoked", current.credential);
+			return true;
+		},
+		list() {
+			return [...records.values()].map((record) => record.credential);
+		}
+	});
+}
+async function checkStores(options, credential, active) {
+	try {
+		const tenant = credentialTenant(credential, active);
+		const policy = options.settings === void 0 || tenant === void 0 ? void 0 : (await options.settings.settingsFor(tenant))?.credentials;
+		if (policy !== void 0 && credentialPolicyViolation(credential, policy) !== void 0) return {
+			ok: false,
+			cause: "credential-policy"
+		};
+		if (options.revoked !== void 0 && await options.revoked(credential.id)) return {
+			ok: false,
+			cause: "credential-revoked"
+		};
+		if (credential.kind !== "user" || options.owner === void 0) return { ok: true };
+		const owner = await options.owner(credential.principal);
+		if (owner === null || owner === void 0) return {
+			ok: false,
+			cause: "owner-unavailable"
+		};
+		return {
+			ok: true,
+			owner
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+function touch(verifier, id) {
+	if (verifier.touch === void 0) return;
+	try {
+		const touched = verifier.touch(id, Math.floor(Date.now() / 1e3));
+		if (isThenable(touched)) Promise.resolve(touched).catch(() => void 0);
+	} catch {}
+}
+function sampled(sample) {
+	if (sample === 1) return true;
+	const draw = /* @__PURE__ */ new Uint32Array(1);
+	globalThis.crypto.getRandomValues(draw);
+	return (draw[0] ?? 0) / 4294967296 < sample;
+}
+function reportUse(options, credential) {
+	const sample = options.sample ?? 1;
+	if (options.sink === void 0 || !Number.isFinite(sample) || sample <= 0 || sample > 1 || !sampled(sample)) return;
+	write(options.sink, [credentialEvent(compact({
+		operation: "used",
+		credential,
+		source: options.source,
+		sample
+	}))]);
+}
+/**
+* A `SubjectResolver` for opaque API keys (`pdk_<id>_<secret>`): each call
+* resolves a key into the subject its credential acts as. Every failure (a
+* malformed or unknown key, a record that is not a valid credential, expiry,
+* a tenant policy the key breaks, a revoked id, a missing owner, a throwing
+* verifier or callback) is the anonymous subject, never a throw.
+*/
+function subjectFromApiKey(options) {
+	return (key, resolve) => resolveApiKey(key, options, resolve?.tenant);
+}
+function anonymous() {
+	return anonymousSubject();
+}
+async function resolveApiKey(key, options, tenant) {
+	if (typeof key !== "string" || key.length === 0) return anonymous();
+	const deny = (cause, reason = "invalid-token") => {
+		try {
+			options.onAuth?.(compact({
+				reason,
+				cause,
+				source: "api-key",
+				requestId: options.requestId
+			}));
+		} catch {}
+		return anonymous();
+	};
+	const parts = parseApiKey(key);
+	if (parts === void 0) return deny("malformed");
+	let verified;
+	try {
+		verified = await options.verifier.verify(key);
+	} catch {
+		return deny(void 0, "source-threw");
+	}
+	if (verified === null || verified === void 0) return deny("unknown-credential");
+	const credential = parseCredential(verified);
+	if (credential === void 0 || credential.id !== parts.id) return deny("invalid-claims");
+	if (credential.expiresAt !== void 0 && credential.expiresAt <= Date.now() / 1e3) return deny("expired");
+	const checked = await checkStores(options, credential, tenant);
+	if (!checked.ok) return checked.cause === void 0 ? deny(void 0, "source-threw") : deny(checked.cause);
+	const subject = credentialSubject(credential, compact({
+		permissions: options.permissions,
+		owner: checked.owner
+	}));
+	if (subject.principal === null) return deny("owner-unavailable");
+	reportUse(options, credential);
+	touch(options.verifier, credential.id);
+	return subject;
+}
+//#endregion
+export { parseApiKey as a, memoryCredentials as i, generateApiKey as n, subjectFromApiKey as o, hashApiKey as r, apiKeyVerifier as t };