@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/dist/auth/oauth-single/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAA0B,EAC1B,GAAqB;IAErB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3C,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAqB,EACrB,UAAU,GAAG,qBAAqB,EAClC,WAAW,GAAG,wBAAwB,EACtC,OAAO,GAAiB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IAEvF,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7D,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;QAC9C,aAAa,EAAE,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA0B;IACxD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC5E,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAsB,EAAE,CACtD,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO;QACL,GAAG,KAAK;QACR,GAAG;QACH,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;QAC3B,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,aAAa,EAAE,WAAW,CAAC,eAAe,CAAC;QAC3C,cAAc,EAAE,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC5F,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAA0B;IACnD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK;QACxC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY;QAC7C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/auth/repositories.d.ts

@@ -0,0 +1,58 @@
+export declare const AUTH_USER_REPOSITORY: {
+    readonly name: "users";
+    readonly resource: "auth_users";
+    readonly scope: "system";
+    readonly resourceDefinition: {
+        readonly name: "auth_users";
+        readonly table: "auth_users";
+        readonly scope: "system";
+        readonly columns: readonly ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"];
+        readonly readableColumns: readonly ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"];
+        readonly orderableColumns: readonly ["id", "email", "created_at"];
+        readonly writableColumns: readonly ["display_name", "is_admin"];
+    };
+};
+export declare const AUTH_GROUP_REPOSITORY: {
+    readonly name: "groups";
+    readonly resource: "auth_groups";
+    readonly scope: "system";
+    readonly resourceDefinition: {
+        readonly name: "auth_groups";
+        readonly table: "auth_groups";
+        readonly scope: "system";
+        readonly columns: readonly ["name", "display_name", "description", "created_at", "updated_at"];
+        readonly idColumn: "name";
+        readonly readableColumns: readonly ["name", "display_name", "description", "created_at", "updated_at"];
+        readonly orderableColumns: readonly ["name", "created_at"];
+        readonly writableColumns: readonly ["name", "display_name", "description"];
+    };
+};
+export declare const authRepositoryDefinitions: readonly [{
+    readonly name: "users";
+    readonly resource: "auth_users";
+    readonly scope: "system";
+    readonly resourceDefinition: {
+        readonly name: "auth_users";
+        readonly table: "auth_users";
+        readonly scope: "system";
+        readonly columns: readonly ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"];
+        readonly readableColumns: readonly ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"];
+        readonly orderableColumns: readonly ["id", "email", "created_at"];
+        readonly writableColumns: readonly ["display_name", "is_admin"];
+    };
+}, {
+    readonly name: "groups";
+    readonly resource: "auth_groups";
+    readonly scope: "system";
+    readonly resourceDefinition: {
+        readonly name: "auth_groups";
+        readonly table: "auth_groups";
+        readonly scope: "system";
+        readonly columns: readonly ["name", "display_name", "description", "created_at", "updated_at"];
+        readonly idColumn: "name";
+        readonly readableColumns: readonly ["name", "display_name", "description", "created_at", "updated_at"];
+        readonly orderableColumns: readonly ["name", "created_at"];
+        readonly writableColumns: readonly ["name", "display_name", "description"];
+    };
+}];
+//# sourceMappingURL=repositories.d.ts.map

package/dist/auth/repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositories.d.ts","sourceRoot":"","sources":["../../src/auth/repositories.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB;aAC/B,IAAI,EAAE,OAAO;aACb,QAAQ,EAAE,YAAY;aACtB,KAAK,EAAE,QAAQ;aACf,kBAAkB;iBAChB,IAAI,EAAE,YAAY;iBAClB,KAAK,EAAE,YAAY;iBACnB,KAAK,EAAE,QAAQ;iBACf,OAAO,YAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;iBACtG,eAAe,YAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;iBAC9G,gBAAgB,YAAG,IAAI,EAAE,OAAO,EAAE,YAAY;iBAC9C,eAAe,YAAG,cAAc,EAAE,UAAU;;CAEtC,CAAC;AAEX,eAAO,MAAM,qBAAqB;aAChC,IAAI,EAAE,QAAQ;aACd,QAAQ,EAAE,aAAa;aACvB,KAAK,EAAE,QAAQ;aACf,kBAAkB;iBAChB,IAAI,EAAE,aAAa;iBACnB,KAAK,EAAE,aAAa;iBACpB,KAAK,EAAE,QAAQ;iBACf,OAAO,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;iBAC3E,QAAQ,EAAE,MAAM;iBAChB,eAAe,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;iBACnF,gBAAgB,YAAG,MAAM,EAAE,YAAY;iBACvC,eAAe,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa;;CAEjD,CAAC;AAEX,eAAO,MAAM,yBAAyB;mBA9B9B,OAAO;uBACH,YAAY;oBACf,QAAQ;;iBAEb,IAAI,EAAE,YAAY;iBAClB,KAAK,EAAE,YAAY;iBACnB,KAAK,EAAE,QAAQ;iBACf,OAAO,YAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;iBACtG,eAAe,YAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY;iBAC9G,gBAAgB,YAAG,IAAI,EAAE,OAAO,EAAE,YAAY;iBAC9C,eAAe,YAAG,cAAc,EAAE,UAAU;;;mBAKxC,QAAQ;uBACJ,aAAa;oBAChB,QAAQ;;iBAEb,IAAI,EAAE,aAAa;iBACnB,KAAK,EAAE,aAAa;iBACpB,KAAK,EAAE,QAAQ;iBACf,OAAO,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;iBAC3E,QAAQ,EAAE,MAAM;iBAChB,eAAe,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY;iBACnF,gBAAgB,YAAG,MAAM,EAAE,YAAY;iBACvC,eAAe,YAAG,MAAM,EAAE,cAAc,EAAE,aAAa;;EAIoC,CAAC"}

package/dist/auth/repositories.js

@@ -0,0 +1,31 @@
+export const AUTH_USER_REPOSITORY = {
+    name: "users",
+    resource: "auth_users",
+    scope: "system",
+    resourceDefinition: {
+        name: "auth_users",
+        table: "auth_users",
+        scope: "system",
+        columns: ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"],
+        readableColumns: ["id", "provider", "subject", "email", "display_name", "is_admin", "created_at", "updated_at"],
+        orderableColumns: ["id", "email", "created_at"],
+        writableColumns: ["display_name", "is_admin"],
+    },
+};
+export const AUTH_GROUP_REPOSITORY = {
+    name: "groups",
+    resource: "auth_groups",
+    scope: "system",
+    resourceDefinition: {
+        name: "auth_groups",
+        table: "auth_groups",
+        scope: "system",
+        columns: ["name", "display_name", "description", "created_at", "updated_at"],
+        idColumn: "name",
+        readableColumns: ["name", "display_name", "description", "created_at", "updated_at"],
+        orderableColumns: ["name", "created_at"],
+        writableColumns: ["name", "display_name", "description"],
+    },
+};
+export const authRepositoryDefinitions = [AUTH_USER_REPOSITORY, AUTH_GROUP_REPOSITORY];
+//# sourceMappingURL=repositories.js.map

package/dist/auth/repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositories.js","sourceRoot":"","sources":["../../src/auth/repositories.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,YAAY;IACtB,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC;QACvG,eAAe,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC;QAC/G,gBAAgB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC;QAC/C,eAAe,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;KAC9C;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,aAAa;IACvB,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;QAC5E,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;QACpF,gBAAgB,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;QACxC,eAAe,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,CAAC;KACzD;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAC"}

package/dist/auth/scopes/d1.d.ts

@@ -0,0 +1,17 @@
+import type { AuthScope, UserGrant } from "./model.js";
+export declare function ensureScopes(env: unknown, scopes?: readonly unknown[], { who }?: {
+    who?: string | undefined;
+}): Promise<void>;
+export declare function listAuthorizationScopes(env: unknown, { who }?: {
+    who?: string | undefined;
+}): Promise<AuthScope[]>;
+export declare function getAuthorizationScope(env: unknown, name: string, { who }?: {
+    who?: string | undefined;
+}): Promise<AuthScope | null>;
+export declare function listUserGrants(env: unknown, userId: string, { who }?: {
+    who?: string | undefined;
+}): Promise<UserGrant[]>;
+export declare function replaceUserGrants(env: unknown, userId: string, scopes: readonly string[], grantedBy: string | null | undefined, { who }?: {
+    who?: string | undefined;
+}): Promise<string[]>;
+//# sourceMappingURL=d1.d.ts.map

package/dist/auth/scopes/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/d1.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvD,wBAAsB,YAAY,CAChC,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,SAAS,OAAO,EAAO,EAC/B,EAAE,GAAmB,EAAE;;CAAK,GAC3B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,EAAE,GAAmB,EAAE;;CAAK,GAC3B,OAAO,CAAC,SAAS,EAAE,CAAC,CAKtB;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,EAAE,GAAmB,EAAE;;CAAK,GAC3B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3B;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,EAAE,GAAmB,EAAE;;CAAK,GAC3B,OAAO,CAAC,SAAS,EAAE,CAAC,CAMtB;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,EAAE,GAAmB,EAAE;;CAAK,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB"}

package/dist/auth/scopes/d1.js

@@ -0,0 +1,54 @@
+import { createD1, hasD1Binding } from "../../core/database/index.js";
+import { AUTH_GRANT_TABLE, AUTH_SCOPE_TABLE } from "../constants.js";
+import { normalizeScopes } from "./validation.js";
+export async function ensureScopes(env, scopes = [], { who = "system:read" } = {}) {
+    if (!hasD1Binding(env))
+        return;
+    const db = createD1(env, { who });
+    for (const scope of normalizeScopes(scopes)) {
+        await db.prepare(`
+      INSERT INTO ${AUTH_SCOPE_TABLE} (name,label,description,system)
+      VALUES (?,?,?,?)
+      ON CONFLICT(name) DO NOTHING
+    `).bind(scope.name, scope.label, scope.description, scope.system ? 1 : 0).run();
+    }
+}
+export async function listAuthorizationScopes(env, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who })
+        .prepare(`SELECT name,label,description,system FROM ${AUTH_SCOPE_TABLE} ORDER BY name`)
+        .all();
+    return result.results ?? [];
+}
+export async function getAuthorizationScope(env, name, { who = "system:read" } = {}) {
+    return createD1(env, { who })
+        .prepare(`SELECT name,label,description,system FROM ${AUTH_SCOPE_TABLE} WHERE name=?`)
+        .bind(name)
+        .first();
+}
+export async function listUserGrants(env, userId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who })
+        .prepare(`SELECT scope_name,granted_at FROM ${AUTH_GRANT_TABLE} WHERE user_id=? ORDER BY scope_name`)
+        .bind(userId)
+        .all();
+    return result.results ?? [];
+}
+export async function replaceUserGrants(env, userId, scopes, grantedBy, { who = "system:read" } = {}) {
+    const catalog = await listAuthorizationScopes(env, { who });
+    const valid = new Map(catalog.map((scope) => [scope.name, scope]));
+    const requested = [...new Set(scopes)];
+    const unknown = requested.filter((scope) => !valid.has(scope));
+    if (unknown.length)
+        throw new TypeError(`Unknown scopes: ${unknown.join(", ")}`);
+    const protectedScopes = requested.filter((scope) => Boolean(valid.get(scope)?.system));
+    if (protectedScopes.length) {
+        throw new TypeError(`System scopes cannot be assigned directly: ${protectedScopes.join(", ")}`);
+    }
+    const db = createD1(env, { who });
+    await db.batch([
+        db.prepare(`DELETE FROM ${AUTH_GRANT_TABLE} WHERE user_id=?`).bind(userId),
+        ...requested.map((scope) => db.prepare(`INSERT INTO ${AUTH_GRANT_TABLE} (user_id,scope_name,granted_by) VALUES (?,?,?)`)
+            .bind(userId, scope, grantedBy || null)),
+    ]);
+    return requested;
+}
+//# sourceMappingURL=d1.js.map

package/dist/auth/scopes/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../../src/auth/scopes/d1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAY,EACZ,MAAM,GAAuB,EAAE,EAC/B,EAAE,GAAG,GAAG,aAAa,EAAE,GAAG,EAAE;IAE5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,OAAO,CAAC;oBACD,gBAAgB;;;KAG/B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAY,EACZ,EAAE,GAAG,GAAG,aAAa,EAAE,GAAG,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,6CAA6C,gBAAgB,gBAAgB,CAAC;SACtF,GAAG,EAA+B,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAY,EACZ,IAAY,EACZ,EAAE,GAAG,GAAG,aAAa,EAAE,GAAG,EAAE;IAE5B,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SAC1B,OAAO,CAAC,6CAA6C,gBAAgB,eAAe,CAAC;SACrF,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,EAAa,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAY,EACZ,MAAc,EACd,EAAE,GAAG,GAAG,aAAa,EAAE,GAAG,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,qCAAqC,gBAAgB,sCAAsC,CAAC;SACpG,IAAI,CAAC,MAAM,CAAC;SACZ,GAAG,EAA+B,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,MAAc,EACd,MAAyB,EACzB,SAAoC,EACpC,EAAE,GAAG,GAAG,aAAa,EAAE,GAAG,EAAE;IAE5B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACvF,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,8CAA8C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,eAAe,gBAAgB,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1E,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,EAAE,CAAC,OAAO,CAAC,eAAe,gBAAgB,iDAAiD,CAAC;aACzF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAC1C;KACF,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth/scopes/domain.d.ts

@@ -0,0 +1,7 @@
+import { AppDomain } from "../../domain/index.js";
+import type { AuthScope, ScopeAuthorizationState } from "./model.js";
+export declare class AuthScopesDomain extends AppDomain<AuthScope, unknown, ScopeAuthorizationState> {
+    constructor();
+}
+export declare const authScopes: AuthScopesDomain;
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/scopes/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAIrE,qBAAa,gBAAiB,SAAQ,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC;IAC1F,cAkBC;CACF;AAED,eAAO,MAAM,UAAU,kBAAyB,CAAC"}

package/dist/auth/scopes/domain.js

@@ -0,0 +1,25 @@
+import { AppDomain } from "../../domain/index.js";
+import { getAuthorizationScope, listAuthorizationScopes, validateScopeName } from "./service.js";
+import { badRequest, notFound } from "../../api/http.js";
+import { ScopeListView } from "./views/list.js";
+export class AuthScopesDomain extends AppDomain {
+    constructor() {
+        super({ name: "auth.scopes", basePath: "/api/admin/scopes", auth: "user", scopes: "scopes:read" });
+        this.view("list", ScopeListView);
+        this.route({
+            method: "GET",
+            handler: ({ env, identity }) => listAuthorizationScopes(env, { who: identity.who }).then((scopes) => Response.json({ scopes })),
+        });
+        this.route({ method: "GET", path: "/:scopeName", handler: async ({ env, identity, params }) => {
+                try {
+                    const scope = await getAuthorizationScope(env, validateScopeName(params.scopeName), { who: identity.who });
+                    return scope ? Response.json({ scope }) : notFound("Scope not found.");
+                }
+                catch (error) {
+                    return badRequest(error instanceof Error ? error.message : "Invalid scope name");
+                }
+            } });
+    }
+}
+export const authScopes = new AuthScopesDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/scopes/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/scopes/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,MAAM,OAAO,gBAAiB,SAAQ,SAAsD;IAC1F;QACE,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC7B,uBAAuB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAC1B;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC5F,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC3G,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC,EAAE,CAAC,CAAC;IACP,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/auth/scopes/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./model.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/scopes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/scopes/index.js

@@ -0,0 +1,4 @@
+export * from "./model.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/scopes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/scopes/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/scopes/model.d.ts

@@ -0,0 +1,26 @@
+export interface AuthScope {
+    name: string;
+    label: string;
+    description: string;
+    system: boolean;
+    active?: boolean | number;
+}
+export interface NewAuthScope {
+    name: string;
+    label?: string;
+    description?: string;
+    system?: boolean;
+}
+export interface UserGrant {
+    scope_name: string;
+    granted_at?: string;
+}
+export interface ScopeAuthorizationState {
+    user?: {
+        auth_strategy?: string;
+    } | null;
+    authUser?: {
+        is_admin?: boolean;
+    } | null;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/scopes/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/model.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE;AAC3H,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE;AACtG,MAAM,WAAW,SAAS;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;AACtE,MAAM,WAAW,uBAAuB;IAAG,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE"}

package/dist/auth/scopes/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/scopes/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/scopes/model.ts"],"names":[],"mappings":""}

package/dist/auth/scopes/policy.d.ts

@@ -0,0 +1,3 @@
+import type { ScopeAuthorizationState } from "./model.js";
+export declare function canManageScopes(state: ScopeAuthorizationState): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/auth/scopes/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1D,wBAAgB,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEvE"}

package/dist/auth/scopes/policy.js

@@ -0,0 +1,4 @@
+export function canManageScopes(state) {
+    return state.user?.auth_strategy === "http_basic" || state.authUser?.is_admin === true;
+}
+//# sourceMappingURL=policy.js.map

package/dist/auth/scopes/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/auth/scopes/policy.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,OAAO,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;AACzF,CAAC"}

package/dist/auth/scopes/service.d.ts

@@ -0,0 +1,4 @@
+export { ensureScopes, getAuthorizationScope, listAuthorizationScopes, listUserGrants, replaceUserGrants } from "./d1.js";
+export { normalizeScopes, validateScopeName, validateScopeInput, validateScopeNames } from "./validation.js";
+export { canManageScopes } from "./policy.js";
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/scopes/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/scopes/service.js

@@ -0,0 +1,4 @@
+export { ensureScopes, getAuthorizationScope, listAuthorizationScopes, listUserGrants, replaceUserGrants } from "./d1.js";
+export { normalizeScopes, validateScopeName, validateScopeInput, validateScopeNames } from "./validation.js";
+export { canManageScopes } from "./policy.js";
+//# sourceMappingURL=service.js.map

package/dist/auth/scopes/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/scopes/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/scopes/validation.d.ts

@@ -0,0 +1,6 @@
+import type { AuthScope, NewAuthScope } from "./model.js";
+export declare function normalizeScopes(scopes?: readonly unknown[]): AuthScope[];
+export declare function validateScopeName(value: unknown): string;
+export declare function validateScopeInput(value: unknown): NewAuthScope;
+export declare function validateScopeNames(values: readonly unknown[]): string[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/scopes/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,eAAe,CAAC,MAAM,GAAE,SAAS,OAAO,EAAO,GAAG,SAAS,EAAE,CAc5E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMxD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAI/D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,EAAE,CAEvE"}

package/dist/auth/scopes/validation.js

@@ -0,0 +1,33 @@
+const SCOPE_PATTERN = /^[a-z0-9]+(?::[a-z0-9-]+)+$/;
+export function normalizeScopes(scopes = []) {
+    return scopes
+        .map((scope) => {
+        if (typeof scope === "string")
+            return { name: scope };
+        return scope && typeof scope === "object" ? scope : null;
+    })
+        .filter((scope) => scope !== null && SCOPE_PATTERN.test(String(scope.name ?? "")))
+        .map((scope) => ({
+        name: String(scope.name),
+        label: String(scope.label ?? scope.name),
+        description: String(scope.description ?? ""),
+        system: Boolean(scope.system),
+    }));
+}
+export function validateScopeName(value) {
+    const name = String(value ?? "").trim();
+    if (!SCOPE_PATTERN.test(name)) {
+        throw new TypeError("Scope names must use the form resource:action.");
+    }
+    return name;
+}
+export function validateScopeInput(value) {
+    const scope = normalizeScopes([value])[0];
+    if (!scope)
+        throw new TypeError("A valid scope name is required.");
+    return scope;
+}
+export function validateScopeNames(values) {
+    return [...new Set(values.map(validateScopeName))];
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/scopes/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/scopes/validation.ts"],"names":[],"mappings":"AACA,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,MAAM,UAAU,eAAe,CAAC,MAAM,GAAuB,EAAE;IAC7D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAuB,EAAE;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACtD,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAyB,EAAE,CACvC,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;QACxC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;KAC9B,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/auth/scopes/views/list.d.ts

@@ -0,0 +1,9 @@
+/** @jsxImportSource hono/jsx */
+import type { FC } from "hono/jsx";
+import type { AuthScope } from "../model.js";
+export interface ScopeListViewProps {
+    scopes: readonly AuthScope[];
+}
+/** Hono JSX keeps this view renderable directly in a Worker without React. */
+export declare const ScopeListView: FC<ScopeListViewProps>;
+//# sourceMappingURL=list.d.ts.map

package/dist/auth/scopes/views/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/auth/scopes/views/list.tsx"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,MAAM,WAAW,kBAAkB;IAAG,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE;AACpE,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC,kBAAkB,CAAwI,CAAC"}

package/dist/auth/scopes/views/list.js

@@ -0,0 +1,4 @@
+import { jsx as _jsx, jsxs as _jsxs } from "hono/jsx/jsx-runtime";
+/** Hono JSX keeps this view renderable directly in a Worker without React. */
+export const ScopeListView = ({ scopes }) => _jsx("ul", { children: scopes.map((scope) => _jsxs("li", { children: [_jsx("strong", { children: scope.label }), " ", _jsx("code", { children: scope.name })] }, scope.name)) });
+//# sourceMappingURL=list.js.map

package/dist/auth/scopes/views/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/auth/scopes/views/list.tsx"],"names":[],"mappings":";AAIA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,uBAAK,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAqB,2BAAS,KAAK,CAAC,KAAK,GAAU,OAAC,yBAAO,KAAK,CAAC,IAAI,GAAQ,KAApE,KAAK,CAAC,IAAI,CAA+D,CAAC,GAAM,CAAC"}

package/dist/auth/subscriptions/d1.d.ts

@@ -0,0 +1,10 @@
+import type { Subscription, SubscriptionEntitlement, SubscriptionManifestEntry, SubscriptionServiceOptions } from "./model.js";
+export declare function listSubscriptionRows(env: unknown, { who }?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function getSubscriptionRow(env: unknown, subscriptionId: string, { who }?: SubscriptionServiceOptions): Promise<Subscription | null>;
+export declare function listTenantSubscriptionRows(env: unknown, tenantId: string, { who }?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function listSubscriptionEntitlementRows(env: unknown, subscriptionId: string, { who }?: SubscriptionServiceOptions): Promise<SubscriptionEntitlement[]>;
+export declare function writeSubscriptionManifest(env: unknown, manifest: readonly SubscriptionManifestEntry[], who: string): Promise<void>;
+export declare function replaceTenantSubscriptionRows(env: unknown, tenantId: string, subscriptionIds: readonly string[], { who }?: SubscriptionServiceOptions): Promise<Subscription[]>;
+export declare function hasSubscriptionRow(env: unknown, tenantId: string, subscriptionId: string, { who }?: SubscriptionServiceOptions): Promise<boolean>;
+export declare function listEntitlementValueRows(env: unknown, tenantId: string, entitlement: string, { who }?: SubscriptionServiceOptions): Promise<unknown[]>;
+//# sourceMappingURL=d1.d.ts.map

package/dist/auth/subscriptions/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/d1.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAKpB,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,OAAO,EACZ,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,YAAY,EAAE,CAAC,CAKzB;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,YAAY,EAAE,CAAC,CASzB;AAED,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,uBAAuB,EAAE,CAAC,CASpC;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,SAAS,yBAAyB,EAAE,EAC9C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,EAAE,GAAqB,EAAE,GAAE,0BAA+B,GACzD,OAAO,CAAC,YAAY,EAAE,CAAC,CAkBzB;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,EAAE,GAAmB,EAAE,GAAE,0BAA+B,GACvD,OAAO,CAAC,OAAO,EAAE,CAAC,CAQpB"}

package/dist/auth/subscriptions/d1.js

@@ -0,0 +1,86 @@
+import { createD1 } from "../../core/database/index.js";
+import { parseJsonValue } from "../encoding.js";
+export async function listSubscriptionRows(env, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who })
+        .prepare("SELECT id,name,created_at,updated_at FROM auth_subscriptions ORDER BY name COLLATE NOCASE")
+        .all();
+    return result.results;
+}
+export async function getSubscriptionRow(env, subscriptionId, { who = "system:read" } = {}) {
+    return createD1(env, { who })
+        .prepare("SELECT id,name,created_at,updated_at FROM auth_subscriptions WHERE id=?")
+        .bind(subscriptionId)
+        .first();
+}
+export async function listTenantSubscriptionRows(env, tenantId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare(`
+    SELECT s.id,s.name,s.created_at,s.updated_at
+    FROM auth_subscriptions s
+    JOIN auth_tenant_subscriptions ts ON ts.subscription_id=s.id
+    WHERE ts.tenant_id=?
+    ORDER BY s.name COLLATE NOCASE
+  `).bind(tenantId).all();
+    return result.results;
+}
+export async function listSubscriptionEntitlementRows(env, subscriptionId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who })
+        .prepare("SELECT entitlement,value_json FROM auth_subscription_entitlements WHERE subscription_id=? ORDER BY entitlement")
+        .bind(subscriptionId)
+        .all();
+    return result.results.map((row) => ({
+        entitlement: row.entitlement,
+        value: parseJsonValue(row.value_json),
+    }));
+}
+export async function writeSubscriptionManifest(env, manifest, who) {
+    const db = createD1(env, { who });
+    for (const subscription of manifest) {
+        await db.prepare("INSERT INTO auth_subscriptions (id,name) VALUES (?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,updated_at=CURRENT_TIMESTAMP")
+            .bind(subscription.id, subscription.name)
+            .run();
+        for (const [entitlement, value] of Object.entries(subscription.entitlements)) {
+            await db.prepare("INSERT INTO auth_subscription_entitlements (subscription_id,entitlement,value_json) VALUES (?,?,?) ON CONFLICT(subscription_id,entitlement) DO UPDATE SET value_json=excluded.value_json,updated_at=CURRENT_TIMESTAMP")
+                .bind(subscription.id, entitlement, JSON.stringify(value))
+                .run();
+        }
+        const entitlementNames = Object.keys(subscription.entitlements);
+        const deleteSql = entitlementNames.length
+            ? `DELETE FROM auth_subscription_entitlements WHERE subscription_id=? AND entitlement NOT IN (${entitlementNames.map(() => "?").join(",")})`
+            : "DELETE FROM auth_subscription_entitlements WHERE subscription_id=?";
+        await db.prepare(deleteSql).bind(subscription.id, ...entitlementNames).run();
+    }
+}
+export async function replaceTenantSubscriptionRows(env, tenantId, subscriptionIds, { who = "system:update" } = {}) {
+    const db = createD1(env, { who });
+    if (subscriptionIds.length) {
+        const placeholders = subscriptionIds.map(() => "?").join(",");
+        const result = await db.prepare(`SELECT id FROM auth_subscriptions WHERE id IN (${placeholders})`)
+            .bind(...subscriptionIds)
+            .all();
+        if (result.results.length !== subscriptionIds.length) {
+            throw new TypeError("One or more subscriptions do not exist.");
+        }
+    }
+    await db.batch([
+        db.prepare("DELETE FROM auth_tenant_subscriptions WHERE tenant_id=?").bind(tenantId),
+        ...subscriptionIds.map((subscriptionId) => db.prepare("INSERT INTO auth_tenant_subscriptions (tenant_id,subscription_id) VALUES (?,?)")
+            .bind(tenantId, subscriptionId)),
+    ]);
+    return listTenantSubscriptionRows(env, tenantId, { who });
+}
+export async function hasSubscriptionRow(env, tenantId, subscriptionId, { who = "system:read" } = {}) {
+    return Boolean(await createD1(env, { who })
+        .prepare("SELECT 1 FROM auth_tenant_subscriptions WHERE tenant_id=? AND subscription_id=?")
+        .bind(tenantId, subscriptionId)
+        .first());
+}
+export async function listEntitlementValueRows(env, tenantId, entitlement, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare(`
+    SELECT e.value_json
+    FROM auth_subscription_entitlements e
+    JOIN auth_tenant_subscriptions ts ON ts.subscription_id=e.subscription_id
+    WHERE ts.tenant_id=? AND e.entitlement=?
+  `).bind(tenantId, entitlement).all();
+    return result.results.map((row) => parseJsonValue(row.value_json));
+}
+//# sourceMappingURL=d1.js.map

package/dist/auth/subscriptions/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/d1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAWhD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAY,EACZ,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,2FAA2F,CAAC;SACpG,GAAG,EAAgB,CAAC;IACvB,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,cAAsB,EACtB,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SAC1B,OAAO,CAAC,yEAAyE,CAAC;SAClF,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,EAAgB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAY,EACZ,QAAgB,EAChB,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;;;;;;GAMnD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAgB,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAY,EACZ,cAAsB,EACtB,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,gHAAgH,CAAC;SACzH,IAAI,CAAC,cAAc,CAAC;SACpB,GAAG,EAAkB,CAAC;IACzB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;KACtC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAY,EACZ,QAA8C,EAC9C,GAAW;IAEX,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,EAAE,CAAC,OAAO,CAAC,qIAAqI,CAAC;aACpJ,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC;aACxC,GAAG,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7E,MAAM,EAAE,CAAC,OAAO,CAAC,uNAAuN,CAAC;iBACtO,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;iBAC3D,GAAG,EAAE,CAAC;QACT,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM;YACvC,CAAC,CAAC,8FAA8F,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;YAC5I,CAAC,CAAC,oEAAoE,CAAC;QACzE,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAY,EACZ,QAAgB,EAChB,eAAkC,EAClC,EAAE,GAAG,GAAG,eAAe,EAAE,GAA+B,EAAE;IAE1D,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,kDAAkD,YAAY,GAAG,CAAC;aAC/F,IAAI,CAAC,GAAG,eAAe,CAAC;aACxB,GAAG,EAAkB,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CACxC,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC;aACzF,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,QAAgB,EAChB,cAAsB,EACtB,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,iFAAiF,CAAC;SAC1F,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;SAC9B,KAAK,EAAE,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,EAAE,GAAG,GAAG,aAAa,EAAE,GAA+B,EAAE;IAExD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;;;;;GAKnD,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG,EAAuB,CAAC;IAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/auth/subscriptions/domain.d.ts

@@ -0,0 +1,10 @@
+import { AppDomain } from "../../domain/index.js";
+import type { Subscription } from "./model.js";
+/** Manifest-owned subscription catalog with administrator assignment routes. */
+export declare class AuthSubscriptionsDomain extends AppDomain<Subscription> {
+    #private;
+    constructor(manifest?: readonly unknown[]);
+    initialize(env: unknown): Promise<void>;
+}
+export declare const authSubscriptions: AuthSubscriptionsDomain;
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/subscriptions/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,gFAAgF;AAChF,qBAAa,uBAAwB,SAAQ,SAAS,CAAC,YAAY,CAAC;;IAGlE,YAAY,QAAQ,GAAE,SAAS,OAAO,EAAO,EAmB5C;IAED,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtC;CACF;AAED,eAAO,MAAM,iBAAiB,yBAAgC,CAAC"}

package/dist/auth/subscriptions/domain.js

@@ -0,0 +1,33 @@
+import { AppDomain } from "../../domain/index.js";
+import { badRequest, errorMessage, notFound, readJsonObject, stringArrayField } from "../../api/http.js";
+import { ensureSubscriptionManifest, getSubscription, listSubscriptions, listTenantSubscriptions, replaceTenantSubscriptions } from "./service.js";
+/** Manifest-owned subscription catalog with administrator assignment routes. */
+export class AuthSubscriptionsDomain extends AppDomain {
+    #manifest;
+    constructor(manifest = []) {
+        super({ name: "auth.subscriptions", basePath: "/api/admin/subscriptions", auth: "user", scopes: "subscriptions:read" });
+        this.#manifest = manifest;
+        this.route({ method: "GET", handler: ({ env, identity }) => listSubscriptions(env, { who: identity.who }).then((subscriptions) => Response.json({ subscriptions })) });
+        this.route({ method: "GET", path: "/:subscriptionId", handler: async ({ env, identity, params }) => {
+                const subscription = await getSubscription(env, params.subscriptionId, { who: identity.who });
+                return subscription ? Response.json({ subscription }) : notFound("Subscription not found.");
+            } });
+        this.route({ method: "GET", absolutePath: "/api/admin/tenants/:tenantId/subscriptions", handler: async ({ env, identity, params }) => Response.json({ subscriptions: await listTenantSubscriptions(env, params.tenantId, { who: identity.who }) }) });
+        this.route({ method: "PUT", absolutePath: "/api/admin/tenants/:tenantId/subscriptions", csrf: true, scopes: "subscriptions:manage", handler: async ({ request, env, identity, params }) => {
+                try {
+                    const subscriptions = stringArrayField(await readJsonObject(request), "subscriptions");
+                    if (!subscriptions)
+                        return badRequest("subscriptions must be an array");
+                    return Response.json({ subscriptions: await replaceTenantSubscriptions(env, params.tenantId, subscriptions, { who: identity.who }) });
+                }
+                catch (error) {
+                    return badRequest(errorMessage(error));
+                }
+            } });
+    }
+    initialize(env) {
+        return ensureSubscriptionManifest(env, [...this.#manifest], { who: "system:update" });
+    }
+}
+export const authSubscriptions = new AuthSubscriptionsDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/subscriptions/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/subscriptions/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAInJ,gFAAgF;AAChF,MAAM,OAAO,uBAAwB,SAAQ,SAAuB;IACzD,SAAS,CAAqB;IAEvC,YAAY,QAAQ,GAAuB,EAAE;QAC3C,KAAK,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvK,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;gBACjG,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9F,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC9F,CAAC,EAAE,CAAC,CAAC;QACL,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,4CAA4C,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CACnI,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,4CAA4C,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;gBACxL,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;oBACvF,IAAI,CAAC,aAAa;wBAAE,OAAO,UAAU,CAAC,gCAAgC,CAAC,CAAC;oBACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxI,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC,EAAE,CAAC,CAAC;IACP,CAAC;IAED,UAAU,CAAC,GAAY;QACrB,OAAO,0BAA0B,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IACxF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,uBAAuB,EAAE,CAAC"}

package/dist/auth/subscriptions/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/subscriptions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/subscriptions/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}