permdock 0.4.0 → 0.6.0

package/dist/sink-BEZSlMS_.js

@@ -0,0 +1,957 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { d as isoNow, n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
+import { n as requireEventInstant } from "./event-time-CsegxXxB.js";
+//#region src/core/event-schemas.ts
+const SCHEMA = "https://json-schema.org/draft/2020-12/schema";
+/** The URL each event family's schema is published at, and its CloudEvents `dataschema`. */
+const EVENT_SCHEMA_IDS = Object.freeze({
+	decision: "https://permdock.com/schemas/decision-event-v1.json",
+	directory: "https://permdock.com/schemas/directory-event-v1.json",
+	membership: "https://permdock.com/schemas/membership-event-v1.json",
+	credential: "https://permdock.com/schemas/credential-event-v1.json",
+	access: "https://permdock.com/schemas/access-event-v1.json",
+	automation: "https://permdock.com/schemas/automation-event-v1.json",
+	catalog: "https://permdock.com/schemas/catalog-event-v1.json",
+	delivery: "https://permdock.com/schemas/delivery-event-v1.json"
+});
+/** `format` is an annotation, so `pattern` enforces it. */
+const instant = {
+	type: "string",
+	format: "date-time",
+	pattern: RFC3339_PATTERN
+};
+const text = { type: "string" };
+const id = {
+	type: "string",
+	minLength: 1
+};
+const strings = {
+	type: "array",
+	items: text
+};
+const ref = {
+	type: "object",
+	required: ["id"],
+	properties: { id },
+	additionalProperties: false
+};
+const actor = {
+	type: "object",
+	required: ["id", "kind"],
+	properties: {
+		id,
+		kind: text
+	},
+	additionalProperties: false
+};
+const risk = { enum: [
+	"low",
+	"medium",
+	"high",
+	"critical"
+] };
+const credentialKind = { enum: [
+	"user",
+	"service",
+	"feed"
+] };
+const appData = {
+	type: "object",
+	description: "The application's own data, set where the event is built: plain JSON, never read by a decision."
+};
+const within = {
+	type: "object",
+	additionalProperties: text
+};
+function family(key, title, description, node) {
+	return freezeDeep({
+		$schema: SCHEMA,
+		$id: EVENT_SCHEMA_IDS[key],
+		title,
+		description,
+		...node
+	});
+}
+const DECISION_EVENT_SCHEMA = family("decision", "PermDock decision event", "A DecisionEvent, wire format v1: the data of com.permdock.decision and com.permdock.approval.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"outcome",
+		"permission",
+		"scope",
+		"resource",
+		"subject",
+		"trusted",
+		"call"
+	],
+	properties: {
+		x: appData,
+		type: { const: "decision" },
+		at: instant,
+		outcome: { enum: [
+			"granted",
+			"denied",
+			"approval-required"
+		] },
+		permission: id,
+		scope: text,
+		resource: {
+			type: "object",
+			required: ["type"],
+			properties: {
+				type: text,
+				id: text
+			},
+			additionalProperties: false
+		},
+		subject: {
+			type: "object",
+			required: ["principal"],
+			properties: {
+				principal: {
+					type: ["object", "null"],
+					required: ["id", "roles"],
+					properties: {
+						id,
+						roles: strings,
+						tenant: text
+					},
+					additionalProperties: false
+				},
+				actor,
+				delegation: {
+					type: "object",
+					properties: {
+						scope: text,
+						authorization_details: {
+							type: "array",
+							items: {
+								type: "object",
+								required: ["type"],
+								properties: { type: text }
+							}
+						},
+						access: { type: "array" }
+					},
+					additionalProperties: false
+				},
+				credential: {
+					type: "object",
+					required: ["id", "kind"],
+					properties: {
+						id,
+						kind: credentialKind
+					},
+					additionalProperties: false
+				},
+				supportSession: {
+					type: "object",
+					required: ["id"],
+					properties: { id },
+					additionalProperties: false
+				}
+			},
+			additionalProperties: false
+		},
+		tenant: text,
+		membership: {
+			type: "object",
+			required: ["roles"],
+			properties: {
+				roles: strings,
+				expiresAt: instant
+			}
+		},
+		via: { type: ["string", "null"] },
+		matched: {
+			type: "object",
+			required: ["role", "permission"],
+			properties: {
+				role: { type: ["string", "null"] },
+				permission: text,
+				name: text,
+				meta: { type: "object" },
+				to: {},
+				hosted: { type: "object" },
+				breakGlass: { const: true }
+			},
+			additionalProperties: false
+		},
+		obligations: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["kind"],
+				properties: { kind: text }
+			}
+		},
+		purpose: strings,
+		reason: text,
+		denials: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["role", "reason"],
+				properties: {
+					role: { type: ["string", "null"] },
+					reason: text,
+					to: {},
+					detail: {}
+				},
+				additionalProperties: false
+			}
+		},
+		alternatives: strings,
+		token: text,
+		trusted: { type: "boolean" },
+		call: { enum: [
+			"can",
+			"decide",
+			"assert",
+			"filter",
+			"endpoint",
+			"adapter",
+			"approval",
+			"simulate",
+			"explain"
+		] },
+		adapter: text,
+		model: id,
+		phase: { enum: [
+			"requested",
+			"resolved",
+			"expired",
+			"cancelled"
+		] },
+		counts: {
+			type: "object",
+			required: [
+				"granted",
+				"denied",
+				"approvalRequired"
+			],
+			properties: {
+				granted: {
+					type: "integer",
+					minimum: 0
+				},
+				denied: {
+					type: "integer",
+					minimum: 0
+				},
+				approvalRequired: {
+					type: "integer",
+					minimum: 0
+				}
+			},
+			additionalProperties: false
+		}
+	},
+	additionalProperties: false
+});
+const DIRECTORY_EVENT_SCHEMA = family("directory", "PermDock directory event", "A DirectoryEvent, wire format v1: the data of com.permdock.directory.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"tenant",
+		"resource",
+		"credential"
+	],
+	properties: {
+		x: appData,
+		type: { const: "directory" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"create",
+			"replace",
+			"patch",
+			"delete"
+		] },
+		tenant: id,
+		resource: {
+			type: "object",
+			required: ["type", "id"],
+			properties: {
+				type: { enum: ["User", "Group"] },
+				id
+			},
+			additionalProperties: false
+		},
+		credential: { oneOf: [{
+			type: "object",
+			required: ["kind"],
+			properties: { kind: { const: "token" } },
+			additionalProperties: false
+		}, {
+			type: "object",
+			required: ["kind"],
+			properties: {
+				kind: { const: "jwt" },
+				iss: text
+			},
+			additionalProperties: false
+		}] },
+		active: { type: "boolean" }
+	},
+	additionalProperties: false
+});
+const MEMBERSHIP_EVENT_SCHEMA = family("membership", "PermDock membership event", "A MembershipEvent, wire format v1: the data of com.permdock.membership.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"principal",
+		"roles"
+	],
+	properties: {
+		x: appData,
+		type: { const: "membership" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"added",
+			"removed",
+			"changed"
+		] },
+		principal: ref,
+		scope: text,
+		id: text,
+		within,
+		via: text,
+		expiresAt: instant,
+		roles: {
+			type: "object",
+			required: ["added", "removed"],
+			properties: {
+				added: strings,
+				removed: strings
+			},
+			additionalProperties: false
+		},
+		by: actor
+	},
+	additionalProperties: false
+});
+const CREDENTIAL_EVENT_SCHEMA = family("credential", "PermDock credential event", "A CredentialEvent, wire format v1: the data of com.permdock.credential.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"credential",
+		"principal"
+	],
+	properties: {
+		x: appData,
+		type: { const: "credential" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"created",
+			"used",
+			"rotated",
+			"revoked"
+		] },
+		credential: {
+			type: "object",
+			required: ["id", "kind"],
+			properties: {
+				id,
+				kind: credentialKind
+			},
+			additionalProperties: false
+		},
+		principal: ref,
+		tenant: text,
+		expiresAt: instant,
+		by: actor,
+		sample: {
+			type: "number",
+			exclusiveMinimum: 0,
+			maximum: 1
+		}
+	},
+	additionalProperties: false
+});
+const ACCESS_EVENT_SCHEMA = family("access", "PermDock support access event", "An AccessEvent, wire format v1: the data of com.permdock.support-session.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"tenant",
+		"principal",
+		"via",
+		"roles"
+	],
+	properties: {
+		x: appData,
+		type: { const: "access" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"started",
+			"ended",
+			"revoked"
+		] },
+		tenant: id,
+		principal: ref,
+		via: text,
+		roles: strings,
+		member: {
+			type: "object",
+			required: ["group"],
+			properties: { group: text },
+			additionalProperties: false
+		},
+		expiresAt: instant,
+		grantedBy: text,
+		reason: text,
+		actor,
+		session: {
+			type: "object",
+			required: ["id", "principal"],
+			properties: {
+				id,
+				principal: id
+			},
+			additionalProperties: false
+		},
+		permissions: strings
+	},
+	additionalProperties: false
+});
+const AUTOMATION_EVENT_SCHEMA = family("automation", "PermDock automation event", "An AutomationEvent, wire format v1: the data of com.permdock.automation.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"automation",
+		"principal",
+		"publishedBy",
+		"permissions"
+	],
+	properties: {
+		x: appData,
+		type: { const: "automation" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"published",
+			"changed",
+			"revoked",
+			"run"
+		] },
+		automation: {
+			type: "object",
+			required: [
+				"id",
+				"version",
+				"mode"
+			],
+			properties: {
+				id,
+				version: { type: ["integer", "string"] },
+				mode: { enum: ["publisher", "service"] },
+				name: text
+			},
+			additionalProperties: false
+		},
+		principal: ref,
+		publishedBy: id,
+		tenant: text,
+		roles: strings,
+		permissions: strings,
+		run: ref,
+		by: actor
+	},
+	additionalProperties: false
+});
+const CATALOG_EVENT_SCHEMA = family("catalog", "PermDock catalog event", "The data of com.permdock.catalog.* CloudEvents, wire format v1: a catalog publish or a drift against live hosted grants.", {
+	type: "object",
+	required: ["kind", "fingerprint"],
+	properties: {
+		kind: { enum: ["publish", "drift"] },
+		fingerprint: id,
+		previous: text,
+		findings: {
+			type: "array",
+			items: { oneOf: [
+				{
+					type: "object",
+					required: ["code", "permission"],
+					properties: {
+						code: { enum: [
+							"permission-removed",
+							"not-hostable",
+							"grantee-removed",
+							"approval-tightened"
+						] },
+						permission: text,
+						grant: text
+					},
+					additionalProperties: false
+				},
+				{
+					type: "object",
+					required: [
+						"code",
+						"permission",
+						"operation",
+						"previous",
+						"risk"
+					],
+					properties: {
+						code: { const: "operation-risk-raised" },
+						permission: text,
+						operation: text,
+						previous: risk,
+						risk
+					},
+					additionalProperties: false
+				},
+				{
+					type: "object",
+					required: [
+						"code",
+						"permission",
+						"operation"
+					],
+					properties: {
+						code: { const: "operation-approval-removed" },
+						permission: text,
+						operation: text
+					},
+					additionalProperties: false
+				}
+			] }
+		}
+	},
+	additionalProperties: false
+});
+const DELIVERY_EVENT_SCHEMA = family("delivery", "PermDock delivery event", "A DeliveryEvent, wire format v1: the data of com.permdock.delivery.* CloudEvents.", {
+	type: "object",
+	required: [
+		"type",
+		"at",
+		"source",
+		"operation",
+		"channel",
+		"delivery"
+	],
+	properties: {
+		x: appData,
+		type: { const: "delivery" },
+		at: instant,
+		source: text,
+		operation: { enum: [
+			"sent",
+			"delivered",
+			"bounced",
+			"complained",
+			"failed"
+		] },
+		channel: { enum: [
+			"email",
+			"chat",
+			"webhook"
+		] },
+		delivery: {
+			type: "object",
+			required: ["id", "key"],
+			properties: {
+				id,
+				key: id
+			},
+			additionalProperties: false
+		},
+		recipient: {
+			type: "object",
+			properties: {
+				principal: ref,
+				trusted: { const: true }
+			},
+			additionalProperties: false
+		},
+		permission: id,
+		tenant: text,
+		category: { enum: [
+			"transactional",
+			"notification",
+			"security",
+			"approval"
+		] },
+		approval: id,
+		provider: {
+			type: "object",
+			required: ["name"],
+			properties: {
+				name: id,
+				id: text
+			},
+			additionalProperties: false
+		},
+		cause: { enum: [
+			"denied",
+			"unlinked",
+			"no-transport",
+			"no-message",
+			"invalid-recipient",
+			"invalid-message",
+			"rate-limited",
+			"quota-exceeded",
+			"unauthorized",
+			"unavailable",
+			"suppressed",
+			"rejected"
+		] },
+		retryable: { type: "boolean" },
+		reason: text
+	},
+	additionalProperties: false
+});
+/** Every sink event family's schema, keyed by the event's `type`. */
+const SINK_EVENT_SCHEMAS = Object.freeze({
+	decision: DECISION_EVENT_SCHEMA,
+	directory: DIRECTORY_EVENT_SCHEMA,
+	membership: MEMBERSHIP_EVENT_SCHEMA,
+	credential: CREDENTIAL_EVENT_SCHEMA,
+	access: ACCESS_EVENT_SCHEMA,
+	automation: AUTOMATION_EVENT_SCHEMA,
+	delivery: DELIVERY_EVENT_SCHEMA
+});
+//#endregion
+//#region src/core/sink.ts
+/**
+* The closed list of CloudEvents `type` values, `com.permdock.<family>` or
+* `com.permdock.<family>.<operation>`. `RESERVED_CLOUD_EVENT_TYPES` are named
+* for later releases and nothing emits them yet.
+*/
+const CLOUD_EVENT_TYPES = Object.freeze({
+	decision: "com.permdock.decision",
+	approvalRequested: "com.permdock.approval.requested",
+	approvalResolved: "com.permdock.approval.resolved",
+	approvalExpired: "com.permdock.approval.expired",
+	approvalCancelled: "com.permdock.approval.cancelled",
+	membershipAdded: "com.permdock.membership.added",
+	membershipRemoved: "com.permdock.membership.removed",
+	membershipChanged: "com.permdock.membership.changed",
+	credentialCreated: "com.permdock.credential.created",
+	credentialUsed: "com.permdock.credential.used",
+	credentialRotated: "com.permdock.credential.rotated",
+	credentialRevoked: "com.permdock.credential.revoked",
+	directoryCreated: "com.permdock.directory.created",
+	directoryReplaced: "com.permdock.directory.replaced",
+	directoryPatched: "com.permdock.directory.patched",
+	directoryDeleted: "com.permdock.directory.deleted",
+	catalogPublished: "com.permdock.catalog.published",
+	catalogDrifted: "com.permdock.catalog.drifted",
+	supportSessionStarted: "com.permdock.support-session.started",
+	supportSessionEnded: "com.permdock.support-session.ended",
+	automationPublished: "com.permdock.automation.published",
+	automationChanged: "com.permdock.automation.changed",
+	automationRevoked: "com.permdock.automation.revoked",
+	automationRun: "com.permdock.automation.run",
+	deliverySent: "com.permdock.delivery.sent",
+	deliveryDelivered: "com.permdock.delivery.delivered",
+	deliveryBounced: "com.permdock.delivery.bounced",
+	deliveryComplained: "com.permdock.delivery.complained",
+	deliveryFailed: "com.permdock.delivery.failed"
+});
+/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+const RESERVED_CLOUD_EVENT_TYPES = Object.freeze([]);
+/** The CloudEvents JSON format media type for one event (structured mode). */
+const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
+/** The CloudEvents JSON batch format media type: a JSON array of events. */
+const CLOUDEVENTS_BATCH_CONTENT_TYPE = "application/cloudevents-batch+json";
+const ABSOLUTE_URI = /^[A-Za-z][A-Za-z\d+.-]*:\S+$/u;
+const TRACEPARENT = /^[\da-f]{2}-[\da-f]{32}-[\da-f]{16}-[\da-f]{2}$/u;
+/** `true` for an RFC 3986 absolute URI: a scheme, a colon and no whitespace. */
+function isAbsoluteUri(value) {
+	return typeof value === "string" && ABSOLUTE_URI.test(value);
+}
+/** `true` for a W3C Trace Context `traceparent` whose ids are not all zero. */
+function isTraceparent(value) {
+	if (typeof value !== "string" || !TRACEPARENT.test(value)) return false;
+	const [version, trace, span] = value.split("-");
+	return version !== "ff" && !/^0+$/u.test(trace ?? "") && !/^0+$/u.test(span ?? "");
+}
+function approvalType(phase) {
+	switch (phase) {
+		case "requested": return CLOUD_EVENT_TYPES.approvalRequested;
+		case "resolved": return CLOUD_EVENT_TYPES.approvalResolved;
+		case "expired": return CLOUD_EVENT_TYPES.approvalExpired;
+		case "cancelled": return CLOUD_EVENT_TYPES.approvalCancelled;
+		default: return phase;
+	}
+}
+function directoryType(operation) {
+	switch (operation) {
+		case "create": return CLOUD_EVENT_TYPES.directoryCreated;
+		case "replace": return CLOUD_EVENT_TYPES.directoryReplaced;
+		case "patch": return CLOUD_EVENT_TYPES.directoryPatched;
+		case "delete": return CLOUD_EVENT_TYPES.directoryDeleted;
+		default: return operation;
+	}
+}
+function membershipType(operation) {
+	switch (operation) {
+		case "added": return CLOUD_EVENT_TYPES.membershipAdded;
+		case "removed": return CLOUD_EVENT_TYPES.membershipRemoved;
+		case "changed": return CLOUD_EVENT_TYPES.membershipChanged;
+		default: return operation;
+	}
+}
+function credentialType(operation) {
+	switch (operation) {
+		case "created": return CLOUD_EVENT_TYPES.credentialCreated;
+		case "used": return CLOUD_EVENT_TYPES.credentialUsed;
+		case "rotated": return CLOUD_EVENT_TYPES.credentialRotated;
+		case "revoked": return CLOUD_EVENT_TYPES.credentialRevoked;
+		default: return operation;
+	}
+}
+function automationType(operation) {
+	switch (operation) {
+		case "published": return CLOUD_EVENT_TYPES.automationPublished;
+		case "changed": return CLOUD_EVENT_TYPES.automationChanged;
+		case "revoked": return CLOUD_EVENT_TYPES.automationRevoked;
+		case "run": return CLOUD_EVENT_TYPES.automationRun;
+		default: return operation;
+	}
+}
+function deliveryType(operation) {
+	switch (operation) {
+		case "sent": return CLOUD_EVENT_TYPES.deliverySent;
+		case "delivered": return CLOUD_EVENT_TYPES.deliveryDelivered;
+		case "bounced": return CLOUD_EVENT_TYPES.deliveryBounced;
+		case "complained": return CLOUD_EVENT_TYPES.deliveryComplained;
+		case "failed": return CLOUD_EVENT_TYPES.deliveryFailed;
+		default: return operation;
+	}
+}
+/**
+* The CloudEvents `type` of a sink event. A support access event maps onto the
+* `support-session` family, and a consent the tenant pulls early (`revoked`)
+* ends the session like a lapse; `data.operation` keeps the difference.
+*/
+function cloudEventType(event) {
+	switch (event.type) {
+		case "directory": return directoryType(event.operation);
+		case "membership": return membershipType(event.operation);
+		case "credential": return credentialType(event.operation);
+		case "access": return event.operation === "started" ? CLOUD_EVENT_TYPES.supportSessionStarted : CLOUD_EVENT_TYPES.supportSessionEnded;
+		case "automation": return automationType(event.operation);
+		case "delivery": return deliveryType(event.operation);
+		case "decision": return event.phase === void 0 ? CLOUD_EVENT_TYPES.decision : approvalType(event.phase);
+		default: return event;
+	}
+}
+function cloudEventSubject(event) {
+	if (event.type === "directory") return event.resource.id;
+	if (event.type === "membership" || event.type === "access") return event.principal.id;
+	if (event.type === "credential") return event.credential.id;
+	if (event.type === "delivery") return event.delivery.id;
+	if (event.type === "automation") return event.automation.id;
+	return event.permission;
+}
+/** `x` as given, after checking it is a plain JSON object; a builder throws on bad input. */
+function checkedX(x) {
+	if (x !== void 0) assertAppData(x, "x of a sink event");
+	return x;
+}
+/**
+* An `automation` sink event for `automation`. `run` carries the run id and
+* belongs on `run` events only.
+*/
+function automationEvent(input) {
+	if (input.run === void 0 !== (input.operation !== "run")) throw new TypeError("PermDock: automationEvent needs run on run events only");
+	const { automation } = input;
+	return compact({
+		type: "automation",
+		at: requireEventInstant(input.at, "at") ?? isoNow(),
+		source: input.source ?? "permdock",
+		operation: input.operation,
+		automation: compact({
+			id: automation.id,
+			version: automation.version,
+			mode: automation.mode,
+			name: automation.name
+		}),
+		principal: { id: automation.principal },
+		publishedBy: automation.publishedBy,
+		tenant: automation.tenant,
+		roles: automation.roles,
+		permissions: automation.permissions,
+		run: input.run === void 0 ? void 0 : { id: input.run },
+		by: input.by,
+		x: checkedX(input.x)
+	});
+}
+/**
+* The `access` event of a `SupportSession`: `started` when it begins,
+* `ended` when it lapses, `revoked` when it is ended early. `principal` is
+* the staff member, as for a support membership.
+*/
+function supportSessionEvent(input) {
+	const { session } = input;
+	return compact({
+		type: "access",
+		at: requireEventInstant(input.at, "at") ?? isoNow(),
+		source: input.source ?? "permdock",
+		operation: input.operation,
+		tenant: session.tenant,
+		principal: { id: session.actor },
+		via: "support-session",
+		roles: [],
+		expiresAt: requireEventInstant(session.expiresAt, "expiresAt"),
+		grantedBy: session.approvedBy,
+		reason: session.reason,
+		session: {
+			id: session.id,
+			principal: session.principal
+		},
+		permissions: session.permissions,
+		x: checkedX(input.x)
+	});
+}
+/**
+* A `credential` sink event for `credential`. `sample` belongs on `used`
+* events only and must be in `(0, 1]`.
+*/
+function credentialEvent(input) {
+	const sample = input.sample;
+	if (sample !== void 0 && (input.operation !== "used" || !Number.isFinite(sample) || sample <= 0 || sample > 1)) throw new RangeError("PermDock: sample is a number in (0, 1] on used events only");
+	const { credential } = input;
+	return compact({
+		type: "credential",
+		at: requireEventInstant(input.at, "at") ?? isoNow(),
+		source: input.source ?? "permdock",
+		operation: input.operation,
+		credential: {
+			id: credential.id,
+			kind: credential.kind
+		},
+		principal: { id: credential.principal },
+		tenant: credential.tenant,
+		expiresAt: requireEventInstant(credential.expiresAt, "expiresAt"),
+		by: input.by,
+		sample,
+		x: checkedX(input.x)
+	});
+}
+function membershipEvent(input) {
+	if (input.scope === void 0 !== (input.id === void 0)) throw new TypeError("PermDock: membershipEvent needs scope and id together");
+	if (input.scope === void 0 && input.within !== void 0) throw new TypeError("PermDock: membershipEvent within needs a scope");
+	return compact({
+		type: "membership",
+		at: requireEventInstant(input.at, "at") ?? isoNow(),
+		source: input.source,
+		operation: input.operation,
+		principal: input.principal,
+		scope: input.scope,
+		id: input.id,
+		within: input.within,
+		via: input.via,
+		expiresAt: requireEventInstant(input.expiresAt, "expiresAt"),
+		roles: input.roles,
+		by: input.by,
+		x: checkedX(input.x)
+	});
+}
+/**
+* A support-access lifecycle event. `started` on consent, `ended` when the
+* session lapses, `revoked` when the tenant pulls consent early. It never
+* decides; the app writes and revokes the membership.
+*/
+function accessEvent(input) {
+	return compact({
+		type: "access",
+		at: requireEventInstant(input.at, "at") ?? isoNow(),
+		source: input.source,
+		operation: input.operation,
+		tenant: input.tenant,
+		principal: input.principal,
+		via: input.via ?? "support",
+		roles: input.roles,
+		member: input.member,
+		expiresAt: requireEventInstant(input.expiresAt, "expiresAt"),
+		grantedBy: input.grantedBy,
+		reason: input.reason,
+		actor: input.actor,
+		x: checkedX(input.x)
+	});
+}
+/**
+* Wraps a sink event in a CloudEvents 1.0 envelope. Throws a `TypeError` when
+* `source` is not an absolute URI or `traceparent` is not W3C Trace Context.
+*/
+function toCloudEvent(event, options) {
+	if (!isAbsoluteUri(options.source)) throw new TypeError("PermDock: a CloudEvents source is an absolute URI");
+	if (options.traceparent !== void 0 && !isTraceparent(options.traceparent)) throw new TypeError("PermDock: traceparent is not W3C Trace Context");
+	return compact({
+		specversion: "1.0",
+		type: cloudEventType(event),
+		source: options.source,
+		subject: cloudEventSubject(event),
+		id: options.id ?? globalThis.crypto.randomUUID(),
+		time: event.at,
+		datacontenttype: "application/json",
+		dataschema: EVENT_SCHEMA_IDS[event.type],
+		traceparent: options.traceparent,
+		tracestate: options.traceparent === void 0 ? void 0 : options.tracestate,
+		data: event
+	});
+}
+/**
+* Signs sink events as an offline evidence export: a compact JWS with
+* `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
+* Live deliveries use Standard Webhooks instead.
+*/
+function signDecisionBatch(events, signer, options) {
+	const source = options.source;
+	return signer.sign({ events: events.map((event) => toCloudEvent(event, { source })) }, compact({
+		typ: "vnd.permdock.evidence+jwt",
+		audience: options.audience
+	}));
+}
+function memoryDecisionSink(options = {}) {
+	const capacity = options.capacity ?? 1e4;
+	const buffer = [];
+	const signed = [];
+	if (options.signer !== void 0 && !isAbsoluteUri(options.source)) throw new TypeError("PermDock: a CloudEvents source is an absolute URI");
+	return {
+		write(events) {
+			buffer.push(...events);
+			if (buffer.length > capacity) buffer.splice(0, buffer.length - capacity);
+			if (options.signer === void 0) return;
+			return signDecisionBatch(events, options.signer, compact({
+				audience: options.audience,
+				source: options.source
+			})).then((batch) => {
+				signed.push(batch);
+			}).catch(() => void 0);
+		},
+		events() {
+			return [...buffer];
+		},
+		batches() {
+			return [...signed];
+		}
+	};
+}
+//#endregion
+export { EVENT_SCHEMA_IDS as C, DIRECTORY_EVENT_SCHEMA as S, SINK_EVENT_SCHEMAS as T, AUTOMATION_EVENT_SCHEMA as _, accessEvent as a, DECISION_EVENT_SCHEMA as b, credentialEvent as c, membershipEvent as d, memoryDecisionSink as f, ACCESS_EVENT_SCHEMA as g, toCloudEvent as h, RESERVED_CLOUD_EVENT_TYPES as i, isAbsoluteUri as l, supportSessionEvent as m, CLOUDEVENTS_CONTENT_TYPE as n, automationEvent as o, signDecisionBatch as p, CLOUD_EVENT_TYPES as r, cloudEventType as s, CLOUDEVENTS_BATCH_CONTENT_TYPE as t, isTraceparent as u, CATALOG_EVENT_SCHEMA as v, MEMBERSHIP_EVENT_SCHEMA as w, DELIVERY_EVENT_SCHEMA as x, CREDENTIAL_EVENT_SCHEMA as y };