permdock 0.5.0 → 0.7.0

package/dist/{scim-ClHtpyV3.js → scim-YNieBO1U.js}

@@ -1,12 +1,12 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as readAppData } from "./app-data-MuyzVqX8.js";
 import { d as isoNow } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { n as sha256, r as sha256Digest } from "./sha256-D9ihqmvd.js";
 import { d as membershipEvent, f as memoryDecisionSink } from "./sink-BEZSlMS_.js";
 import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
 import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
+import { _ as SCIM_CONTENT_TYPE, b as isDirectoryUniquenessError, c as parseScimFilter, f as ERROR_SCHEMA, g as ROLES_EXTENSION, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "./postgres-store-BL9M_CA1.js";
 //#region src/scim/auth.ts
 function hexToBytes(hex) {
 	if (hex.length % 2 !== 0) return;
@@ -85,43 +85,6 @@ function sha256Hex(value) {
 	return hex;
 }
 //#endregion
-//#region src/scim/types.ts
-const SCIM_CONTENT_TYPE = "application/scim+json";
-const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
-const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
-const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
-const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
-const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
-/** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
-const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
-const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
-var DirectoryUniquenessError = class extends Error {
-	name = "DirectoryUniquenessError";
-	code = "uniqueness";
-	constructor(message = "uniqueness") {
-		super(message);
-	}
-};
-var DirectoryNotFoundError = class extends Error {
-	name = "DirectoryNotFoundError";
-	code = "not-found";
-	constructor(message = "not found") {
-		super(message);
-	}
-};
-function isNamedError(error, name, code) {
-	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
-}
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
-function isDirectoryUniquenessError(error) {
-	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
-}
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
-function isDirectoryNotFoundError(error) {
-	return isNamedError(error, "DirectoryNotFoundError", "not-found");
-}
-//#endregion
 //#region src/scim/discovery.ts
 const SCHEMA_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema";
 function serviceProviderConfig() {
@@ -240,238 +203,6 @@ function schemas() {
 	];
 }
 //#endregion
-//#region src/scim/filter.ts
-const COMPARE = /* @__PURE__ */ new Set([
-	"eq",
-	"ne",
-	"co",
-	"sw"
-]);
-function skipSpace(input, index) {
-	let cursor = index;
-	while (cursor < input.length && input[cursor] === " ") cursor += 1;
-	return cursor;
-}
-function readIdent(input, index) {
-	const start = skipSpace(input, index);
-	if (!/[A-Za-z]/u.test(input[start] ?? "")) return;
-	let cursor = start;
-	while (cursor < input.length && /[A-Za-z0-9._]/u.test(input[cursor] ?? "")) cursor += 1;
-	return {
-		value: input.slice(start, cursor),
-		next: cursor
-	};
-}
-function readString(input, index) {
-	const start = skipSpace(input, index);
-	if (input[start] !== "\"") return;
-	let cursor = start + 1;
-	let value = "";
-	while (cursor < input.length) {
-		const char = input[cursor];
-		if (char === "\\") {
-			value += input[cursor + 1] ?? "";
-			cursor += 2;
-			continue;
-		}
-		if (char === "\"") return {
-			value,
-			next: cursor + 1
-		};
-		value += char;
-		cursor += 1;
-	}
-}
-function readLiteral(input, index) {
-	const quoted = readString(input, index);
-	if (quoted !== void 0) return quoted;
-	const ident = readIdent(input, index);
-	if (ident === void 0) return;
-	if (ident.value.toLowerCase() === "true") return {
-		value: true,
-		next: ident.next
-	};
-	if (ident.value.toLowerCase() === "false") return {
-		value: false,
-		next: ident.next
-	};
-	return {
-		value: ident.value,
-		next: ident.next
-	};
-}
-function parsePrimary(input, index) {
-	const start = skipSpace(input, index);
-	if (input[start] === "(") {
-		const inner = parseOr(input, start + 1);
-		if (inner === void 0) return;
-		const close = skipSpace(input, inner.next);
-		if (input[close] !== ")") return;
-		return {
-			filter: inner.filter,
-			next: close + 1
-		};
-	}
-	const attribute = readIdent(input, start);
-	if (attribute === void 0) return;
-	const opToken = readIdent(input, attribute.next);
-	if (opToken === void 0) return;
-	const op = opToken.value.toLowerCase();
-	if (op === "pr") return {
-		filter: {
-			op: "pr",
-			attribute: attribute.value
-		},
-		next: opToken.next
-	};
-	if (!COMPARE.has(op)) return;
-	const value = readLiteral(input, opToken.next);
-	if (value === void 0) return;
-	return {
-		filter: {
-			op,
-			attribute: attribute.value,
-			value: value.value
-		},
-		next: value.next
-	};
-}
-function parseAnd(input, index) {
-	const first = parsePrimary(input, index);
-	if (first === void 0) return;
-	const filters = [first.filter];
-	let cursor = first.next;
-	for (;;) {
-		const nextOp = readIdent(input, cursor);
-		if (nextOp?.value.toLowerCase() !== "and") break;
-		const next = parsePrimary(input, nextOp.next);
-		if (next === void 0) return;
-		filters.push(next.filter);
-		cursor = next.next;
-	}
-	if (filters.length === 1) return {
-		filter: first.filter,
-		next: cursor
-	};
-	return {
-		filter: {
-			op: "and",
-			filters
-		},
-		next: cursor
-	};
-}
-function parseOr(input, index) {
-	const first = parseAnd(input, index);
-	if (first === void 0) return;
-	const filters = [first.filter];
-	let cursor = first.next;
-	for (;;) {
-		const nextOp = readIdent(input, cursor);
-		if (nextOp?.value.toLowerCase() !== "or") break;
-		const next = parseAnd(input, nextOp.next);
-		if (next === void 0) return;
-		filters.push(next.filter);
-		cursor = next.next;
-	}
-	if (filters.length === 1) return {
-		filter: first.filter,
-		next: cursor
-	};
-	return {
-		filter: {
-			op: "or",
-			filters
-		},
-		next: cursor
-	};
-}
-function parseScimFilter(input) {
-	const trimmed = input.trim();
-	if (trimmed === "") return;
-	const parsed = parseOr(trimmed, 0);
-	if (parsed === void 0) return;
-	if (skipSpace(trimmed, parsed.next) !== trimmed.length) return;
-	return parsed.filter;
-}
-function readAttribute(target, attribute) {
-	if (attribute === "members.value") {
-		const members = target["members"];
-		if (!Array.isArray(members)) return;
-		return members.map((member) => {
-			if (member !== null && typeof member === "object" && "value" in member) return member.value;
-		});
-	}
-	const parts = attribute.split(".");
-	let current = target;
-	for (const part of parts) {
-		if (current === null || typeof current !== "object") return;
-		current = current[part];
-	}
-	return current;
-}
-function asString(value) {
-	if (typeof value === "boolean") return value ? "true" : "false";
-	return String(value);
-}
-function matchCompare(actual, op, expected) {
-	if (Array.isArray(actual)) return actual.some((item) => matchCompare(item, op, expected));
-	if (actual === void 0 || actual === null) return op === "ne";
-	if (typeof expected === "boolean" || typeof actual === "boolean") {
-		const left = asString(actual).toLowerCase();
-		const right = asString(expected).toLowerCase();
-		return op === "eq" ? left === right : op === "ne" ? left !== right : false;
-	}
-	const left = asString(actual);
-	const right = asString(expected);
-	switch (op) {
-		case "eq": return left === right;
-		case "ne": return left !== right;
-		case "co": return left.includes(right);
-		case "sw": return left.startsWith(right);
-		default: return op;
-	}
-}
-/** RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an item. */
-function present(value) {
-	if (Array.isArray(value)) return value.some(present);
-	return value !== void 0 && value !== null && value !== "";
-}
-function matchFilter(target, filter) {
-	if (filter === void 0) return true;
-	const record = target;
-	switch (filter.op) {
-		case "and": return filter.filters.every((item) => matchFilter(target, item));
-		case "or": return filter.filters.some((item) => matchFilter(target, item));
-		case "pr": return present(readAttribute(record, filter.attribute));
-		case "eq":
-		case "ne":
-		case "co":
-		case "sw": return matchCompare(readAttribute(record, filter.attribute), filter.op, filter.value);
-		default: return filter;
-	}
-}
-const SUPPORTED_FILTER_ATTRIBUTES = /* @__PURE__ */ new Set([
-	"id",
-	"userName",
-	"externalId",
-	"active",
-	"displayName",
-	"members.value"
-]);
-function filterSupported(filter) {
-	switch (filter.op) {
-		case "and":
-		case "or": return filter.filters.every(filterSupported);
-		case "pr":
-		case "eq":
-		case "ne":
-		case "co":
-		case "sw": return SUPPORTED_FILTER_ATTRIBUTES.has(filter.attribute);
-		default: return filter;
-	}
-}
-//#endregion
 //#region src/scim/body.ts
 /** The parsed body; `undefined` for an empty or unreadable one. Invalid JSON throws a `SyntaxError`. */
 async function readJson(request) {
@@ -1303,269 +1034,4 @@ function directoryMembershipSource(store, options = {}) {
 	} };
 }
 //#endregion
-//#region src/scim/store.ts
-const DEFAULT_COUNT = 100;
-function now() {
-	return isoNow();
-}
-function createdAt(at, ...candidates) {
-	return candidates.find((value) => value !== void 0 && value !== "") ?? at;
-}
-function randomId(prefix) {
-	const bytes = /* @__PURE__ */ new Uint8Array(8);
-	crypto.getRandomValues(bytes);
-	let hex = "";
-	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-	return `${prefix}${hex}`;
-}
-function directoryKey(tenant, id) {
-	return `${tenant}\0${id}`;
-}
-function asError(error) {
-	return error instanceof Error ? error : new Error(String(error));
-}
-function pageOf(items, page) {
-	const count = page.count ?? DEFAULT_COUNT;
-	let start = 0;
-	if (page.cursor !== void 0 && page.cursor !== "") {
-		const decoded = Math.trunc(Number(page.cursor));
-		start = Number.isFinite(decoded) && decoded > 0 ? decoded : 0;
-	} else if (page.startIndex !== void 0 && page.startIndex > 0) start = page.startIndex - 1;
-	const slice = items.slice(start, start + count);
-	const nextIndex = start + slice.length;
-	return compact({
-		Resources: slice,
-		totalResults: items.length,
-		startIndex: start + 1,
-		itemsPerPage: slice.length,
-		nextCursor: nextIndex < items.length ? String(nextIndex) : void 0
-	});
-}
-function emailsOf(value) {
-	if (!Array.isArray(value)) return;
-	return value.flatMap((item) => {
-		if (item === null || typeof item !== "object") return [];
-		const record = item;
-		if (typeof record.value !== "string") return [];
-		return [compact({
-			value: record.value,
-			primary: typeof record.primary === "boolean" ? record.primary : void 0,
-			type: typeof record.type === "string" ? record.type : void 0
-		})];
-	});
-}
-function membersOf(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((item) => {
-		if (item === null || typeof item !== "object") return [];
-		const record = item;
-		return typeof record.value === "string" ? [{ value: record.value }] : [];
-	});
-}
-function rolesOf(value) {
-	if (!Array.isArray(value)) return;
-	return value.filter((item) => typeof item === "string");
-}
-function memberValues(value) {
-	return membersOf(value).map((member) => member.value);
-}
-function applyUserOp(user, op) {
-	const path = op.path ?? "";
-	if (path === "active" && typeof op.value === "boolean") return {
-		...user,
-		active: op.value
-	};
-	if (path === "userName" && typeof op.value === "string") return {
-		...user,
-		userName: op.value
-	};
-	if (path === "externalId") return compact({
-		...user,
-		externalId: typeof op.value === "string" ? op.value : void 0
-	});
-	if (path === "emails") return compact({
-		...user,
-		emails: emailsOf(op.value)
-	});
-	return user;
-}
-function applyGroupOp(group, op) {
-	const path = op.path ?? "";
-	if (path === "displayName" && typeof op.value === "string") return {
-		...group,
-		displayName: op.value
-	};
-	if (path === "externalId") return compact({
-		...group,
-		externalId: typeof op.value === "string" ? op.value : void 0
-	});
-	if (path === "roles") return compact({
-		...group,
-		roles: rolesOf(op.value)
-	});
-	if (path !== "members") return group;
-	const incoming = memberValues(op.value);
-	const current = group.members.map((member) => member.value);
-	if (op.op === "replace") return {
-		...group,
-		members: incoming.map((value) => ({ value }))
-	};
-	if (op.op === "add") {
-		const next = [...current];
-		for (const value of incoming) if (!next.includes(value)) next.push(value);
-		return {
-			...group,
-			members: next.map((value) => ({ value }))
-		};
-	}
-	return {
-		...group,
-		members: current.filter((value) => !incoming.includes(value)).map((value) => ({ value }))
-	};
-}
-function stampUser(user, created) {
-	const at = now();
-	return freezeDeep({
-		...user,
-		meta: compact({
-			created: createdAt(at, created, user.meta.created),
-			lastModified: at,
-			resourceType: "User",
-			location: user.meta.location
-		})
-	});
-}
-function stampGroup(group, created) {
-	const at = now();
-	return freezeDeep({
-		...group,
-		meta: compact({
-			created: createdAt(at, created, group.meta.created),
-			lastModified: at,
-			resourceType: "Group",
-			location: group.meta.location
-		})
-	});
-}
-function memoryDirectoryStore() {
-	const users = /* @__PURE__ */ new Map();
-	const groups = /* @__PURE__ */ new Map();
-	function usersIn(tenant) {
-		const found = [];
-		for (const [key, user] of users) if (key.startsWith(`${tenant}\0`)) found.push(user);
-		return found;
-	}
-	function groupsIn(tenant) {
-		const found = [];
-		for (const [key, group] of groups) if (key.startsWith(`${tenant}\0`)) found.push(group);
-		return found;
-	}
-	function assertUserUnique(tenant, user, ignoreId) {
-		for (const existing of usersIn(tenant)) {
-			if (existing.id === ignoreId) continue;
-			if (existing.userName === user.userName) throw new DirectoryUniquenessError("userName");
-			if (user.externalId !== void 0 && existing.externalId === user.externalId) throw new DirectoryUniquenessError("externalId");
-		}
-	}
-	function assertGroupUnique(tenant, group, ignoreId) {
-		for (const existing of groupsIn(tenant)) {
-			if (existing.id === ignoreId) continue;
-			if (group.externalId !== void 0 && existing.externalId === group.externalId) throw new DirectoryUniquenessError("externalId");
-		}
-	}
-	return {
-		getUser(tenant, id) {
-			return Promise.resolve(users.get(directoryKey(tenant, id)) ?? null);
-		},
-		findUsers(tenant, filter, page) {
-			const matched = usersIn(tenant).filter((user) => matchFilter(user, filter));
-			return Promise.resolve(pageOf(matched, page));
-		},
-		putUser(tenant, user) {
-			try {
-				const id = user.id === "" ? randomId("u_") : user.id;
-				const existing = users.get(directoryKey(tenant, id));
-				const next = stampUser({
-					...user,
-					id
-				}, existing?.meta.created);
-				assertUserUnique(tenant, next, id);
-				users.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		patchUser(tenant, id, ops) {
-			try {
-				const existing = users.get(directoryKey(tenant, id));
-				if (existing === void 0) throw new DirectoryNotFoundError();
-				let next = existing;
-				for (const op of ops) next = applyUserOp(next, op);
-				next = stampUser(next, existing.meta.created);
-				assertUserUnique(tenant, next, id);
-				users.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		deleteUser(tenant, id) {
-			if (!users.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
-			for (const group of groupsIn(tenant)) {
-				if (!group.members.some((member) => member.value === id)) continue;
-				groups.set(directoryKey(tenant, group.id), stampGroup({
-					...group,
-					members: group.members.filter((member) => member.value !== id)
-				}, group.meta.created));
-			}
-			return Promise.resolve();
-		},
-		getGroup(tenant, id) {
-			return Promise.resolve(groups.get(directoryKey(tenant, id)) ?? null);
-		},
-		findGroups(tenant, filter, page) {
-			const matched = groupsIn(tenant).filter((group) => matchFilter(group, filter));
-			return Promise.resolve(pageOf(matched, page));
-		},
-		putGroup(tenant, group) {
-			try {
-				const id = group.id === "" ? randomId("g_") : group.id;
-				const existing = groups.get(directoryKey(tenant, id));
-				const next = stampGroup({
-					...group,
-					id,
-					members: group.members
-				}, existing?.meta.created);
-				assertGroupUnique(tenant, next, id);
-				groups.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		patchGroup(tenant, id, ops) {
-			try {
-				const existing = groups.get(directoryKey(tenant, id));
-				if (existing === void 0) throw new DirectoryNotFoundError();
-				let next = existing;
-				for (const op of ops) next = applyGroupOp(next, op);
-				next = stampGroup(next, existing.meta.created);
-				assertGroupUnique(tenant, next, id);
-				groups.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		deleteGroup(tenant, id) {
-			if (!groups.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
-			return Promise.resolve();
-		},
-		groupsFor(tenant, userId) {
-			return Promise.resolve(groupsIn(tenant).filter((group) => group.members.some((member) => member.value === userId)));
-		}
-	};
-}
-//#endregion
-export { isDirectoryUniquenessError as C, isDirectoryNotFoundError as S, sha256Hex as T, LIST_SCHEMA as _, normalizePatchOps as a, SCIM_CONTENT_TYPE as b, parseScimFilter as c, serviceProviderConfig as d, APP_DATA_EXTENSION as f, GROUP_SCHEMA as g, ERROR_SCHEMA as h, tenantFromPath as i, resourceTypes as l, DirectoryUniquenessError as m, directoryMembershipSource as n, filterSupported as o, DirectoryNotFoundError as p, scimHandler as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, PATCH_SCHEMA as v, authenticateScim as w, USER_SCHEMA as x, ROLES_EXTENSION as y };
+export { resourceTypes as a, authenticateScim as c, normalizePatchOps as i, sha256Hex as l, scimHandler as n, schemas as o, tenantFromPath as r, serviceProviderConfig as s, directoryMembershipSource as t };

package/dist/{scopes-CUPSjo9q.js → scopes-BHsc-wp-.js}

@@ -249,4 +249,4 @@ function subjectForPermission(subject, key) {
 	};
 }
 //#endregion
-export { normalizeMemberships as a, rootScope as c, scopeList as d, subjectForPermission as f, keepsPermission as i, scopeChain as l, tenantOf as m, defineScopes as n, resolveScope as o, subjectMemberships as p, findScope as r, rootMembershipId as s, activeFor as t, scopeIdOf as u };
+export { normalizeMembership as a, rootMembershipId as c, scopeIdOf as d, scopeList as f, tenantOf as h, keepsPermission as i, rootScope as l, subjectMemberships as m, defineScopes as n, normalizeMemberships as o, subjectForPermission as p, findScope as r, resolveScope as s, activeFor as t, scopeChain as u };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Bg5Tpluk.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-C2PXIv4c.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CQpoquwj.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-B_Qg9D3e.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-R07lFBnX.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-BLd4MnBX.js";
-import { i as evaluationsHandler } from "../evaluations-16UqqQ6W.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-Chrs5fQ-.js";
-import { l as ReplayStore } from "../types-DiQjupG2.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-6lg8v_is.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DqK9eDmM.js";
-import { a as RunKind, c as RunTicketAutomations, d as RunTicketOptions, f as RunTicketSubjectOptions, h as subjectFromRunTicket, i as RunContext, l as RunTicketFailureCause, m as signRunTicket, n as RunAutomation, o as RunPrincipal, p as parseRunTicket, r as RunBinding, s as RunTicket, t as RunActClaim, u as RunTicketInput } from "../run-ticket-BjhTOi6u.js";
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-C4gZUEZy.js";
+import { i as evaluationsHandler } from "../evaluations-BCddEOfO.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-BSfRl0hZ.js";
+import { l as ReplayStore } from "../types-cTos-H7p.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-B_qRg0ws.js";
+import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-Pahd3IYJ.js";
+import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-BpNi7BCi.js";
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -3,12 +3,12 @@ import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockAppro
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CTviyH5L.js";
 import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DZHQ0KF6.js";
-import { d as discoverViaSignatureAgent, f as invalidSignatureProblem, m as webBotAuthVerifier, o as evaluationsHandler, p as invalidSignatureResponse, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DT2Kx1F8.js";
+import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
 import { n as tenantScope } from "../adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "../create-DnrmLnLW.js";
-import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-DqCT4CgZ.js";
-import { n as signRunTicket, r as subjectFromRunTicket, t as parseRunTicket } from "../run-ticket-sxFI6LAk.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { t as createPermDock } from "../create-DJrlhEp9.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-Bnga6I50.js";
+import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-B5d_63Ma.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
 import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-DgFFD-Ga.js";
-export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-DqCT4CgZ.js → server-Bnga6I50.js}

@@ -1,13 +1,13 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { n as isThenable } from "./thenable-yD7SabqG.js";
 import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-DkWjdL98.js";
 import { t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
-import { n as parseSupportSession } from "./support-session-C6xJQYut.js";
+import { n as parseSupportSession } from "./support-session-Cna49-3f.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 import { c as credentialEvent } from "./sink-BEZSlMS_.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-DM2um3ha.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-CIM7wHwA.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;