permdock 0.4.0 → 0.6.0

package/dist/{server-types-DdqBwZN_.d.ts → server-types-CKQiCnON.d.ts}

@@ -1,12 +1,14 @@
-import { E as Policy, Er as JsonWebKeyLike, Ft as SnapshotOptions, an as Snapshot, ir as Decision, j as PolicyVocabulary, jt as PermDock, kr as Subject, vr as Actor } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { f as ApprovalStore } from "./types-Br9IXUBG.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-OD_4c__H.js";
-import { t as InstanceOptions } from "./instance-options-plkrsAog.js";
+import { Nn as Decision, Rt as Instant, Vt as Snapshot, ar as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock, s as SnapshotOptions } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Cr93qqdP.js";
-import { r as PdpFactory } from "./types-CIlTojhq.js";
-import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
+import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
+import { r as PdpFactory } from "./types-_WhUP7ud.js";
+import { i as evaluationsHandler } from "./evaluations-C_1vdSZc.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
@@ -14,7 +16,7 @@ type ConnectionOptions<T = unknown> = {
   readonly permission?: Permission;
   /** The row for `permission`, or a loader re-run on every revalidation. */
   readonly data?: ConnectionData<T>;
-  /** Milliseconds between periodic revalidations; off by default. */
+  /** Seconds between periodic revalidations; off by default. */
   readonly revalidate?: number;
 };
 type Connection = {
@@ -51,22 +53,6 @@ type TenantOption<TContext> = string | ((context: TContext) => string | undefine
 /** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
 declare function tenantScope<TContext>(option: TenantOption<TContext> | undefined, context: TContext): Promise<TenantScope>;
 //#endregion
-//#region src/server/evaluations.d.ts
-declare function createEvaluationsHandler(options: {
-  readonly policy: Policy;
-  readonly resolve?: (request: Request) => Promise<PermDock>;
-  readonly getPermDock?: (query?: {
-    readonly tenant?: string;
-  }) => Promise<PermDock>;
-  readonly store?: ApprovalStore;
-  readonly adapter?: string;
-  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
-  readonly maxEvaluations?: number;
-}): {
-  readonly POST: (request: Request) => Promise<Response>;
-  readonly GET: (request: Request) => Promise<Response>;
-};
-//#endregion
 //#region src/server/web-bot-auth.d.ts
 type WebBotAuthJwk = JsonWebKeyLike & {
   readonly kid?: string;
@@ -85,14 +71,18 @@ type WebBotAuthOptions = {
   readonly keys: WebBotAuthKeys | WebBotAuthKeyLookup;
   readonly required?: boolean;
   readonly maxAge?: number;
-  /** Unix seconds; defaults to the system clock. */
-  readonly now?: () => number;
+  /** The clock; defaults to the system clock. */
+  readonly now?: () => Instant;
 };
 /**
- * An adapter's `webBotAuth` option: `(request) => verifyWebBotAuth(request, options)`,
+ * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`,
  * so an app without it does not bundle RFC 9421 verification.
  */
-type WebBotAuthVerifier = (request: Request) => Promise<Actor | undefined>;
+type WebBotAuthVerifier = {
+  readonly name?: string;
+  /** The verified signer as an actor, `undefined` for an unsigned request; throws `InvalidSignatureError` for a bad signature. */
+  verify(request: Request): Promise<Actor | undefined>;
+};
 type DiscoverViaSignatureAgentOptions = {
   readonly allow: readonly string[];
   readonly fetch?: typeof fetch;
@@ -105,21 +95,26 @@ declare class InvalidSignatureError extends Error {
 declare function invalidSignatureResponse(error: unknown): Response | undefined;
 declare function invalidSignatureProblem(detail: string): Response;
 declare function discoverViaSignatureAgent(options: DiscoverViaSignatureAgentOptions): WebBotAuthKeys;
-declare function verifyWebBotAuth(request: Request, options: WebBotAuthOptions | undefined): Promise<Actor | undefined>;
+/**
+ * Verifies Web Bot Auth requests: an RFC 9421 signature tagged `web-bot-auth`
+ * that covers `@authority`, and `signature-agent` when the request sends
+ * `Signature-Agent` (draft-meunier-webbotauth-httpsig-protocol).
+ */
+declare function webBotAuthVerifier(options?: WebBotAuthOptions): WebBotAuthVerifier;
 //#endregion
 //#region src/server/server-types.d.ts
 type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
   readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly actor?: (request: Request) => unknown;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
   readonly webBotAuth?: WebBotAuthVerifier;
   readonly tenant?: string | ((request: Request) => string | undefined | Promise<string | undefined>);
   readonly store?: ApprovalStore;
   /** Ends or revalidates open connections; never a decision input. */
   readonly revocations?: RevocationFeed;
   /**
-   * `createPermDock` from `permdock/pdp`: `protect` then decides delegated
+   * `getPermDock` from `permdock/pdp`: `protect` then decides delegated
    * permissions through the remote PDP. The instance handlers receive stays
    * synchronous and keeps denying delegated permissions (`pdp-unavailable`).
    */
@@ -131,7 +126,7 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
    * Replaces the response of a refused guard. A status below 300, or a
    * throw, keeps the default response and reports through `on('error')`.
    */
-  readonly onDenied?: OnDenied;
+  readonly deniedResponse?: DeniedResponse;
   /**
    * Request values merged into `subject.context`, under `policy.context`.
    * Only values the server derived belong here, never client input. A throw
@@ -139,11 +134,13 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
    * `on('error')`.
    */
   readonly context?: (request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
-  /** Wraps each instance the kernel builds; build it with `wrapPermDock` to cover derived instances. */
+  /** Wraps each instance the factory builds; build it with `wrapPermDock` to cover derived instances. */
   readonly wrap?: PermDockWrap;
+  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
+  readonly adapter?: string;
 };
-/** What `onDenied` receives: the refusal and the default Problem Details for it. */
-type OnDeniedEvent = {
+/** What `deniedResponse` receives: the refusal and the default Problem Details for it. */
+type DeniedResponseEvent = {
   readonly decision: Exclude<Decision, {
     readonly outcome: "granted";
   }>;
@@ -151,7 +148,7 @@ type OnDeniedEvent = {
   readonly request: Request | undefined;
 };
 /** Returns Problem Details with extra members, a `Response`, or nothing for the default. */
-type OnDenied = (event: OnDeniedEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
+type DeniedResponse = (event: DeniedResponseEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
 type OperationScopes = {
   oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
 };
@@ -189,14 +186,14 @@ type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
 /**
- * `protect(permission, loadData?, options?)`, or `protect(null, loadData?,
+ * `protect(permission, data?, options?)`, or `protect(null, data?,
  * { oauthScopes })` for a route that needs a signed-in principal and, from a
  * delegated token, one of the OAuth scopes it declares, but no permission.
  */
 type Protect<V extends PolicyVocabulary = PolicyVocabulary, TArgs extends unknown[] = []> = {
-  <T = unknown>(permission: Permission, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V>>;
-  <T = unknown>(permission: null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<ScopeGuard<T, V>>;
-  <T = unknown>(permission: Permission | null, loadData?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  <T = unknown>(permission: Permission, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V>>;
+  <T = unknown>(permission: null, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<ScopeGuard<T, V>>;
+  <T = unknown>(permission: Permission | null, data?: Loader<T>, protectOptions?: ProtectOptions): (request: Request, ...args: TArgs) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
 };
 type OpenApiHooks = {
   readonly security: (permission: Permission) => {
@@ -207,7 +204,7 @@ type OpenApiHooks = {
 };
 type ProtectOptions = {
   /**
-   * `true` when `loadData` returns a row the server loaded itself, to skip
+   * `true` when `data` returns a row the server loaded itself, to skip
    * schema validation. Anything else is validated against the resource
    * schema before the check.
    */
@@ -223,25 +220,19 @@ type ProtectOptions = {
   /** Adds the evaluation `trace` to the guard's decision. */
   readonly explain?: boolean;
 };
-type ServerKernelOptions<TUser, V extends PolicyVocabulary = PolicyVocabulary> = Omit<ServerPermDockOptions<TUser>, "wrap"> & {
-  /** Wraps each instance the kernel builds: `otel`, then the adapter's `wrap`. */
-  readonly wrap?: (permdock: PermDock<V>) => PermDock<V>;
-  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
-  readonly adapter?: string;
-};
-/**
- * What an HTTP adapter builds on: `ServerPermDock` plus an explicit
- * `TenantScope` on every call, so the adapter resolves the tenant from its
- * own framework context.
- */
 type SnapshotQuery = {
   /** The active tenant; defaults to the `tenant` option resolved from the request. */
   readonly tenant?: string;
   readonly include?: SnapshotOptions["include"];
   readonly tenants?: "all";
 };
-type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
+/**
+ * What `createPermDock` from `permdock/server` returns. Every member takes an
+ * optional `TenantScope`, so an adapter resolves the tenant from its own
+ * framework context.
+ */
+type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly getPermDock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
   /**
    * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit, Nuxt), built from the
    * request's cached subject. Send it with `snapshotHeaders(snapshot)`.
@@ -251,8 +242,10 @@ type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
   /**
    * `protect` against an instance the adapter already holds, such as a gateway
    * connection's: the same OAuth scope check, loader, decision and approval resume.
+   * A method, so a `ServerPermDock<V>` stays assignable to `ServerPermDock`.
    */
-  readonly protectOn: <T = unknown>(instance: PermDock<V>, permission: Permission | null, load?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request) => Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  protectOn<T = unknown>(instance: PermDock<V>, permission: Permission | null, data?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request): Promise<Guard<T, V> | ScopeGuard<T, V>>;
+  /** A long-lived connection for a stream or socket opened by `request`. */
   readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>, scope?: TenantScope) => Promise<Connection>;
   /**
    * Lets `to`, a second `Request` an adapter built for the same incoming
@@ -260,22 +253,12 @@ type ServerKernel<V extends PolicyVocabulary = PolicyVocabulary> = {
    * actor already resolved for `from`.
    */
   readonly shareSubject: (from: Request, to: Request) => void;
-  readonly problem: ServerPermDock<V>["problem"];
-  readonly openapi: OpenApiHooks;
-  readonly permdockHandler: (scope?: (request: Request) => TenantScope | Promise<TenantScope>) => ReturnType<typeof createEvaluationsHandler>;
-};
-type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (request: Request) => Promise<PermDock<V>>;
-  readonly getSnapshot: ServerKernel<V>["getSnapshot"];
-  readonly protect: Protect<V>;
-  /** A long-lived connection for a stream or socket opened by `request`. */
-  readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>) => Promise<Connection>;
   readonly problem: (decision: Decision, init?: {
     readonly permission?: Permission;
     readonly instance?: string;
   }) => Response;
   readonly openapi: OpenApiHooks;
-  readonly permdockHandler: () => ReturnType<typeof createEvaluationsHandler>;
+  readonly permdockHandler: (scope?: (request: Request) => TenantScope | Promise<TenantScope>) => ReturnType<typeof evaluationsHandler>;
 };
 //#endregion
-export { ConnectionOptions as A, verifyWebBotAuth as C, tenantScope as D, TenantScope as E, Connection as O, invalidSignatureResponse as S, TenantOption as T, WebBotAuthKeys as _, OperationScopes as a, discoverViaSignatureAgent as b, ServerKernel as c, ServerPermDockOptions as d, SnapshotQuery as f, WebBotAuthKeyLookup as g, WebBotAuthJwk as h, OpenApiHooks as i, ConnectionData as k, ServerKernelOptions as l, InvalidSignatureError as m, OnDenied as n, ProtectOptions as o, DiscoverViaSignatureAgentOptions as p, OnDeniedEvent as r, ScopeGuard as s, Guard as t, ServerPermDock as u, WebBotAuthOptions as v, createEvaluationsHandler as w, invalidSignatureProblem as x, WebBotAuthVerifier as y };
+export { TenantScope as C, ConnectionOptions as D, ConnectionData as E, TenantOption as S, Connection as T, WebBotAuthVerifier as _, OperationScopes as a, invalidSignatureResponse as b, ServerPermDock as c, DiscoverViaSignatureAgentOptions as d, InvalidSignatureError as f, WebBotAuthOptions as g, WebBotAuthKeys as h, OpenApiHooks as i, ServerPermDockOptions as l, WebBotAuthKeyLookup as m, DeniedResponseEvent as n, ProtectOptions as o, WebBotAuthJwk as p, Guard as r, ScopeGuard as s, DeniedResponse as t, SnapshotQuery as u, discoverViaSignatureAgent as v, tenantScope as w, webBotAuthVerifier as x, invalidSignatureProblem as y };

package/dist/{sha256-BO0swRXL.js → sha256-D9ihqmvd.js}

@@ -141,10 +141,17 @@ function sha256(message) {
 	outView.setInt32(28, h7, false);
 	return out;
 }
+/**
+* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
+* of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+*/
+function sha256Digest(text) {
+	return `sha-256:${bytesToBase64Url(sha256(text))}`;
+}
 function bytesToBase64Url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCodePoint(byte);
 	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }
 //#endregion
-export { sha256 as n, bytesToBase64Url as t };
+export { sha256 as n, sha256Digest as r, bytesToBase64Url as t };

package/dist/{shared-1uhI-e-b.js → shared-BAK8t4Uo.js}

@@ -1,8 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { a as quoteSqlIdent, i as quoteQualifiedTable, o as quoteSqlLiteral, s as quoteSqlTable, t as SQL_IDENT } from "./sql-t8teWOfo.js";
-import "./sources-B1-b-R0t.js";
+import { i as configError } from "./errors-CWTY6uih.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
+import "./sources-vs5dGOsS.js";
 //#region src/cli/sql/quote.ts
 function quoteIdent(name) {
 	return quoteSqlIdent(name, CLI);
@@ -27,6 +28,15 @@ const CLI = "PermDock CLI";
 function declaredArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
 }
+/**
+* A text array as a Postgres literal (`'{admin,owner}'`). An element that
+* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
+* reads as `NULL`, is double-quoted and escaped, so one element can never
+* split into several.
+*/
+function textArrayLiteral(values) {
+	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
+}
 //#endregion
 //#region src/cli/sql/columns.ts
 /** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
@@ -85,7 +95,7 @@ function arrayColumnsOf(schema) {
 }
 const SQL_TYPE = /^[A-Za-z_][A-Za-z0-9_]*( [A-Za-z_][A-Za-z0-9_]*)*(\[\])?$/u;
 function sqlType(name) {
-	if (!SQL_TYPE.test(name)) throw new Error(`PermDock CLI: unsafe SQL type '${name}'`);
+	if (!SQL_TYPE.test(name)) throw configError(`PermDock CLI: unsafe SQL type '${name}'`);
 	return name;
 }
 function tenantTypeOf(ctx) {
@@ -162,7 +172,7 @@ function userIdHelperSql(ctx) {
 const SESSION_LIVE_HELPER = "permdock_session_live";
 /** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
 function liveSessionSql(ctx) {
-	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
+	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
 	return `(select ${qualified(ctx, SESSION_LIVE_HELPER)}())`;
 }
 /**
@@ -214,7 +224,7 @@ function subjectIdSql(ctx) {
 	}
 }
 function subjectClaimSql(ctx, claim) {
-	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	if (!CLAIM.test(claim)) throw configError(`PermDock CLI: unsafe claim name '${claim}'`);
 	switch (ctx.dialect) {
 		case "supabase": return `((select auth.jwt()) ->> ${quoteLiteral(claim)})`;
 		case "neon": return `((select auth.session()) ->> ${quoteLiteral(claim)})`;
@@ -224,7 +234,7 @@ function subjectClaimSql(ctx, claim) {
 }
 /** A claim as `jsonb`; the `guc` dialect stores JSON text in `<prefix>.<claim>`. */
 function subjectClaimJsonSql(ctx, claim) {
-	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	if (!CLAIM.test(claim)) throw configError(`PermDock CLI: unsafe claim name '${claim}'`);
 	switch (ctx.dialect) {
 		case "supabase": return `((select auth.jwt()) -> ${quoteLiteral(claim)})`;
 		case "neon": return `((select auth.session()) -> ${quoteLiteral(claim)})`;
@@ -275,7 +285,8 @@ const CUSTOM_ROLES = {
 	trustedReplace: "permdock_trusted_replace_custom_role_grants",
 	trustedRename: "permdock_trusted_rename_custom_role_grants",
 	trustedRemove: "permdock_trusted_delete_custom_role_grants",
-	cascade: "permdock_cascade_custom_role"
+	cascade: "permdock_cascade_custom_role",
+	shared: "permdock_is_shared_role"
 };
 /** The function `rls.roles` adds. The name is part of the SQL contract. */
 const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
@@ -291,4 +302,4 @@ function allowEntry(ctx) {
 	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
 }
 //#endregion
-export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };
+export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, textArrayLiteral as L, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{shared-JhMeOsDF.js → shared-DvvFzYXe.js}

@@ -1,13 +1,12 @@
-import { t as decisionToken } from "./token-Bx9qy30p.js";
+import { a as durationOf, f as nowMillis } from "./time-DkWjdL98.js";
+import { t as decisionToken } from "./token-BLZcjQgt.js";
 //#region src/pdp/shared.ts
-const MAX_CACHE_TTL_MS = 3e4;
+const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
-/** Milliseconds, clamped to `[0, 30s]`; anything unparseable disables the cache. */
+/** Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole number of seconds above 0 disables the cache. */
 function ttlMs(cache) {
-	if (cache === void 0) return 0;
-	const raw = typeof cache.ttl === "number" ? cache.ttl : cache.ttl.endsWith("ms") ? Number(cache.ttl.slice(0, -2)) : Number(cache.ttl.slice(0, -1)) * 1e3;
-	if (!Number.isFinite(raw) || raw <= 0) return 0;
-	return Math.min(raw, MAX_CACHE_TTL_MS);
+	const ttl = durationOf(cache?.ttl);
+	return ttl === void 0 ? 0 : Math.min(ttl, MAX_CACHE_TTL) * 1e3;
 }
 function denied(reason) {
 	return {
@@ -68,13 +67,13 @@ function ttlCache(ttl) {
 		get(key) {
 			if (ttl <= 0) return;
 			const hit = entries.get(key);
-			if (hit !== void 0 && Date.now() - hit.at < ttl) return hit.value;
+			if (hit !== void 0 && nowMillis() - hit.at < ttl) return hit.value;
 			entries.delete(key);
 		},
 		set(key, value) {
 			if (ttl <= 0) return;
 			entries.set(key, {
-				at: Date.now(),
+				at: nowMillis(),
 				value
 			});
 			if (entries.size > CACHE_MAX) {

package/dist/signals-D3NcTKUS.js

@@ -0,0 +1,32 @@
+//#region src/cli/core/signals.ts
+const EXIT_CODES = {
+	SIGINT: 130,
+	SIGTERM: 143
+};
+/** How long a signalled run may take to clean up before the process exits. */
+const GRACE_MS = 2e3;
+/**
+* Turns SIGINT and SIGTERM into an aborted signal and the 128 + n exit code.
+* A second signal, or a run still busy after the grace period, exits at once.
+*/
+function trapSignals() {
+	const controller = new AbortController();
+	const handlers = Object.entries(EXIT_CODES).map(([name, code]) => {
+		const handler = () => {
+			if (controller.signal.aborted) process.exit(code);
+			process.exitCode = code;
+			controller.abort(/* @__PURE__ */ new Error(`Received ${name}`));
+			setTimeout(() => process.exit(code), GRACE_MS).unref();
+		};
+		process.on(name, handler);
+		return [name, handler];
+	});
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			for (const [name, handler] of handlers) process.off(name, handler);
+		}
+	};
+}
+//#endregion
+export { trapSignals };

package/dist/sink-4-eQIRWf.d.ts

@@ -0,0 +1,225 @@
+import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { V as AppData } from "./vocabulary-CN8H_9UF.js";
+import { u as OperationRisk } from "./operations-X0VM7F3m.js";
+import { t as Automation } from "./automation-BNM3TtDo.js";
+//#region src/core/sink.d.ts
+/**
+ * The closed list of CloudEvents `type` values, `com.permdock.<family>` or
+ * `com.permdock.<family>.<operation>`. `RESERVED_CLOUD_EVENT_TYPES` are named
+ * for later releases and nothing emits them yet.
+ */
+declare const CLOUD_EVENT_TYPES: {
+  readonly decision: "com.permdock.decision";
+  readonly approvalRequested: "com.permdock.approval.requested";
+  readonly approvalResolved: "com.permdock.approval.resolved";
+  readonly approvalExpired: "com.permdock.approval.expired";
+  readonly approvalCancelled: "com.permdock.approval.cancelled";
+  readonly membershipAdded: "com.permdock.membership.added";
+  readonly membershipRemoved: "com.permdock.membership.removed";
+  readonly membershipChanged: "com.permdock.membership.changed";
+  readonly credentialCreated: "com.permdock.credential.created";
+  readonly credentialUsed: "com.permdock.credential.used";
+  readonly credentialRotated: "com.permdock.credential.rotated";
+  readonly credentialRevoked: "com.permdock.credential.revoked";
+  readonly directoryCreated: "com.permdock.directory.created";
+  readonly directoryReplaced: "com.permdock.directory.replaced";
+  readonly directoryPatched: "com.permdock.directory.patched";
+  readonly directoryDeleted: "com.permdock.directory.deleted";
+  readonly catalogPublished: "com.permdock.catalog.published";
+  readonly catalogDrifted: "com.permdock.catalog.drifted";
+  readonly supportSessionStarted: "com.permdock.support-session.started";
+  readonly supportSessionEnded: "com.permdock.support-session.ended";
+  readonly automationPublished: "com.permdock.automation.published";
+  readonly automationChanged: "com.permdock.automation.changed";
+  readonly automationRevoked: "com.permdock.automation.revoked";
+  readonly automationRun: "com.permdock.automation.run";
+  readonly deliverySent: "com.permdock.delivery.sent";
+  readonly deliveryDelivered: "com.permdock.delivery.delivered";
+  readonly deliveryBounced: "com.permdock.delivery.bounced";
+  readonly deliveryComplained: "com.permdock.delivery.complained";
+  readonly deliveryFailed: "com.permdock.delivery.failed";
+};
+type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
+/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+declare const RESERVED_CLOUD_EVENT_TYPES: readonly CloudEventType[];
+/** The CloudEvents JSON format media type for one event (structured mode). */
+declare const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
+/** The CloudEvents JSON batch format media type: a JSON array of events. */
+declare const CLOUDEVENTS_BATCH_CONTENT_TYPE = "application/cloudevents-batch+json";
+/**
+ * Why a published catalog drifted. The first four broke a live hosted grant,
+ * which the Cloud then suspends; the `operation-*` codes only report.
+ */
+type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened" | "operation-risk-raised" | "operation-approval-removed";
+/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+type CatalogFinding = {
+  readonly code: CatalogFindingCode;
+  readonly permission: string;
+  readonly grant?: string;
+  /** The operation name, on the `operation-*` codes. */
+  readonly operation?: string;
+  /** `meta.risk` before the publish, on `operation-risk-raised`; an unset risk is `low`. */
+  readonly previous?: OperationRisk;
+  /** `meta.risk` after the publish, on `operation-risk-raised`. */
+  readonly risk?: OperationRisk;
+};
+/** `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a drift against live hosted grants. */
+type CatalogEventData = {
+  readonly kind: "publish" | "drift";
+  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  readonly fingerprint: string;
+  readonly previous?: string;
+  readonly findings?: readonly CatalogFinding[];
+};
+/** A CloudEvents 1.0 event in the JSON format, with the distributed-tracing extension. */
+type CloudEvent = {
+  readonly specversion: "1.0";
+  readonly type: CloudEventType;
+  /** An absolute URI naming the producer. */
+  readonly source: string;
+  readonly subject?: string;
+  readonly id: string;
+  /** An RFC 3339 instant: the sink event's `at`. */
+  readonly time: string;
+  readonly datacontenttype: "application/json";
+  /** The published JSON Schema of `data`, `https://permdock.com/schemas/<family>-event-v1.json`. */
+  readonly dataschema: string;
+  /** W3C Trace Context `traceparent`, the CloudEvents distributed-tracing extension. */
+  readonly traceparent?: string;
+  readonly tracestate?: string;
+  readonly data: SinkEvent | CatalogEventData;
+};
+type CloudEventOptions = {
+  /** An absolute URI naming the producer, such as the app's origin. */
+  readonly source: string;
+  /** Defaults to a random UUID. */
+  readonly id?: string;
+  readonly traceparent?: string;
+  readonly tracestate?: string;
+};
+type SignDecisionBatchOptions = {
+  readonly audience?: string | readonly string[];
+  /** An absolute URI naming the producer, the `source` of every CloudEvent. */
+  readonly source: string;
+};
+type MemoryDecisionSinkOptions = {
+  readonly capacity?: number;
+} & ({
+  readonly signer?: undefined;
+  readonly audience?: undefined;
+  readonly source?: undefined;
+} | {
+  /** Signs each write as an evidence export of CloudEvents. */
+  readonly signer: TokenSigner;
+  readonly audience?: string | readonly string[];
+  /** An absolute URI naming the producer, the `source` of every CloudEvent. */
+  readonly source: string;
+});
+type MemoryDecisionSink = DecisionSink & {
+  readonly events: () => readonly SinkEvent[];
+  readonly batches: () => readonly string[];
+};
+/**
+ * The CloudEvents `type` of a sink event. A support access event maps onto the
+ * `support-session` family, and a consent the tenant pulls early (`revoked`)
+ * ends the session like a lapse; `data.operation` keeps the difference.
+ */
+declare function cloudEventType(event: SinkEvent): CloudEventType;
+/**
+ * An `automation` sink event for `automation`. `run` carries the run id and
+ * belongs on `run` events only.
+ */
+declare function automationEvent(input: {
+  readonly operation: AutomationEvent["operation"];
+  readonly automation: Automation;
+  readonly run?: string;
+  readonly source?: string;
+  readonly by?: AutomationEvent["by"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AutomationEvent;
+/**
+ * The `access` event of a `SupportSession`: `started` when it begins,
+ * `ended` when it lapses, `revoked` when it is ended early. `principal` is
+ * the staff member, as for a support membership.
+ */
+declare function supportSessionEvent(input: {
+  readonly operation: AccessEvent["operation"];
+  readonly session: SupportSession;
+  readonly source?: string;
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AccessEvent;
+/**
+ * A `credential` sink event for `credential`. `sample` belongs on `used`
+ * events only and must be in `(0, 1]`.
+ */
+declare function credentialEvent(input: {
+  readonly operation: CredentialEvent["operation"];
+  readonly credential: Credential;
+  readonly source?: string;
+  readonly by?: CredentialEvent["by"];
+  readonly sample?: number;
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): CredentialEvent;
+declare function membershipEvent(input: {
+  readonly source: string;
+  readonly operation: MembershipEvent["operation"];
+  readonly principal: MembershipEvent["principal"];
+  readonly scope?: string;
+  readonly id?: string;
+  readonly within?: MembershipEvent["within"];
+  readonly via?: string;
+  /** An RFC 3339 instant, or NumericDate seconds as a `Membership` holds them. */
+  readonly expiresAt?: string | number;
+  readonly roles: MembershipEvent["roles"];
+  readonly by?: MembershipEvent["by"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): MembershipEvent;
+/**
+ * A support-access lifecycle event. `started` on consent, `ended` when the
+ * session lapses, `revoked` when the tenant pulls consent early. It never
+ * decides; the app writes and revokes the membership.
+ */
+declare function accessEvent(input: {
+  readonly source: string;
+  readonly operation: AccessEvent["operation"];
+  readonly tenant: string;
+  readonly principal: AccessEvent["principal"];
+  readonly via?: string;
+  readonly roles: readonly string[];
+  readonly member?: AccessEvent["member"];
+  /** An RFC 3339 instant, or NumericDate seconds as a `Membership` holds them. */
+  readonly expiresAt?: string | number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly actor?: AccessEvent["actor"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AccessEvent;
+/**
+ * Wraps a sink event in a CloudEvents 1.0 envelope. Throws a `TypeError` when
+ * `source` is not an absolute URI or `traceparent` is not W3C Trace Context.
+ */
+declare function toCloudEvent(event: SinkEvent, options: CloudEventOptions): CloudEvent;
+/**
+ * Signs sink events as an offline evidence export: a compact JWS with
+ * `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
+ * Live deliveries use Standard Webhooks instead.
+ */
+declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options: SignDecisionBatchOptions): Promise<string>;
+declare function memoryDecisionSink(options?: MemoryDecisionSinkOptions): MemoryDecisionSink;
+//#endregion
+export { toCloudEvent as S, credentialEvent as _, CatalogFinding as a, signDecisionBatch as b, CloudEventOptions as c, MemoryDecisionSinkOptions as d, RESERVED_CLOUD_EVENT_TYPES as f, cloudEventType as g, automationEvent as h, CatalogEventData as i, CloudEventType as l, accessEvent as m, CLOUDEVENTS_CONTENT_TYPE as n, CatalogFindingCode as o, SignDecisionBatchOptions as p, CLOUD_EVENT_TYPES as r, CloudEvent as s, CLOUDEVENTS_BATCH_CONTENT_TYPE as t, MemoryDecisionSink as u, membershipEvent as v, supportSessionEvent as x, memoryDecisionSink as y };