permdock 0.3.1 → 0.5.0

package/dist/run-BWc9qqvE.js

@@ -1,174 +0,0 @@
-import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
-import { o as cliVersion } from "./version-BvacVTZR.js";
-import { a as resolveCwd, i as readConfig } from "./config-BJiM-xAm.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
-import { stripVTControlCharacters } from "node:util";
-import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
-//#region src/cli/run.ts
-const NAMES = Object.keys(commands).filter(isCommand);
-const NO_CONFIG = {
-	config: {},
-	warnings: [],
-	file: void 0
-};
-async function run(argv, options) {
-	const stdoutChunks = [];
-	const stderrChunks = [];
-	const io = options?.io ?? {
-		stdout: (text) => {
-			stdoutChunks.push(text);
-		},
-		stderr: (text) => {
-			stderrChunks.push(text);
-		}
-	};
-	const writeOut = (text) => {
-		const line = lined(text);
-		io.stdout(line);
-		if (options?.io !== void 0) stdoutChunks.push(line);
-	};
-	const writeErr = (text) => {
-		const line = lined(text);
-		io.stderr(line);
-		if (options?.io !== void 0) stderrChunks.push(line);
-	};
-	const done = (code) => ({
-		code,
-		stdout: stdoutChunks.join(""),
-		stderr: stderrChunks.join("")
-	});
-	const flags = beforeSeparator(argv);
-	const globals = parseArgs([...flags], globalArgs);
-	const json = globals.json === true;
-	const color = io.color === true && globals.color !== false;
-	const plain = (text) => color ? text : stripVTControlCharacters(text);
-	const askedHelp = flags.includes("--help") || flags.includes("-h");
-	const first = globals._[0];
-	const name = first === "help" ? globals._[1] : first;
-	let result;
-	const configFile = stringArg(globals.config);
-	const contextFor = (cwd, loaded = NO_CONFIG) => ({
-		cwd,
-		config: loaded.config,
-		...configFile === void 0 ? {} : { configFile },
-		...loaded.file === void 0 ? {} : { configPath: loaded.file },
-		configWarnings: loaded.warnings,
-		io,
-		now: io.now?.() ?? /* @__PURE__ */ new Date(),
-		json,
-		color,
-		interactive: io.interactive === true && !json && globals.yes !== true,
-		report: (outcome) => {
-			result = outcome;
-		}
-	});
-	/** A failed run: text on stderr, or Problem Details on stdout under `--json`. */
-	const fail = (kind, message, command) => {
-		if (json) writeOut(JSON.stringify(cliProblem(kind, message, command), null, 2));
-		else writeErr(message);
-		return done(exitCodeOf(kind));
-	};
-	if (name !== void 0 && !isCommand(name)) return fail("usage", `unknown command '${name}'. Use ${new Intl.ListFormat("en-GB", { type: "disjunction" }).format(NAMES)}.`);
-	if (name === void 0 && (flags.includes("--version") || flags.includes("-v"))) {
-		writeOut(cliVersion());
-		return done(0);
-	}
-	if (askedHelp || first === "help" || name === void 0) {
-		const root = rootCommand();
-		const usage = name === void 0 ? await renderUsage(root) : await renderUsage(await load(name, contextFor(options?.cwd ?? process.cwd())), root);
-		if (name === void 0 && !askedHelp && first !== "help") {
-			writeErr(plain(usage));
-			return done(2);
-		}
-		writeOut(plain(usage));
-		return done(0);
-	}
-	const cwd = resolveCwd(stringArg(globals.cwd), options?.cwd ?? process.cwd());
-	let loaded;
-	try {
-		loaded = await readConfig(cwd, configFile);
-	} catch (error) {
-		return fail(cliErrorKind(error), describeError(error));
-	}
-	if (name !== "config") for (const warning of loaded.warnings) writeErr(`permdock: warning: ${warning}`);
-	try {
-		const command = await load(name, contextFor(cwd, loaded));
-		const rawArgs = withoutCommand(argv, name);
-		await runCommand(command, { rawArgs: normaliseValues(rawArgs, await resolveArgs(command)) });
-	} catch (error) {
-		if (!(error instanceof Error)) return fail("usage", String(error), name);
-		if (error.name === "CLIError") return fail("usage", `${name}: ${stripVTControlCharacters(error.message)}`, name);
-		return fail(cliErrorKind(error), error.message, name);
-	}
-	if (result === void 0) return done(0);
-	if (json && result.code !== 0 && !isJson(result.output)) return fail(result.code === 2 ? "usage" : "failed", result.output, name);
-	writeOut(result.output);
-	return done(result.code);
-}
-/** The root help lists commands from a static table, so it loads none of them. */
-function rootCommand() {
-	return defineCommand({
-		meta: {
-			name: "permdock",
-			description: "Collect, export, diff and check the permissions a PermDock policy declares"
-		},
-		args: {
-			...globalArgs,
-			version: {
-				type: "boolean",
-				alias: "v",
-				description: "Print the permdock version"
-			}
-		},
-		subCommands: Object.fromEntries(NAMES.map((name) => [name, defineCommand({ meta: {
-			name,
-			description: COMMAND_DESCRIPTIONS[name]
-		} })]))
-	});
-}
-async function load(name, ctx) {
-	return (await commands[name]())(ctx);
-}
-function isJson(text) {
-	try {
-		JSON.parse(text);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function lined(text) {
-	return text.endsWith("\n") ? text : `${text}\n`;
-}
-function beforeSeparator(argv) {
-	const end = argv.indexOf("--");
-	return end === -1 ? argv : argv.slice(0, end);
-}
-/** argv with the command name removed, wherever the global flags put it. */
-function withoutCommand(argv, name) {
-	const index = argv.findIndex((token, i) => token === name && argv[i - 1] !== "--cwd" && argv[i - 1] !== "--config");
-	return argv.filter((_, i) => i !== index);
-}
-/**
-* A value never starts with `-` (bar `-` itself): `--out --check` is a bare
-* `--out` and `--check`, as it was before citty, which would take `--check`
-* as the value. A bare string flag reads as `''`; a bare enum flag keeps its
-* default.
-*/
-function normaliseValues(rawArgs, def) {
-	const out = [];
-	for (const [i, token] of rawArgs.entries()) {
-		if (token === "--") {
-			out.push(...rawArgs.slice(i));
-			break;
-		}
-		const arg = token.startsWith("--") ? def[token.slice(2)] : void 0;
-		const next = rawArgs[i + 1];
-		const bare = next === void 0 || next !== "-" && next.startsWith("-");
-		if (arg?.type === "enum" && bare) continue;
-		out.push(arg?.type === "string" && bare ? `${token}=` : token);
-	}
-	return out;
-}
-//#endregion
-export { run as t };

package/dist/server-DlZ28Oz5.js

@@ -1,268 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { n as isThenable } from "./thenable-okc2xDsj.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { r as credentialEvent } from "./sink-Bd9PSyfq.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject } from "./credential-8P81ff4u.js";
-//#region src/server/credentials.ts
-const PREFIX = "pdk_";
-const ID = /^[\w-]{1,128}$/u;
-const TAIL = /^[A-Za-z\d]{49}$/u;
-const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-const SECRET_LENGTH = 43;
-const CHECKSUM_LENGTH = 6;
-const MAX_KEY = 182;
-const CRC_TABLE = (() => {
-	const table = /* @__PURE__ */ new Uint32Array(256);
-	for (let index = 0; index < 256; index += 1) {
-		let value = index;
-		for (let bit = 0; bit < 8; bit += 1) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
-		table[index] = value >>> 0;
-	}
-	return table;
-})();
-/** CRC-32 (IEEE 802.3) of the key's ASCII bytes, as 6 base62 characters. */
-function checksum(text) {
-	let crc = 4294967295;
-	for (let index = 0; index < text.length; index += 1) crc = (CRC_TABLE[(crc ^ (text.codePointAt(index) ?? 0)) & 255] ?? 0) ^ crc >>> 8;
-	let value = (crc ^ 4294967295) >>> 0;
-	let out = "";
-	for (let index = 0; index < CHECKSUM_LENGTH; index += 1) {
-		out = (ALPHABET[value % 62] ?? "") + out;
-		value = Math.floor(value / 62);
-	}
-	return out;
-}
-/**
-* Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
-* the secret 43 base62 characters and the checksum the 6 base62 characters of
-* the CRC-32 of everything before it. Anything else, including a checksum
-* that does not match, is `undefined`.
-*/
-function parseApiKey(key) {
-	if (typeof key !== "string" || key.length > MAX_KEY || !key.startsWith(PREFIX)) return;
-	const body = key.slice(4);
-	const cut = body.lastIndexOf("_");
-	if (cut <= 0) return;
-	const id = body.slice(0, cut);
-	const tail = body.slice(cut + 1);
-	if (!ID.test(id) || !TAIL.test(tail)) return;
-	const secret = tail.slice(0, SECRET_LENGTH);
-	return tail.slice(SECRET_LENGTH) === checksum(`${PREFIX}${id}_${secret}`) ? {
-		id,
-		secret
-	} : void 0;
-}
-/**
-* A fresh `pdk_<id>_<secret><checksum>`: a 43-character base62 secret (about
-* 256 bits) and a 6-character CRC-32 checksum, so a secret scanner can tell a
-* real key from a lookalike without calling the issuer.
-*/
-function generateApiKey(id) {
-	if (!ID.test(id)) throw new TypeError("PermDock: an API key id is 1 to 128 of A-Z, a-z, 0-9, _ and -");
-	let secret = "";
-	const bytes = /* @__PURE__ */ new Uint8Array(64);
-	while (secret.length < SECRET_LENGTH) {
-		globalThis.crypto.getRandomValues(bytes);
-		for (const byte of bytes) if (byte < 248 && secret.length < SECRET_LENGTH) secret += ALPHABET[byte % 62];
-	}
-	const key = `${PREFIX}${id}_${secret}`;
-	return `${key}${checksum(key)}`;
-}
-/** base64url SHA-256 of the whole key, the value to store and compare. */
-async function hashApiKey(key) {
-	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(key));
-	return bytesToBase64Url(new Uint8Array(digest));
-}
-function sameHash(left, right) {
-	if (left.length !== right.length) return false;
-	let difference = 0;
-	for (let index = 0; index < left.length; index += 1) difference |= (left.codePointAt(index) ?? 0) ^ (right.codePointAt(index) ?? 0);
-	return difference === 0;
-}
-/**
-* A `CredentialVerifier` over the application's own table: `find` looks a
-* key up by the id in it, and the key's hash is compared in constant time.
-* A record that is not a valid v1 credential, or whose id is not the key's,
-* verifies to `null`. A throwing `find` propagates, so the resolver denies
-* with `source-threw`.
-*/
-function apiKeyVerifier(options) {
-	return Object.freeze({
-		...options.touch === void 0 ? {} : { touch: options.touch },
-		async verify(secret) {
-			const parts = parseApiKey(secret);
-			if (parts === void 0) return null;
-			const stored = await options.find(parts.id);
-			if (stored === null || stored === void 0) return null;
-			const credential = parseCredential(stored.credential);
-			if (credential === void 0 || credential.id !== parts.id || typeof stored.hash !== "string" || !sameHash(await hashApiKey(secret), stored.hash)) return null;
-			return credential;
-		}
-	});
-}
-function write(sink, event) {
-	try {
-		const written = sink.write(event);
-		if (isThenable(written)) Promise.resolve(written).catch(() => void 0);
-	} catch {}
-}
-/**
-* In-process credentials for tests and single-replica apps. `issue`, `rotate`
-* and `revoke` write `credential` events to `sink` when one is given.
-*/
-function memoryCredentials(options = {}) {
-	const records = /* @__PURE__ */ new Map();
-	const used = /* @__PURE__ */ new Map();
-	const verifier = apiKeyVerifier({ find: (id) => records.get(id) });
-	const emit = (operation, credential) => {
-		if (options.sink !== void 0) write(options.sink, [credentialEvent(compact({
-			operation,
-			credential,
-			source: options.source
-		}))]);
-	};
-	const store = async (credential) => {
-		const key = generateApiKey(credential.id);
-		records.set(credential.id, {
-			credential,
-			hash: await hashApiKey(key)
-		});
-		return key;
-	};
-	return Object.freeze({
-		verify: (secret) => verifier.verify(secret),
-		touch(id, at) {
-			if (records.has(id)) used.set(id, at);
-		},
-		lastUsedAt(id) {
-			return used.get(id);
-		},
-		async issue(input) {
-			const credential = parseCredential(input);
-			if (credential === void 0) throw new TypeError("PermDock: not a valid v1 credential");
-			if (records.has(credential.id)) throw new Error(`PermDock: credential '${credential.id}' exists`);
-			const key = await store(credential);
-			emit("created", credential);
-			return key;
-		},
-		async rotate(id) {
-			const current = records.get(id);
-			if (current === void 0) return;
-			const key = await store(current.credential);
-			emit("rotated", current.credential);
-			return key;
-		},
-		revoke(id) {
-			const current = records.get(id);
-			if (current === void 0) return false;
-			records.delete(id);
-			used.delete(id);
-			emit("revoked", current.credential);
-			return true;
-		},
-		list() {
-			return [...records.values()].map((record) => record.credential);
-		}
-	});
-}
-async function checkStores(options, credential, active) {
-	try {
-		const tenant = credentialTenant(credential, active);
-		const policy = options.settings === void 0 || tenant === void 0 ? void 0 : (await options.settings.settingsFor(tenant))?.credentials;
-		if (policy !== void 0 && credentialPolicyViolation(credential, policy) !== void 0) return {
-			ok: false,
-			cause: "credential-policy"
-		};
-		if (options.revoked !== void 0 && await options.revoked(credential.id)) return {
-			ok: false,
-			cause: "credential-revoked"
-		};
-		if (credential.kind !== "user" || options.owner === void 0) return { ok: true };
-		const owner = await options.owner(credential.principal);
-		if (owner === null || owner === void 0) return {
-			ok: false,
-			cause: "owner-unavailable"
-		};
-		return {
-			ok: true,
-			owner
-		};
-	} catch {
-		return { ok: false };
-	}
-}
-function touch(verifier, id) {
-	if (verifier.touch === void 0) return;
-	try {
-		const touched = verifier.touch(id, Math.floor(Date.now() / 1e3));
-		if (isThenable(touched)) Promise.resolve(touched).catch(() => void 0);
-	} catch {}
-}
-function sampled(sample) {
-	if (sample === 1) return true;
-	const draw = /* @__PURE__ */ new Uint32Array(1);
-	globalThis.crypto.getRandomValues(draw);
-	return (draw[0] ?? 0) / 4294967296 < sample;
-}
-function reportUse(options, credential) {
-	const sample = options.sample ?? 1;
-	if (options.sink === void 0 || !Number.isFinite(sample) || sample <= 0 || sample > 1 || !sampled(sample)) return;
-	write(options.sink, [credentialEvent(compact({
-		operation: "used",
-		credential,
-		source: options.source,
-		sample
-	}))]);
-}
-/**
-* A `SubjectResolver` for opaque API keys (`pdk_<id>_<secret>`): each call
-* resolves a key into the subject its credential acts as. Every failure (a
-* malformed or unknown key, a record that is not a valid credential, expiry,
-* a tenant policy the key breaks, a revoked id, a missing owner, a throwing
-* verifier or callback) is the anonymous subject, never a throw.
-*/
-function subjectFromApiKey(options) {
-	return (key, resolve) => resolveApiKey(key, options, resolve?.tenant);
-}
-function anonymous() {
-	return anonymousSubject();
-}
-async function resolveApiKey(key, options, tenant) {
-	if (typeof key !== "string" || key.length === 0) return anonymous();
-	const deny = (cause, reason = "invalid-token") => {
-		try {
-			options.onAuth?.(compact({
-				reason,
-				cause,
-				source: "api-key",
-				requestId: options.requestId
-			}));
-		} catch {}
-		return anonymous();
-	};
-	const parts = parseApiKey(key);
-	if (parts === void 0) return deny("malformed");
-	let verified;
-	try {
-		verified = await options.verifier.verify(key);
-	} catch {
-		return deny(void 0, "source-threw");
-	}
-	if (verified === null || verified === void 0) return deny("unknown-credential");
-	const credential = parseCredential(verified);
-	if (credential === void 0 || credential.id !== parts.id) return deny("invalid-claims");
-	if (credential.expiresAt !== void 0 && credential.expiresAt <= Date.now() / 1e3) return deny("expired");
-	const checked = await checkStores(options, credential, tenant);
-	if (!checked.ok) return checked.cause === void 0 ? deny(void 0, "source-threw") : deny(checked.cause);
-	const subject = credentialSubject(credential, compact({
-		permissions: options.permissions,
-		owner: checked.owner
-	}));
-	if (subject.principal === null) return deny("owner-unavailable");
-	reportUse(options, credential);
-	touch(options.verifier, credential.id);
-	return subject;
-}
-//#endregion
-export { parseApiKey as a, memoryCredentials as i, generateApiKey as n, subjectFromApiKey as o, hashApiKey as r, apiKeyVerifier as t };

package/dist/sink-B1fZzIMf.d.ts

@@ -1,104 +0,0 @@
-import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-IB6yxpC3.js";
-//#region src/core/sink.d.ts
-/** The closed list of CloudEvents `type` values PermDock emits. */
-declare const CLOUD_EVENT_TYPES: {
-  readonly decision: "dev.permdock.decision";
-  readonly approval: "dev.permdock.approval";
-  readonly directory: "dev.permdock.directory";
-  readonly membership: "dev.permdock.membership";
-  readonly catalog: "dev.permdock.catalog";
-  readonly credential: "dev.permdock.credential";
-  readonly accessStarted: "dev.permdock.access.started";
-  readonly accessEnded: "dev.permdock.access.ended";
-  readonly accessRevoked: "dev.permdock.access.revoked";
-};
-type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
-/** Why a published catalog broke a live hosted grant, which the Cloud then suspends. */
-type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened";
-/** One drift finding: the permission key and, when one broke, the hosted grant id. */
-type CatalogFinding = {
-  readonly code: CatalogFindingCode;
-  readonly permission: string;
-  readonly grant?: string;
-};
-/** `data` of a `dev.permdock.catalog` event: a `permdock cloud push` or a drift against live hosted grants. */
-type CatalogEventData = {
-  readonly kind: "publish" | "drift";
-  /** The catalog fingerprint after the publish, or the one drift was measured against. */
-  readonly fingerprint: string;
-  readonly previous?: string;
-  readonly findings?: readonly CatalogFinding[];
-};
-type CloudEvent = {
-  readonly specversion: "1.0";
-  readonly type: CloudEventType;
-  readonly source: string;
-  readonly subject?: string;
-  readonly id: string;
-  readonly time: string;
-  readonly datacontenttype: "application/json";
-  readonly data: SinkEvent | CatalogEventData;
-};
-type SignDecisionBatchOptions = {
-  readonly audience?: string | readonly string[];
-  readonly source?: string;
-};
-type MemorySinkOptions = {
-  readonly capacity?: number;
-  readonly signer?: TokenSigner;
-  readonly audience?: string | readonly string[];
-  readonly source?: string;
-};
-type MemorySink = DecisionSink & {
-  readonly events: () => readonly SinkEvent[];
-  readonly batches: () => readonly string[];
-};
-/**
- * A `credential` sink event for `credential`. `sample` belongs on `used`
- * events only and must be in `(0, 1]`.
- */
-declare function credentialEvent(input: {
-  readonly operation: CredentialEvent["operation"];
-  readonly credential: Credential;
-  readonly source?: string;
-  readonly by?: CredentialEvent["by"];
-  readonly sample?: number;
-  readonly at?: string;
-}): CredentialEvent;
-declare function membershipEvent(input: {
-  readonly source: string;
-  readonly operation: MembershipEvent["operation"];
-  readonly principal: MembershipEvent["principal"];
-  readonly scope?: string;
-  readonly id?: string;
-  readonly within?: MembershipEvent["within"];
-  readonly via?: string;
-  readonly expiresAt?: number;
-  readonly roles: MembershipEvent["roles"];
-  readonly by?: MembershipEvent["by"];
-  readonly at?: string;
-}): MembershipEvent;
-/**
- * A support-access lifecycle event. `started` on consent, `ended` when the
- * session lapses, `revoked` when the tenant pulls consent early. It never
- * decides; the app writes and revokes the membership.
- */
-declare function accessEvent(input: {
-  readonly source: string;
-  readonly operation: AccessEvent["operation"];
-  readonly tenant: string;
-  readonly principal: AccessEvent["principal"];
-  readonly via?: string;
-  readonly roles: readonly string[];
-  readonly member?: AccessEvent["member"];
-  readonly expiresAt?: number;
-  readonly grantedBy?: string;
-  readonly reason?: string;
-  readonly actor?: AccessEvent["actor"];
-  readonly at?: string;
-}): AccessEvent;
-declare function toCloudEvent(event: SinkEvent, source?: string): CloudEvent;
-declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options?: SignDecisionBatchOptions): Promise<string>;
-declare function memorySink(options?: MemorySinkOptions): MemorySink;
-//#endregion
-export { CloudEvent as a, MemorySinkOptions as c, credentialEvent as d, membershipEvent as f, toCloudEvent as h, CatalogFindingCode as i, SignDecisionBatchOptions as l, signDecisionBatch as m, CatalogEventData as n, CloudEventType as o, memorySink as p, CatalogFinding as r, MemorySink as s, CLOUD_EVENT_TYPES as t, accessEvent as u };

package/dist/sink-Bd9PSyfq.js

@@ -1,141 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-//#region src/core/sink.ts
-/** The closed list of CloudEvents `type` values PermDock emits. */
-const CLOUD_EVENT_TYPES = Object.freeze({
-	decision: "dev.permdock.decision",
-	approval: "dev.permdock.approval",
-	directory: "dev.permdock.directory",
-	membership: "dev.permdock.membership",
-	catalog: "dev.permdock.catalog",
-	credential: "dev.permdock.credential",
-	accessStarted: "dev.permdock.access.started",
-	accessEnded: "dev.permdock.access.ended",
-	accessRevoked: "dev.permdock.access.revoked"
-});
-function cloudEventType(event) {
-	switch (event.type) {
-		case "directory": return CLOUD_EVENT_TYPES.directory;
-		case "membership": return CLOUD_EVENT_TYPES.membership;
-		case "credential": return CLOUD_EVENT_TYPES.credential;
-		case "access": return event.operation === "started" ? CLOUD_EVENT_TYPES.accessStarted : event.operation === "ended" ? CLOUD_EVENT_TYPES.accessEnded : CLOUD_EVENT_TYPES.accessRevoked;
-		case "decision":
-			if (event.phase === "requested" || event.phase === "resolved") return CLOUD_EVENT_TYPES.approval;
-			return CLOUD_EVENT_TYPES.decision;
-		default: return event;
-	}
-}
-function cloudEventSubject(event) {
-	if (event.type === "directory") return event.resource.id;
-	if (event.type === "membership" || event.type === "access") return event.principal.id;
-	if (event.type === "credential") return event.credential.id;
-	return event.permission;
-}
-/**
-* A `credential` sink event for `credential`. `sample` belongs on `used`
-* events only and must be in `(0, 1]`.
-*/
-function credentialEvent(input) {
-	const sample = input.sample;
-	if (sample !== void 0 && (input.operation !== "used" || !Number.isFinite(sample) || sample <= 0 || sample > 1)) throw new RangeError("PermDock: sample is a number in (0, 1] on used events only");
-	const { credential } = input;
-	return compact({
-		type: "credential",
-		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-		source: input.source ?? "permdock",
-		operation: input.operation,
-		credential: {
-			id: credential.id,
-			kind: credential.kind
-		},
-		principal: { id: credential.principal },
-		tenant: credential.tenant,
-		expiresAt: credential.expiresAt,
-		by: input.by,
-		sample
-	});
-}
-function membershipEvent(input) {
-	if (input.scope === void 0 !== (input.id === void 0)) throw new TypeError("PermDock: membershipEvent needs scope and id together");
-	if (input.scope === void 0 && input.within !== void 0) throw new TypeError("PermDock: membershipEvent within needs a scope");
-	return compact({
-		type: "membership",
-		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-		source: input.source,
-		operation: input.operation,
-		principal: input.principal,
-		scope: input.scope,
-		id: input.id,
-		within: input.within,
-		via: input.via,
-		expiresAt: input.expiresAt,
-		roles: input.roles,
-		by: input.by
-	});
-}
-/**
-* A support-access lifecycle event. `started` on consent, `ended` when the
-* session lapses, `revoked` when the tenant pulls consent early. It never
-* decides; the app writes and revokes the membership.
-*/
-function accessEvent(input) {
-	return compact({
-		type: "access",
-		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-		source: input.source,
-		operation: input.operation,
-		tenant: input.tenant,
-		principal: input.principal,
-		via: input.via ?? "support",
-		roles: input.roles,
-		member: input.member,
-		expiresAt: input.expiresAt,
-		grantedBy: input.grantedBy,
-		reason: input.reason,
-		actor: input.actor
-	});
-}
-function toCloudEvent(event, source = "permdock") {
-	return compact({
-		specversion: "1.0",
-		type: cloudEventType(event),
-		source,
-		subject: cloudEventSubject(event),
-		id: globalThis.crypto.randomUUID(),
-		time: event.at,
-		datacontenttype: "application/json",
-		data: event
-	});
-}
-function signDecisionBatch(events, signer, options = {}) {
-	const source = options.source ?? "permdock";
-	return signer.sign({ events: events.map((event) => toCloudEvent(event, source)) }, compact({
-		typ: "permdock-decisions+jwt",
-		audience: options.audience
-	}));
-}
-function memorySink(options = {}) {
-	const capacity = options.capacity ?? 1e4;
-	const buffer = [];
-	const signed = [];
-	return {
-		write(events) {
-			buffer.push(...events);
-			if (buffer.length > capacity) buffer.splice(0, buffer.length - capacity);
-			if (options.signer === void 0) return;
-			return signDecisionBatch(events, options.signer, compact({
-				audience: options.audience,
-				source: options.source
-			})).then((batch) => {
-				signed.push(batch);
-			}).catch(() => void 0);
-		},
-		events() {
-			return [...buffer];
-		},
-		batches() {
-			return [...signed];
-		}
-	};
-}
-//#endregion
-export { memorySink as a, membershipEvent as i, accessEvent as n, signDecisionBatch as o, credentialEvent as r, toCloudEvent as s, CLOUD_EVENT_TYPES as t };