@memberjunction/global 6.2.0-edge.5 → 6.2.0-edge.6

package/dist/__tests__/UUIDCompliance.test.js

@@ -361,7 +361,7 @@ const NESTED_SCAN_BASELINE = {
     'MJCoreEntitiesServer/src/custom/MJApplicationEntityServer.server.ts': 1,
     'MJCoreEntitiesServer/src/custom/MJEntityFieldPermissionEntityServer.server.ts': 1,
     'MJCoreEntitiesServer/src/custom/MJUserRoleEntityServer.server.ts': 2,
-    'MJCoreEntitiesServer/src/custom/query-extraction/sync.ts': 7,
+    'MJCoreEntitiesServer/src/custom/query-extraction/sync.ts': 5,
     'MJCoreEntitiesServer/src/custom/rubrics/evaluationSubmit.ts': 2,
     'MJCoreEntitiesServer/src/custom/rubrics/versionPublish.ts': 1,
     'MJServer/src/resolvers/IntegrationDiscoveryResolver.ts': 1,

package/dist/__tests__/UserScopedCacheKey.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=UserScopedCacheKey.test.d.ts.map

package/dist/__tests__/UserScopedCacheKey.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserScopedCacheKey.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/UserScopedCacheKey.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/UserScopedCacheKey.test.js

@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest';
+import { UserCacheKeySegment, UserScopedCacheKey } from '../util/UserScopedCacheKey.js';
+describe('UserCacheKeySegment', () => {
+    it('normalizes the user ID so the same user always maps to one segment', () => {
+        expect(UserCacheKeySegment(' A1B2-C3D4 ')).toBe('u:a1b2-c3d4');
+        expect(UserCacheKeySegment('a1b2-c3d4')).toBe('u:a1b2-c3d4');
+    });
+    it('returns null when there is no user, so the caller does not cache', () => {
+        expect(UserCacheKeySegment(undefined)).toBeNull();
+        expect(UserCacheKeySegment(null)).toBeNull();
+        expect(UserCacheKeySegment('  ')).toBeNull();
+    });
+});
+describe('UserScopedCacheKey', () => {
+    it('gives two users different keys for the same entry', () => {
+        const a = UserScopedCacheKey('user-a', 'agent-1', 'Customers');
+        const b = UserScopedCacheKey('user-b', 'agent-1', 'Customers');
+        expect(a).toBe('agent-1:Customers:u:user-a');
+        expect(a).not.toBe(b);
+    });
+    it('returns null when there is no user', () => {
+        expect(UserScopedCacheKey(undefined, 'agent-1', 'Customers')).toBeNull();
+    });
+});
+//# sourceMappingURL=UserScopedCacheKey.test.js.map

package/dist/__tests__/UserScopedCacheKey.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserScopedCacheKey.test.js","sourceRoot":"","sources":["../../src/__tests__/UserScopedCacheKey.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -12,9 +12,11 @@ export * from './util/PatternUtils.js';
 export * from './util/ResourcePatternUtils.js';
 export * from './util/UUIDUtils.js';
 export * from './util/UUIDCollections.js';
+export * from './util/UserScopedCacheKey.js';
 export * from './util/CronUtils.js';
 export * from './util/SerializationUtils.js';
 export * from './util/BinaryEncoding.js';
+export * from './util/ProofOfPossession.js';
 export * from './ValidationTypes.js';
 export * from './JSONValidator.js';
 export * from './SafeExpressionEvaluator.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAChE,cAAc,aAAa,CAAA;AAC3B,cAAc,QAAQ,CAAA;AACtB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,2BAA2B,CAAA;AACzC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AAMtC,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAChE,cAAc,aAAa,CAAA;AAC3B,cAAc,QAAQ,CAAA;AACtB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,2BAA2B,CAAA;AACzC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AAMtC,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA"}

package/dist/index.js

@@ -13,9 +13,11 @@ export * from './util/PatternUtils.js';
 export * from './util/ResourcePatternUtils.js';
 export * from './util/UUIDUtils.js';
 export * from './util/UUIDCollections.js';
+export * from './util/UserScopedCacheKey.js';
 export * from './util/CronUtils.js';
 export * from './util/SerializationUtils.js';
 export * from './util/BinaryEncoding.js';
+export * from './util/ProofOfPossession.js';
 export * from './ValidationTypes.js';
 export * from './JSONValidator.js';
 export * from './SafeExpressionEvaluator.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAChE,cAAc,aAAa,CAAA;AAC3B,cAAc,QAAQ,CAAA;AACtB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,2BAA2B,CAAA;AACzC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AAEtC,2DAA2D;AAC3D,oCAAoC;AAEpC,0BAA0B;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA;AAE7C,6DAA6D;AAC7D,oCAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAChE,cAAc,aAAa,CAAA;AAC3B,cAAc,QAAQ,CAAA;AACtB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,2BAA2B,CAAA;AACzC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AAEtC,2DAA2D;AAC3D,oCAAoC;AAEpC,0BAA0B;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA;AAE7C,6DAA6D;AAC7D,oCAAoC"}

package/dist/util/ProofOfPossession.d.ts

@@ -0,0 +1,68 @@
+/** The public half of a proof key, as a JWK with only the members RFC 7638 hashes. */
+export interface ProofPublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+/** A proof key: the non-extractable private key that signs, and its public JWK that the server records. */
+export interface ProofOfPossessionKey {
+    PrivateKey: CryptoKey;
+    PublicJwk: ProofPublicJwk;
+}
+/** What one proof is made for. */
+export interface ProofOfPossessionRequest {
+    /** HTTP method of the protected request (`htm`). */
+    Method: string;
+    /** Full URL of the protected request (`htu`). */
+    Url: string;
+    /** The bearer token sent with the request; the proof carries its hash (`ath`), so it works for that token only. */
+    AccessToken: string;
+    /** Signing time (`iat`), epoch seconds. Defaults to now. */
+    NowSeconds?: number;
+}
+/** What the verifier expects of a proof. */
+export interface ProofOfPossessionExpectation {
+    Method: string;
+    /**
+     * The path the proof must name, matched as a suffix of the proof URL's path. This binds a proof to one
+     * endpoint, so a proof made for another route of the same API cannot be reused here. The origin and any
+     * base path are not compared: one API can be reached under several public origins and base paths (a
+     * proxy, `MJAPI_BASE_PATH`), and the caller cannot reliably list them. Leaving them open grants nothing,
+     * because only the holder of the bound key can sign a proof, and `ath` ties the proof to one token.
+     */
+    PathSuffix: string;
+    /** The bearer token presented with the proof. */
+    AccessToken: string;
+    NowSeconds: number;
+    /** How far `iat` may be from `NowSeconds`, either way. */
+    MaxSkewSeconds: number;
+}
+/** Why a proof was refused. */
+export type ProofOfPossessionRefusal = 'malformed' | 'bad_signature' | 'request_mismatch' | 'token_mismatch' | 'stale';
+/** Outcome of {@link VerifyProofOfPossessionJwt}; `Thumbprint` identifies the key that signed. */
+export type ProofOfPossessionVerification = {
+    Valid: true;
+    Thumbprint: string;
+} | {
+    Valid: false;
+    Reason: ProofOfPossessionRefusal;
+};
+/** Creates a proof key. The private key is non-extractable, so no script can read it out, only use it. */
+export declare function CreateProofOfPossessionKey(): Promise<ProofOfPossessionKey>;
+/** The RFC 7638 SHA-256 thumbprint of a proof key, base64url-encoded (the value of a token's `cnf.jkt`). */
+export declare function ComputeJwkThumbprint(jwk: ProofPublicJwk): Promise<string>;
+/** Signs a proof that the holder of `key` is making `request`. */
+export declare function CreateProofOfPossessionJwt(key: ProofOfPossessionKey, request: ProofOfPossessionRequest): Promise<string>;
+/**
+ * Checks a proof against what the request expects. Never throws: anything unparseable is `malformed`.
+ * Does not keep a replay cache of `jti`; a proof is bound to one token (`ath`) and to `MaxSkewSeconds`, so a
+ * replay needs both the proof and that token within the window.
+ */
+export declare function VerifyProofOfPossessionJwt(proof: string, expected: ProofOfPossessionExpectation): Promise<ProofOfPossessionVerification>;
+/**
+ * Narrows a value (e.g. a JWK a client sent) to a public P-256 JWK, keeping only the members RFC 7638 hashes;
+ * null for anything else, including a JWK that carries a private key.
+ */
+export declare function ToProofPublicJwk(value: unknown): ProofPublicJwk | null;
+//# sourceMappingURL=ProofOfPossession.d.ts.map

package/dist/util/ProofOfPossession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProofOfPossession.d.ts","sourceRoot":"","sources":["../../src/util/ProofOfPossession.ts"],"names":[],"mappings":"AAaA,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACb;AAED,2GAA2G;AAC3G,MAAM,WAAW,oBAAoB;IACjC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,cAAc,CAAC;CAC7B;AAED,kCAAkC;AAClC,MAAM,WAAW,wBAAwB;IACrC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,mHAAmH;IACnH,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,4BAA4B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED,+BAA+B;AAC/B,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,eAAe,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAEvH,kGAAkG;AAClG,MAAM,MAAM,6BAA6B,GACnC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAOzD,0GAA0G;AAC1G,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAShF;AAED,4GAA4G;AAC5G,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/E;AAED,kEAAkE;AAClE,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9H;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA6B9I;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAStE"}

package/dist/util/ProofOfPossession.js

@@ -0,0 +1,163 @@
+/**
+ * @fileoverview Proof of possession for bearer tokens, in the DPoP shape (RFC 9449), shared by the browser
+ * that holds a key and the server that checks it.
+ *
+ * The holder makes a P-256 key pair whose private half can never be exported, registers the public half
+ * when its token is issued (the server records the key's RFC 7638 thumbprint in the token), and signs a
+ * short-lived proof for each protected request. A token copied off the holder's machine is then useless for
+ * that request: the copier cannot produce a proof, because the key never left the browser.
+ *
+ * Uses only the Web Crypto API (`crypto.subtle`), available in browsers (secure contexts) and Node.js 15+.
+ */
+import { Base64ToBytes, BytesToBase64 } from './BinaryEncoding.js';
+const PROOF_TYPE = 'dpop+jwt';
+const PROOF_ALGORITHM = 'ES256';
+const KEY_ALGORITHM = { name: 'ECDSA', namedCurve: 'P-256' };
+const SIGN_ALGORITHM = { name: 'ECDSA', hash: 'SHA-256' };
+/** Creates a proof key. The private key is non-extractable, so no script can read it out, only use it. */
+export async function CreateProofOfPossessionKey() {
+    const subtle = requireSubtle();
+    const pair = await subtle.generateKey(KEY_ALGORITHM, false, ['sign', 'verify']);
+    const exported = await subtle.exportKey('jwk', pair.publicKey);
+    const publicJwk = ToProofPublicJwk(exported);
+    if (!publicJwk) {
+        throw new Error('CreateProofOfPossessionKey: the generated public key did not export as a P-256 JWK.');
+    }
+    return { PrivateKey: pair.privateKey, PublicJwk: publicJwk };
+}
+/** The RFC 7638 SHA-256 thumbprint of a proof key, base64url-encoded (the value of a token's `cnf.jkt`). */
+export async function ComputeJwkThumbprint(jwk) {
+    // RFC 7638 §3.2: the required members only, in lexicographic order, with no whitespace.
+    const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+    return sha256Base64Url(canonical);
+}
+/** Signs a proof that the holder of `key` is making `request`. */
+export async function CreateProofOfPossessionJwt(key, request) {
+    const header = { typ: PROOF_TYPE, alg: PROOF_ALGORITHM, jwk: key.PublicJwk };
+    const payload = {
+        htm: request.Method,
+        htu: request.Url,
+        iat: request.NowSeconds ?? Math.floor(Date.now() / 1000),
+        jti: bytesToBase64Url(requireCrypto().getRandomValues(new Uint8Array(16))),
+        ath: await sha256Base64Url(request.AccessToken),
+    };
+    const signingInput = `${encodeJsonPart(header)}.${encodeJsonPart(payload)}`;
+    const signature = await requireSubtle().sign(SIGN_ALGORITHM, key.PrivateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${bytesToBase64Url(new Uint8Array(signature))}`;
+}
+/**
+ * Checks a proof against what the request expects. Never throws: anything unparseable is `malformed`.
+ * Does not keep a replay cache of `jti`; a proof is bound to one token (`ath`) and to `MaxSkewSeconds`, so a
+ * replay needs both the proof and that token within the window.
+ */
+export async function VerifyProofOfPossessionJwt(proof, expected) {
+    const parts = typeof proof === 'string' ? proof.split('.') : [];
+    if (parts.length !== 3) {
+        return { Valid: false, Reason: 'malformed' };
+    }
+    const header = decodeJsonPart(parts[0]);
+    const payload = decodeJsonPart(parts[1]);
+    const signature = decodeBase64Url(parts[2]);
+    if (!header || !payload || !signature || header.typ !== PROOF_TYPE || header.alg !== PROOF_ALGORITHM) {
+        return { Valid: false, Reason: 'malformed' };
+    }
+    const jwk = ToProofPublicJwk(header.jwk);
+    if (!jwk) {
+        return { Valid: false, Reason: 'malformed' };
+    }
+    const signed = await verifySignature(jwk, `${parts[0]}.${parts[1]}`, signature);
+    if (!signed) {
+        return { Valid: false, Reason: 'bad_signature' };
+    }
+    if (payload.htm !== expected.Method || !pathEndsWith(payload.htu, expected.PathSuffix)) {
+        return { Valid: false, Reason: 'request_mismatch' };
+    }
+    if (typeof payload.iat !== 'number' || Math.abs(expected.NowSeconds - payload.iat) > expected.MaxSkewSeconds) {
+        return { Valid: false, Reason: 'stale' };
+    }
+    if (payload.ath !== (await sha256Base64Url(expected.AccessToken))) {
+        return { Valid: false, Reason: 'token_mismatch' };
+    }
+    return { Valid: true, Thumbprint: await ComputeJwkThumbprint(jwk) };
+}
+/**
+ * Narrows a value (e.g. a JWK a client sent) to a public P-256 JWK, keeping only the members RFC 7638 hashes;
+ * null for anything else, including a JWK that carries a private key.
+ */
+export function ToProofPublicJwk(value) {
+    if (typeof value !== 'object' || value === null) {
+        return null;
+    }
+    const jwk = value;
+    if (jwk.kty !== 'EC' || jwk.crv !== 'P-256' || typeof jwk.x !== 'string' || typeof jwk.y !== 'string' || 'd' in jwk) {
+        return null;
+    }
+    return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };
+}
+async function verifySignature(jwk, signingInput, signature) {
+    try {
+        const subtle = requireSubtle();
+        const publicKey = await subtle.importKey('jwk', { ...jwk, ext: true }, KEY_ALGORITHM, false, ['verify']);
+        return await subtle.verify(SIGN_ALGORITHM, publicKey, signature, new TextEncoder().encode(signingInput));
+    }
+    catch {
+        // An unimportable key (e.g. coordinates off the curve) is the same as a bad signature: the proof is refused.
+        return false;
+    }
+}
+function pathEndsWith(url, suffix) {
+    if (typeof url !== 'string') {
+        return false;
+    }
+    try {
+        return new URL(url).pathname.endsWith(suffix);
+    }
+    catch {
+        return false;
+    }
+}
+async function sha256Base64Url(text) {
+    const digest = await requireSubtle().digest('SHA-256', new TextEncoder().encode(text));
+    return bytesToBase64Url(new Uint8Array(digest));
+}
+function encodeJsonPart(value) {
+    return bytesToBase64Url(new TextEncoder().encode(JSON.stringify(value)));
+}
+function decodeJsonPart(part) {
+    const bytes = decodeBase64Url(part);
+    if (!bytes) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(bytes));
+        return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function bytesToBase64Url(bytes) {
+    return BytesToBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function decodeBase64Url(part) {
+    if (!/^[A-Za-z0-9_-]+$/.test(part)) {
+        return null;
+    }
+    const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+    try {
+        return Base64ToBytes(base64 + '='.repeat((4 - (base64.length % 4)) % 4));
+    }
+    catch {
+        return null;
+    }
+}
+function requireCrypto() {
+    if (typeof crypto === 'undefined' || !crypto.subtle) {
+        throw new Error('Web Crypto API not available: proof of possession needs a secure context. Serve the page over HTTPS (or from localhost).');
+    }
+    return crypto;
+}
+function requireSubtle() {
+    return requireCrypto().subtle;
+}
+//# sourceMappingURL=ProofOfPossession.js.map

package/dist/util/ProofOfPossession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProofOfPossession.js","sourceRoot":"","sources":["../../src/util/ProofOfPossession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAsDhE,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC7E,MAAM,cAAc,GAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEvE,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC5C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAmB;IAC1D,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAyB,EAAE,OAAiC;IACzG,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG;QACZ,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACxD,GAAG,EAAE,gBAAgB,CAAC,aAAa,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,GAAG,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;KAClD,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACrH,OAAO,GAAG,YAAY,IAAI,gBAAgB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAa,EAAE,QAAsC;IAClG,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QACnG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC3G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QAClH,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAmB,EAAE,YAAoB,EAAE,SAAqB;IAC3F,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzG,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,SAAyB,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QACL,6GAA6G;QAC7G,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,MAAc;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,OAAO,gBAAgB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACjC,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChI,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACvC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACjC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,aAAa;IAClB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;IAChJ,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,aAAa;IAClB,OAAO,aAAa,EAAE,CAAC,MAAM,CAAC;AAClC,CAAC"}

package/dist/util/UserScopedCacheKey.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @fileoverview Cache keys for in-process caches that hold user-scoped data.
+ *
+ * Data loaded under a user's permissions (row-level filters, field-level security, entity
+ * permissions) differs from one user to the next. An in-process cache that stores such data must
+ * therefore key every entry by the user it was loaded for; a key without a user hands the first
+ * caller's rows to everyone who asks next. These helpers make that segment uniform across caches.
+ *
+ * The user ID is the segment: it is always correct, at the cost of one entry per user. Sharing an
+ * entry between users with identical permissions is a valid optimization only when the key encodes
+ * everything that narrows the load (role filters, API-key ceilings, denied fields) — that is the
+ * job of the RunView cache's own fingerprint, not of an ad-hoc cache.
+ *
+ * @module @memberjunction/global/UserScopedCacheKey
+ */
+/**
+ * Returns the cache key segment that identifies the user an entry was loaded for, or `null` when
+ * there is no user. A `null` result means the data must not be cached at all, because any key built
+ * without a user would be shared by every caller.
+ *
+ * @param userID - the ID of the user the data was loaded for
+ * @returns `u:<normalized user ID>`, or `null` when `userID` is empty
+ *
+ * @example
+ * UserCacheKeySegment('A1B2C3D4-E5F6-7890-ABCD-EF1234567890') // 'u:a1b2c3d4-e5f6-7890-abcd-ef1234567890'
+ * UserCacheKeySegment(undefined)                              // null
+ */
+export declare function UserCacheKeySegment(userID: string | null | undefined): string | null;
+/**
+ * Builds a cache key for user-scoped data from the entry's own key parts plus the user segment
+ * ({@link UserCacheKeySegment}). Returns `null` when there is no user; callers must then skip the
+ * cache for both read and write.
+ *
+ * @param userID - the ID of the user the data was loaded for
+ * @param parts - the parts that identify the entry apart from the user, in a fixed order
+ * @returns the parts and the user segment joined with `:`, or `null` when `userID` is empty
+ *
+ * @example
+ * UserScopedCacheKey(contextUser.ID, agentID, sourceName) // '<agentID>:<sourceName>:u:<userID>'
+ */
+export declare function UserScopedCacheKey(userID: string | null | undefined, ...parts: string[]): string | null;
+//# sourceMappingURL=UserScopedCacheKey.d.ts.map

package/dist/util/UserScopedCacheKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserScopedCacheKey.d.ts","sourceRoot":"","sources":["../../src/util/UserScopedCacheKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAGvG"}

package/dist/util/UserScopedCacheKey.js

@@ -0,0 +1,49 @@
+/**
+ * @fileoverview Cache keys for in-process caches that hold user-scoped data.
+ *
+ * Data loaded under a user's permissions (row-level filters, field-level security, entity
+ * permissions) differs from one user to the next. An in-process cache that stores such data must
+ * therefore key every entry by the user it was loaded for; a key without a user hands the first
+ * caller's rows to everyone who asks next. These helpers make that segment uniform across caches.
+ *
+ * The user ID is the segment: it is always correct, at the cost of one entry per user. Sharing an
+ * entry between users with identical permissions is a valid optimization only when the key encodes
+ * everything that narrows the load (role filters, API-key ceilings, denied fields) — that is the
+ * job of the RunView cache's own fingerprint, not of an ad-hoc cache.
+ *
+ * @module @memberjunction/global/UserScopedCacheKey
+ */
+import { NormalizeUUID } from './UUIDUtils.js';
+/**
+ * Returns the cache key segment that identifies the user an entry was loaded for, or `null` when
+ * there is no user. A `null` result means the data must not be cached at all, because any key built
+ * without a user would be shared by every caller.
+ *
+ * @param userID - the ID of the user the data was loaded for
+ * @returns `u:<normalized user ID>`, or `null` when `userID` is empty
+ *
+ * @example
+ * UserCacheKeySegment('A1B2C3D4-E5F6-7890-ABCD-EF1234567890') // 'u:a1b2c3d4-e5f6-7890-abcd-ef1234567890'
+ * UserCacheKeySegment(undefined)                              // null
+ */
+export function UserCacheKeySegment(userID) {
+    const normalized = NormalizeUUID(userID);
+    return normalized.length > 0 ? `u:${normalized}` : null;
+}
+/**
+ * Builds a cache key for user-scoped data from the entry's own key parts plus the user segment
+ * ({@link UserCacheKeySegment}). Returns `null` when there is no user; callers must then skip the
+ * cache for both read and write.
+ *
+ * @param userID - the ID of the user the data was loaded for
+ * @param parts - the parts that identify the entry apart from the user, in a fixed order
+ * @returns the parts and the user segment joined with `:`, or `null` when `userID` is empty
+ *
+ * @example
+ * UserScopedCacheKey(contextUser.ID, agentID, sourceName) // '<agentID>:<sourceName>:u:<userID>'
+ */
+export function UserScopedCacheKey(userID, ...parts) {
+    const segment = UserCacheKeySegment(userID);
+    return segment === null ? null : [...parts, segment].join(':');
+}
+//# sourceMappingURL=UserScopedCacheKey.js.map

package/dist/util/UserScopedCacheKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserScopedCacheKey.js","sourceRoot":"","sources":["../../src/util/UserScopedCacheKey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACjE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC,EAAE,GAAG,KAAe;IACpF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@memberjunction/global",
   "type": "module",
-  "version": "6.2.0-edge.5",
+  "version": "6.2.0-edge.6",
   "description": "MemberJunction: Global Object - Needed for ALL other MJ components",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",