@owlmeans/iam 0.1.18-rc.8 → 0.1.18

package/build/gate/resolve.js

@@ -0,0 +1,93 @@
+import { GateParamSource, GateResolutionFailure } from '../consts.js';
+const isRecord = (value) => value != null && typeof value === 'object';
+/**
+ * A resource id is a scalar. Anything else is refused rather than coerced.
+ *
+ * Stringifying an object would produce `"[object Object]"`, which then either matches nothing or —
+ * far worse — matches another record that stringified the same way.
+ */
+const scalar = (value) => {
+    switch (typeof value) {
+        case 'string':
+            return value;
+        case 'number':
+        case 'boolean':
+        case 'bigint':
+            return `${value}`;
+        default:
+            return null;
+    }
+};
+const sourceOf = (req, source) => {
+    switch (source) {
+        case GateParamSource.Params: return req.params;
+        case GateParamSource.Query: return req.query;
+        case GateParamSource.Body: return req.body;
+        case GateParamSource.Headers: return req.headers;
+        case GateParamSource.Auth: return req.auth;
+    }
+};
+/**
+ * Walk one source for the selector's path.
+ *
+ * Headers get two adjustments they need and nothing else does: the first segment is lowercased,
+ * because HTTP header names are case-insensitive and every server normalises them differently; and a
+ * single-element array unwraps, because a repeated header arrives as an array and silently picking
+ * one of several values would be an authorization decision made by accident.
+ */
+const walk = (container, path, source) => {
+    if (!isRecord(container)) {
+        return { reason: GateResolutionFailure.SourceMissing };
+    }
+    let cursor = container;
+    for (const [index, rawSegment] of path.entries()) {
+        if (!isRecord(cursor)) {
+            return { reason: GateResolutionFailure.NotProvided };
+        }
+        const segment = source === GateParamSource.Headers && index === 0
+            ? rawSegment.toLowerCase()
+            : rawSegment;
+        cursor = cursor[segment];
+    }
+    if (source === GateParamSource.Headers && Array.isArray(cursor)) {
+        if (cursor.length !== 1) {
+            return { reason: GateResolutionFailure.NotScalar };
+        }
+        cursor = cursor[0];
+    }
+    if (cursor == null) {
+        return { reason: GateResolutionFailure.NotProvided };
+    }
+    return { value: cursor };
+};
+/**
+ * Resolve the resource id a selector points at.
+ *
+ * Sources are tried in the selector's own order — for the bare form, route params before the query —
+ * and the first that yields a value wins. When none does, the reason travels back so the caller can
+ * tell a MISCONFIGURED gate (the request never carried that key) from a legitimately DENIED one.
+ */
+export const resolveGateResource = (req, selector) => {
+    let reason = GateResolutionFailure.SourceMissing;
+    for (const source of selector.sources) {
+        const result = walk(sourceOf(req, source), selector.path, source);
+        if (result.reason != null) {
+            // A hard refusal is more informative than "keep looking" — report it rather than letting a
+            // later, emptier source overwrite it with a vaguer reason.
+            if (result.reason === GateResolutionFailure.NotScalar) {
+                return { reason: result.reason, from: source };
+            }
+            if (reason === GateResolutionFailure.SourceMissing) {
+                reason = result.reason;
+            }
+            continue;
+        }
+        const value = scalar(result.value);
+        if (value == null) {
+            return { reason: GateResolutionFailure.NotScalar, from: source };
+        }
+        return { id: value, from: source };
+    }
+    return { reason };
+};
+//# sourceMappingURL=resolve.js.map

package/build/gate/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/C,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,EAAE,CAAA;QACnB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,MAAuB,EAAW,EAAE;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAA;QAC9C,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,CAAA;QAC5C,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;QAC1C,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAA;QAChD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,CACX,SAAkB,EAAE,IAAc,EAAE,MAAuB,EACN,EAAE;IACvD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,MAAM,GAAY,SAAS,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;YAC/D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,UAAU,CAAA;QAEd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAoB,EAAE,QAA8B,EAC5B,EAAE;IAC1B,IAAI,MAAM,GAA0B,qBAAqB,CAAC,aAAa,CAAA;IAEvE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEjE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,2DAA2D;YAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAChD,CAAC;YACD,IAAI,MAAM,KAAK,qBAAqB,CAAC,aAAa,EAAE,CAAC;gBACnD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA"}

package/build/gate/types.d.ts

@@ -0,0 +1,109 @@
+import type { GateParamSource, GateParamErrorCode, GateResolutionFailure } from '../consts.js';
+/**
+ * The parts of a request a gate selector may read.
+ *
+ * Structural on purpose: `AbstractRequest` is assignable to it, so `@owlmeans/server-iam` passes its
+ * request straight through, while tooling outside the server stack can resolve a selector against a
+ * plain object without taking a dependency on `@owlmeans/entrypoint`.
+ */
+export interface GateRequestLike {
+    params?: unknown;
+    query?: unknown;
+    body?: unknown;
+    headers?: unknown;
+    auth?: unknown;
+}
+/** Where one gate param reads its resource id from. */
+export interface GateResourceSelector {
+    /** The selector text exactly as written, for diagnostics. */
+    readonly selector: string;
+    /** Undefined for the bare form, which searches `sources` in order. */
+    readonly source?: GateParamSource;
+    /** Length 1 and UNSPLIT for the bare form — a bare key may legally contain dots. */
+    readonly path: string[];
+    /** The explicit source, or `DEFAULT_GATE_PARAM_SOURCES`. */
+    readonly sources: GateParamSource[];
+}
+export interface GateParamProblem {
+    code: GateParamErrorCode;
+    detail: string;
+}
+export interface ParsedGateParam {
+    permission: string;
+    /**
+     * @deprecated The bare-form flat key, kept so existing readers keep compiling. Read `resource`,
+     * which carries the source and the path for both forms.
+     */
+    resourceParam?: string;
+    resource?: GateResourceSelector;
+    error?: GateParamProblem;
+}
+export interface GateResourceResolution {
+    id?: string;
+    from?: GateParamSource;
+    reason?: GateResolutionFailure;
+}
+/** What an entrypoint declares, so a selector can be checked against it before it is ever deployed. */
+export interface GateParamAudit {
+    routePath?: string;
+    routeParams?: string[];
+    filter?: {
+        query?: object;
+        params?: object;
+        body?: object;
+        headers?: object;
+    };
+}
+export interface GateParamIssue {
+    param: string;
+    code: GateParamErrorCode;
+    detail: string;
+}
+/** The gate-param grammar: `<permission>@<selector>` read, written and taken apart. */
+export interface GateParamHelper {
+    /**
+     * Read the `@…` half of a gate param.
+     *
+     * Two forms, and the difference between them is deliberate:
+     *
+     *   `@enquiryId`        — bare. A FLAT key, searched in `params` then `query`. It is never split on
+     *                         a dot, because a query key legally contains one and splitting it would
+     *                         change the meaning of selectors already deployed.
+     *   `@body:order.id`    — qualified. An explicit source and a nested path.
+     *
+     * The rule worth remembering: the bare form is lenient and flat, the qualified form is strict and
+     * nested.
+     */
+    parseGateSelector: (selector: string) => GateResourceSelector | GateParamProblem;
+    /**
+     * Split a gate param into the permission it checks and where the resource id comes from.
+     *
+     * Splits at the FIRST `@`. Everything before it is the permission name looked up in the subject's
+     * grants; everything after says where to read the resource id at request time. The suffix is the
+     * gate's syntax and nothing else's — a permission stored or granted under a name containing one is a
+     * key nothing ever looks up.
+     */
+    parseGateParam: (param: string) => ParsedGateParam;
+    /** Compose a gate param. The inverse of `parseGateParam` for every selector it accepts. */
+    formatGateParam: (permission: string, selector?: string | {
+        source?: GateParamSource;
+        path: string[];
+    }) => string;
+}
+/** Gate params checked against the entrypoint that declares them. */
+export interface GateValidationHelper {
+    /** The `:name` segments of a route template. */
+    routeParamsOf: (path: string) => string[];
+    /**
+     * Check gate params against what their entrypoint declares.
+     *
+     * Reports only what is provable from the declaration itself. Anything that would need a guess is
+     * left alone: a check that fires on correct code stops being read.
+     *
+     * Meant to run where a mistake can still be fixed — while code is being generated, or once per alias
+     * as a diagnostic. It must never decide a request: with `some()` semantics across params, one
+     * malformed sibling must not be able to refuse a legitimately passing one.
+     */
+    validateGateParams: (params: string[], audit?: GateParamAudit) => GateParamIssue[];
+}
+//# sourceMappingURL=types.d.ts.map

package/build/gate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/gate/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAE9F;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,oBAAoB,CAAA;IAC/B,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAC/B;AAED,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,oBAAoB,GAAG,gBAAgB,CAAA;IAChF;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,eAAe,CAAA;IAClD,2FAA2F;IAC3F,eAAe,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,KAC7D,MAAM,CAAA;CACZ;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;IACzC;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,cAAc,KAAK,cAAc,EAAE,CAAA;CACnF"}

package/build/gate/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/gate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/gate/types.ts"],"names":[],"mappings":""}

package/build/gate/types.local.d.ts

@@ -0,0 +1,5 @@
+export interface SchemaLike {
+    properties?: Record<string, unknown>;
+    additionalProperties?: unknown;
+}
+//# sourceMappingURL=types.local.d.ts.map

package/build/gate/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../../src/gate/types.local.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B"}

package/build/gate/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/gate/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../../src/gate/types.local.ts"],"names":[],"mappings":""}

package/build/gate/validate.d.ts

@@ -0,0 +1,4 @@
+import type { GateValidationHelper } from './types.js';
+export declare const createGateValidationHelper: () => GateValidationHelper;
+export declare const gateValidationHelper: GateValidationHelper;
+//# sourceMappingURL=validate.d.ts.map

package/build/gate/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAwD,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAI5G,eAAO,MAAM,0BAA0B,QAAO,oBAkH7C,CAAA;AAED,eAAO,MAAM,oBAAoB,sBAA+B,CAAA"}

package/build/gate/validate.js

@@ -0,0 +1,100 @@
+import { normalizePath, SEP, PARAM } from '@owlmeans/route';
+import { GateParamSource, GateParamErrorCode } from '../consts.js';
+import { gateParamHelper } from './param.js';
+export const createGateValidationHelper = () => {
+    const routeParamsOf = (path) => normalizePath(path).split(SEP)
+        .filter(segment => segment.startsWith(PARAM))
+        .map(segment => segment.slice(PARAM.length));
+    /**
+     * Whether a key can survive validation to reach the gate.
+     *
+     * The server compiles entrypoint filters with AJV's `removeAdditional`, which strips an undeclared
+     * key BEFORE the handler — and therefore before the gate — runs. So a selector naming a key the
+     * filter does not declare denies every request, with a clean build and nothing logged.
+     *
+     * The `additionalProperties === false` qualifier is what makes this check usable rather than noise:
+     * AJV only strips when a schema says so. An entrypoint that declares no filter for a source strips
+     * nothing, and reporting those would fire on nearly every endpoint and be ignored within a week.
+     */
+    const unreachable = (schema, key) => {
+        if (schema == null) {
+            return false;
+        }
+        const { properties, additionalProperties } = schema;
+        if (additionalProperties !== false) {
+            return false;
+        }
+        return properties == null || !(key in properties);
+    };
+    const filterFor = (audit, source) => {
+        switch (source) {
+            case GateParamSource.Query: return audit.filter?.query;
+            case GateParamSource.Body: return audit.filter?.body;
+            case GateParamSource.Headers: return audit.filter?.headers;
+            case GateParamSource.Params: return audit.filter?.params;
+            case GateParamSource.Auth: return undefined;
+        }
+    };
+    const auditSelector = (audit, selector) => {
+        const key = selector.path[0];
+        if (key == null) {
+            return null;
+        }
+        // The bare form searches route params first and the query second, so it is only provably wrong
+        // when BOTH are impossible. A declared route param settles it; otherwise fall through to the
+        // query check below, which only fires on an explicitly closed schema.
+        const routeParams = audit.routeParams
+            ?? (audit.routePath != null ? routeParamsOf(audit.routePath) : undefined);
+        if (selector.source == null) {
+            if (routeParams?.includes(key) === true) {
+                return null;
+            }
+            if (unreachable(audit.filter?.query, key) && unreachable(audit.filter?.params, key)) {
+                return {
+                    code: GateParamErrorCode.UnknownRouteParam,
+                    detail: `"${key}" is not a route param of "${audit.routePath ?? '?'}"`
+                        + ' and is declared by neither the params nor the query filter'
+                };
+            }
+            return null;
+        }
+        if (selector.source === GateParamSource.Params) {
+            if (routeParams != null && !routeParams.includes(key) && unreachable(audit.filter?.params, key)) {
+                return {
+                    code: GateParamErrorCode.UnknownRouteParam,
+                    detail: `"${key}" is not a route param of "${audit.routePath ?? '?'}"`
+                };
+            }
+            return null;
+        }
+        if (unreachable(filterFor(audit, selector.source), key)) {
+            return {
+                code: GateParamErrorCode.UnreachableKey,
+                detail: `the ${selector.source} filter declares no "${key}" and forbids additional properties,`
+                    + ' so it is removed by validation before the gate can read it'
+            };
+        }
+        return null;
+    };
+    const validateGateParams = (params, audit) => {
+        const issues = [];
+        for (const param of params) {
+            const parsed = gateParamHelper.parseGateParam(param);
+            if (parsed.error != null) {
+                issues.push({ param, code: parsed.error.code, detail: parsed.error.detail });
+                continue;
+            }
+            if (parsed.resource == null || audit == null) {
+                continue;
+            }
+            const issue = auditSelector(audit, parsed.resource);
+            if (issue != null) {
+                issues.push({ param, ...issue });
+            }
+        }
+        return issues;
+    };
+    return { routeParamsOf, validateGateParams };
+};
+export const gateValidationHelper = createGateValidationHelper();
+//# sourceMappingURL=validate.js.map

package/build/gate/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAG5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAyB,EAAE;IACnE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE,CAC/C,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC5C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhD;;;;;;;;;;OAUG;IACH,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAW,EAAE;QACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAoB,CAAA;QACjE,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;YACnC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;IACnD,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAqB,EAAE,MAAuB,EAAsB,EAAE;QACvF,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAA;YACtD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAA;YACpD,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,CAAA;YAC1D,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAA;YACxD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,SAAS,CAAA;QAC7C,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CACpB,KAAqB,EAAE,QAA8B,EACf,EAAE;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,+FAA+F;QAC/F,6FAA6F;QAC7F,sEAAsE;QACtE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;eAChC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAE3E,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5B,IAAI,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpF,OAAO;oBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;oBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;0BAClE,6DAA6D;iBAClE,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChG,OAAO;oBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;oBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;iBACvE,CAAA;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;gBACvC,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,wBAAwB,GAAG,sCAAsC;sBAC3F,6DAA6D;aAClE,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,CAAC,MAAgB,EAAE,KAAsB,EAAoB,EAAE;QACxF,MAAM,MAAM,GAAqB,EAAE,CAAA;QAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YAEpD,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC5E,SAAQ;YACV,CAAC;YAED,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC7C,SAAQ;YACV,CAAC;YAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,EAAE,CAAA"}

package/build/index.d.ts

@@ -1,5 +1,14 @@
 export type * from './types.js';
+export type * from './gate/types.js';
+export type * from './permission/types.js';
+export type * from './runtime/types.js';
+export type * from './utils/types.js';
 export * from './consts.js';
 export * from './errors.js';
 export * from './utils.js';
+export * from './facet.js';
+export * from './gate/index.js';
+export * from './permission.js';
+export * from './runtime.js';
+export { IamRuntimeOrganizationSchema, IamRuntimeOrganizationListSchema, IamRuntimeMemberSchema, IamRuntimeMemberListSchema, IamRuntimeMemberUpdateSchema, IamRuntimePermissionSchema, IamRuntimePermissionListSchema, IamRuntimeGrantSchema, IamRuntimeGrantListSchema, IamRuntimeGrantRequestSchema } from './schemas.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,iBAAiB,CAAA;AACpC,mBAAmB,uBAAuB,CAAA;AAC1C,mBAAmB,oBAAoB,CAAA;AACvC,mBAAmB,kBAAkB,CAAA;AACrC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA"}

package/build/index.js

@@ -1,4 +1,9 @@
 export * from './consts.js';
 export * from './errors.js';
 export * from './utils.js';
+export * from './facet.js';
+export * from './gate/index.js';
+export * from './permission.js';
+export * from './runtime.js';
+export { IamRuntimeOrganizationSchema, IamRuntimeOrganizationListSchema, IamRuntimeMemberSchema, IamRuntimeMemberListSchema, IamRuntimeMemberUpdateSchema, IamRuntimePermissionSchema, IamRuntimePermissionListSchema, IamRuntimeGrantSchema, IamRuntimeGrantListSchema, IamRuntimeGrantRequestSchema } from './schemas.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA"}

package/build/permission/types.d.ts

@@ -0,0 +1,35 @@
+import type { GateParamProblem } from '../gate/types.js';
+/** A permission NAME taken apart. Never carries a selector — `@` is the gate's syntax alone. */
+export interface ParsedPermissionName {
+    /** The whole name, exactly as it must be stored and granted. */
+    name: string;
+    /** What IAM stores as `resource`. The whole name when there is no action separator. */
+    resource: string;
+    /** What IAM stores as `action`. Absent for a bare, unsplittable legacy name. */
+    action?: string;
+    /** Set when the argument carried an `@` — which a NAME never legally does. */
+    problem?: GateParamProblem;
+}
+/** Permission NAMES: `<resource>--<action>`, never carrying a gate selector. */
+export interface PermissionNameHelper {
+    /**
+     * Read a permission NAME.
+     *
+     * The name is `<resource>--<action>`, with TWO hyphens. One hyphen is not a separator: `enquiry-view`
+     * is a resource called `enquiry-view` carrying no action, and it must keep parsing that way — a name
+     * already granted somewhere cannot be re-interpreted without orphaning the grant.
+     *
+     * A name never carries a gate selector. `@` is the gate's syntax, and a name containing one is
+     * exactly the corruption this function exists to make visible, so it is reported through `problem`
+     * rather than quietly split.
+     */
+    parsePermissionName: (name: string) => ParsedPermissionName;
+    /** Compose a permission name. The inverse of `parsePermissionName`. */
+    composePermissionName: (parts: {
+        resource: string;
+        action?: string;
+    }) => string;
+    /** True when the value is a usable permission name — well-formed and carrying no gate selector. */
+    isPermissionName: (value: string) => boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,oBAAoB,CAAA;IAC3D,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAA;IAC/E,mGAAmG;IACnG,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;CAC7C"}

package/build/permission/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/permission/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":""}

package/build/permission.d.ts

@@ -0,0 +1,8 @@
+import type { ParsedPermissionName, PermissionNameHelper } from './permission/types.js';
+export declare const createPermissionNameHelper: () => PermissionNameHelper;
+export declare const permissionNameHelper: PermissionNameHelper;
+/** @deprecated compat:factory-refactor — use `permissionNameHelper.parsePermissionName(…)` */
+export declare const parsePermissionName: (name: string) => ParsedPermissionName;
+/** @deprecated compat:factory-refactor — use `permissionNameHelper.isPermissionName(…)` */
+export declare const isPermissionName: (value: string) => boolean;
+//# sourceMappingURL=permission.d.ts.map

package/build/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEvF,eAAO,MAAM,0BAA0B,QAAO,oBAmC7C,CAAA;AAED,eAAO,MAAM,oBAAoB,sBAA+B,CAAA;AAEhE,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,oBACH,CAAA;AAEhD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,OAAuD,CAAA"}

package/build/permission.js

@@ -0,0 +1,34 @@
+import { PERMISSION_ACTION_SEPARATOR, RESOURCE_PARAM_SEPARATOR, GateParamErrorCode } from './consts.js';
+export const createPermissionNameHelper = () => {
+    const parsePermissionName = (name) => {
+        const problem = name.includes(RESOURCE_PARAM_SEPARATOR)
+            ? {
+                code: GateParamErrorCode.UnreachableKey,
+                detail: `"${name}" carries a gate selector; "${RESOURCE_PARAM_SEPARATOR}" is never part of a`
+                    + ' permission name, and nothing ever looks up a name that contains one'
+            }
+            : undefined;
+        const idx = name.indexOf(PERMISSION_ACTION_SEPARATOR);
+        if (idx < 0) {
+            return { name, resource: name, ...(problem != null ? { problem } : {}) };
+        }
+        const action = name.slice(idx + PERMISSION_ACTION_SEPARATOR.length);
+        return {
+            name,
+            resource: name.slice(0, idx),
+            ...(action !== '' ? { action } : {}),
+            ...(problem != null ? { problem } : {})
+        };
+    };
+    const composePermissionName = (parts) => parts.action == null || parts.action === ''
+        ? parts.resource
+        : `${parts.resource}${PERMISSION_ACTION_SEPARATOR}${parts.action}`;
+    const isPermissionName = (value) => value !== '' && !value.includes(RESOURCE_PARAM_SEPARATOR);
+    return { parsePermissionName, composePermissionName, isPermissionName };
+};
+export const permissionNameHelper = createPermissionNameHelper();
+/** @deprecated compat:factory-refactor — use `permissionNameHelper.parsePermissionName(…)` */
+export const parsePermissionName = (name) => permissionNameHelper.parsePermissionName(name);
+/** @deprecated compat:factory-refactor — use `permissionNameHelper.isPermissionName(…)` */
+export const isPermissionName = (value) => permissionNameHelper.isPermissionName(value);
+//# sourceMappingURL=permission.js.map

package/build/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGvG,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAyB,EAAE;IACnE,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAwB,EAAE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACrD,CAAC,CAAC;gBACA,IAAI,EAAE,kBAAkB,CAAC,cAAc;gBACvC,MAAM,EAAE,IAAI,IAAI,+BAA+B,wBAAwB,sBAAsB;sBACzF,sEAAsE;aAC3E;YACD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;QACrD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;QAEnE,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5B,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC,CAAA;IAED,MAAM,qBAAqB,GAAG,CAC5B,KAA4C,EACpC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QACtD,CAAC,CAAC,KAAK,CAAC,QAAQ;QAChB,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,GAAG,2BAA2B,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;IAEpE,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAClD,KAAK,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAE3D,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,EAAE,CAAA;AAEhE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAwB,EAAE,CACxE,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA"}

package/build/runtime/types.d.ts

@@ -0,0 +1,90 @@
+import type { IamDefaultClass, IamGrantMode, IamGrantOrigin } from '../consts.js';
+/** One organization of the calling subject. */
+export interface IamRuntimeOrganization {
+    entitySlug: string;
+    title?: string;
+    owner: boolean;
+    groups?: string[];
+    home?: boolean;
+}
+export interface IamRuntimeOrganizationList {
+    items: IamRuntimeOrganization[];
+}
+export interface IamRuntimeOrganizationCreate {
+    title?: string;
+}
+export interface IamRuntimeOrganizationUpdate {
+    title: string;
+}
+export interface IamRuntimeOrganizationParams {
+    entitySlug: string;
+}
+export interface IamRuntimeMember {
+    profileId: string;
+    email?: string;
+    name?: string;
+    owner: boolean;
+    groups: string[];
+    managed?: boolean;
+}
+export interface IamRuntimeMemberList {
+    items: IamRuntimeMember[];
+}
+/** Find-or-create by e-mail; adding someone twice answers the same member. */
+export interface IamRuntimeMemberInvite {
+    email: string;
+    name?: string;
+    owner?: boolean;
+}
+export interface IamRuntimeMemberUpdate {
+    owner?: boolean;
+    groups?: string[];
+}
+export interface IamRuntimeMemberParams {
+    entitySlug: string;
+    profileId: string;
+}
+/** A definition of the calling client that can be granted in an organization. */
+export interface IamRuntimePermission {
+    name: string;
+    title?: string;
+    area?: string;
+    resourceScoped?: boolean;
+    managed?: boolean;
+    defaultClass?: IamDefaultClass;
+}
+export interface IamRuntimePermissionList {
+    items: IamRuntimePermission[];
+}
+/** A grant of a member in the organization; `through` names the group a `Group`-origin one comes from. */
+export interface IamRuntimeGrant {
+    profileId: string;
+    permission: string;
+    resources?: string[];
+    mode?: IamGrantMode;
+    origin?: IamGrantOrigin;
+    through?: string;
+}
+export interface IamRuntimeGrantList {
+    items: IamRuntimeGrant[];
+}
+export interface IamRuntimeGrantQuery {
+    profileId?: string;
+}
+/** Grant or revoke. The binding is the path's organization — the body cannot name another. */
+export interface IamRuntimeGrantRequest {
+    profileId: string;
+    permission: string;
+    resources?: string[];
+    mode?: IamGrantMode;
+}
+export interface IamRuntimeAck {
+    ok: boolean;
+}
+export interface IamRuntimeProtocolOptions {
+    /** The service alias that serves the API — every route, the base included, is pinned to it. */
+    service: string;
+    /** The base path under that service. Defaults to `IAM_RUNTIME_PATH`. */
+    path?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAEjF,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,EAAE,CAAA;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,gBAAgB,EAAE,CAAA;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,eAAe,CAAA;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,IAAI,CAAC,EAAE,YAAY,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;CACZ;AAED,MAAM,WAAW,yBAAyB;IACxC,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd"}

package/build/runtime/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/runtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":""}