permdock 0.7.0 → 0.9.0

package/dist/{index-CMiPH2Tv.d.ts → index-BinlXeU-.d.ts}

@@ -1,11 +1,14 @@
-import { T as Policy, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-cTos-H7p.js";
+import { T as Policy, mt as TokenSigner, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DsHGPtkR.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion
 //#region src/ssf/poll-client.d.ts
 type PollSetsOptions = {
-  /** The transmitter's RFC 8936 poll endpoint, the stream's `delivery.endpoint_url`. */
+  /**
+   * The transmitter's RFC 8936 poll endpoint, the stream's
+   * `delivery.endpoint_url`.
+   */
   readonly endpoint: string;
   /** The `Authorization` header value. */
   readonly authorization?: string;
@@ -20,7 +23,10 @@ type PollSetsOptions = {
   readonly fetch?: typeof fetch;
   readonly signal?: AbortSignal;
 };
-/** One SET from a poll response: its `jti` and the compact JWS, not yet verified. */
+/**
+ * One SET from a poll response: its `jti` and the compact JWS, not yet
+ * verified.
+ */
 type PolledSet = {
   readonly jti: string;
   readonly set: string;
@@ -42,22 +48,25 @@ declare function pollSets(options: PollSetsOptions): Promise<PollSetsResult>;
 //#region src/ssf/set-queue.d.ts
 /**
  * An in-process `SetQueue`: pending SETs per stream in insertion order. A
- * process restart loses them; a deployment with more than one instance needs
- * a shared queue.
+ * process restart loses them; a deployment with more than one instance needs a
+ * shared queue.
  */
 declare function memorySetQueue(): SetQueue;
 /**
- * The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's
- * `acks` and `setErrs`, then answers `{ sets, moreAvailable }` with up to
- * `maxEvents` pending SETs. It answers at once whatever `returnImmediately`
- * says, which RFC 8936 section 2.4 allows.
+ * The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's `acks`
+ * and `setErrs`, then answers `{ sets, moreAvailable }` with up to `maxEvents`
+ * pending SETs. It answers at once whatever `returnImmediately` says, which RFC
+ * 8936 section 2.4 allows.
  */
 declare function setPollHandler(options: SetPollHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
 //#region src/ssf/streams.d.ts
 /** One stream a transmitter holds and the receiver that created it. */
 type SsfStream = {
-  /** The receiver `ssfTransmitter`'s `authorize` answered when the stream was created. */
+  /**
+   * The receiver `ssfTransmitter`'s `authorize` answered when the stream was
+   * created.
+   */
   readonly owner: string;
   readonly configuration: SsfStreamConfiguration;
 };
@@ -68,15 +77,21 @@ type SsfStream = {
 type SsfStreamStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  create(owner: string, configuration: SsfStreamConfiguration): void | Promise<void>;
-  get(streamId: string): SsfStream | null | Promise<SsfStream | null>;
-  /** Every stream of `owner`, or every stream when `owner` is absent, oldest first. */
-  list(owner?: string): readonly SsfStream[] | Promise<readonly SsfStream[]>;
-  /** Replaces the configuration of the stream `configuration.stream_id`; the owner and status stay. */
-  update(configuration: SsfStreamConfiguration): void | Promise<void>;
-  delete(streamId: string): void | Promise<void>;
-  status(streamId: string): SsfStreamStatus | null | Promise<SsfStreamStatus | null>;
-  setStatus(status: SsfStreamStatus): void | Promise<void>;
+  create: (owner: string, configuration: SsfStreamConfiguration) => void | Promise<void>;
+  get: (streamId: string) => SsfStream | null | Promise<SsfStream | null>;
+  /**
+   * Every stream of `owner`, or every stream when `owner` is absent, oldest
+   * first.
+   */
+  list: (owner?: string) => readonly SsfStream[] | Promise<readonly SsfStream[]>;
+  /**
+   * Replaces the configuration of the stream `configuration.stream_id`; the
+   * owner and status stay.
+   */
+  update: (configuration: SsfStreamConfiguration) => void | Promise<void>;
+  delete: (streamId: string) => void | Promise<void>;
+  status: (streamId: string) => SsfStreamStatus | null | Promise<SsfStreamStatus | null>;
+  setStatus: (status: SsfStreamStatus) => void | Promise<void>;
 };
 /**
  * An in-process `SsfStreamStore`. A process restart loses every stream; a
@@ -88,12 +103,18 @@ declare function memorySsfStreamStore(): SsfStreamStore;
 type SsfTransmitterOptions = {
   /** `iss` of every stream and of the metadata; the `iss` the signer writes. */
   readonly issuer: string;
-  /** The URL the handler is mounted at; endpoints are `<endpoint>/stream`, `/status`, `/verify` and `/poll`. Default `issuer`. */
+  /**
+   * The URL the handler is mounted at; endpoints are `<endpoint>/stream`,
+   * `/status`, `/verify` and `/poll`. Default `issuer`.
+   */
   readonly endpoint?: string;
   readonly streams: SsfStreamStore;
   readonly queue: SetQueue;
   readonly signer: TokenSigner;
-  /** The receiver the request's credentials authenticate, or `null` to refuse it with `401`. */
+  /**
+   * The receiver the request's credentials authenticate, or `null` to refuse it
+   * with `401`.
+   */
   readonly authorize: (request: Request) => string | null | Promise<string | null>;
   /** `aud` of a receiver's streams; default the receiver itself. */
   readonly audience?: (receiver: string) => string | readonly string[];
@@ -110,7 +131,10 @@ type FanOutSetOptions = {
   readonly signer: TokenSigner;
   readonly fetch?: typeof fetch;
 };
-/** How one stream took a SET. `queued` is `true` for a poll stream and for a paused push stream. */
+/**
+ * How one stream took a SET. `queued` is `true` for a poll stream and for a
+ * paused push stream.
+ */
 type SsfFanOut = {
   readonly stream: string;
   readonly jti: string;
@@ -119,17 +143,17 @@ type SsfFanOut = {
 };
 /**
  * Signs `event` once per distinct stream audience and delivers it to every
- * stream that is not disabled and has the event in `events_delivered`: a
- * push stream through `pushSet`, a poll stream or a paused stream into the
- * queue. Answers one row per stream that took the event.
+ * stream that is not disabled and has the event in `events_delivered`: a push
+ * stream through `pushSet`, a poll stream or a paused stream into the queue.
+ * Answers one row per stream that took the event.
  */
 declare function fanOutSet(event: SetEvent, options: FanOutSetOptions): Promise<readonly SsfFanOut[]>;
 /**
  * An SSF 1.0 transmitter as one Fetch handler, routed by path suffix:
- * `/.well-known/ssf-configuration` (section 7.1), `/stream` (8.1.1),
- * `/status` (8.1.2), `/verify` (8.1.4) and `/poll` (RFC 8936). Each receiver
- * sees only the streams it created. Disabling or deleting a stream drops its
- * pending SETs; a paused stream holds them until it is enabled again.
+ * `/.well-known/ssf-configuration` (section 7.1), `/stream` (8.1.1), `/status`
+ * (8.1.2), `/verify` (8.1.4) and `/poll` (RFC 8936). Each receiver sees only
+ * the streams it created. Disabling or deleting a stream drops its pending
+ * SETs; a paused stream holds them until it is enabled again.
  */
 declare function ssfTransmitter(options: SsfTransmitterOptions): (request: Request) => Promise<Response>;
 //#endregion
@@ -140,15 +164,15 @@ declare const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
 declare const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
 /**
  * Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
- * `sub_id` is the event's subject and `events` holds exactly one entry, as
- * SSF 1.0 requires. `iss` is the signer's own.
+ * `sub_id` is the event's subject and `events` holds exactly one entry, as SSF
+ * 1.0 requires. `iss` is the signer's own.
  */
 declare function signSet(event: SetEvent, signer: TokenSigner, options: SignSetOptions): Promise<string>;
 /**
- * Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
- * maps the receiver's `err` to a cause; `401` and `403` are
- * `authentication-failed` and `access-denied`; a network failure, a timeout,
- * a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+ * Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400` maps
+ * the receiver's `err` to a cause; `401` and `403` are `authentication-failed`
+ * and `access-denied`; a network failure, a timeout, a `429` or a `5xx` is
+ * `unavailable` with `retry: true`. Never throws.
  */
 declare function pushSet(set: string, options: PushSetOptions): Promise<SetDelivery>;
 type CaepCredentialChange = CaepCommon & {
@@ -195,7 +219,10 @@ type RiscEvents = {
   }) => SetEvent;
   readonly credentialCompromise: (input: RiscCredentialCompromise) => SetEvent;
 };
-/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
+/**
+ * RISC 1.0 event builders for the events PermDock's receiver treats as revoking
+ * every session.
+ */
 declare const riscEvents: RiscEvents;
 /**
  * The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the

package/dist/{index-BSfRl0hZ.d.ts → index-CV-7DWeD.d.ts}

@@ -1,9 +1,8 @@
-import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
-import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-C4gZUEZy.js";
+import { J as DecisionSink, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Un as Decision, hr as Subject, ht as TokenVerifier, j as PolicyVocabulary, jt as CredentialKind, kt as Credential, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, st as SettingsSource } from "./policy-types-DGIO_gxq.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CyRN0-Cd.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are
@@ -21,9 +20,9 @@ type ProblemFromErrorOptions = {
 };
 /**
  * Turns a thrown PermDock error into its Problem Details response, with the
- * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
- * same decision. Returns `undefined` for anything else so the framework's own
- * error path takes over.
+ * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the same
+ * decision. Returns `undefined` for anything else so the framework's own error
+ * path takes over.
  */
 declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
 //#endregion
@@ -35,7 +34,10 @@ type ApiKeyParts = {
   readonly id: string;
   readonly secret: string;
 };
-/** What an application stores per key: the credential and the key's hash, never the key. */
+/**
+ * What an application stores per key: the credential and the key's hash, never
+ * the key.
+ */
 type StoredCredential = {
   readonly credential: Credential;
   readonly hash: string;
@@ -43,19 +45,19 @@ type StoredCredential = {
 /**
  * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
  * the secret 43 base62 characters and the checksum the 6 base62 characters of
- * the CRC-32 of everything before it. Anything else, including a checksum
- * that does not match, is `undefined`.
+ * the CRC-32 of everything before it. Anything else, including a checksum that
+ * does not match, is `undefined`.
  */
 declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
 /**
- * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is
- * 26 lowercase base32 characters and the checksum is 6 more. A checksum that
- * does not match is `undefined`.
+ * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is 26
+ * lowercase base32 characters and the checksum is 6 more. A checksum that does
+ * not match is `undefined`.
  */
 declare function parseFeedKey(key: unknown): ApiKeyParts | undefined;
 /**
- * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters
- * (130 bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
+ * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters (130
+ * bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
  */
 declare function generateFeedKey(id: string): string;
 /**
@@ -67,11 +69,11 @@ declare function generateApiKey(id: string): string;
 /** base64url SHA-256 of the whole key, the value to store and compare. */
 declare function hashApiKey(key: string): Promise<string>;
 /**
- * A `CredentialVerifier` over the application's own table: `find` looks a
- * key up by the id in it, and the key's hash is compared in constant time.
- * A record that is not a valid v1 credential, or whose id is not the key's,
- * verifies to `null`. A throwing `find` propagates, so the resolver denies
- * with `source-threw`.
+ * A `CredentialVerifier` over the application's own table: `find` looks a key
+ * up by the id in it, and the key's hash is compared in constant time. A record
+ * that is not a valid v1 credential, or whose id is not the key's, verifies to
+ * `null`. A throwing `find` propagates, so the resolver denies with
+ * `source-threw`.
  */
 declare function apiKeyVerifier(options: {
   readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
@@ -80,14 +82,14 @@ declare function apiKeyVerifier(options: {
 }): CredentialVerifier;
 type MemoryCredentialStore = CredentialVerifier & {
   /** Stores `credential` and returns its key; the key is never stored. */
-  issue(credential: Credential): Promise<string>;
+  issue: (credential: Credential) => Promise<string>;
   /** A new secret for the same id; the old key stops verifying at once. */
-  rotate(id: string): Promise<string | undefined>;
+  rotate: (id: string) => Promise<string | undefined>;
   /** `true` when a credential was removed. */
-  revoke(id: string): boolean;
-  list(): readonly Credential[];
+  revoke: (id: string) => boolean;
+  list: () => readonly Credential[];
   /** When `touch` last recorded a use of `id`, as RFC 3339. */
-  lastUsedAt(id: string): string | undefined;
+  lastUsedAt: (id: string) => string | undefined;
 };
 /**
  * In-process credentials for tests and single-replica apps. `issue`, `rotate`
@@ -99,24 +101,30 @@ declare function memoryCredentialStore(options?: {
 }): MemoryCredentialStore;
 type ApiKeySubjectOptions = {
   readonly verifier: CredentialVerifier;
-  /** The definitions, to turn the credential's permission keys into its delegation. */
+  /**
+   * The definitions, to turn the credential's permission keys into its
+   * delegation.
+   */
   readonly permissions: PermissionTree;
   /**
-   * Loads the live owner of a user-bound key: roles and memberships as of
-   * this request, asked with the key's tenant. `null` (a deleted or
-   * suspended user) is anonymous with `owner-unavailable`, and a throw is
-   * `source-threw`. Without it the owner is `{ id, kind: 'user' }` and its
-   * rights come from the `memberships` source passed to `createPermDock`.
+   * Loads the live owner of a user-bound key: roles and memberships as of this
+   * request, asked with the key's tenant. `null` (a deleted or suspended user)
+   * is anonymous with `owner-unavailable`, and a throw is `source-threw`.
+   * Without it the owner is `{ id, kind: 'user' }` and its rights come from the
+   * `memberships` source passed to `createPermDock`.
    */
   readonly principals?: PrincipalSource;
-  /** The tenant the request acts in: a user key is held to its owner's memberships there. */
+  /**
+   * The tenant the request acts in: a user key is held to its owner's
+   * memberships there.
+   */
   readonly tenant?: string;
   /** `true` when the application revoked the credential id; a throw denies. */
   readonly revoked?: (id: string) => boolean | Promise<boolean>;
   /**
-   * The tenant `credentials` policy, checked on every use so a tightened
-   * policy reaches existing keys: a service key's own tenant, a user key's
-   * the `tenant` the resolver is called with. A throw denies.
+   * The tenant `credentials` policy, checked on every use so a tightened policy
+   * reaches existing keys: a service key's own tenant, a user key's the
+   * `tenant` the resolver is called with. A throw denies.
    */
   readonly settings?: SettingsSource;
   /** Receives a `credential` event with operation `used` for sampled uses. */
@@ -132,10 +140,10 @@ type ApiKeySubjectOptions = {
 };
 /**
  * Resolves an opaque API key (`pdk_<id>_<secret>`) into the subject its
- * credential acts as. Every failure (a malformed or unknown key, a record
- * that is not a valid credential, expiry, a tenant policy the key breaks, a
- * revoked id, a missing owner, a throwing verifier, source or callback) is
- * the anonymous subject, never a throw.
+ * credential acts as. Every failure (a malformed or unknown key, a record that
+ * is not a valid credential, expiry, a tenant policy the key breaks, a revoked
+ * id, a missing owner, a throwing verifier, source or callback) is the
+ * anonymous subject, never a throw.
  */
 declare function subjectFromApiKey(key: string | undefined | null, options: ApiKeySubjectOptions): Promise<Subject<ApiKeyPrincipal>>;
 //#endregion
@@ -145,7 +153,7 @@ type SupportSessionFailureCause = TokenFailureCause | "invalid-claims" | "sessio
 /** The live state of each support session, so one can end before it expires. */
 type SupportSessionSource = {
   /** The session as of now, or `null` for an unknown one. A throw ends it. */
-  session(id: string): {
+  session: (id: string) => {
     readonly id: string;
     readonly ended?: boolean;
   } | null | Promise<{
@@ -176,19 +184,19 @@ type SupportSessionContext = {
 };
 /**
  * Signs a granted `SupportSession` as a `vnd.permdock.support-session+jwt`
- * (`sub` the viewed principal, `act` the support actor, `jti` the session
- * id) that expires with the session. Throws a `TypeError` for a record
+ * (`sub` the viewed principal, `act` the support actor, `jti` the session id)
+ * that expires with the session. Throws a `TypeError` for a record
  * `parseSupportSession` refuses.
  */
 declare function signSupportSession(session: SupportSession, signer: TokenSigner, options?: {
   readonly audience?: string | readonly string[];
 }): Promise<string>;
 /**
- * Resolves a `vnd.permdock.support-session+jwt` into the subject each
- * request of the session acts as: the viewed principal loaded live, a
- * `support` actor, the session's permissions as the delegation and
- * `context.supportSession`. The actor must still exist. Every failure is the
- * anonymous subject, never a throw.
+ * Resolves a `vnd.permdock.support-session+jwt` into the subject each request
+ * of the session acts as: the viewed principal loaded live, a `support` actor,
+ * the session's permissions as the delegation and `context.supportSession`. The
+ * actor must still exist. Every failure is the anonymous subject, never a
+ * throw.
  */
 declare function subjectFromSupportSession(token: string | undefined | null, options: SupportSessionSubjectOptions): Promise<Subject>;
 //#endregion
@@ -196,15 +204,19 @@ declare function subjectFromSupportSession(token: string | undefined | null, opt
 declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
 declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
 declare function validationProblem(detail: string): Response;
-declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
+type DecisionProblemOptions = {
   readonly instance?: string;
   readonly approval?: ApprovalHint;
   /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
   readonly disclosure?: Disclosure;
   /** Whether the request carried credentials, which picks the `401` challenge. */
   readonly credentials?: boolean;
-  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
+  /**
+   * The scope an `insufficient_scope` challenge names; the permission's own
+   * scope when absent.
+   */
   readonly scope?: string;
-}): Response;
+};
+declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: DecisionProblemOptions): Response;
 //#endregion
 export { subjectFromApiKey as C, createPermDock as E, parseFeedKey as S, problemFromError as T, generateApiKey as _, SupportSessionContext as a, memoryCredentialStore as b, SupportSessionSubjectOptions as c, ApiKeyFailureCause as d, ApiKeyParts as f, apiKeyVerifier as g, StoredCredential as h, wwwAuthenticate as i, signSupportSession as l, MemoryCredentialStore as m, problemResponse as n, SupportSessionFailureCause as o, ApiKeySubjectOptions as p, validationProblem as r, SupportSessionSource as s, problemFromDecision as t, subjectFromSupportSession as u, generateFeedKey as v, ProblemFromErrorOptions as w, parseApiKey as x, hashApiKey as y };