permdock 0.7.0 → 0.9.0

package/dist/{approvers-CqPOLD-o.js → approvers-B4r0N_Uz.js}

@@ -1,6 +1,9 @@
 import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 //#region src/core/approvers.ts
-/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+/**
+* Approves when the approver holds `permission` in the request's tenant (any
+* role, custom roles included).
+*/
 function holder(permission) {
 	const key = permission?.key;
 	if (typeof key !== "string" || key === "") throw new Error("PermDock: holder() needs a permission");
@@ -38,7 +41,10 @@ function flattenApprovers(input) {
 	if (isReadonlyArray(input)) return input;
 	return [input];
 }
-/** Every approver `input` names, inside `anyOf` groups too, for reading facts and labels. */
+/**
+* Every approver `input` names, inside `anyOf` groups too, for reading facts
+* and labels.
+*/
 function approverLeaves(input) {
 	return flattenApprovers(input).flatMap((item) => item.kind === "any-of" ? item.of.flatMap((entry) => approverLeaves(entry)) : [item]);
 }

package/dist/{arazzo-ClrF3PVb.js → arazzo-BpS7LnV0.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, u as permissionsFlag } from "./flags-aaeRAdiD.js";
+import { c as given, u as permissionsFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/arazzo.ts
 const check = defineLeaf({
 	flags: {
@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-rdeJ8n1J.js")).runArazzo({
+		return (await import("./arazzo-CmQaGPkM.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-rdeJ8n1J.js → arazzo-CmQaGPkM.js}

@@ -1,9 +1,9 @@
-import { _ as arazzoFindings } from "./src-DLFrtrrC.js";
-import { c as missingInput } from "./errors-DpP_U6Bf.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as ARAZZO_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { _ as arazzoFindings } from "./src-C_pi2Rnh.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{args-CC3OwyHW.js → args-0FrVs5EH.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
 //#region ../../node_modules/.pnpm/fastest-levenshtein@1.0.16/node_modules/fastest-levenshtein/esm/mod.js
 const peq = /* @__PURE__ */ new Uint32Array(65536);
 const myers_32 = (a, b) => {
@@ -185,7 +185,10 @@ function suggestion(given, names) {
 	const best = didYouMean(given, names);
 	return best === void 0 ? "" : ` Did you mean ${best}?`;
 }
-/** Every spelling a flag set accepts: `--name`, `--no-name` for booleans, `-x` aliases. */
+/**
+* Every spelling a flag set accepts: `--name`, `--no-name` for booleans, `-x`
+* aliases.
+*/
 function lookupOf(flags) {
 	const lookup = /* @__PURE__ */ new Map();
 	for (const [name, flag] of Object.entries(flags)) {
@@ -207,7 +210,10 @@ function lookupOf(flags) {
 function flagSpellings(flags) {
 	return [...lookupOf(flags).keys()];
 }
-/** A value never starts with `-`, bar `-` itself: `--out --check` is a bare `--out`. */
+/**
+* A value never starts with `-`, bar `-` itself: `--out --check` is a bare
+* `--out`.
+*/
 function isValue(token) {
 	return token !== void 0 && (token === "-" || !token.startsWith("-"));
 }
@@ -218,8 +224,8 @@ function checkEnum(command, name, flag, value) {
 	if (flag.type === "enum" && !flag.options.includes(value)) throw new CliError("usage", `${command}: --${name} ${value === "" ? "needs a value" : `'${value}' is not one of ${flag.options.join(", ")}`}.${suggestion(value, flag.options)}`, { code: "invalid_value" });
 }
 /**
-* Splits argv into the flags `flags` declares, positionals and the tokens
-* after `--`. An undeclared flag is a usage error naming the nearest one.
+* Splits argv into the flags `flags` declares, positionals and the tokens after
+* `--`. An undeclared flag is a usage error naming the nearest one.
 * `--name=value`, `--name value`, `--no-name` and `-x` aliases all read.
 */
 function parseFlags(command, argv, flags) {
@@ -244,11 +250,12 @@ function parseFlags(command, argv, flags) {
 		const flag = flags[found.name];
 		if (flag === void 0) continue;
 		if (flag.type === "boolean") {
-			if (eq !== -1) {
+			if (eq === -1) values.set(found.name, !found.negated);
+			else {
 				const raw = token.slice(eq + 1);
 				if (raw !== "true" && raw !== "false") throw new CliError("usage", `${command}: ${spelling} takes true or false, got '${raw}'`, { code: "invalid_value" });
 				values.set(found.name, raw === "true" !== found.negated);
-			} else values.set(found.name, !found.negated);
+			}
 			continue;
 		}
 		let value;

package/dist/astro/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { APIContext, MiddlewareHandler } from "astro";
 //#region src/astro/create.d.ts
 type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;
@@ -12,7 +12,10 @@ type AstroPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVoc
   readonly permdock: PermDock<V>;
   readonly permdockData: TData;
 };
-/** The context a wrapped endpoint receives: its own `APIContext` with typed `locals`. */
+/**
+ * The context a wrapped endpoint receives: its own `APIContext` with typed
+ * `locals`.
+ */
 type AstroPermDockContext<TContext extends APIContext = APIContext, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TContext & {
   readonly locals: AstroPermDockLocals<TData, V>;
 };
@@ -23,18 +26,33 @@ type AstroProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
   <TOperation extends Operation>(operation: TOperation, input?: ContextReader<APIContext, OperationInput<TOperation>>, protectOptions?: ProtectOptions): AstroGuarded<unknown, V>;
 };
 type AstroPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** `onRequest` in `src/middleware.ts`: sets `context.locals.permdock`; a bad Web Bot Auth signature is a `401`. */
+  /**
+   * `onRequest` in `src/middleware.ts`: sets `context.locals.permdock`; a bad
+   * Web Bot Auth signature is a `401`.
+   */
   readonly middleware: () => MiddlewareHandler;
-  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  /**
+   * `export const DELETE = protect(permissions.post.delete,
+   * loadPost)(handler)`.
+   */
   readonly protect: AstroProtect<V>;
-  /** Types `context.locals.permdock` for an endpoint and answers a thrown PermDock error with Problem Details. */
+  /**
+   * Types `context.locals.permdock` for an endpoint and answers a thrown
+   * PermDock error with Problem Details.
+   */
   readonly withPermDock: AstroGuarded<unknown, V>;
-  /** The instance for an endpoint, an action or a page's frontmatter (`Astro` is an `APIContext`). */
+  /**
+   * The instance for an endpoint, an action or a page's frontmatter (`Astro` is
+   * an `APIContext`).
+   */
   readonly getPermDock: (context: APIContext) => Promise<PermDock<V>>;
   /** The snapshot a page passes to a `permdock/react` island. */
   readonly getSnapshot: (context: APIContext, query?: SnapshotQuery) => Promise<Snapshot>;
   readonly connection: (context: APIContext, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  /** `export const { GET, POST } = permdockHandler()` in `src/pages/api/permdock.ts`. */
+  /**
+   * `export const { GET, POST } = permdockHandler()` in
+   * `src/pages/api/permdock.ts`.
+   */
   readonly permdockHandler: () => PermDockHandlers<APIContext>;
   readonly openapi: OpenApiHooks;
 };

package/dist/astro/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/astro/create.ts
 const route = {
 	context: (context) => context,

package/dist/{audience-BrMs8c4o.js → audience-DTjR8xet.js}

@@ -1,10 +1,11 @@
-import { t as whoCan } from "./who-can-BwNsI_Js.js";
+import { t as whoCan } from "./who-can-BoDJm0Nc.js";
 //#region src/delivery/audience.ts
 async function granted(permdock, ids, permission, row) {
 	const unique = [...new Set(ids.filter((id) => typeof id === "string" && id !== ""))];
 	const decisions = await Promise.all(unique.map(async (id) => {
 		try {
-			return (await permdock.decideFor(id, permission, row)).outcome;
+			const { outcome } = await permdock.decideFor(id, permission, row);
+			return outcome;
 		} catch {
 			return "denied";
 		}
@@ -14,8 +15,8 @@ async function granted(permdock, ids, permission, row) {
 /**
 * Who may receive a delivery about `row`: the holders `whoCan` lists (or
 * `candidates`), kept only where `decideFor` grants `permission` in the
-* sender's active tenant. A collection permission has no holders to list,
-* so it needs `candidates`; without them it is empty and incomplete.
+* sender's active tenant. A collection permission has no holders to list, so it
+* needs `candidates`; without them it is empty and incomplete.
 */
 async function audience(permdock, permission, row, options = {}) {
 	if (options.candidates !== void 0) return Object.freeze({
@@ -41,10 +42,9 @@ async function audience(permdock, permission, row, options = {}) {
 	});
 }
 /**
-* The subscribers whose principal `decideFor` grants the event's
-* permission on its row, in their order: the per-event filter for webhook
-* endpoints and realtime channels. A subscriber without a string
-* `principal` is dropped.
+* The subscribers whose principal `decideFor` grants the event's permission on
+* its row, in their order: the per-event filter for webhook endpoints and
+* realtime channels. A subscriber without a string `principal` is dropped.
 */
 async function subscribersFor(permdock, event, subscribers) {
 	const ids = subscribers.map((subscriber) => subscriber.principal).filter((id) => typeof id === "string");

package/dist/{auth-CscUX8Sy.js → auth--yPyZNgr.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { a as refreshCredential, c as stringField, n as discoverAuthorizationServer } from "./device-BARQ8eYG.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as refreshCredential, c as stringField, n as discoverAuthorizationServer } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { t as CLOUD_BASE_URL } from "./base-url-BQbddZO5.js";
 import { existsSync } from "node:fs";
@@ -15,7 +15,10 @@ function firstNonEmpty(...values) {
 	for (const value of values) if (value !== void 0 && value !== "") return value;
 	return "";
 }
-/** `--url`, then `PERMDOCK_CLOUD_URL`, then the platform issuer; never a trailing slash. */
+/**
+* `--url`, then `PERMDOCK_CLOUD_URL`, then the platform issuer; never a
+* trailing slash.
+*/
 function cloudUrl(flag, env) {
 	return firstNonEmpty(flag, env["PERMDOCK_CLOUD_URL"], CLOUD_BASE_URL).replace(/\/+$/u, "");
 }
@@ -54,7 +57,10 @@ function isHttps(value, issuer) {
 }
 //#endregion
 //#region src/cli/cloud/auth.ts
-/** The service name credentials are stored under, in the keychain or the config directory. */
+/**
+* The service name credentials are stored under, in the keychain or the config
+* directory.
+*/
 const CREDENTIAL_SERVICE = "permdock";
 /** Seconds before `expires_at` at which a stored access token counts as expired. */
 const EXPIRY_SKEW_SECONDS = 30;
@@ -98,7 +104,10 @@ function repositoryRoot(cwd) {
 		dir = parent;
 	}
 }
-/** The credentials file when it would land inside the repository at `cwd`; `null` when it is outside. */
+/**
+* The credentials file when it would land inside the repository at `cwd`;
+* `null` when it is outside.
+*/
 function credentialsInsideRepository(cwd, runtime) {
 	const root = repositoryRoot(cwd);
 	if (root === null) return null;
@@ -159,7 +168,10 @@ async function readAuth(command, issuer, env, runtime) {
 		source: "login"
 	};
 }
-/** The bearer for `cloud push`: `PERMDOCK_CLOUD_KEY`, then a login holding `catalog:write`. */
+/**
+* The bearer for `cloud push`: `PERMDOCK_CLOUD_KEY`, then a login holding
+* `catalog:write`.
+*/
 async function pushAuth(issuer, env, runtime) {
 	const key = env["PERMDOCK_CLOUD_KEY"];
 	if (key !== void 0 && key !== "") return {

package/dist/authzen/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, Zn as Actor, rr as Delegation, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "../types-DC44-hqb.js";
-import { a as ProblemDetails } from "../errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
-import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-BCddEOfO.js";
+import { T as Policy, lr as Delegation, pr as Principal, rr as Actor } from "../policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-DOWuBpWv.js";
 //#region src/authzen/map.d.ts
 type AuthzenEntity = {
   readonly type?: unknown;
@@ -32,7 +32,10 @@ type AuthzenSubject = {
   readonly type: "user";
   readonly id: string;
 };
-/** What `search/subject` asks a lister for: candidates of `type` for one action on one resource. */
+/**
+ * What `search/subject` asks a lister for: candidates of `type` for one action
+ * on one resource.
+ */
 type AuthzenSubjectQuery = {
   readonly type: string;
   readonly action: AuthzenEntity;
@@ -40,9 +43,9 @@ type AuthzenSubjectQuery = {
   readonly context?: unknown;
 };
 /**
- * The principals a policy decision point may answer `search/subject` with,
- * the way `AuthzenResourceAdapter.list` supplies rows. Each record is decided
- * as `{ type: "user", id, properties }`; only candidates that are granted are
+ * The principals a policy decision point may answer `search/subject` with, the
+ * way `AuthzenResourceAdapter.list` supplies rows. Each record is decided as `{
+ * type: "user", id, properties }`; only candidates that are granted are
  * returned, so a lister may answer a superset.
  */
 type AuthzenSubjectLister = {
@@ -62,10 +65,10 @@ type SearchActionsOptions = AuthzenSearchOptions & {
   readonly data?: unknown;
 };
 /**
- * The AuthZEN `search/action` answer for `user` on `resource`: every
- * permission of `resource.type` in the policy is decided, and the distinct
- * actions of the granted ones are returned in catalog order. Paging is the
- * caller's (`authzenPage`).
+ * The AuthZEN `search/action` answer for `user` on `resource`: every permission
+ * of `resource.type` in the policy is decided, and the distinct actions of the
+ * granted ones are returned in catalog order. Paging is the caller's
+ * (`authzenPage`).
  */
 export declare function searchActions<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, user: TUser, resource: AuthzenEntity & {
   readonly type: string;
@@ -73,8 +76,8 @@ export declare function searchActions<TUser, TPrincipal extends Principal = Prin
 /**
  * The AuthZEN `search/subject` answer: the candidates `lister` returns for
  * `request`, each decided as itself, filtered to those granted `action` on
- * `resource`. An unknown action, a subject type other than `user`, or a
- * lister that throws answers none.
+ * `resource`. An unknown action, a subject type other than `user`, or a lister
+ * that throws answers none.
  */
 export declare function searchSubjects<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, lister: AuthzenSubjectLister, request: AuthzenItem & {
   readonly subject: {
@@ -99,9 +102,9 @@ type AuthzenPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject: (request: Request) => TUser | Promise<TUser>;
   readonly anonymous?: boolean;
   /**
-   * Allow-list over the authenticated PEP. Only a PEP it returns `true` for
-   * may evaluate the body's `subject`, `actor` and `delegation`; every other
-   * caller is evaluated as itself. Off by default.
+   * Allow-list over the authenticated PEP. Only a PEP it returns `true` for may
+   * evaluate the body's `subject`, `actor` and `delegation`; every other caller
+   * is evaluated as itself. Off by default.
    */
   readonly trustedPep?: (pep: unknown) => boolean;
   readonly resources?: Readonly<Record<string, AuthzenResourceAdapter>>;
@@ -129,7 +132,10 @@ type AuthzenPageRequest = {
 type AuthzenPage<T> = {
   readonly results: readonly T[];
   readonly page: {
-    /** The offset of the next page as a decimal string, or `""` on the last page. */
+    /**
+     * The offset of the next page as a decimal string, or `""` on the last
+     * page.
+     */
     readonly next_token: string;
     readonly count: number;
     readonly total: number;
@@ -150,10 +156,10 @@ export declare function emptyAuthzenPage<T>(): AuthzenPage<T>;
 type AuthzenRequestKind = "evaluation" | "evaluations" | "search/subject" | "search/resource" | "search/action";
 type AuthzenSearchKind = Extract<AuthzenRequestKind, `search/${string}`>;
 /**
- * A checked AuthZEN request. An `evaluations` body with no items is the
- * single evaluation AuthZEN 1.0 section 7.1 makes it, so it parses as
- * `kind: "evaluation"`; the `evaluations` items already carry the shared
- * top-level fields.
+ * A checked AuthZEN request. An `evaluations` body with no items is the single
+ * evaluation AuthZEN 1.0 section 7.1 makes it, so it parses as `kind:
+ * "evaluation"`; the `evaluations` items already carry the shared top-level
+ * fields.
  */
 type AuthzenRequest = AuthzenEvaluationRequest | AuthzenEvaluationsRequest | AuthzenSearchRequest;
 type AuthzenEvaluationRequest = {
@@ -185,14 +191,14 @@ type ParseAuthzenRequestOptions = {
 };
 /**
  * Checks a parsed AuthZEN body the way `permdock/authzen` answers it: the body
- * is an object, then each required entity and field in a fixed order, then
- * the `evaluations` array, batch size and semantic. A failure is the 400 (or
- * 413) Problem Details the handler sends, with the same `detail`.
+ * is an object, then each required entity and field in a fixed order, then the
+ * `evaluations` array, batch size and semantic. A failure is the 400 (or 413)
+ * Problem Details the handler sends, with the same `detail`.
  */
 export declare function parseAuthzenRequest<K extends AuthzenRequestKind>(kind: K, body: unknown, options?: ParseAuthzenRequestOptions): ParseAuthzenRequestResult<AuthzenRequestOf<K>>;
 /**
- * Reads `request` as an AuthZEN body: `Content-Type: application/json`, at
- * most 1 MiB (a 413 above it), valid JSON, then `parseAuthzenRequest`.
+ * Reads `request` as an AuthZEN body: `Content-Type: application/json`, at most
+ * 1 MiB (a 413 above it), valid JSON, then `parseAuthzenRequest`.
  */
 export declare function readAuthzenRequest<K extends AuthzenRequestKind>(kind: K, request: Request, options?: ParseAuthzenRequestOptions): Promise<ParseAuthzenRequestResult<AuthzenRequestOf<K>>>;
 //#endregion

package/dist/authzen/index.js

@@ -1,14 +1,14 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { r as ownGet } from "../paths-DXSHAMIa.js";
-import { a as problemType, o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-DpPtSKNZ.js";
+import { r as ownGet } from "../paths-CUvURzHp.js";
+import { a as problemType, o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { t as fromWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as readBodyText, t as MAX_BODY_BYTES } from "../body-text-QcXok_SI.js";
-import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { a as methodNotAllowed, c as problemResponse, u as unauthenticatedProblem } from "../problem-CTviyH5L.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-DxE7czo9.js";
-import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-DReoiVBw.js";
+import { n as readBodyText, t as MAX_BODY_BYTES } from "../body-text-DQhcmqdY.js";
+import { r as hasCredentials } from "../http-DKLXrFGk.js";
+import { d as unauthenticatedProblem, l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
+import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-IBceAeKT.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {
 	outcome: "denied",
@@ -40,7 +40,10 @@ function permissionOf(lookup, item) {
 function resourceData(item) {
 	return itemResourceData(item.resource);
 }
-/** The row id an item names; `undefined` for none and for the collection sentinel `id: "*"`. */
+/**
+* The row id an item names; `undefined` for none and for the collection
+* sentinel `id: "*"`.
+*/
 function resourceIdOf(item) {
 	return wireResourceId(item.resource?.id);
 }
@@ -251,9 +254,9 @@ function evaluations(body, maxEvaluations) {
 }
 /**
 * Checks a parsed AuthZEN body the way `permdock/authzen` answers it: the body
-* is an object, then each required entity and field in a fixed order, then
-* the `evaluations` array, batch size and semantic. A failure is the 400 (or
-* 413) Problem Details the handler sends, with the same `detail`.
+* is an object, then each required entity and field in a fixed order, then the
+* `evaluations` array, batch size and semantic. A failure is the 400 (or 413)
+* Problem Details the handler sends, with the same `detail`.
 */
 function parseAuthzenRequest(kind, body, options = {}) {
 	return parseAny(kind, body, options);
@@ -283,8 +286,8 @@ function parseAny(kind, body, options) {
 	}
 }
 /**
-* Reads `request` as an AuthZEN body: `Content-Type: application/json`, at
-* most 1 MiB (a 413 above it), valid JSON, then `parseAuthzenRequest`.
+* Reads `request` as an AuthZEN body: `Content-Type: application/json`, at most
+* 1 MiB (a 413 above it), valid JSON, then `parseAuthzenRequest`.
 */
 async function readAuthzenRequest(kind, request, options = {}) {
 	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return invalid("AuthZEN requests must use Content-Type: application/json");
@@ -358,10 +361,10 @@ function scopeOf(options) {
 	};
 }
 /**
-* The AuthZEN `search/action` answer for `user` on `resource`: every
-* permission of `resource.type` in the policy is decided, and the distinct
-* actions of the granted ones are returned in catalog order. Paging is the
-* caller's (`authzenPage`).
+* The AuthZEN `search/action` answer for `user` on `resource`: every permission
+* of `resource.type` in the policy is decided, and the distinct actions of the
+* granted ones are returned in catalog order. Paging is the caller's
+* (`authzenPage`).
 */
 async function searchActions(policy, user, resource, options = {}) {
 	const { permdock } = await buildInstance({
@@ -377,8 +380,8 @@ async function searchActions(policy, user, resource, options = {}) {
 /**
 * The AuthZEN `search/subject` answer: the candidates `lister` returns for
 * `request`, each decided as itself, filtered to those granted `action` on
-* `resource`. An unknown action, a subject type other than `user`, or a
-* lister that throws answers none.
+* `resource`. An unknown action, a subject type other than `user`, or a lister
+* that throws answers none.
 */
 async function searchSubjects(policy, lister, request, options = {}) {
 	const permission = permissionOf(permissionLookup(policy.permissions), request);

package/dist/{automation-DOtAFWdy.d.ts → automation-C6Jg75xq.d.ts}

@@ -1,18 +1,18 @@
-import { Lt as InstanceHandle, Rn as Denial, Rt as Instant } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { t as Operation } from "./operations-BNLes61x.js";
+import { Ut as InstanceHandle, Wn as Denial, Wt as Instant } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { t as Operation } from "./operations-Ci_rT6Uo.js";
 //#region src/core/automation.d.ts
 /**
  * Who an automation runs as. `publisher`: the person who published it, with
- * their rights as of each run. `service`: a `kind: 'service'` principal
- * holding `roles` in `tenant`, capped at what the publisher could assign.
+ * their rights as of each run. `service`: a `kind: 'service'` principal holding
+ * `roles` in `tenant`, capped at what the publisher could assign.
  */
 type AutomationMode = "publisher" | "service";
 /**
- * Automation v1: a published, versioned run of operations. Every run acts
- * as `principal` with live rights, narrowed to `permissions` (the
- * operations' permissions) and to any policy delegation to
- * `actor('automation')`. The event that triggers a run never grants.
+ * Automation v1: a published, versioned run of operations. Every run acts as
+ * `principal` with live rights, narrowed to `permissions` (the operations'
+ * permissions) and to any policy delegation to `actor('automation')`. The event
+ * that triggers a run never grants.
  */
 type Automation = {
   readonly v: 1;
@@ -32,7 +32,10 @@ type Automation = {
   readonly operations: readonly string[];
   /** The delegation: the permission keys of `operations`. */
   readonly permissions: readonly string[];
-  /** The permission key a caller needs to start a run; absent, only server code starts one. */
+  /**
+   * The permission key a caller needs to start a run; absent, only server code
+   * starts one.
+   */
   readonly run?: string;
   readonly revoked?: boolean;
   readonly name?: string;
@@ -41,16 +44,22 @@ type Automation = {
 type AutomationSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  /** The automation as of now, or `null` for an unknown one. A throw is no automation. */
-  automation(id: string, options?: {
+  /**
+   * The automation as of now, or `null` for an unknown one. A throw is no
+   * automation.
+   */
+  automation: (id: string, options?: {
     readonly tenant?: string;
-  }): Automation | null | Promise<Automation | null>;
+  }) => Automation | null | Promise<Automation | null>;
 };
 type OperationRef = Pick<Operation, "name" | "permission">;
 type AutomationRequest = {
   readonly id: string;
   readonly version: number | string;
-  /** The operations the automation runs: entries of an `OperationMap`, or the map itself. */
+  /**
+   * The operations the automation runs: entries of an `OperationMap`, or the
+   * map itself.
+   */
   readonly operations: readonly OperationRef[] | Readonly<Record<string, OperationRef>>;
   /** Defaults to `'publisher'`. */
   readonly mode?: AutomationMode;
@@ -76,38 +85,39 @@ type DecideAutomationOptions = {
   readonly now?: Instant;
 };
 /**
- * Validates an untrusted automation record and returns a frozen copy with
- * only the v1 fields, or `undefined`. A service automation needs `tenant`
- * and `roles`; a publisher automation runs as `publishedBy` and has no
- * `roles`.
+ * Validates an untrusted automation record and returns a frozen copy with only
+ * the v1 fields, or `undefined`. A service automation needs `tenant` and
+ * `roles`; a publisher automation runs as `publishedBy` and has no `roles`.
  */
 declare function parseAutomation(input: unknown): Automation | undefined;
 type MemoryAutomationSource = {
-  automation(id: string, options?: {
+  automation: (id: string, options?: {
     readonly tenant?: string;
-  }): Automation | null;
+  }) => Automation | null;
   /** Adds or replaces a record by id; an invalid record throws. */
-  put(automation: Automation): void;
+  put: (automation: Automation) => void;
 };
-/** An in-process `AutomationSource`; records are kept by id and checked with `parseAutomation`. */
+/**
+ * An in-process `AutomationSource`; records are kept by id and checked with
+ * `parseAutomation`.
+ */
 declare function memoryAutomationSource(automations?: readonly Automation[]): MemoryAutomationSource;
 /**
  * Decides whether the subject of `permdock` may publish the automation in
- * `request`, and returns the record to store. The publisher must be a
- * signed-in user or service that is not a link, a feed, a contact, a
- * credential or a run, and must be able to use every operation's permission
- * now (`exceeds-creator`); each run re-checks their live rights. A
- * `service` automation's tenant must be one the publisher is a member of,
- * its roles among their `assignableRoles` there and its permissions within
- * `assignablePermissions`. PermDock never stores the record; the
- * application does, after a `granted` result.
+ * `request`, and returns the record to store. The publisher must be a signed-in
+ * user or service that is not a link, a feed, a contact, a credential or a run,
+ * and must be able to use every operation's permission now (`exceeds-creator`);
+ * each run re-checks their live rights. A `service` automation's tenant must be
+ * one the publisher is a member of, its roles among their `assignableRoles`
+ * there and its permissions within `assignablePermissions`. PermDock never
+ * stores the record; the application does, after a `granted` result.
  */
 /**
  * Decides whether the subject of `permdock` may publish the automation in
  * `request` and returns the record to store: the publisher's own reach over
  * every operation's permission and, for a `service` automation, their
- * assignable ceiling. Each run re-checks the publisher live. An instance
- * built from a snapshot denies with `unsupported`.
+ * assignable ceiling. Each run re-checks the publisher live. An instance built
+ * from a snapshot denies with `unsupported`.
  */
 declare function decideAutomation(permdock: InstanceHandle, request: AutomationRequest, options?: DecideAutomationOptions): Promise<AutomationDecision>;
 //#endregion