@atproto/oauth-scopes 0.0.2 → 0.1.0

package/dist/scopes/blob-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-permission.js","sourceRoot":"","sources":["../../src/scopes/blob-permission.ts"],"names":[],"mappings":";;;AAAA,4CAAmE;AACnE,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAMyB;AAIZ,QAAA,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC,CAAA;AAM7D,MAAa,cAAc;IAGzB,YAA4B,MAAyB;QAAzC;;;;mBAAgB,MAAM;WAAmB;IAAG,CAAC;IAEzD,OAAO,CAAC,OAA4B;QAClC,OAAO,IAAA,0BAAgB,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,CAAC;IAED,QAAQ;QACN,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAuBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACjD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA2B;QAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA4B;QAChD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAc,CAAC;SACjC,CAAC,CAAA;IACJ,CAAC;;AAnDH,wCAoDC;AAvC2B;;;;WAAS,IAAI,kBAAM,CAC3C,MAAM,EACN;QACE,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kBAAQ;YAClB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnB,8DAA8D;gBAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,sBAAc,CAAA;gBAEhD,OAAO,KAAK;qBACT,GAAG,CAAC,WAAW,CAAC;qBAChB,MAAM,CAAC,cAAc,CAAC;qBACtB,IAAI,EAAqB,CAAA;YAC9B,CAAC;SACF;KACF,EACD,QAAQ,CACT;EAnB+B,CAmB/B;AAsBH,SAAS,WAAW,CAClB,KAAQ;IAER,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CACvB,CAAA;AACpC,CAAC;AAED,SAAS,cAAc,CACrB,KAAiB,EACjB,KAAa,EACb,GAA0B;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,4EAA4E;QAC5E,8DAA8D;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM;QACN,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/scopes/identity-permission.d.ts

@@ -0,0 +1,25 @@
+import { Parser } from '../lib/parser.js';
+import { ResourcePermission } from '../lib/resource-permission.js';
+import { ScopeSyntax } from '../lib/syntax.js';
+export declare const IDENTITY_ATTRIBUTES: readonly ["handle", "*"];
+export type IdentityAttribute = (typeof IDENTITY_ATTRIBUTES)[number];
+export type IdentityPermissionMatch = {
+    attr: IdentityAttribute;
+};
+export declare class IdentityPermission implements ResourcePermission<'identity', IdentityPermissionMatch> {
+    readonly attr: IdentityAttribute;
+    constructor(attr: IdentityAttribute);
+    matches(options: IdentityPermissionMatch): boolean;
+    toString(): import("../lib/syntax.js").ScopeStringFor<"identity">;
+    protected static readonly parser: Parser<"identity", {
+        attr: {
+            multiple: false;
+            required: true;
+            validate: (value: unknown) => value is "*" | "handle";
+        };
+    }>;
+    static fromString(scope: string): IdentityPermission | null;
+    static fromSyntax(syntax: ScopeSyntax<'identity'>): IdentityPermission | null;
+    static scopeNeededFor(options: IdentityPermissionMatch): string;
+}
+//# sourceMappingURL=identity-permission.d.ts.map

package/dist/scopes/identity-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-permission.d.ts","sourceRoot":"","sources":["../../src/scopes/identity-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAGhE,eAAO,MAAM,mBAAmB,0BAA0C,CAAA;AAC1E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpE,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,qBAAa,kBACX,YAAW,kBAAkB,CAAC,UAAU,EAAE,uBAAuB,CAAC;aAEtC,IAAI,EAAE,iBAAiB;gBAAvB,IAAI,EAAE,iBAAiB;IAEnD,OAAO,CAAC,OAAO,EAAE,uBAAuB;IAIxC,QAAQ;IAIR,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;OAU/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC;IAMjD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM;CAGhE"}

package/dist/scopes/identity-permission.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityPermission = exports.IDENTITY_ATTRIBUTES = void 0;
+const parser_js_1 = require("../lib/parser.js");
+const syntax_string_js_1 = require("../lib/syntax-string.js");
+const syntax_js_1 = require("../lib/syntax.js");
+const util_js_1 = require("../lib/util.js");
+exports.IDENTITY_ATTRIBUTES = Object.freeze(['handle', '*']);
+class IdentityPermission {
+    constructor(attr) {
+        Object.defineProperty(this, "attr", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: attr
+        });
+    }
+    matches(options) {
+        return this.attr === '*' || this.attr === options.attr;
+    }
+    toString() {
+        return IdentityPermission.parser.format(this);
+    }
+    static fromString(scope) {
+        if (!(0, syntax_js_1.isScopeStringFor)(scope, 'identity'))
+            return null;
+        const syntax = syntax_string_js_1.ScopeStringSyntax.fromString(scope);
+        return IdentityPermission.fromSyntax(syntax);
+    }
+    static fromSyntax(syntax) {
+        const result = IdentityPermission.parser.parse(syntax);
+        if (!result)
+            return null;
+        return new IdentityPermission(result.attr);
+    }
+    static scopeNeededFor(options) {
+        return IdentityPermission.parser.format(options);
+    }
+}
+exports.IdentityPermission = IdentityPermission;
+Object.defineProperty(IdentityPermission, "parser", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new parser_js_1.Parser('identity', {
+        attr: {
+            multiple: false,
+            required: true,
+            validate: (0, util_js_1.knownValuesValidator)(exports.IDENTITY_ATTRIBUTES),
+        },
+    }, 'attr')
+});
+//# sourceMappingURL=identity-permission.js.map

package/dist/scopes/identity-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-permission.js","sourceRoot":"","sources":["../../src/scopes/identity-permission.ts"],"names":[],"mappings":";;;AAAA,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAAgE;AAChE,4CAAqD;AAExC,QAAA,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAU,CAAC,CAAA;AAO1E,MAAa,kBAAkB;IAG7B,YAA4B,IAAuB;QAAvC;;;;mBAAgB,IAAI;WAAmB;IAAG,CAAC;IAEvD,OAAO,CAAC,OAAgC;QACtC,OAAO,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAA;IACxD,CAAC;IAED,QAAQ;QACN,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IAcD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,UAAU,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA+B;QAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAAgC;QACpD,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClD,CAAC;;AAvCH,gDAwCC;AA3B2B;;;;WAAS,IAAI,kBAAM,CAC3C,UAAU,EACV;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAA,8BAAoB,EAAC,2BAAmB,CAAC;SACpD;KACF,EACD,MAAM,CACP;EAV+B,CAU/B"}

package/dist/scopes/include-scope.d.ts

@@ -0,0 +1,54 @@
+import { AtprotoAudience } from '@atproto/did';
+import { LexPermission, LexPermissionSet } from '../lib/lexicon.js';
+import { Nsid, isNsid } from '../lib/nsid.js';
+import { Parser } from '../lib/parser.js';
+import { ScopeSyntax } from '../lib/syntax.js';
+import { BlobPermission } from './blob-permission.js';
+import { RepoPermission } from './repo-permission.js';
+import { RpcPermission } from './rpc-permission.js';
+export { type LexPermission, type LexPermissionSet, type Nsid, isNsid };
+/**
+ * This is used to handle "include:" oauth scope values, used to include
+ * permissions from a lexicon defined permission set. Not being a resource
+ * permission, it does not implement `Matchable`.
+ */
+export declare class IncludeScope {
+    readonly nsid: Nsid;
+    readonly aud: undefined | AtprotoAudience;
+    constructor(nsid: Nsid, aud?: undefined | AtprotoAudience);
+    toString(): import("../lib/syntax.js").ScopeStringFor<"include">;
+    /**
+     * Converts an "include:" to the list of permissions it includes, based on the
+     * lexicon defined permission set.
+     */
+    toPermissions(permissionSet: LexPermissionSet): (BlobPermission | RepoPermission | RpcPermission)[];
+    protected parsePermission(permission: LexPermission): BlobPermission | RepoPermission | RpcPermission | null;
+    /**
+     * Verifies that a permission included through a lexicon permission set is
+     * allowed in the context of the `include:` scope. This basically checks that
+     * the permission is "under" the namespace authority of the `include:` scope,
+     * and that it only contains "repo:", "rpc:", or "blob:" permissions.
+     */
+    protected isAllowedPermission(permission: unknown): permission is RpcPermission | RepoPermission | BlobPermission;
+    /**
+     * Verifies that a permission item's nsid is under the same authority as the
+     * nsid of the lexicon itself (which is the same as the nsid of the `include:`
+     * scope).
+     */
+    isParentAuthorityOf(otherNsid: '*' | Nsid): boolean;
+    protected static readonly parser: Parser<"include", {
+        nsid: {
+            multiple: false;
+            required: true;
+            validate: (v: unknown) => v is Nsid;
+        };
+        aud: {
+            multiple: false;
+            required: false;
+            validate: (value: unknown) => value is AtprotoAudience;
+        };
+    }>;
+    static fromString(scope: string): IncludeScope | null;
+    static fromSyntax(syntax: ScopeSyntax<'include'>): IncludeScope | null;
+}
+//# sourceMappingURL=include-scope.d.ts.map

package/dist/scopes/include-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"include-scope.d.ts","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,OAAO,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,EAAE,CAAA;AAEvE;;;;GAIG;AACH,qBAAa,YAAY;aAEL,IAAI,EAAE,IAAI;aACV,GAAG,EAAE,SAAS,GAAG,eAAe;gBADhC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,SAAS,GAAG,eAA2B;IAG9D,QAAQ;IAIR;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,gBAAgB;IAM7C,SAAS,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa;IAoBnD;;;;;OAKG;IACH,SAAS,CAAC,mBAAmB,CAC3B,UAAU,EAAE,OAAO,GAClB,UAAU,IAAI,aAAa,GAAG,cAAc,GAAG,cAAc;IAgBhE;;;;OAIG;IACI,mBAAmB,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI;IAgChD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;;;;;;OAe/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;CAKjD"}

package/dist/scopes/include-scope.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IncludeScope = exports.isNsid = void 0;
+const did_1 = require("@atproto/did");
+const nsid_js_1 = require("../lib/nsid.js");
+Object.defineProperty(exports, "isNsid", { enumerable: true, get: function () { return nsid_js_1.isNsid; } });
+const parser_js_1 = require("../lib/parser.js");
+const syntax_lexicon_js_1 = require("../lib/syntax-lexicon.js");
+const syntax_string_js_1 = require("../lib/syntax-string.js");
+const syntax_js_1 = require("../lib/syntax.js");
+const blob_permission_js_1 = require("./blob-permission.js");
+const repo_permission_js_1 = require("./repo-permission.js");
+const rpc_permission_js_1 = require("./rpc-permission.js");
+/**
+ * This is used to handle "include:" oauth scope values, used to include
+ * permissions from a lexicon defined permission set. Not being a resource
+ * permission, it does not implement `Matchable`.
+ */
+class IncludeScope {
+    constructor(nsid, aud = undefined) {
+        Object.defineProperty(this, "nsid", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: nsid
+        });
+        Object.defineProperty(this, "aud", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: aud
+        });
+    }
+    toString() {
+        return IncludeScope.parser.format(this);
+    }
+    /**
+     * Converts an "include:" to the list of permissions it includes, based on the
+     * lexicon defined permission set.
+     */
+    toPermissions(permissionSet) {
+        return permissionSet.permissions
+            .map(this.parsePermission, this)
+            .filter(this.isAllowedPermission, this);
+    }
+    parsePermission(permission) {
+        if (permission.resource === 'rpc' &&
+            permission.inheritAud === true &&
+            permission.aud === undefined &&
+            this.aud !== undefined) {
+            // "rpc" permissions can "inherit" their audience from "aud" param defined
+            // in the "include:<nsid>?aud=<audience>" scope the permission set was
+            // loaded from.
+            return parsePermission({
+                ...permission,
+                inheritAud: undefined,
+                aud: this.aud,
+            });
+        }
+        return parsePermission(permission);
+    }
+    /**
+     * Verifies that a permission included through a lexicon permission set is
+     * allowed in the context of the `include:` scope. This basically checks that
+     * the permission is "under" the namespace authority of the `include:` scope,
+     * and that it only contains "repo:", "rpc:", or "blob:" permissions.
+     */
+    isAllowedPermission(permission) {
+        if (permission instanceof rpc_permission_js_1.RpcPermission) {
+            return permission.lxm.every(this.isParentAuthorityOf, this);
+        }
+        if (permission instanceof repo_permission_js_1.RepoPermission) {
+            return permission.collection.every(this.isParentAuthorityOf, this);
+        }
+        if (permission instanceof blob_permission_js_1.BlobPermission) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Verifies that a permission item's nsid is under the same authority as the
+     * nsid of the lexicon itself (which is the same as the nsid of the `include:`
+     * scope).
+     */
+    isParentAuthorityOf(otherNsid) {
+        if (otherNsid === '*') {
+            return false;
+        }
+        const lexiconNsid = this.nsid;
+        const groupPrefixEnd = lexiconNsid.lastIndexOf('.');
+        // There should always be a dot, but since this is a security feature, let's
+        // be strict about it.
+        if (groupPrefixEnd === -1) {
+            throw new TypeError('Dot character (".") missing from lexicon NSID');
+        }
+        // Make sure that otherNsid is at least as long as the "group prefix"
+        if (groupPrefixEnd >= otherNsid.length - 1) {
+            return false;
+        }
+        // Make sure that the "otherNsid" starts with the group of the lexiconNsid,
+        // up to the dot itself. We check in reverse order as nsids tend to have
+        // long common prefixes.
+        for (let i = groupPrefixEnd; i >= 0; i--) {
+            if (lexiconNsid.charCodeAt(i) !== otherNsid.charCodeAt(i)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    static fromString(scope) {
+        if (!(0, syntax_js_1.isScopeStringFor)(scope, 'include'))
+            return null;
+        const syntax = syntax_string_js_1.ScopeStringSyntax.fromString(scope);
+        return IncludeScope.fromSyntax(syntax);
+    }
+    static fromSyntax(syntax) {
+        const result = IncludeScope.parser.parse(syntax);
+        if (!result)
+            return null;
+        return new IncludeScope(result.nsid, result.aud);
+    }
+}
+exports.IncludeScope = IncludeScope;
+Object.defineProperty(IncludeScope, "parser", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new parser_js_1.Parser('include', {
+        nsid: {
+            multiple: false,
+            required: true,
+            validate: nsid_js_1.isNsid,
+        },
+        aud: {
+            multiple: false,
+            required: false,
+            validate: did_1.isAtprotoAudience,
+        },
+    }, 'nsid')
+});
+function parsePermission(permission) {
+    if (isPermissionForResource(permission, 'repo')) {
+        return repo_permission_js_1.RepoPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
+    }
+    if (isPermissionForResource(permission, 'rpc')) {
+        return rpc_permission_js_1.RpcPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
+    }
+    if (isPermissionForResource(permission, 'blob')) {
+        return blob_permission_js_1.BlobPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
+    }
+    return null;
+}
+function isPermissionForResource(permission, type) {
+    return permission.resource === type;
+}
+//# sourceMappingURL=include-scope.js.map

package/dist/scopes/include-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"include-scope.js","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":";;;AAAA,sCAAiE;AAEjE,4CAA6C;AASkB,uFAThD,gBAAM,OASgD;AARrE,gDAAyC;AACzC,gEAA8D;AAC9D,8DAA2D;AAC3D,gDAAgE;AAChE,6DAAqD;AACrD,6DAAqD;AACrD,2DAAmD;AAInD;;;;GAIG;AACH,MAAa,YAAY;IACvB,YACkB,IAAU,EACV,MAAmC,SAAS;QAD5D;;;;mBAAgB,IAAI;WAAM;QAC1B;;;;mBAAgB,GAAG;WAAyC;IAC3D,CAAC;IAEJ,QAAQ;QACN,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,aAA+B;QAC3C,OAAO,aAAa,CAAC,WAAW;aAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC;aAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IAES,eAAe,CAAC,UAAyB;QACjD,IACE,UAAU,CAAC,QAAQ,KAAK,KAAK;YAC7B,UAAU,CAAC,UAAU,KAAK,IAAI;YAC9B,UAAU,CAAC,GAAG,KAAK,SAAS;YAC5B,IAAI,CAAC,GAAG,KAAK,SAAS,EACtB,CAAC;YACD,0EAA0E;YAC1E,sEAAsE;YACtE,eAAe;YACf,OAAO,eAAe,CAAC;gBACrB,GAAG,UAAU;gBACb,UAAU,EAAE,SAAS;gBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,eAAe,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACO,mBAAmB,CAC3B,UAAmB;QAEnB,IAAI,UAAU,YAAY,iCAAa,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,UAAU,YAAY,mCAAc,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,UAAU,YAAY,mCAAc,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;OAIG;IACI,mBAAmB,CAAC,SAAqB;QAC9C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAA;QAE7B,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAEnD,4EAA4E;QAC5E,sBAAsB;QACtB,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;QACtE,CAAC;QAED,qEAAqE;QACrE,IAAI,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,wBAAwB;QACxB,KAAK,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAmBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;;AAhIH,oCAiIC;AA5B2B;;;;WAAS,IAAI,kBAAM,CAC3C,SAAS,EACT;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,gBAAM;SACjB;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,uBAAiB;SAC5B;KACF,EACD,MAAM,CACP;EAf+B,CAe/B;AAeH,SAAS,eAAe,CAAC,UAAyB;IAChD,IAAI,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,mCAAc,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,iCAAa,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,mCAAc,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAa,EACb,IAAO;IAEP,OAAO,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAA;AACrC,CAAC"}

package/dist/scopes/repo-permission.d.ts

@@ -0,0 +1,40 @@
+import { Nsid, isNsid } from '../lib/nsid.js';
+import { Parser } from '../lib/parser.js';
+import { ResourcePermission } from '../lib/resource-permission.js';
+import { NeArray, NeRoArray, ScopeSyntax } from '../lib/syntax.js';
+export { type Nsid, isNsid };
+export declare const REPO_ACTIONS: readonly ["create", "update", "delete"];
+export type RepoAction = (typeof REPO_ACTIONS)[number];
+export declare const isRepoAction: (value: unknown) => value is "delete" | "create" | "update";
+export type CollectionParam = '*' | Nsid;
+export declare const isCollectionParam: (value: unknown) => value is CollectionParam;
+export type RepoPermissionMatch = {
+    collection: string;
+    action: RepoAction;
+};
+export declare class RepoPermission implements ResourcePermission<'repo', RepoPermissionMatch> {
+    readonly collection: NeRoArray<'*' | Nsid>;
+    readonly action: NeRoArray<RepoAction>;
+    constructor(collection: NeRoArray<'*' | Nsid>, action: NeRoArray<RepoAction>);
+    matches({ action, collection }: RepoPermissionMatch): boolean;
+    toString(): import("../lib/syntax.js").ScopeStringFor<"repo">;
+    protected static readonly parser: Parser<"repo", {
+        collection: {
+            multiple: true;
+            required: true;
+            validate: (value: unknown) => value is CollectionParam;
+            normalize: (value: NeRoArray<import("../lib/syntax.js").ParamValue>) => readonly ["*"] | NeArray<`${string}.${string}.${string}`> | ["*" | `${string}.${string}.${string}`];
+        };
+        action: {
+            multiple: true;
+            required: false;
+            validate: (value: unknown) => value is "delete" | "create" | "update";
+            default: readonly ["create", "update", "delete"];
+            normalize: (value: NeRoArray<import("../lib/syntax.js").ParamValue>) => readonly ["create", "update", "delete"] | NeArray<"delete" | "create" | "update">;
+        };
+    }>;
+    static fromString(scope: string): RepoPermission | null;
+    static fromSyntax(syntax: ScopeSyntax<'repo'>): RepoPermission | null;
+    static scopeNeededFor(options: RepoPermissionMatch): string;
+}
+//# sourceMappingURL=repo-permission.d.ts.map

package/dist/scopes/repo-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-permission.d.ts","sourceRoot":"","sources":["../../src/scopes/repo-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,EACL,OAAO,EACP,SAAS,EACT,WAAW,EAEZ,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,EAAE,CAAA;AAE5B,eAAO,MAAM,YAAY,yCAId,CAAA;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AACtD,eAAO,MAAM,YAAY,6DAAqC,CAAA;AAE9D,MAAM,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAA;AACxC,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eAC5B,CAAA;AAEhC,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;CACnB,CAAA;AAED,qBAAa,cACX,YAAW,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC;aAGxC,UAAU,EAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;aACjC,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;gBAD7B,UAAU,EAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,EACjC,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;IAG/C,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,mBAAmB;IAQnD,QAAQ;IAIR,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;8BA5BO,OAAO,KAAG,KAAK,IAAI,eAAe;;;;;;;;;;OAwDxE;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAMvD,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,cAAc,GAAG,IAAI;IAOrE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;CAM5D"}

package/dist/scopes/repo-permission.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RepoPermission = exports.isCollectionParam = exports.isRepoAction = exports.REPO_ACTIONS = exports.isNsid = void 0;
+const nsid_js_1 = require("../lib/nsid.js");
+Object.defineProperty(exports, "isNsid", { enumerable: true, get: function () { return nsid_js_1.isNsid; } });
+const parser_js_1 = require("../lib/parser.js");
+const syntax_string_js_1 = require("../lib/syntax-string.js");
+const syntax_js_1 = require("../lib/syntax.js");
+const util_js_1 = require("../lib/util.js");
+exports.REPO_ACTIONS = Object.freeze([
+    'create',
+    'update',
+    'delete',
+]);
+exports.isRepoAction = (0, util_js_1.knownValuesValidator)(exports.REPO_ACTIONS);
+const isCollectionParam = (value) => value === '*' || (0, nsid_js_1.isNsid)(value);
+exports.isCollectionParam = isCollectionParam;
+class RepoPermission {
+    constructor(collection, action) {
+        Object.defineProperty(this, "collection", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: collection
+        });
+        Object.defineProperty(this, "action", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: action
+        });
+    }
+    matches({ action, collection }) {
+        return (this.action.includes(action) &&
+            (this.collection.includes('*') ||
+                this.collection.includes(collection)));
+    }
+    toString() {
+        return RepoPermission.parser.format(this);
+    }
+    static fromString(scope) {
+        if (!(0, syntax_js_1.isScopeStringFor)(scope, 'repo'))
+            return null;
+        const syntax = syntax_string_js_1.ScopeStringSyntax.fromString(scope);
+        return RepoPermission.fromSyntax(syntax);
+    }
+    static fromSyntax(syntax) {
+        const result = RepoPermission.parser.parse(syntax);
+        if (!result)
+            return null;
+        return new RepoPermission(result.collection, result.action);
+    }
+    static scopeNeededFor(options) {
+        return RepoPermission.parser.format({
+            collection: [options.collection],
+            action: [options.action],
+        });
+    }
+}
+exports.RepoPermission = RepoPermission;
+Object.defineProperty(RepoPermission, "parser", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new parser_js_1.Parser('repo', {
+        collection: {
+            multiple: true,
+            required: true,
+            validate: exports.isCollectionParam,
+            normalize: (value) => {
+                if (value.length > 1) {
+                    if (value.includes('*'))
+                        return ['*'];
+                    return [...new Set(value)].sort();
+                }
+                return value;
+            },
+        },
+        action: {
+            multiple: true,
+            required: false,
+            validate: exports.isRepoAction,
+            default: exports.REPO_ACTIONS,
+            normalize: (value) => {
+                return value === exports.REPO_ACTIONS
+                    ? exports.REPO_ACTIONS // No need to filter if the default was used
+                    : exports.REPO_ACTIONS.filter(includedIn, value);
+            },
+        },
+    }, 'collection')
+});
+/**
+ * Special utility function to be used as predicate for array methods like
+ * `Array.prototype.includes`, etc. When used as predicate, it expects that
+ * the array method is called with a `thisArg` that is a readonly array of
+ * the same type as the `value` parameter.
+ */
+function includedIn(value) {
+    return this.includes(value);
+}
+//# sourceMappingURL=repo-permission.js.map

package/dist/scopes/repo-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-permission.js","sourceRoot":"","sources":["../../src/scopes/repo-permission.ts"],"names":[],"mappings":";;;AAAA,4CAA6C;AAYzB,uFAZL,gBAAM,OAYK;AAX1B,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAKyB;AACzB,4CAAqD;AAIxC,QAAA,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,QAAQ;IACR,QAAQ;IACR,QAAQ;CACA,CAAC,CAAA;AAEE,QAAA,YAAY,GAAG,IAAA,8BAAoB,EAAC,oBAAY,CAAC,CAAA;AAGvD,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAA4B,EAAE,CAC5E,KAAK,KAAK,GAAG,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,CAAA;AADnB,QAAA,iBAAiB,qBACE;AAOhC,MAAa,cAAc;IAGzB,YACkB,UAAiC,EACjC,MAA6B;QAD7C;;;;mBAAgB,UAAU;WAAuB;QACjD;;;;mBAAgB,MAAM;WAAuB;IAC5C,CAAC;IAEJ,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAuB;QACjD,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5B,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC3B,IAAI,CAAC,UAAgC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAA;IACH,CAAC;IAED,QAAQ;QACN,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAgCD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACjD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA2B;QAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA4B;QAChD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,UAAU,EAAE,CAAC,OAAO,CAAC,UAAwB,CAAC;YAC9C,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACzB,CAAC,CAAA;IACJ,CAAC;;AApEH,wCAqEC;AAjD2B;;;;WAAS,IAAI,kBAAM,CAC3C,MAAM,EACN;QACE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,yBAAiB;YAC3B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,OAAO,CAAC,GAAG,CAAU,CAAA;oBAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAmB,CAAA;gBACpD,CAAC;gBACD,OAAO,KAAqB,CAAA;YAC9B,CAAC;SACF;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,oBAAY;YACtB,OAAO,EAAE,oBAAY;YACrB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnB,OAAO,KAAK,KAAK,oBAAY;oBAC3B,CAAC,CAAC,oBAAY,CAAC,4CAA4C;oBAC3D,CAAC,CAAE,oBAAY,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAyB,CAAA;YACrE,CAAC;SACF;KACF,EACD,YAAY,CACb;EA5B+B,CA4B/B;AAuBH;;;;;GAKG;AACH,SAAS,UAAU,CAAwB,KAAQ;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC"}

package/dist/scopes/rpc-permission.d.ts

@@ -0,0 +1,38 @@
+import { AtprotoAudience, isAtprotoAudience } from '@atproto/did';
+import { Nsid, isNsid } from '../lib/nsid.js';
+import { Parser } from '../lib/parser.js';
+import { ResourcePermission } from '../lib/resource-permission.js';
+import { NeRoArray, ScopeSyntax } from '../lib/syntax.js';
+export { type AtprotoAudience, type Nsid, isAtprotoAudience, isNsid };
+export type LxmParam = '*' | Nsid;
+export declare const isLxmParam: (value: unknown) => value is LxmParam;
+export type AudParam = '*' | AtprotoAudience;
+export declare const isAudParam: (value: unknown) => value is AudParam;
+export type RpcPermissionMatch = {
+    lxm: string;
+    aud: string;
+};
+export declare class RpcPermission implements ResourcePermission<'rpc', RpcPermissionMatch> {
+    readonly aud: '*' | AtprotoAudience;
+    readonly lxm: NeRoArray<'*' | Nsid>;
+    constructor(aud: '*' | AtprotoAudience, lxm: NeRoArray<'*' | Nsid>);
+    matches(options: RpcPermissionMatch): boolean;
+    toString(): import("../lib/syntax.js").ScopeStringFor<"rpc">;
+    protected static readonly parser: Parser<"rpc", {
+        lxm: {
+            multiple: true;
+            required: true;
+            validate: (value: unknown) => value is LxmParam;
+            normalize: (value: NeRoArray<import("../lib/syntax.js").ParamValue>) => readonly ["*"] | [`${string}.${string}.${string}`, ...`${string}.${string}.${string}`[]];
+        };
+        aud: {
+            multiple: false;
+            required: true;
+            validate: (value: unknown) => value is AudParam;
+        };
+    }>;
+    static fromString(scope: string): RpcPermission | null;
+    static fromSyntax(syntax: ScopeSyntax<'rpc'>): RpcPermission | null;
+    static scopeNeededFor(options: RpcPermissionMatch): string;
+}
+//# sourceMappingURL=rpc-permission.d.ts.map

package/dist/scopes/rpc-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-permission.d.ts","sourceRoot":"","sources":["../../src/scopes/rpc-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAE3E,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAA;AAErE,MAAM,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAA;AACjC,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,QACrB,CAAA;AAChC,MAAM,MAAM,QAAQ,GAAG,GAAG,GAAG,eAAe,CAAA;AAC5C,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,QACV,CAAA;AAE3C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,qBAAa,aACX,YAAW,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,CAAC;aAGtC,GAAG,EAAE,GAAG,GAAG,eAAe;aAC1B,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;gBAD1B,GAAG,EAAE,GAAG,GAAG,eAAe,EAC1B,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;IAG5C,OAAO,CAAC,OAAO,EAAE,kBAAkB;IAQnC,QAAQ;IAIR,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;8BA/BA,OAAO,KAAG,KAAK,IAAI,QAAQ;;;;;;8BAG3B,OAAO,KAAG,KAAK,IAAI,QAAQ;;OA+C1D;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAMtD,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,aAAa,GAAG,IAAI;IAUnE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM;CAM3D"}

package/dist/scopes/rpc-permission.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RpcPermission = exports.isAudParam = exports.isLxmParam = exports.isNsid = exports.isAtprotoAudience = void 0;
+const did_1 = require("@atproto/did");
+Object.defineProperty(exports, "isAtprotoAudience", { enumerable: true, get: function () { return did_1.isAtprotoAudience; } });
+const nsid_js_1 = require("../lib/nsid.js");
+Object.defineProperty(exports, "isNsid", { enumerable: true, get: function () { return nsid_js_1.isNsid; } });
+const parser_js_1 = require("../lib/parser.js");
+const syntax_string_js_1 = require("../lib/syntax-string.js");
+const syntax_js_1 = require("../lib/syntax.js");
+const isLxmParam = (value) => value === '*' || (0, nsid_js_1.isNsid)(value);
+exports.isLxmParam = isLxmParam;
+const isAudParam = (value) => value === '*' || (0, did_1.isAtprotoAudience)(value);
+exports.isAudParam = isAudParam;
+class RpcPermission {
+    constructor(aud, lxm) {
+        Object.defineProperty(this, "aud", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: aud
+        });
+        Object.defineProperty(this, "lxm", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: lxm
+        });
+    }
+    matches(options) {
+        const { aud, lxm } = this;
+        return ((aud === '*' || aud === options.aud) &&
+            (lxm.includes('*') || lxm.includes(options.lxm)));
+    }
+    toString() {
+        return RpcPermission.parser.format(this);
+    }
+    static fromString(scope) {
+        if (!(0, syntax_js_1.isScopeStringFor)(scope, 'rpc'))
+            return null;
+        const syntax = syntax_string_js_1.ScopeStringSyntax.fromString(scope);
+        return RpcPermission.fromSyntax(syntax);
+    }
+    static fromSyntax(syntax) {
+        const result = RpcPermission.parser.parse(syntax);
+        if (!result)
+            return null;
+        // rpc:*?aud=* is forbidden
+        if (result.aud === '*' && result.lxm.includes('*'))
+            return null;
+        return new RpcPermission(result.aud, result.lxm);
+    }
+    static scopeNeededFor(options) {
+        return RpcPermission.parser.format({
+            aud: options.aud,
+            lxm: [options.lxm],
+        });
+    }
+}
+exports.RpcPermission = RpcPermission;
+Object.defineProperty(RpcPermission, "parser", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new parser_js_1.Parser('rpc', {
+        lxm: {
+            multiple: true,
+            required: true,
+            validate: exports.isLxmParam,
+            normalize: (value) => value.length > 1 && value.includes('*')
+                ? ['*']
+                : [...new Set(value)].sort(),
+        },
+        aud: {
+            multiple: false,
+            required: true,
+            validate: exports.isAudParam,
+        },
+    }, 'lxm')
+});
+//# sourceMappingURL=rpc-permission.js.map

package/dist/scopes/rpc-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-permission.js","sourceRoot":"","sources":["../../src/scopes/rpc-permission.ts"],"names":[],"mappings":";;;AAAA,sCAAiE;AAOvB,kGAPhB,uBAAiB,OAOgB;AAN3D,4CAA6C;AAMgB,uFAN9C,gBAAM,OAM8C;AALnE,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAA2E;AAKpE,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC9D,KAAK,KAAK,GAAG,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,CAAA;AADnB,QAAA,UAAU,cACS;AAEzB,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC9D,KAAK,KAAK,GAAG,IAAI,IAAA,uBAAiB,EAAC,KAAK,CAAC,CAAA;AAD9B,QAAA,UAAU,cACoB;AAO3C,MAAa,aAAa;IAGxB,YACkB,GAA0B,EAC1B,GAA0B;QAD1C;;;;mBAAgB,GAAG;WAAuB;QAC1C;;;;mBAAgB,GAAG;WAAuB;IACzC,CAAC;IAEJ,OAAO,CAAC,OAA2B;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACzB,OAAO,CACL,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC;YACpC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAK,GAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAED,QAAQ;QACN,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IAuBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAChD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA0B;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE/D,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA2B;QAC/C,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,GAAG,EAAE,OAAO,CAAC,GAAsB;YACnC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAW,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;;AA9DH,sCA+DC;AA3C2B;;;;WAAS,IAAI,kBAAM,CAC3C,KAAK,EACL;QACE,GAAG,EAAE;YACH,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kBAAU;YACpB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAE,CAAC,GAAG,CAAW;gBAClB,CAAC,CAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAwB;SACxD;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kBAAU;SACrB;KACF,EACD,KAAK,CACN;EAnB+B,CAmB/B"}

package/dist/scopes-set.d.ts

@@ -1,6 +1,17 @@
 import { ScopeMissingError } from './scope-missing-error.js';
-import { ScopeMatchingOptionsByResource } from './utilities.js';
+import { AccountPermissionMatch } from './scopes/account-permission.js';
+import { BlobPermissionMatch } from './scopes/blob-permission.js';
+import { IdentityPermissionMatch } from './scopes/identity-permission.js';
+import { RepoPermissionMatch } from './scopes/repo-permission.js';
+import { RpcPermissionMatch } from './scopes/rpc-permission.js';
 export { ScopeMissingError };
+export type ScopeMatchingOptionsByResource = {
+    account: AccountPermissionMatch;
+    identity: IdentityPermissionMatch;
+    repo: RepoPermissionMatch;
+    rpc: RpcPermissionMatch;
+    blob: BlobPermissionMatch;
+};
 /**
  * Utility class to manage a set of scopes and check if they match specific
  * options for a given resource.

package/dist/scopes-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scopes-set.d.ts","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EACL,8BAA8B,EAG/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B;;;GAGG;AACH,qBAAa,SAAU,SAAQ,GAAG,CAAC,MAAM,CAAC;IACxC;;;OAGG;IACI,OAAO,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC3D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC,GACzC,OAAO;IAOH,MAAM,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC1D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAQrC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO;IAIrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC;IAIvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;CAG9C"}
+{"version":3,"file":"scopes-set.d.ts","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAEL,sBAAsB,EACvB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,mBAAmB,EACpB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAEL,uBAAuB,EACxB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAEL,mBAAmB,EACpB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAiB,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE9E,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,MAAM,MAAM,8BAA8B,GAAG;IAC3C,OAAO,EAAE,sBAAsB,CAAA;IAC/B,QAAQ,EAAE,uBAAuB,CAAA;IACjC,IAAI,EAAE,mBAAmB,CAAA;IACzB,GAAG,EAAE,kBAAkB,CAAA;IACvB,IAAI,EAAE,mBAAmB,CAAA;CAC1B,CAAA;AAED;;;GAGG;AACH,qBAAa,SAAU,SAAQ,GAAG,CAAC,MAAM,CAAC;IACxC;;;OAGG;IACI,OAAO,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC3D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC,GACzC,OAAO;IAOH,MAAM,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC1D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAQrC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO;IAIrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC;IAIvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;CAG9C"}