@owlmeans/iam 0.1.18-rc.8 → 0.1.18

package/build/consts.js

@@ -1,4 +1,225 @@
+import { EmailSchema, ProfileIdSchema, TitleSchema } from './consts.local.js';
+import { EntitySlugValueSchema } from '@owlmeans/auth';
 export const DEFAULT_ALIAS = 'iam-service';
 export const IAM_MODE_KEYCLOAK = 'keycloak';
 export const IAM_MODE_INTEGRATED = 'integrated';
+/**
+ * Gate-param syntax: `<permission>[@<selector>]`.
+ *
+ * The `@` belongs to the GATE and to nothing else. It says where a resource id is read from at
+ * request time; it is never part of a permission's stored NAME. A definition or a grant whose name
+ * carries one is a key nothing ever looks up, so every grant against it is a silent no-op.
+ */
+export const RESOURCE_PARAM_SEPARATOR = '@';
+/**
+ * Separates an explicit source from its path: `@body:order.id`.
+ *
+ * Deliberately `:` rather than a dot. Under a dotted-only form the meaning of a selector changes the
+ * moment a route gains a param named like a source keyword — `/report/:query` with `@query.id` flips
+ * from "the route param literally named `query.id`" to "the query string's `id`", redirecting an
+ * authorization lookup from a router-matched value to attacker-supplied input, caused by an
+ * unrelated route rename. `:` is decidable in one character, and no gate-param string written before
+ * this existed can contain one.
+ */
+export const RESOURCE_SOURCE_SEPARATOR = ':';
+/** Separates path segments inside a qualified selector: `@body:order.id`. */
+export const RESOURCE_PATH_SEPARATOR = '.';
+/** Where a qualified selector may read a resource id from. */
+export var GateParamSource;
+(function (GateParamSource) {
+    GateParamSource["Params"] = "params";
+    GateParamSource["Query"] = "query";
+    GateParamSource["Body"] = "body";
+    GateParamSource["Headers"] = "headers";
+    GateParamSource["Auth"] = "auth";
+})(GateParamSource || (GateParamSource = {}));
+/**
+ * What the bare form (`@enquiryId`) searches, in order.
+ *
+ * Params first, then query. The query fallback is legacy and deliberately kept: removing it would
+ * silently deny already-deployed applications whose selector happens to name a query key, and a
+ * silent denial inside a customer's running app is the worst available outcome.
+ */
+export const DEFAULT_GATE_PARAM_SOURCES = [
+    GateParamSource.Params, GateParamSource.Query
+];
+/** Why a gate param is structurally wrong — a misconfiguration, not a failed authorization. */
+export var GateParamErrorCode;
+(function (GateParamErrorCode) {
+    GateParamErrorCode["UnknownSource"] = "gate-param:unknown-source";
+    GateParamErrorCode["EmptySelector"] = "gate-param:empty-selector";
+    GateParamErrorCode["EmptySegment"] = "gate-param:empty-segment";
+    /** Named a request key the entrypoint's filter does not declare — AJV strips it before the gate. */
+    GateParamErrorCode["UnreachableKey"] = "gate-param:unreachable-key";
+    /** Named a route param the entrypoint's own path does not carry. */
+    GateParamErrorCode["UnknownRouteParam"] = "gate-param:unknown-route-param";
+})(GateParamErrorCode || (GateParamErrorCode = {}));
+/** Why a selector produced no resource id. */
+export var GateResolutionFailure;
+(function (GateResolutionFailure) {
+    /** The source exists, the path does not. */
+    GateResolutionFailure["NotProvided"] = "not-provided";
+    /** The request carries no such source at all. */
+    GateResolutionFailure["SourceMissing"] = "source-missing";
+    /** Resolved to an object or a multi-element array — refused rather than stringified. */
+    GateResolutionFailure["NotScalar"] = "not-scalar";
+    /** The selector itself did not parse. */
+    GateResolutionFailure["Malformed"] = "malformed";
+})(GateResolutionFailure || (GateResolutionFailure = {}));
+/**
+ * Which FORM of a grant an operation addresses.
+ *
+ * A resource-scoped permission is grantable two ways, under one name: `Blanket` (a PermissionSet
+ * carrying no `resources`, which `hasPermission` reads as covering every id) and `Resources` (an
+ * explicit id list). They are stored separately and must be revoked separately, or a UI offering
+ * both controls would have one silently wipe the other.
+ *
+ * Every subject, person or group, also has ONE blanket value of its own per binding: `true` grants,
+ * `false` RESTRICTS (it cuts what the subject would inherit from a default class, a group or a
+ * bundle), absent inherits. A `Blanket` or `All` revoke of a declared definition writes the
+ * restriction; `Inherit` takes the subject's own value back.
+ */
+export var IamGrantMode;
+(function (IamGrantMode) {
+    IamGrantMode["Blanket"] = "blanket";
+    IamGrantMode["Resources"] = "resources";
+    /** Revoke-only: every form. Illegal on a grant. */
+    IamGrantMode["All"] = "all";
+    /**
+     * Revoke-only: drop the subject's OWN blanket value in the binding — a grant or a restriction —
+     * so it holds exactly what it inherits. Resource-scoped sets are untouched. Illegal on a grant.
+     */
+    IamGrantMode["Inherit"] = "inherit";
+})(IamGrantMode || (IamGrantMode = {}));
+/** What to do about grants that still reference a definition being removed. */
+export var IamRemovalPolicy;
+(function (IamRemovalPolicy) {
+    /** Strip the permission from every subject of the entity, then drop the definition. */
+    IamRemovalPolicy["Cascade"] = "cascade";
+    /** Refuse while any subject still holds it; the holders travel in the error. */
+    IamRemovalPolicy["Refuse"] = "refuse";
+})(IamRemovalPolicy || (IamRemovalPolicy = {}));
+/**
+ * The grouping tiers a permission definition may be tagged with.
+ *
+ * A tag decides NOTHING at request time — `hasPermission` and every gate treat a permission name as
+ * one opaque string — and only groups the permission in an administrator's screen. `guest` is
+ * deliberately absent: a public surface declares no permissions, and adding an area later would
+ * re-classify names already tagged.
+ */
+export const IAM_AREAS = ['user', 'operator', 'admin'];
+/** Separates the resource from the action in a permission name. TWO hyphens, never one. */
+export const PERMISSION_ACTION_SEPARATOR = '--';
+/**
+ * Who holds a permission without an explicit grant — a property of the DEFINITION, evaluated when
+ * claims are built and never written onto a profile.
+ *
+ * `User` is every signed-in subject of the client (an unbound, unmanaged `user`-area definition
+ * only); `Member` and `Owner` are every member / owner of the organization the subject acts in, so
+ * they require an `entityScoped` definition. A class default is a BLANKET set: `Owner` on a
+ * resource-scoped definition is its all-records form.
+ */
+export var IamDefaultClass;
+(function (IamDefaultClass) {
+    IamDefaultClass["None"] = "none";
+    IamDefaultClass["User"] = "user";
+    IamDefaultClass["Member"] = "member";
+    IamDefaultClass["Owner"] = "owner";
+})(IamDefaultClass || (IamDefaultClass = {}));
+/** Why a subject holds a grant, as a listing reports it. */
+export var IamGrantOrigin;
+(function (IamGrantOrigin) {
+    /** Written on the subject's own row. */
+    IamGrantOrigin["Direct"] = "direct";
+    /** The definition's `defaultClass` covers the subject. */
+    IamGrantOrigin["Default"] = "default";
+    /** Held by a group the subject is a member of — `IamGrant.through` names it. */
+    IamGrantOrigin["Group"] = "group";
+    /** A group's own listing only: the names its bundles select; its own grants are `Direct`. */
+    IamGrantOrigin["Bundle"] = "bundle";
+})(IamGrantOrigin || (IamGrantOrigin = {}));
+/**
+ * The managed group `syncStaff` keeps in a client's owning organization: the owner's own staff,
+ * admitted to the client with the bundles the sync hands it. Its key, membership, bundles and
+ * existence are the synchronization's alone; its grants and restrictions are the operator's and
+ * survive every sync.
+ */
+export const IAM_MEMBERS_GROUP = 'members';
+/**
+ * The `profileId` of a credential that proves an e-mail address and identifies nobody yet: what the
+ * end-user sign-in hands the provider's finalizer, which then resolves the account itself. It carries
+ * no `entitySlug` — a proof bound to an organization is something else.
+ */
+export const IAM_EMAIL_PROOF = 'proof:email';
+/**
+ * The guard of the runtime IAM API (`makeIamRuntimeProtocols`). The serving process registers it: it
+ * admits a bearer access token the provider itself issued, and takes the client and the account from
+ * that token, never from the request.
+ */
+export const IAM_RUNTIME_GUARD = 'iam-runtime-guard';
+/** Where the runtime IAM API mounts under its service unless the declaration names another path. */
+export const IAM_RUNTIME_PATH = '/runtime';
+/**
+ * The runtime API's leaf paths under its base. One table so the declarations and a fetch-only client
+ * (a target's server, which binds no entrypoint of the provider's tree) cannot disagree on a segment.
+ */
+export const IAM_RUNTIME_ROUTES = {
+    organizations: '/organizations',
+    organization: '/organizations/:entitySlug',
+    members: '/organizations/:entitySlug/members',
+    member: '/organizations/:entitySlug/members/:profileId',
+    memberRemove: '/organizations/:entitySlug/members/:profileId/remove',
+    permissions: '/organizations/:entitySlug/permissions',
+    grants: '/organizations/:entitySlug/grants',
+    grantsRevoke: '/organizations/:entitySlug/grants/revoke',
+};
+export const IamRuntimeOrganizationCreateSchema = {
+    type: 'object',
+    properties: { title: { ...TitleSchema, nullable: true } },
+    required: [],
+    additionalProperties: false,
+};
+export const IamRuntimeOrganizationUpdateSchema = {
+    type: 'object',
+    properties: { title: { ...TitleSchema } },
+    required: ['title'],
+    additionalProperties: false,
+};
+export const IamRuntimeOrganizationParamsSchema = {
+    type: 'object',
+    properties: { entitySlug: { ...EntitySlugValueSchema } },
+    required: ['entitySlug'],
+    additionalProperties: false,
+};
+export const IamRuntimeMemberInviteSchema = {
+    type: 'object',
+    properties: {
+        email: { ...EmailSchema },
+        name: { ...TitleSchema, nullable: true },
+        owner: { type: 'boolean', nullable: true },
+    },
+    required: ['email'],
+    additionalProperties: false,
+};
+export const IamRuntimeMemberParamsSchema = {
+    type: 'object',
+    properties: {
+        entitySlug: { ...EntitySlugValueSchema },
+        profileId: { ...ProfileIdSchema },
+    },
+    required: ['entitySlug', 'profileId'],
+    additionalProperties: false,
+};
+export const IamRuntimeGrantQuerySchema = {
+    type: 'object',
+    properties: { profileId: { ...ProfileIdSchema, nullable: true } },
+    required: [],
+    additionalProperties: false,
+};
+export const IamRuntimeAckSchema = {
+    type: 'object',
+    properties: { ok: { type: 'boolean' } },
+    required: ['ok'],
+    additionalProperties: false,
+};
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAG7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAE1C,8DAA8D;AAC9D,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,kCAAe,CAAA;IACf,gCAAa,CAAA;IACb,sCAAmB,CAAA;IACnB,gCAAa,CAAA;AACf,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK;CAC9C,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAN,IAAY,kBAQX;AARD,WAAY,kBAAkB;IAC5B,iEAA2C,CAAA;IAC3C,iEAA2C,CAAA;IAC3C,+DAAyC,CAAA;IACzC,oGAAoG;IACpG,mEAA6C,CAAA;IAC7C,oEAAoE;IACpE,0EAAoD,CAAA;AACtD,CAAC,EARW,kBAAkB,KAAlB,kBAAkB,QAQ7B;AAED,8CAA8C;AAC9C,MAAM,CAAN,IAAY,qBASX;AATD,WAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,qDAA4B,CAAA;IAC5B,iDAAiD;IACjD,yDAAgC,CAAA;IAChC,wFAAwF;IACxF,iDAAwB,CAAA;IACxB,yCAAyC;IACzC,gDAAuB,CAAA;AACzB,CAAC,EATW,qBAAqB,KAArB,qBAAqB,QAShC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,YAUX;AAVD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,uCAAuB,CAAA;IACvB,mDAAmD;IACnD,2BAAW,CAAA;IACX;;;OAGG;IACH,mCAAmB,CAAA;AACrB,CAAC,EAVW,YAAY,KAAZ,YAAY,QAUvB;AAED,+EAA+E;AAC/E,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,uFAAuF;IACvF,uCAAmB,CAAA;IACnB,gFAAgF;IAChF,qCAAiB,CAAA;AACnB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,gCAAa,CAAA;IACb,oCAAiB,CAAA;IACjB,kCAAe,CAAA;AACjB,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,4DAA4D;AAC5D,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACxB,wCAAwC;IACxC,mCAAiB,CAAA;IACjB,0DAA0D;IAC1D,qCAAmB,CAAA;IACnB,gFAAgF;IAChF,iCAAe,CAAA;IACf,6FAA6F;IAC7F,mCAAiB,CAAA;AACnB,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEpD,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,4BAA4B;IAC1C,OAAO,EAAE,oCAAoC;IAC7C,MAAM,EAAE,+CAA+C;IACvD,YAAY,EAAE,sDAAsD;IACpE,WAAW,EAAE,wCAAwC;IACrD,MAAM,EAAE,mCAAmC;IAC3C,YAAY,EAAE,0CAA0C;CAChD,CAAA;AAEV,MAAM,CAAC,MAAM,kCAAkC,GAAiD;IAC9F,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IACzD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAiD;IAC9F,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE;IACzC,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAiD;IAC9F,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE;IACxD,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE;QACzB,IAAI,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3C;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE;QACxC,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;KAClC;IACD,QAAQ,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACrC,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IACjE,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAkC;IAChE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACvC,QAAQ,EAAE,CAAC,IAAI,CAAC;IAChB,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}

package/build/consts.local.d.ts

@@ -0,0 +1,58 @@
+export declare const TitleSchema: {
+    readonly type: 'string';
+    readonly minLength: 0;
+    readonly maxLength: 256;
+};
+/** A pairwise subject: `<clientId>:<digest>`. Never a path separator, never whitespace. */
+export declare const ProfileIdSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 256;
+    readonly pattern: '^[^/\\s]+$';
+};
+export declare const PermissionNameSchema: {
+    readonly type: 'string';
+    readonly minLength: 1;
+    readonly maxLength: 128;
+};
+export declare const EmailSchema: {
+    readonly type: 'string';
+    readonly format: 'email';
+    readonly minLength: 3;
+    readonly maxLength: 254;
+};
+export declare const ResourcesSchema: {
+    readonly type: 'array';
+    readonly items: {
+        readonly type: 'string';
+        readonly minLength: 1;
+        readonly maxLength: 128;
+    };
+    readonly maxItems: 256;
+    readonly nullable: true;
+};
+export declare const aliases: {
+    readonly base: 'iam-runtime';
+    readonly organization: {
+        readonly list: 'iam-runtime:organization:list';
+        readonly create: 'iam-runtime:organization:create';
+        readonly update: 'iam-runtime:organization:update';
+    };
+    readonly member: {
+        readonly list: 'iam-runtime:member:list';
+        readonly add: 'iam-runtime:member:add';
+        readonly update: 'iam-runtime:member:update';
+        readonly remove: 'iam-runtime:member:remove';
+    };
+    readonly permission: {
+        readonly list: 'iam-runtime:permission:list';
+    };
+    readonly grant: {
+        readonly list: 'iam-runtime:grant:list';
+        readonly assign: 'iam-runtime:grant:assign';
+        readonly revoke: 'iam-runtime:grant:revoke';
+    };
+};
+/** Keys a facet stand-in answers `undefined` for, so it is never mistaken for a thenable or a primitive. */
+export declare const INERT_KEYS: Set<PropertyKey>;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAEpF,2FAA2F;AAC3F,eAAO,MAAM,eAAe;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;aAAE,OAAO,EAAE,YAAY;CAAW,CAAA;AAE/G,eAAO,MAAM,oBAAoB;aAAK,IAAI,EAAE,QAAQ;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAE7F,eAAO,MAAM,WAAW;aAAK,IAAI,EAAE,QAAQ;aAAE,MAAM,EAAE,OAAO;aAAE,SAAS,EAAE,CAAC;aAAE,SAAS,EAAE,GAAG;CAAW,CAAA;AAErG,eAAO,MAAM,eAAe;aAC1B,IAAI,EAAE,OAAO;aAAE,KAAK;iBAAI,IAAI,EAAE,QAAQ;iBAAE,SAAS,EAAE,CAAC;iBAAE,SAAS,EAAE,GAAG;;aAAI,QAAQ,EAAE,GAAG;aAAE,QAAQ;CACvF,CAAA;AAEV,eAAO,MAAM,OAAO;aAClB,IAAI,EAAE,aAAa;aACnB,YAAY;iBAAI,IAAI,EAAE,+BAA+B;iBAAE,MAAM,EAAE,iCAAiC;iBAAE,MAAM,EAAE,iCAAiC;;aAC3I,MAAM;iBACJ,IAAI,EAAE,yBAAyB;iBAAE,GAAG,EAAE,wBAAwB;iBAC9D,MAAM,EAAE,2BAA2B;iBAAE,MAAM,EAAE,2BAA2B;;aAE1E,UAAU;iBAAI,IAAI,EAAE,6BAA6B;;aACjD,KAAK;iBAAI,IAAI,EAAE,wBAAwB;iBAAE,MAAM,EAAE,0BAA0B;iBAAE,MAAM,EAAE,0BAA0B;;CACvG,CAAA;AAEV,4GAA4G;AAC5G,eAAO,MAAM,UAAU,kBAA2C,CAAA"}

package/build/consts.local.js

@@ -0,0 +1,21 @@
+export const TitleSchema = { type: 'string', minLength: 0, maxLength: 256 };
+/** A pairwise subject: `<clientId>:<digest>`. Never a path separator, never whitespace. */
+export const ProfileIdSchema = { type: 'string', minLength: 1, maxLength: 256, pattern: '^[^/\\s]+$' };
+export const PermissionNameSchema = { type: 'string', minLength: 1, maxLength: 128 };
+export const EmailSchema = { type: 'string', format: 'email', minLength: 3, maxLength: 254 };
+export const ResourcesSchema = {
+    type: 'array', items: { type: 'string', minLength: 1, maxLength: 128 }, maxItems: 256, nullable: true,
+};
+export const aliases = {
+    base: 'iam-runtime',
+    organization: { list: 'iam-runtime:organization:list', create: 'iam-runtime:organization:create', update: 'iam-runtime:organization:update' },
+    member: {
+        list: 'iam-runtime:member:list', add: 'iam-runtime:member:add',
+        update: 'iam-runtime:member:update', remove: 'iam-runtime:member:remove',
+    },
+    permission: { list: 'iam-runtime:permission:list' },
+    grant: { list: 'iam-runtime:grant:list', assign: 'iam-runtime:grant:assign', revoke: 'iam-runtime:grant:revoke' },
+};
+/** Keys a facet stand-in answers `undefined` for, so it is never mistaken for a thenable or a primitive. */
+export const INERT_KEYS = new Set(['then', 'toJSON']);
+//# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAEpF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAW,CAAA;AAE/G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAE7F,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAW,CAAA;AAErG,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI;CAC7F,CAAA;AAEV,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI,EAAE,aAAa;IACnB,YAAY,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,iCAAiC,EAAE,MAAM,EAAE,iCAAiC,EAAE;IAC7I,MAAM,EAAE;QACN,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,wBAAwB;QAC9D,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,2BAA2B;KACzE;IACD,UAAU,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACnD,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,0BAA0B,EAAE;CACzG,CAAA;AAEV,4GAA4G;AAC5G,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA"}

package/build/errors.d.ts

@@ -15,6 +15,19 @@ export declare class IamGrantError extends IamError {
     static typeName: string;
     constructor(message?: string);
 }
+/**
+ * A refusal about a permission DEFINITION, as opposed to a grant.
+ *
+ * Separate from `IamGrantError`, which means a grant's subject is missing or its entity does not
+ * match — reusing it for a definition-level refusal is a category error the next reader has to unpick.
+ *
+ * Codes: `permission:held:<name>` (still granted to someone, under a policy that refuses),
+ * `permission:managed:<name>` (platform-owned, deleted only with an explicit second key).
+ */
+export declare class IamPermissionError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
 export declare class IamUnsupported extends IamError {
     static typeName: string;
     constructor(message?: string);
@@ -23,4 +36,17 @@ export declare class IamUserError extends IamError {
     static typeName: string;
     constructor(message?: string);
 }
+/**
+ * A refusal about an organization or a membership in it — an unknown organization, the last owner,
+ * the membership cap.
+ */
+export declare class IamOrganizationError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
+/** A refusal about a group: an unknown key, a managed group written by an operator, another app's group. */
+export declare class IamGroupError extends IamError {
+    static typeName: string;
+    constructor(message?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,OAAuB,QAAQ,SAA8C;IAE7E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,4GAA4G;AAC5G,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF"}

package/build/errors.js

@@ -27,6 +27,22 @@ export class IamGrantError extends IamError {
         this.type = IamGrantError.typeName;
     }
 }
+/**
+ * A refusal about a permission DEFINITION, as opposed to a grant.
+ *
+ * Separate from `IamGrantError`, which means a grant's subject is missing or its entity does not
+ * match — reusing it for a definition-level refusal is a category error the next reader has to unpick.
+ *
+ * Codes: `permission:held:<name>` (still granted to someone, under a policy that refuses),
+ * `permission:managed:<name>` (platform-owned, deleted only with an explicit second key).
+ */
+export class IamPermissionError extends IamError {
+    static typeName = `IamPermission${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`permission:${message}`);
+        this.type = IamPermissionError.typeName;
+    }
+}
 export class IamUnsupported extends IamError {
     static typeName = `IamUnsupported${ResilientError.typeName}`;
     constructor(message = 'error') {
@@ -41,10 +57,32 @@ export class IamUserError extends IamError {
         this.type = IamUserError.typeName;
     }
 }
+/**
+ * A refusal about an organization or a membership in it — an unknown organization, the last owner,
+ * the membership cap.
+ */
+export class IamOrganizationError extends IamError {
+    static typeName = `IamOrganization${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`organization:${message}`);
+        this.type = IamOrganizationError.typeName;
+    }
+}
+/** A refusal about a group: an unknown key, a managed group written by an operator, another app's group. */
+export class IamGroupError extends IamError {
+    static typeName = `IamGroup${ResilientError.typeName}`;
+    constructor(message = 'error') {
+        super(`group:${message}`);
+        this.type = IamGroupError.typeName;
+    }
+}
 ResilientError.registerErrorClass(IamError);
 ResilientError.registerErrorClass(IamClientError);
 ResilientError.registerErrorClass(IamResourceError);
 ResilientError.registerErrorClass(IamGrantError);
+ResilientError.registerErrorClass(IamPermissionError);
 ResilientError.registerErrorClass(IamUnsupported);
 ResilientError.registerErrorClass(IamUserError);
+ResilientError.registerErrorClass(IamOrganizationError);
+ResilientError.registerErrorClass(IamGroupError);
 //# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,iBAAiB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE5E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,UAAU,cAAc,CAAC,QAAQ,EAAE,CAAA;IAErE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;AACnD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAChD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACvC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE3E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,iBAAiB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE5E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,UAAU,cAAc,CAAC,QAAQ,EAAE,CAAA;IAErE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACzC,MAAM,CAAU,QAAQ,GAAG,kBAAkB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE7E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAA;IAC3C,CAAC;CACF;AAED,4GAA4G;AAC5G,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;AACnD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAChD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;AAC/C,cAAc,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;AACvD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA"}

package/build/facet.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A facet a backend cannot provide: every method throws `IamUnsupported(what)`.
+ *
+ * It throws SYNCHRONOUSLY, because a facet may carry synchronous methods (`subjects.identify`) and a
+ * rejected promise would hand those a value of the wrong type; an awaited call rejects the same way
+ * either way. Caller code turns the refusal into a fallback, exactly as for any other unsupported
+ * operation.
+ */
+export declare const unsupportedFacet: <T extends object>(what: string) => T;
+//# sourceMappingURL=facet.d.ts.map

package/build/facet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facet.d.ts","sourceRoot":"","sources":["../src/facet.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAG,CAK9D,CAAA"}

package/build/facet.js

@@ -0,0 +1,16 @@
+import { IamUnsupported } from './errors.js';
+import { INERT_KEYS } from './consts.local.js';
+/**
+ * A facet a backend cannot provide: every method throws `IamUnsupported(what)`.
+ *
+ * It throws SYNCHRONOUSLY, because a facet may carry synchronous methods (`subjects.identify`) and a
+ * rejected promise would hand those a value of the wrong type; an awaited call rejects the same way
+ * either way. Caller code turns the refusal into a fallback, exactly as for any other unsupported
+ * operation.
+ */
+export const unsupportedFacet = (what) => new Proxy(Object.freeze({}), {
+    get: (_, key) => typeof key === 'symbol' || INERT_KEYS.has(key)
+        ? undefined
+        : () => { throw new IamUnsupported(what); },
+});
+//# sourceMappingURL=facet.js.map

package/build/facet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facet.js","sourceRoot":"","sources":["../src/facet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAmB,IAAY,EAAK,EAAE,CACpE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAM,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;CAC7C,CAAC,CAAA"}

package/build/gate/consts.local.d.ts

@@ -0,0 +1,2 @@
+export declare const SOURCES: string[];
+//# sourceMappingURL=consts.local.d.ts.map

package/build/gate/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../src/gate/consts.local.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,EAAqC,MAAM,EAAE,CAAA"}

package/build/gate/consts.local.js

@@ -0,0 +1,3 @@
+import { GateParamSource } from '../consts.js';
+export const SOURCES = Object.values(GateParamSource);
+//# sourceMappingURL=consts.local.js.map

package/build/gate/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../src/gate/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAa,CAAA"}

package/build/gate/index.d.ts

@@ -0,0 +1,4 @@
+export * from './param.js';
+export * from './resolve.js';
+export * from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/build/gate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gate/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/build/gate/index.js

@@ -0,0 +1,4 @@
+export * from './param.js';
+export * from './resolve.js';
+export * from './validate.js';
+//# sourceMappingURL=index.js.map

package/build/gate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/gate/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA"}

package/build/gate/param.d.ts

@@ -0,0 +1,6 @@
+import type { GateParamHelper, ParsedGateParam } from './types.js';
+export declare const createGateParamHelper: () => GateParamHelper;
+export declare const gateParamHelper: GateParamHelper;
+/** @deprecated compat:factory-refactor — use `gateParamHelper.parseGateParam(…)` */
+export declare const parseGateParam: (param: string) => ParsedGateParam;
+//# sourceMappingURL=param.d.ts.map

package/build/gate/param.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAA0C,eAAe,EAAE,MAAM,YAAY,CAAA;AAG1G,eAAO,MAAM,qBAAqB,QAAO,eA+FxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,oFAAoF;AACpF,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAAwD,CAAA"}

package/build/gate/param.js

@@ -0,0 +1,83 @@
+import { RESOURCE_PARAM_SEPARATOR, RESOURCE_SOURCE_SEPARATOR, RESOURCE_PATH_SEPARATOR, GateParamErrorCode, DEFAULT_GATE_PARAM_SOURCES } from '../consts.js';
+import { SOURCES } from './consts.local.js';
+export const createGateParamHelper = () => {
+    const parseGateSelector = (selector) => {
+        if (selector === '') {
+            return { code: GateParamErrorCode.EmptySelector, detail: 'the selector after "@" is empty' };
+        }
+        const idx = selector.indexOf(RESOURCE_SOURCE_SEPARATOR);
+        if (idx < 0) {
+            return {
+                selector,
+                path: [selector],
+                sources: DEFAULT_GATE_PARAM_SOURCES
+            };
+        }
+        const source = selector.slice(0, idx);
+        const rest = selector.slice(idx + 1);
+        if (!SOURCES.includes(source)) {
+            return {
+                code: GateParamErrorCode.UnknownSource,
+                detail: `"${source}" is not one of ${SOURCES.join(', ')}`
+            };
+        }
+        if (rest === '') {
+            return {
+                code: GateParamErrorCode.EmptySelector,
+                detail: `"${source}:" names no path`
+            };
+        }
+        const path = rest.split(RESOURCE_PATH_SEPARATOR);
+        if (path.some(segment => segment === '')) {
+            return {
+                code: GateParamErrorCode.EmptySegment,
+                detail: `"${rest}" has an empty path segment`
+            };
+        }
+        return {
+            selector,
+            source: source,
+            path,
+            sources: [source]
+        };
+    };
+    const parseGateParam = (param) => {
+        const idx = param.indexOf(RESOURCE_PARAM_SEPARATOR);
+        if (idx < 0) {
+            return { permission: param };
+        }
+        const permission = param.slice(0, idx);
+        const selector = param.slice(idx + 1);
+        const parsed = parseGateSelector(selector);
+        if ('code' in parsed) {
+            return { permission, resourceParam: selector, error: parsed };
+        }
+        return {
+            permission,
+            // Kept for readers written against the flat form. Only meaningful when the form IS flat.
+            ...(parsed.source == null ? { resourceParam: selector } : {}),
+            resource: parsed
+        };
+    };
+    const formatGateParam = (permission, selector) => {
+        if (selector == null) {
+            return permission;
+        }
+        if (typeof selector === 'string') {
+            return selector === '' ? permission : `${permission}${RESOURCE_PARAM_SEPARATOR}${selector}`;
+        }
+        if (selector.path.length < 1) {
+            return permission;
+        }
+        const path = selector.path.join(RESOURCE_PATH_SEPARATOR);
+        const tail = selector.source == null
+            ? path
+            : `${selector.source}${RESOURCE_SOURCE_SEPARATOR}${path}`;
+        return `${permission}${RESOURCE_PARAM_SEPARATOR}${tail}`;
+    };
+    return { parseGateSelector, parseGateParam, formatGateParam };
+};
+export const gateParamHelper = createGateParamHelper();
+/** @deprecated compat:factory-refactor — use `gateParamHelper.parseGateParam(…)` */
+export const parseGateParam = (param) => gateParamHelper.parseGateParam(param);
+//# sourceMappingURL=param.js.map

package/build/gate/param.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"param.js","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAAE,yBAAyB,EAAE,uBAAuB,EAC3D,kBAAkB,EAAE,0BAA0B,EAChE,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAA2C,EAAE;QACtF,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;QAC9F,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;QACvD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ;gBACR,IAAI,EAAE,CAAC,QAAQ,CAAC;gBAChB,OAAO,EAAE,0BAA0B;aACpC,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QAEpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;gBACtC,MAAM,EAAE,IAAI,MAAM,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC1D,CAAA;QACH,CAAC;QAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;gBACtC,MAAM,EAAE,IAAI,MAAM,kBAAkB;aACrC,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;gBACrC,MAAM,EAAE,IAAI,IAAI,6BAA6B;aAC9C,CAAA;QACH,CAAC;QAED,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,MAAyB;YACjC,IAAI;YACJ,OAAO,EAAE,CAAC,MAAyB,CAAC;SACrC,CAAA;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QACnD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAE1C,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC/D,CAAC;QAED,OAAO;YACL,UAAU;YACV,yFAAyF;YACzF,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,MAAM;SACjB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,CACtB,UAAkB,EAClB,QAAgE,EACxD,EAAE;QACV,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,wBAAwB,GAAG,QAAQ,EAAE,CAAA;QAC7F,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,yBAAyB,GAAG,IAAI,EAAE,CAAA;QAE3D,OAAO,GAAG,UAAU,GAAG,wBAAwB,GAAG,IAAI,EAAE,CAAA;IAC1D,CAAC,CAAA;IAED,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;AAC/D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAA;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAmB,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA"}

package/build/gate/resolve.d.ts

@@ -0,0 +1,10 @@
+import type { GateRequestLike, GateResourceSelector, GateResourceResolution } from './types.js';
+/**
+ * Resolve the resource id a selector points at.
+ *
+ * Sources are tried in the selector's own order — for the bare form, route params before the query —
+ * and the first that yields a value wins. When none does, the reason travels back so the caller can
+ * tell a MISCONFIGURED gate (the request never carried that key) from a legitimately DENIED one.
+ */
+export declare const resolveGateResource: (req: GateRequestLike, selector: GateResourceSelector) => GateResourceResolution;
+//# sourceMappingURL=resolve.d.ts.map

package/build/gate/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AA4E/F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QACzB,eAAe,YAAY,oBAAoB,KACnD,sBA2BF,CAAA"}