@opentdf/sdk 0.9.0-beta.85 → 0.9.0-beta.87

package/dist/cjs/src/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnsupportedFeatureError = exports.PermissionDeniedError = exports.UnauthenticatedError = exports.ServiceError = exports.NetworkError = exports.UnsafeUrlError = exports.IntegrityError = exports.DecryptError = exports.InvalidFileError = exports.AttributeValidationError = exports.ConfigurationError = exports.TdfError = void 0;
+exports.AttributeNotFoundError = exports.UnsupportedFeatureError = exports.PermissionDeniedError = exports.UnauthenticatedError = exports.ServiceError = exports.NetworkError = exports.UnsafeUrlError = exports.IntegrityError = exports.DecryptError = exports.InvalidFileError = exports.AttributeValidationError = exports.ConfigurationError = exports.TdfError = void 0;
 function scrubCause(error, d) {
     if (!error || (d && d > 4)) {
         return {};
@@ -138,4 +138,16 @@ class UnsupportedFeatureError extends TdfError {
     }
 }
 exports.UnsupportedFeatureError = UnsupportedFeatureError;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxTQUFTLFVBQVUsQ0FBQyxLQUFhLEVBQUUsQ0FBVTtJQUMzQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEtBQWMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2xCLEtBQUssQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEIsS0FBSyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQzVCLENBQUM7SUFDRCxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDbkIsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQWEsUUFBUyxTQUFRLEtBQUs7SUFHakMsWUFBWSxPQUFnQixFQUFFLEtBQWE7UUFDekMsS0FBSyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUgzQixTQUFJLEdBQUcsVUFBVSxDQUFDO1FBSXpCLDRFQUE0RTtRQUM1RSw2SUFBNkk7UUFDN0kseUdBQXlHO1FBQ3pHLE1BQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDcEQsQ0FBQztDQUNGO0FBVkQsNEJBVUM7QUFFRDs7R0FFRztBQUNILE1BQWEsa0JBQW1CLFNBQVEsUUFBUTtJQUFoRDs7UUFDVyxTQUFJLEdBQUcsb0JBQW9CLENBQUM7SUFDdkMsQ0FBQztDQUFBO0FBRkQsZ0RBRUM7QUFFRDs7R0FFRztBQUNILE1BQWEsd0JBQXlCLFNBQVEsa0JBQWtCO0lBRzlELFlBQVksT0FBZSxFQUFFLFNBQWtCLEVBQUUsS0FBYTtRQUM1RCxLQUFLLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBSGYsU0FBSSxHQUFHLDBCQUEwQixDQUFDO1FBSXpDLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQVBELDREQU9DO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLGdCQUFpQixTQUFRLFFBQVE7Q0FBRztBQUFqRCw0Q0FBaUQ7QUFFakQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxnQkFBZ0I7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFGRCxvQ0FFQztBQUVELE1BQWEsY0FBZSxTQUFRLGdCQUFnQjtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDbkMsQ0FBQztDQUFBO0FBRkQsd0NBRUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFhLGNBQWUsU0FBUSxnQkFBZ0I7SUFJbEQsWUFBWSxPQUFlLEVBQUUsR0FBRyxHQUFhO1FBQzNDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUpSLFNBQUksR0FBRyxnQkFBZ0IsQ0FBQztRQUsvQixNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQVRELHdDQVNDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxRQUFRO0lBQTFDOztRQUNXLFNBQUksR0FBRyxjQUFjLENBQUM7SUFDakMsQ0FBQztDQUFBO0FBRkQsb0NBRUM7QUFFRDs7R0FFRztBQUNILE1BQWEsWUFBYSxTQUFRLFFBQVE7SUFBMUM7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFGRCxvQ0FFQztBQUVELG1DQUFtQztBQUNuQyxNQUFhLG9CQUFxQixTQUFRLFFBQVE7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLHNCQUFzQixDQUFDO0lBQ3pDLENBQUM7Q0FBQTtBQUZELG9EQUVDO0FBRUQsa0NBQWtDO0FBQ2xDLE1BQWEscUJBQXNCLFNBQVEsUUFBUTtJQUlqRCxZQUFZLE9BQWUsRUFBRSxXQUFzQixFQUFFLEtBQWE7UUFDaEUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUpmLFNBQUksR0FBRyx1QkFBdUIsQ0FBQztRQUt0QyxJQUFJLFdBQVcsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxXQUFXLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7Q0FDRjtBQVZELHNEQVVDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHVCQUF3QixTQUFRLFFBQVE7SUFBckQ7O1FBQ1csU0FBSSxHQUFHLHlCQUF5QixDQUFDO0lBQzVDLENBQUM7Q0FBQTtBQUZELDBEQUVDIn0=
+/**
+ * One or more attribute value FQNs were not found on the platform.
+ * Thrown by {@link validateAttributes} and {@link validateAttributeValue} when the platform
+ * does not recognize the requested FQNs.
+ */
+class AttributeNotFoundError extends TdfError {
+    constructor() {
+        super(...arguments);
+        this.name = 'AttributeNotFoundError';
+    }
+}
+exports.AttributeNotFoundError = AttributeNotFoundError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxTQUFTLFVBQVUsQ0FBQyxLQUFhLEVBQUUsQ0FBVTtJQUMzQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEtBQWMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2xCLEtBQUssQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEIsS0FBSyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQzVCLENBQUM7SUFDRCxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDbkIsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQWEsUUFBUyxTQUFRLEtBQUs7SUFHakMsWUFBWSxPQUFnQixFQUFFLEtBQWE7UUFDekMsS0FBSyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUgzQixTQUFJLEdBQUcsVUFBVSxDQUFDO1FBSXpCLDRFQUE0RTtRQUM1RSw2SUFBNkk7UUFDN0kseUdBQXlHO1FBQ3pHLE1BQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDcEQsQ0FBQztDQUNGO0FBVkQsNEJBVUM7QUFFRDs7R0FFRztBQUNILE1BQWEsa0JBQW1CLFNBQVEsUUFBUTtJQUFoRDs7UUFDVyxTQUFJLEdBQUcsb0JBQW9CLENBQUM7SUFDdkMsQ0FBQztDQUFBO0FBRkQsZ0RBRUM7QUFFRDs7R0FFRztBQUNILE1BQWEsd0JBQXlCLFNBQVEsa0JBQWtCO0lBRzlELFlBQVksT0FBZSxFQUFFLFNBQWtCLEVBQUUsS0FBYTtRQUM1RCxLQUFLLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBSGYsU0FBSSxHQUFHLDBCQUEwQixDQUFDO1FBSXpDLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQVBELDREQU9DO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLGdCQUFpQixTQUFRLFFBQVE7Q0FBRztBQUFqRCw0Q0FBaUQ7QUFFakQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxnQkFBZ0I7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFGRCxvQ0FFQztBQUVELE1BQWEsY0FBZSxTQUFRLGdCQUFnQjtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDbkMsQ0FBQztDQUFBO0FBRkQsd0NBRUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFhLGNBQWUsU0FBUSxnQkFBZ0I7SUFJbEQsWUFBWSxPQUFlLEVBQUUsR0FBRyxHQUFhO1FBQzNDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUpSLFNBQUksR0FBRyxnQkFBZ0IsQ0FBQztRQUsvQixNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQVRELHdDQVNDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxRQUFRO0lBQTFDOztRQUNXLFNBQUksR0FBRyxjQUFjLENBQUM7SUFDakMsQ0FBQztDQUFBO0FBRkQsb0NBRUM7QUFFRDs7R0FFRztBQUNILE1BQWEsWUFBYSxTQUFRLFFBQVE7SUFBMUM7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFGRCxvQ0FFQztBQUVELG1DQUFtQztBQUNuQyxNQUFhLG9CQUFxQixTQUFRLFFBQVE7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLHNCQUFzQixDQUFDO0lBQ3pDLENBQUM7Q0FBQTtBQUZELG9EQUVDO0FBRUQsa0NBQWtDO0FBQ2xDLE1BQWEscUJBQXNCLFNBQVEsUUFBUTtJQUlqRCxZQUFZLE9BQWUsRUFBRSxXQUFzQixFQUFFLEtBQWE7UUFDaEUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUpmLFNBQUksR0FBRyx1QkFBdUIsQ0FBQztRQUt0QyxJQUFJLFdBQVcsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxXQUFXLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7Q0FDRjtBQVZELHNEQVVDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHVCQUF3QixTQUFRLFFBQVE7SUFBckQ7O1FBQ1csU0FBSSxHQUFHLHlCQUF5QixDQUFDO0lBQzVDLENBQUM7Q0FBQTtBQUZELDBEQUVDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQWEsc0JBQXVCLFNBQVEsUUFBUTtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsd0JBQXdCLENBQUM7SUFDM0MsQ0FBQztDQUFBO0FBRkQsd0RBRUMifQ==

package/dist/cjs/src/index.js

@@ -36,13 +36,18 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigurationError = exports.AttributeValidationError = exports.NetworkError = exports.DecryptError = exports.InvalidFileError = exports.IntegrityError = exports.PermissionDeniedError = exports.TdfError = exports.PlatformClient = exports.tdfSpecVersion = exports.clientType = exports.version = exports.attributeFQNsAsValues = exports.AuthProviders = exports.withHeaders = exports.HttpRequest = void 0;
+exports.ConfigurationError = exports.AttributeNotFoundError = exports.AttributeValidationError = exports.NetworkError = exports.DecryptError = exports.InvalidFileError = exports.IntegrityError = exports.PermissionDeniedError = exports.TdfError = exports.PlatformClient = exports.tdfSpecVersion = exports.clientType = exports.version = exports.attributeValueExists = exports.attributeExists = exports.validateAttributes = exports.listAttributes = exports.attributeFQNsAsValues = exports.AuthProviders = exports.withHeaders = exports.HttpRequest = void 0;
 var auth_js_1 = require("./auth/auth.js");
 Object.defineProperty(exports, "HttpRequest", { enumerable: true, get: function () { return auth_js_1.HttpRequest; } });
 Object.defineProperty(exports, "withHeaders", { enumerable: true, get: function () { return auth_js_1.withHeaders; } });
 exports.AuthProviders = __importStar(require("./auth/providers.js"));
 var api_js_1 = require("./policy/api.js");
 Object.defineProperty(exports, "attributeFQNsAsValues", { enumerable: true, get: function () { return api_js_1.attributeFQNsAsValues; } });
+var discovery_js_1 = require("./policy/discovery.js");
+Object.defineProperty(exports, "listAttributes", { enumerable: true, get: function () { return discovery_js_1.listAttributes; } });
+Object.defineProperty(exports, "validateAttributes", { enumerable: true, get: function () { return discovery_js_1.validateAttributes; } });
+Object.defineProperty(exports, "attributeExists", { enumerable: true, get: function () { return discovery_js_1.attributeExists; } });
+Object.defineProperty(exports, "attributeValueExists", { enumerable: true, get: function () { return discovery_js_1.attributeValueExists; } });
 var version_js_1 = require("./version.js");
 Object.defineProperty(exports, "version", { enumerable: true, get: function () { return version_js_1.version; } });
 Object.defineProperty(exports, "clientType", { enumerable: true, get: function () { return version_js_1.clientType; } });
@@ -58,7 +63,8 @@ Object.defineProperty(exports, "InvalidFileError", { enumerable: true, get: func
 Object.defineProperty(exports, "DecryptError", { enumerable: true, get: function () { return errors_js_1.DecryptError; } });
 Object.defineProperty(exports, "NetworkError", { enumerable: true, get: function () { return errors_js_1.NetworkError; } });
 Object.defineProperty(exports, "AttributeValidationError", { enumerable: true, get: function () { return errors_js_1.AttributeValidationError; } });
+Object.defineProperty(exports, "AttributeNotFoundError", { enumerable: true, get: function () { return errors_js_1.AttributeNotFoundError; } });
 Object.defineProperty(exports, "ConfigurationError", { enumerable: true, get: function () { return errors_js_1.ConfigurationError; } });
 __exportStar(require("./seekable.js"), exports);
 __exportStar(require("../tdf3/src/models/index.js"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMENBQThGO0FBQWpELHNHQUFBLFdBQVcsT0FBQTtBQUFFLHNHQUFBLFdBQVcsT0FBQTtBQUNyRSxxRUFBcUQ7QUFDckQsMENBQXdEO0FBQS9DLCtHQUFBLHFCQUFxQixPQUFBO0FBQzlCLDJDQUFtRTtBQUExRCxxR0FBQSxPQUFPLE9BQUE7QUFBRSx3R0FBQSxVQUFVLE9BQUE7QUFBRSw0R0FBQSxjQUFjLE9BQUE7QUFDNUMsNkNBQWtHO0FBQXpGLDZHQUFBLGNBQWMsT0FBQTtBQUN2QiwrQ0FBNkI7QUFDN0IseUNBU3FCO0FBUm5CLHFHQUFBLFFBQVEsT0FBQTtBQUNSLGtIQUFBLHFCQUFxQixPQUFBO0FBQ3JCLDJHQUFBLGNBQWMsT0FBQTtBQUNkLDZHQUFBLGdCQUFnQixPQUFBO0FBQ2hCLHlHQUFBLFlBQVksT0FBQTtBQUNaLHlHQUFBLFlBQVksT0FBQTtBQUNaLHFIQUFBLHdCQUF3QixPQUFBO0FBQ3hCLCtHQUFBLGtCQUFrQixPQUFBO0FBRXBCLGdEQUE4QjtBQUM5Qiw4REFBNEMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMENBQThGO0FBQWpELHNHQUFBLFdBQVcsT0FBQTtBQUFFLHNHQUFBLFdBQVcsT0FBQTtBQUNyRSxxRUFBcUQ7QUFDckQsMENBQXdEO0FBQS9DLCtHQUFBLHFCQUFxQixPQUFBO0FBQzlCLHNEQUsrQjtBQUo3Qiw4R0FBQSxjQUFjLE9BQUE7QUFDZCxrSEFBQSxrQkFBa0IsT0FBQTtBQUNsQiwrR0FBQSxlQUFlLE9BQUE7QUFDZixvSEFBQSxvQkFBb0IsT0FBQTtBQUV0QiwyQ0FBbUU7QUFBMUQscUdBQUEsT0FBTyxPQUFBO0FBQUUsd0dBQUEsVUFBVSxPQUFBO0FBQUUsNEdBQUEsY0FBYyxPQUFBO0FBQzVDLDZDQUFrRztBQUF6Riw2R0FBQSxjQUFjLE9BQUE7QUFDdkIsK0NBQTZCO0FBQzdCLHlDQVVxQjtBQVRuQixxR0FBQSxRQUFRLE9BQUE7QUFDUixrSEFBQSxxQkFBcUIsT0FBQTtBQUNyQiwyR0FBQSxjQUFjLE9BQUE7QUFDZCw2R0FBQSxnQkFBZ0IsT0FBQTtBQUNoQix5R0FBQSxZQUFZLE9BQUE7QUFDWix5R0FBQSxZQUFZLE9BQUE7QUFDWixxSEFBQSx3QkFBd0IsT0FBQTtBQUN4QixtSEFBQSxzQkFBc0IsT0FBQTtBQUN0QiwrR0FBQSxrQkFBa0IsT0FBQTtBQUVwQixnREFBOEI7QUFDOUIsOERBQTRDIn0=

package/dist/cjs/src/policy/discovery.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAttributes = listAttributes;
+exports.validateAttributes = validateAttributes;
+exports.attributeExists = attributeExists;
+exports.attributeValueExists = attributeValueExists;
+const connect_1 = require("@connectrpc/connect");
+const errors_js_1 = require("../errors.js");
+const utils_js_1 = require("../utils.js");
+const platform_js_1 = require("../platform.js");
+// Caps the pagination loop in listAttributes. 10 pages × 1000 records = 10,000
+// attributes maximum, which is generous for browser use while preventing runaway
+// memory growth if a server repeatedly returns a non-zero next_offset.
+const MAX_LIST_ATTRIBUTES_PAGES = 10;
+// Number of attributes to request per page. Matches the platform's default
+// (ListRequestLimitDefault = 1000) so behavior is stable regardless of server config.
+const LIST_ATTRIBUTES_PAGE_SIZE = 1000;
+// Matches the server-side proto constraint: GetAttributeValuesByFqnsRequest has
+// max_items: 250 on the fqns field, so the client rejects oversized requests
+// locally instead of receiving a cryptic server validation error.
+const MAX_VALIDATE_FQNS = 250;
+// Attribute value FQN format: https://<namespace>/attr/<name>/value/<value>
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_VALUE_FQN_RE = /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+\/value\/[a-zA-Z0-9._~%-]+$/i;
+// Attribute-level FQN format: https://<namespace>/attr/<name>  (no /value/ segment)
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_FQN_RE = /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+$/i;
+/**
+ * Returns all active attributes available on the platform, auto-paginating through all results.
+ * An optional namespace name or ID may be provided to filter results.
+ *
+ * Use this before calling `createZTDF()` to see what attributes are available for data tagging.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param namespace Optional namespace name or ID to filter results.
+ * @returns All active {@link Attribute} objects on the platform.
+ *
+ * @example
+ * ```ts
+ * const attrs = await listAttributes(platformUrl, authProvider);
+ * for (const a of attrs) {
+ *   console.log(a.fqn);
+ * }
+ * ```
+ */
+async function listAttributes(platformUrl, authProvider, namespace) {
+    if (!(0, utils_js_1.validateSecureUrl)(platformUrl)) {
+        throw new errors_js_1.ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    const platform = new platform_js_1.PlatformClient({ authProvider, platformUrl });
+    const result = [];
+    let nextOffset = 0;
+    for (let pages = 0; pages < MAX_LIST_ATTRIBUTES_PAGES; pages++) {
+        let resp;
+        try {
+            resp = await platform.v1.attributes.listAttributes({
+                namespace: namespace ?? '',
+                pagination: { offset: nextOffset, limit: LIST_ATTRIBUTES_PAGE_SIZE },
+            });
+        }
+        catch (e) {
+            throw new errors_js_1.NetworkError(`[ListAttributes] ${(0, utils_js_1.extractRpcErrorMessage)(e)}`);
+        }
+        result.push(...resp.attributes);
+        nextOffset = resp.pagination?.nextOffset ?? 0;
+        if (nextOffset === 0) {
+            return result;
+        }
+    }
+    throw new errors_js_1.ConfigurationError(`listAttributes returned more than ${MAX_LIST_ATTRIBUTES_PAGES * LIST_ATTRIBUTES_PAGE_SIZE} attributes. Use the namespace parameter to narrow results.`);
+}
+/**
+ * Checks that all provided attribute value FQNs exist on the platform.
+ * Validates FQN format first, then verifies existence via the platform API.
+ *
+ * Use this before `createZTDF()` to catch missing or misspelled attributes early
+ * instead of discovering the problem at decryption time.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param fqns Attribute value FQNs to validate, in the form
+ *   `https://<namespace>/attr/<name>/value/<value>`.
+ * @throws {@link AttributeNotFoundError} if any FQNs are not found on the platform.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or there are too many FQNs.
+ *
+ * @example
+ * ```ts
+ * await validateAttributes(platformUrl, authProvider, [
+ *   'https://opentdf.io/attr/department/value/marketing',
+ * ]);
+ * // Safe to encrypt — all attributes confirmed present
+ * ```
+ */
+async function validateAttributes(platformUrl, authProvider, fqns) {
+    if (!fqns || fqns.length === 0) {
+        return;
+    }
+    if (!(0, utils_js_1.validateSecureUrl)(platformUrl)) {
+        throw new errors_js_1.ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (fqns.length > MAX_VALIDATE_FQNS) {
+        throw new errors_js_1.ConfigurationError(`too many attribute FQNs: ${fqns.length} exceeds maximum of ${MAX_VALIDATE_FQNS}`);
+    }
+    for (const fqn of fqns) {
+        if (!ATTRIBUTE_VALUE_FQN_RE.test(fqn)) {
+            throw new errors_js_1.ConfigurationError('invalid attribute value FQN format');
+        }
+    }
+    const platform = new platform_js_1.PlatformClient({ authProvider, platformUrl });
+    let resp;
+    try {
+        resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns });
+    }
+    catch (e) {
+        throw new errors_js_1.NetworkError(`[GetAttributeValuesByFqns] ${(0, utils_js_1.extractRpcErrorMessage)(e)}`);
+    }
+    const found = resp.fqnAttributeValues;
+    const missing = fqns.filter((fqn) => !(fqn in found));
+    if (missing.length > 0) {
+        throw new errors_js_1.AttributeNotFoundError(`attribute not found: ${missing.length} FQN(s) missing`);
+    }
+}
+/**
+ * Reports whether the attribute definition identified by `attributeFqn` exists on the platform.
+ *
+ * `attributeFqn` should be an attribute-level FQN (no `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param attributeFqn The attribute-level FQN to check.
+ * @returns `true` if the attribute exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a non-not-found service error occurs.
+ */
+async function attributeExists(platformUrl, authProvider, attributeFqn) {
+    if (!(0, utils_js_1.validateSecureUrl)(platformUrl)) {
+        throw new errors_js_1.ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (!ATTRIBUTE_FQN_RE.test(attributeFqn)) {
+        throw new errors_js_1.ConfigurationError('invalid attribute FQN format');
+    }
+    const platform = new platform_js_1.PlatformClient({ authProvider, platformUrl });
+    try {
+        await platform.v1.attributes.getAttribute({
+            identifier: { case: 'fqn', value: attributeFqn },
+        });
+        return true;
+    }
+    catch (e) {
+        if (e instanceof connect_1.ConnectError && e.code === connect_1.Code.NotFound) {
+            return false;
+        }
+        throw new errors_js_1.NetworkError(`[GetAttribute] ${(0, utils_js_1.extractRpcErrorMessage)(e)}`);
+    }
+}
+/**
+ * Reports whether the attribute value FQN exists on the platform.
+ *
+ * `valueFqn` should be a full attribute value FQN (with `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>/value/<value>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param valueFqn The attribute value FQN to check.
+ * @returns `true` if the value exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a service error occurs.
+ */
+async function attributeValueExists(platformUrl, authProvider, valueFqn) {
+    if (!(0, utils_js_1.validateSecureUrl)(platformUrl)) {
+        throw new errors_js_1.ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (!ATTRIBUTE_VALUE_FQN_RE.test(valueFqn)) {
+        throw new errors_js_1.ConfigurationError('invalid attribute value FQN format');
+    }
+    const platform = new platform_js_1.PlatformClient({ authProvider, platformUrl });
+    let resp;
+    try {
+        resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns: [valueFqn] });
+    }
+    catch (e) {
+        throw new errors_js_1.NetworkError(`[GetAttributeValuesByFqns] ${(0, utils_js_1.extractRpcErrorMessage)(e)}`);
+    }
+    return valueFqn in resp.fqnAttributeValues;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzY292ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3BvbGljeS9kaXNjb3ZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFpREEsd0NBaUNDO0FBd0JELGdEQXNDQztBQWVELDBDQXlCQztBQWVELG9EQXNCQztBQTdORCxpREFBeUQ7QUFDekQsNENBQXdGO0FBRXhGLDBDQUF3RTtBQUN4RSxnREFBZ0Q7QUFHaEQsK0VBQStFO0FBQy9FLGlGQUFpRjtBQUNqRix1RUFBdUU7QUFDdkUsTUFBTSx5QkFBeUIsR0FBRyxFQUFFLENBQUM7QUFFckMsMkVBQTJFO0FBQzNFLHNGQUFzRjtBQUN0RixNQUFNLHlCQUF5QixHQUFHLElBQUksQ0FBQztBQUV2QyxnRkFBZ0Y7QUFDaEYsNkVBQTZFO0FBQzdFLGtFQUFrRTtBQUNsRSxNQUFNLGlCQUFpQixHQUFHLEdBQUcsQ0FBQztBQUU5Qiw0RUFBNEU7QUFDNUUsNkVBQTZFO0FBQzdFLE1BQU0sc0JBQXNCLEdBQzFCLG9GQUFvRixDQUFDO0FBRXZGLG9GQUFvRjtBQUNwRiw2RUFBNkU7QUFDN0UsTUFBTSxnQkFBZ0IsR0FBRywwREFBMEQsQ0FBQztBQUVwRjs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBQ0ksS0FBSyxVQUFVLGNBQWMsQ0FDbEMsV0FBbUIsRUFDbkIsWUFBMEIsRUFDMUIsU0FBa0I7SUFFbEIsSUFBSSxDQUFDLElBQUEsNEJBQWlCLEVBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksOEJBQWtCLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsSUFBSSw0QkFBYyxDQUFDLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDbkUsTUFBTSxNQUFNLEdBQWdCLEVBQUUsQ0FBQztJQUMvQixJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7SUFFbkIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLHlCQUF5QixFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDL0QsSUFBSSxJQUFJLENBQUM7UUFDVCxJQUFJLENBQUM7WUFDSCxJQUFJLEdBQUcsTUFBTSxRQUFRLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7Z0JBQ2pELFNBQVMsRUFBRSxTQUFTLElBQUksRUFBRTtnQkFDMUIsVUFBVSxFQUFFLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUseUJBQXlCLEVBQUU7YUFDckUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksd0JBQVksQ0FBQyxvQkFBb0IsSUFBQSxpQ0FBc0IsRUFBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUVELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEMsVUFBVSxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLENBQUMsQ0FBQztRQUM5QyxJQUFJLFVBQVUsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNyQixPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sSUFBSSw4QkFBa0IsQ0FDMUIscUNBQXFDLHlCQUF5QixHQUFHLHlCQUF5Qiw2REFBNkQsQ0FDeEosQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBcUJHO0FBQ0ksS0FBSyxVQUFVLGtCQUFrQixDQUN0QyxXQUFtQixFQUNuQixZQUEwQixFQUMxQixJQUFjO0lBRWQsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQy9CLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDLElBQUEsNEJBQWlCLEVBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksOEJBQWtCLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLDhCQUFrQixDQUMxQiw0QkFBNEIsSUFBSSxDQUFDLE1BQU0sdUJBQXVCLGlCQUFpQixFQUFFLENBQ2xGLENBQUM7SUFDSixDQUFDO0lBRUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN2QixJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEMsTUFBTSxJQUFJLDhCQUFrQixDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDckUsQ0FBQztJQUNILENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLDRCQUFjLENBQUMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUNuRSxJQUFJLElBQUksQ0FBQztJQUNULElBQUksQ0FBQztRQUNILElBQUksR0FBRyxNQUFNLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLHdCQUF3QixDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBSSx3QkFBWSxDQUFDLDhCQUE4QixJQUFBLGlDQUFzQixFQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDO0lBQ3RDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN0RCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLGtDQUFzQixDQUFDLHdCQUF3QixPQUFPLENBQUMsTUFBTSxpQkFBaUIsQ0FBQyxDQUFDO0lBQzVGLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0ksS0FBSyxVQUFVLGVBQWUsQ0FDbkMsV0FBbUIsRUFDbkIsWUFBMEIsRUFDMUIsWUFBb0I7SUFFcEIsSUFBSSxDQUFDLElBQUEsNEJBQWlCLEVBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksOEJBQWtCLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sSUFBSSw4QkFBa0IsQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLDRCQUFjLENBQUMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUNuRSxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztZQUN4QyxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUU7U0FDakQsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLElBQUksQ0FBQyxZQUFZLHNCQUFZLElBQUksQ0FBQyxDQUFDLElBQUksS0FBSyxjQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDMUQsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsTUFBTSxJQUFJLHdCQUFZLENBQUMsa0JBQWtCLElBQUEsaUNBQXNCLEVBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0ksS0FBSyxVQUFVLG9CQUFvQixDQUN4QyxXQUFtQixFQUNuQixZQUEwQixFQUMxQixRQUFnQjtJQUVoQixJQUFJLENBQUMsSUFBQSw0QkFBaUIsRUFBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sSUFBSSw4QkFBa0IsQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFRCxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDM0MsTUFBTSxJQUFJLDhCQUFrQixDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLElBQUksNEJBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLElBQUksSUFBSSxDQUFDO0lBQ1QsSUFBSSxDQUFDO1FBQ0gsSUFBSSxHQUFHLE1BQU0sUUFBUSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsd0JBQXdCLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksd0JBQVksQ0FBQyw4QkFBOEIsSUFBQSxpQ0FBc0IsRUFBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUVELE9BQU8sUUFBUSxJQUFJLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztBQUM3QyxDQUFDIn0=

package/dist/types/src/errors.d.ts

@@ -71,4 +71,12 @@ export declare class PermissionDeniedError extends TdfError {
 export declare class UnsupportedFeatureError extends TdfError {
     name: string;
 }
+/**
+ * One or more attribute value FQNs were not found on the platform.
+ * Thrown by {@link validateAttributes} and {@link validateAttributeValue} when the platform
+ * does not recognize the requested FQNs.
+ */
+export declare class AttributeNotFoundError extends TdfError {
+    name: string;
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/types/src/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/errors.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACxB,IAAI,SAAc;gBAEf,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAO5C;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,SAAwB;CACtC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IACrD,IAAI,SAA8B;IAC3C,SAAS,EAAE,OAAO,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK;CAI/D;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD;;GAEG;AACH,qBAAa,YAAa,SAAQ,gBAAgB;IACvC,IAAI,SAAkB;CAChC;AAED,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;CAClC;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE;CAK9C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED,mCAAmC;AACnC,qBAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,SAA0B;CACxC;AAED,kCAAkC;AAClC,qBAAa,qBAAsB,SAAQ,QAAQ;IACxC,IAAI,SAA2B;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK;CAMnE;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,SAA6B;CAC3C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/errors.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACxB,IAAI,SAAc;gBAEf,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAO5C;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,SAAwB;CACtC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IACrD,IAAI,SAA8B;IAC3C,SAAS,EAAE,OAAO,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK;CAI/D;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD;;GAEG;AACH,qBAAa,YAAa,SAAQ,gBAAgB;IACvC,IAAI,SAAkB;CAChC;AAED,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;CAClC;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IACzC,IAAI,SAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE;CAK9C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IAC/B,IAAI,SAAkB;CAChC;AAED,mCAAmC;AACnC,qBAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,SAA0B;CACxC;AAED,kCAAkC;AAClC,qBAAa,qBAAsB,SAAQ,QAAQ;IACxC,IAAI,SAA2B;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK;CAMnE;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,SAA6B;CAC3C;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,QAAQ;IACzC,IAAI,SAA4B;CAC1C"}

package/dist/types/src/index.d.ts

@@ -1,10 +1,11 @@
 export { type AuthProvider, type HttpMethod, HttpRequest, withHeaders } from './auth/auth.js';
 export * as AuthProviders from './auth/providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export { listAttributes, validateAttributes, attributeExists, attributeValueExists, } from './policy/discovery.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
 export { PlatformClient, type PlatformClientOptions, type PlatformServices } from './platform.js';
 export * from './opentdf.js';
-export { TdfError, PermissionDeniedError, IntegrityError, InvalidFileError, DecryptError, NetworkError, AttributeValidationError, ConfigurationError, } from './errors.js';
+export { TdfError, PermissionDeniedError, IntegrityError, InvalidFileError, DecryptError, NetworkError, AttributeValidationError, AttributeNotFoundError, ConfigurationError, } from './errors.js';
 export * from './seekable.js';
 export * from '../tdf3/src/models/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClG,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClG,cAAc,cAAc,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC"}

package/dist/types/src/policy/discovery.d.ts

@@ -0,0 +1,74 @@
+import { type AuthProvider } from '../auth/auth.js';
+import type { Attribute } from '../platform/policy/objects_pb.js';
+/**
+ * Returns all active attributes available on the platform, auto-paginating through all results.
+ * An optional namespace name or ID may be provided to filter results.
+ *
+ * Use this before calling `createZTDF()` to see what attributes are available for data tagging.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param namespace Optional namespace name or ID to filter results.
+ * @returns All active {@link Attribute} objects on the platform.
+ *
+ * @example
+ * ```ts
+ * const attrs = await listAttributes(platformUrl, authProvider);
+ * for (const a of attrs) {
+ *   console.log(a.fqn);
+ * }
+ * ```
+ */
+export declare function listAttributes(platformUrl: string, authProvider: AuthProvider, namespace?: string): Promise<Attribute[]>;
+/**
+ * Checks that all provided attribute value FQNs exist on the platform.
+ * Validates FQN format first, then verifies existence via the platform API.
+ *
+ * Use this before `createZTDF()` to catch missing or misspelled attributes early
+ * instead of discovering the problem at decryption time.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param fqns Attribute value FQNs to validate, in the form
+ *   `https://<namespace>/attr/<name>/value/<value>`.
+ * @throws {@link AttributeNotFoundError} if any FQNs are not found on the platform.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or there are too many FQNs.
+ *
+ * @example
+ * ```ts
+ * await validateAttributes(platformUrl, authProvider, [
+ *   'https://opentdf.io/attr/department/value/marketing',
+ * ]);
+ * // Safe to encrypt — all attributes confirmed present
+ * ```
+ */
+export declare function validateAttributes(platformUrl: string, authProvider: AuthProvider, fqns: string[]): Promise<void>;
+/**
+ * Reports whether the attribute definition identified by `attributeFqn` exists on the platform.
+ *
+ * `attributeFqn` should be an attribute-level FQN (no `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param attributeFqn The attribute-level FQN to check.
+ * @returns `true` if the attribute exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a non-not-found service error occurs.
+ */
+export declare function attributeExists(platformUrl: string, authProvider: AuthProvider, attributeFqn: string): Promise<boolean>;
+/**
+ * Reports whether the attribute value FQN exists on the platform.
+ *
+ * `valueFqn` should be a full attribute value FQN (with `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>/value/<value>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param valueFqn The attribute value FQN to check.
+ * @returns `true` if the value exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a service error occurs.
+ */
+export declare function attributeValueExists(platformUrl: string, authProvider: AuthProvider, valueFqn: string): Promise<boolean>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/types/src/policy/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/policy/discovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAyBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,YAAY,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC,CA6BtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/web/src/errors.js

@@ -123,4 +123,15 @@ export class UnsupportedFeatureError extends TdfError {
         this.name = 'UnsupportedFeatureError';
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxTQUFTLFVBQVUsQ0FBQyxLQUFhLEVBQUUsQ0FBVTtJQUMzQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEtBQWMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2xCLEtBQUssQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEIsS0FBSyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQzVCLENBQUM7SUFDRCxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDbkIsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sT0FBTyxRQUFTLFNBQVEsS0FBSztJQUdqQyxZQUFZLE9BQWdCLEVBQUUsS0FBYTtRQUN6QyxLQUFLLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBSDNCLFNBQUksR0FBRyxVQUFVLENBQUM7UUFJekIsNEVBQTRFO1FBQzVFLDZJQUE2STtRQUM3SSx5R0FBeUc7UUFDekcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwRCxDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxrQkFBbUIsU0FBUSxRQUFRO0lBQWhEOztRQUNXLFNBQUksR0FBRyxvQkFBb0IsQ0FBQztJQUN2QyxDQUFDO0NBQUE7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxrQkFBa0I7SUFHOUQsWUFBWSxPQUFlLEVBQUUsU0FBa0IsRUFBRSxLQUFhO1FBQzVELEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFIZixTQUFJLEdBQUcsMEJBQTBCLENBQUM7UUFJekMsSUFBSSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sZ0JBQWlCLFNBQVEsUUFBUTtDQUFHO0FBRWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFlBQWEsU0FBUSxnQkFBZ0I7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFFRCxNQUFNLE9BQU8sY0FBZSxTQUFRLGdCQUFnQjtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDbkMsQ0FBQztDQUFBO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLGNBQWUsU0FBUSxnQkFBZ0I7SUFJbEQsWUFBWSxPQUFlLEVBQUUsR0FBRyxHQUFhO1FBQzNDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUpSLFNBQUksR0FBRyxnQkFBZ0IsQ0FBQztRQUsvQixNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFlBQWEsU0FBUSxRQUFRO0lBQTFDOztRQUNXLFNBQUksR0FBRyxjQUFjLENBQUM7SUFDakMsQ0FBQztDQUFBO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sWUFBYSxTQUFRLFFBQVE7SUFBMUM7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFFRCxtQ0FBbUM7QUFDbkMsTUFBTSxPQUFPLG9CQUFxQixTQUFRLFFBQVE7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLHNCQUFzQixDQUFDO0lBQ3pDLENBQUM7Q0FBQTtBQUVELGtDQUFrQztBQUNsQyxNQUFNLE9BQU8scUJBQXNCLFNBQVEsUUFBUTtJQUlqRCxZQUFZLE9BQWUsRUFBRSxXQUFzQixFQUFFLEtBQWE7UUFDaEUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUpmLFNBQUksR0FBRyx1QkFBdUIsQ0FBQztRQUt0QyxJQUFJLFdBQVcsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxXQUFXLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLHVCQUF3QixTQUFRLFFBQVE7SUFBckQ7O1FBQ1csU0FBSSxHQUFHLHlCQUF5QixDQUFDO0lBQzVDLENBQUM7Q0FBQSJ9
+/**
+ * One or more attribute value FQNs were not found on the platform.
+ * Thrown by {@link validateAttributes} and {@link validateAttributeValue} when the platform
+ * does not recognize the requested FQNs.
+ */
+export class AttributeNotFoundError extends TdfError {
+    constructor() {
+        super(...arguments);
+        this.name = 'AttributeNotFoundError';
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxTQUFTLFVBQVUsQ0FBQyxLQUFhLEVBQUUsQ0FBVTtJQUMzQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEtBQWMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2xCLEtBQUssQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEIsS0FBSyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQzVCLENBQUM7SUFDRCxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDbkIsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sT0FBTyxRQUFTLFNBQVEsS0FBSztJQUdqQyxZQUFZLE9BQWdCLEVBQUUsS0FBYTtRQUN6QyxLQUFLLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBSDNCLFNBQUksR0FBRyxVQUFVLENBQUM7UUFJekIsNEVBQTRFO1FBQzVFLDZJQUE2STtRQUM3SSx5R0FBeUc7UUFDekcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwRCxDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxrQkFBbUIsU0FBUSxRQUFRO0lBQWhEOztRQUNXLFNBQUksR0FBRyxvQkFBb0IsQ0FBQztJQUN2QyxDQUFDO0NBQUE7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxrQkFBa0I7SUFHOUQsWUFBWSxPQUFlLEVBQUUsU0FBa0IsRUFBRSxLQUFhO1FBQzVELEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFIZixTQUFJLEdBQUcsMEJBQTBCLENBQUM7UUFJekMsSUFBSSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sZ0JBQWlCLFNBQVEsUUFBUTtDQUFHO0FBRWpEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFlBQWEsU0FBUSxnQkFBZ0I7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFFRCxNQUFNLE9BQU8sY0FBZSxTQUFRLGdCQUFnQjtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDbkMsQ0FBQztDQUFBO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLGNBQWUsU0FBUSxnQkFBZ0I7SUFJbEQsWUFBWSxPQUFlLEVBQUUsR0FBRyxHQUFhO1FBQzNDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUpSLFNBQUksR0FBRyxnQkFBZ0IsQ0FBQztRQUsvQixNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxHQUFHLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFlBQWEsU0FBUSxRQUFRO0lBQTFDOztRQUNXLFNBQUksR0FBRyxjQUFjLENBQUM7SUFDakMsQ0FBQztDQUFBO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sWUFBYSxTQUFRLFFBQVE7SUFBMUM7O1FBQ1csU0FBSSxHQUFHLGNBQWMsQ0FBQztJQUNqQyxDQUFDO0NBQUE7QUFFRCxtQ0FBbUM7QUFDbkMsTUFBTSxPQUFPLG9CQUFxQixTQUFRLFFBQVE7SUFBbEQ7O1FBQ1csU0FBSSxHQUFHLHNCQUFzQixDQUFDO0lBQ3pDLENBQUM7Q0FBQTtBQUVELGtDQUFrQztBQUNsQyxNQUFNLE9BQU8scUJBQXNCLFNBQVEsUUFBUTtJQUlqRCxZQUFZLE9BQWUsRUFBRSxXQUFzQixFQUFFLEtBQWE7UUFDaEUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUpmLFNBQUksR0FBRyx1QkFBdUIsQ0FBQztRQUt0QyxJQUFJLFdBQVcsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxXQUFXLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7Q0FDRjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLHVCQUF3QixTQUFRLFFBQVE7SUFBckQ7O1FBQ1csU0FBSSxHQUFHLHlCQUF5QixDQUFDO0lBQzVDLENBQUM7Q0FBQTtBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLE9BQU8sc0JBQXVCLFNBQVEsUUFBUTtJQUFwRDs7UUFDVyxTQUFJLEdBQUcsd0JBQXdCLENBQUM7SUFDM0MsQ0FBQztDQUFBIn0=

package/dist/web/src/index.js

@@ -1,10 +1,11 @@
 export { HttpRequest, withHeaders } from './auth/auth.js';
 export * as AuthProviders from './auth/providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export { listAttributes, validateAttributes, attributeExists, attributeValueExists, } from './policy/discovery.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
 export { PlatformClient } from './platform.js';
 export * from './opentdf.js';
-export { TdfError, PermissionDeniedError, IntegrityError, InvalidFileError, DecryptError, NetworkError, AttributeValidationError, ConfigurationError, } from './errors.js';
+export { TdfError, PermissionDeniedError, IntegrityError, InvalidFileError, DecryptError, NetworkError, AttributeValidationError, AttributeNotFoundError, ConfigurationError, } from './errors.js';
 export * from './seekable.js';
 export * from '../tdf3/src/models/index.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFzQyxXQUFXLEVBQUUsV0FBVyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUYsT0FBTyxLQUFLLGFBQWEsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RCxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDbkUsT0FBTyxFQUFFLGNBQWMsRUFBcUQsTUFBTSxlQUFlLENBQUM7QUFDbEcsY0FBYyxjQUFjLENBQUM7QUFDN0IsT0FBTyxFQUNMLFFBQVEsRUFDUixxQkFBcUIsRUFDckIsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixZQUFZLEVBQ1osWUFBWSxFQUNaLHdCQUF3QixFQUN4QixrQkFBa0IsR0FDbkIsTUFBTSxhQUFhLENBQUM7QUFDckIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw2QkFBNkIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFzQyxXQUFXLEVBQUUsV0FBVyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUYsT0FBTyxLQUFLLGFBQWEsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RCxPQUFPLEVBQ0wsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixlQUFlLEVBQ2Ysb0JBQW9CLEdBQ3JCLE1BQU0sdUJBQXVCLENBQUM7QUFDL0IsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ25FLE9BQU8sRUFBRSxjQUFjLEVBQXFELE1BQU0sZUFBZSxDQUFDO0FBQ2xHLGNBQWMsY0FBYyxDQUFDO0FBQzdCLE9BQU8sRUFDTCxRQUFRLEVBQ1IscUJBQXFCLEVBQ3JCLGNBQWMsRUFDZCxnQkFBZ0IsRUFDaEIsWUFBWSxFQUNaLFlBQVksRUFDWix3QkFBd0IsRUFDeEIsc0JBQXNCLEVBQ3RCLGtCQUFrQixHQUNuQixNQUFNLGFBQWEsQ0FBQztBQUNyQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLDZCQUE2QixDQUFDIn0=

package/dist/web/src/policy/discovery.js

@@ -0,0 +1,182 @@
+import { ConnectError, Code } from '@connectrpc/connect';
+import { AttributeNotFoundError, ConfigurationError, NetworkError } from '../errors.js';
+import { extractRpcErrorMessage, validateSecureUrl } from '../utils.js';
+import { PlatformClient } from '../platform.js';
+// Caps the pagination loop in listAttributes. 10 pages × 1000 records = 10,000
+// attributes maximum, which is generous for browser use while preventing runaway
+// memory growth if a server repeatedly returns a non-zero next_offset.
+const MAX_LIST_ATTRIBUTES_PAGES = 10;
+// Number of attributes to request per page. Matches the platform's default
+// (ListRequestLimitDefault = 1000) so behavior is stable regardless of server config.
+const LIST_ATTRIBUTES_PAGE_SIZE = 1000;
+// Matches the server-side proto constraint: GetAttributeValuesByFqnsRequest has
+// max_items: 250 on the fqns field, so the client rejects oversized requests
+// locally instead of receiving a cryptic server validation error.
+const MAX_VALIDATE_FQNS = 250;
+// Attribute value FQN format: https://<namespace>/attr/<name>/value/<value>
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_VALUE_FQN_RE = /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+\/value\/[a-zA-Z0-9._~%-]+$/i;
+// Attribute-level FQN format: https://<namespace>/attr/<name>  (no /value/ segment)
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_FQN_RE = /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+$/i;
+/**
+ * Returns all active attributes available on the platform, auto-paginating through all results.
+ * An optional namespace name or ID may be provided to filter results.
+ *
+ * Use this before calling `createZTDF()` to see what attributes are available for data tagging.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param namespace Optional namespace name or ID to filter results.
+ * @returns All active {@link Attribute} objects on the platform.
+ *
+ * @example
+ * ```ts
+ * const attrs = await listAttributes(platformUrl, authProvider);
+ * for (const a of attrs) {
+ *   console.log(a.fqn);
+ * }
+ * ```
+ */
+export async function listAttributes(platformUrl, authProvider, namespace) {
+    if (!validateSecureUrl(platformUrl)) {
+        throw new ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    const platform = new PlatformClient({ authProvider, platformUrl });
+    const result = [];
+    let nextOffset = 0;
+    for (let pages = 0; pages < MAX_LIST_ATTRIBUTES_PAGES; pages++) {
+        let resp;
+        try {
+            resp = await platform.v1.attributes.listAttributes({
+                namespace: namespace ?? '',
+                pagination: { offset: nextOffset, limit: LIST_ATTRIBUTES_PAGE_SIZE },
+            });
+        }
+        catch (e) {
+            throw new NetworkError(`[ListAttributes] ${extractRpcErrorMessage(e)}`);
+        }
+        result.push(...resp.attributes);
+        nextOffset = resp.pagination?.nextOffset ?? 0;
+        if (nextOffset === 0) {
+            return result;
+        }
+    }
+    throw new ConfigurationError(`listAttributes returned more than ${MAX_LIST_ATTRIBUTES_PAGES * LIST_ATTRIBUTES_PAGE_SIZE} attributes. Use the namespace parameter to narrow results.`);
+}
+/**
+ * Checks that all provided attribute value FQNs exist on the platform.
+ * Validates FQN format first, then verifies existence via the platform API.
+ *
+ * Use this before `createZTDF()` to catch missing or misspelled attributes early
+ * instead of discovering the problem at decryption time.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param fqns Attribute value FQNs to validate, in the form
+ *   `https://<namespace>/attr/<name>/value/<value>`.
+ * @throws {@link AttributeNotFoundError} if any FQNs are not found on the platform.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or there are too many FQNs.
+ *
+ * @example
+ * ```ts
+ * await validateAttributes(platformUrl, authProvider, [
+ *   'https://opentdf.io/attr/department/value/marketing',
+ * ]);
+ * // Safe to encrypt — all attributes confirmed present
+ * ```
+ */
+export async function validateAttributes(platformUrl, authProvider, fqns) {
+    if (!fqns || fqns.length === 0) {
+        return;
+    }
+    if (!validateSecureUrl(platformUrl)) {
+        throw new ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (fqns.length > MAX_VALIDATE_FQNS) {
+        throw new ConfigurationError(`too many attribute FQNs: ${fqns.length} exceeds maximum of ${MAX_VALIDATE_FQNS}`);
+    }
+    for (const fqn of fqns) {
+        if (!ATTRIBUTE_VALUE_FQN_RE.test(fqn)) {
+            throw new ConfigurationError('invalid attribute value FQN format');
+        }
+    }
+    const platform = new PlatformClient({ authProvider, platformUrl });
+    let resp;
+    try {
+        resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns });
+    }
+    catch (e) {
+        throw new NetworkError(`[GetAttributeValuesByFqns] ${extractRpcErrorMessage(e)}`);
+    }
+    const found = resp.fqnAttributeValues;
+    const missing = fqns.filter((fqn) => !(fqn in found));
+    if (missing.length > 0) {
+        throw new AttributeNotFoundError(`attribute not found: ${missing.length} FQN(s) missing`);
+    }
+}
+/**
+ * Reports whether the attribute definition identified by `attributeFqn` exists on the platform.
+ *
+ * `attributeFqn` should be an attribute-level FQN (no `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param attributeFqn The attribute-level FQN to check.
+ * @returns `true` if the attribute exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a non-not-found service error occurs.
+ */
+export async function attributeExists(platformUrl, authProvider, attributeFqn) {
+    if (!validateSecureUrl(platformUrl)) {
+        throw new ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (!ATTRIBUTE_FQN_RE.test(attributeFqn)) {
+        throw new ConfigurationError('invalid attribute FQN format');
+    }
+    const platform = new PlatformClient({ authProvider, platformUrl });
+    try {
+        await platform.v1.attributes.getAttribute({
+            identifier: { case: 'fqn', value: attributeFqn },
+        });
+        return true;
+    }
+    catch (e) {
+        if (e instanceof ConnectError && e.code === Code.NotFound) {
+            return false;
+        }
+        throw new NetworkError(`[GetAttribute] ${extractRpcErrorMessage(e)}`);
+    }
+}
+/**
+ * Reports whether the attribute value FQN exists on the platform.
+ *
+ * `valueFqn` should be a full attribute value FQN (with `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>/value/<value>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param valueFqn The attribute value FQN to check.
+ * @returns `true` if the value exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a service error occurs.
+ */
+export async function attributeValueExists(platformUrl, authProvider, valueFqn) {
+    if (!validateSecureUrl(platformUrl)) {
+        throw new ConfigurationError('platformUrl must use HTTPS protocol');
+    }
+    if (!ATTRIBUTE_VALUE_FQN_RE.test(valueFqn)) {
+        throw new ConfigurationError('invalid attribute value FQN format');
+    }
+    const platform = new PlatformClient({ authProvider, platformUrl });
+    let resp;
+    try {
+        resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns: [valueFqn] });
+    }
+    catch (e) {
+        throw new NetworkError(`[GetAttributeValuesByFqns] ${extractRpcErrorMessage(e)}`);
+    }
+    return valueFqn in resp.fqnAttributeValues;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzY292ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3BvbGljeS9kaXNjb3ZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsa0JBQWtCLEVBQUUsWUFBWSxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRXhGLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUN4RSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFHaEQsK0VBQStFO0FBQy9FLGlGQUFpRjtBQUNqRix1RUFBdUU7QUFDdkUsTUFBTSx5QkFBeUIsR0FBRyxFQUFFLENBQUM7QUFFckMsMkVBQTJFO0FBQzNFLHNGQUFzRjtBQUN0RixNQUFNLHlCQUF5QixHQUFHLElBQUksQ0FBQztBQUV2QyxnRkFBZ0Y7QUFDaEYsNkVBQTZFO0FBQzdFLGtFQUFrRTtBQUNsRSxNQUFNLGlCQUFpQixHQUFHLEdBQUcsQ0FBQztBQUU5Qiw0RUFBNEU7QUFDNUUsNkVBQTZFO0FBQzdFLE1BQU0sc0JBQXNCLEdBQzFCLG9GQUFvRixDQUFDO0FBRXZGLG9GQUFvRjtBQUNwRiw2RUFBNkU7QUFDN0UsTUFBTSxnQkFBZ0IsR0FBRywwREFBMEQsQ0FBQztBQUVwRjs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxjQUFjLENBQ2xDLFdBQW1CLEVBQ25CLFlBQTBCLEVBQzFCLFNBQWtCO0lBRWxCLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sTUFBTSxHQUFnQixFQUFFLENBQUM7SUFDL0IsSUFBSSxVQUFVLEdBQUcsQ0FBQyxDQUFDO0lBRW5CLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQy9ELElBQUksSUFBSSxDQUFDO1FBQ1QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxHQUFHLE1BQU0sUUFBUSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDO2dCQUNqRCxTQUFTLEVBQUUsU0FBUyxJQUFJLEVBQUU7Z0JBQzFCLFVBQVUsRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLHlCQUF5QixFQUFFO2FBQ3JFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLFlBQVksQ0FBQyxvQkFBb0Isc0JBQXNCLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2hDLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxDQUFDLENBQUM7UUFDOUMsSUFBSSxVQUFVLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckIsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztJQUNILENBQUM7SUFFRCxNQUFNLElBQUksa0JBQWtCLENBQzFCLHFDQUFxQyx5QkFBeUIsR0FBRyx5QkFBeUIsNkRBQTZELENBQ3hKLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXFCRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsa0JBQWtCLENBQ3RDLFdBQW1CLEVBQ25CLFlBQTBCLEVBQzFCLElBQWM7SUFFZCxJQUFJLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsT0FBTztJQUNULENBQUM7SUFFRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksa0JBQWtCLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLGlCQUFpQixFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLGtCQUFrQixDQUMxQiw0QkFBNEIsSUFBSSxDQUFDLE1BQU0sdUJBQXVCLGlCQUFpQixFQUFFLENBQ2xGLENBQUM7SUFDSixDQUFDO0lBRUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN2QixJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDckUsQ0FBQztJQUNILENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLElBQUksSUFBSSxDQUFDO0lBQ1QsSUFBSSxDQUFDO1FBQ0gsSUFBSSxHQUFHLE1BQU0sUUFBUSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsd0JBQXdCLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsTUFBTSxJQUFJLFlBQVksQ0FBQyw4QkFBOEIsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUM7SUFDdEMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3RELElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksc0JBQXNCLENBQUMsd0JBQXdCLE9BQU8sQ0FBQyxNQUFNLGlCQUFpQixDQUFDLENBQUM7SUFDNUYsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGVBQWUsQ0FDbkMsV0FBbUIsRUFDbkIsWUFBMEIsRUFDMUIsWUFBb0I7SUFFcEIsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLHFDQUFxQyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUN6QyxNQUFNLElBQUksa0JBQWtCLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsSUFBSSxjQUFjLENBQUMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUNuRSxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztZQUN4QyxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUU7U0FDakQsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLElBQUksQ0FBQyxZQUFZLFlBQVksSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMxRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxNQUFNLElBQUksWUFBWSxDQUFDLGtCQUFrQixzQkFBc0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEUsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLG9CQUFvQixDQUN4QyxXQUFtQixFQUNuQixZQUEwQixFQUMxQixRQUFnQjtJQUVoQixJQUFJLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksa0JBQWtCLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsSUFBSSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLElBQUksSUFBSSxDQUFDO0lBQ1QsSUFBSSxDQUFDO1FBQ0gsSUFBSSxHQUFHLE1BQU0sUUFBUSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsd0JBQXdCLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksWUFBWSxDQUFDLDhCQUE4QixzQkFBc0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUVELE9BQU8sUUFBUSxJQUFJLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztBQUM3QyxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentdf/sdk",
-  "version": "0.9.0-beta.85",
+  "version": "0.9.0-beta.87",
   "description": "OpenTDF for the Web",
   "homepage": "https://github.com/opentdf/web-sdk",
   "bugs": {

package/src/errors.ts

@@ -119,3 +119,12 @@ export class PermissionDeniedError extends TdfError {
 export class UnsupportedFeatureError extends TdfError {
   override name = 'UnsupportedFeatureError';
 }
+
+/**
+ * One or more attribute value FQNs were not found on the platform.
+ * Thrown by {@link validateAttributes} and {@link validateAttributeValue} when the platform
+ * does not recognize the requested FQNs.
+ */
+export class AttributeNotFoundError extends TdfError {
+  override name = 'AttributeNotFoundError';
+}

package/src/index.ts

@@ -1,6 +1,12 @@
 export { type AuthProvider, type HttpMethod, HttpRequest, withHeaders } from './auth/auth.js';
 export * as AuthProviders from './auth/providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
+export {
+  listAttributes,
+  validateAttributes,
+  attributeExists,
+  attributeValueExists,
+} from './policy/discovery.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
 export { PlatformClient, type PlatformClientOptions, type PlatformServices } from './platform.js';
 export * from './opentdf.js';
@@ -12,6 +18,7 @@ export {
   DecryptError,
   NetworkError,
   AttributeValidationError,
+  AttributeNotFoundError,
   ConfigurationError,
 } from './errors.js';
 export * from './seekable.js';

package/src/policy/discovery.ts

@@ -0,0 +1,222 @@
+import { ConnectError, Code } from '@connectrpc/connect';
+import { AttributeNotFoundError, ConfigurationError, NetworkError } from '../errors.js';
+import { type AuthProvider } from '../auth/auth.js';
+import { extractRpcErrorMessage, validateSecureUrl } from '../utils.js';
+import { PlatformClient } from '../platform.js';
+import type { Attribute } from '../platform/policy/objects_pb.js';
+
+// Caps the pagination loop in listAttributes. 10 pages × 1000 records = 10,000
+// attributes maximum, which is generous for browser use while preventing runaway
+// memory growth if a server repeatedly returns a non-zero next_offset.
+const MAX_LIST_ATTRIBUTES_PAGES = 10;
+
+// Number of attributes to request per page. Matches the platform's default
+// (ListRequestLimitDefault = 1000) so behavior is stable regardless of server config.
+const LIST_ATTRIBUTES_PAGE_SIZE = 1000;
+
+// Matches the server-side proto constraint: GetAttributeValuesByFqnsRequest has
+// max_items: 250 on the fqns field, so the client rejects oversized requests
+// locally instead of receiving a cryptic server validation error.
+const MAX_VALIDATE_FQNS = 250;
+
+// Attribute value FQN format: https://<namespace>/attr/<name>/value/<value>
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_VALUE_FQN_RE =
+  /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+\/value\/[a-zA-Z0-9._~%-]+$/i;
+
+// Attribute-level FQN format: https://<namespace>/attr/<name>  (no /value/ segment)
+// Restricts to safe URL characters to prevent XSS via FQNs in error messages
+const ATTRIBUTE_FQN_RE = /^https?:\/\/[a-zA-Z0-9._~%-]+\/attr\/[a-zA-Z0-9._~%-]+$/i;
+
+/**
+ * Returns all active attributes available on the platform, auto-paginating through all results.
+ * An optional namespace name or ID may be provided to filter results.
+ *
+ * Use this before calling `createZTDF()` to see what attributes are available for data tagging.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param namespace Optional namespace name or ID to filter results.
+ * @returns All active {@link Attribute} objects on the platform.
+ *
+ * @example
+ * ```ts
+ * const attrs = await listAttributes(platformUrl, authProvider);
+ * for (const a of attrs) {
+ *   console.log(a.fqn);
+ * }
+ * ```
+ */
+export async function listAttributes(
+  platformUrl: string,
+  authProvider: AuthProvider,
+  namespace?: string
+): Promise<Attribute[]> {
+  if (!validateSecureUrl(platformUrl)) {
+    throw new ConfigurationError('platformUrl must use HTTPS protocol');
+  }
+  const platform = new PlatformClient({ authProvider, platformUrl });
+  const result: Attribute[] = [];
+  let nextOffset = 0;
+
+  for (let pages = 0; pages < MAX_LIST_ATTRIBUTES_PAGES; pages++) {
+    let resp;
+    try {
+      resp = await platform.v1.attributes.listAttributes({
+        namespace: namespace ?? '',
+        pagination: { offset: nextOffset, limit: LIST_ATTRIBUTES_PAGE_SIZE },
+      });
+    } catch (e) {
+      throw new NetworkError(`[ListAttributes] ${extractRpcErrorMessage(e)}`);
+    }
+
+    result.push(...resp.attributes);
+    nextOffset = resp.pagination?.nextOffset ?? 0;
+    if (nextOffset === 0) {
+      return result;
+    }
+  }
+
+  throw new ConfigurationError(
+    `listAttributes returned more than ${MAX_LIST_ATTRIBUTES_PAGES * LIST_ATTRIBUTES_PAGE_SIZE} attributes. Use the namespace parameter to narrow results.`
+  );
+}
+
+/**
+ * Checks that all provided attribute value FQNs exist on the platform.
+ * Validates FQN format first, then verifies existence via the platform API.
+ *
+ * Use this before `createZTDF()` to catch missing or misspelled attributes early
+ * instead of discovering the problem at decryption time.
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param fqns Attribute value FQNs to validate, in the form
+ *   `https://<namespace>/attr/<name>/value/<value>`.
+ * @throws {@link AttributeNotFoundError} if any FQNs are not found on the platform.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or there are too many FQNs.
+ *
+ * @example
+ * ```ts
+ * await validateAttributes(platformUrl, authProvider, [
+ *   'https://opentdf.io/attr/department/value/marketing',
+ * ]);
+ * // Safe to encrypt — all attributes confirmed present
+ * ```
+ */
+export async function validateAttributes(
+  platformUrl: string,
+  authProvider: AuthProvider,
+  fqns: string[]
+): Promise<void> {
+  if (!fqns || fqns.length === 0) {
+    return;
+  }
+
+  if (!validateSecureUrl(platformUrl)) {
+    throw new ConfigurationError('platformUrl must use HTTPS protocol');
+  }
+
+  if (fqns.length > MAX_VALIDATE_FQNS) {
+    throw new ConfigurationError(
+      `too many attribute FQNs: ${fqns.length} exceeds maximum of ${MAX_VALIDATE_FQNS}`
+    );
+  }
+
+  for (const fqn of fqns) {
+    if (!ATTRIBUTE_VALUE_FQN_RE.test(fqn)) {
+      throw new ConfigurationError('invalid attribute value FQN format');
+    }
+  }
+
+  const platform = new PlatformClient({ authProvider, platformUrl });
+  let resp;
+  try {
+    resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns });
+  } catch (e) {
+    throw new NetworkError(`[GetAttributeValuesByFqns] ${extractRpcErrorMessage(e)}`);
+  }
+
+  const found = resp.fqnAttributeValues;
+  const missing = fqns.filter((fqn) => !(fqn in found));
+  if (missing.length > 0) {
+    throw new AttributeNotFoundError(`attribute not found: ${missing.length} FQN(s) missing`);
+  }
+}
+
+/**
+ * Reports whether the attribute definition identified by `attributeFqn` exists on the platform.
+ *
+ * `attributeFqn` should be an attribute-level FQN (no `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param attributeFqn The attribute-level FQN to check.
+ * @returns `true` if the attribute exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a non-not-found service error occurs.
+ */
+export async function attributeExists(
+  platformUrl: string,
+  authProvider: AuthProvider,
+  attributeFqn: string
+): Promise<boolean> {
+  if (!validateSecureUrl(platformUrl)) {
+    throw new ConfigurationError('platformUrl must use HTTPS protocol');
+  }
+
+  if (!ATTRIBUTE_FQN_RE.test(attributeFqn)) {
+    throw new ConfigurationError('invalid attribute FQN format');
+  }
+
+  const platform = new PlatformClient({ authProvider, platformUrl });
+  try {
+    await platform.v1.attributes.getAttribute({
+      identifier: { case: 'fqn', value: attributeFqn },
+    });
+    return true;
+  } catch (e) {
+    if (e instanceof ConnectError && e.code === Code.NotFound) {
+      return false;
+    }
+    throw new NetworkError(`[GetAttribute] ${extractRpcErrorMessage(e)}`);
+  }
+}
+
+/**
+ * Reports whether the attribute value FQN exists on the platform.
+ *
+ * `valueFqn` should be a full attribute value FQN (with `/value/` segment):
+ * `https://<namespace>/attr/<attribute_name>/value/<value>`
+ *
+ * @param platformUrl The platform base URL.
+ * @param authProvider An auth provider for the request.
+ * @param valueFqn The attribute value FQN to check.
+ * @returns `true` if the value exists, `false` if it does not.
+ * @throws {@link ConfigurationError} if the FQN format is invalid or the URL is insecure.
+ * @throws {@link NetworkError} if a service error occurs.
+ */
+export async function attributeValueExists(
+  platformUrl: string,
+  authProvider: AuthProvider,
+  valueFqn: string
+): Promise<boolean> {
+  if (!validateSecureUrl(platformUrl)) {
+    throw new ConfigurationError('platformUrl must use HTTPS protocol');
+  }
+
+  if (!ATTRIBUTE_VALUE_FQN_RE.test(valueFqn)) {
+    throw new ConfigurationError('invalid attribute value FQN format');
+  }
+
+  const platform = new PlatformClient({ authProvider, platformUrl });
+  let resp;
+  try {
+    resp = await platform.v1.attributes.getAttributeValuesByFqns({ fqns: [valueFqn] });
+  } catch (e) {
+    throw new NetworkError(`[GetAttributeValuesByFqns] ${extractRpcErrorMessage(e)}`);
+  }
+
+  return valueFqn in resp.fqnAttributeValues;
+}