permdock 0.7.0 → 0.8.0

package/dist/{schema-gIcCx7zM.js → schema-Dst9I9Gs.js}

@@ -1,6 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { l as packageRoot } from "./version-DMQ0dnN5.js";
+import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -97,9 +98,12 @@ function validatorFor(file) {
 	return compiled;
 }
 function describeErrors(errors) {
-	return (errors ?? []).slice(0, 5).map((error) => `  ${error.instancePath || "/"} ${error.message ?? ""}`).join("\n");
+	return (errors ?? []).slice(0, 5).map((error) => `  ${nonEmptyOr(error.instancePath, "/")} ${error.message ?? ""}`).join("\n");
 }
-/** Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema, and 3.3 against the pinned patch of 3.2. */
+/**
+* Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema,
+* and 3.3 against the pinned patch of 3.2.
+*/
 function validateOpenapi(document) {
 	const version = isRecord(document) ? document["openapi"] : void 0;
 	const match = typeof version === "string" ? /^3\.([123])\.\d+$/u.exec(version) : null;

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
-import { t as SqlQuery } from "../sql-CDEPCA0g.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-DH9DUDEM.js";
+import { t as SqlQuery } from "../sql-B80DFdpG.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-BT5-1VsX.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,3 +1,3 @@
-import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-YNieBO1U.js";
-import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-BL9M_CA1.js";
+import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-DcyrPS-r.js";
 export { APP_DATA_EXTENSION, DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/{scim-C7JYhySg.js → scim-D8YupzX1.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/scim.ts
 const generate = defineLeaf({
 	flags: {
@@ -28,7 +28,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = given(flags.out);
 		const schema = given(flags.schema);
-		const { runScimGenerate } = await import("./generate-3FNO5P5Q.js");
+		const { runScimGenerate } = await import("./generate-CRVV5V7l.js");
 		return runScimGenerate({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{scim-YNieBO1U.js → scim-jJBJ7g1Z.js}

@@ -1,12 +1,12 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { n as sha256, r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { d as membershipEvent, f as memoryDecisionSink } from "./sink-BEZSlMS_.js";
-import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
-import { _ as SCIM_CONTENT_TYPE, b as isDirectoryUniquenessError, c as parseScimFilter, f as ERROR_SCHEMA, g as ROLES_EXTENSION, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "./postgres-store-BL9M_CA1.js";
+import { n as sha256, r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { d as membershipEvent, f as memoryDecisionSink } from "./sink-D9_vh372.js";
+import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-DQhcmqdY.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { _ as SCIM_CONTENT_TYPE, b as isDirectoryUniquenessError, c as parseScimFilter, f as ERROR_SCHEMA, g as ROLES_EXTENSION, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "./postgres-store-DcyrPS-r.js";
 //#region src/scim/auth.ts
 function hexToBytes(hex) {
 	if (hex.length % 2 !== 0) return;
@@ -204,7 +204,10 @@ function schemas() {
 }
 //#endregion
 //#region src/scim/body.ts
-/** The parsed body; `undefined` for an empty or unreadable one. Invalid JSON throws a `SyntaxError`. */
+/**
+* The parsed body; `undefined` for an empty or unreadable one. Invalid JSON
+* throws a `SyntaxError`.
+*/
 async function readJson(request) {
 	const read = await readBodyText(request);
 	if (!read.ok) return read.cause === "too-large" ? { tooLarge: true } : {
@@ -230,7 +233,10 @@ function readRoles(body) {
 	if (!isRecord(extension) || !Array.isArray(extension["roles"])) return;
 	return extension["roles"].filter((item) => typeof item === "string");
 }
-/** `x` from the `AppData` extension; a value that is not a plain JSON object is dropped. */
+/**
+* `x` from the `AppData` extension; a value that is not a plain JSON object is
+* dropped.
+*/
 function readX(body) {
 	const extension = body[APP_DATA_EXTENSION];
 	return isRecord(extension) && extension["x"] !== void 0 ? readAppData(void 0, extension["x"]) : void 0;
@@ -513,7 +519,10 @@ function scimResponse(status, body, extra) {
 		}
 	});
 }
-/** RFC 7644 section 3.12: `scimType` is defined for `400` and `409` only, so other statuses omit it. */
+/**
+* RFC 7644 section 3.12: `scimType` is defined for `400` and `409` only, so
+* other statuses omit it.
+*/
 function scimError(status, scimType, detail, extra) {
 	return scimResponse(status, compact({
 		schemas: [ERROR_SCHEMA],
@@ -529,8 +538,8 @@ function forbidden() {
 	return scimError(403, "", "the credential may not provision this tenant", { "www-authenticate": "Bearer error=\"insufficient_scope\"" });
 }
 /**
-* RFC 7644 section 3.14 `meta.version`: a weak entity tag over the
-* resource as rendered, `meta.location` excluded so every URL agrees.
+* RFC 7644 section 3.14 `meta.version`: a weak entity tag over the resource as
+* rendered, `meta.location` excluded so every URL agrees.
 */
 function withVersion(resource, meta) {
 	const { location: _location, ...stable } = meta;
@@ -554,14 +563,20 @@ function versionOf(rendered) {
 function entityTags(field) {
 	return field.split(",").map((tag) => tag.trim().replace(/^W\//u, "")).filter((tag) => tag !== "");
 }
-/** RFC 9110 section 13.1.1 `If-Match` against a weak `meta.version`: `true` when the request may proceed. */
+/**
+* RFC 9110 section 13.1.1 `If-Match` against a weak `meta.version`: `true` when
+* the request may proceed.
+*/
 function ifMatchHolds(request, version) {
 	const field = request.headers.get("if-match");
 	if (field === null) return true;
 	const tags = entityTags(field);
 	return tags.includes("*") || tags.includes(version.replace(/^W\//u, ""));
 }
-/** RFC 9110 section 13.1.2 `If-None-Match`: `true` when the client holds `version`. */
+/**
+* RFC 9110 section 13.1.2 `If-None-Match`: `true` when the client holds
+* `version`.
+*/
 function ifNoneMatchHolds(request, version) {
 	const field = request.headers.get("if-none-match");
 	if (field === null) return false;
@@ -720,7 +735,10 @@ function resourceResponse(status, rendered, location) {
 function renderedOf(request, resource) {
 	return "userName" in resource ? renderUser(resource, locationOf(request, "Users", resource.id)) : renderGroup(resource, locationOf(request, "Groups", resource.id));
 }
-/** `false` when `If-Match` names a version other than `current`'s; a missing resource passes to the store. */
+/**
+* `false` when `If-Match` names a version other than `current`'s; a missing
+* resource passes to the store.
+*/
 function matches(request, current) {
 	return current === null || ifMatchHolds(request, versionOf(renderedOf(request, current)));
 }

package/dist/{scopes-BHsc-wp-.js → scopes-0Up_UA2t.js}

@@ -1,12 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { i as idText, n as expirySeconds } from "./expiry-D4_YKRKD.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { i as idText, n as expirySeconds } from "./expiry-6XByK0dm.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
 //#region src/core/scopes.ts
 const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
 const NAME = /^[a-z][a-z0-9_]*$/u;
-/** A policy without `scopes` keeps the historical pair: `tenant`, and `team` inside it. */
+/**
+* A policy without `scopes` keeps the historical pair: `tenant`, and `team`
+* inside it.
+*/
 const IMPLICIT = Object.freeze([Object.freeze({ name: "tenant" }), Object.freeze({
 	name: "team",
 	within: "tenant"
@@ -17,9 +20,9 @@ function fail(message) {
 /**
 * Validates `definePolicy({ scopes })`. Declaration order is the scope order;
 * every scope after the first names an earlier one in `within`, so the scopes
-* form one tree rooted at the first and have no cycles.
-* A scope named `tenant` is the first and `team` the second, so the aliases
-* never point at two different scopes.
+* form one tree rooted at the first and have no cycles. A scope named `tenant`
+* is the first and `team` the second, so the aliases never point at two
+* different scopes.
 */
 function defineScopes(input) {
 	if (input === void 0) return Object.freeze([]);
@@ -49,7 +52,10 @@ function defineScopes(input) {
 	}
 	return Object.freeze(out);
 }
-/** The scopes a policy or snapshot evaluates with: the declared list, or the implicit pair. */
+/**
+* The scopes a policy or snapshot evaluates with: the declared list, or the
+* implicit pair.
+*/
 function scopeList(declared) {
 	return declared === void 0 || declared.length === 0 ? IMPLICIT : declared;
 }
@@ -77,7 +83,10 @@ function scopeChain(scopes, name) {
 function rootScope(scopes) {
 	return scopes[0]?.name;
 }
-/** The id a membership holds for `scope`: its own id, or the `within` entry of an ancestor. */
+/**
+* The id a membership holds for `scope`: its own id, or the `within` entry of
+* an ancestor.
+*/
 function scopeIdOf(membership, scope) {
 	if (membership.scope === scope) return membership.id;
 	const within = membership.within;
@@ -85,19 +94,25 @@ function scopeIdOf(membership, scope) {
 	return within[scope];
 }
 /**
-* A membership of the first scope itself (the only scope without a parent):
-* its id is a tenant. Needs no scope list, for code that holds only a subject.
+* A membership of the first scope itself (the only scope without a parent): its
+* id is a tenant. Needs no scope list, for code that holds only a subject.
 */
 function rootMembershipId(membership) {
 	if (membership.scope !== void 0) return membership.within === void 0 ? membership.id : void 0;
 	return membership.team === void 0 ? membership.tenant : void 0;
 }
-/** The instance of the first scope a membership sits in; what the active tenant selects. */
+/**
+* The instance of the first scope a membership sits in; what the active tenant
+* selects.
+*/
 function tenantOf(membership, scopes) {
 	const root = rootScope(scopes);
 	return root === void 0 ? void 0 : scopeIdOf(membership, root);
 }
-/** A non-empty string. Unlike `isId` in `./ids.ts` it has no length cap: membership fields come from the app, not the wire. */
+/**
+* A non-empty string. Unlike `isId` in `./ids.ts` it has no length cap:
+* membership fields come from the app, not the wire.
+*/
 function isNonEmptyString(value) {
 	return typeof value === "string" && value !== "";
 }
@@ -107,10 +122,10 @@ function roleList(value) {
 }
 /**
 * The canonical form of one membership, or `undefined` when it is malformed
-* (fail-closed: it grants nothing). A named membership is
-* `{ scope, id, within }` with one `within` entry per ancestor of `scope`;
-* the `tenant` / `team` input shape and alias names normalise to it. A
-* resource membership keeps `on`. Shapes are exclusive.
+* (fail-closed: it grants nothing). A named membership is `{ scope, id, within
+* }` with one `within` entry per ancestor of `scope`; the `tenant` / `team`
+* input shape and alias names normalise to it. A resource membership keeps
+* `on`. Shapes are exclusive.
 */
 function normalizeMembership(input, scopes) {
 	if (input === null || typeof input !== "object" || Array.isArray(input)) return;
@@ -212,8 +227,8 @@ function normalizeMemberships(input, scopes) {
 }
 /**
 * A subject's memberships in canonical form. Resolved subjects already are;
-* this accepts a hand-built subject passed straight to a condition evaluator
-* or compiler.
+* this accepts a hand-built subject passed straight to a condition evaluator or
+* compiler.
 */
 function subjectMemberships(memberships, scopes) {
 	const list = memberships ?? [];
@@ -228,13 +243,16 @@ function activeFor(membership, scopes, active) {
 	if (root === void 0 || membership.scope === void 0 || !scopeChain(scopes, membership.scope).includes(root)) return true;
 	return active !== void 0 && scopeIdOf(membership, root) === active;
 }
-/** Whether `membership` counts for `key`: always, unless a suspension limits it to `keep`. */
+/**
+* Whether `membership` counts for `key`: always, unless a suspension limits it
+* to `keep`.
+*/
 function keepsPermission(membership, key) {
 	return membership.keep === void 0 || membership.keep.includes(key);
 }
 /**
-* The subject as it stands for one permission: memberships a suspension
-* limits to other permissions are left out. The same object when none is.
+* The subject as it stands for one permission: memberships a suspension limits
+* to other permissions are left out. The same object when none is.
 */
 function subjectForPermission(subject, key) {
 	const principal = subject.principal;

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CQpoquwj.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-B_Qg9D3e.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-YGg2mXyH.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-zi_4T-rx.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-R07lFBnX.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-C4gZUEZy.js";
-import { i as evaluationsHandler } from "../evaluations-BCddEOfO.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-BSfRl0hZ.js";
-import { l as ReplayStore } from "../types-cTos-H7p.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-B_qRg0ws.js";
-import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-Pahd3IYJ.js";
-import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-BpNi7BCi.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CIlpSA2G.js";
+import { i as evaluationsHandler } from "../evaluations-z8dQFDaN.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8s204GL.js";
+import { l as ReplayStore } from "../types-DjuMBNF9.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-C-qX4mJW.js";
+import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
+import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-DbWI9f99.js";
 export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -1,14 +1,14 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DT2Kx1F8.js";
-import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { n as tenantScope } from "../adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "../create-DJrlhEp9.js";
-import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-Bnga6I50.js";
-import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-B5d_63Ma.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-DgFFD-Ga.js";
+import { c as problemFromDecision, f as validationProblem, l as problemResponse, p as wwwAuthenticate } from "../problem-BVLHFK33.js";
+import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
+import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { n as tenantScope } from "../adapter-context-CIQpQxbE.js";
+import { t as createPermDock } from "../create-_noSrY1T.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-3cVlTLde.js";
+import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-Dv7aF7Dk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-D67a3nzk.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-Bnga6I50.js → server-3cVlTLde.js}

@@ -1,13 +1,13 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-DkWjdL98.js";
-import { t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
-import { n as parseSupportSession } from "./support-session-Cna49-3f.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { f as nowMillis, g as secondsOf, m as rfc3339, o as epochSeconds, u as isoAt } from "./time-nR1JesoH.js";
+import { t as bytesToBase64Url } from "./sha256-C-4WXKIu.js";
+import { n as parseSupportSession } from "./support-session-BsmPCbz8.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { c as credentialEvent } from "./sink-BEZSlMS_.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-CIM7wHwA.js";
+import { c as credentialEvent } from "./sink-D9_vh372.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-CyyyvCsL.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;
@@ -41,8 +41,8 @@ function checksum(text, alphabet) {
 /**
 * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
 * the secret 43 base62 characters and the checksum the 6 base62 characters of
-* the CRC-32 of everything before it. Anything else, including a checksum
-* that does not match, is `undefined`.
+* the CRC-32 of everything before it. Anything else, including a checksum that
+* does not match, is `undefined`.
 */
 function parseApiKey(key) {
 	if (typeof key !== "string" || key.length > MAX_KEY || !key.startsWith(PREFIX)) return;
@@ -63,9 +63,9 @@ const FEED_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
 const FEED_SECRET_LENGTH = 26;
 const FEED_TAIL = /* @__PURE__ */ new RegExp(`^[a-z2-7]{${String(32)}}$`, "u");
 /**
-* Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is
-* 26 lowercase base32 characters and the checksum is 6 more. A checksum that
-* does not match is `undefined`.
+* Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is 26
+* lowercase base32 characters and the checksum is 6 more. A checksum that does
+* not match is `undefined`.
 */
 function parseFeedKey(key) {
 	if (typeof key !== "string" || key.length > 56 || !key.startsWith(FEED_PREFIX)) return;
@@ -82,8 +82,8 @@ function parseFeedKey(key) {
 	} : void 0;
 }
 /**
-* A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters
-* (130 bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
+* A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters (130
+* bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
 */
 function generateFeedKey(id) {
 	if (!isFeedId(id)) throw new TypeError("PermDock: a feed id is 1 to 16 of a-z, 0-9 and -");
@@ -124,11 +124,11 @@ function sameHash(left, right) {
 	return difference === 0;
 }
 /**
-* A `CredentialVerifier` over the application's own table: `find` looks a
-* key up by the id in it, and the key's hash is compared in constant time.
-* A record that is not a valid v1 credential, or whose id is not the key's,
-* verifies to `null`. A throwing `find` propagates, so the resolver denies
-* with `source-threw`.
+* A `CredentialVerifier` over the application's own table: `find` looks a key
+* up by the id in it, and the key's hash is compared in constant time. A record
+* that is not a valid v1 credential, or whose id is not the key's, verifies to
+* `null`. A throwing `find` propagates, so the resolver denies with
+* `source-threw`.
 */
 function apiKeyVerifier(options) {
 	return Object.freeze({
@@ -266,10 +266,10 @@ function anonymous() {
 }
 /**
 * Resolves an opaque API key (`pdk_<id>_<secret>`) into the subject its
-* credential acts as. Every failure (a malformed or unknown key, a record
-* that is not a valid credential, expiry, a tenant policy the key breaks, a
-* revoked id, a missing owner, a throwing verifier, source or callback) is
-* the anonymous subject, never a throw.
+* credential acts as. Every failure (a malformed or unknown key, a record that
+* is not a valid credential, expiry, a tenant policy the key breaks, a revoked
+* id, a missing owner, a throwing verifier, source or callback) is the
+* anonymous subject, never a throw.
 */
 async function subjectFromApiKey(key, options) {
 	const tenant = options.tenant;
@@ -314,8 +314,8 @@ async function subjectFromApiKey(key, options) {
 const SUPPORT_SESSION_TYP = "vnd.permdock.support-session+jwt";
 /**
 * Signs a granted `SupportSession` as a `vnd.permdock.support-session+jwt`
-* (`sub` the viewed principal, `act` the support actor, `jti` the session
-* id) that expires with the session. Throws a `TypeError` for a record
+* (`sub` the viewed principal, `act` the support actor, `jti` the session id)
+* that expires with the session. Throws a `TypeError` for a record
 * `parseSupportSession` refuses.
 */
 function signSupportSession(session, signer, options = {}) {
@@ -380,11 +380,11 @@ async function ended(sessions, id) {
 	}
 }
 /**
-* Resolves a `vnd.permdock.support-session+jwt` into the subject each
-* request of the session acts as: the viewed principal loaded live, a
-* `support` actor, the session's permissions as the delegation and
-* `context.supportSession`. The actor must still exist. Every failure is the
-* anonymous subject, never a throw.
+* Resolves a `vnd.permdock.support-session+jwt` into the subject each request
+* of the session acts as: the viewed principal loaded live, a `support` actor,
+* the session's permissions as the delegation and `context.supportSession`. The
+* actor must still exist. Every failure is the anonymous subject, never a
+* throw.
 */
 async function subjectFromSupportSession(token, options) {
 	if (typeof token !== "string" || token.length === 0) return anonymousSubject();