permdock 0.4.0 → 0.5.0

package/dist/{create-BBO24vj6.js → create-DnrmLnLW.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as problemDetails } from "./problem-details-DECUnXAn.js";
-import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
-import { r as challengeScope } from "./permdock-L26udHSk.js";
+import { n as problemDetails } from "./problem-details-cn5X30gZ.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
+import { c as withApp, i as challengeScope } from "./permdock-B9JxkBwC.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { i as decisionResponse, o as notFoundProblem, s as problemFromDecision, t as ANONYMOUS, u as unauthenticatedProblem } from "./problem-CnWraVhC.js";
-import { n as resolveOrNull } from "./build-instance-DIIV9DbC.js";
-import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-C9YJsv3H.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-BVM7aWNs.js";
+import { i as decisionResponse, o as notFoundProblem, s as problemFromDecision, t as ANONYMOUS, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
+import { n as resolveOrNull } from "./build-instance-BMnAudHn.js";
+import { n as applyApprovalResume, o as evaluationsHandler, u as InvalidSignatureError } from "./evaluations-DZ2CbV5k.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-BTRTG7OT.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",
@@ -89,7 +89,7 @@ async function refused(hook, fallback, decision, request, report) {
 			decision
 		};
 		const status = result.status;
-		if (typeof status !== "number" || status < 300) throw new TypeError(`PermDock: onDenied returned status ${String(status)}; a refusal keeps a status of 300 or more`);
+		if (typeof status !== "number" || status < 300) throw new TypeError(`PermDock: deniedResponse returned status ${String(status)}; a refusal keeps a status of 300 or more`);
 		return {
 			ok: false,
 			response: result instanceof Response ? result : new Response(JSON.stringify(result), {
@@ -112,11 +112,11 @@ async function guardOn(deps, instance, remote, report, request, permission, load
 	const credentials = request === void 0 ? false : hasCredentials(request);
 	if (permission === null) {
 		if (declared === void 0) throw new TypeError(request === void 0 ? "PermDock: protect(null) needs oauthScopes" : `PermDock: protect(null) needs oauthScopes, and no operation declares them for ${request.method} ${new URL(request.url).pathname}`);
-		if (instance.subject.principal === null) return refused(deps.options.onDenied, unauthenticatedProblem(credentials), ANONYMOUS, request, report);
+		if (instance.subject.principal === null) return refused(deps.options.deniedResponse, unauthenticatedProblem(credentials), ANONYMOUS, request, report);
 	}
 	const { actor, delegation } = instance.subject;
 	const held = permission === null && (actor !== void 0 || delegation !== void 0) ? delegation?.scopes ?? [] : delegation?.scopes;
-	if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return refused(deps.options.onDenied, scopeProblem(permission, instance.subject, credentials, declared[0]), NOT_DELEGATED, request, report);
+	if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return refused(deps.options.deniedResponse, scopeProblem(permission, instance.subject, credentials, declared[0]), NOT_DELEGATED, request, report);
 	let data;
 	if (load !== void 0) {
 		let loaded;
@@ -124,7 +124,7 @@ async function guardOn(deps, instance, remote, report, request, permission, load
 			loaded = await load();
 		} catch (error) {
 			report(error);
-			return refused(deps.options.onDenied, loadFailedProblem(permission), LOAD_FAILED, request, report);
+			return refused(deps.options.deniedResponse, loadFailedProblem(permission), LOAD_FAILED, request, report);
 		}
 		if (loaded === null || loaded === void 0) return {
 			ok: false,
@@ -138,7 +138,7 @@ async function guardOn(deps, instance, remote, report, request, permission, load
 		data
 	};
 	const decideOptions = compact({
-		source: "adapter",
+		call: "adapter",
 		adapter: deps.adapter,
 		field: protectOptions.field,
 		explain: protectOptions.explain,
@@ -162,7 +162,7 @@ async function guardOn(deps, instance, remote, report, request, permission, load
 		decision,
 		data
 	};
-	return refused(deps.options.onDenied, problemFromDecision(decision, permission, instance.subject, compact({
+	return refused(deps.options.deniedResponse, problemFromDecision(decision, permission, instance.subject, compact({
 		approval: deps.options.approval,
 		credentials,
 		scope: declared?.[0] ?? challengeScope(deps.policy, permission),
@@ -172,18 +172,17 @@ async function guardOn(deps, instance, remote, report, request, permission, load
 //#endregion
 //#region src/server/create.ts
 async function resolveActor(request, options) {
-	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request)) ?? actorFrom(options.actor, request);
+	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth.verify(request)) ?? actorFrom(options.actor, request);
 }
 const NO_TENANT = "\0";
-function createPermDock(policy, options) {
-	return createServerKernel(policy, options);
-}
 /**
-* The kernel behind every HTTP adapter. The subject and actor are resolved
-* once per `Request`; one instance is cached per `(Request, tenant)`, so a
-* global middleware and a later tenant-scoped `protect` never share a tenant.
+* The Fetch factory behind every HTTP adapter. The subject and actor are
+* resolved once per `Request`; one instance is cached per `(Request, tenant)`,
+* so a global middleware and a later tenant-scoped `protect` never share a
+* tenant.
 */
-function createServerKernel(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const adapter = options.adapter ?? "server";
 	const subjects = /* @__PURE__ */ new WeakMap();
 	const instances = /* @__PURE__ */ new WeakMap();
@@ -217,7 +216,7 @@ function createServerKernel(policy, options) {
 				context
 			},
 			errors,
-			wrap: options.wrap
+			wrap: (created) => options.wrap === void 0 ? created : options.wrap(created)
 		});
 		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, built.options);
 		reporters.set(built.permdock, built.report);
@@ -243,7 +242,7 @@ function createServerKernel(policy, options) {
 	};
 	const connection = async (request, connectionOptions = {}, scope) => {
 		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		const { openConnection } = await import("./connection-DUsczpB5.js");
+		const { openConnection } = await import("./connection-DjhIJSs2.js");
 		return openConnection({
 			open: async () => (await build(request, { tenant })).permdock,
 			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
@@ -253,9 +252,9 @@ function createServerKernel(policy, options) {
 			options: connectionOptions
 		});
 	};
-	const permdock = async (request, scope) => (await build(request, scope)).permdock;
+	const getPermDock = async (request, scope) => (await build(request, scope)).permdock;
 	const getSnapshot = async (request, query = {}) => {
-		return (await permdock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
+		return (await getPermDock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
 			include: query.include,
 			tenants: query.tenants
 		}));
@@ -265,7 +264,7 @@ function createServerKernel(policy, options) {
 		options,
 		adapter
 	};
-	const protectRoute = (permission, loadData, protectOptions = {}) => {
+	const protectRoute = (permission, data, protectOptions = {}) => {
 		if (permission === null && routeScopes(protectOptions.oauthScopes) === void 0 && options.operations === void 0) throw new TypeError("PermDock: protect(null) needs oauthScopes, in its options or an operations entry");
 		return async (request, scope) => {
 			let instance;
@@ -280,7 +279,7 @@ function createServerKernel(policy, options) {
 				};
 				throw error;
 			}
-			return guardOn(deps, instance, remote, report, request, permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions);
+			return guardOn(deps, instance, remote, report, request, permission, data === void 0 ? void 0 : () => data(request), protectOptions);
 		};
 	};
 	const protect = protectRoute;
@@ -299,14 +298,14 @@ function createServerKernel(policy, options) {
 			} };
 		}
 	};
-	const permdockHandler = (scope) => createEvaluationsHandler(compact({
+	const permdockHandler = (scope) => evaluationsHandler(compact({
 		policy,
-		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
+		resolve: scope === void 0 ? getPermDock : async (request) => getPermDock(request, await scope(request)),
 		store: options.store,
 		adapter
 	}));
 	return {
-		permdock,
+		getPermDock,
 		getSnapshot,
 		protect,
 		protectOn: (instance, permission, load, protectOptions = {}, request) => guardOn(deps, instance, void 0, reporters.get(instance) ?? (() => void 0), request, permission, load, protectOptions),
@@ -321,4 +320,4 @@ function createServerKernel(policy, options) {
 	};
 }
 //#endregion
-export { createServerKernel as n, createPermDock as t };
+export { createPermDock as t };

package/dist/{credential-kue0qpbm.js → credential-DM2um3ha.js}

@@ -1,11 +1,20 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-BsblpB-z.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { a as ownRecord, n as idList, r as isId } from "./capability-txATtKV4.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
+/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+function isFeedId(value) {
+	return /^[a-z0-9-]{1,16}$/u.test(value);
+}
 const MAX_NAME = 256;
 function policies(policy) {
 	return isReadonlyArray(policy) ? policy : [policy];
@@ -18,10 +27,14 @@ function policies(policy) {
 function credentialPolicyViolation(credential, policy) {
 	const list = policies(policy);
 	for (const item of list) if (item.kinds !== void 0 && !item.kinds.includes(credential.kind)) return "kind";
-	if (credential.expiresAt === void 0) return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	if (credential.expiresAt === void 0) {
+		if (credential.kind === "feed") return;
+		return list.some((item) => item.allowNoExpiry === true) && list.every((item) => item.maxTtl === void 0) ? void 0 : "no-expiry";
+	}
+	const lifetime = (secondsOf(credential.expiresAt) ?? NaN) - (secondsOf(credential.createdAt) ?? NaN);
 	for (const item of list) {
 		const max = item.maxTtl;
-		if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max) || max < 0 || credential.expiresAt - credential.createdAt > max)) return "ttl";
+		if (max !== void 0 && (!Number.isSafeInteger(max) || max < 0 || !(lifetime <= max))) return "ttl";
 	}
 }
 function parsePermissions(value) {
@@ -39,9 +52,6 @@ function parsePermissions(value) {
 	}
 	return out;
 }
-function isTime(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
 /**
 * Validates an untrusted credential record and returns a frozen copy with
 * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
@@ -51,19 +61,30 @@ function isTime(value) {
 function parseCredential(input) {
 	const value = ownRecord(input);
 	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
-	if (value["kind"] !== "user" && value["kind"] !== "service") return;
+	if (value["kind"] !== "user" && value["kind"] !== "service" && value["kind"] !== "feed") return;
 	if (!isId(value["principal"]) || !isId(value["createdBy"])) return;
 	const permissions = parsePermissions(value["permissions"]);
-	if (permissions === void 0 || !isTime(value["createdAt"])) return;
-	if (value["expiresAt"] !== void 0 && !isTime(value["expiresAt"])) return;
+	if (permissions === void 0 || !isRfc3339(value["createdAt"])) return;
+	if (value["expiresAt"] !== void 0 && !isRfc3339(value["expiresAt"])) return;
 	if (value["name"] !== void 0 && (typeof value["name"] !== "string" || value["name"].length > MAX_NAME)) return;
 	let tenant;
 	let roles;
+	let on;
 	if (value["kind"] === "service") {
 		roles = idList(value["roles"]);
-		if (!isId(value["tenant"]) || roles === void 0) return;
+		if (!isId(value["tenant"]) || roles === void 0 || value["on"] !== void 0) return;
 		tenant = value["tenant"];
-	} else if (value["roles"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+	} else if (value["kind"] === "feed") {
+		roles = idList(value["roles"]);
+		const target = ownRecord(value["on"]);
+		if (roles === void 0 || target === void 0 || !isId(target["resource"]) || !isId(target["id"]) || value["principal"] !== value["id"] || !isFeedId(value["id"])) return;
+		if (value["tenant"] !== void 0 && !isId(value["tenant"])) return;
+		tenant = typeof value["tenant"] === "string" ? value["tenant"] : void 0;
+		on = {
+			resource: target["resource"],
+			id: target["id"]
+		};
+	} else if (value["roles"] !== void 0 || value["on"] !== void 0 || value["tenant"] !== void 0 && !isId(value["tenant"])) return;
 	else tenant = value["tenant"];
 	return freezeDeep(compact({
 		v: 1,
@@ -72,6 +93,7 @@ function parseCredential(input) {
 		principal: value["principal"],
 		tenant,
 		roles,
+		on,
 		permissions,
 		createdBy: value["createdBy"],
 		createdAt: value["createdAt"],
@@ -120,7 +142,7 @@ function credentialDelegation(credential, permissions) {
 * owner, passed live as `owner` (roles and memberships as of this request),
 * with the credential's delegation: every check is the owner's rights
 * intersected with the key's. One that names a `tenant` makes it the active
-* tenant, and `createPermDock` then keeps only the owner's memberships
+* tenant, and `getPermDock` then keeps only the owner's memberships
 * inside it and no global role. A `service` credential is a `service`
 * principal whose only membership is `roles` in `tenant`. An owner whose id
 * is not the credential's `principal`, or who is not a user, is anonymous.
@@ -128,7 +150,20 @@ function credentialDelegation(credential, permissions) {
 function credentialSubject(credential, options) {
 	const delegation = credentialDelegation(credential, options.permissions);
 	let principal;
-	if (credential.kind === "user") {
+	if (credential.kind === "feed") {
+		if (credential.on === void 0 || credential.roles === void 0) return anonymousSubject();
+		const membership = compact({
+			on: credential.on,
+			roles: credential.roles,
+			via: "feed"
+		});
+		principal = compact({
+			id: credential.id,
+			kind: "feed",
+			memberships: [membership],
+			credential
+		});
+	} else if (credential.kind === "user") {
 		const owner = options.owner ?? {
 			id: credential.principal,
 			kind: "user"
@@ -158,11 +193,11 @@ function credentialSubject(credential, options) {
 		principal,
 		delegation,
 		context: {},
-		expiresAt: credential.expiresAt
+		expiresAt: secondsOf(credential.expiresAt)
 	}));
 }
 function credentialToken(credential) {
-	const payload = JSON.stringify({
+	const payload = canonicalJson({
 		t: "credential",
 		id: credential.id,
 		kind: credential.kind,
@@ -170,11 +205,12 @@ function credentialToken(credential) {
 		tenant: credential.tenant ?? null,
 		roles: credential.roles ?? null,
 		permissions: credential.permissions,
+		...credential.on === void 0 ? {} : { on: credential.on },
 		createdBy: credential.createdBy,
 		expiresAt: credential.expiresAt ?? null,
 		name: credential.name ?? null
 	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+	return sha256Digest(payload);
 }
 function denied(reason, detail) {
 	return freezeDeep({
@@ -213,28 +249,90 @@ function refuse(reason, detail) {
 		decision: denied(reason, detail)
 	};
 }
+function oneResource(resource) {
+	const names = new Set(listPermissions(resource).map((leaf) => leaf.resource));
+	const [name] = names;
+	return names.size === 1 && name !== void 0 ? name : void 0;
+}
+function granteeOnResource(to, resource, role) {
+	for (const grant of flattenGrantee(to)) if (grant.kind === "role" && grant.role === role && typeof grant.scope === "object" && grant.scope.resource === resource) return true;
+	return false;
+}
+function roleDeclaredOn(permdock, resource, resourceName, roleName, id, row) {
+	const preview = permdock.simulate({
+		roles: [],
+		memberships: [{
+			on: {
+				resource: resourceName,
+				id
+			},
+			roles: [roleName]
+		}]
+	});
+	for (const leaf of listPermissions(resource)) {
+		if (leaf.resource !== resourceName) continue;
+		const decision = preview.explain(leaf, row, { trusted: true });
+		const seen = [
+			..."matched" in decision && decision.matched !== void 0 ? [decision.matched] : [],
+			...decision.trace?.allows ?? [],
+			...decision.trace?.denies ?? [],
+			..."denials" in decision ? decision.denials : []
+		];
+		for (const grant of seen) {
+			if (grant.role !== roleName) continue;
+			if (granteeOnResource(grant.to, resourceName, roleName)) return true;
+		}
+	}
+	return false;
+}
+function feedTarget(permdock, request, entries) {
+	const resource = oneResource(request.on.resource);
+	if (resource === void 0 || !isFeedId(request.id) || !isId(request.on.id) || request.row === void 0 || request.row === null || request.roles.length === 0) return refuse("validation");
+	for (const entry of entries) {
+		if (entry.leaf.resource !== resource) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (entry.ids !== void 0 && (entry.ids.length !== 1 || entry.ids[0] !== request.on.id)) return refuse("exceeds-creator", { permission: entry.leaf.key });
+		if (permdock.decide(entry.leaf, request.row, { trusted: true }).outcome !== "granted") return refuse("exceeds-creator", { permission: entry.leaf.key });
+	}
+	for (const name of request.roles) if (!roleDeclaredOn(permdock, request.on.resource, resource, name, request.on.id, request.row)) return refuse("exceeds-creator", { role: name });
+	return {
+		ok: true,
+		resource
+	};
+}
+function feedOn(request, feed) {
+	if (request.kind !== "feed" || feed === void 0) return;
+	if (feed.ok && "resource" in feed) return {
+		resource: feed.resource,
+		id: request.on.id
+	};
+}
 function checkRequest(permdock, request, now) {
 	const creator = permdock.subject.principal;
 	if (creator === null) return refuse("anonymous");
-	if (creator.kind === "link" || "credential" in creator) return refuse("exceeds-creator", { creator: creator.kind === "link" ? "link" : "credential" });
+	if (creator.kind === "link" || creator.kind === "feed" || creator.kind === "contact") return refuse("exceeds-creator", { creator: creator.kind });
+	if ("credential" in creator) return refuse("exceeds-creator", { creator: "credential" });
 	const entries = permissionEntries(request, leafByKey(permdock.permissions));
-	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (!isTime(request.expiresAt) || request.expiresAt <= now)) return refuse("validation");
+	const expires = request.expiresAt === void 0 ? void 0 : secondsOf(request.expiresAt);
+	if (entries === void 0 || !isId(request.id) || request.expiresAt !== void 0 && (expires === void 0 || expires <= now)) return refuse("validation");
+	const feed = request.kind === "feed" ? feedTarget(permdock, request, entries) : void 0;
+	if (feed !== void 0 && !feed.ok) return feed;
 	const subject = permdock.subject;
 	for (const entry of entries) for (const id of entry.ids ?? [void 0]) if (coveredByDelegation(entry.leaf, subject.delegation, id, subject.actor !== void 0) !== void 0) return refuse("exceeds-creator", { permission: entry.leaf.key });
 	const credential = parseCredential(compact({
 		v: 1,
 		id: request.id,
 		kind: request.kind,
-		principal: request.kind === "service" ? request.principal ?? request.id : creator.id,
-		tenant: request.tenant,
-		roles: request.kind === "service" ? request.roles : void 0,
+		principal: request.kind === "service" ? request.principal ?? request.id : request.kind === "feed" ? request.id : creator.id,
+		tenant: "tenant" in request ? request.tenant : void 0,
+		roles: request.kind === "service" || request.kind === "feed" ? request.roles : void 0,
+		on: feedOn(request, feed),
 		permissions: entries.map((entry) => compact({
 			permission: entry.leaf.key,
-			ids: entry.ids
+			ids: request.kind === "feed" ? [request.on.id] : entry.ids
 		})),
 		createdBy: creator.id,
-		createdAt: now,
-		expiresAt: request.expiresAt === void 0 ? void 0 : Math.floor(request.expiresAt),
+		createdAt: rfc3339(now),
+		expiresAt: request.expiresAt,
 		name: request.name
 	}));
 	if (credential === void 0) return refuse("validation");
@@ -275,8 +373,31 @@ function credentialTenant(credential, active) {
 * its token. PermDock never stores the credential; the application does,
 * after a `granted` result.
 */
-async function decideCredential(permdock, request, options = {}) {
-	const checked = checkRequest(permdock, request, options.now ?? Math.floor(Date.now() / 1e3));
+/**
+* Decides whether the subject of `permdock` may create the credential in
+* `request`: the creator's own reach, the `credentials` policy of the key's
+* tenant (the call's `settings`, else the instance's), and `approval`.
+* PermDock never stores the credential; the application does, after a
+* `granted` result. An instance built from a snapshot denies with
+* `unsupported`.
+*/
+function decideCredential(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideCredentialWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideCredentialWith(permdock, request, options) {
+	const checked = checkRequest(permdock, request, nowSeconds(options.now));
 	if (!checked.ok) return checked.decision;
 	const { credential } = checked;
 	const tenant = credentialTenant(credential, permdock.subject.principal?.tenant);
@@ -303,4 +424,4 @@ async function decideCredential(permdock, request, options = {}) {
 	});
 }
 //#endregion
-export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, parseCredential as o, credentialSubject as r, credentialDelegation as t };
+export { decideCredential as a, credentialTenant as i, credentialPolicyViolation as n, isFeedId as o, credentialSubject as r, parseCredential as s, credentialDelegation as t };

package/dist/credentials-DPyHmYz5.js

@@ -0,0 +1,74 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+//#region src/cli/core/io.ts
+const FRAMES = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const FRAME_MS = 80;
+/**
+* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI
+* output stay readable. `done` replaces the spinner with a final line.
+*/
+function progressReporter(input) {
+	return (message) => {
+		if (!input.tty) {
+			input.write(`${message}\n`);
+			return { done: (final) => {
+				if (final !== void 0) input.write(`${final}\n`);
+			} };
+		}
+		let frame = 0;
+		const draw = () => {
+			input.write(`\r${input.style.paint("cyan", FRAMES[frame % FRAMES.length] ?? "")} ${message}`);
+			frame += 1;
+		};
+		draw();
+		const timer = setInterval(draw, FRAME_MS);
+		timer.unref();
+		return { done: (final) => {
+			clearInterval(timer);
+			input.write(`\r\u001B[2K${final === void 0 ? "" : `${input.style.okMark} ${final}\n`}`);
+		} };
+	};
+}
+/** The value of a `--*-stdin` secret: stdin up to the first newline, trimmed. */
+async function readSecret(readStdin) {
+	if (readStdin === void 0) return;
+	const text = (await readStdin()).split(/\r?\n/u, 1)[0]?.trim() ?? "";
+	return text === "" ? void 0 : text;
+}
+//#endregion
+//#region src/cli/core/credentials.ts
+const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]+)@/giu;
+/** `text` with every registered secret and every URL password masked. */
+function redact(text, secrets) {
+	let out = text.replace(URL_PASSWORD, "$1***@");
+	for (const secret of secrets) if (secret.length >= 4) out = out.replaceAll(secret, "***");
+	return out;
+}
+/**
+* The secret piped in for `--<flag>-stdin`, when it was passed, registered
+* for redaction.
+*/
+async function secretInput(ctx, input) {
+	let value;
+	if (input.stdin) {
+		value = await readSecret(ctx.io.readStdin);
+		if (value === void 0) throw new CliError("usage", `${ctx.command}: --${input.flag}-stdin read nothing from stdin`, {
+			code: "missing_value",
+			extensions: { flag: `--${input.flag}-stdin` }
+		});
+	}
+	if (value !== void 0) ctx.addSecret(value);
+	return value;
+}
+//#endregion
+export { secretInput as n, progressReporter as r, redact as t };