@opentdf/sdk 0.13.0-beta.126 → 0.13.0-beta.128

package/dist/cjs/src/index.js

@@ -36,7 +36,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigurationError = exports.AttributeNotFoundError = exports.AttributeValidationError = exports.NetworkError = exports.DecryptError = exports.InvalidFileError = exports.IntegrityError = exports.PermissionDeniedError = exports.TdfError = exports.PlatformClient = exports.tdfSpecVersion = exports.clientType = exports.version = exports.attributeValueExists = exports.attributeExists = exports.validateAttributes = exports.listAttributes = exports.attributeFQNsAsValues = exports.externalJwtTokenProvider = exports.refreshTokenProvider = exports.clientCredentialsTokenProvider = exports.authProviderInterceptor = exports.authTokenDPoPInterceptor = exports.authTokenInterceptor = exports.AuthProviders = exports.withHeaders = exports.HttpRequest = void 0;
+exports.ConfigurationError = exports.AttributeNotFoundError = exports.AttributeValidationError = exports.NetworkError = exports.DecryptError = exports.InvalidFileError = exports.IntegrityError = exports.PermissionDeniedError = exports.TdfError = exports.PlatformClient = exports.tdfSpecVersion = exports.clientType = exports.version = exports.attributeValueExists = exports.attributeExists = exports.validateAttributes = exports.listAttributes = exports.withRequestToken = exports.forToken = exports.forUserName = exports.forClientId = exports.forEmail = exports.attributeFQNsAsValues = exports.externalJwtTokenProvider = exports.refreshTokenProvider = exports.clientCredentialsTokenProvider = exports.authProviderInterceptor = exports.authTokenDPoPInterceptor = exports.authTokenInterceptor = exports.AuthProviders = exports.withHeaders = exports.HttpRequest = void 0;
 var auth_js_1 = require("./auth/auth.js");
 Object.defineProperty(exports, "HttpRequest", { enumerable: true, get: function () { return auth_js_1.HttpRequest; } });
 Object.defineProperty(exports, "withHeaders", { enumerable: true, get: function () { return auth_js_1.withHeaders; } });
@@ -51,6 +51,12 @@ Object.defineProperty(exports, "refreshTokenProvider", { enumerable: true, get:
 Object.defineProperty(exports, "externalJwtTokenProvider", { enumerable: true, get: function () { return token_providers_js_1.externalJwtTokenProvider; } });
 var api_js_1 = require("./policy/api.js");
 Object.defineProperty(exports, "attributeFQNsAsValues", { enumerable: true, get: function () { return api_js_1.attributeFQNsAsValues; } });
+var entity_identifiers_js_1 = require("./platform/authorization/entity-identifiers.js");
+Object.defineProperty(exports, "forEmail", { enumerable: true, get: function () { return entity_identifiers_js_1.forEmail; } });
+Object.defineProperty(exports, "forClientId", { enumerable: true, get: function () { return entity_identifiers_js_1.forClientId; } });
+Object.defineProperty(exports, "forUserName", { enumerable: true, get: function () { return entity_identifiers_js_1.forUserName; } });
+Object.defineProperty(exports, "forToken", { enumerable: true, get: function () { return entity_identifiers_js_1.forToken; } });
+Object.defineProperty(exports, "withRequestToken", { enumerable: true, get: function () { return entity_identifiers_js_1.withRequestToken; } });
 var discovery_js_1 = require("./policy/discovery.js");
 Object.defineProperty(exports, "listAttributes", { enumerable: true, get: function () { return discovery_js_1.listAttributes; } });
 Object.defineProperty(exports, "validateAttributes", { enumerable: true, get: function () { return discovery_js_1.validateAttributes; } });
@@ -75,4 +81,4 @@ Object.defineProperty(exports, "AttributeNotFoundError", { enumerable: true, get
 Object.defineProperty(exports, "ConfigurationError", { enumerable: true, get: function () { return errors_js_1.ConfigurationError; } });
 __exportStar(require("./seekable.js"), exports);
 __exportStar(require("../tdf3/src/models/index.js"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMENBQThGO0FBQWpELHNHQUFBLFdBQVcsT0FBQTtBQUFFLHNHQUFBLFdBQVcsT0FBQTtBQUNyRSxxRUFBcUQ7QUFDckQsMERBU2dDO0FBUjlCLHVIQUFBLG9CQUFvQixPQUFBO0FBQ3BCLDJIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLDBIQUFBLHVCQUF1QixPQUFBO0FBT3pCLGdFQU9tQztBQU5qQyxvSUFBQSw4QkFBOEIsT0FBQTtBQUM5QiwwSEFBQSxvQkFBb0IsT0FBQTtBQUNwQiw4SEFBQSx3QkFBd0IsT0FBQTtBQUsxQiwwQ0FBd0Q7QUFBL0MsK0dBQUEscUJBQXFCLE9BQUE7QUFDOUIsc0RBSytCO0FBSjdCLDhHQUFBLGNBQWMsT0FBQTtBQUNkLGtIQUFBLGtCQUFrQixPQUFBO0FBQ2xCLCtHQUFBLGVBQWUsT0FBQTtBQUNmLG9IQUFBLG9CQUFvQixPQUFBO0FBRXRCLDJDQUFtRTtBQUExRCxxR0FBQSxPQUFPLE9BQUE7QUFBRSx3R0FBQSxVQUFVLE9BQUE7QUFBRSw0R0FBQSxjQUFjLE9BQUE7QUFDNUMsNkNBQWtHO0FBQXpGLDZHQUFBLGNBQWMsT0FBQTtBQUN2QiwrQ0FBNkI7QUFDN0IseUNBVXFCO0FBVG5CLHFHQUFBLFFBQVEsT0FBQTtBQUNSLGtIQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDJHQUFBLGNBQWMsT0FBQTtBQUNkLDZHQUFBLGdCQUFnQixPQUFBO0FBQ2hCLHlHQUFBLFlBQVksT0FBQTtBQUNaLHlHQUFBLFlBQVksT0FBQTtBQUNaLHFIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLG1IQUFBLHNCQUFzQixPQUFBO0FBQ3RCLCtHQUFBLGtCQUFrQixPQUFBO0FBRXBCLGdEQUE4QjtBQUM5Qiw4REFBNEMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMENBQThGO0FBQWpELHNHQUFBLFdBQVcsT0FBQTtBQUFFLHNHQUFBLFdBQVcsT0FBQTtBQUNyRSxxRUFBcUQ7QUFDckQsMERBU2dDO0FBUjlCLHVIQUFBLG9CQUFvQixPQUFBO0FBQ3BCLDJIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLDBIQUFBLHVCQUF1QixPQUFBO0FBT3pCLGdFQU9tQztBQU5qQyxvSUFBQSw4QkFBOEIsT0FBQTtBQUM5QiwwSEFBQSxvQkFBb0IsT0FBQTtBQUNwQiw4SEFBQSx3QkFBd0IsT0FBQTtBQUsxQiwwQ0FBd0Q7QUFBL0MsK0dBQUEscUJBQXFCLE9BQUE7QUFDOUIsd0ZBTXdEO0FBTHRELGlIQUFBLFFBQVEsT0FBQTtBQUNSLG9IQUFBLFdBQVcsT0FBQTtBQUNYLG9IQUFBLFdBQVcsT0FBQTtBQUNYLGlIQUFBLFFBQVEsT0FBQTtBQUNSLHlIQUFBLGdCQUFnQixPQUFBO0FBRWxCLHNEQUsrQjtBQUo3Qiw4R0FBQSxjQUFjLE9BQUE7QUFDZCxrSEFBQSxrQkFBa0IsT0FBQTtBQUNsQiwrR0FBQSxlQUFlLE9BQUE7QUFDZixvSEFBQSxvQkFBb0IsT0FBQTtBQUV0QiwyQ0FBbUU7QUFBMUQscUdBQUEsT0FBTyxPQUFBO0FBQUUsd0dBQUEsVUFBVSxPQUFBO0FBQUUsNEdBQUEsY0FBYyxPQUFBO0FBQzVDLDZDQUFrRztBQUF6Riw2R0FBQSxjQUFjLE9BQUE7QUFDdkIsK0NBQTZCO0FBQzdCLHlDQVVxQjtBQVRuQixxR0FBQSxRQUFRLE9BQUE7QUFDUixrSEFBQSxxQkFBcUIsT0FBQTtBQUNyQiwyR0FBQSxjQUFjLE9BQUE7QUFDZCw2R0FBQSxnQkFBZ0IsT0FBQTtBQUNoQix5R0FBQSxZQUFZLE9BQUE7QUFDWix5R0FBQSxZQUFZLE9BQUE7QUFDWixxSEFBQSx3QkFBd0IsT0FBQTtBQUN4QixtSEFBQSxzQkFBc0IsT0FBQTtBQUN0QiwrR0FBQSxrQkFBa0IsT0FBQTtBQUVwQixnREFBOEI7QUFDOUIsOERBQTRDIn0=

package/dist/cjs/src/platform/authorization/entity-identifiers.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.forEmail = forEmail;
+exports.forClientId = forClientId;
+exports.forUserName = forUserName;
+exports.forToken = forToken;
+exports.withRequestToken = withRequestToken;
+const protobuf_1 = require("@bufbuild/protobuf");
+const wkt_1 = require("@bufbuild/protobuf/wkt");
+const authorization_pb_js_1 = require("./v2/authorization_pb.js");
+const entity_pb_js_1 = require("../entity/entity_pb.js");
+/**
+ * Convenience constructors for {@link EntityIdentifier}, mirroring the Go SDK
+ * helpers (`ForEmail`, `ForClientID`, etc.).
+ *
+ * Each function builds a complete `EntityIdentifier` so callers avoid deeply
+ * nested object literals.
+ *
+ * @example
+ * ```ts
+ * // Before
+ * const eid = create(EntityIdentifierSchema, {
+ *   identifier: {
+ *     case: 'entityChain',
+ *     value: create(EntityChainSchema, {
+ *       entities: [create(EntitySchema, {
+ *         entityType: { case: 'emailAddress', value: 'jen@example.com' },
+ *         category: Entity_Category.SUBJECT,
+ *       })],
+ *     }),
+ *   },
+ * });
+ *
+ * // After
+ * const eid = forEmail('jen@example.com');
+ * ```
+ */
+/** Returns an EntityIdentifier for a subject identified by email address. */
+function forEmail(email) {
+    return fromEntity((0, protobuf_1.create)(entity_pb_js_1.EntitySchema, {
+        entityType: { case: 'emailAddress', value: email },
+        category: entity_pb_js_1.Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier for a subject identified by client ID. */
+function forClientId(clientId) {
+    return fromEntity((0, protobuf_1.create)(entity_pb_js_1.EntitySchema, {
+        entityType: { case: 'clientId', value: clientId },
+        category: entity_pb_js_1.Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier for a subject identified by username. */
+function forUserName(userName) {
+    return fromEntity((0, protobuf_1.create)(entity_pb_js_1.EntitySchema, {
+        entityType: { case: 'userName', value: userName },
+        category: entity_pb_js_1.Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier that resolves the entity from the given JWT. */
+function forToken(jwt) {
+    return (0, protobuf_1.create)(authorization_pb_js_1.EntityIdentifierSchema, {
+        identifier: {
+            case: 'token',
+            value: (0, protobuf_1.create)(entity_pb_js_1.TokenSchema, { jwt }),
+        },
+    });
+}
+/**
+ * Returns an EntityIdentifier that instructs the authorization service to
+ * derive the entity from the request's Authorization header token.
+ */
+function withRequestToken() {
+    return (0, protobuf_1.create)(authorization_pb_js_1.EntityIdentifierSchema, {
+        identifier: {
+            case: 'withRequestToken',
+            value: (0, protobuf_1.create)(wkt_1.BoolValueSchema, { value: true }),
+        },
+    });
+}
+function fromEntity(entity) {
+    return (0, protobuf_1.create)(authorization_pb_js_1.EntityIdentifierSchema, {
+        identifier: {
+            case: 'entityChain',
+            value: (0, protobuf_1.create)(entity_pb_js_1.EntityChainSchema, { entities: [entity] }),
+        },
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW50aXR5LWlkZW50aWZpZXJzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL3BsYXRmb3JtL2F1dGhvcml6YXRpb24vZW50aXR5LWlkZW50aWZpZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBMENBLDRCQU9DO0FBR0Qsa0NBT0M7QUFHRCxrQ0FPQztBQUdELDRCQU9DO0FBTUQsNENBT0M7QUE1RkQsaURBQTRDO0FBQzVDLGdEQUF5RDtBQUN6RCxrRUFHa0M7QUFDbEMseURBTWdDO0FBRWhDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBeUJHO0FBRUgsNkVBQTZFO0FBQzdFLFNBQWdCLFFBQVEsQ0FBQyxLQUFhO0lBQ3BDLE9BQU8sVUFBVSxDQUNmLElBQUEsaUJBQU0sRUFBQywyQkFBWSxFQUFFO1FBQ25CLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtRQUNsRCxRQUFRLEVBQUUsOEJBQWUsQ0FBQyxPQUFPO0tBQ2xDLENBQUMsQ0FDSCxDQUFDO0FBQ0osQ0FBQztBQUVELHlFQUF5RTtBQUN6RSxTQUFnQixXQUFXLENBQUMsUUFBZ0I7SUFDMUMsT0FBTyxVQUFVLENBQ2YsSUFBQSxpQkFBTSxFQUFDLDJCQUFZLEVBQUU7UUFDbkIsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO1FBQ2pELFFBQVEsRUFBRSw4QkFBZSxDQUFDLE9BQU87S0FDbEMsQ0FBQyxDQUNILENBQUM7QUFDSixDQUFDO0FBRUQsd0VBQXdFO0FBQ3hFLFNBQWdCLFdBQVcsQ0FBQyxRQUFnQjtJQUMxQyxPQUFPLFVBQVUsQ0FDZixJQUFBLGlCQUFNLEVBQUMsMkJBQVksRUFBRTtRQUNuQixVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7UUFDakQsUUFBUSxFQUFFLDhCQUFlLENBQUMsT0FBTztLQUNsQyxDQUFDLENBQ0gsQ0FBQztBQUNKLENBQUM7QUFFRCwrRUFBK0U7QUFDL0UsU0FBZ0IsUUFBUSxDQUFDLEdBQVc7SUFDbEMsT0FBTyxJQUFBLGlCQUFNLEVBQUMsNENBQXNCLEVBQUU7UUFDcEMsVUFBVSxFQUFFO1lBQ1YsSUFBSSxFQUFFLE9BQU87WUFDYixLQUFLLEVBQUUsSUFBQSxpQkFBTSxFQUFDLDBCQUFXLEVBQUUsRUFBRSxHQUFHLEVBQUUsQ0FBQztTQUNwQztLQUNGLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixnQkFBZ0I7SUFDOUIsT0FBTyxJQUFBLGlCQUFNLEVBQUMsNENBQXNCLEVBQUU7UUFDcEMsVUFBVSxFQUFFO1lBQ1YsSUFBSSxFQUFFLGtCQUFrQjtZQUN4QixLQUFLLEVBQUUsSUFBQSxpQkFBTSxFQUFDLHFCQUFlLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUM7U0FDaEQ7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQsU0FBUyxVQUFVLENBQUMsTUFBYztJQUNoQyxPQUFPLElBQUEsaUJBQU0sRUFBQyw0Q0FBc0IsRUFBRTtRQUNwQyxVQUFVLEVBQUU7WUFDVixJQUFJLEVBQUUsYUFBYTtZQUNuQixLQUFLLEVBQUUsSUFBQSxpQkFBTSxFQUFDLGdDQUFpQixFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztTQUN6RDtLQUNGLENBQUMsQ0FBQztBQUNMLENBQUMifQ==

package/dist/types/src/index.d.ts

@@ -3,6 +3,7 @@ export * as AuthProviders from './auth/providers.js';
 export { authTokenInterceptor, authTokenDPoPInterceptor, authProviderInterceptor, type AuthConfig, type DPoPInterceptor, type DPoPInterceptorOptions, type Interceptor, type TokenProvider, } from './auth/interceptors.js';
 export { clientCredentialsTokenProvider, refreshTokenProvider, externalJwtTokenProvider, type ClientCredentialsTokenProviderOptions, type RefreshTokenProviderOptions, type ExternalJwtTokenProviderOptions, } from './auth/token-providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export { forEmail, forClientId, forUserName, forToken, withRequestToken, } from './platform/authorization/entity-identifiers.js';
 export { listAttributes, validateAttributes, attributeExists, attributeValueExists, } from './policy/discovery.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
 export { PlatformClient, type PlatformClientOptions, type PlatformServices } from './platform.js';

package/dist/types/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,qCAAqC,EAC1C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClG,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,qCAAqC,EAC1C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClG,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC"}

package/dist/types/src/platform/authorization/entity-identifiers.d.ts

@@ -0,0 +1,41 @@
+import { type EntityIdentifier } from './v2/authorization_pb.js';
+/**
+ * Convenience constructors for {@link EntityIdentifier}, mirroring the Go SDK
+ * helpers (`ForEmail`, `ForClientID`, etc.).
+ *
+ * Each function builds a complete `EntityIdentifier` so callers avoid deeply
+ * nested object literals.
+ *
+ * @example
+ * ```ts
+ * // Before
+ * const eid = create(EntityIdentifierSchema, {
+ *   identifier: {
+ *     case: 'entityChain',
+ *     value: create(EntityChainSchema, {
+ *       entities: [create(EntitySchema, {
+ *         entityType: { case: 'emailAddress', value: 'jen@example.com' },
+ *         category: Entity_Category.SUBJECT,
+ *       })],
+ *     }),
+ *   },
+ * });
+ *
+ * // After
+ * const eid = forEmail('jen@example.com');
+ * ```
+ */
+/** Returns an EntityIdentifier for a subject identified by email address. */
+export declare function forEmail(email: string): EntityIdentifier;
+/** Returns an EntityIdentifier for a subject identified by client ID. */
+export declare function forClientId(clientId: string): EntityIdentifier;
+/** Returns an EntityIdentifier for a subject identified by username. */
+export declare function forUserName(userName: string): EntityIdentifier;
+/** Returns an EntityIdentifier that resolves the entity from the given JWT. */
+export declare function forToken(jwt: string): EntityIdentifier;
+/**
+ * Returns an EntityIdentifier that instructs the authorization service to
+ * derive the entity from the request's Authorization header token.
+ */
+export declare function withRequestToken(): EntityIdentifier;
+//# sourceMappingURL=entity-identifiers.d.ts.map

package/dist/types/src/platform/authorization/entity-identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-identifiers.d.ts","sourceRoot":"","sources":["../../../../../src/platform/authorization/entity-identifiers.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AASlC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAOxD;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAO9D;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAO9D;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAOtD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,CAOnD"}

package/dist/web/src/index.js

@@ -3,6 +3,7 @@ export * as AuthProviders from './auth/providers.js';
 export { authTokenInterceptor, authTokenDPoPInterceptor, authProviderInterceptor, } from './auth/interceptors.js';
 export { clientCredentialsTokenProvider, refreshTokenProvider, externalJwtTokenProvider, } from './auth/token-providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export { forEmail, forClientId, forUserName, forToken, withRequestToken, } from './platform/authorization/entity-identifiers.js';
 export { listAttributes, validateAttributes, attributeExists, attributeValueExists, } from './policy/discovery.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
 export { PlatformClient } from './platform.js';
@@ -10,4 +11,4 @@ export * from './opentdf.js';
 export { TdfError, PermissionDeniedError, IntegrityError, InvalidFileError, DecryptError, NetworkError, AttributeValidationError, AttributeNotFoundError, ConfigurationError, } from './errors.js';
 export * from './seekable.js';
 export * from '../tdf3/src/models/index.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFzQyxXQUFXLEVBQUUsV0FBVyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUYsT0FBTyxLQUFLLGFBQWEsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQ0wsb0JBQW9CLEVBQ3BCLHdCQUF3QixFQUN4Qix1QkFBdUIsR0FNeEIsTUFBTSx3QkFBd0IsQ0FBQztBQUNoQyxPQUFPLEVBQ0wsOEJBQThCLEVBQzlCLG9CQUFvQixFQUNwQix3QkFBd0IsR0FJekIsTUFBTSwyQkFBMkIsQ0FBQztBQUNuQyxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RCxPQUFPLEVBQ0wsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixlQUFlLEVBQ2Ysb0JBQW9CLEdBQ3JCLE1BQU0sdUJBQXVCLENBQUM7QUFDL0IsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ25FLE9BQU8sRUFBRSxjQUFjLEVBQXFELE1BQU0sZUFBZSxDQUFDO0FBQ2xHLGNBQWMsY0FBYyxDQUFDO0FBQzdCLE9BQU8sRUFDTCxRQUFRLEVBQ1IscUJBQXFCLEVBQ3JCLGNBQWMsRUFDZCxnQkFBZ0IsRUFDaEIsWUFBWSxFQUNaLFlBQVksRUFDWix3QkFBd0IsRUFDeEIsc0JBQXNCLEVBQ3RCLGtCQUFrQixHQUNuQixNQUFNLGFBQWEsQ0FBQztBQUNyQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLDZCQUE2QixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFzQyxXQUFXLEVBQUUsV0FBVyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUYsT0FBTyxLQUFLLGFBQWEsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQ0wsb0JBQW9CLEVBQ3BCLHdCQUF3QixFQUN4Qix1QkFBdUIsR0FNeEIsTUFBTSx3QkFBd0IsQ0FBQztBQUNoQyxPQUFPLEVBQ0wsOEJBQThCLEVBQzlCLG9CQUFvQixFQUNwQix3QkFBd0IsR0FJekIsTUFBTSwyQkFBMkIsQ0FBQztBQUNuQyxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RCxPQUFPLEVBQ0wsUUFBUSxFQUNSLFdBQVcsRUFDWCxXQUFXLEVBQ1gsUUFBUSxFQUNSLGdCQUFnQixHQUNqQixNQUFNLGdEQUFnRCxDQUFDO0FBQ3hELE9BQU8sRUFDTCxjQUFjLEVBQ2Qsa0JBQWtCLEVBQ2xCLGVBQWUsRUFDZixvQkFBb0IsR0FDckIsTUFBTSx1QkFBdUIsQ0FBQztBQUMvQixPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDbkUsT0FBTyxFQUFFLGNBQWMsRUFBcUQsTUFBTSxlQUFlLENBQUM7QUFDbEcsY0FBYyxjQUFjLENBQUM7QUFDN0IsT0FBTyxFQUNMLFFBQVEsRUFDUixxQkFBcUIsRUFDckIsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixZQUFZLEVBQ1osWUFBWSxFQUNaLHdCQUF3QixFQUN4QixzQkFBc0IsRUFDdEIsa0JBQWtCLEdBQ25CLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNkJBQTZCLENBQUMifQ==

package/dist/web/src/platform/authorization/entity-identifiers.js

@@ -0,0 +1,81 @@
+import { create } from '@bufbuild/protobuf';
+import { BoolValueSchema } from '@bufbuild/protobuf/wkt';
+import { EntityIdentifierSchema, } from './v2/authorization_pb.js';
+import { Entity_Category, EntityChainSchema, EntitySchema, TokenSchema, } from '../entity/entity_pb.js';
+/**
+ * Convenience constructors for {@link EntityIdentifier}, mirroring the Go SDK
+ * helpers (`ForEmail`, `ForClientID`, etc.).
+ *
+ * Each function builds a complete `EntityIdentifier` so callers avoid deeply
+ * nested object literals.
+ *
+ * @example
+ * ```ts
+ * // Before
+ * const eid = create(EntityIdentifierSchema, {
+ *   identifier: {
+ *     case: 'entityChain',
+ *     value: create(EntityChainSchema, {
+ *       entities: [create(EntitySchema, {
+ *         entityType: { case: 'emailAddress', value: 'jen@example.com' },
+ *         category: Entity_Category.SUBJECT,
+ *       })],
+ *     }),
+ *   },
+ * });
+ *
+ * // After
+ * const eid = forEmail('jen@example.com');
+ * ```
+ */
+/** Returns an EntityIdentifier for a subject identified by email address. */
+export function forEmail(email) {
+    return fromEntity(create(EntitySchema, {
+        entityType: { case: 'emailAddress', value: email },
+        category: Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier for a subject identified by client ID. */
+export function forClientId(clientId) {
+    return fromEntity(create(EntitySchema, {
+        entityType: { case: 'clientId', value: clientId },
+        category: Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier for a subject identified by username. */
+export function forUserName(userName) {
+    return fromEntity(create(EntitySchema, {
+        entityType: { case: 'userName', value: userName },
+        category: Entity_Category.SUBJECT,
+    }));
+}
+/** Returns an EntityIdentifier that resolves the entity from the given JWT. */
+export function forToken(jwt) {
+    return create(EntityIdentifierSchema, {
+        identifier: {
+            case: 'token',
+            value: create(TokenSchema, { jwt }),
+        },
+    });
+}
+/**
+ * Returns an EntityIdentifier that instructs the authorization service to
+ * derive the entity from the request's Authorization header token.
+ */
+export function withRequestToken() {
+    return create(EntityIdentifierSchema, {
+        identifier: {
+            case: 'withRequestToken',
+            value: create(BoolValueSchema, { value: true }),
+        },
+    });
+}
+function fromEntity(entity) {
+    return create(EntityIdentifierSchema, {
+        identifier: {
+            case: 'entityChain',
+            value: create(EntityChainSchema, { entities: [entity] }),
+        },
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW50aXR5LWlkZW50aWZpZXJzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL3BsYXRmb3JtL2F1dGhvcml6YXRpb24vZW50aXR5LWlkZW50aWZpZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUM1QyxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDekQsT0FBTyxFQUVMLHNCQUFzQixHQUN2QixNQUFNLDBCQUEwQixDQUFDO0FBQ2xDLE9BQU8sRUFFTCxlQUFlLEVBQ2YsaUJBQWlCLEVBQ2pCLFlBQVksRUFDWixXQUFXLEdBQ1osTUFBTSx3QkFBd0IsQ0FBQztBQUVoQzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXlCRztBQUVILDZFQUE2RTtBQUM3RSxNQUFNLFVBQVUsUUFBUSxDQUFDLEtBQWE7SUFDcEMsT0FBTyxVQUFVLENBQ2YsTUFBTSxDQUFDLFlBQVksRUFBRTtRQUNuQixVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7UUFDbEQsUUFBUSxFQUFFLGVBQWUsQ0FBQyxPQUFPO0tBQ2xDLENBQUMsQ0FDSCxDQUFDO0FBQ0osQ0FBQztBQUVELHlFQUF5RTtBQUN6RSxNQUFNLFVBQVUsV0FBVyxDQUFDLFFBQWdCO0lBQzFDLE9BQU8sVUFBVSxDQUNmLE1BQU0sQ0FBQyxZQUFZLEVBQUU7UUFDbkIsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO1FBQ2pELFFBQVEsRUFBRSxlQUFlLENBQUMsT0FBTztLQUNsQyxDQUFDLENBQ0gsQ0FBQztBQUNKLENBQUM7QUFFRCx3RUFBd0U7QUFDeEUsTUFBTSxVQUFVLFdBQVcsQ0FBQyxRQUFnQjtJQUMxQyxPQUFPLFVBQVUsQ0FDZixNQUFNLENBQUMsWUFBWSxFQUFFO1FBQ25CLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtRQUNqRCxRQUFRLEVBQUUsZUFBZSxDQUFDLE9BQU87S0FDbEMsQ0FBQyxDQUNILENBQUM7QUFDSixDQUFDO0FBRUQsK0VBQStFO0FBQy9FLE1BQU0sVUFBVSxRQUFRLENBQUMsR0FBVztJQUNsQyxPQUFPLE1BQU0sQ0FBQyxzQkFBc0IsRUFBRTtRQUNwQyxVQUFVLEVBQUU7WUFDVixJQUFJLEVBQUUsT0FBTztZQUNiLEtBQUssRUFBRSxNQUFNLENBQUMsV0FBVyxFQUFFLEVBQUUsR0FBRyxFQUFFLENBQUM7U0FDcEM7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQjtJQUM5QixPQUFPLE1BQU0sQ0FBQyxzQkFBc0IsRUFBRTtRQUNwQyxVQUFVLEVBQUU7WUFDVixJQUFJLEVBQUUsa0JBQWtCO1lBQ3hCLEtBQUssRUFBRSxNQUFNLENBQUMsZUFBZSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDO1NBQ2hEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLE1BQWM7SUFDaEMsT0FBTyxNQUFNLENBQUMsc0JBQXNCLEVBQUU7UUFDcEMsVUFBVSxFQUFFO1lBQ1YsSUFBSSxFQUFFLGFBQWE7WUFDbkIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7U0FDekQ7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentdf/sdk",
-  "version": "0.13.0-beta.126",
+  "version": "0.13.0-beta.128",
   "description": "OpenTDF for the Web",
   "homepage": "https://github.com/opentdf/web-sdk",
   "bugs": {

package/src/index.ts

@@ -19,6 +19,13 @@ export {
   type ExternalJwtTokenProviderOptions,
 } from './auth/token-providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export {
+  forEmail,
+  forClientId,
+  forUserName,
+  forToken,
+  withRequestToken,
+} from './platform/authorization/entity-identifiers.js';
 export {
   listAttributes,
   validateAttributes,

package/src/platform/authorization/entity-identifiers.ts

@@ -0,0 +1,102 @@
+import { create } from '@bufbuild/protobuf';
+import { BoolValueSchema } from '@bufbuild/protobuf/wkt';
+import {
+  type EntityIdentifier,
+  EntityIdentifierSchema,
+} from './v2/authorization_pb.js';
+import {
+  type Entity,
+  Entity_Category,
+  EntityChainSchema,
+  EntitySchema,
+  TokenSchema,
+} from '../entity/entity_pb.js';
+
+/**
+ * Convenience constructors for {@link EntityIdentifier}, mirroring the Go SDK
+ * helpers (`ForEmail`, `ForClientID`, etc.).
+ *
+ * Each function builds a complete `EntityIdentifier` so callers avoid deeply
+ * nested object literals.
+ *
+ * @example
+ * ```ts
+ * // Before
+ * const eid = create(EntityIdentifierSchema, {
+ *   identifier: {
+ *     case: 'entityChain',
+ *     value: create(EntityChainSchema, {
+ *       entities: [create(EntitySchema, {
+ *         entityType: { case: 'emailAddress', value: 'jen@example.com' },
+ *         category: Entity_Category.SUBJECT,
+ *       })],
+ *     }),
+ *   },
+ * });
+ *
+ * // After
+ * const eid = forEmail('jen@example.com');
+ * ```
+ */
+
+/** Returns an EntityIdentifier for a subject identified by email address. */
+export function forEmail(email: string): EntityIdentifier {
+  return fromEntity(
+    create(EntitySchema, {
+      entityType: { case: 'emailAddress', value: email },
+      category: Entity_Category.SUBJECT,
+    })
+  );
+}
+
+/** Returns an EntityIdentifier for a subject identified by client ID. */
+export function forClientId(clientId: string): EntityIdentifier {
+  return fromEntity(
+    create(EntitySchema, {
+      entityType: { case: 'clientId', value: clientId },
+      category: Entity_Category.SUBJECT,
+    })
+  );
+}
+
+/** Returns an EntityIdentifier for a subject identified by username. */
+export function forUserName(userName: string): EntityIdentifier {
+  return fromEntity(
+    create(EntitySchema, {
+      entityType: { case: 'userName', value: userName },
+      category: Entity_Category.SUBJECT,
+    })
+  );
+}
+
+/** Returns an EntityIdentifier that resolves the entity from the given JWT. */
+export function forToken(jwt: string): EntityIdentifier {
+  return create(EntityIdentifierSchema, {
+    identifier: {
+      case: 'token',
+      value: create(TokenSchema, { jwt }),
+    },
+  });
+}
+
+/**
+ * Returns an EntityIdentifier that instructs the authorization service to
+ * derive the entity from the request's Authorization header token.
+ */
+export function withRequestToken(): EntityIdentifier {
+  return create(EntityIdentifierSchema, {
+    identifier: {
+      case: 'withRequestToken',
+      value: create(BoolValueSchema, { value: true }),
+    },
+  });
+}
+
+function fromEntity(entity: Entity): EntityIdentifier {
+  return create(EntityIdentifierSchema, {
+    identifier: {
+      case: 'entityChain',
+      value: create(EntityChainSchema, { entities: [entity] }),
+    },
+  });
+}