permdock 0.6.0 → 0.8.0

package/dist/{scopes-CUPSjo9q.js → scopes-0Up_UA2t.js}

@@ -1,12 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { i as idText, n as expirySeconds } from "./expiry-D4_YKRKD.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { i as idText, n as expirySeconds } from "./expiry-6XByK0dm.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
 //#region src/core/scopes.ts
 const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
 const NAME = /^[a-z][a-z0-9_]*$/u;
-/** A policy without `scopes` keeps the historical pair: `tenant`, and `team` inside it. */
+/**
+* A policy without `scopes` keeps the historical pair: `tenant`, and `team`
+* inside it.
+*/
 const IMPLICIT = Object.freeze([Object.freeze({ name: "tenant" }), Object.freeze({
 	name: "team",
 	within: "tenant"
@@ -17,9 +20,9 @@ function fail(message) {
 /**
 * Validates `definePolicy({ scopes })`. Declaration order is the scope order;
 * every scope after the first names an earlier one in `within`, so the scopes
-* form one tree rooted at the first and have no cycles.
-* A scope named `tenant` is the first and `team` the second, so the aliases
-* never point at two different scopes.
+* form one tree rooted at the first and have no cycles. A scope named `tenant`
+* is the first and `team` the second, so the aliases never point at two
+* different scopes.
 */
 function defineScopes(input) {
 	if (input === void 0) return Object.freeze([]);
@@ -49,7 +52,10 @@ function defineScopes(input) {
 	}
 	return Object.freeze(out);
 }
-/** The scopes a policy or snapshot evaluates with: the declared list, or the implicit pair. */
+/**
+* The scopes a policy or snapshot evaluates with: the declared list, or the
+* implicit pair.
+*/
 function scopeList(declared) {
 	return declared === void 0 || declared.length === 0 ? IMPLICIT : declared;
 }
@@ -77,7 +83,10 @@ function scopeChain(scopes, name) {
 function rootScope(scopes) {
 	return scopes[0]?.name;
 }
-/** The id a membership holds for `scope`: its own id, or the `within` entry of an ancestor. */
+/**
+* The id a membership holds for `scope`: its own id, or the `within` entry of
+* an ancestor.
+*/
 function scopeIdOf(membership, scope) {
 	if (membership.scope === scope) return membership.id;
 	const within = membership.within;
@@ -85,19 +94,25 @@ function scopeIdOf(membership, scope) {
 	return within[scope];
 }
 /**
-* A membership of the first scope itself (the only scope without a parent):
-* its id is a tenant. Needs no scope list, for code that holds only a subject.
+* A membership of the first scope itself (the only scope without a parent): its
+* id is a tenant. Needs no scope list, for code that holds only a subject.
 */
 function rootMembershipId(membership) {
 	if (membership.scope !== void 0) return membership.within === void 0 ? membership.id : void 0;
 	return membership.team === void 0 ? membership.tenant : void 0;
 }
-/** The instance of the first scope a membership sits in; what the active tenant selects. */
+/**
+* The instance of the first scope a membership sits in; what the active tenant
+* selects.
+*/
 function tenantOf(membership, scopes) {
 	const root = rootScope(scopes);
 	return root === void 0 ? void 0 : scopeIdOf(membership, root);
 }
-/** A non-empty string. Unlike `isId` in `./ids.ts` it has no length cap: membership fields come from the app, not the wire. */
+/**
+* A non-empty string. Unlike `isId` in `./ids.ts` it has no length cap:
+* membership fields come from the app, not the wire.
+*/
 function isNonEmptyString(value) {
 	return typeof value === "string" && value !== "";
 }
@@ -107,10 +122,10 @@ function roleList(value) {
 }
 /**
 * The canonical form of one membership, or `undefined` when it is malformed
-* (fail-closed: it grants nothing). A named membership is
-* `{ scope, id, within }` with one `within` entry per ancestor of `scope`;
-* the `tenant` / `team` input shape and alias names normalise to it. A
-* resource membership keeps `on`. Shapes are exclusive.
+* (fail-closed: it grants nothing). A named membership is `{ scope, id, within
+* }` with one `within` entry per ancestor of `scope`; the `tenant` / `team`
+* input shape and alias names normalise to it. A resource membership keeps
+* `on`. Shapes are exclusive.
 */
 function normalizeMembership(input, scopes) {
 	if (input === null || typeof input !== "object" || Array.isArray(input)) return;
@@ -212,8 +227,8 @@ function normalizeMemberships(input, scopes) {
 }
 /**
 * A subject's memberships in canonical form. Resolved subjects already are;
-* this accepts a hand-built subject passed straight to a condition evaluator
-* or compiler.
+* this accepts a hand-built subject passed straight to a condition evaluator or
+* compiler.
 */
 function subjectMemberships(memberships, scopes) {
 	const list = memberships ?? [];
@@ -228,13 +243,16 @@ function activeFor(membership, scopes, active) {
 	if (root === void 0 || membership.scope === void 0 || !scopeChain(scopes, membership.scope).includes(root)) return true;
 	return active !== void 0 && scopeIdOf(membership, root) === active;
 }
-/** Whether `membership` counts for `key`: always, unless a suspension limits it to `keep`. */
+/**
+* Whether `membership` counts for `key`: always, unless a suspension limits it
+* to `keep`.
+*/
 function keepsPermission(membership, key) {
 	return membership.keep === void 0 || membership.keep.includes(key);
 }
 /**
-* The subject as it stands for one permission: memberships a suspension
-* limits to other permissions are left out. The same object when none is.
+* The subject as it stands for one permission: memberships a suspension limits
+* to other permissions are left out. The same object when none is.
 */
 function subjectForPermission(subject, key) {
 	const principal = subject.principal;
@@ -249,4 +267,4 @@ function subjectForPermission(subject, key) {
 	};
 }
 //#endregion
-export { normalizeMemberships as a, rootScope as c, scopeList as d, subjectForPermission as f, keepsPermission as i, scopeChain as l, tenantOf as m, defineScopes as n, resolveScope as o, subjectMemberships as p, findScope as r, rootMembershipId as s, activeFor as t, scopeIdOf as u };
+export { normalizeMembership as a, rootMembershipId as c, scopeIdOf as d, scopeList as f, tenantOf as h, keepsPermission as i, rootScope as l, subjectMemberships as m, defineScopes as n, normalizeMemberships as o, subjectForPermission as p, findScope as r, resolveScope as s, activeFor as t, scopeChain as u };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-DHUrAkku.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DH5QEGXh.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-YGg2mXyH.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-zi_4T-rx.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-R07lFBnX.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CKQiCnON.js";
-import { i as evaluationsHandler } from "../evaluations-C_1vdSZc.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8YjkEZ4.js";
-import { l as ReplayStore } from "../types-C791HFu9.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-rbD7LS6h.js";
-import { t as memoryReplayStore } from "../replay-Bkm-Ne4l.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-PXI-vGpY.js";
-import { a as RunKind, c as RunTicketAutomations, d as RunTicketOptions, f as RunTicketSubjectOptions, h as subjectFromRunTicket, i as RunContext, l as RunTicketFailureCause, m as signRunTicket, n as RunAutomation, o as RunPrincipal, p as parseRunTicket, r as RunBinding, s as RunTicket, t as RunActClaim, u as RunTicketInput } from "../run-ticket-DocwaTKn.js";
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CIlpSA2G.js";
+import { i as evaluationsHandler } from "../evaluations-z8dQFDaN.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8s204GL.js";
+import { l as ReplayStore } from "../types-DjuMBNF9.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-C-qX4mJW.js";
+import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
+import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-DbWI9f99.js";
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -1,14 +1,14 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DZHQ0KF6.js";
-import { d as discoverViaSignatureAgent, f as invalidSignatureProblem, m as webBotAuthVerifier, o as evaluationsHandler, p as invalidSignatureResponse, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { n as tenantScope } from "../adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "../create-DCF2SvoT.js";
-import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-C3WXAHZj.js";
-import { n as signRunTicket, r as subjectFromRunTicket, t as parseRunTicket } from "../run-ticket-sxFI6LAk.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-DgFFD-Ga.js";
-export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+import { c as problemFromDecision, f as validationProblem, l as problemResponse, p as wwwAuthenticate } from "../problem-BVLHFK33.js";
+import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
+import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { n as tenantScope } from "../adapter-context-CIQpQxbE.js";
+import { t as createPermDock } from "../create-_noSrY1T.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-3cVlTLde.js";
+import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-Dv7aF7Dk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-D67a3nzk.js";
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-C3WXAHZj.js → server-3cVlTLde.js}

@@ -1,13 +1,13 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-DkWjdL98.js";
-import { t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
-import { n as parseSupportSession } from "./support-session-C6xJQYut.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-nR1JesoH.js";
+import { t as bytesToBase64Url } from "./sha256-C-4WXKIu.js";
+import { n as parseSupportSession } from "./support-session-BsmPCbz8.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { c as credentialEvent } from "./sink-BEZSlMS_.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-BcoiejpY.js";
+import { c as credentialEvent } from "./sink-D9_vh372.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-CyyyvCsL.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;
@@ -41,8 +41,8 @@ function checksum(text, alphabet) {
 /**
 * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
 * the secret 43 base62 characters and the checksum the 6 base62 characters of
-* the CRC-32 of everything before it. Anything else, including a checksum
-* that does not match, is `undefined`.
+* the CRC-32 of everything before it. Anything else, including a checksum that
+* does not match, is `undefined`.
 */
 function parseApiKey(key) {
 	if (typeof key !== "string" || key.length > MAX_KEY || !key.startsWith(PREFIX)) return;
@@ -63,9 +63,9 @@ const FEED_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
 const FEED_SECRET_LENGTH = 26;
 const FEED_TAIL = /* @__PURE__ */ new RegExp(`^[a-z2-7]{${String(32)}}$`, "u");
 /**
-* Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is
-* 26 lowercase base32 characters and the checksum is 6 more. A checksum that
-* does not match is `undefined`.
+* Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is 26
+* lowercase base32 characters and the checksum is 6 more. A checksum that does
+* not match is `undefined`.
 */
 function parseFeedKey(key) {
 	if (typeof key !== "string" || key.length > 56 || !key.startsWith(FEED_PREFIX)) return;
@@ -82,8 +82,8 @@ function parseFeedKey(key) {
 	} : void 0;
 }
 /**
-* A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters
-* (130 bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
+* A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters (130
+* bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
 */
 function generateFeedKey(id) {
 	if (!isFeedId(id)) throw new TypeError("PermDock: a feed id is 1 to 16 of a-z, 0-9 and -");
@@ -124,11 +124,11 @@ function sameHash(left, right) {
 	return difference === 0;
 }
 /**
-* A `CredentialVerifier` over the application's own table: `find` looks a
-* key up by the id in it, and the key's hash is compared in constant time.
-* A record that is not a valid v1 credential, or whose id is not the key's,
-* verifies to `null`. A throwing `find` propagates, so the resolver denies
-* with `source-threw`.
+* A `CredentialVerifier` over the application's own table: `find` looks a key
+* up by the id in it, and the key's hash is compared in constant time. A record
+* that is not a valid v1 credential, or whose id is not the key's, verifies to
+* `null`. A throwing `find` propagates, so the resolver denies with
+* `source-threw`.
 */
 function apiKeyVerifier(options) {
 	return Object.freeze({
@@ -266,10 +266,10 @@ function anonymous() {
 }
 /**
 * Resolves an opaque API key (`pdk_<id>_<secret>`) into the subject its
-* credential acts as. Every failure (a malformed or unknown key, a record
-* that is not a valid credential, expiry, a tenant policy the key breaks, a
-* revoked id, a missing owner, a throwing verifier, source or callback) is
-* the anonymous subject, never a throw.
+* credential acts as. Every failure (a malformed or unknown key, a record that
+* is not a valid credential, expiry, a tenant policy the key breaks, a revoked
+* id, a missing owner, a throwing verifier, source or callback) is the
+* anonymous subject, never a throw.
 */
 async function subjectFromApiKey(key, options) {
 	const tenant = options.tenant;
@@ -314,8 +314,8 @@ async function subjectFromApiKey(key, options) {
 const SUPPORT_SESSION_TYP = "vnd.permdock.support-session+jwt";
 /**
 * Signs a granted `SupportSession` as a `vnd.permdock.support-session+jwt`
-* (`sub` the viewed principal, `act` the support actor, `jti` the session
-* id) that expires with the session. Throws a `TypeError` for a record
+* (`sub` the viewed principal, `act` the support actor, `jti` the session id)
+* that expires with the session. Throws a `TypeError` for a record
 * `parseSupportSession` refuses.
 */
 function signSupportSession(session, signer, options = {}) {
@@ -380,11 +380,11 @@ async function ended(sessions, id) {
 	}
 }
 /**
-* Resolves a `vnd.permdock.support-session+jwt` into the subject each
-* request of the session acts as: the viewed principal loaded live, a
-* `support` actor, the session's permissions as the delegation and
-* `context.supportSession`. The actor must still exist. Every failure is the
-* anonymous subject, never a throw.
+* Resolves a `vnd.permdock.support-session+jwt` into the subject each request
+* of the session acts as: the viewed principal loaded live, a `support` actor,
+* the session's permissions as the delegation and `context.supportSession`. The
+* actor must still exist. Every failure is the anonymous subject, never a
+* throw.
 */
 async function subjectFromSupportSession(token, options) {
 	if (typeof token !== "string" || token.length === 0) return anonymousSubject();

package/dist/{server-types-CKQiCnON.d.ts → server-types-CIlpSA2G.d.ts}

@@ -1,18 +1,21 @@
-import { Nn as Decision, Rt as Instant, Vt as Snapshot, ar as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as PermDock, s as SnapshotOptions } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
+import { Gt as Snapshot, Ln as Decision, Rt as Instant, Zn as Actor, ar as JsonWebKeyLike, j as PolicyVocabulary, lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-B6Sf4T_S.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-zi_4T-rx.js";
+import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { r as PdpFactory } from "./types-_WhUP7ud.js";
-import { i as evaluationsHandler } from "./evaluations-C_1vdSZc.js";
+import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { r as PdpFactory } from "./types-B4uqKDnp.js";
+import { i as evaluationsHandler } from "./evaluations-z8dQFDaN.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
-  /** The permission the stream or socket is opened for; re-checked after every revalidation. */
+  /**
+   * The permission the stream or socket is opened for; re-checked after every
+   * revalidation.
+   */
   readonly permission?: Permission;
   /** The row for `permission`, or a loader re-run on every revalidation. */
   readonly data?: ConnectionData<T>;
@@ -25,13 +28,13 @@ type Connection = {
   /** Aborts with a `PermDockRevokedError` when the connection must end. */
   readonly signal: AbortSignal;
   /**
-   * Per-message decision. Data is validated against the resource schema
-   * first unless `{ trusted: true }` marks it as a row the server loaded.
+   * Per-message decision. Data is validated against the resource schema first
+   * unless `{ trusted: true }` marks it as a row the server loaded.
    */
   readonly check: (permission: Permission, data?: unknown, options?: {
     readonly trusted?: boolean;
   }) => Decision;
-  readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
+  readonly filter: <T>(permission: Permission<string, NoInfer<T>, "instance">, items: readonly T[]) => T[];
   /**
    * Resolves once every revalidation queued so far has finished, so a message
    * checked after a revocation event is checked against the rebuilt instance.
@@ -43,14 +46,17 @@ type Connection = {
 //#endregion
 //#region src/core/adapter-context.d.ts
 /**
- * The active tenant an adapter resolved from its own framework context.
- * Present means "use this tenant", even when `tenant` is `undefined`.
+ * The active tenant an adapter resolved from its own framework context. Present
+ * means "use this tenant", even when `tenant` is `undefined`.
  */
 type TenantScope = {
   readonly tenant: string | undefined;
 };
 type TenantOption<TContext> = string | ((context: TContext) => string | undefined | Promise<string | undefined>);
-/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+/**
+ * Resolves an adapter `tenant` option against its framework context; a throw is
+ * no tenant.
+ */
 declare function tenantScope<TContext>(option: TenantOption<TContext> | undefined, context: TContext): Promise<TenantScope>;
 //#endregion
 //#region src/server/web-bot-auth.d.ts
@@ -75,13 +81,16 @@ type WebBotAuthOptions = {
   readonly now?: () => Instant;
 };
 /**
- * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`,
- * so an app without it does not bundle RFC 9421 verification.
+ * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`, so an app
+ * without it does not bundle RFC 9421 verification.
  */
 type WebBotAuthVerifier = {
   readonly name?: string;
-  /** The verified signer as an actor, `undefined` for an unsigned request; throws `InvalidSignatureError` for a bad signature. */
-  verify(request: Request): Promise<Actor | undefined>;
+  /**
+   * The verified signer as an actor, `undefined` for an unsigned request;
+   * throws `InvalidSignatureError` for a bad signature.
+   */
+  verify: (request: Request) => Promise<Actor | undefined>;
 };
 type DiscoverViaSignatureAgentOptions = {
   readonly allow: readonly string[];
@@ -104,7 +113,10 @@ declare function webBotAuthVerifier(options?: WebBotAuthOptions): WebBotAuthVeri
 //#endregion
 //#region src/server/server-types.d.ts
 type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
-  /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
+  /**
+   * The user, or a full `Subject` (core then skips `policy.subject`); `null` is
+   * anonymous.
+   */
   readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly actor?: (request: Request) => unknown;
   /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
@@ -123,23 +135,32 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly approval?: ApprovalHint;
   readonly operations?: OperationScopes;
   /**
-   * Replaces the response of a refused guard. A status below 300, or a
-   * throw, keeps the default response and reports through `on('error')`.
+   * Replaces the response of a refused guard. A status below 300, or a throw,
+   * keeps the default response and reports through `on('error')`.
    */
   readonly deniedResponse?: DeniedResponse;
   /**
-   * Request values merged into `subject.context`, under `policy.context`.
-   * Only values the server derived belong here, never client input. A throw
-   * or a value that is not a JSON object adds nothing and reports through
+   * Request values merged into `subject.context`, under `policy.context`. Only
+   * values the server derived belong here, never client input. A throw or a
+   * value that is not a JSON object adds nothing and reports through
    * `on('error')`.
    */
   readonly context?: (request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
-  /** Wraps each instance the factory builds; build it with `wrapPermDock` to cover derived instances. */
+  /**
+   * Wraps each instance the factory builds; build it with `wrapPermDock` to
+   * cover derived instances.
+   */
   readonly wrap?: PermDockWrap;
-  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
+  /**
+   * The `adapter` label on decision events, revocations and approvals. Defaults
+   * to `server`.
+   */
   readonly adapter?: string;
 };
-/** What `deniedResponse` receives: the refusal and the default Problem Details for it. */
+/**
+ * What `deniedResponse` receives: the refusal and the default Problem Details
+ * for it.
+ */
 type DeniedResponseEvent = {
   readonly decision: Exclude<Decision, {
     readonly outcome: "granted";
@@ -147,10 +168,13 @@ type DeniedResponseEvent = {
   readonly problem: ProblemDetails;
   readonly request: Request | undefined;
 };
-/** Returns Problem Details with extra members, a `Response`, or nothing for the default. */
+/**
+ * Returns Problem Details with extra members, a `Response`, or nothing for the
+ * default.
+ */
 type DeniedResponse = (event: DeniedResponseEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
 type OperationScopes = {
-  oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
+  oauthScopesForRequest: (method: string, path: string) => readonly string[] | undefined;
 };
 type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly ok: true;
@@ -162,7 +186,10 @@ type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
-  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  /**
+   * The refusal behind `response`; absent for a missing row or a bad
+   * signature.
+   */
   readonly decision?: Exclude<Decision, {
     readonly outcome: "granted";
   }>;
@@ -179,15 +206,18 @@ type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
-  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  /**
+   * The refusal behind `response`; absent for a missing row or a bad
+   * signature.
+   */
   readonly decision?: Exclude<Decision, {
     readonly outcome: "granted";
   }>;
 };
 type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
 /**
- * `protect(permission, data?, options?)`, or `protect(null, data?,
- * { oauthScopes })` for a route that needs a signed-in principal and, from a
+ * `protect(permission, data?, options?)`, or `protect(null, data?, {
+ * oauthScopes })` for a route that needs a signed-in principal and, from a
  * delegated token, one of the OAuth scopes it declares, but no permission.
  */
 type Protect<V extends PolicyVocabulary = PolicyVocabulary, TArgs extends unknown[] = []> = {
@@ -204,9 +234,9 @@ type OpenApiHooks = {
 };
 type ProtectOptions = {
   /**
-   * `true` when `data` returns a row the server loaded itself, to skip
-   * schema validation. Anything else is validated against the resource
-   * schema before the check.
+   * `true` when `data` returns a row the server loaded itself, to skip schema
+   * validation. Anything else is validated against the resource schema before
+   * the check.
    */
   readonly trusted?: boolean;
   /**
@@ -221,7 +251,10 @@ type ProtectOptions = {
   readonly explain?: boolean;
 };
 type SnapshotQuery = {
-  /** The active tenant; defaults to the `tenant` option resolved from the request. */
+  /**
+   * The active tenant; defaults to the `tenant` option resolved from the
+   * request.
+   */
   readonly tenant?: string;
   readonly include?: SnapshotOptions["include"];
   readonly tenants?: "all";
@@ -234,23 +267,25 @@ type SnapshotQuery = {
 type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly getPermDock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
   /**
-   * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit, Nuxt), built from the
-   * request's cached subject. Send it with `snapshotHeaders(snapshot)`.
+   * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit,
+   * Nuxt), built from the request's cached subject. Send it with
+   * `snapshotHeaders(snapshot)`.
    */
   readonly getSnapshot: (request: Request, query?: SnapshotQuery) => Promise<Snapshot>;
   readonly protect: Protect<V, [scope?: TenantScope]>;
   /**
    * `protect` against an instance the adapter already holds, such as a gateway
-   * connection's: the same OAuth scope check, loader, decision and approval resume.
-   * A method, so a `ServerPermDock<V>` stays assignable to `ServerPermDock`.
+   * connection's: the same OAuth scope check, loader, decision and approval
+   * resume. A method, so a `ServerPermDock<V>` stays assignable to
+   * `ServerPermDock`.
    */
   protectOn<T = unknown>(instance: PermDock<V>, permission: Permission | null, data?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request): Promise<Guard<T, V> | ScopeGuard<T, V>>;
   /** A long-lived connection for a stream or socket opened by `request`. */
   readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>, scope?: TenantScope) => Promise<Connection>;
   /**
    * Lets `to`, a second `Request` an adapter built for the same incoming
-   * request (to re-read a body a parser consumed), reuse the subject and
-   * actor already resolved for `from`.
+   * request (to re-read a body a parser consumed), reuse the subject and actor
+   * already resolved for `from`.
    */
   readonly shareSubject: (from: Request, to: Request) => void;
   readonly problem: (decision: Decision, init?: {

package/dist/{sha256-D9ihqmvd.js → sha256-C-4WXKIu.js}

@@ -69,7 +69,8 @@ function rotr(value, bits) {
 	return value >>> bits | value << 32 - bits;
 }
 /**
-* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and WinterTC-safe.
+* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and
+* WinterTC-safe.
 */
 function sha256(message) {
 	const bytes = new TextEncoder().encode(message);
@@ -142,8 +143,8 @@ function sha256(message) {
 	return out;
 }
 /**
-* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
-* of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256 of
+* `text`. An RFC 9651 sf-token, so it fits a structured header as is.
 */
 function sha256Digest(text) {
 	return `sha-256:${bytesToBase64Url(sha256(text))}`;