@structured-id/ids 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,368 @@
+import { MessageType } from '@protobuf-ts/runtime';
+
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/errors.ts
+function describe(reason) {
+  switch (reason.type) {
+    case "malformed":
+      return "not a UUID";
+    case "length":
+      return `${reason.length} bytes, expected 16`;
+    case "nil":
+      return "the nil UUID";
+    case "max":
+      return "the max UUID";
+    case "variant":
+      return "not an RFC 4122 UUID";
+    case "version":
+      return `UUID version ${reason.version}, expected version 7`;
+  }
+}
+var IdError = class extends Error {
+  constructor(kind, reason) {
+    super(`invalid ${kind}: ${describe(reason)}`);
+    this.kind = kind;
+    this.reason = reason;
+  }
+  kind;
+  reason;
+  name = "IdError";
+};
+var MissingIdError = class extends Error {
+  constructor(kind) {
+    super(`missing ${kind}`);
+    this.kind = kind;
+  }
+  kind;
+  name = "MissingIdError";
+};
+
+// src/validate.ts
+function validate(bytes, kind) {
+  if (bytes.length !== 16) {
+    throw new IdError(kind, { type: "length", length: bytes.length });
+  }
+  let zero = true;
+  let ones = true;
+  for (const byte of bytes) {
+    zero &&= byte === 0;
+    ones &&= byte === 255;
+  }
+  if (zero) throw new IdError(kind, { type: "nil" });
+  if (ones) throw new IdError(kind, { type: "max" });
+  if ((bytes[8] & 192) !== 128) {
+    throw new IdError(kind, { type: "variant" });
+  }
+  const version = bytes[6] >> 4;
+  if (version !== 7) throw new IdError(kind, { type: "version", version });
+  return bytes.slice();
+}
+var HEX = /^[0-9a-fA-F]{32}$/;
+function parseText(text, kind) {
+  let body = text;
+  if (body.length === 45 && body.startsWith("urn:uuid:")) {
+    body = body.slice(9);
+  } else if (body.length === 38 && body.startsWith("{") && body.endsWith("}")) {
+    body = body.slice(1, 37);
+  }
+  let hex;
+  if (body.length === 36) {
+    if (body[8] !== "-" || body[13] !== "-" || body[18] !== "-" || body[23] !== "-") {
+      throw new IdError(kind, { type: "malformed" });
+    }
+    hex = body.slice(0, 8) + body.slice(9, 13) + body.slice(14, 18) + body.slice(19, 23) + body.slice(24);
+  } else if (body.length === 32 && text.length === 32) {
+    hex = body;
+  } else {
+    throw new IdError(kind, { type: "malformed" });
+  }
+  if (!HEX.test(hex)) throw new IdError(kind, { type: "malformed" });
+  const bytes = new Uint8Array(16);
+  for (let i = 0; i < 16; i++) {
+    bytes[i] = Number.parseInt(hex.slice(2 * i, 2 * i + 2), 16);
+  }
+  return bytes;
+}
+function formatText(bytes) {
+  let hex = "";
+  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+// src/ids.ts
+var Identifier = class _Identifier {
+  #bytes;
+  constructor(bytes) {
+    this.#bytes = bytes;
+  }
+  /** A copy of the 16 bytes in network order: the wire value. */
+  toBytes() {
+    return this.#bytes.slice();
+  }
+  /** Lowercase hyphenated text, for display only; the wire carries bytes. */
+  toString() {
+    return formatText(this.#bytes);
+  }
+  /** The same text as `toString`, so JSON logs show a readable value. */
+  toJSON() {
+    return this.toString();
+  }
+  /** True for an identifier of the same kind with the same bytes. */
+  equals(other) {
+    if (!(other instanceof _Identifier) || other.kind !== this.kind) return false;
+    const theirs = other.#bytes;
+    return this.#bytes.every((byte, i) => byte === theirs[i]);
+  }
+};
+var BindingId = class _BindingId extends Identifier {
+  static kind = "BindingId";
+  kind = "BindingId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _BindingId(validate(bytes, _BindingId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _BindingId.fromBytes(parseText(text, _BindingId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _BindingId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+var MachineUserId = class _MachineUserId extends Identifier {
+  static kind = "MachineUserId";
+  kind = "MachineUserId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _MachineUserId(validate(bytes, _MachineUserId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _MachineUserId.fromBytes(parseText(text, _MachineUserId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _MachineUserId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+var PasswordOperationId = class _PasswordOperationId extends Identifier {
+  static kind = "PasswordOperationId";
+  kind = "PasswordOperationId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _PasswordOperationId(validate(bytes, _PasswordOperationId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _PasswordOperationId.fromBytes(parseText(text, _PasswordOperationId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _PasswordOperationId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+var ProvisioningConnectorId = class _ProvisioningConnectorId extends Identifier {
+  static kind = "ProvisioningConnectorId";
+  kind = "ProvisioningConnectorId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _ProvisioningConnectorId(validate(bytes, _ProvisioningConnectorId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _ProvisioningConnectorId.fromBytes(parseText(text, _ProvisioningConnectorId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _ProvisioningConnectorId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+var ProvisioningCredentialId = class _ProvisioningCredentialId extends Identifier {
+  static kind = "ProvisioningCredentialId";
+  kind = "ProvisioningCredentialId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _ProvisioningCredentialId(validate(bytes, _ProvisioningCredentialId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _ProvisioningCredentialId.fromBytes(parseText(text, _ProvisioningCredentialId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _ProvisioningCredentialId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+var ResourceId = class _ResourceId extends Identifier {
+  static kind = "ResourceId";
+  kind = "ResourceId";
+  constructor(bytes) {
+    super(bytes);
+  }
+  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */
+  static fromBytes(bytes) {
+    return new _ResourceId(validate(bytes, _ResourceId.kind));
+  }
+  /** Accept a textual UUID as this identifier, or throw `IdError`. */
+  static parse(text) {
+    return _ResourceId.fromBytes(parseText(text, _ResourceId.kind));
+  }
+  /** Validate a decoded wire message; throws `IdError`. */
+  static fromWire(message) {
+    return _ResourceId.fromBytes(message.value);
+  }
+  /** The wire message carrying this identifier's bytes. */
+  toWire() {
+    return { value: this.toBytes() };
+  }
+};
+function required(type, message) {
+  if (message === void 0) throw new MissingIdError(type.kind);
+  return type.fromWire(message);
+}
+function optional(type, message) {
+  return message === void 0 ? void 0 : type.fromWire(message);
+}
+
+// src/generated/sid/v1/ids/ids.ts
+var ids_exports = {};
+__export(ids_exports, {
+  BindingId: () => BindingId2,
+  MachineUserId: () => MachineUserId2,
+  PasswordOperationId: () => PasswordOperationId2,
+  ProvisioningConnectorId: () => ProvisioningConnectorId2,
+  ProvisioningCredentialId: () => ProvisioningCredentialId2,
+  ResourceId: () => ResourceId2
+});
+var BindingId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.BindingId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var BindingId2 = new BindingId$Type();
+var PasswordOperationId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.PasswordOperationId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var PasswordOperationId2 = new PasswordOperationId$Type();
+var MachineUserId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.MachineUserId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var MachineUserId2 = new MachineUserId$Type();
+var ProvisioningConnectorId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.ProvisioningConnectorId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var ProvisioningConnectorId2 = new ProvisioningConnectorId$Type();
+var ResourceId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.ResourceId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var ResourceId2 = new ResourceId$Type();
+var ProvisioningCredentialId$Type = class extends MessageType {
+  constructor() {
+    super("sid.v1.ids.ProvisioningCredentialId", [
+      {
+        no: 1,
+        name: "value",
+        kind: "scalar",
+        T: 12
+        /*ScalarType.BYTES*/
+      }
+    ]);
+  }
+};
+var ProvisioningCredentialId2 = new ProvisioningCredentialId$Type();
+
+// src/index.ts
+var PROTO_PATH = "sid/v1/ids/ids.proto";
+
+export { BindingId, IdError, MachineUserId, MissingIdError, PROTO_PATH, PasswordOperationId, ProvisioningConnectorId, ProvisioningCredentialId, ResourceId, optional, required, ids_exports as wire };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/validate.ts","../src/ids.ts","../src/generated/sid/v1/ids/ids.ts","../src/index.ts"],"names":["BindingId","MachineUserId","PasswordOperationId","ProvisioningConnectorId","ProvisioningCredentialId","ResourceId"],"mappings":";;;;;;;;;AAwBA,SAAS,SAAS,MAAA,EAA+B;AAC/C,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,WAAA;AACH,MAAA,OAAO,YAAA;AAAA,IACT,KAAK,QAAA;AACH,MAAA,OAAO,CAAA,EAAG,OAAO,MAAM,CAAA,mBAAA,CAAA;AAAA,IACzB,KAAK,KAAA;AACH,MAAA,OAAO,cAAA;AAAA,IACT,KAAK,KAAA;AACH,MAAA,OAAO,cAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,sBAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,CAAA,aAAA,EAAgB,OAAO,OAAO,CAAA,oBAAA,CAAA;AAAA;AAE3C;AAMO,IAAM,OAAA,GAAN,cAAsB,KAAA,CAAM;AAAA,EAGjC,WAAA,CACW,MACA,MAAA,EACT;AACA,IAAA,KAAA,CAAM,WAAW,IAAI,CAAA,EAAA,EAAK,QAAA,CAAS,MAAM,CAAC,CAAA,CAAE,CAAA;AAHnC,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAGX;AAAA,EAJW,IAAA;AAAA,EACA,MAAA;AAAA,EAJO,IAAA,GAAO,SAAA;AAQ3B;AAGO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAGxC,YAAqB,IAAA,EAAc;AACjC,IAAA,KAAA,CAAM,CAAA,QAAA,EAAW,IAAI,CAAA,CAAE,CAAA;AADJ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAErB;AAAA,EAFqB,IAAA;AAAA,EAFH,IAAA,GAAO,gBAAA;AAK3B;;;ACxDO,SAAS,QAAA,CAAS,OAAmB,IAAA,EAA0B;AACpE,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,MAAM,IAAI,QAAQ,IAAA,EAAM,EAAE,MAAM,QAAA,EAAU,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAA,KAAS,IAAA,KAAS,CAAA;AAClB,IAAA,IAAA,KAAS,IAAA,KAAS,GAAA;AAAA,EACpB;AACA,EAAA,IAAI,IAAA,QAAY,IAAI,OAAA,CAAQ,MAAM,EAAE,IAAA,EAAM,OAAO,CAAA;AACjD,EAAA,IAAI,IAAA,QAAY,IAAI,OAAA,CAAQ,MAAM,EAAE,IAAA,EAAM,OAAO,CAAA;AAEjD,EAAA,IAAA,CAAM,KAAA,CAAM,CAAC,CAAA,GAAe,GAAA,MAAU,GAAA,EAAM;AAC1C,IAAA,MAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,IAAA,EAAM,WAAW,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,OAAA,GAAW,KAAA,CAAM,CAAC,CAAA,IAAgB,CAAA;AACxC,EAAA,IAAI,OAAA,KAAY,CAAA,EAAG,MAAM,IAAI,OAAA,CAAQ,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,OAAA,EAAS,CAAA;AACvE,EAAA,OAAO,MAAM,KAAA,EAAM;AACrB;AAEA,IAAM,GAAA,GAAM,mBAAA;AAQL,SAAS,SAAA,CAAU,MAAc,IAAA,EAA0B;AAChE,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,IAAI,KAAK,MAAA,KAAW,EAAA,IAAM,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA,EAAG;AACtD,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,EACrB,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,KAAW,EAAA,IAAM,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC3E,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EACzB;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACtB,IAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,IAAO,KAAK,EAAE,CAAA,KAAM,GAAA,IAAO,IAAA,CAAK,EAAE,CAAA,KAAM,GAAA,IAAO,IAAA,CAAK,EAAE,MAAM,GAAA,EAAK;AAC/E,MAAA,MAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IAC/C;AACA,IAAA,GAAA,GACE,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,IACf,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAChB,IAAA,CAAK,MAAM,EAAA,EAAI,EAAE,IACjB,IAAA,CAAK,KAAA,CAAM,IAAI,EAAE,CAAA,GACjB,IAAA,CAAK,KAAA,CAAM,EAAE,CAAA;AAAA,EACjB,WAAW,IAAA,CAAK,MAAA,KAAW,EAAA,IAAM,IAAA,CAAK,WAAW,EAAA,EAAI;AACnD,IAAA,GAAA,GAAM,IAAA;AAAA,EACR,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,EAAG,MAAM,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,IAAA,EAAM,WAAA,EAAa,CAAA;AACjE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,WAAW,KAAA,EAA2B;AACpD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,IAAA,IAAQ,OAAO,GAAA,IAAO,IAAA,CAAK,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAClE,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAC1G;;;AC3DA,IAAe,UAAA,GAAf,MAAe,WAAA,CAAW;AAAA,EAEf,MAAA;AAAA,EAEC,YAAY,KAAA,EAAmB;AACvC,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,OAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EAC3B;AAAA;AAAA,EAGA,QAAA,GAAmB;AACjB,IAAA,OAAO,UAAA,CAAW,KAAK,MAAM,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAA,GAAiB;AACf,IAAA,OAAO,KAAK,QAAA,EAAS;AAAA,EACvB;AAAA;AAAA,EAGA,OAAO,KAAA,EAAyB;AAC9B,IAAA,IAAI,EAAE,KAAA,YAAiB,WAAA,CAAA,IAAe,MAAM,IAAA,KAAS,IAAA,CAAK,MAAM,OAAO,KAAA;AACvE,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AACrB,IAAA,OAAO,IAAA,CAAK,OAAO,KAAA,CAAM,CAAC,MAAM,CAAA,KAAM,IAAA,KAAS,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EAC1D;AACF,CAAA;AAMO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,UAAA,CAAW;AAAA,EACxC,OAAgB,IAAA,GAAO,WAAA;AAAA,EACd,IAAA,GAAO,WAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAA8B;AAC7C,IAAA,OAAO,IAAI,UAAA,CAAU,QAAA,CAAS,KAAA,EAAO,UAAA,CAAU,IAAI,CAAC,CAAA;AAAA,EACtD;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAAyB;AACpC,IAAA,OAAO,WAAU,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,UAAA,CAAU,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAAoC;AAClD,IAAA,OAAO,UAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,MAAA,GAAyB;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAMO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,UAAA,CAAW;AAAA,EAC5C,OAAgB,IAAA,GAAO,eAAA;AAAA,EACd,IAAA,GAAO,eAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAAkC;AACjD,IAAA,OAAO,IAAI,cAAA,CAAc,QAAA,CAAS,KAAA,EAAO,cAAA,CAAc,IAAI,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAA6B;AACxC,IAAA,OAAO,eAAc,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,cAAA,CAAc,IAAI,CAAC,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAA4C;AAC1D,IAAA,OAAO,cAAA,CAAc,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,MAAA,GAA6B;AAC3B,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAOO,IAAM,mBAAA,GAAN,MAAM,oBAAA,SAA4B,UAAA,CAAW;AAAA,EAClD,OAAgB,IAAA,GAAO,qBAAA;AAAA,EACd,IAAA,GAAO,qBAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAAwC;AACvD,IAAA,OAAO,IAAI,oBAAA,CAAoB,QAAA,CAAS,KAAA,EAAO,oBAAA,CAAoB,IAAI,CAAC,CAAA;AAAA,EAC1E;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAAmC;AAC9C,IAAA,OAAO,qBAAoB,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,oBAAA,CAAoB,IAAI,CAAC,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAAwD;AACtE,IAAA,OAAO,oBAAA,CAAoB,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAA,GAAmC;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAMO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgC,UAAA,CAAW;AAAA,EACtD,OAAgB,IAAA,GAAO,yBAAA;AAAA,EACd,IAAA,GAAO,yBAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAA4C;AAC3D,IAAA,OAAO,IAAI,wBAAA,CAAwB,QAAA,CAAS,KAAA,EAAO,wBAAA,CAAwB,IAAI,CAAC,CAAA;AAAA,EAClF;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAAuC;AAClD,IAAA,OAAO,yBAAwB,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,wBAAA,CAAwB,IAAI,CAAC,CAAA;AAAA,EACxF;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAAgE;AAC9E,IAAA,OAAO,wBAAA,CAAwB,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EACxD;AAAA;AAAA,EAGA,MAAA,GAAuC;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAMO,IAAM,wBAAA,GAAN,MAAM,yBAAA,SAAiC,UAAA,CAAW;AAAA,EACvD,OAAgB,IAAA,GAAO,0BAAA;AAAA,EACd,IAAA,GAAO,0BAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAA6C;AAC5D,IAAA,OAAO,IAAI,yBAAA,CAAyB,QAAA,CAAS,KAAA,EAAO,yBAAA,CAAyB,IAAI,CAAC,CAAA;AAAA,EACpF;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAAwC;AACnD,IAAA,OAAO,0BAAyB,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,yBAAA,CAAyB,IAAI,CAAC,CAAA;AAAA,EAC1F;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAAkE;AAChF,IAAA,OAAO,yBAAA,CAAyB,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EACzD;AAAA;AAAA,EAGA,MAAA,GAAwC;AACtC,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAMO,IAAM,UAAA,GAAN,MAAM,WAAA,SAAmB,UAAA,CAAW;AAAA,EACzC,OAAgB,IAAA,GAAO,YAAA;AAAA,EACd,IAAA,GAAO,YAAA;AAAA,EAER,YAAY,KAAA,EAAmB;AACrC,IAAA,KAAA,CAAM,KAAK,CAAA;AAAA,EACb;AAAA;AAAA,EAGA,OAAO,UAAU,KAAA,EAA+B;AAC9C,IAAA,OAAO,IAAI,WAAA,CAAW,QAAA,CAAS,KAAA,EAAO,WAAA,CAAW,IAAI,CAAC,CAAA;AAAA,EACxD;AAAA;AAAA,EAGA,OAAO,MAAM,IAAA,EAA0B;AACrC,IAAA,OAAO,YAAW,SAAA,CAAU,SAAA,CAAU,IAAA,EAAM,WAAA,CAAW,IAAI,CAAC,CAAA;AAAA,EAC9D;AAAA;AAAA,EAGA,OAAO,SAAS,OAAA,EAAsC;AACpD,IAAA,OAAO,WAAA,CAAW,SAAA,CAAU,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC3C;AAAA;AAAA,EAGA,MAAA,GAA0B;AACxB,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,OAAA,EAAQ,EAAE;AAAA,EACjC;AACF;AAYO,SAAS,QAAA,CAAe,MAAoB,OAAA,EAA2B;AAC5E,EAAA,IAAI,YAAY,MAAA,EAAW,MAAM,IAAI,cAAA,CAAe,KAAK,IAAI,CAAA;AAC7D,EAAA,OAAO,IAAA,CAAK,SAAS,OAAO,CAAA;AAC9B;AAOO,SAAS,QAAA,CAAe,MAAoB,OAAA,EAAuC;AACxF,EAAA,OAAO,OAAA,KAAY,MAAA,GAAY,MAAA,GAAY,IAAA,CAAK,SAAS,OAAO,CAAA;AAClE;;;AC1QA,IAAA,WAAA,GAAA;AAAA,QAAA,CAAA,WAAA,EAAA;AAAA,EAAA,SAAA,EAAA,MAAAA,UAAAA;AAAA,EAAA,aAAA,EAAA,MAAAC,cAAAA;AAAA,EAAA,mBAAA,EAAA,MAAAC,oBAAAA;AAAA,EAAA,uBAAA,EAAA,MAAAC,wBAAAA;AAAA,EAAA,wBAAA,EAAA,MAAAC,yBAAAA;AAAA,EAAA,UAAA,EAAA,MAAAC;AAAA,CAAA,CAAA;AA0GA,IAAM,cAAA,GAAN,cAA6B,WAAA,CAAuB;AAAA,EAChD,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,sBAAA,EAAwB;AAAA,MAC1B;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAML,UAAAA,GAAY,IAAI,cAAA,EAAe;AAE5C,IAAM,wBAAA,GAAN,cAAuC,WAAA,CAAiC;AAAA,EACpE,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,gCAAA,EAAkC;AAAA,MACpC;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAME,oBAAAA,GAAsB,IAAI,wBAAA,EAAyB;AAEhE,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAA2B;AAAA,EACxD,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,0BAAA,EAA4B;AAAA,MAC9B;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAMD,cAAAA,GAAgB,IAAI,kBAAA,EAAmB;AAEpD,IAAM,4BAAA,GAAN,cAA2C,WAAA,CAAqC;AAAA,EAC5E,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,oCAAA,EAAsC;AAAA,MACxC;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAME,wBAAAA,GAA0B,IAAI,4BAAA,EAA6B;AAExE,IAAM,eAAA,GAAN,cAA8B,WAAA,CAAwB;AAAA,EAClD,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,uBAAA,EAAyB;AAAA,MAC3B;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAME,WAAAA,GAAa,IAAI,eAAA,EAAgB;AAE9C,IAAM,6BAAA,GAAN,cAA4C,WAAA,CAAsC;AAAA,EAC9E,WAAA,GAAc;AACV,IAAA,KAAA,CAAM,qCAAA,EAAuC;AAAA,MACzC;AAAA,QAAE,EAAA,EAAI,CAAA;AAAA,QAAG,IAAA,EAAM,OAAA;AAAA,QAAS,IAAA,EAAM,QAAA;AAAA,QAAU,CAAA,EAAG;AAAA;AAAA;AAAwB,KACtE,CAAA;AAAA,EACL;AACJ,CAAA;AAIO,IAAMD,yBAAAA,GAA2B,IAAI,6BAAA,EAA8B;;;ACxJnE,IAAM,UAAA,GAAa","file":"index.js","sourcesContent":["/** The identifier kinds this package delivers: one per `sid.v1.ids` message. */\nexport type IdKind =\n  | \"BindingId\"\n  | \"MachineUserId\"\n  | \"PasswordOperationId\"\n  | \"ProvisioningConnectorId\"\n  | \"ProvisioningCredentialId\"\n  | \"ResourceId\";\n\n/** Why a value is not a valid identifier. */\nexport type IdErrorReason =\n  /** The text is not a UUID in any accepted textual form. */\n  | { readonly type: \"malformed\" }\n  /** Binary form of a length other than 16 bytes. */\n  | { readonly type: \"length\"; readonly length: number }\n  /** The nil UUID (all zero bits). */\n  | { readonly type: \"nil\" }\n  /** The max UUID (all one bits). */\n  | { readonly type: \"max\" }\n  /** The variant bits are not those of RFC 9562. */\n  | { readonly type: \"variant\" }\n  /** An RFC 9562 UUID of a version other than 7. */\n  | { readonly type: \"version\"; readonly version: number };\n\nfunction describe(reason: IdErrorReason): string {\n  switch (reason.type) {\n    case \"malformed\":\n      return \"not a UUID\";\n    case \"length\":\n      return `${reason.length} bytes, expected 16`;\n    case \"nil\":\n      return \"the nil UUID\";\n    case \"max\":\n      return \"the max UUID\";\n    case \"variant\":\n      return \"not an RFC 4122 UUID\";\n    case \"version\":\n      return `UUID version ${reason.version}, expected version 7`;\n  }\n}\n\n/**\n * A value that is not a valid identifier of the requested kind. Carries the\n * kind and the reason, never the value, so it can be logged freely.\n */\nexport class IdError extends Error {\n  override readonly name = \"IdError\";\n\n  constructor(\n    readonly kind: IdKind,\n    readonly reason: IdErrorReason,\n  ) {\n    super(`invalid ${kind}: ${describe(reason)}`);\n  }\n}\n\n/** A required identifier message was absent. Absence is never a default. */\nexport class MissingIdError extends Error {\n  override readonly name = \"MissingIdError\";\n\n  constructor(readonly kind: IdKind) {\n    super(`missing ${kind}`);\n  }\n}\n","import { IdError, type IdKind } from \"./errors\";\n\n/**\n * The only accepted shape: exactly 16 bytes of a non-nil, non-max UUID of\n * the RFC 9562 variant and version 7 (RFC 9562 sections 4.1, 4.2, 5.7, 5.9,\n * 5.10). Returns a copy, so later changes to the input cannot reach it.\n */\nexport function validate(bytes: Uint8Array, kind: IdKind): Uint8Array {\n  if (bytes.length !== 16) {\n    throw new IdError(kind, { type: \"length\", length: bytes.length });\n  }\n  let zero = true;\n  let ones = true;\n  for (const byte of bytes) {\n    zero &&= byte === 0x00;\n    ones &&= byte === 0xff;\n  }\n  if (zero) throw new IdError(kind, { type: \"nil\" });\n  if (ones) throw new IdError(kind, { type: \"max\" });\n  // RFC 9562 4.1: the variant is the top bits of octet 8; this one is 10.\n  if (((bytes[8] as number) & 0xc0) !== 0x80) {\n    throw new IdError(kind, { type: \"variant\" });\n  }\n  // RFC 9562 4.2: the version is the high nibble of octet 6.\n  const version = (bytes[6] as number) >> 4;\n  if (version !== 7) throw new IdError(kind, { type: \"version\", version });\n  return bytes.slice();\n}\n\nconst HEX = /^[0-9a-fA-F]{32}$/;\n\n/**\n * The 16 bytes of a textual UUID: hyphenated, simple (32 hex digits), braced\n * hyphenated or `urn:uuid:` hyphenated (RFC 9562 section 4), the forms the\n * Rust `sid-ids` parser accepts. Text is a presentation form; the wire\n * carries bytes.\n */\nexport function parseText(text: string, kind: IdKind): Uint8Array {\n  let body = text;\n  if (body.length === 45 && body.startsWith(\"urn:uuid:\")) {\n    body = body.slice(9);\n  } else if (body.length === 38 && body.startsWith(\"{\") && body.endsWith(\"}\")) {\n    body = body.slice(1, 37);\n  }\n  let hex: string;\n  if (body.length === 36) {\n    if (body[8] !== \"-\" || body[13] !== \"-\" || body[18] !== \"-\" || body[23] !== \"-\") {\n      throw new IdError(kind, { type: \"malformed\" });\n    }\n    hex =\n      body.slice(0, 8) +\n      body.slice(9, 13) +\n      body.slice(14, 18) +\n      body.slice(19, 23) +\n      body.slice(24);\n  } else if (body.length === 32 && text.length === 32) {\n    hex = body;\n  } else {\n    throw new IdError(kind, { type: \"malformed\" });\n  }\n  if (!HEX.test(hex)) throw new IdError(kind, { type: \"malformed\" });\n  const bytes = new Uint8Array(16);\n  for (let i = 0; i < 16; i++) {\n    bytes[i] = Number.parseInt(hex.slice(2 * i, 2 * i + 2), 16);\n  }\n  return bytes;\n}\n\n/** Lowercase hyphenated form (RFC 9562 section 4). */\nexport function formatText(bytes: Uint8Array): string {\n  let hex = \"\";\n  for (const byte of bytes) hex += byte.toString(16).padStart(2, \"0\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n","import type { IdKind } from \"./errors\";\nimport { MissingIdError } from \"./errors\";\nimport type * as wire from \"./generated/sid/v1/ids/ids\";\nimport { formatText, parseText, validate } from \"./validate\";\n\n/**\n * The common behaviour of every identifier. A value is always a valid UUIDv7:\n * it is built only through validation and its bytes are private. Each kind is\n * its own class with a literal `kind`, so values of different kinds are\n * different types even when their bytes are equal.\n *\n * A valid identifier proves only its shape. It does not prove that the entity\n * exists, whom it belongs to, or that the caller may act on it.\n */\nabstract class Identifier {\n  abstract readonly kind: IdKind;\n  readonly #bytes: Uint8Array;\n\n  protected constructor(bytes: Uint8Array) {\n    this.#bytes = bytes;\n  }\n\n  /** A copy of the 16 bytes in network order: the wire value. */\n  toBytes(): Uint8Array {\n    return this.#bytes.slice();\n  }\n\n  /** Lowercase hyphenated text, for display only; the wire carries bytes. */\n  toString(): string {\n    return formatText(this.#bytes);\n  }\n\n  /** The same text as `toString`, so JSON logs show a readable value. */\n  toJSON(): string {\n    return this.toString();\n  }\n\n  /** True for an identifier of the same kind with the same bytes. */\n  equals(other: unknown): boolean {\n    if (!(other instanceof Identifier) || other.kind !== this.kind) return false;\n    const theirs = other.#bytes;\n    return this.#bytes.every((byte, i) => byte === theirs[i]);\n  }\n}\n\n/**\n * A Profile's identity at one organization: the pairwise subject that\n * organization's services see. Opaque and unlinkable across organizations.\n */\nexport class BindingId extends Identifier {\n  static readonly kind = \"BindingId\";\n  readonly kind = \"BindingId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): BindingId {\n    return new BindingId(validate(bytes, BindingId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): BindingId {\n    return BindingId.fromBytes(parseText(text, BindingId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.BindingId): BindingId {\n    return BindingId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.BindingId {\n    return { value: this.toBytes() };\n  }\n}\n\n/**\n * A non-human actor (a service, bot or agent) with its own credentials. Not a\n * Binding, a Profile or a device, whatever its bytes.\n */\nexport class MachineUserId extends Identifier {\n  static readonly kind = \"MachineUserId\";\n  readonly kind = \"MachineUserId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): MachineUserId {\n    return new MachineUserId(validate(bytes, MachineUserId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): MachineUserId {\n    return MachineUserId.fromBytes(parseText(text, MachineUserId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.MachineUserId): MachineUserId {\n    return MachineUserId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.MachineUserId {\n    return { value: this.toBytes() };\n  }\n}\n\n/**\n * One password-installing operation (a registration, change or authorized\n * reset) from its preparation to its commit. Every retry carries it, so a lost\n * response resolves to the operation's one outcome.\n */\nexport class PasswordOperationId extends Identifier {\n  static readonly kind = \"PasswordOperationId\";\n  readonly kind = \"PasswordOperationId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): PasswordOperationId {\n    return new PasswordOperationId(validate(bytes, PasswordOperationId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): PasswordOperationId {\n    return PasswordOperationId.fromBytes(parseText(text, PasswordOperationId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.PasswordOperationId): PasswordOperationId {\n    return PasswordOperationId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.PasswordOperationId {\n    return { value: this.toBytes() };\n  }\n}\n\n/**\n * A provisioning connector: one directory source or target acting as its own\n * actor with its own credentials and grants. Not a machine user or a Profile.\n */\nexport class ProvisioningConnectorId extends Identifier {\n  static readonly kind = \"ProvisioningConnectorId\";\n  readonly kind = \"ProvisioningConnectorId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): ProvisioningConnectorId {\n    return new ProvisioningConnectorId(validate(bytes, ProvisioningConnectorId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): ProvisioningConnectorId {\n    return ProvisioningConnectorId.fromBytes(parseText(text, ProvisioningConnectorId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.ProvisioningConnectorId): ProvisioningConnectorId {\n    return ProvisioningConnectorId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.ProvisioningConnectorId {\n    return { value: this.toBytes() };\n  }\n}\n\n/**\n * One credential of a provisioning connector: the reference listings,\n * rotations, revocations and audit records name. Never the secret itself.\n */\nexport class ProvisioningCredentialId extends Identifier {\n  static readonly kind = \"ProvisioningCredentialId\";\n  readonly kind = \"ProvisioningCredentialId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): ProvisioningCredentialId {\n    return new ProvisioningCredentialId(validate(bytes, ProvisioningCredentialId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): ProvisioningCredentialId {\n    return ProvisioningCredentialId.fromBytes(parseText(text, ProvisioningCredentialId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.ProvisioningCredentialId): ProvisioningCredentialId {\n    return ProvisioningCredentialId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.ProvisioningCredentialId {\n    return { value: this.toBytes() };\n  }\n}\n\n/**\n * A registered protected resource: the application or API at which access is\n * enforced, in its issuer's context. Not an OAuth client or an audience string.\n */\nexport class ResourceId extends Identifier {\n  static readonly kind = \"ResourceId\";\n  readonly kind = \"ResourceId\";\n\n  private constructor(bytes: Uint8Array) {\n    super(bytes);\n  }\n\n  /** Accept 16 bytes as this identifier, or throw `IdError` saying why not. */\n  static fromBytes(bytes: Uint8Array): ResourceId {\n    return new ResourceId(validate(bytes, ResourceId.kind));\n  }\n\n  /** Accept a textual UUID as this identifier, or throw `IdError`. */\n  static parse(text: string): ResourceId {\n    return ResourceId.fromBytes(parseText(text, ResourceId.kind));\n  }\n\n  /** Validate a decoded wire message; throws `IdError`. */\n  static fromWire(message: wire.ResourceId): ResourceId {\n    return ResourceId.fromBytes(message.value);\n  }\n\n  /** The wire message carrying this identifier's bytes. */\n  toWire(): wire.ResourceId {\n    return { value: this.toBytes() };\n  }\n}\n\n/** An identifier class: its kind and its checked wire conversion. */\nexport interface IdType<T, W> {\n  readonly kind: IdKind;\n  fromWire(message: W): T;\n}\n\n/**\n * The identifier in a required message field: absence throws\n * `MissingIdError`, an invalid value throws `IdError`.\n */\nexport function required<T, W>(type: IdType<T, W>, message: W | undefined): T {\n  if (message === undefined) throw new MissingIdError(type.kind);\n  return type.fromWire(message);\n}\n\n/**\n * The identifier in an optional message field: absence stays `undefined`, a\n * present but invalid value throws `IdError` (an empty message is invalid,\n * not absent).\n */\nexport function optional<T, W>(type: IdType<T, W>, message: W | undefined): T | undefined {\n  return message === undefined ? undefined : type.fromWire(message);\n}\n","// @generated by protobuf-ts 2.11.1 with parameter force_optimize_code_size\n// @generated from protobuf file \"sid/v1/ids/ids.proto\" (package \"sid.v1.ids\", syntax proto3)\n// tslint:disable\nimport { MessageType } from \"@protobuf-ts/runtime\";\n/**\n * A Profile's identity at one organization: the pairwise subject that\n * organization's services see. Opaque and unlinkable across organizations;\n * it never carries or reveals a ProfileId.\n *\n * @generated from protobuf message sid.v1.ids.BindingId\n */\nexport interface BindingId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n/**\n * One password-installing operation (a registration, change or authorized\n * reset) from its preparation to its commit. Every step and retry of the\n * operation carries it, so a lost response resolves to the operation's one\n * outcome instead of starting another.\n *\n * @generated from protobuf message sid.v1.ids.PasswordOperationId\n */\nexport interface PasswordOperationId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n/**\n * A non-human actor (a service, bot or agent) with its own SID credentials.\n * Not a Binding, a Profile or a device, whatever its bytes.\n *\n * @generated from protobuf message sid.v1.ids.MachineUserId\n */\nexport interface MachineUserId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n/**\n * A provisioning connector: one directory source sending SCIM to an\n * organization, or one target the organization provisions, acting as its own\n * actor with its own credentials and grants. Not a machine user or a Profile.\n *\n * @generated from protobuf message sid.v1.ids.ProvisioningConnectorId\n */\nexport interface ProvisioningConnectorId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n/**\n * A registered protected resource: the application or API at which access is\n * enforced, in its issuer's context. Not an OAuth client and not an audience\n * string; its indicator and issuer come from its registration.\n *\n * @generated from protobuf message sid.v1.ids.ResourceId\n */\nexport interface ResourceId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n/**\n * One credential of a provisioning connector: the reference listings,\n * rotations, revocations and audit records name. Never the secret itself.\n *\n * @generated from protobuf message sid.v1.ids.ProvisioningCredentialId\n */\nexport interface ProvisioningCredentialId {\n    /**\n     * Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,\n     * in network byte order. Nil, max, other lengths, versions and variants are\n     * invalid. Issued by SID; compared by exact byte equality.\n     *\n     * @generated from protobuf field: bytes value = 1\n     */\n    value: Uint8Array;\n}\n// @generated message type with reflection information, may provide speed optimized methods\nclass BindingId$Type extends MessageType<BindingId> {\n    constructor() {\n        super(\"sid.v1.ids.BindingId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.BindingId\n */\nexport const BindingId = new BindingId$Type();\n// @generated message type with reflection information, may provide speed optimized methods\nclass PasswordOperationId$Type extends MessageType<PasswordOperationId> {\n    constructor() {\n        super(\"sid.v1.ids.PasswordOperationId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.PasswordOperationId\n */\nexport const PasswordOperationId = new PasswordOperationId$Type();\n// @generated message type with reflection information, may provide speed optimized methods\nclass MachineUserId$Type extends MessageType<MachineUserId> {\n    constructor() {\n        super(\"sid.v1.ids.MachineUserId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.MachineUserId\n */\nexport const MachineUserId = new MachineUserId$Type();\n// @generated message type with reflection information, may provide speed optimized methods\nclass ProvisioningConnectorId$Type extends MessageType<ProvisioningConnectorId> {\n    constructor() {\n        super(\"sid.v1.ids.ProvisioningConnectorId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.ProvisioningConnectorId\n */\nexport const ProvisioningConnectorId = new ProvisioningConnectorId$Type();\n// @generated message type with reflection information, may provide speed optimized methods\nclass ResourceId$Type extends MessageType<ResourceId> {\n    constructor() {\n        super(\"sid.v1.ids.ResourceId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.ResourceId\n */\nexport const ResourceId = new ResourceId$Type();\n// @generated message type with reflection information, may provide speed optimized methods\nclass ProvisioningCredentialId$Type extends MessageType<ProvisioningCredentialId> {\n    constructor() {\n        super(\"sid.v1.ids.ProvisioningCredentialId\", [\n            { no: 1, name: \"value\", kind: \"scalar\", T: 12 /*ScalarType.BYTES*/ }\n        ]);\n    }\n}\n/**\n * @generated MessageType for protobuf message sid.v1.ids.ProvisioningCredentialId\n */\nexport const ProvisioningCredentialId = new ProvisioningCredentialId$Type();\n","/**\n * StructuredID identifiers for TypeScript.\n *\n * Each identifier kind is its own class (`BindingId`, `MachineUserId`, ...),\n * built only through validation: exactly 16 bytes of an RFC 9562 UUIDv7, not\n * nil or max. `wire` holds the generated `sid.v1.ids` messages with their\n * binary and standard ProtoJSON codecs; decoding one proves nothing, and the\n * checked conversion (`fromWire`, `required`, `optional`) validates it.\n */\nexport { IdError, MissingIdError, type IdErrorReason, type IdKind } from \"./errors\";\nexport {\n  BindingId,\n  MachineUserId,\n  PasswordOperationId,\n  ProvisioningConnectorId,\n  ProvisioningCredentialId,\n  ResourceId,\n  optional,\n  required,\n  type IdType,\n} from \"./ids\";\nexport * as wire from \"./generated/sid/v1/ids/ids\";\n\n/** The include-relative path of the identifier schema this package carries. */\nexport const PROTO_PATH = \"sid/v1/ids/ids.proto\";\n"]}

package/package.json

@@ -1,6 +1,81 @@
 {
   "name": "@structured-id/ids",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "type": "module",
+  "description": "StructuredID identifiers: one checked type per identifier kind, the sid.v1.ids wire messages and validated conversions between them.",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./schema/sid/v1/ids/ids.proto": "./schema/sid/v1/ids/ids.proto"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "schema": "node scripts/schema.mjs",
+    "generate": "node scripts/schema.mjs && buf generate schema",
+    "build": "yarn generate && tsup",
+    "test": "yarn generate && vitest run",
+    "lint": "yarn generate && eslint src/ tests/",
+    "typecheck": "yarn generate && tsc --noEmit",
+    "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.mjs\"",
+    "format:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" \"scripts/**/*.mjs\"",
+    "prepack": "yarn build"
+  },
+  "keywords": [
+    "structuredid",
+    "identifier",
+    "uuidv7",
+    "protobuf"
+  ],
+  "author": "StructuredID <oss@structured.id>",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/structured-id/sdk.git",
+    "directory": "typescript/packages/ids"
+  },
+  "bugs": {
+    "url": "https://github.com/structured-id/sdk/issues"
+  },
+  "homepage": "https://github.com/structured-id/sdk/tree/main/typescript/packages/ids#readme",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@protobuf-ts/runtime": "^2.11.1"
+  },
+  "devDependencies": {
+    "@bufbuild/buf": "^1.73.0",
+    "@eslint/js": "^10.0.1",
+    "@protobuf-ts/plugin": "^2.11.1",
+    "@types/node": "^26.6.3",
+    "eslint": "^10.11.0",
+    "prettier": "^3.9.9",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.71.0",
+    "vite": "^8",
+    "vitest": "^5.0.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/schema/sid/v1/ids/ids.proto

@@ -0,0 +1,68 @@
+syntax = "proto3";
+
+// StructuredID identifiers in their binary wire form. Each identifier kind is
+// its own message, so values of different kinds are different types in every
+// generated language even though their bytes have the same shape. Text forms
+// (hyphenated UUID) are for display in SDKs and clients only.
+//
+// This file imports nothing, so a consumer can compile it on its own.
+package sid.v1.ids;
+
+// A Profile's identity at one organization: the pairwise subject that
+// organization's services see. Opaque and unlinkable across organizations;
+// it never carries or reveals a ProfileId.
+message BindingId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}
+
+// One password-installing operation (a registration, change or authorized
+// reset) from its preparation to its commit. Every step and retry of the
+// operation carries it, so a lost response resolves to the operation's one
+// outcome instead of starting another.
+message PasswordOperationId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}
+
+// A non-human actor (a service, bot or agent) with its own SID credentials.
+// Not a Binding, a Profile or a device, whatever its bytes.
+message MachineUserId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}
+
+// A provisioning connector: one directory source sending SCIM to an
+// organization, or one target the organization provisions, acting as its own
+// actor with its own credentials and grants. Not a machine user or a Profile.
+message ProvisioningConnectorId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}
+
+// A registered protected resource: the application or API at which access is
+// enforced, in its issuer's context. Not an OAuth client and not an audience
+// string; its indicator and issuer come from its registration.
+message ResourceId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}
+
+// One credential of a provisioning connector: the reference listings,
+// rotations, revocations and audit records name. Never the secret itself.
+message ProvisioningCredentialId {
+  // Exactly 16 bytes: an RFC 9562 UUID of version 7 and the RFC 9562 variant,
+  // in network byte order. Nil, max, other lengths, versions and variants are
+  // invalid. Issued by SID; compared by exact byte equality.
+  bytes value = 1;
+}