@atproto/oauth-scopes 0.2.2 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @atproto/oauth-scopes
 
+## 0.3.1
+
+### Patch Changes
+
+- Updated dependencies [[`d54d707`](https://github.com/bluesky-social/atproto/commit/d54d7077eb32041e1f61c312efa1dd0d768c774e), [`d54d707`](https://github.com/bluesky-social/atproto/commit/d54d7077eb32041e1f61c312efa1dd0d768c774e)]:
+  - @atproto/did@0.3.0
+
+## 0.3.0
+
+### Minor Changes
+
+- [#4383](https://github.com/bluesky-social/atproto/pull/4383) [`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Replace `@atproto/lexicon` with `@atproto/lex-document`
+
+- [#4353](https://github.com/bluesky-social/atproto/pull/4353) [`0adc852`](https://github.com/bluesky-social/atproto/commit/0adc852c31ffa154c1b93e38182c35880ecdb4ba) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Use arrays to represent "account" permission's `action` attribute, allowing multiple actions to be specified for that resource.
+
+### Patch Changes
+
+- [#4382](https://github.com/bluesky-social/atproto/pull/4382) [`be8e6c1`](https://github.com/bluesky-social/atproto/commit/be8e6c1f25814202b98e2616a217599a6c46e0db) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add `toScopes()` utility on `IncludeScope`
+
+- [#4382](https://github.com/bluesky-social/atproto/pull/4382) [`be8e6c1`](https://github.com/bluesky-social/atproto/commit/be8e6c1f25814202b98e2616a217599a6c46e0db) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove ability to define `blob` permission in permission sets
+
+- [#4383](https://github.com/bluesky-social/atproto/pull/4383) [`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Replace `@atproto/lexicon-resolver` with `@atproto/lex-resolver`
+
+- [#4353](https://github.com/bluesky-social/atproto/pull/4353) [`0adc852`](https://github.com/bluesky-social/atproto/commit/0adc852c31ffa154c1b93e38182c35880ecdb4ba) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Allow lexicon permission data to be readonly
+
+- [#4382](https://github.com/bluesky-social/atproto/pull/4382) [`be8e6c1`](https://github.com/bluesky-social/atproto/commit/be8e6c1f25814202b98e2616a217599a6c46e0db) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Disallow `rpc` permissions with specific `aud` in permission-sets
+
+- Updated dependencies [[`8012627`](https://github.com/bluesky-social/atproto/commit/8012627a1226cb2f1c753385ad2497b6b43ffd2e), [`bcae2b7`](https://github.com/bluesky-social/atproto/commit/bcae2b77b68da6dc2ec202651c8bf41fd5769f69), [`d396de0`](https://github.com/bluesky-social/atproto/commit/d396de016d1d55d08cfad1dabd3ffd9eaeea76ea)]:
+  - @atproto/did@0.2.3
+  - @atproto/syntax@0.4.2
+
 ## 0.2.2
 
 ### Patch Changes

package/LICENSE.txt

@@ -1,6 +1,6 @@
 Dual MIT/Apache-2.0 License
 
-Copyright (c) 2022-2025 Bluesky Social PBC, and Contributors
+Copyright (c) 2022-2026 Bluesky Social PBC, and Contributors
 
 Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
 

package/dist/lib/lexicon.d.ts

@@ -1,2 +1,19 @@
-export type { LexPermission, LexPermissionSet } from '@atproto/lexicon';
+import { ParamValue } from './syntax.js';
+export type LexiconPermission<P extends string = string> = {
+    readonly type: 'permission';
+    readonly resource: P;
+    readonly [x: string]: undefined | ParamValue | readonly ParamValue[];
+};
+type LangMap = {
+    readonly [Lang in string]?: string;
+};
+export type LexiconPermissionSet = {
+    readonly type: 'permission-set';
+    readonly permissions: readonly LexiconPermission<string>[];
+    readonly title?: string;
+    readonly 'title:lang'?: LangMap;
+    readonly detail?: string;
+    readonly 'detail:lang'?: LangMap;
+};
+export {};
 //# sourceMappingURL=lexicon.d.ts.map

package/dist/lib/lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon.d.ts","sourceRoot":"","sources":["../../src/lib/lexicon.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"lexicon.d.ts","sourceRoot":"","sources":["../../src/lib/lexicon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKxC,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IACpB,QAAQ,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,UAAU,EAAE,CAAA;CACrE,CAAA;AAED,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,MAAM;CAAE,CAAA;AAErD,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAA;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC,CAAA"}

package/dist/lib/lexicon.js.map

@@ -1 +1 @@
-{"version":3,"file":"lexicon.js","sourceRoot":"","sources":["../../src/lib/lexicon.ts"],"names":[],"mappings":"","sourcesContent":["export type { LexPermission, LexPermissionSet } from '@atproto/lexicon'\n"]}
+{"version":3,"file":"lexicon.js","sourceRoot":"","sources":["../../src/lib/lexicon.ts"],"names":[],"mappings":"","sourcesContent":["import { ParamValue } from './syntax.js'\n\n// @NOTE Not types from from '@atproto/lex-document' because we want a readonly\n// version here to prevent accidental mutation.\n\nexport type LexiconPermission<P extends string = string> = {\n  readonly type: 'permission'\n  readonly resource: P\n  readonly [x: string]: undefined | ParamValue | readonly ParamValue[]\n}\n\ntype LangMap = { readonly [Lang in string]?: string }\n\nexport type LexiconPermissionSet = {\n  readonly type: 'permission-set'\n  readonly permissions: readonly LexiconPermission<string>[]\n  readonly title?: string\n  readonly 'title:lang'?: LangMap\n  readonly detail?: string\n  readonly 'detail:lang'?: LangMap\n}\n"]}

package/dist/lib/syntax-lexicon.d.ts

@@ -1,26 +1,17 @@
-import { LexPermission } from './lexicon.js';
+import { LexiconPermission } from './lexicon.js';
 import { ScopeSyntax } from './syntax.js';
 /**
- * Translates a {@link LexPermission} into a {@link ScopeSyntax}.
+ * Translates a {@link LexiconPermission} into a {@link ScopeSyntax}.
  */
 export declare class LexPermissionSyntax<P extends string = string> implements ScopeSyntax<P> {
-    readonly lexPermission: Readonly<LexPermission & {
-        resource: P;
-    }>;
-    constructor(lexPermission: Readonly<LexPermission & {
-        resource: P;
-    }>);
+    readonly lexPermission: LexiconPermission<P>;
+    constructor(lexPermission: LexiconPermission<P>);
     get prefix(): P;
     get positional(): undefined;
-    get(key: string): string | number | boolean | (string | number | boolean)[] | undefined;
+    get(key: string): import("./syntax.js").ParamValue | readonly import("./syntax.js").ParamValue[] | undefined;
     keys(): Generator<string, void, unknown>;
-    getSingle(key: string): string | number | boolean | null | undefined;
-    getMulti(key: string): (string | number | boolean)[] | null | undefined;
-    toJSON(): Readonly<{
-        type: "permission";
-        resource: string;
-    } & Record<string, string | number | boolean | (string | number | boolean)[] | undefined> & {
-        resource: P;
-    }>;
+    getSingle(key: string): import("./syntax.js").ParamValue | null | undefined;
+    getMulti(key: string): readonly import("./syntax.js").ParamValue[] | null | undefined;
+    toJSON(): LexiconPermission<P>;
 }
 //# sourceMappingURL=syntax-lexicon.d.ts.map

package/dist/lib/syntax-lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syntax-lexicon.d.ts","sourceRoot":"","sources":["../../src/lib/syntax-lexicon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,qBAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CACxD,YAAW,WAAW,CAAC,CAAC,CAAC;IAGvB,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,GAAG;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC;gBAAxD,aAAa,EAAE,QAAQ,CAAC,aAAa,GAAG;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC;IAGnE,IAAI,MAAM,MAET;IAED,IAAI,UAAU,cAEb;IAED,GAAG,CAAC,GAAG,EAAE,MAAM;IAWd,IAAI;IAML,SAAS,CAAC,GAAG,EAAE,MAAM;IAMrB,QAAQ,CAAC,GAAG,EAAE,MAAM;IAOpB,MAAM;;;;kBAzCyD,CAAC;;CA4CjE"}
+{"version":3,"file":"syntax-lexicon.d.ts","sourceRoot":"","sources":["../../src/lib/syntax-lexicon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAIzC;;GAEG;AACH,qBAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CACxD,YAAW,WAAW,CAAC,CAAC,CAAC;IAEb,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAAnC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAExD,IAAI,MAAM,MAET;IAED,IAAI,UAAU,cAEb;IAED,GAAG,CAAC,GAAG,EAAE,MAAM;IAWd,IAAI;IAML,SAAS,CAAC,GAAG,EAAE,MAAM;IAMrB,QAAQ,CAAC,GAAG,EAAE,MAAM;IAOpB,MAAM;CAGP"}

package/dist/lib/syntax-lexicon.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LexPermissionSyntax = void 0;
+const isArray = Array.isArray;
 /**
- * Translates a {@link LexPermission} into a {@link ScopeSyntax}.
+ * Translates a {@link LexiconPermission} into a {@link ScopeSyntax}.
  */
 class LexPermissionSyntax {
     constructor(lexPermission) {
@@ -38,7 +39,7 @@ class LexPermissionSyntax {
     }
     getSingle(key) {
         const value = this.get(key);
-        if (Array.isArray(value))
+        if (isArray(value))
             return null;
         return value;
     }
@@ -46,7 +47,7 @@ class LexPermissionSyntax {
         const value = this.get(key);
         if (value === undefined)
             return undefined;
-        if (!Array.isArray(value))
+        if (!isArray(value))
             return null;
         return value;
     }

package/dist/lib/syntax-lexicon.js.map

@@ -1 +1 @@
-{"version":3,"file":"syntax-lexicon.js","sourceRoot":"","sources":["../../src/lib/syntax-lexicon.ts"],"names":[],"mappings":";;;AAGA;;GAEG;AACH,MAAa,mBAAmB;IAG9B,YACW,aAAwD;QAAjE;;;;mBAAS,aAAa;WAA2C;IAChE,CAAC;IAEJ,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,2BAA2B;QAC3B,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,SAAS,CAAA;QACpC,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAA;QAExC,iDAAiD;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAE7D,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;IAED,CAAC,IAAI;QACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,aAAa,CAAA;IAC3B,CAAC;CACF;AAhDD,kDAgDC","sourcesContent":["import { LexPermission } from './lexicon.js'\nimport { ScopeSyntax } from './syntax.js'\n\n/**\n * Translates a {@link LexPermission} into a {@link ScopeSyntax}.\n */\nexport class LexPermissionSyntax<P extends string = string>\n  implements ScopeSyntax<P>\n{\n  constructor(\n    readonly lexPermission: Readonly<LexPermission & { resource: P }>,\n  ) {}\n\n  get prefix() {\n    return this.lexPermission.resource\n  }\n\n  get positional() {\n    return undefined\n  }\n\n  get(key: string) {\n    // Ignore reserved keywords\n    if (key === 'type') return undefined\n    if (key === 'resource') return undefined\n\n    // Ignore inherited properties (toString(), etc.)\n    if (!Object.hasOwn(this.lexPermission, key)) return undefined\n\n    return this.lexPermission[key]\n  }\n\n  *keys() {\n    for (const key of Object.keys(this.lexPermission)) {\n      if (this.get(key) !== undefined) yield key\n    }\n  }\n\n  getSingle(key: string) {\n    const value = this.get(key)\n    if (Array.isArray(value)) return null\n    return value\n  }\n\n  getMulti(key: string) {\n    const value = this.get(key)\n    if (value === undefined) return undefined\n    if (!Array.isArray(value)) return null\n    return value\n  }\n\n  toJSON() {\n    return this.lexPermission\n  }\n}\n"]}
+{"version":3,"file":"syntax-lexicon.js","sourceRoot":"","sources":["../../src/lib/syntax-lexicon.ts"],"names":[],"mappings":";;;AAGA,MAAM,OAAO,GAAoD,KAAK,CAAC,OAAO,CAAA;AAE9E;;GAEG;AACH,MAAa,mBAAmB;IAG9B,YAAqB,aAAmC;QAA5C;;;;mBAAS,aAAa;WAAsB;IAAG,CAAC;IAE5D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,2BAA2B;QAC3B,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,SAAS,CAAA;QACpC,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAA;QAExC,iDAAiD;QACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAE7D,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;IAED,CAAC,IAAI;QACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,aAAa,CAAA;IAC3B,CAAC;CACF;AA9CD,kDA8CC","sourcesContent":["import { LexiconPermission } from './lexicon.js'\nimport { ScopeSyntax } from './syntax.js'\n\nconst isArray: (value: unknown) => value is readonly unknown[] = Array.isArray\n\n/**\n * Translates a {@link LexiconPermission} into a {@link ScopeSyntax}.\n */\nexport class LexPermissionSyntax<P extends string = string>\n  implements ScopeSyntax<P>\n{\n  constructor(readonly lexPermission: LexiconPermission<P>) {}\n\n  get prefix() {\n    return this.lexPermission.resource\n  }\n\n  get positional() {\n    return undefined\n  }\n\n  get(key: string) {\n    // Ignore reserved keywords\n    if (key === 'type') return undefined\n    if (key === 'resource') return undefined\n\n    // Ignore inherited properties (toString(), etc.)\n    if (!Object.hasOwn(this.lexPermission, key)) return undefined\n\n    return this.lexPermission[key]\n  }\n\n  *keys() {\n    for (const key of Object.keys(this.lexPermission)) {\n      if (this.get(key) !== undefined) yield key\n    }\n  }\n\n  getSingle(key: string) {\n    const value = this.get(key)\n    if (isArray(value)) return null\n    return value\n  }\n\n  getMulti(key: string) {\n    const value = this.get(key)\n    if (value === undefined) return undefined\n    if (!isArray(value)) return null\n    return value\n  }\n\n  toJSON() {\n    return this.lexPermission\n  }\n}\n"]}

package/dist/lib/syntax.d.ts

@@ -18,6 +18,7 @@ export interface ScopeSyntax<P extends string> {
     readonly positional?: ParamValue;
     keys(): Iterable<string, void, unknown>;
     getSingle(key: string): ParamValue | null | undefined;
-    getMulti(key: string): ParamValue[] | null | undefined;
+    getMulti(key: string): readonly ParamValue[] | null | undefined;
 }
+export declare function isScopeSyntaxFor<P extends string>(syntax: ScopeSyntax<string>, prefix: P): syntax is ScopeSyntax<P>;
 //# sourceMappingURL=syntax.d.ts.map

package/dist/lib/syntax.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syntax.d.ts","sourceRoot":"","sources":["../../src/lib/syntax.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAE/C,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IACvC,CAAC,GACD,GAAG,CAAC,IAAI,MAAM,EAAE,GAChB,GAAG,CAAC,IAAI,MAAM,EAAE,CAAA;AAEpB;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,GACR,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,CAc5B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CACvD"}
+{"version":3,"file":"syntax.d.ts","sourceRoot":"","sources":["../../src/lib/syntax.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAE/C,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IACvC,CAAC,GACD,GAAG,CAAC,IAAI,MAAM,EAAE,GAChB,GAAG,CAAC,IAAI,MAAM,EAAE,CAAA;AAEpB;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,GACR,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,CAc5B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC3C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CAChE;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAC3B,MAAM,EAAE,CAAC,GACR,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAE1B"}

package/dist/lib/syntax.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isScopeStringFor = isScopeStringFor;
+exports.isScopeSyntaxFor = isScopeSyntaxFor;
 /**
  * Allows to quickly check if a scope is for a specific resource.
  */
@@ -19,4 +20,7 @@ function isScopeStringFor(value, prefix) {
         return value === prefix;
     }
 }
+function isScopeSyntaxFor(syntax, prefix) {
+    return syntax.prefix === prefix;
+}
 //# sourceMappingURL=syntax.js.map

package/dist/lib/syntax.js.map

@@ -1 +1 @@
-{"version":3,"file":"syntax.js","sourceRoot":"","sources":["../../src/lib/syntax.ts"],"names":[],"mappings":";;AAiBA,4CAiBC;AApBD;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,KAAa,EACb,MAAS;IAET,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAA;QACd,CAAC;QAED,6BAA6B;QAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;SAAM,CAAC;QACN,iCAAiC;QACjC,OAAO,KAAK,KAAK,MAAM,CAAA;IACzB,CAAC;AACH,CAAC","sourcesContent":["export type ParamValue = string | number | boolean\n\nexport type NeArray<T> = [T, ...T[]]\n\n/**\n * Non-empty readonly array\n */\nexport type NeRoArray<T> = readonly [T, ...T[]]\n\nexport type ScopeStringFor<P extends string> =\n  | P\n  | `${P}:${string}`\n  | `${P}?${string}`\n\n/**\n * Allows to quickly check if a scope is for a specific resource.\n */\nexport function isScopeStringFor<P extends string>(\n  value: string,\n  prefix: P,\n): value is ScopeStringFor<P> {\n  if (value.length > prefix.length) {\n    // First, check the next char is either : or ?\n    const nextChar = value.charCodeAt(prefix.length)\n    if (nextChar !== 0x3a /* : */ && nextChar !== 0x3f /* ? */) {\n      return false\n    }\n\n    // Then check the full prefix\n    return value.startsWith(prefix)\n  } else {\n    // value and prefix must be equal\n    return value === prefix\n  }\n}\n\n/**\n * Abstract interface that allows parsing various syntaxes into permission\n * representations.\n */\nexport interface ScopeSyntax<P extends string> {\n  readonly prefix: P\n  readonly positional?: ParamValue\n  keys(): Iterable<string, void, unknown>\n  getSingle(key: string): ParamValue | null | undefined\n  getMulti(key: string): ParamValue[] | null | undefined\n}\n"]}
+{"version":3,"file":"syntax.js","sourceRoot":"","sources":["../../src/lib/syntax.ts"],"names":[],"mappings":";;AAiBA,4CAiBC;AAcD,4CAKC;AAvCD;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,KAAa,EACb,MAAS;IAET,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAA;QACd,CAAC;QAED,6BAA6B;QAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;SAAM,CAAC;QACN,iCAAiC;QACjC,OAAO,KAAK,KAAK,MAAM,CAAA;IACzB,CAAC;AACH,CAAC;AAcD,SAAgB,gBAAgB,CAC9B,MAA2B,EAC3B,MAAS;IAET,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAA;AACjC,CAAC","sourcesContent":["export type ParamValue = string | number | boolean\n\nexport type NeArray<T> = [T, ...T[]]\n\n/**\n * Non-empty readonly array\n */\nexport type NeRoArray<T> = readonly [T, ...T[]]\n\nexport type ScopeStringFor<P extends string> =\n  | P\n  | `${P}:${string}`\n  | `${P}?${string}`\n\n/**\n * Allows to quickly check if a scope is for a specific resource.\n */\nexport function isScopeStringFor<P extends string>(\n  value: string,\n  prefix: P,\n): value is ScopeStringFor<P> {\n  if (value.length > prefix.length) {\n    // First, check the next char is either : or ?\n    const nextChar = value.charCodeAt(prefix.length)\n    if (nextChar !== 0x3a /* : */ && nextChar !== 0x3f /* ? */) {\n      return false\n    }\n\n    // Then check the full prefix\n    return value.startsWith(prefix)\n  } else {\n    // value and prefix must be equal\n    return value === prefix\n  }\n}\n\n/**\n * Abstract interface that allows parsing various syntaxes into permission\n * representations.\n */\nexport interface ScopeSyntax<P extends string> {\n  readonly prefix: P\n  readonly positional?: ParamValue\n  keys(): Iterable<string, void, unknown>\n  getSingle(key: string): ParamValue | null | undefined\n  getMulti(key: string): readonly ParamValue[] | null | undefined\n}\n\nexport function isScopeSyntaxFor<P extends string>(\n  syntax: ScopeSyntax<string>,\n  prefix: P,\n): syntax is ScopeSyntax<P> {\n  return syntax.prefix === prefix\n}\n"]}

package/dist/scopes/account-permission.d.ts

@@ -1,6 +1,6 @@
 import { Parser } from '../lib/parser.js';
 import { ResourcePermission } from '../lib/resource-permission.js';
-import { ScopeSyntax } from '../lib/syntax.js';
+import { NeRoArray, ScopeSyntax } from '../lib/syntax.js';
 export declare const ACCOUNT_ATTRIBUTES: readonly ["email", "repo", "status"];
 export type AccountAttribute = (typeof ACCOUNT_ATTRIBUTES)[number];
 export declare const ACCOUNT_ACTIONS: readonly ["read", "manage"];
@@ -11,8 +11,8 @@ export type AccountPermissionMatch = {
 };
 export declare class AccountPermission implements ResourcePermission<'account', AccountPermissionMatch> {
     readonly attr: AccountAttribute;
-    readonly action: AccountAction;
-    constructor(attr: AccountAttribute, action: AccountAction);
+    readonly action: NeRoArray<AccountAction>;
+    constructor(attr: AccountAttribute, action: NeRoArray<AccountAction>);
     matches(options: AccountPermissionMatch): boolean;
     toString(): import("../lib/syntax.js").ScopeStringFor<"account">;
     protected static readonly parser: Parser<"account", {
@@ -22,10 +22,10 @@ export declare class AccountPermission implements ResourcePermission<'account',
             validate: (value: unknown) => value is "email" | "repo" | "status";
         };
         action: {
-            multiple: false;
+            multiple: true;
             required: false;
             validate: (value: unknown) => value is "read" | "manage";
-            default: "read";
+            default: ["read"];
         };
     }>;
     static fromString(scope: string): AccountPermission | null;

package/dist/scopes/account-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-permission.d.ts","sourceRoot":"","sources":["../../src/scopes/account-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAGhE,eAAO,MAAM,kBAAkB,sCAIpB,CAAA;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE,eAAO,MAAM,eAAe,6BAA6C,CAAA;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;CACtB,CAAA;AAED,qBAAa,iBACX,YAAW,kBAAkB,CAAC,SAAS,EAAE,sBAAsB,CAAC;aAG9C,IAAI,EAAE,gBAAgB;aACtB,MAAM,EAAE,aAAa;gBADrB,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,aAAa;IAGvC,OAAO,CAAC,OAAO,EAAE,sBAAsB;IAOvC,QAAQ;IAIR,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;;;;;;;OAgB/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;IAOhD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,sBAAsB;CAGtD"}
+{"version":3,"file":"account-permission.d.ts","sourceRoot":"","sources":["../../src/scopes/account-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAG3E,eAAO,MAAM,kBAAkB,sCAIpB,CAAA;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAElE,eAAO,MAAM,eAAe,6BAA6C,CAAA;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;CACtB,CAAA;AAED,qBAAa,iBACX,YAAW,kBAAkB,CAAC,SAAS,EAAE,sBAAsB,CAAC;aAG9C,IAAI,EAAE,gBAAgB;aACtB,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC;gBADhC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC;IAGlD,OAAO,CAAC,OAAO,EAAE,sBAAsB;IAOvC,QAAQ;IAIR,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;;;;;;;OAgB/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;IAOhD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,sBAAsB;CAMtD"}

package/dist/scopes/account-permission.js

@@ -28,7 +28,7 @@ class AccountPermission {
     }
     matches(options) {
         return (this.attr === options.attr &&
-            (this.action === 'manage' || this.action === options.action));
+            (this.action.includes('manage') || this.action.includes(options.action)));
     }
     toString() {
         return AccountPermission.parser.format(this);
@@ -46,7 +46,10 @@ class AccountPermission {
         return new AccountPermission(result.attr, result.action);
     }
     static scopeNeededFor(options) {
-        return AccountPermission.parser.format(options);
+        return AccountPermission.parser.format({
+            attr: options.attr,
+            action: [options.action],
+        });
     }
 }
 exports.AccountPermission = AccountPermission;
@@ -61,10 +64,10 @@ Object.defineProperty(AccountPermission, "parser", {
             validate: (0, util_js_1.knownValuesValidator)(exports.ACCOUNT_ATTRIBUTES),
         },
         action: {
-            multiple: false,
+            multiple: true,
             required: false,
             validate: (0, util_js_1.knownValuesValidator)(exports.ACCOUNT_ACTIONS),
-            default: 'read',
+            default: ['read'],
         },
     }, 'attr')
 });

package/dist/scopes/account-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-permission.js","sourceRoot":"","sources":["../../src/scopes/account-permission.ts"],"names":[],"mappings":";;;AAAA,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAAgE;AAChE,4CAAqD;AAExC,QAAA,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,OAAO;IACP,MAAM;IACN,QAAQ;CACA,CAAC,CAAA;AAGE,QAAA,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC,CAAA;AAQzE,MAAa,iBAAiB;IAG5B,YACkB,IAAsB,EACtB,MAAqB;QADrC;;;;mBAAgB,IAAI;WAAkB;QACtC;;;;mBAAgB,MAAM;WAAe;IACpC,CAAC;IAEJ,OAAO,CAAC,OAA+B;QACrC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAC1B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC7D,CAAA;IACH,CAAC;IAED,QAAQ;QACN,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAoBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA+B;QACnD,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;;AApDH,8CAqDC;AAlC2B;;;;WAAS,IAAI,kBAAM,CAC3C,SAAS,EACT;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAA,8BAAoB,EAAC,0BAAkB,CAAC;SACnD;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAA,8BAAoB,EAAC,uBAAe,CAAC;YAC/C,OAAO,EAAE,MAAe;SACzB;KACF,EACD,MAAM,CACP;EAhB+B,CAgB/B","sourcesContent":["import { Parser } from '../lib/parser.js'\nimport { ResourcePermission } from '../lib/resource-permission.js'\nimport { ScopeStringSyntax } from '../lib/syntax-string.js'\nimport { ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'\nimport { knownValuesValidator } from '../lib/util.js'\n\nexport const ACCOUNT_ATTRIBUTES = Object.freeze([\n  'email',\n  'repo',\n  'status',\n] as const)\nexport type AccountAttribute = (typeof ACCOUNT_ATTRIBUTES)[number]\n\nexport const ACCOUNT_ACTIONS = Object.freeze(['read', 'manage'] as const)\nexport type AccountAction = (typeof ACCOUNT_ACTIONS)[number]\n\nexport type AccountPermissionMatch = {\n  attr: AccountAttribute\n  action: AccountAction\n}\n\nexport class AccountPermission\n  implements ResourcePermission<'account', AccountPermissionMatch>\n{\n  constructor(\n    public readonly attr: AccountAttribute,\n    public readonly action: AccountAction,\n  ) {}\n\n  matches(options: AccountPermissionMatch) {\n    return (\n      this.attr === options.attr &&\n      (this.action === 'manage' || this.action === options.action)\n    )\n  }\n\n  toString() {\n    return AccountPermission.parser.format(this)\n  }\n\n  protected static readonly parser = new Parser(\n    'account',\n    {\n      attr: {\n        multiple: false,\n        required: true,\n        validate: knownValuesValidator(ACCOUNT_ATTRIBUTES),\n      },\n      action: {\n        multiple: false,\n        required: false,\n        validate: knownValuesValidator(ACCOUNT_ACTIONS),\n        default: 'read' as const,\n      },\n    },\n    'attr',\n  )\n\n  static fromString(scope: string) {\n    if (!isScopeStringFor(scope, 'account')) return null\n    const syntax = ScopeStringSyntax.fromString(scope)\n    return AccountPermission.fromSyntax(syntax)\n  }\n\n  static fromSyntax(syntax: ScopeSyntax<'account'>) {\n    const result = AccountPermission.parser.parse(syntax)\n    if (!result) return null\n\n    return new AccountPermission(result.attr, result.action)\n  }\n\n  static scopeNeededFor(options: AccountPermissionMatch) {\n    return AccountPermission.parser.format(options)\n  }\n}\n"]}
+{"version":3,"file":"account-permission.js","sourceRoot":"","sources":["../../src/scopes/account-permission.ts"],"names":[],"mappings":";;;AAAA,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAA2E;AAC3E,4CAAqD;AAExC,QAAA,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,OAAO;IACP,MAAM;IACN,QAAQ;CACA,CAAC,CAAA;AAGE,QAAA,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC,CAAA;AAQzE,MAAa,iBAAiB;IAG5B,YACkB,IAAsB,EACtB,MAAgC;QADhD;;;;mBAAgB,IAAI;WAAkB;QACtC;;;;mBAAgB,MAAM;WAA0B;IAC/C,CAAC;IAEJ,OAAO,CAAC,OAA+B;QACrC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IAED,QAAQ;QACN,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAoBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA+B;QACnD,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACzB,CAAC,CAAA;IACJ,CAAC;;AAvDH,8CAwDC;AArC2B;;;;WAAS,IAAI,kBAAM,CAC3C,SAAS,EACT;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAA,8BAAoB,EAAC,0BAAkB,CAAC;SACnD;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAA,8BAAoB,EAAC,uBAAe,CAAC;YAC/C,OAAO,EAAE,CAAC,MAAe,CAAC;SAC3B;KACF,EACD,MAAM,CACP;EAhB+B,CAgB/B","sourcesContent":["import { Parser } from '../lib/parser.js'\nimport { ResourcePermission } from '../lib/resource-permission.js'\nimport { ScopeStringSyntax } from '../lib/syntax-string.js'\nimport { NeRoArray, ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'\nimport { knownValuesValidator } from '../lib/util.js'\n\nexport const ACCOUNT_ATTRIBUTES = Object.freeze([\n  'email',\n  'repo',\n  'status',\n] as const)\nexport type AccountAttribute = (typeof ACCOUNT_ATTRIBUTES)[number]\n\nexport const ACCOUNT_ACTIONS = Object.freeze(['read', 'manage'] as const)\nexport type AccountAction = (typeof ACCOUNT_ACTIONS)[number]\n\nexport type AccountPermissionMatch = {\n  attr: AccountAttribute\n  action: AccountAction\n}\n\nexport class AccountPermission\n  implements ResourcePermission<'account', AccountPermissionMatch>\n{\n  constructor(\n    public readonly attr: AccountAttribute,\n    public readonly action: NeRoArray<AccountAction>,\n  ) {}\n\n  matches(options: AccountPermissionMatch) {\n    return (\n      this.attr === options.attr &&\n      (this.action.includes('manage') || this.action.includes(options.action))\n    )\n  }\n\n  toString() {\n    return AccountPermission.parser.format(this)\n  }\n\n  protected static readonly parser = new Parser(\n    'account',\n    {\n      attr: {\n        multiple: false,\n        required: true,\n        validate: knownValuesValidator(ACCOUNT_ATTRIBUTES),\n      },\n      action: {\n        multiple: true,\n        required: false,\n        validate: knownValuesValidator(ACCOUNT_ACTIONS),\n        default: ['read' as const],\n      },\n    },\n    'attr',\n  )\n\n  static fromString(scope: string) {\n    if (!isScopeStringFor(scope, 'account')) return null\n    const syntax = ScopeStringSyntax.fromString(scope)\n    return AccountPermission.fromSyntax(syntax)\n  }\n\n  static fromSyntax(syntax: ScopeSyntax<'account'>) {\n    const result = AccountPermission.parser.parse(syntax)\n    if (!result) return null\n\n    return new AccountPermission(result.attr, result.action)\n  }\n\n  static scopeNeededFor(options: AccountPermissionMatch) {\n    return AccountPermission.parser.format({\n      attr: options.attr,\n      action: [options.action],\n    })\n  }\n}\n"]}

package/dist/scopes/include-scope.d.ts

@@ -1,12 +1,11 @@
 import { AtprotoAudience } from '@atproto/did';
-import { LexPermission, LexPermissionSet } from '../lib/lexicon.js';
+import { LexiconPermission, LexiconPermissionSet } from '../lib/lexicon.js';
 import { Nsid, isNsid } from '../lib/nsid.js';
 import { Parser } from '../lib/parser.js';
-import { ScopeSyntax } from '../lib/syntax.js';
-import { BlobPermission } from './blob-permission.js';
+import { ScopeStringFor, ScopeSyntax } from '../lib/syntax.js';
 import { RepoPermission } from './repo-permission.js';
 import { RpcPermission } from './rpc-permission.js';
-export { type LexPermission, type LexPermissionSet, type Nsid, isNsid };
+export { type LexiconPermission, type LexiconPermissionSet, type Nsid, isNsid };
 /**
  * This is used to handle "include:" oauth scope values, used to include
  * permissions from a lexicon defined permission set. Not being a resource
@@ -16,20 +15,22 @@ export declare class IncludeScope {
     readonly nsid: Nsid;
     readonly aud: undefined | AtprotoAudience;
     constructor(nsid: Nsid, aud?: undefined | AtprotoAudience);
-    toString(): import("../lib/syntax.js").ScopeStringFor<"include">;
+    toString(): ScopeStringFor<"include">;
+    toPermissions(permissionSet: LexiconPermissionSet): Array<RepoPermission | RpcPermission>;
+    toScopes(permissionSet: LexiconPermissionSet): Array<ScopeStringFor<'repo' | 'rpc'>>;
     /**
      * Converts an "include:" to the list of permissions it includes, based on the
      * lexicon defined permission set.
      */
-    toPermissions(permissionSet: LexPermissionSet): (BlobPermission | RepoPermission | RpcPermission)[];
-    protected parsePermission(permission: LexPermission): BlobPermission | RepoPermission | RpcPermission | null;
+    buildPermissions(permissionSet: LexiconPermissionSet): Generator<RepoPermission | RpcPermission, void, unknown>;
+    protected parseLexPermission(permission: LexiconPermission): ScopeSyntax<'repo' | 'rpc'> | null;
     /**
      * Verifies that a permission included through a lexicon permission set is
      * allowed in the context of the `include:` scope. This basically checks that
      * the permission is "under" the namespace authority of the `include:` scope,
      * and that it only contains "repo:", "rpc:", or "blob:" permissions.
      */
-    protected isAllowedPermission(permission: unknown): permission is RpcPermission | RepoPermission | BlobPermission;
+    protected isAllowedPermission(permission: RpcPermission | RepoPermission): boolean;
     /**
      * Verifies that a permission item's nsid is under the same authority as the
      * nsid of the lexicon itself (which is the same as the nsid of the `include:`

package/dist/scopes/include-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"include-scope.d.ts","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,OAAO,EAAE,WAAW,EAAoB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,EAAE,CAAA;AAEvE;;;;GAIG;AACH,qBAAa,YAAY;aAEL,IAAI,EAAE,IAAI;aACV,GAAG,EAAE,SAAS,GAAG,eAAe;gBADhC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,SAAS,GAAG,eAA2B;IAG9D,QAAQ;IAIR;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,gBAAgB;IAM7C,SAAS,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa;IAoBnD;;;;;OAKG;IACH,SAAS,CAAC,mBAAmB,CAC3B,UAAU,EAAE,OAAO,GAClB,UAAU,IAAI,aAAa,GAAG,cAAc,GAAG,cAAc;IAgBhE;;;;OAIG;IACI,mBAAmB,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI;IAgChD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;;;;;;OAe/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;CAKjD"}
+{"version":3,"file":"include-scope.d.ts","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC,OAAO,EACL,cAAc,EACd,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,KAAK,IAAI,EAAE,MAAM,EAAE,CAAA;AAE/E;;;;GAIG;AACH,qBAAa,YAAY;aAEL,IAAI,EAAE,IAAI;aACV,GAAG,EAAE,SAAS,GAAG,eAAe;gBADhC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,SAAS,GAAG,eAA2B;IAG9D,QAAQ;IAIR,aAAa,CACX,aAAa,EAAE,oBAAoB,GAClC,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC;IAIxC,QAAQ,CACN,aAAa,EAAE,oBAAoB,GAClC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IAIxC;;;OAGG;IACF,gBAAgB,CACf,aAAa,EAAE,oBAAoB,GAClC,SAAS,CAAC,cAAc,GAAG,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC;IAc3D,SAAS,CAAC,kBAAkB,CAC1B,UAAU,EAAE,iBAAiB,GAC5B,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI;IAkCrC;;;;;OAKG;IACH,SAAS,CAAC,mBAAmB,CAC3B,UAAU,EAAE,aAAa,GAAG,cAAc,GACzC,OAAO;IAYV;;;;OAIG;IACI,mBAAmB,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI;IAgChD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;;;;;;;;;;;OAe/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;IAM/B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;CAKjD"}

package/dist/scopes/include-scope.js

@@ -8,7 +8,6 @@ const parser_js_1 = require("../lib/parser.js");
 const syntax_lexicon_js_1 = require("../lib/syntax-lexicon.js");
 const syntax_string_js_1 = require("../lib/syntax-string.js");
 const syntax_js_1 = require("../lib/syntax.js");
-const blob_permission_js_1 = require("./blob-permission.js");
 const repo_permission_js_1 = require("./repo-permission.js");
 const rpc_permission_js_1 = require("./rpc-permission.js");
 /**
@@ -34,30 +33,54 @@ class IncludeScope {
     toString() {
         return IncludeScope.parser.format(this);
     }
+    toPermissions(permissionSet) {
+        return Array.from(this.buildPermissions(permissionSet));
+    }
+    toScopes(permissionSet) {
+        return Array.from(this.buildPermissions(permissionSet), (p) => p.toString());
+    }
     /**
      * Converts an "include:" to the list of permissions it includes, based on the
      * lexicon defined permission set.
      */
-    toPermissions(permissionSet) {
-        return permissionSet.permissions
-            .map(this.parsePermission, this)
-            .filter(this.isAllowedPermission, this);
+    *buildPermissions(permissionSet) {
+        for (const lexPermission of permissionSet.permissions) {
+            const syntax = this.parseLexPermission(lexPermission);
+            if (!syntax)
+                continue;
+            const resourcePermission = toResourcePermission(syntax);
+            if (!resourcePermission)
+                continue;
+            if (this.isAllowedPermission(resourcePermission)) {
+                yield resourcePermission;
+            }
+        }
     }
-    parsePermission(permission) {
-        if (permission.resource === 'rpc' &&
-            permission.inheritAud === true &&
-            permission.aud === undefined &&
-            this.aud !== undefined) {
+    parseLexPermission(permission) {
+        // This function converts permissions listed in the permission set into
+        // their respective ScopeSyntax representations, handling special cases as
+        // needed.
+        if (isLexPermissionForResource(permission, 'repo')) {
+            return new syntax_lexicon_js_1.LexPermissionSyntax(permission);
+        }
+        if (isLexPermissionForResource(permission, 'rpc')) {
+            // "rpc" permissions with a defined audience are not allowed in permission
+            // sets
+            if (permission.aud !== undefined && permission.aud !== '*') {
+                return null;
+            }
             // "rpc" permissions can "inherit" their audience from "aud" param defined
             // in the "include:<nsid>?aud=<audience>" scope the permission set was
             // loaded from.
-            return parsePermission({
-                ...permission,
-                inheritAud: undefined,
-                aud: this.aud,
-            });
+            if (permission.inheritAud === true &&
+                permission.aud === undefined &&
+                this.aud !== undefined) {
+                const { inheritAud, ...rest } = permission;
+                return new syntax_lexicon_js_1.LexPermissionSyntax({ aud: this.aud, ...rest });
+            }
+            return new syntax_lexicon_js_1.LexPermissionSyntax(permission);
         }
-        return parsePermission(permission);
+        return null;
     }
     /**
      * Verifies that a permission included through a lexicon permission set is
@@ -72,10 +95,7 @@ class IncludeScope {
         if (permission instanceof repo_permission_js_1.RepoPermission) {
             return permission.collection.every(this.isParentAuthorityOf, this);
         }
-        if (permission instanceof blob_permission_js_1.BlobPermission) {
-            return true;
-        }
-        return false;
+        throw new TypeError(`Unexpected permission ${permission}`);
     }
     /**
      * Verifies that a permission item's nsid is under the same authority as the
@@ -138,19 +158,16 @@ Object.defineProperty(IncludeScope, "parser", {
         },
     }, 'nsid')
 });
-function parsePermission(permission) {
-    if (isPermissionForResource(permission, 'repo')) {
-        return repo_permission_js_1.RepoPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
-    }
-    if (isPermissionForResource(permission, 'rpc')) {
-        return rpc_permission_js_1.RpcPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
+function toResourcePermission(syntax) {
+    if ((0, syntax_js_1.isScopeSyntaxFor)(syntax, 'repo')) {
+        return repo_permission_js_1.RepoPermission.fromSyntax(syntax);
     }
-    if (isPermissionForResource(permission, 'blob')) {
-        return blob_permission_js_1.BlobPermission.fromSyntax(new syntax_lexicon_js_1.LexPermissionSyntax(permission));
+    if ((0, syntax_js_1.isScopeSyntaxFor)(syntax, 'rpc')) {
+        return rpc_permission_js_1.RpcPermission.fromSyntax(syntax);
     }
     return null;
 }
-function isPermissionForResource(permission, type) {
+function isLexPermissionForResource(permission, type) {
     return permission.resource === type;
 }
 //# sourceMappingURL=include-scope.js.map

package/dist/scopes/include-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"include-scope.js","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":";;;AAAA,sCAAiE;AAEjE,4CAA6C;AASkB,uFAThD,gBAAM,OASgD;AARrE,gDAAyC;AACzC,gEAA8D;AAC9D,8DAA2D;AAC3D,gDAAgE;AAChE,6DAAqD;AACrD,6DAAqD;AACrD,2DAAmD;AAInD;;;;GAIG;AACH,MAAa,YAAY;IACvB,YACkB,IAAU,EACV,MAAmC,SAAS;QAD5D;;;;mBAAgB,IAAI;WAAM;QAC1B;;;;mBAAgB,GAAG;WAAyC;IAC3D,CAAC;IAEJ,QAAQ;QACN,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,aAA+B;QAC3C,OAAO,aAAa,CAAC,WAAW;aAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC;aAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IAES,eAAe,CAAC,UAAyB;QACjD,IACE,UAAU,CAAC,QAAQ,KAAK,KAAK;YAC7B,UAAU,CAAC,UAAU,KAAK,IAAI;YAC9B,UAAU,CAAC,GAAG,KAAK,SAAS;YAC5B,IAAI,CAAC,GAAG,KAAK,SAAS,EACtB,CAAC;YACD,0EAA0E;YAC1E,sEAAsE;YACtE,eAAe;YACf,OAAO,eAAe,CAAC;gBACrB,GAAG,UAAU;gBACb,UAAU,EAAE,SAAS;gBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,eAAe,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACO,mBAAmB,CAC3B,UAAmB;QAEnB,IAAI,UAAU,YAAY,iCAAa,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,UAAU,YAAY,mCAAc,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,UAAU,YAAY,mCAAc,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;OAIG;IACI,mBAAmB,CAAC,SAAqB;QAC9C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAA;QAE7B,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAEnD,4EAA4E;QAC5E,sBAAsB;QACtB,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;QACtE,CAAC;QAED,qEAAqE;QACrE,IAAI,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,wBAAwB;QACxB,KAAK,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAmBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;;AAhIH,oCAiIC;AA5B2B;;;;WAAS,IAAI,kBAAM,CAC3C,SAAS,EACT;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,gBAAM;SACjB;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,uBAAiB;SAC5B;KACF,EACD,MAAM,CACP;EAf+B,CAe/B;AAeH,SAAS,eAAe,CAAC,UAAyB;IAChD,IAAI,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,mCAAc,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,iCAAa,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,mCAAc,CAAC,UAAU,CAAC,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAa,EACb,IAAO;IAEP,OAAO,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAA;AACrC,CAAC","sourcesContent":["import { AtprotoAudience, isAtprotoAudience } from '@atproto/did'\nimport { LexPermission, LexPermissionSet } from '../lib/lexicon.js'\nimport { Nsid, isNsid } from '../lib/nsid.js'\nimport { Parser } from '../lib/parser.js'\nimport { LexPermissionSyntax } from '../lib/syntax-lexicon.js'\nimport { ScopeStringSyntax } from '../lib/syntax-string.js'\nimport { ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'\nimport { BlobPermission } from './blob-permission.js'\nimport { RepoPermission } from './repo-permission.js'\nimport { RpcPermission } from './rpc-permission.js'\n\nexport { type LexPermission, type LexPermissionSet, type Nsid, isNsid }\n\n/**\n * This is used to handle \"include:\" oauth scope values, used to include\n * permissions from a lexicon defined permission set. Not being a resource\n * permission, it does not implement `Matchable`.\n */\nexport class IncludeScope {\n  constructor(\n    public readonly nsid: Nsid,\n    public readonly aud: undefined | AtprotoAudience = undefined,\n  ) {}\n\n  toString() {\n    return IncludeScope.parser.format(this)\n  }\n\n  /**\n   * Converts an \"include:\" to the list of permissions it includes, based on the\n   * lexicon defined permission set.\n   */\n  toPermissions(permissionSet: LexPermissionSet) {\n    return permissionSet.permissions\n      .map(this.parsePermission, this)\n      .filter(this.isAllowedPermission, this)\n  }\n\n  protected parsePermission(permission: LexPermission) {\n    if (\n      permission.resource === 'rpc' &&\n      permission.inheritAud === true &&\n      permission.aud === undefined &&\n      this.aud !== undefined\n    ) {\n      // \"rpc\" permissions can \"inherit\" their audience from \"aud\" param defined\n      // in the \"include:<nsid>?aud=<audience>\" scope the permission set was\n      // loaded from.\n      return parsePermission({\n        ...permission,\n        inheritAud: undefined,\n        aud: this.aud,\n      })\n    }\n\n    return parsePermission(permission)\n  }\n\n  /**\n   * Verifies that a permission included through a lexicon permission set is\n   * allowed in the context of the `include:` scope. This basically checks that\n   * the permission is \"under\" the namespace authority of the `include:` scope,\n   * and that it only contains \"repo:\", \"rpc:\", or \"blob:\" permissions.\n   */\n  protected isAllowedPermission(\n    permission: unknown,\n  ): permission is RpcPermission | RepoPermission | BlobPermission {\n    if (permission instanceof RpcPermission) {\n      return permission.lxm.every(this.isParentAuthorityOf, this)\n    }\n\n    if (permission instanceof RepoPermission) {\n      return permission.collection.every(this.isParentAuthorityOf, this)\n    }\n\n    if (permission instanceof BlobPermission) {\n      return true\n    }\n\n    return false\n  }\n\n  /**\n   * Verifies that a permission item's nsid is under the same authority as the\n   * nsid of the lexicon itself (which is the same as the nsid of the `include:`\n   * scope).\n   */\n  public isParentAuthorityOf(otherNsid: '*' | Nsid) {\n    if (otherNsid === '*') {\n      return false\n    }\n\n    const lexiconNsid = this.nsid\n\n    const groupPrefixEnd = lexiconNsid.lastIndexOf('.')\n\n    // There should always be a dot, but since this is a security feature, let's\n    // be strict about it.\n    if (groupPrefixEnd === -1) {\n      throw new TypeError('Dot character (\".\") missing from lexicon NSID')\n    }\n\n    // Make sure that otherNsid is at least as long as the \"group prefix\"\n    if (groupPrefixEnd >= otherNsid.length - 1) {\n      return false\n    }\n\n    // Make sure that the \"otherNsid\" starts with the group of the lexiconNsid,\n    // up to the dot itself. We check in reverse order as nsids tend to have\n    // long common prefixes.\n    for (let i = groupPrefixEnd; i >= 0; i--) {\n      if (lexiconNsid.charCodeAt(i) !== otherNsid.charCodeAt(i)) {\n        return false\n      }\n    }\n\n    return true\n  }\n\n  protected static readonly parser = new Parser(\n    'include',\n    {\n      nsid: {\n        multiple: false,\n        required: true,\n        validate: isNsid,\n      },\n      aud: {\n        multiple: false,\n        required: false,\n        validate: isAtprotoAudience,\n      },\n    },\n    'nsid',\n  )\n\n  static fromString(scope: string) {\n    if (!isScopeStringFor(scope, 'include')) return null\n    const syntax = ScopeStringSyntax.fromString(scope)\n    return IncludeScope.fromSyntax(syntax)\n  }\n\n  static fromSyntax(syntax: ScopeSyntax<'include'>) {\n    const result = IncludeScope.parser.parse(syntax)\n    if (!result) return null\n    return new IncludeScope(result.nsid, result.aud)\n  }\n}\n\nfunction parsePermission(permission: LexPermission) {\n  if (isPermissionForResource(permission, 'repo')) {\n    return RepoPermission.fromSyntax(new LexPermissionSyntax(permission))\n  }\n  if (isPermissionForResource(permission, 'rpc')) {\n    return RpcPermission.fromSyntax(new LexPermissionSyntax(permission))\n  }\n  if (isPermissionForResource(permission, 'blob')) {\n    return BlobPermission.fromSyntax(new LexPermissionSyntax(permission))\n  }\n  return null\n}\n\nfunction isPermissionForResource<P extends LexPermission, T extends string>(\n  permission: P,\n  type: T,\n): permission is P & { resource: T } {\n  return permission.resource === type\n}\n"]}
+{"version":3,"file":"include-scope.js","sourceRoot":"","sources":["../../src/scopes/include-scope.ts"],"names":[],"mappings":";;;AAAA,sCAAiE;AAEjE,4CAA6C;AAa0B,uFAbxD,gBAAM,OAawD;AAZ7E,gDAAyC;AACzC,gEAA8D;AAC9D,8DAA2D;AAC3D,gDAKyB;AACzB,6DAAqD;AACrD,2DAAmD;AAInD;;;;GAIG;AACH,MAAa,YAAY;IACvB,YACkB,IAAU,EACV,MAAmC,SAAS;QAD5D;;;;mBAAgB,IAAI;WAAM;QAC1B;;;;mBAAgB,GAAG;WAAyC;IAC3D,CAAC;IAEJ,QAAQ;QACN,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAED,aAAa,CACX,aAAmC;QAEnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,QAAQ,CACN,aAAmC;QAEnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED;;;OAGG;IACH,CAAC,gBAAgB,CACf,aAAmC;QAEnC,KAAK,MAAM,aAAa,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;YACrD,IAAI,CAAC,MAAM;gBAAE,SAAQ;YAErB,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;YACvD,IAAI,CAAC,kBAAkB;gBAAE,SAAQ;YAEjC,IAAI,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,MAAM,kBAAkB,CAAA;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,UAA6B;QAE7B,uEAAuE;QACvE,0EAA0E;QAC1E,UAAU;QAEV,IAAI,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAA;QAC5C,CAAC;QAED,IAAI,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;YAClD,0EAA0E;YAC1E,OAAO;YACP,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAA;YACb,CAAC;YAED,0EAA0E;YAC1E,sEAAsE;YACtE,eAAe;YACf,IACE,UAAU,CAAC,UAAU,KAAK,IAAI;gBAC9B,UAAU,CAAC,GAAG,KAAK,SAAS;gBAC5B,IAAI,CAAC,GAAG,KAAK,SAAS,EACtB,CAAC;gBACD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;gBAC1C,OAAO,IAAI,uCAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,OAAO,IAAI,uCAAmB,CAAC,UAAU,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACO,mBAAmB,CAC3B,UAA0C;QAE1C,IAAI,UAAU,YAAY,iCAAa,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,UAAU,YAAY,mCAAc,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED;;;;OAIG;IACI,mBAAmB,CAAC,SAAqB;QAC9C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAA;QAE7B,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAEnD,4EAA4E;QAC5E,sBAAsB;QACtB,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;QACtE,CAAC;QAED,qEAAqE;QACrE,IAAI,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,wBAAwB;QACxB,KAAK,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAmBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAA;QACpD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;;AAlKH,oCAmKC;AA5B2B;;;;WAAS,IAAI,kBAAM,CAC3C,SAAS,EACT;QACE,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,gBAAM;SACjB;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,uBAAiB;SAC5B;KACF,EACD,MAAM,CACP;EAf+B,CAe/B;AAeH,SAAS,oBAAoB,CAC3B,MAAmC;IAEnC,IAAI,IAAA,4BAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,mCAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,IAAA,4BAAgB,EAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,iCAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,0BAA0B,CAGjC,UAAa,EAAE,IAAO;IACtB,OAAO,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAA;AACrC,CAAC","sourcesContent":["import { AtprotoAudience, isAtprotoAudience } from '@atproto/did'\nimport { LexiconPermission, LexiconPermissionSet } from '../lib/lexicon.js'\nimport { Nsid, isNsid } from '../lib/nsid.js'\nimport { Parser } from '../lib/parser.js'\nimport { LexPermissionSyntax } from '../lib/syntax-lexicon.js'\nimport { ScopeStringSyntax } from '../lib/syntax-string.js'\nimport {\n  ScopeStringFor,\n  ScopeSyntax,\n  isScopeStringFor,\n  isScopeSyntaxFor,\n} from '../lib/syntax.js'\nimport { RepoPermission } from './repo-permission.js'\nimport { RpcPermission } from './rpc-permission.js'\n\nexport { type LexiconPermission, type LexiconPermissionSet, type Nsid, isNsid }\n\n/**\n * This is used to handle \"include:\" oauth scope values, used to include\n * permissions from a lexicon defined permission set. Not being a resource\n * permission, it does not implement `Matchable`.\n */\nexport class IncludeScope {\n  constructor(\n    public readonly nsid: Nsid,\n    public readonly aud: undefined | AtprotoAudience = undefined,\n  ) {}\n\n  toString() {\n    return IncludeScope.parser.format(this)\n  }\n\n  toPermissions(\n    permissionSet: LexiconPermissionSet,\n  ): Array<RepoPermission | RpcPermission> {\n    return Array.from(this.buildPermissions(permissionSet))\n  }\n\n  toScopes(\n    permissionSet: LexiconPermissionSet,\n  ): Array<ScopeStringFor<'repo' | 'rpc'>> {\n    return Array.from(this.buildPermissions(permissionSet), (p) => p.toString())\n  }\n\n  /**\n   * Converts an \"include:\" to the list of permissions it includes, based on the\n   * lexicon defined permission set.\n   */\n  *buildPermissions(\n    permissionSet: LexiconPermissionSet,\n  ): Generator<RepoPermission | RpcPermission, void, unknown> {\n    for (const lexPermission of permissionSet.permissions) {\n      const syntax = this.parseLexPermission(lexPermission)\n      if (!syntax) continue\n\n      const resourcePermission = toResourcePermission(syntax)\n      if (!resourcePermission) continue\n\n      if (this.isAllowedPermission(resourcePermission)) {\n        yield resourcePermission\n      }\n    }\n  }\n\n  protected parseLexPermission(\n    permission: LexiconPermission,\n  ): ScopeSyntax<'repo' | 'rpc'> | null {\n    // This function converts permissions listed in the permission set into\n    // their respective ScopeSyntax representations, handling special cases as\n    // needed.\n\n    if (isLexPermissionForResource(permission, 'repo')) {\n      return new LexPermissionSyntax(permission)\n    }\n\n    if (isLexPermissionForResource(permission, 'rpc')) {\n      // \"rpc\" permissions with a defined audience are not allowed in permission\n      // sets\n      if (permission.aud !== undefined && permission.aud !== '*') {\n        return null\n      }\n\n      // \"rpc\" permissions can \"inherit\" their audience from \"aud\" param defined\n      // in the \"include:<nsid>?aud=<audience>\" scope the permission set was\n      // loaded from.\n      if (\n        permission.inheritAud === true &&\n        permission.aud === undefined &&\n        this.aud !== undefined\n      ) {\n        const { inheritAud, ...rest } = permission\n        return new LexPermissionSyntax({ aud: this.aud, ...rest })\n      }\n\n      return new LexPermissionSyntax(permission)\n    }\n\n    return null\n  }\n\n  /**\n   * Verifies that a permission included through a lexicon permission set is\n   * allowed in the context of the `include:` scope. This basically checks that\n   * the permission is \"under\" the namespace authority of the `include:` scope,\n   * and that it only contains \"repo:\", \"rpc:\", or \"blob:\" permissions.\n   */\n  protected isAllowedPermission(\n    permission: RpcPermission | RepoPermission,\n  ): boolean {\n    if (permission instanceof RpcPermission) {\n      return permission.lxm.every(this.isParentAuthorityOf, this)\n    }\n\n    if (permission instanceof RepoPermission) {\n      return permission.collection.every(this.isParentAuthorityOf, this)\n    }\n\n    throw new TypeError(`Unexpected permission ${permission}`)\n  }\n\n  /**\n   * Verifies that a permission item's nsid is under the same authority as the\n   * nsid of the lexicon itself (which is the same as the nsid of the `include:`\n   * scope).\n   */\n  public isParentAuthorityOf(otherNsid: '*' | Nsid) {\n    if (otherNsid === '*') {\n      return false\n    }\n\n    const lexiconNsid = this.nsid\n\n    const groupPrefixEnd = lexiconNsid.lastIndexOf('.')\n\n    // There should always be a dot, but since this is a security feature, let's\n    // be strict about it.\n    if (groupPrefixEnd === -1) {\n      throw new TypeError('Dot character (\".\") missing from lexicon NSID')\n    }\n\n    // Make sure that otherNsid is at least as long as the \"group prefix\"\n    if (groupPrefixEnd >= otherNsid.length - 1) {\n      return false\n    }\n\n    // Make sure that the \"otherNsid\" starts with the group of the lexiconNsid,\n    // up to the dot itself. We check in reverse order as nsids tend to have\n    // long common prefixes.\n    for (let i = groupPrefixEnd; i >= 0; i--) {\n      if (lexiconNsid.charCodeAt(i) !== otherNsid.charCodeAt(i)) {\n        return false\n      }\n    }\n\n    return true\n  }\n\n  protected static readonly parser = new Parser(\n    'include',\n    {\n      nsid: {\n        multiple: false,\n        required: true,\n        validate: isNsid,\n      },\n      aud: {\n        multiple: false,\n        required: false,\n        validate: isAtprotoAudience,\n      },\n    },\n    'nsid',\n  )\n\n  static fromString(scope: string) {\n    if (!isScopeStringFor(scope, 'include')) return null\n    const syntax = ScopeStringSyntax.fromString(scope)\n    return IncludeScope.fromSyntax(syntax)\n  }\n\n  static fromSyntax(syntax: ScopeSyntax<'include'>) {\n    const result = IncludeScope.parser.parse(syntax)\n    if (!result) return null\n    return new IncludeScope(result.nsid, result.aud)\n  }\n}\n\nfunction toResourcePermission(\n  syntax: ScopeSyntax<'repo' | 'rpc'>,\n): RepoPermission | RpcPermission | null {\n  if (isScopeSyntaxFor(syntax, 'repo')) {\n    return RepoPermission.fromSyntax(syntax)\n  }\n  if (isScopeSyntaxFor(syntax, 'rpc')) {\n    return RpcPermission.fromSyntax(syntax)\n  }\n  return null\n}\n\nfunction isLexPermissionForResource<\n  P extends { resource: unknown },\n  T extends string,\n>(permission: P, type: T): permission is P & { resource: T } {\n  return permission.resource === type\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-scopes",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "license": "MIT",
   "description": "A library for manipulating and validating ATproto OAuth scopes in TypeScript.",
   "keywords": [
@@ -25,9 +25,8 @@
     }
   },
   "dependencies": {
-    "@atproto/did": "^0.2.2",
-    "@atproto/lexicon": "^0.5.2",
-    "@atproto/syntax": "^0.4.1"
+    "@atproto/did": "^0.3.0",
+    "@atproto/syntax": "^0.4.3"
   },
   "devDependencies": {
     "jest": "^28.1.2",

package/src/lib/lexicon.ts

@@ -1 +1,21 @@
-export type { LexPermission, LexPermissionSet } from '@atproto/lexicon'
+import { ParamValue } from './syntax.js'
+
+// @NOTE Not types from from '@atproto/lex-document' because we want a readonly
+// version here to prevent accidental mutation.
+
+export type LexiconPermission<P extends string = string> = {
+  readonly type: 'permission'
+  readonly resource: P
+  readonly [x: string]: undefined | ParamValue | readonly ParamValue[]
+}
+
+type LangMap = { readonly [Lang in string]?: string }
+
+export type LexiconPermissionSet = {
+  readonly type: 'permission-set'
+  readonly permissions: readonly LexiconPermission<string>[]
+  readonly title?: string
+  readonly 'title:lang'?: LangMap
+  readonly detail?: string
+  readonly 'detail:lang'?: LangMap
+}

package/src/lib/syntax-lexicon.ts

@@ -1,15 +1,15 @@
-import { LexPermission } from './lexicon.js'
+import { LexiconPermission } from './lexicon.js'
 import { ScopeSyntax } from './syntax.js'
 
+const isArray: (value: unknown) => value is readonly unknown[] = Array.isArray
+
 /**
- * Translates a {@link LexPermission} into a {@link ScopeSyntax}.
+ * Translates a {@link LexiconPermission} into a {@link ScopeSyntax}.
  */
 export class LexPermissionSyntax<P extends string = string>
   implements ScopeSyntax<P>
 {
-  constructor(
-    readonly lexPermission: Readonly<LexPermission & { resource: P }>,
-  ) {}
+  constructor(readonly lexPermission: LexiconPermission<P>) {}
 
   get prefix() {
     return this.lexPermission.resource
@@ -38,14 +38,14 @@ export class LexPermissionSyntax<P extends string = string>
 
   getSingle(key: string) {
     const value = this.get(key)
-    if (Array.isArray(value)) return null
+    if (isArray(value)) return null
     return value
   }
 
   getMulti(key: string) {
     const value = this.get(key)
     if (value === undefined) return undefined
-    if (!Array.isArray(value)) return null
+    if (!isArray(value)) return null
     return value
   }
 

package/src/lib/syntax.ts

@@ -43,5 +43,12 @@ export interface ScopeSyntax<P extends string> {
   readonly positional?: ParamValue
   keys(): Iterable<string, void, unknown>
   getSingle(key: string): ParamValue | null | undefined
-  getMulti(key: string): ParamValue[] | null | undefined
+  getMulti(key: string): readonly ParamValue[] | null | undefined
+}
+
+export function isScopeSyntaxFor<P extends string>(
+  syntax: ScopeSyntax<string>,
+  prefix: P,
+): syntax is ScopeSyntax<P> {
+  return syntax.prefix === prefix
 }

package/src/scopes/account-permission.test.ts

@@ -7,21 +7,21 @@ describe('AccountPermission', () => {
         const scope1 = AccountPermission.fromString('account:email?action=read')
         expect(scope1).not.toBeNull()
         expect(scope1!.attr).toBe('email')
-        expect(scope1!.action).toBe('read')
+        expect(scope1!.action).toEqual(['read'])
 
         const scope2 = AccountPermission.fromString(
           'account:repo?action=manage',
         )
         expect(scope2).not.toBeNull()
         expect(scope2!.attr).toBe('repo')
-        expect(scope2!.action).toBe('manage')
+        expect(scope2!.action).toEqual(['manage'])
       })
 
       it('should parse scope without action (defaults to read)', () => {
         const scope = AccountPermission.fromString('account:status')
         expect(scope).not.toBeNull()
         expect(scope!.attr).toBe('status')
-        expect(scope!.action).toBe('read')
+        expect(scope!.action).toEqual(['read'])
       })
 
       it('should reject invalid attribute names', () => {
@@ -144,26 +144,26 @@ describe('AccountPermission', () => {
 
     describe('toString', () => {
       it('should format scope with explicit action', () => {
-        const scope = new AccountPermission('email', 'manage')
+        const scope = new AccountPermission('email', ['manage'])
         expect(scope.toString()).toBe('account:email?action=manage')
       })
 
       it('should format scope with default action', () => {
-        const scope = new AccountPermission('repo', 'read')
+        const scope = new AccountPermission('repo', ['read'])
         expect(scope.toString()).toBe('account:repo')
       })
 
       it('should format all attributes correctly', () => {
-        expect(new AccountPermission('email', 'read').toString()).toBe(
+        expect(new AccountPermission('email', ['read']).toString()).toBe(
           'account:email',
         )
-        expect(new AccountPermission('repo', 'read').toString()).toBe(
+        expect(new AccountPermission('repo', ['read']).toString()).toBe(
           'account:repo',
         )
-        expect(new AccountPermission('status', 'read').toString()).toBe(
+        expect(new AccountPermission('status', ['read']).toString()).toBe(
           'account:status',
         )
-        expect(new AccountPermission('email', 'manage').toString()).toBe(
+        expect(new AccountPermission('email', ['manage']).toString()).toBe(
           'account:email?action=manage',
         )
       })

package/src/scopes/account-permission.ts

@@ -1,7 +1,7 @@
 import { Parser } from '../lib/parser.js'
 import { ResourcePermission } from '../lib/resource-permission.js'
 import { ScopeStringSyntax } from '../lib/syntax-string.js'
-import { ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'
+import { NeRoArray, ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'
 import { knownValuesValidator } from '../lib/util.js'
 
 export const ACCOUNT_ATTRIBUTES = Object.freeze([
@@ -24,13 +24,13 @@ export class AccountPermission
 {
   constructor(
     public readonly attr: AccountAttribute,
-    public readonly action: AccountAction,
+    public readonly action: NeRoArray<AccountAction>,
   ) {}
 
   matches(options: AccountPermissionMatch) {
     return (
       this.attr === options.attr &&
-      (this.action === 'manage' || this.action === options.action)
+      (this.action.includes('manage') || this.action.includes(options.action))
     )
   }
 
@@ -47,10 +47,10 @@ export class AccountPermission
         validate: knownValuesValidator(ACCOUNT_ATTRIBUTES),
       },
       action: {
-        multiple: false,
+        multiple: true,
         required: false,
         validate: knownValuesValidator(ACCOUNT_ACTIONS),
-        default: 'read' as const,
+        default: ['read' as const],
       },
     },
     'attr',
@@ -70,6 +70,9 @@ export class AccountPermission
   }
 
   static scopeNeededFor(options: AccountPermissionMatch) {
-    return AccountPermission.parser.format(options)
+    return AccountPermission.parser.format({
+      attr: options.attr,
+      action: [options.action],
+    })
   }
 }

package/src/scopes/include-scope.test.ts

@@ -2,7 +2,7 @@ import { ScopeStringFor } from '../lib/syntax'
 import { LexPermissionSyntax } from '../lib/syntax-lexicon'
 import { AccountPermission } from './account-permission'
 import { IdentityPermission } from './identity-permission'
-import { IncludeScope, LexPermissionSet } from './include-scope'
+import { IncludeScope, LexiconPermissionSet } from './include-scope'
 
 describe('IncludeScope', () => {
   describe('static', () => {
@@ -157,19 +157,18 @@ describe('IncludeScope', () => {
       })
     })
 
-    describe('toPermissions', () => {
+    describe('buildPermissions', () => {
       /**
-       * Utility that transforms an "include:<nsid>" scope and matching
+       * Utility that transforms a (valid) "include:<nsid>" scope and matching
        * (resolved) permission set into the list of permission scopes.
        */
       const compilePermissions = (
         scope: ScopeStringFor<'include'>,
-        permissionSet: LexPermissionSet,
-      ) =>
-        IncludeScope.fromString(scope)?.toPermissions(permissionSet).map(String)
+        permissionSet: LexiconPermissionSet,
+      ) => IncludeScope.fromString(scope)!.toScopes(permissionSet)
 
       describe('blob', () => {
-        describe('enables', () => {
+        describe('rejects', () => {
           it('valid permissions', () => {
             expect(
               compilePermissions('include:com.example.calendar.auth', {
@@ -182,11 +181,9 @@ describe('IncludeScope', () => {
                   },
                 ],
               }),
-            ).toEqual(['blob:image/*'])
+            ).toEqual([])
           })
-        })
 
-        describe('rejects', () => {
           it('invalid permissions', () => {
             expect(
               compilePermissions('include:com.example.calendar.auth', {
@@ -220,7 +217,7 @@ describe('IncludeScope', () => {
 
       describe('rpc', () => {
         describe('enables', () => {
-          it('valid permissions', () => {
+          it('allows * aud', () => {
             expect(
               compilePermissions('include:com.example.calendar.auth', {
                 type: 'permission-set',
@@ -228,17 +225,15 @@ describe('IncludeScope', () => {
                   {
                     type: 'permission',
                     resource: 'rpc',
-                    aud: 'did:web:example.com#foo',
+                    aud: '*',
                     lxm: ['com.example.calendar.listEvents'],
                   },
                 ],
               }),
-            ).toEqual([
-              'rpc:com.example.calendar.listEvents?aud=did:web:example.com%23foo',
-            ])
+            ).toEqual(['rpc:com.example.calendar.listEvents?aud=*'])
           })
 
-          it('valid inherited-aud permissions', () => {
+          it('inherits aud', () => {
             expect(
               compilePermissions(
                 'include:com.example.calendar.auth?aud=did:web:example.com#foo',
@@ -268,6 +263,22 @@ describe('IncludeScope', () => {
         })
 
         describe('rejects', () => {
+          it('forbids use of specific "aud"', () => {
+            expect(
+              compilePermissions('include:com.example.calendar.auth', {
+                type: 'permission-set',
+                permissions: [
+                  {
+                    type: 'permission',
+                    resource: 'rpc',
+                    aud: 'did:web:example.com#foo',
+                    lxm: ['com.example.calendar.listEvents'],
+                  },
+                ],
+              }),
+            ).toEqual([])
+          })
+
           it('invalid "lxm" syntax', () => {
             expect(
               compilePermissions('include:com.example.calendar.auth', {
@@ -569,7 +580,7 @@ describe('IncludeScope', () => {
           type: 'permission',
           resource: 'account',
           attr: 'email',
-          action: 'read',
+          action: ['read'],
         } as const
 
         it('parses valid permission syntax', () => {
@@ -578,7 +589,7 @@ describe('IncludeScope', () => {
           expect(AccountPermission.fromSyntax(syntax)).toMatchObject({
             constructor: AccountPermission,
             attr: 'email',
-            action: 'read',
+            action: ['read'],
           })
         })
 

package/src/scopes/include-scope.ts

@@ -1,15 +1,19 @@
 import { AtprotoAudience, isAtprotoAudience } from '@atproto/did'
-import { LexPermission, LexPermissionSet } from '../lib/lexicon.js'
+import { LexiconPermission, LexiconPermissionSet } from '../lib/lexicon.js'
 import { Nsid, isNsid } from '../lib/nsid.js'
 import { Parser } from '../lib/parser.js'
 import { LexPermissionSyntax } from '../lib/syntax-lexicon.js'
 import { ScopeStringSyntax } from '../lib/syntax-string.js'
-import { ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'
-import { BlobPermission } from './blob-permission.js'
+import {
+  ScopeStringFor,
+  ScopeSyntax,
+  isScopeStringFor,
+  isScopeSyntaxFor,
+} from '../lib/syntax.js'
 import { RepoPermission } from './repo-permission.js'
 import { RpcPermission } from './rpc-permission.js'
 
-export { type LexPermission, type LexPermissionSet, type Nsid, isNsid }
+export { type LexiconPermission, type LexiconPermissionSet, type Nsid, isNsid }
 
 /**
  * This is used to handle "include:" oauth scope values, used to include
@@ -26,34 +30,72 @@ export class IncludeScope {
     return IncludeScope.parser.format(this)
   }
 
+  toPermissions(
+    permissionSet: LexiconPermissionSet,
+  ): Array<RepoPermission | RpcPermission> {
+    return Array.from(this.buildPermissions(permissionSet))
+  }
+
+  toScopes(
+    permissionSet: LexiconPermissionSet,
+  ): Array<ScopeStringFor<'repo' | 'rpc'>> {
+    return Array.from(this.buildPermissions(permissionSet), (p) => p.toString())
+  }
+
   /**
    * Converts an "include:" to the list of permissions it includes, based on the
    * lexicon defined permission set.
    */
-  toPermissions(permissionSet: LexPermissionSet) {
-    return permissionSet.permissions
-      .map(this.parsePermission, this)
-      .filter(this.isAllowedPermission, this)
+  *buildPermissions(
+    permissionSet: LexiconPermissionSet,
+  ): Generator<RepoPermission | RpcPermission, void, unknown> {
+    for (const lexPermission of permissionSet.permissions) {
+      const syntax = this.parseLexPermission(lexPermission)
+      if (!syntax) continue
+
+      const resourcePermission = toResourcePermission(syntax)
+      if (!resourcePermission) continue
+
+      if (this.isAllowedPermission(resourcePermission)) {
+        yield resourcePermission
+      }
+    }
   }
 
-  protected parsePermission(permission: LexPermission) {
-    if (
-      permission.resource === 'rpc' &&
-      permission.inheritAud === true &&
-      permission.aud === undefined &&
-      this.aud !== undefined
-    ) {
+  protected parseLexPermission(
+    permission: LexiconPermission,
+  ): ScopeSyntax<'repo' | 'rpc'> | null {
+    // This function converts permissions listed in the permission set into
+    // their respective ScopeSyntax representations, handling special cases as
+    // needed.
+
+    if (isLexPermissionForResource(permission, 'repo')) {
+      return new LexPermissionSyntax(permission)
+    }
+
+    if (isLexPermissionForResource(permission, 'rpc')) {
+      // "rpc" permissions with a defined audience are not allowed in permission
+      // sets
+      if (permission.aud !== undefined && permission.aud !== '*') {
+        return null
+      }
+
       // "rpc" permissions can "inherit" their audience from "aud" param defined
       // in the "include:<nsid>?aud=<audience>" scope the permission set was
       // loaded from.
-      return parsePermission({
-        ...permission,
-        inheritAud: undefined,
-        aud: this.aud,
-      })
+      if (
+        permission.inheritAud === true &&
+        permission.aud === undefined &&
+        this.aud !== undefined
+      ) {
+        const { inheritAud, ...rest } = permission
+        return new LexPermissionSyntax({ aud: this.aud, ...rest })
+      }
+
+      return new LexPermissionSyntax(permission)
     }
 
-    return parsePermission(permission)
+    return null
   }
 
   /**
@@ -63,8 +105,8 @@ export class IncludeScope {
    * and that it only contains "repo:", "rpc:", or "blob:" permissions.
    */
   protected isAllowedPermission(
-    permission: unknown,
-  ): permission is RpcPermission | RepoPermission | BlobPermission {
+    permission: RpcPermission | RepoPermission,
+  ): boolean {
     if (permission instanceof RpcPermission) {
       return permission.lxm.every(this.isParentAuthorityOf, this)
     }
@@ -73,11 +115,7 @@ export class IncludeScope {
       return permission.collection.every(this.isParentAuthorityOf, this)
     }
 
-    if (permission instanceof BlobPermission) {
-      return true
-    }
-
-    return false
+    throw new TypeError(`Unexpected permission ${permission}`)
   }
 
   /**
@@ -147,22 +185,21 @@ export class IncludeScope {
   }
 }
 
-function parsePermission(permission: LexPermission) {
-  if (isPermissionForResource(permission, 'repo')) {
-    return RepoPermission.fromSyntax(new LexPermissionSyntax(permission))
-  }
-  if (isPermissionForResource(permission, 'rpc')) {
-    return RpcPermission.fromSyntax(new LexPermissionSyntax(permission))
+function toResourcePermission(
+  syntax: ScopeSyntax<'repo' | 'rpc'>,
+): RepoPermission | RpcPermission | null {
+  if (isScopeSyntaxFor(syntax, 'repo')) {
+    return RepoPermission.fromSyntax(syntax)
   }
-  if (isPermissionForResource(permission, 'blob')) {
-    return BlobPermission.fromSyntax(new LexPermissionSyntax(permission))
+  if (isScopeSyntaxFor(syntax, 'rpc')) {
+    return RpcPermission.fromSyntax(syntax)
   }
   return null
 }
 
-function isPermissionForResource<P extends LexPermission, T extends string>(
-  permission: P,
-  type: T,
-): permission is P & { resource: T } {
+function isLexPermissionForResource<
+  P extends { resource: unknown },
+  T extends string,
+>(permission: P, type: T): permission is P & { resource: T } {
   return permission.resource === type
 }

package/tsconfig.tests.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["./src/atproto-oauth-scope.ts","./src/index.ts","./src/scope-missing-error.ts","./src/scope-permissions-transition.test.ts","./src/scope-permissions-transition.ts","./src/scope-permissions.test.ts","./src/scope-permissions.ts","./src/scopes-set.test.ts","./src/scopes-set.ts","./src/lib/lexicon.ts","./src/lib/mime.test.ts","./src/lib/mime.ts","./src/lib/nsid.ts","./src/lib/parser.ts","./src/lib/resource-permission.ts","./src/lib/syntax-lexicon.ts","./src/lib/syntax-string.test.ts","./src/lib/syntax-string.ts","./src/lib/syntax.test.ts","./src/lib/syntax.ts","./src/lib/util.ts","./src/scopes/account-permission.test.ts","./src/scopes/account-permission.ts","./src/scopes/blob-permission.test.ts","./src/scopes/blob-permission.ts","./src/scopes/identity-permission.test.ts","./src/scopes/identity-permission.ts","./src/scopes/include-scope.test.ts","./src/scopes/include-scope.ts","./src/scopes/repo-permission.test.ts","./src/scopes/repo-permission.ts","./src/scopes/rpc-permission.test.ts","./src/scopes/rpc-permission.ts"],"version":"5.8.3"}