permdock 0.7.0 → 0.9.0

package/dist/{instance-snapshot-CjcwnEiV.js → instance-snapshot-DuWf1cT3.js}

@@ -1,21 +1,21 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
-import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { a as getResource, c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { p as nowSeconds, s as instantAt } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { o as sameId } from "./expiry-6XByK0dm.js";
+import { a as getResource, c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { p as nowSeconds, s as instantAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-C5rOdTp5.js";
-import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-BrRANrpT.js";
-import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
-import { o as levelCondition, r as grantList, s as levelNames, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-0RtHWQDx.js";
-import { t as buildSnapshot } from "./snapshot-CbGmYiJx.js";
+import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-CDB6_keF.js";
+import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-CLQ8__GF.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
+import { t as buildSnapshot } from "./snapshot-CXlzi69u.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -41,8 +41,8 @@ function identity(membership) {
 /**
 * Merges memberships from several sources: entries naming the same instance
 * with the same `via`, expiry, owner and seats become one entry with the union
-* of their roles. Entries that differ in any of those stay separate, so a
-* staff role and a contact role in one instance keep their own `via`.
+* of their roles. Entries that differ in any of those stay separate, so a staff
+* role and a contact role in one instance keep their own `via`.
 */
 function mergeMemberships(lists) {
 	const merged = /* @__PURE__ */ new Map();
@@ -59,8 +59,8 @@ function mergeMemberships(lists) {
 function all(values) {
 	return values.some((value) => isThenable(value)) ? Promise.all(values) : values;
 }
-function then(value, next) {
-	return isThenable(value) ? Promise.resolve(value).then(next) : next(value);
+function then(value, map) {
+	return isThenable(value) ? Promise.resolve(value).then(map) : map(value);
 }
 /**
 * One `MembershipSource` over several: memberships are merged and
@@ -73,8 +73,8 @@ function composeMemberships(sources) {
 	const versioned = sources.filter((source) => source.version !== void 0);
 	const rolesReaders = sources.filter((source) => source.globalRolesFor !== void 0);
 	return {
-		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal) {
-			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal) ?? [])), (lists) => [...new Set(lists.flat())]);
+		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal, context) {
+			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal, context) ?? [])), (lists) => [...new Set(lists.flat())]);
 		} },
 		membershipsFor(principal, options) {
 			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
@@ -96,8 +96,8 @@ function composeMemberships(sources) {
 				return [...seen.values()];
 			});
 		} },
-		...versioned.length === 0 ? {} : { version(principal) {
-			return then(all(versioned.map((source) => source.version?.(principal))), (versions) => {
+		...versioned.length === 0 ? {} : { version(principal, context) {
+			return then(all(versioned.map((source) => source.version?.(principal, context))), (versions) => {
 				const known = versions.filter((value) => typeof value === "number" && Number.isFinite(value));
 				return known.length === 0 ? void 0 : Math.max(...known);
 			});
@@ -109,33 +109,41 @@ function asMembershipSource(input) {
 	return Array.isArray(input) ? composeMemberships(input) : input;
 }
 /**
-* Trust the memberships the verified token carries, and read `source` only
-* when the token marks them truncated. With `version`, a token minted before
-* the latest membership change is stale for the policy's `fresh` permissions,
-* or with `onStale: 'reread'` has its memberships read from `source` instead.
+* Trust the memberships the verified token carries, and read `source` only when
+* the token marks them truncated. With `version`, a token minted before the
+* latest membership change is stale for the policy's `fresh` permissions, or
+* with `onStale: 'reread'` has its memberships read from `source` instead. With
+* `versions`, an instance with intent `read` takes the version from that
+* process-wide cache, so concurrent instances share one read and a token issued
+* within its `maxStaleMs` needs none; intent `write` always reads.
 */
 function claimsFirst(source, options = {}) {
 	const inner = asMembershipSource(source);
-	const version = options.version ?? (inner.version === void 0 ? void 0 : (principal) => inner.version?.(principal));
+	const read = options.version ?? inner.version?.bind(inner);
+	const versions = options.versions;
+	const version = read === void 0 ? void 0 : versions === void 0 ? (principal, context) => read(principal, context) : (principal, context) => versions.current(principal, () => read(principal, context), { live: context?.intent !== "read" });
 	return {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
 		...version === void 0 ? {} : { version },
-		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal) => inner.globalRolesFor?.(principal) ?? [] },
+		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal, context) => inner.globalRolesFor?.(principal, context) ?? [] },
 		...options.onStale === "reread" ? { onStale: "reread" } : {},
 		claimsFirst: true
 	};
 }
-/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+/**
+* Whether the identity provider owns `membership`: the application must not
+* add, change or remove it.
+*/
 function isExternallyManaged(membership) {
 	return membership.managedBy === "idp";
 }
 /**
-* How many principals hold `role` in one scope instance now, from the
-* source's member list (`MembershipSource.list`): live memberships of exactly
-* that scope and instance, each principal counted once. The `holders` a
-* `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
-* when the source cannot list or the read fails, which that check denies.
+* How many principals hold `role` in one scope instance now, from the source's
+* member list (`MembershipSource.list`): live memberships of exactly that scope
+* and instance, each principal counted once. The `holders` a `decideRoleChange`
+* with `min`, `max` or `transferOnly` needs. `undefined` when the source cannot
+* list or the read fails, which that check denies.
 */
 async function countHolders(source, query) {
 	const composed = asMembershipSource(source);
@@ -185,8 +193,8 @@ function mayHoldManaged(policy, role, membership) {
 /**
 * Drops every role a membership's kind may not hold (fail-closed: a missing
 * `via` is no kind) and every non-assignable role on an identity-provider
-* membership. Global roles have no kind, so a role with `for` held globally
-* is dropped too.
+* membership. Global roles have no kind, so a role with `for` held globally is
+* dropped too.
 */
 function applyRoleKinds(policy, roles, memberships) {
 	const kinds = policy.roles.some((binding) => binding.for !== void 0);
@@ -208,7 +216,10 @@ function applyRoleKinds(policy, roles, memberships) {
 function usesAssigns(policy) {
 	return policy.roles.some((binding) => binding.assigns !== void 0);
 }
-/** Declared role names in declaration order: bindings first, then vocabulary-only leaves. */
+/**
+* Declared role names in declaration order: bindings first, then
+* vocabulary-only leaves.
+*/
 function declarationOrder(policy) {
 	const names = policy.roles.map((binding) => binding.name);
 	const seen = new Set(names);
@@ -219,9 +230,9 @@ function declarationOrder(policy) {
 	return names;
 }
 /**
-* Each role's depth in the `assigns` graph: a role nobody else assigns is 0,
-* a role another assigns sits one below its deepest assigner. Cycles stop
-* after one pass per role.
+* Each role's depth in the `assigns` graph: a role nobody else assigns is 0, a
+* role another assigns sits one below its deepest assigner. Cycles stop after
+* one pass per role.
 */
 function assignDepths(policy) {
 	const names = declarationOrder(policy);
@@ -262,7 +273,10 @@ function audiencesOf(policy, names) {
 	}
 	return out;
 }
-/** Whether `membership` is the instance itself or one of its ancestors named in `within`. */
+/**
+* Whether `membership` is the instance itself or one of its ancestors named in
+* `within`.
+*/
 //#endregion
 //#region src/core/held-roles.ts
 /**
@@ -293,7 +307,10 @@ function roleLeaf(policy, name) {
 }
 //#endregion
 //#region src/core/snapshot-grants.ts
-/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+/**
+* A grant on a relation with a `period` is decided on the server, where the
+* clock is.
+*/
 function periodBound(policy, grant) {
 	const relations = policy.resources.get(grant.permission.resource)?.relations;
 	return flattenGrantee(grant.to).some((item) => {
@@ -330,8 +347,8 @@ function graphAware(grant, where) {
 	}));
 }
 /**
-* `where()` keeps a grant that is server-only because it reads the graph:
-* its `related` nodes compile to subqueries given relation mappings.
+* `where()` keeps a grant that is server-only because it reads the graph: its
+* `related` nodes compile to subqueries given relation mappings.
 */
 function whereGrant(grant) {
 	return grant.graph === true ? freezeDeep({
@@ -340,8 +357,8 @@ function whereGrant(grant) {
 	}) : grant;
 }
 /**
-* Every grant the subject may reach, once per membership that holds all of
-* its scoped roles, so a client can check that membership's tenant, team or
+* Every grant the subject may reach, once per membership that holds all of its
+* scoped roles, so a client can check that membership's tenant, team or
 * resource. A scoped role held only globally reaches nothing.
 */
 function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds$1(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
@@ -407,24 +424,26 @@ function assignableCandidates(policy) {
 	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
 }
 /**
-* The levels a held allow of a permission covers: its own `level`, every
-* level when it has no row condition, or the levels whose condition equals
-* its condition.
+* The levels a held allow of a permission covers: its own `level`, every level
+* when it has no row condition, or the levels whose condition equals its
+* condition; with `orderedLevels`, also every narrower level.
 */
 function heldLevels(policy, grant, names) {
-	if (grant.level !== void 0) return [grant.level];
+	const resource = grant.permission.resource;
+	if (grant.level !== void 0) return coveredLevels(policy, resource, [grant.level]);
 	if (grant.where === void 0) return names;
 	const held = canonicalJson(grant.where);
-	return names.filter((name) => {
-		const condition = levelCondition(policy, grant.permission.resource, name);
+	return coveredLevels(policy, resource, names.filter((name) => {
+		const condition = levelCondition(policy, resource, name);
 		return condition !== void 0 && canonicalJson(condition) === held;
-	});
+	}));
 }
 /**
 * What the subject may hand out in `tenant`: declared assignable roles and the
-* tenant custom-role ceiling, narrowed by `allowed` (`CustomRoleSource.assignable`),
-* then intersected with the permissions the subject holds there. Holding a
-* role or a granted permission with `meta.manageRoles` lifts the intersection.
+* tenant custom-role ceiling, narrowed by `allowed`
+* (`CustomRoleSource.assignable`), then intersected with the permissions the
+* subject holds there. Holding a role or a granted permission with
+* `meta.manageRoles` lifts the intersection.
 */
 function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds$1(), global = false) {
 	const principal = subject.principal;
@@ -547,7 +566,10 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 }
 //#endregion
 //#region src/core/instance-snapshot.ts
-/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+/**
+* The one path from a resolved subject to a `Snapshot`; pure apart from the
+* default clock.
+*/
 function snapshotOf(policy, subject, options) {
 	const now = options.now ?? nowSeconds$1();
 	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
@@ -582,7 +604,10 @@ function snapshotOf(policy, subject, options) {
 		}
 	}));
 }
-/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+/**
+* The policy's scopes as snapshots and `permdock cloud push` carry them, with
+* the resources each partitions.
+*/
 function snapshotScopes(policy) {
 	if (policy.scopes.length === 0) return;
 	const resources = [...policy.resources.values()];
@@ -603,4 +628,4 @@ function snapshotScopes(policy) {
 	});
 }
 //#endregion
-export { isExternallyManaged as _, whereGrant as a, applyRoleKinds as c, rankRoles as d, usesAssigns as f, countHolders as g, composeMemberships as h, collectSnapshotGrants as i, audiencesOf as l, claimsFirst as m, snapshotScopes as n, heldRoleNames as o, asMembershipSource as p, assignableIn as r, roleLeaf as s, snapshotOf as t, bindingOf as u };
+export { claimsFirst as _, heldLevels as a, isExternallyManaged as b, heldRoleNames as c, audiencesOf as d, bindingOf as f, asMembershipSource as g, usesAssigns as h, assignableIn as i, roleLeaf as l, roleMeta as m, snapshotScopes as n, collectSnapshotGrants as o, rankRoles as p, assignableCandidates as r, whereGrant as s, snapshotOf as t, applyRoleKinds as u, composeMemberships as v, countHolders as y };

package/dist/{instant-BluqDvyS.js → instant-DK3Iz83e.js}

@@ -2,8 +2,8 @@
 const ISO_INSTANT = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?)(Z|[+-]\d{2}(?::?\d{2})?)?)?$/u;
 /**
 * Milliseconds since the epoch for an ISO 8601 date or date-time, or
-* `undefined`. A date-time without a zone and a bare date are UTC, the same
-* in memory, in the ORM compilers and in generated SQL.
+* `undefined`. A date-time without a zone and a bare date are UTC, the same in
+* memory, in the ORM compilers and in generated SQL.
 */
 function isoInstant(value) {
 	const match = ISO_INSTANT.exec(value);

package/dist/{internals-Dk8A8fX3.js → internals-B3IgHrvo.js}

@@ -1,12 +1,15 @@
 //#region src/core/internals.ts
 const INTERNALS = Symbol.for("permdock.internals");
-/** Attaches `internals` to `instance` as a non-enumerable member; call before freezing. */
+/**
+* Attaches `internals` to `instance` as a non-enumerable member; call before
+* freezing.
+*/
 function attachInternals(instance, internals) {
 	Object.defineProperty(instance, INTERNALS, { value: internals });
 }
 /**
-* The internals of a server instance, or `undefined` for an instance built
-* from a snapshot or one that is not PermDock's. A feature function treats
+* The internals of a server instance, or `undefined` for an instance built from
+* a snapshot or one that is not PermDock's. A feature function treats
 * `undefined` as a check it cannot answer and denies with `unsupported`.
 */
 function internalsOf(permdock) {

package/dist/{json-schema-B-vAwlde.js → json-schema-BPGa-RjQ.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 //#region src/core/json-schema.ts
 function issue(issues, path, message) {
 	issues.push({
@@ -64,7 +64,10 @@ function resolveRef(root, ref) {
 	if (target === void 0) throw new TypeError(`Unsupported or unknown $ref ${ref}`);
 	return target;
 }
-/** Validates a `copyJson` result against `node`, reading `$ref` targets from `root`. */
+/**
+* Validates a `copyJson` result against `node`, reading `$ref` targets from
+* `root`.
+*/
 function checkSchema(node, value, path, issues, root = node) {
 	if (node.$ref !== void 0) {
 		checkSchema(resolveRef(root, node.$ref), value, path, issues, root);
@@ -130,7 +133,10 @@ function checkSchema(node, value, path, issues, root = node) {
 		else if (node.additionalProperties !== void 0) checkSchema(node.additionalProperties, value[key], [...path, key], issues, root);
 	}
 }
-/** The path of the first `__proto__`, `constructor` or `prototype` key in `value`, if any. */
+/**
+* The path of the first `__proto__`, `constructor` or `prototype` key in
+* `value`, if any.
+*/
 function forbiddenKeyPath(value, path = []) {
 	if (value === null || typeof value !== "object") return;
 	for (const [key, child] of Object.entries(value)) {

package/dist/{json-schema-CN_iLFH2.d.ts → json-schema-BfXgnRNT.d.ts}

@@ -1,10 +1,10 @@
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/json-schema.d.ts
 /**
- * The JSON Schema 2020-12 keywords the package's own schemas use;
- * `checkSchema` interprets exactly these. `$ref` resolves only `#/$defs/<name>`
- * against the root node. Annotations (`title`, `description`, `format`) are
- * ignored, so a `format` always sits next to a `pattern` that enforces it.
+ * The JSON Schema 2020-12 keywords the package's own schemas use; `checkSchema`
+ * interprets exactly these. `$ref` resolves only `#/$defs/<name>` against the
+ * root node. Annotations (`title`, `description`, `format`) are ignored, so a
+ * `format` always sits next to a `pattern` that enforces it.
  */
 type JsonSchemaNode = {
   readonly $schema?: string;

package/dist/jwt/index.d.ts

@@ -1,10 +1,13 @@
-import { Y as JwtClaims, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, pt as VerifiedToken, sr as Principal, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-D4UC9TTW.js";
-import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-cTos-H7p.js";
-import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
+import { Z as JwtClaims, _t as VerifiedToken, hr as Subject, ht as TokenVerifier, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DsHGPtkR.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
-/** `on('auth')` causes: a verification failure, or one of the three capability checks. */
+/**
+ * `on('auth')` causes: a verification failure, or one of the three capability
+ * checks.
+ */
 type CapabilityFailureCause = TokenFailureCause | "capability-revoked" | "capability-replayed" | "redeemer-mismatch" | "link-policy";
 type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "audience" | "profile"> & {
   /** The issuer the capability was signed by (`iss`); required. */
@@ -13,20 +16,26 @@ type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer"
   readonly audience: string | readonly string[];
   readonly verifier?: TokenVerifier;
   /**
-   * The link policies of the scope instances the linked resource sits in
-   * (its tenant, its customer); every one must hold. A throw denies.
+   * The link policies of the scope instances the linked resource sits in (its
+   * tenant, its customer); every one must hold. A throw denies.
    */
   readonly linkPolicy?: (capability: Capability) => LinkPolicy | readonly LinkPolicy[] | undefined | Promise<LinkPolicy | readonly LinkPolicy[] | undefined>;
   /** `true` when the application revoked the link id (`sub`); a throw denies. */
   readonly revoked?: (id: string) => boolean | Promise<boolean>;
-  /** Claims the `jti` of a one-time capability; a one-time capability without it is refused. */
+  /**
+   * Claims the `jti` of a one-time capability; a one-time capability without it
+   * is refused.
+   */
   readonly replay?: ReplayStore;
-  /** The request's own verified subject, checked against the capability's `redeemer`. */
+  /**
+   * The request's own verified subject, checked against the capability's
+   * `redeemer`.
+   */
   readonly viewer?: Subject;
   /**
    * The incoming request. A capability with `cnf` resolves only when the
-   * request carries a DPoP proof (RFC 9449) signed by the bound key;
-   * without one it is refused.
+   * request carries a DPoP proof (RFC 9449) signed by the bound key; without
+   * one it is refused.
    */
   readonly request?: Request;
   readonly onAuth?: (event: AuthEvent) => void;
@@ -34,8 +43,8 @@ type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer"
 };
 /**
  * Resolves a `vnd.permdock.capability+jwt` into the `link` subject it acts as.
- * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
- * a revoked link, a replayed one-time token, a redeemer the viewer does not
+ * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim, a
+ * revoked link, a replayed one-time token, a redeemer the viewer does not
  * satisfy, a `cnf` without a matching DPoP proof, a throwing store) is the
  * anonymous subject, never a throw.
  */
@@ -52,13 +61,19 @@ type CiOidcSubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "a
    * from OpenID discovery unless `jwks` is set.
    */
   readonly issuer?: string;
-  /** Validates the verified claims; a failure or a Promise is the anonymous subject. */
+  /**
+   * Validates the verified claims; a failure or a Promise is the anonymous
+   * subject.
+   */
   readonly schema?: StandardSchemaV1;
   readonly verifier?: TokenVerifier;
   readonly onAuth?: (event: AuthEvent) => void;
   readonly requestId?: string;
 };
-/** A CI job: never a user. `ref` is a full ref (`refs/heads/main`, `refs/tags/v1`). */
+/**
+ * A CI job: never a user. `ref` is a full ref (`refs/heads/main`,
+ * `refs/tags/v1`).
+ */
 type CiOidcPrincipal = Principal & {
   readonly kind: "workload";
   readonly issuer: string;
@@ -77,18 +92,27 @@ export declare function subjectFromCiOidc(token: string | undefined | null, opti
 //#endregion
 //#region src/jwt/dpop.d.ts
 type DpopProofOptions = {
-  /** Rejects a proof whose `jti` this key already used within the 60-second window. */
+  /**
+   * Rejects a proof whose `jti` this key already used within the 60-second
+   * window.
+   */
   readonly replay?: ReplayStore;
 };
 export declare function verifyDpopProof(request: Request, claims: JwtClaims, accessToken?: string, options?: DpopProofOptions): Promise<DpopProofResult>;
 //#endregion
 //#region src/jwt/id-token.d.ts
-/** `TokenFailureCause` plus `nonce-mismatch`; a `TokenVerifier` never returns it. */
+/**
+ * `TokenFailureCause` plus `nonce-mismatch`; a `TokenVerifier` never returns
+ * it.
+ */
 type IdTokenFailureCause = TokenFailureCause | "nonce-mismatch";
 type VerifyIdTokenOptions = {
   /** The OpenID Provider's issuer; `iss` must equal it. */
   readonly issuer: string;
-  /** The relying party's `client_id`; `aud` must contain it and `azp`, when present, must equal it. */
+  /**
+   * The relying party's `client_id`; `aud` must contain it and `azp`, when
+   * present, must equal it.
+   */
   readonly clientId: string;
   /** The `nonce` sent in the authentication request; the token's must equal it. */
   readonly nonce?: string;
@@ -118,9 +142,9 @@ type VerifyIdTokenResult = {
 };
 /**
  * Verifies an OpenID Connect ID token for a relying party (Core section
- * 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent,
- * `azp` and, when `nonce` is given, `nonce`. It does not check `at_hash`,
- * `c_hash`, `auth_time` or `acr`. Never throws.
+ * 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent, `azp`
+ * and, when `nonce` is given, `nonce`. It does not check `at_hash`, `c_hash`,
+ * `auth_time` or `acr`. Never throws.
  */
 export declare function verifyIdToken(token: string, options: VerifyIdTokenOptions): Promise<VerifyIdTokenResult>;
 //#endregion
@@ -135,13 +159,19 @@ export declare function subjectFromJwt(token: string | undefined | null, options
 export declare function jwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
 //#endregion
 //#region src/jwt/subject-token.d.ts
-/** `TokenFailureCause` plus the two checks `verifySubjectToken` adds; a `TokenVerifier` never returns them. */
+/**
+ * `TokenFailureCause` plus the two checks `verifySubjectToken` adds; a
+ * `TokenVerifier` never returns them.
+ */
 type SubjectTokenFailureCause = TokenFailureCause | "replayed" | "lifetime-exceeded";
 type VerifySubjectTokenOptions = {
   /** Tried in order; the first that accepts the token wins. */
   readonly verifiers: readonly TokenVerifier[];
   readonly audience: string | readonly string[];
-  /** Records each `jti` once; `claim` when the store has it, else `seen` and `remember`. */
+  /**
+   * Records each `jti` once; `claim` when the store has it, else `seen` and
+   * `remember`.
+   */
   readonly replay: ReplayStore;
   /** The largest `exp - iat`, in seconds; default 300. */
   readonly maxLifetime?: number;
@@ -163,10 +193,10 @@ type VerifySubjectTokenResult = {
 };
 /**
  * Verifies a subject token: an RFC 9068 `at+jwt` naming one subject for one
- * request, such as the `PermDock-Subject` header. The first of `verifiers`
- * that accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`,
- * live at most `maxLifetime` seconds, and present its `jti` once. A replay
- * store that throws refuses the token as `replayed`. Never throws.
+ * request, such as the `PermDock-Subject` header. The first of `verifiers` that
+ * accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`, live at
+ * most `maxLifetime` seconds, and present its `jti` once. A replay store that
+ * throws refuses the token as `replayed`. Never throws.
  */
 export declare function verifySubjectToken(token: string, options: VerifySubjectTokenOptions): Promise<VerifySubjectTokenResult>;
 //#endregion

package/dist/jwt/index.js

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as epochSeconds, p as nowSeconds } from "../time-DkWjdL98.js";
-import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as epochSeconds, p as nowSeconds } from "../time-nR1JesoH.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-L7NnfhiE.js";
-import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
+import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-BqX94r07.js";
+import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as loadJose } from "../load-jose-DZ4dnjri.js";
-import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-etGIS_Dv.js";
-import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
+import { i as validateCustomClaims, n as idTokenMismatch, r as mapClaimsToSubject, t as acceptMismatch } from "../map-claims-C-nv08_n.js";
+import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 //#region src/jwt/dpop.ts
 const DPOP_WINDOW_SECONDS = 60;
 const PROOF_ALGS = /* @__PURE__ */ new Set([
@@ -147,8 +147,8 @@ async function stores(options, capability, issuedAt, once) {
 }
 /**
 * Resolves a `vnd.permdock.capability+jwt` into the `link` subject it acts as.
-* Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
-* a revoked link, a replayed one-time token, a redeemer the viewer does not
+* Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim, a
+* revoked link, a replayed one-time token, a redeemer the viewer does not
 * satisfy, a `cnf` without a matching DPoP proof, a throwing store) is the
 * anonymous subject, never a throw.
 */
@@ -321,9 +321,9 @@ async function subjectFromCiOidc(token, options) {
 //#region src/jwt/id-token.ts
 /**
 * Verifies an OpenID Connect ID token for a relying party (Core section
-* 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent,
-* `azp` and, when `nonce` is given, `nonce`. It does not check `at_hash`,
-* `c_hash`, `auth_time` or `acr`. Never throws.
+* 3.1.3.7): signature, `iss`, `aud`, `exp`, `iat`, `typ` `JWT` or absent, `azp`
+* and, when `nonce` is given, `nonce`. It does not check `at_hash`, `c_hash`,
+* `auth_time` or `acr`. Never throws.
 */
 async function verifyIdToken(token, options) {
 	const verifier = options.verifier ?? joseTokenVerifier(compact({
@@ -552,10 +552,10 @@ function mtlsThumbprint(claims) {
 }
 /**
 * The sender constraint to enforce. Without a configured `sender`, a token
-* whose `cnf` binds it to a key or a certificate is held to that binding,
-* never accepted as a bearer token (RFC 9449 section 7.1, RFC 8705
-* section 3). An explicit `sender: "none"` is the opt-out for a gateway
-* that verified the binding upstream.
+* whose `cnf` binds it to a key or a certificate is held to that binding, never
+* accepted as a bearer token (RFC 9449 section 7.1, RFC 8705 section 3). An
+* explicit `sender: "none"` is the opt-out for a gateway that verified the
+* binding upstream.
 */
 function senderFor(options, cnf) {
 	if (options.sender !== void 0) return options.sender;
@@ -670,7 +670,10 @@ async function resolveSubject(token, options, request) {
 //#endregion
 //#region src/jwt/subject-token.ts
 const DEFAULT_MAX_LIFETIME = 300;
-/** Causes a verifier for another issuer answers; a different cause names the token's real fault. */
+/**
+* Causes a verifier for another issuer answers; a different cause names the
+* token's real fault.
+*/
 const OTHER_ISSUER = /* @__PURE__ */ new Set(["wrong-issuer", "unknown-kid"]);
 async function firstAccepted(token, options) {
 	const causes = [];
@@ -703,10 +706,10 @@ async function claimOnce(replay, key, expiresAt) {
 }
 /**
 * Verifies a subject token: an RFC 9068 `at+jwt` naming one subject for one
-* request, such as the `PermDock-Subject` header. The first of `verifiers`
-* that accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`,
-* live at most `maxLifetime` seconds, and present its `jti` once. A replay
-* store that throws refuses the token as `replayed`. Never throws.
+* request, such as the `PermDock-Subject` header. The first of `verifiers` that
+* accepts it wins. The token must carry `sub`, `jti`, `iat` and `exp`, live at
+* most `maxLifetime` seconds, and present its `jti` once. A replay store that
+* throws refuses the token as `replayed`. Never throws.
 */
 async function verifySubjectToken(token, options) {
 	const verified = await firstAccepted(token, options);