permdock 0.16.0 → 0.18.0

package/dist/{role-builder-BK2-T6oD.js → role-builder-CMW4wWzn.js}

@@ -2,12 +2,11 @@ import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557Z
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
 import { c as isConditionDate, l as isConditionRef, r as isSubjectRef, s as isCondition, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
-import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-B4r0N_Uz.js";
 import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
-import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, r as assertDuration } from "./time-nR1JesoH.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Dke-9rd1.js";
+import { d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Dke-9rd1.js";
+import { a as normalizeApproval, t as activationApproval } from "./approval-normalize-CUjgSsOl.js";
 import { c as sanitizeFields, n as normalizeValidity } from "./validity-Buc7w8E9.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {
@@ -215,159 +214,6 @@ function normalizeWhere(input) {
 	});
 }
 //#endregion
-//#region src/core/approval-normalize.ts
-/**
-* Every approver a requirement names: `by`, each stage and its escalation, and
-* `escalation.to`, inside `anyOf` groups too.
-*/
-function approversOf(requirement) {
-	return [
-		...approverLeaves(requirement.by),
-		...(requirement.stages ?? []).flatMap((stage) => approverLeaves(stage.by).concat(approverLeaves(stage.escalation?.to))),
-		...approverLeaves(requirement.escalation?.to)
-	];
-}
-function asApprover(input) {
-	if (isPermissionApprover(input)) {
-		if (typeof input.permission !== "string" || input.permission === "") throw new Error("PermDock: a permission approver needs a permission key");
-		return Object.freeze({
-			kind: "permission",
-			permission: input.permission
-		});
-	}
-	if (isAnyOfInput(input)) {
-		if (!Array.isArray(input.of) || input.of.length === 0) throw new Error("PermDock: anyOf() needs at least one approver");
-		const of = input.of.map((item) => {
-			const normalized = asApprover(item);
-			const items = flattenApprovers(normalized);
-			if (items.length === 0) throw new Error("PermDock: an anyOf() item names no approver");
-			const [first] = items;
-			return isReadonlyArray(normalized) || first === void 0 ? items : first;
-		});
-		return Object.freeze({
-			kind: "any-of",
-			of: Object.freeze(of)
-		});
-	}
-	if (isReadonlyArray(input)) {
-		const items = [];
-		for (const item of input) items.push(...flattenApprovers(asApprover(item)));
-		return items;
-	}
-	if (isUserApprover(input)) return user(input.id);
-	return asGrantee(input);
-}
-function normalizeApproval(approval, permission) {
-	if (approval === void 0) return;
-	if (approval === "human") return "human";
-	if (approval.staleOn !== void 0 && approval.staleOn !== "resource-change") throw new Error(`PermDock: approval staleOn must be 'resource-change', got '${String(approval.staleOn)}'`);
-	const label = permission ?? "a grant";
-	assertQuorum(approval.quorum, "approval.quorum", label);
-	if (approval.ttl !== void 0) assertDuration(approval.ttl, `approval.ttl on '${label}'`);
-	const escalation = normalizeEscalation(approval.escalation, label);
-	const mode = approval.mode ?? "any";
-	if (mode !== "any") return compact({
-		mode,
-		stages: normalizeStages(approval, mode, label),
-		distinct: approval.distinct,
-		staleOn: approval.staleOn,
-		ttl: approval.ttl,
-		escalation
-	});
-	if (approval.stages !== void 0) throw new Error(`PermDock: approval.stages on '${label}' needs mode: 'all' or 'sequential'`);
-	const by = approval.by === void 0 ? void 0 : asApprover(approval.by);
-	if (by === void 0 && approval.distinct === void 0 && approval.staleOn === void 0 && approval.quorum === void 0 && approval.ttl === void 0 && escalation === void 0) return "human";
-	return compact({
-		by: by ?? authenticated(),
-		distinct: approval.distinct,
-		staleOn: approval.staleOn,
-		quorum: approval.quorum,
-		ttl: approval.ttl,
-		escalation
-	});
-}
-function assertQuorum(quorum, name, label) {
-	if (quorum !== void 0 && (!Number.isInteger(quorum) || quorum < 1)) throw new Error(`PermDock: ${name} on '${label}' must be an integer of at least 1, got ${String(quorum)}`);
-}
-function normalizeStages(approval, mode, label) {
-	if (mode !== "all" && mode !== "sequential") throw new Error(`PermDock: approval.mode on '${label}' must be 'any', 'all' or 'sequential', got '${mode}'`);
-	if (approval.by !== void 0 || approval.quorum !== void 0) throw new Error(`PermDock: approval on '${label}' sets mode '${mode}': put by and quorum on each stage`);
-	const stages = approval.stages ?? [];
-	if (stages.length === 0) throw new Error(`PermDock: approval mode '${mode}' on '${label}' needs at least one stage`);
-	return stages.map((stage, index) => {
-		assertQuorum(stage.quorum, `approval.stages[${index}].quorum`, label);
-		const by = asApprover(stage.by);
-		if (flattenApprovers(by).length === 0) throw new Error(`PermDock: approval.stages[${index}].by on '${label}' names no approver`);
-		return compact({
-			by,
-			quorum: stage.quorum,
-			escalation: normalizeEscalation(stage.escalation, label)
-		});
-	});
-}
-function normalizeEscalation(escalation, label) {
-	if (escalation === void 0) return;
-	assertDuration(escalation.after, `approval.escalation.after on '${label}'`);
-	return {
-		after: escalation.after,
-		to: asApprover(escalation.to)
-	};
-}
-/**
-* A role with `activation` is eligible-only: it needs a positive `maxDuration`
-* (Doctor PD033 warns without one). `justification` defaults to `'optional'`.
-*/
-function activationApproval(option, roleName) {
-	const label = `activation of '${roleName}'`;
-	const approval = normalizeApproval(option, label);
-	if (approval !== void 0 && approval !== "human" && approversOf(approval).some((item) => item.kind === "relation")) throw new Error(`PermDock: approval on ${label} names a relation; an activation has no row to read it on`);
-	return approval;
-}
-/**
-* A stale-on-change approval needs a row to version: an instance permission
-* whose resource declares `version`.
-*/
-function assertApprovalVersions(grants, resources) {
-	for (const grant of grants) {
-		const approval = grant.approval;
-		if (approval === void 0 || approval === "human" || approval.staleOn === void 0) continue;
-		if (grant.permission.kind !== "instance") throw new Error(`PermDock: approval staleOn on '${grant.permission.key}' needs an instance action; a collection action has no row to version`);
-		if (resources.get(grant.permission.resource)?.version === void 0) throw new Error(`PermDock: approval staleOn on '${grant.permission.key}' needs resource(..., { version: '<field>' }) on '${grant.permission.resource}'`);
-	}
-}
-/**
-* A relation approver is checked by id, from the requested row: the relation
-* lives on the permission's own resource (optionally up its parent chain), or
-* at the end of a list of links from it.
-*/
-function assertApprovalRelations(grants, resources) {
-	for (const grant of grants) {
-		const approval = grant.approval;
-		if (approval === void 0 || approval === "human") continue;
-		for (const item of approversOf(approval)) {
-			if (item.kind !== "relation") continue;
-			const label = `${grant.permission.key}: approver relation '${item.relation}'`;
-			if (grant.permission.kind !== "instance") throw new Error(`PermDock: ${label} needs an instance action; a collection action has no row to read it on`);
-			if (approverRelationResource(grant.permission.resource, item.through, resources) !== item.resource) throw new Error(`PermDock: ${label} must live on '${grant.permission.resource}' or at the end of its through links`);
-			if (resources.get(item.resource)?.relations[item.relation] === void 0) throw new Error(`PermDock: ${label} is not declared on '${item.resource}'`);
-		}
-	}
-}
-/**
-* The resource a relation approver's `through` reaches from `start`, or
-* `undefined`.
-*/
-function approverRelationResource(start, through, resources) {
-	if (through === void 0) return start;
-	if (through === "parent") return isSelfParented(resources.get(start)) ? start : void 0;
-	let current = start;
-	for (const name of through) {
-		const node = current === void 0 ? void 0 : resources.get(current);
-		current = node !== void 0 && Object.hasOwn(node.links, name) ? node.links[name]?.resource : void 0;
-	}
-	return current;
-}
-//#endregion
 //#region src/core/limit-grants.ts
 /** Throws at definition time for a `limit` no store could count. */
 function assertLimit(limit, permissionKey) {
@@ -641,4 +487,4 @@ function roleRules(roleName, scope, options) {
 	});
 }
 //#endregion
-export { opaque as _, deny as a, withGrantSchema as c, assertApprovalVersions as d, normalizeApproval as f, assertSqlFunctionName as g, assertSqlFunctionArg as h, completeGrant as i, asApprover as l, assertPortableTwin as m, role as n, flattenGrants as o, normalizeWhere as p, allow as r, flattenPermissions as s, normalizeAssurance as t, assertApprovalRelations as u };
+export { deny as a, withGrantSchema as c, assertSqlFunctionArg as d, assertSqlFunctionName as f, completeGrant as i, normalizeWhere as l, role as n, flattenGrants as o, opaque as p, allow as r, flattenPermissions as s, normalizeAssurance as t, assertPortableTwin as u };

package/dist/{rpc-vHIwyXCp.js → rpc-KwX_Jcxz.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-DKLXrFGk.js";
-import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
-import { t as adapterKernel } from "./bind-BNQA9JK9.js";
+import { n as tenantScope } from "./adapter-context-OHikyRqV.js";
+import { t as adapterKernel } from "./bind-B4pMH9bm.js";
 import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/{run-DUq1xU4K.js → run-B7lv3NuK.js}

@@ -1,14 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
+import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-BhRkoNS7.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-CcLlvEYW.js";
+import { a as resolveCwd, i as readConfig } from "./config-COHmivz9.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
-import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { a as GLOBAL_FLAGS, i as suggestion, n as parseFlags, r as parseLeaf } from "./args-iafbHiXn.js";
+import { r as progressReporter, t as redact } from "./credentials-dkycUsY3.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DlICTjBh.js";
-import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-BFWLER4r.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -422,11 +421,6 @@ function missingInputNext(argv, error) {
 		].join(" ")
 	}];
 }
-/** The `--flag` tokens before `--`, as typed without a value. */
-function typedFlags(argv) {
-	const end = argv.indexOf("--");
-	return (end === -1 ? argv : argv.slice(0, end)).filter((token) => token.startsWith("--")).map((token) => beforeFirst(token, "="));
-}
 async function run(argv, options) {
 	const stdoutChunks = [];
 	const stderrChunks = [];
@@ -493,16 +487,6 @@ async function run(argv, options) {
 			if (globals.json === true && given !== "json") return cliProblem("usage", `--json and --format ${given} ask for different output; pick one`, command === "" ? void 0 : command, { code: "invalid_value" });
 			return given;
 		}
-		if (resolved.kind === "leaf") {
-			const rename = flagRename(command, "--format");
-			if (rename !== void 0) return cliProblem("usage", renameMessage(command, rename), command, {
-				code: "flag_renamed",
-				extensions: {
-					flag: "--format",
-					replacement: rename.to
-				}
-			});
-		}
 		return cliProblem("usage", `--format '${given}' is not one of text, json, github, sarif.${suggestion(given, [
 			"text",
 			"json",
@@ -549,7 +533,7 @@ async function run(argv, options) {
 			writeOut(plain(resolved.path.length === 0 ? rootHelp(color) : groupHelp(resolved.path, resolved.entry, color)));
 			return done(0);
 		}
-		return bareGroup(resolved.path, resolved.entry, rest);
+		return bareGroup(resolved.path, resolved.entry);
 	}
 	if (askedHelp) {
 		const leaf = await resolved.entry.load();
@@ -561,13 +545,8 @@ async function run(argv, options) {
 		return done(0);
 	}
 	return runLeaf(resolved.path, resolved.entry, resolved.rest);
-	function bareGroup(path, group, tokens) {
+	function bareGroup(path, group) {
 		const name = path.join(" ");
-		const moved = COMMAND_MOVES.find((move) => move.from === name);
-		if (moved !== void 0 && tokens.some((token) => token.startsWith("-"))) return fail(new CliError("usage", `permdock ${name} needs a command since 0.5.0: permdock ${moved.to}`, {
-			code: "command_moved",
-			extensions: { replacement: `permdock ${moved.to}` }
-		}));
 		const help = path.length === 0 ? rootHelp(false) : groupHelp(path, group, false);
 		if (json) return emitProblem(cliProblem("usage", `permdock${name === "" ? "" : ` ${name}`} needs a command`, name === "" ? void 0 : name, {
 			code: "usage",
@@ -589,17 +568,6 @@ async function run(argv, options) {
 		} catch (error) {
 			return fail(error);
 		}
-		const declared = new Set(flagSpellings(leaf.flags));
-		for (const flag of typedFlags(tokens)) {
-			const rename = declared.has(flag) ? void 0 : flagRename(name, flag);
-			if (rename !== void 0) return fail(new CliError("usage", renameMessage(name, rename), {
-				code: "flag_renamed",
-				extensions: {
-					flag,
-					...rename.to === void 0 ? {} : { replacement: rename.to }
-				}
-			}));
-		}
 		try {
 			input = parseLeaf(name, tokens, leaf.flags, leaf.positionals);
 		} catch (error) {

package/dist/run-UPbacxPg.js

@@ -0,0 +1 @@
+export { t as run } from "./run-B7lv3NuK.js";

package/dist/{run-ticket-DfnZCh-u.js → run-ticket-CjvXr6wj.js}

@@ -3,8 +3,8 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { a as ownRecord, n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { a as isId } from "./expiry-6XByK0dm.js";
 import { o as epochSeconds, p as nowSeconds } from "./time-nR1JesoH.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 import { n as toWireDelegation, t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/server/run-ticket.ts
 const RUN_TICKET_TYP = "vnd.permdock.run+jwt";
 /**

package/dist/{run-ticket-ylovhyFQ.d.ts → run-ticket-DPaD27_r.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant, ar as AuthorizationDetail, hr as Subject, ht as TokenVerifier, lr as Delegation, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
-import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
+import { Kt as Instant, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, ht as TokenFailureCause, lr as AuthorizationDetail, pr as Delegation, sr as Actor, yr as Subject } from "./policy-types-D-GwfQTc.js";
+import { _ as PrincipalSource } from "./permdock-ffY4CMd9.js";
 //#region src/server/run-ticket.d.ts
 /**
  * What started the run: a saved automation, a background job, or a caller's own

package/dist/{runtime-BGnrOkVH.js → runtime-rf0ZuyF3.js}

@@ -1,4 +1,4 @@
-import { l as scopedTenant, s as protectedView } from "./views-CD8wuL4Z.js";
+import { l as scopedTenant, s as protectedView } from "./views-MWmJ6Y4P.js";
 //#region src/svelte/protected.ts
 /**
 * The instance for `tenant`, built once per store change rather than once per

package/dist/{saas-DK4V-3Is.js → saas-B8H1MsQ3.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as principal } from "./refs-C8BKxc_e.js";
-import { a as deny, n as role, r as allow } from "./role-builder-BK2-T6oD.js";
-import { C as memoryLimitStore, S as limits, j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { a as deny, n as role, r as allow } from "./role-builder-CMW4wWzn.js";
+import { A as memoryCustomRoleSource, C as limits, S as memoryRelationSource, w as memoryLimitStore } from "./src-Brzq_0in.js";
 import { h as secondsAt } from "./time-nR1JesoH.js";
 import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
-import { r as definePolicy } from "./policy-CLQ8__GF.js";
+import { r as definePolicy } from "./policy-cV_wwPb8.js";
 import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CYcHj_w7.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-B3ggI88M.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -73,10 +73,7 @@ const saasPolicy = definePolicy({
 		})),
 		allow(p.apiKey.revokeAll, {
 			to: r.admin,
-			approval: {
-				by: r.owner,
-				distinct: true
-			}
+			approval: { by: r.owner }
 		}),
 		allow(p.apiKey.revokeAll, { to: r.owner }),
 		...each(admins, (to) => allow(p.analytics.read, { to: [to, saasPlans.pro] })),
@@ -422,8 +419,14 @@ function saasOrg(id) {
 }
 function toMembership(member) {
 	const membership = { roles: [...member.roles] };
-	if (member.tenant !== void 0) membership.tenant = member.tenant;
-	if (member.team !== void 0) membership.team = member.team;
+	if (member.team !== void 0) {
+		membership.scope = "team";
+		membership.id = member.team;
+		if (member.tenant !== void 0) membership.within = { tenant: member.tenant };
+	} else if (member.tenant !== void 0) {
+		membership.scope = "tenant";
+		membership.id = member.tenant;
+	}
 	if (member.on !== void 0) membership.on = {
 		resource: member.on.resource,
 		id: member.on.id

package/dist/{scan-C3HRH9Fs.js → scan-0r3OZqqK.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-C2BCiUEG.js");
+		const { runAdoptionScan } = await import("./adoption-scan-CxExBYSJ.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-DvXvxPhQ.js → schema-B_9tXrbG.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{schema-BOJjqlWL.js → schema-CuX70xgH.js}

@@ -29,11 +29,21 @@ const approval = { oneOf: [{ const: "human" }, {
 	type: "object",
 	properties: {
 		by: {},
-		mode: { enum: [
+		combine: { enum: [
 			"any",
 			"all",
 			"sequential"
 		] },
+		mode: {
+			description: "confirm or authorize; a catalog written before 0.17 holds any, all or sequential here, read as combine.",
+			enum: [
+				"confirm",
+				"authorize",
+				"any",
+				"all",
+				"sequential"
+			]
+		},
 		stages: {
 			type: "array",
 			items: {
@@ -48,7 +58,10 @@ const approval = { oneOf: [{ const: "human" }, {
 				}
 			}
 		},
-		distinct: { type: "boolean" },
+		distinct: {
+			description: "Written before 0.17; false reads as mode: confirm.",
+			type: "boolean"
+		},
 		staleOn: { const: "resource-change" },
 		quorum: {
 			type: "integer",

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dj2qF9VC.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dfv9Toct.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,3 +1,3 @@
-import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-C30QBBoF.js";
 import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-DcyrPS-r.js";
 export { APP_DATA_EXTENSION, DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/{scim-jJBJ7g1Z.js → scim-C30QBBoF.js}

@@ -1042,7 +1042,8 @@ function directoryMembershipSource(store, options = {}) {
 		for (const group of groups) {
 			const mapped = group.roles ?? groupRolesFor(options.groupRoles, group.id);
 			memberships.push(compact({
-				tenant,
+				scope: "tenant",
+				id: tenant,
 				roles: allowedRoles(mapped, options.assignable, options.onUnknownRole),
 				via: `group:${group.id}`,
 				managedBy: "idp"

package/dist/{scim-D8YupzX1.js → scim-CovliQUg.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/scim.ts
 const generate = defineLeaf({
 	flags: {
@@ -28,7 +28,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = given(flags.out);
 		const schema = given(flags.schema);
-		const { runScimGenerate } = await import("./generate-CRVV5V7l.js");
+		const { runScimGenerate } = await import("./generate-BqkZq8Dr.js");
 		return runScimGenerate({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{scopes-0Up_UA2t.js → scopes-BSdYaGHs.js}

@@ -94,14 +94,6 @@ function scopeIdOf(membership, scope) {
 	return within[scope];
 }
 /**
-* A membership of the first scope itself (the only scope without a parent): its
-* id is a tenant. Needs no scope list, for code that holds only a subject.
-*/
-function rootMembershipId(membership) {
-	if (membership.scope !== void 0) return membership.within === void 0 ? membership.id : void 0;
-	return membership.team === void 0 ? membership.tenant : void 0;
-}
-/**
 * The instance of the first scope a membership sits in; what the active tenant
 * selects.
 */
@@ -159,11 +151,11 @@ function normalizeMembership(input, scopes) {
 		if (!Array.isArray(raw["keep"]) || !raw["keep"].every(isNonEmptyString)) return;
 		extra.keep = Object.freeze([...raw["keep"]]);
 	}
+	if (raw["tenant"] !== void 0 || raw["team"] !== void 0) return;
 	const named = raw["scope"] !== void 0 || raw["id"] !== void 0;
-	const legacy = raw["tenant"] !== void 0 || raw["team"] !== void 0;
 	const on = raw["on"];
 	if (on !== void 0) {
-		if (named || legacy || on === null || typeof on !== "object") return;
+		if (named || on === null || typeof on !== "object") return;
 		const target = on;
 		const targetId = idText(target["id"]);
 		if (!isNonEmptyString(target["resource"]) || targetId === void 0) return;
@@ -176,28 +168,14 @@ function normalizeMembership(input, scopes) {
 			...extra
 		});
 	}
-	let scope;
-	let id;
+	if (!named) return;
+	const scope = resolveScope(scopes, raw["scope"]);
 	let within = {};
-	if (named) {
-		if (legacy) return;
-		scope = resolveScope(scopes, raw["scope"]);
-		id = raw["id"];
-		if (raw["within"] !== void 0) {
-			if (raw["within"] === null || typeof raw["within"] !== "object" || Array.isArray(raw["within"])) return;
-			within = raw["within"];
-		}
-	} else if (raw["team"] !== void 0) {
-		scope = resolveScope(scopes, "team");
-		id = raw["team"];
-		const parent = resolveScope(scopes, "tenant");
-		if (raw["tenant"] !== void 0 && parent !== void 0) within = { [parent]: raw["tenant"] };
-	} else if (raw["tenant"] === void 0) return;
-	else {
-		scope = resolveScope(scopes, "tenant");
-		id = raw["tenant"];
+	if (raw["within"] !== void 0) {
+		if (raw["within"] === null || typeof raw["within"] !== "object" || Array.isArray(raw["within"])) return;
+		within = raw["within"];
 	}
-	const text = idText(id);
+	const text = idText(raw["id"]);
 	if (scope === void 0 || text === void 0) return;
 	const ancestors = scopeChain(scopes, scope).slice(1);
 	const resolved = {};
@@ -226,15 +204,6 @@ function normalizeMemberships(input, scopes) {
 	return out;
 }
 /**
-* A subject's memberships in canonical form. Resolved subjects already are;
-* this accepts a hand-built subject passed straight to a condition evaluator or
-* compiler.
-*/
-function subjectMemberships(memberships, scopes) {
-	const list = memberships ?? [];
-	return list.some((membership) => membership.tenant !== void 0 || membership.team !== void 0) ? normalizeMemberships(list, scopes) : list;
-}
-/**
 * Whether a named membership applies under the active tenant: a membership
 * whose chain includes the first scope counts only inside the active tenant.
 */
@@ -267,4 +236,4 @@ function subjectForPermission(subject, key) {
 	};
 }
 //#endregion
-export { normalizeMembership as a, rootMembershipId as c, scopeIdOf as d, scopeList as f, tenantOf as h, keepsPermission as i, rootScope as l, subjectMemberships as m, defineScopes as n, normalizeMemberships as o, subjectForPermission as p, findScope as r, resolveScope as s, activeFor as t, scopeChain as u };
+export { normalizeMembership as a, rootScope as c, scopeList as d, subjectForPermission as f, keepsPermission as i, scopeChain as l, defineScopes as n, normalizeMemberships as o, tenantOf as p, findScope as r, resolveScope as s, activeFor as t, scopeIdOf as u };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-uvp-kyfO.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Dx8PipbO.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-TpzkEKgJ.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CyRN0-Cd.js";
-import { i as evaluationsHandler } from "../evaluations-DOWuBpWv.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-CV-7DWeD.js";
-import { l as ReplayStore } from "../types-DsHGPtkR.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-DOYEuOLx.js";
-import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
-import { _ as subjectFromRunTicket, a as RunContext, c as RunResource, d as RunTicketFailureCause, f as RunTicketInput, g as signRunTicket, h as parseRunTicket, i as RunBinding, l as RunTicket, m as RunTicketSubjectOptions, n as RunActClaim, o as RunKind, p as RunTicketOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketAutomations } from "../run-ticket-ylovhyFQ.js";
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunResource, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-3OnXjZ2D.js";
+import { i as evaluationsHandler } from "../evaluations-CisTTURl.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-rFp6X_QP.js";
+import { l as ReplayStore } from "../types-Ck1KOfug.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-BfPaZ6T1.js";
+import { t as memoryReplayStore } from "../replay-E5X9E1lC.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotKey, r as SnapshotHeadersOptions, s as snapshotTag, t as CacheLifeForOptions } from "../snapshot-cache-B4YvlGG_.js";
+import { _ as subjectFromRunTicket, a as RunContext, c as RunResource, d as RunTicketFailureCause, f as RunTicketInput, g as signRunTicket, h as parseRunTicket, i as RunBinding, l as RunTicket, m as RunTicketSubjectOptions, n as RunActClaim, o as RunKind, p as RunTicketOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketAutomations } from "../run-ticket-DPaD27_r.js";
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunResource, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotKey, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -3,12 +3,12 @@ import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockAppro
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { c as problemFromDecision, f as validationProblem, l as problemResponse, p as wwwAuthenticate } from "../problem-BVLHFK33.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
-import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { n as tenantScope } from "../adapter-context-CIQpQxbE.js";
-import { t as createPermDock } from "../create-BLPKnJKa.js";
-import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-3cVlTLde.js";
-import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-DfnZCh-u.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { i as snapshotTag, n as snapshotHeaders, r as snapshotKey, t as cacheLifeFor } from "../snapshot-cache-B66h7FBK.js";
+import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { n as tenantScope } from "../adapter-context-OHikyRqV.js";
+import { t as createPermDock } from "../create-3A7J9KRR.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-D0PW6ZCw.js";
+import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-CjvXr6wj.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
 import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-D67a3nzk.js";
-export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotKey, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-3cVlTLde.js → server-D0PW6ZCw.js}

@@ -5,9 +5,9 @@ import { n as isThenable } from "./thenable-BNSM1U2R.js";
 import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-nR1JesoH.js";
 import { t as bytesToBase64Url } from "./sha256-C-4WXKIu.js";
 import { n as parseSupportSession } from "./support-session-BsmPCbz8.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 import { c as credentialEvent } from "./sink-D9_vh372.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-CyyyvCsL.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-B3Hj4puZ.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;