permdock 0.7.0 → 0.9.0

package/dist/{index-BE8y3moU.d.ts → index-DJwEgYzA.d.ts}

@@ -1,9 +1,9 @@
-import { $n as AuthorizationDetail, Ln as Decision, Rt as Instant, T as Policy, et as MembershipSource, gn as Approver, it as RelationSource, lr as Subject, or as Membership, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { O as AppData, f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as PermDock } from "./permdock-Dco6dyCK.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DC44-hqb.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-CfiKC5aN.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { Sn as Approver, T as Policy, Un as Decision, Wt as Instant, ar as AuthorizationDetail, fr as Membership, hr as Subject, mt as TokenSigner, nt as MembershipSource, ot as RelationSource } from "./policy-types-DGIO_gxq.js";
+import { M as AppData, f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DLvhVm1r.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-B2efzoSX.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {
   readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
@@ -15,8 +15,8 @@ type AccessReviewsHandlerOptions = {
 };
 /**
  * HTTP for one access-review store: `GET` a review and its items, `POST`
- * `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is
- * not a reviewer and did not open the review gets 404.
+ * `.../keep`, `.../revoke`, `.../applied` and `.../close`. A caller who is not
+ * a reviewer and did not open the review gets 404.
  */
 declare function accessReviewsHandler(store: AccessReviewStore, options: AccessReviewsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
@@ -31,11 +31,14 @@ type AccessReviewVerdict = {
    */
   readonly permissions?: readonly string[];
 };
-/** Whether `by` is named as a reviewer. A link, a feed or a contact is never a reviewer. */
+/**
+ * Whether `by` is named as a reviewer. A link, a feed or a contact is never a
+ * reviewer.
+ */
 declare function accessReviewerEligible(review: AccessReview, by: Subject, permissions?: readonly string[], now?: Instant): boolean;
 /**
- * The decision to persist, or throws. A reviewer cannot decide a holding
- * of their own principal. `holder()` matches only through `permissions`.
+ * The decision to persist, or throws. A reviewer cannot decide a holding of
+ * their own principal. `holder()` matches only through `permissions`.
  */
 declare function decideAccessReviewItem(review: AccessReview, item: AccessReviewItem, verdict: AccessReviewVerdict, at?: Instant): AccessReviewDecision;
 //#endregion
@@ -78,16 +81,16 @@ type AccessReviewOptions = {
   readonly permdockFor?: (principalId: string) => PermDock | Promise<PermDock>;
   /**
    * When set, a global role, a plan, a relation or an inherit grant on a
-   * reviewed permission makes `complete` false. Without it the membership
-   * path is incomplete, because those holders cannot be listed from a tenant.
+   * reviewed permission makes `complete` false. Without it the membership path
+   * is incomplete, because those holders cannot be listed from a tenant.
    */
   readonly policy?: Policy;
   readonly now?: Instant;
 };
 /**
- * Opens a review of who holds `permissions` in the caller's active tenant.
- * The caller must be signed in. PermDock stores the population and does not
- * revoke anything: the application changes the source, then `markApplied`.
+ * Opens a review of who holds `permissions` in the caller's active tenant. The
+ * caller must be signed in. PermDock stores the population and does not revoke
+ * anything: the application changes the source, then `markApplied`.
  */
 declare function startAccessReview(permdock: PermDock, input: StartAccessReviewInput, options: AccessReviewOptions): Promise<AccessReview>;
 //#endregion
@@ -102,9 +105,9 @@ declare function memoryAccessReviewStore(): MemoryAccessReviewStore;
 //#endregion
 //#region src/approvals/delegation.d.ts
 /**
- * A frozen copy of a delegation with only the known fields, or `undefined`
- * when a known field has the wrong type, `until` is not after `from`, or
- * the delegate and the delegator are the same principal.
+ * A frozen copy of a delegation with only the known fields, or `undefined` when
+ * a known field has the wrong type, `until` is not after `from`, or the
+ * delegate and the delegator are the same principal.
  */
 declare function parseApprovalDelegation(input: unknown): ApprovalDelegation | undefined;
 /** In-process delegations. An entry that does not parse is dropped. */
@@ -126,8 +129,8 @@ type MatchDelegationOptions = {
   }>;
 };
 /**
- * The first active delegation under which `delegate` may approve `request`,
- * or `undefined`. The delegator is resolved by `subjectFor` and checked with
+ * The first active delegation under which `delegate` may approve `request`, or
+ * `undefined`. The delegator is resolved by `subjectFor` and checked with
  * `assertApprover`, so relation and permission approvers use the delegator's
  * facts. A throw, a missing option or a delegator the source does not name
  * matches nobody. The delegator's own delegations are never read.
@@ -145,7 +148,10 @@ type IdempotentCall = {
 };
 /** One `Idempotency-Key` entry as `approvalsHandler` stores it. */
 type IdempotencyRecord = {
-  /** The store key: the approver's principal id and the field value, joined by a newline. */
+  /**
+   * The store key: the approver's principal id and the field value, joined by a
+   * newline.
+   */
   readonly key: string;
   readonly response: IdempotentResponse;
   /** Epoch milliseconds. */
@@ -153,7 +159,10 @@ type IdempotencyRecord = {
 };
 /** A response the approvals handler replays for a repeated `Idempotency-Key`. */
 type IdempotentResponse = {
-  /** Which request produced it: a reused key with another fingerprint is refused with `422`. */
+  /**
+   * Which request produced it: a reused key with another fingerprint is refused
+   * with `422`.
+   */
   readonly fingerprint: string;
   readonly status: number;
   readonly headers: readonly (readonly [name: string, value: string])[];
@@ -168,16 +177,19 @@ type IdempotentResponse = {
 type IdempotencyStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  get(key: string): IdempotentResponse | undefined | Promise<IdempotentResponse | undefined>;
+  get: (key: string) => IdempotentResponse | undefined | Promise<IdempotentResponse | undefined>;
   /** `expiresAt` is epoch milliseconds; the store may drop the entry after it. */
-  set(key: string, response: IdempotentResponse, expiresAt: number): void | Promise<void>;
+  set: (key: string, response: IdempotentResponse, expiresAt: number) => void | Promise<void>;
 };
-/** The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never cross approvers. */
+/**
+ * The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never
+ * cross approvers.
+ */
 declare function idempotencyRecordKey(principalId: string, key: string): string;
 /**
- * The record `approvalsHandler` stores after `call` answered `response`:
- * the status, headers and body text, the call's fingerprint, and an expiry
- * 24 hours after `now` (epoch milliseconds, default the clock).
+ * The record `approvalsHandler` stores after `call` answered `response`: the
+ * status, headers and body text, the call's fingerprint, and an expiry 24 hours
+ * after `now` (epoch milliseconds, default the clock).
  */
 declare function idempotencyRecord(input: {
   readonly principalId: string;
@@ -186,7 +198,10 @@ declare function idempotencyRecord(input: {
   readonly response: Response;
   readonly now?: number;
 }): Promise<IdempotencyRecord>;
-/** Whether a stored response came from the same call: a reused key with another call is refused with `422`. */
+/**
+ * Whether a stored response came from the same call: a reused key with another
+ * call is refused with `422`.
+ */
 declare function matchesIdempotencyRecord(response: IdempotentResponse, call: IdempotentCall): boolean;
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 declare function memoryIdempotencyStore(): IdempotencyStore;
@@ -194,18 +209,28 @@ declare function memoryIdempotencyStore(): IdempotencyStore;
 //#region src/approvals/handler.d.ts
 type ApprovalsHandlerOptions = {
   readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
-  /** Refuse the principal even on grants that set `approval: { distinct: false }`. */
+  /**
+   * Refuse the principal even on grants that set `approval: { distinct: false
+   * }`.
+   */
   readonly requireDistinctApprover?: boolean;
   readonly signer?: TokenSigner;
   readonly audience?: string | readonly string[];
-  /** Where `relation()` approvers are read, by the request's resource id; without it they match nobody. */
+  /**
+   * Where `relation()` approvers are read, by the request's resource id;
+   * without it they match nobody.
+   */
   readonly relations?: RelationSource;
-  /** The policy's permission tree, for `through` links and `includes` on relation approvers. */
+  /**
+   * The policy's permission tree, for `through` links and `includes` on
+   * relation approvers.
+   */
   readonly permissions?: PermissionTree;
   /**
    * The approver's own instance in the request's tenant, for
    * `holder(permission)` approvers (custom roles included when the instance
-   * reads a `CustomRoleSource`). Without it, or when it throws, they match nobody.
+   * reads a `CustomRoleSource`). Without it, or when it throws, they match
+   * nobody.
    */
   readonly permdockFor?: (approver: Subject, request: ApprovalRequest) => PermDock | Promise<PermDock>;
   /**
@@ -215,8 +240,8 @@ type ApprovalsHandlerOptions = {
    */
   readonly approvalDelegations?: ApprovalDelegationSource;
   /**
-   * Resolves a delegator's subject from their principal id. Server-side:
-   * never from the request body. A throw matches nobody.
+   * Resolves a delegator's subject from their principal id. Server-side: never
+   * from the request body. A throw matches nobody.
    */
   readonly subjectFor?: (principalId: string, request: ApprovalRequest) => Subject | null | undefined | Promise<Subject | null | undefined>;
   /**
@@ -229,11 +254,10 @@ declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandle
 //#endregion
 //#region src/approvals/parse-request.d.ts
 /**
- * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store
- * or the Cloud returns it, validated against
- * `schemas/approval-request-v1.json`. Returns a deep-frozen copy, or `null`
- * for anything that does not match, including a `__proto__`, `constructor`
- * or `prototype` key.
+ * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or
+ * the Cloud returns it, validated against `schemas/approval-request-v1.json`.
+ * Returns a deep-frozen copy, or `null` for anything that does not match,
+ * including a `__proto__`, `constructor` or `prototype` key.
  */
 declare function parseApprovalRequest(value: unknown): ApprovalRequest | null;
 //#endregion
@@ -246,7 +270,10 @@ declare function parseApprovalRequest(value: unknown): ApprovalRequest | null;
 declare const APPROVAL_REQUEST_SCHEMA: JsonSchemaNode;
 //#endregion
 //#region src/approvals/signature.d.ts
-/** One recorded approval as the `approvals` claim of a `vnd.permdock.approval+jwt` carries it. */
+/**
+ * One recorded approval as the `approvals` claim of a
+ * `vnd.permdock.approval+jwt` carries it.
+ */
 type ApprovalSignatureEntry = {
   readonly by: string;
   /** RFC 3339. */
@@ -257,9 +284,9 @@ type ApprovalSignatureEntry = {
   readonly delegation?: string;
 };
 /**
- * The claims of a `vnd.permdock.approval+jwt` other than `iss`, `aud`,
- * `iat`, `exp` and `jti`, which the signer sets: `jti` is the request `id`,
- * `iat` its `resolvedAt` and `exp` its `expiresAt`.
+ * The claims of a `vnd.permdock.approval+jwt` other than `iss`, `aud`, `iat`,
+ * `exp` and `jti`, which the signer sets: `jti` is the request `id`, `iat` its
+ * `resolvedAt` and `exp` its `expiresAt`.
  */
 type ApprovalSignatureClaims = {
   readonly sub?: string;
@@ -293,16 +320,22 @@ type ApprovalView = Omit<ApprovalRequest, "token">;
 declare function approvalView(request: ApprovalRequest): ApprovalView;
 /**
  * A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
- * `approvalView(request)` as RFC 8785 JSON. A field outside
- * `ApprovalRequest` changes the tag, so hash the stored request as is.
+ * `approvalView(request)` as RFC 8785 JSON. A field outside `ApprovalRequest`
+ * changes the tag, so hash the stored request as is.
  */
 declare function approvalEntityTag(request: ApprovalRequest): string;
 //#endregion
 //#region src/approvals/relations.d.ts
 type ApproverRelationsOptions = {
-  /** The object graph relation approvers are read from; without it they match nobody. */
+  /**
+   * The object graph relation approvers are read from; without it they match
+   * nobody.
+   */
   readonly relations?: RelationSource;
-  /** The permission tree the policy declares; needed to follow `through` links and `includes`. */
+  /**
+   * The permission tree the policy declares; needed to follow `through` links
+   * and `includes`.
+   */
   readonly permissions?: PermissionTree;
   /** The clock relation expiry is read at; defaults to the current time. */
   readonly now?: Instant;
@@ -310,8 +343,8 @@ type ApproverRelationsOptions = {
 /**
  * The relation approvers of `request` that `subject` holds on its resource,
  * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
- * through `relations` by the request's resource id; a request without an id,
- * a missing source or a read that fails holds nothing.
+ * through `relations` by the request's resource id; a request without an id, a
+ * missing source or a read that fails holds nothing.
  */
 declare function approverRelations(request: ApprovalRequest, subject: Subject, options: ApproverRelationsOptions): Promise<readonly string[]>;
 //#endregion
@@ -378,18 +411,24 @@ declare function resumeDecision(input: {
   };
   readonly adapter: string;
   readonly token: string | undefined;
-  /** `false` for checks that do not run the action, such as the decision endpoint. */
+  /**
+   * `false` for checks that do not run the action, such as the decision
+   * endpoint.
+   */
   readonly consume?: boolean;
   readonly now?: Instant;
   /**
-   * Seconds a request this call opens stays open; absent means the
-   * store's `ttl`, else `DEFAULT_APPROVAL_TTL`. The grant's `approval.ttl`
-   * still caps it.
+   * Seconds a request this call opens stays open; absent means the store's
+   * `ttl`, else `DEFAULT_APPROVAL_TTL`. The grant's `approval.ttl` still caps
+   * it.
    */
   readonly ttl?: number;
 }): Promise<Decision>;
 declare function cancelApprovals(store: ApprovalStore, filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number>;
-/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
+/**
+ * The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no
+ * parameters, else `undefined`.
+ */
 declare function readApprovalHeader(headers: Headers | {
   readonly get: (name: string) => string | null;
 }): string | undefined;
@@ -398,14 +437,14 @@ declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
 }, now?: Instant): Promise<ApprovalInspectResult>;
 /**
  * The token to resume `decision` with when the caller carries none: the
- * decision's own token when the store holds an approved or rejected request
- * for it, so `resumeDecision` resumes (or denies) the call without the
- * caller passing the token back. The token already binds permission,
- * resource (or the call's data when there is no row id), subject and actor.
- * A pending request counts only with `denyPending: true`, which makes the
- * call deny with `approval-pending` instead of asking again. `undefined` when
- * the decision needs no approval, there is no store, or the store has no
- * unexpired request for the token; a store that throws counts as none.
+ * decision's own token when the store holds an approved or rejected request for
+ * it, so `resumeDecision` resumes (or denies) the call without the caller
+ * passing the token back. The token already binds permission, resource (or the
+ * call's data when there is no row id), subject and actor. A pending request
+ * counts only with `denyPending: true`, which makes the call deny with
+ * `approval-pending` instead of asking again. `undefined` when the decision
+ * needs no approval, there is no store, or the store has no unexpired request
+ * for the token; a store that throws counts as none.
  */
 declare function storedApprovalToken(store: ApprovalStore | undefined, decision: Decision, options?: {
   readonly denyPending?: boolean;
@@ -419,16 +458,22 @@ declare function approvalPageSize(limit: number | undefined): number;
 type ApprovalCursorPosition = readonly [createdAt: string, token: string];
 /** The `next` cursor after `request`, for a store that pages in its own query. */
 declare function encodeApprovalCursor(request: ApprovalRequest): string;
-/** The `(createdAt, token)` position a `next` cursor names, or `null` for one that does not parse. */
+/**
+ * The `(createdAt, token)` position a `next` cursor names, or `null` for one
+ * that does not parse.
+ */
 declare function decodeApprovalCursor(cursor: string): ApprovalCursorPosition | null;
 /**
  * Pages already-filtered requests in `(createdAt, token)` order, as the
  * built-in stores do: `limit` within 1 to 200 (50 when absent), `cursor` from
- * the previous page's `next`, and no items for a cursor that does not parse.
- * A custom `ApprovalStore` that filters in memory returns it from `list`.
+ * the previous page's `next`, and no items for a cursor that does not parse. A
+ * custom `ApprovalStore` that filters in memory returns it from `list`.
  */
 declare function pageApprovals(matching: readonly ApprovalRequest[], query: ApprovalListQuery): ApprovalPage;
-/** Every matching request of `store`, following `next` until the last page (at most 1000 pages of 200). */
+/**
+ * Every matching request of `store`, following `next` until the last page (at
+ * most 1000 pages of 200).
+ */
 declare function listAllApprovals(store: ApprovalStore, filter: ApprovalListFilter): Promise<ApprovalRequest[]>;
 //#endregion
 //#region src/approvals/permissions.d.ts
@@ -443,23 +488,23 @@ declare function approverPermissions(request: ApprovalRequest, approver: PermDoc
 //#endregion
 //#region src/approvals/store.d.ts
 /**
- * Refuses `by` as an approver of `request`, or returns the index of the
- * stage the approval counts for (`undefined` without `stages`). Eligibility
- * is `approvers.by` or, under `stages`, the first incomplete stage
- * (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
- * is eligible too once the request has waited `escalation.after`. A
- * principal who already approved is refused, so one person never completes
- * two stages. `relations` are the relation approvers `by` holds on the
- * request's resource (see `ApprovalVerdict.relations`).
+ * Refuses `by` as an approver of `request`, or returns the index of the stage
+ * the approval counts for (`undefined` without `stages`). Eligibility is
+ * `approvers.by` or, under `stages`, the first incomplete stage (`sequential`)
+ * or any incomplete stage (`all`); `approvers.escalation.to` is eligible too
+ * once the request has waited `escalation.after`. A principal who already
+ * approved is refused, so one person never completes two stages. `relations`
+ * are the relation approvers `by` holds on the request's resource (see
+ * `ApprovalVerdict.relations`).
  */
 declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, at?: Instant, relations?: readonly string[], permissions?: readonly string[]): number | undefined;
 /**
- * The request after `verdict`, for a store to persist: a rejection resolves
- * it; an approval is appended to `approvals` and resolves it once there are
- * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
- * is not pending, has expired or `verdict.by` may not approve it. Stores
- * should write the result only when the stored row is still pending with the
- * same number of approvals, so two approvers racing both count.
+ * The request after `verdict`, for a store to persist: a rejection resolves it;
+ * an approval is appended to `approvals` and resolves it once there are
+ * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request is
+ * not pending, has expired or `verdict.by` may not approve it. Stores should
+ * write the result only when the stored row is still pending with the same
+ * number of approvals, so two approvers racing both count.
  */
 declare function applyApprovalVerdict(request: ApprovalRequest, verdict: ApprovalVerdict, at?: Instant): ApprovalRequest;
 type MemoryApprovalStore = ApprovalStore & {

package/dist/{index-DH9DUDEM.d.ts → index-Dj2qF9VC.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-B-F-qAZk.js";
-import { O as AppData } from "./permission-types-DhNEmoRG.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
-import { t as SqlQuery } from "./sql-CDEPCA0g.js";
+import { J as DecisionSink, ht as TokenVerifier, nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as SqlQuery } from "./sql-B80DFdpG.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -12,7 +12,10 @@ declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 /** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
 declare const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
+/**
+ * The extension that carries the application's own data (`x`) on a User or a
+ * Group.
+ */
 declare const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 type DirectoryMeta = {
   readonly created: string;
@@ -31,7 +34,10 @@ type DirectoryUser = {
   readonly userName: string;
   readonly active: boolean;
   readonly emails?: readonly DirectoryEmail[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -44,7 +50,10 @@ type DirectoryGroup = {
   readonly displayName: string;
   readonly members: readonly DirectoryGroupMember[];
   readonly roles?: readonly string[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -80,17 +89,17 @@ type ScimPatchOp = {
 type DirectoryStore = {
   /** Shown in errors and events; optional, as on every extension interface. */
   readonly name?: string;
-  getUser(tenant: string, id: string): DirectoryUser | null | Promise<DirectoryUser | null>;
-  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
-  putUser(tenant: string, user: DirectoryUser): DirectoryUser | Promise<DirectoryUser>;
-  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryUser | Promise<DirectoryUser>;
-  deleteUser(tenant: string, id: string): void | Promise<void>;
-  getGroup(tenant: string, id: string): DirectoryGroup | null | Promise<DirectoryGroup | null>;
-  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
-  putGroup(tenant: string, group: DirectoryGroup): DirectoryGroup | Promise<DirectoryGroup>;
-  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryGroup | Promise<DirectoryGroup>;
-  deleteGroup(tenant: string, id: string): void | Promise<void>;
-  groupsFor(tenant: string, userId: string): readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
+  getUser: (tenant: string, id: string) => DirectoryUser | null | Promise<DirectoryUser | null>;
+  findUsers: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
+  putUser: (tenant: string, user: DirectoryUser) => DirectoryUser | Promise<DirectoryUser>;
+  patchUser: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryUser | Promise<DirectoryUser>;
+  deleteUser: (tenant: string, id: string) => void | Promise<void>;
+  getGroup: (tenant: string, id: string) => DirectoryGroup | null | Promise<DirectoryGroup | null>;
+  findGroups: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup: (tenant: string, group: DirectoryGroup) => DirectoryGroup | Promise<DirectoryGroup>;
+  patchGroup: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryGroup | Promise<DirectoryGroup>;
+  deleteGroup: (tenant: string, id: string) => void | Promise<void>;
+  groupsFor: (tenant: string, userId: string) => readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
 };
 type ScimTokenOptions = {
   readonly hash: "sha256";
@@ -99,7 +108,10 @@ type ScimTokenOptions = {
 type DirectoryChange = {
   readonly tenant: string;
   readonly userIds: readonly string[];
-  /** `session-revoked` when a user was deactivated or deleted; `changed` otherwise. */
+  /**
+   * `session-revoked` when a user was deactivated or deleted; `changed`
+   * otherwise.
+   */
   readonly kind: "session-revoked" | "changed";
 };
 type ScimHandlerOptions = {
@@ -108,7 +120,10 @@ type ScimHandlerOptions = {
   readonly token?: ScimTokenOptions;
   readonly verifier?: TokenVerifier;
   readonly audience?: string;
-  /** With `verifier`: where the JWT names its tenant (`claims.tenant`); default `tenant`, then `tid`. */
+  /**
+   * With `verifier`: where the JWT names its tenant (`claims.tenant`); default
+   * `tenant`, then `tid`.
+   */
   readonly claims?: Pick<ClaimsMap, "tenant">;
   readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
   readonly assignable?: readonly string[];
@@ -116,8 +131,8 @@ type ScimHandlerOptions = {
   readonly onChange?: (change: DirectoryChange) => void | Promise<void>;
   /**
    * Publishes for each affected user's id, `externalId` and `userName`:
-   * `session-revoked` when a user is deactivated (`active: false`) or
-   * deleted, so open connections end; `changed` otherwise, so they revalidate.
+   * `session-revoked` when a user is deactivated (`active: false`) or deleted,
+   * so open connections end; `changed` otherwise, so they revalidate.
    */
   readonly revocations?: RevocationFeed;
   readonly onUnknownRole?: (name: string) => void;
@@ -139,9 +154,15 @@ declare class DirectoryNotFoundError extends Error {
   readonly code: "not-found";
   constructor(message?: string);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryUniquenessError(error: unknown): error is DirectoryUniquenessError;
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryNotFoundError(error: unknown): error is DirectoryNotFoundError;
 //#endregion
 //#region src/scim/auth.d.ts
@@ -195,15 +216,18 @@ declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
 //#region src/scim/postgres-store.d.ts
 type PostgresDirectoryStoreOptions = {
-  /** Schema of the generated tables (`permdock scim generate --schema`). Default `permdock`. */
+  /**
+   * Schema of the generated tables (`permdock scim generate --schema`). Default
+   * `permdock`.
+   */
   readonly schema?: string;
 };
 /**
  * A `DirectoryStore` over the tables `permdock scim generate` writes, called
- * through a `SqlQuery` that may read and write them (the table owner, or a
- * role granted on them). Every method is one statement, so a pool needs no
- * transaction: a group and its members change together, and a PATCH that
- * races another write re-reads the row and applies its operations again.
+ * through a `SqlQuery` that may read and write them (the table owner, or a role
+ * granted on them). Every method is one statement, so a pool needs no
+ * transaction: a group and its members change together, and a PATCH that races
+ * another write re-reads the row and applies its operations again.
  */
 declare function postgresDirectoryStore(query: SqlQuery, options?: PostgresDirectoryStoreOptions): DirectoryStore;
 //#endregion