@udibo/oauth2 0.1.0

package/esm/models/authorization.d.ts

@@ -0,0 +1,165 @@
+/**
+ * The authorization a verified credential carries, as one checkable object.
+ *
+ * {@link Authorization} is built from a token's verified claims (an RFC 9068
+ * JWT's payload, an introspection response, or an id_token's claims) and
+ * answers the checks an application makes: `scope` for what the **client**
+ * was delegated, `permissions`/`roles` for what the **person** holds, and the
+ * active organization context. The same object is exposed on the resource
+ * server's authenticated context, and can be built anywhere claims are held
+ * (a BFF session's user, a browser client's session) so every surface checks
+ * authorization the same way.
+ *
+ * Predicates never throw — they return booleans, so conditional rendering and
+ * branching never need try/catch. Enforcement (turning a failed check into a
+ * response) belongs to the resource server and its middleware.
+ *
+ * @module
+ */
+import type { AbstractScope } from "./scope.js";
+/**
+ * The active organization a credential was issued in: the one organization
+ * whose roles and permissions the credential carries. Absent (`null` on
+ * {@link Authorization.organization}) when the subject acts outside any
+ * organization; anything about an organization the credential does not name
+ * is answered by a check endpoint, never by the token.
+ */
+export interface OrganizationContext {
+    /** The organization's id (the `org_id` claim). */
+    id: string;
+    /** The organization's stable handle (the `org_slug` claim), when issued. */
+    slug?: string;
+    /** Roles the subject holds in this organization (the `org_roles` claim). */
+    roles: ReadonlySet<string>;
+}
+/**
+ * Conditions for {@link Authorization.unmet} and the resource servers'
+ * `require()` middleware. Every named condition must hold (AND semantics),
+ * and an array value means **all of** its entries — any-of checks are
+ * deliberately not expressible here; branch on the {@link Authorization}
+ * object in a handler instead, where the semantics stay visible.
+ */
+export interface RequireConditions {
+    /**
+     * Scope the client must have been granted. A space-delimited string or an
+     * array both mean all of the named scopes.
+     */
+    scope?: string | string[];
+    /** Permission(s) the subject must hold ({@link Authorization.can}). */
+    permission?: string | string[];
+    /** Tenant-wide role(s) the subject must hold ({@link Authorization.hasRole}). */
+    role?: string | string[];
+    /**
+     * Role(s) the subject must hold in the active organization
+     * ({@link Authorization.hasOrgRole}).
+     */
+    orgRole?: string | string[];
+    /**
+     * Organization context required: `true` for "any active organization", or
+     * an id/slug the active organization must match
+     * ({@link Authorization.inOrganization}).
+     */
+    organization?: true | string;
+}
+/**
+ * The first condition of a {@link RequireConditions} the authorization does
+ * not satisfy — `kind` names which check failed and `required` what it asked
+ * for. Scope conditions are not reported here: the resource server enforces
+ * them through its scope assertion so the RFC 6750 `insufficient_scope`
+ * challenge stays identical to `requireScope`'s.
+ */
+export interface AuthorizationFailure {
+    /** Which check failed. */
+    kind: "organization" | "role" | "orgRole" | "permission";
+    /** The condition value that was not met. */
+    required: string | true;
+}
+/** The parts an {@link Authorization} is constructed from. */
+export interface AuthorizationInit {
+    /** The scope granted to the client, when known. */
+    scope?: AbstractScope | null;
+    /** Tenant-wide role slugs the subject holds. */
+    roles?: Iterable<string>;
+    /** Permissions the subject holds (tenant-level plus the active organization's). */
+    permissions?: Iterable<string>;
+    /** The active organization context, when the credential carries one. */
+    organization?: OrganizationContext | null;
+}
+/**
+ * Checkable authorization derived from a credential's verified claims.
+ *
+ * Build one with {@link authorizationFromClaims}, or construct directly when
+ * your claims use different names. A machine token (no resource owner) yields
+ * empty roles/permissions and no organization — only its scope answers.
+ *
+ * @example
+ * ```ts
+ * import { authorizationFromClaims } from "@udibo/oauth2/server";
+ *
+ * const authorization = authorizationFromClaims({
+ *   roles: ["editor"],
+ *   permissions: ["posts:write"],
+ *   org_id: "org-1",
+ *   org_slug: "acme",
+ *   org_roles: ["admin"],
+ * });
+ * authorization.can("posts:write"); // true
+ * authorization.inOrganization("acme"); // true
+ * authorization.hasRole("admin"); // false — that role is org-scoped
+ * ```
+ */
+export declare class Authorization {
+    /** The scope granted to the client, or `null` when unknown. */
+    readonly scope: AbstractScope | null;
+    /** Tenant-wide role slugs the subject holds. */
+    readonly roles: ReadonlySet<string>;
+    /** Permissions the subject holds in the credential's scope of issue. */
+    readonly permissions: ReadonlySet<string>;
+    /** The active organization, or `null` when the credential names none. */
+    readonly organization: OrganizationContext | null;
+    /** Builds an authorization from already-parsed parts. */
+    constructor(init?: AuthorizationInit);
+    /**
+     * Whether the client was granted `scope` — the delegation check, distinct
+     * from what the person may do. A space-delimited string means all of the
+     * named scopes. `false` when the granted scope is unknown.
+     */
+    hasScope(scope: string): boolean;
+    /**
+     * Whether the subject holds `permission` — the recommended check: a
+     * permission is the contract, role names are presentation.
+     */
+    can(permission: string): boolean;
+    /** Whether the subject holds the tenant-wide role `role`. */
+    hasRole(role: string): boolean;
+    /** Whether the subject holds `role` in the active organization. */
+    hasOrgRole(role: string): boolean;
+    /**
+     * Whether the credential was issued in an active organization — any one
+     * when called without an argument, or the one whose id or slug matches
+     * `idOrSlug`.
+     */
+    inOrganization(idOrSlug?: string): boolean;
+    /**
+     * The first non-scope condition this authorization does not satisfy, or
+     * `undefined` when every one holds. Scope conditions are ignored here —
+     * the resource server asserts them separately so the RFC 6750 challenge
+     * semantics stay intact. Checked in order: organization, role, orgRole,
+     * permission.
+     */
+    unmet(conditions: RequireConditions): AuthorizationFailure | undefined;
+}
+/**
+ * Build an {@link Authorization} from a credential's verified claims — an
+ * RFC 9068 access token's payload, an RFC 7662 introspection response, or an
+ * id_token's claims. Reads the `roles`, `permissions`, `org_id`, `org_slug`,
+ * and `org_roles` claims; anything malformed is treated as absent rather
+ * than thrown on, since claim shapes vary by issuer. There is no active
+ * organization unless `org_id` is a string — its presence is the whole
+ * question.
+ *
+ * Verify claims before building from them: this function trusts its input.
+ * `scope` is passed separately because access-token scope arrives as the
+ * token's own granted scope object, and id_token claims carry none.
+ */
+export declare function authorizationFromClaims(claims: Record<string, unknown> | null | undefined, scope?: AbstractScope | null): Authorization;

package/esm/models/authorization.js

@@ -0,0 +1,160 @@
+/**
+ * The authorization a verified credential carries, as one checkable object.
+ *
+ * {@link Authorization} is built from a token's verified claims (an RFC 9068
+ * JWT's payload, an introspection response, or an id_token's claims) and
+ * answers the checks an application makes: `scope` for what the **client**
+ * was delegated, `permissions`/`roles` for what the **person** holds, and the
+ * active organization context. The same object is exposed on the resource
+ * server's authenticated context, and can be built anywhere claims are held
+ * (a BFF session's user, a browser client's session) so every surface checks
+ * authorization the same way.
+ *
+ * Predicates never throw — they return booleans, so conditional rendering and
+ * branching never need try/catch. Enforcement (turning a failed check into a
+ * response) belongs to the resource server and its middleware.
+ *
+ * @module
+ */
+/**
+ * Checkable authorization derived from a credential's verified claims.
+ *
+ * Build one with {@link authorizationFromClaims}, or construct directly when
+ * your claims use different names. A machine token (no resource owner) yields
+ * empty roles/permissions and no organization — only its scope answers.
+ *
+ * @example
+ * ```ts
+ * import { authorizationFromClaims } from "@udibo/oauth2/server";
+ *
+ * const authorization = authorizationFromClaims({
+ *   roles: ["editor"],
+ *   permissions: ["posts:write"],
+ *   org_id: "org-1",
+ *   org_slug: "acme",
+ *   org_roles: ["admin"],
+ * });
+ * authorization.can("posts:write"); // true
+ * authorization.inOrganization("acme"); // true
+ * authorization.hasRole("admin"); // false — that role is org-scoped
+ * ```
+ */
+export class Authorization {
+    /** The scope granted to the client, or `null` when unknown. */
+    scope;
+    /** Tenant-wide role slugs the subject holds. */
+    roles;
+    /** Permissions the subject holds in the credential's scope of issue. */
+    permissions;
+    /** The active organization, or `null` when the credential names none. */
+    organization;
+    /** Builds an authorization from already-parsed parts. */
+    constructor(init = {}) {
+        this.scope = init.scope ?? null;
+        this.roles = new Set(init.roles ?? []);
+        this.permissions = new Set(init.permissions ?? []);
+        this.organization = init.organization ?? null;
+    }
+    /**
+     * Whether the client was granted `scope` — the delegation check, distinct
+     * from what the person may do. A space-delimited string means all of the
+     * named scopes. `false` when the granted scope is unknown.
+     */
+    hasScope(scope) {
+        return this.scope?.has(scope) ?? false;
+    }
+    /**
+     * Whether the subject holds `permission` — the recommended check: a
+     * permission is the contract, role names are presentation.
+     */
+    can(permission) {
+        return this.permissions.has(permission);
+    }
+    /** Whether the subject holds the tenant-wide role `role`. */
+    hasRole(role) {
+        return this.roles.has(role);
+    }
+    /** Whether the subject holds `role` in the active organization. */
+    hasOrgRole(role) {
+        return this.organization?.roles.has(role) ?? false;
+    }
+    /**
+     * Whether the credential was issued in an active organization — any one
+     * when called without an argument, or the one whose id or slug matches
+     * `idOrSlug`.
+     */
+    inOrganization(idOrSlug) {
+        if (!this.organization)
+            return false;
+        if (idOrSlug === undefined)
+            return true;
+        return this.organization.id === idOrSlug ||
+            this.organization.slug === idOrSlug;
+    }
+    /**
+     * The first non-scope condition this authorization does not satisfy, or
+     * `undefined` when every one holds. Scope conditions are ignored here —
+     * the resource server asserts them separately so the RFC 6750 challenge
+     * semantics stay intact. Checked in order: organization, role, orgRole,
+     * permission.
+     */
+    unmet(conditions) {
+        if (conditions.organization !== undefined &&
+            !this.inOrganization(conditions.organization === true ? undefined : conditions.organization)) {
+            return { kind: "organization", required: conditions.organization };
+        }
+        for (const role of listOf(conditions.role)) {
+            if (!this.hasRole(role))
+                return { kind: "role", required: role };
+        }
+        for (const role of listOf(conditions.orgRole)) {
+            if (!this.hasOrgRole(role))
+                return { kind: "orgRole", required: role };
+        }
+        for (const permission of listOf(conditions.permission)) {
+            if (!this.can(permission)) {
+                return { kind: "permission", required: permission };
+            }
+        }
+        return undefined;
+    }
+}
+function listOf(value) {
+    if (value === undefined)
+        return [];
+    return typeof value === "string" ? [value] : value;
+}
+function stringsOf(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string");
+}
+/**
+ * Build an {@link Authorization} from a credential's verified claims — an
+ * RFC 9068 access token's payload, an RFC 7662 introspection response, or an
+ * id_token's claims. Reads the `roles`, `permissions`, `org_id`, `org_slug`,
+ * and `org_roles` claims; anything malformed is treated as absent rather
+ * than thrown on, since claim shapes vary by issuer. There is no active
+ * organization unless `org_id` is a string — its presence is the whole
+ * question.
+ *
+ * Verify claims before building from them: this function trusts its input.
+ * `scope` is passed separately because access-token scope arrives as the
+ * token's own granted scope object, and id_token claims carry none.
+ */
+export function authorizationFromClaims(claims, scope) {
+    const orgId = claims?.org_id;
+    const orgSlug = claims?.org_slug;
+    return new Authorization({
+        scope,
+        roles: stringsOf(claims?.roles),
+        permissions: stringsOf(claims?.permissions),
+        organization: typeof orgId === "string"
+            ? {
+                id: orgId,
+                slug: typeof orgSlug === "string" ? orgSlug : undefined,
+                roles: new Set(stringsOf(claims?.org_roles)),
+            }
+            : null,
+    });
+}

package/esm/models/client.d.ts

@@ -0,0 +1,78 @@
+/**
+ * OAuth2 client configuration — the minimum surface the framework reads.
+ *
+ * Only includes fields the framework actually inspects. Users are expected
+ * to extend this interface (or the class that implements it) with
+ * application-specific fields: display name, client secret hashes, token
+ * lifetimes, scope vocabulary, confidentiality flags, rate limits, etc.
+ *
+ * @example
+ * ```ts
+ * interface MyClient extends ClientInterface {
+ *   name: string;
+ *   confidential: boolean;
+ *   tenantId: string;
+ * }
+ * ```
+ */
+export interface ClientInterface {
+    /** Unique client identifier. */
+    id: string;
+    /**
+     * OAuth2 grant type identifiers this client is allowed to use (e.g.
+     * `"authorization_code"`, `"client_credentials"`,
+     * `"urn:ietf:params:oauth:grant-type:device_code"`). The framework
+     * rejects grant-type requests where the identifier is not in this list.
+     * When omitted, the client cannot use any grant type.
+     */
+    grants?: string[];
+    /**
+     * Allowed redirect URIs for the authorization code flow. An authorization
+     * request's `redirect_uri` is authorized by `matchRedirectUri` from
+     * `@udibo/oauth2/server`, which compares it against these entries and rejects
+     * the request when none authorizes it.
+     *
+     * An ordinary entry is a **literal**, compared by exact string match (RFC
+     * 6749 §3.1.2.3), and an exact match always wins. An entry may instead be a
+     * **pattern** — one `*` in the leftmost host label, `https` only, over a
+     * single registrable domain (`https://myapp-*.myorg.deno.net/cb`) — so one
+     * registration covers the per-deploy hostnames a preview environment
+     * produces. `matchRedirectUri` needs `isPublicSuffix` (from
+     * `@udibo/oauth2/server/public-suffix`) to decide that last rule: without it
+     * every pattern entry is **inert** and only literals match. The list proves
+     * the domain is registrable, not that *this* client registered it, so
+     * deciding which clients may hold a pattern stays your policy — see
+     * `matchRedirectUri` and `checkRedirectUriPattern` for the full rules.
+     *
+     * An authorization request that omits `redirect_uri` falls back to the first
+     * **literal** entry, so order the array with that default first. When omitted
+     * or empty, no redirect URI is authorized at all.
+     *
+     * A legacy literal entry containing a `*` (registrable before patterns
+     * existed) now matches **nothing** — the value reads as a pattern and fails
+     * the rules. That fails closed, but silently: re-register such a client.
+     */
+    redirectUris?: string[];
+    /**
+     * Where the authorization server may send the browser after an RP-initiated
+     * logout (OpenID Connect RP-Initiated Logout 1.0 §2). A logout request's
+     * `post_logout_redirect_uri` is authorized against this list by **exact
+     * string match only** — no patterns, no prefix matching. Unlike
+     * {@link ClientInterface.redirectUris}, a logout redirect carries no
+     * credential and so has no code to steal, but it is still an open redirect
+     * wearing your domain, which is a phishing primitive.
+     *
+     * When omitted or empty, no post-logout redirect is authorized: the logout
+     * still ends the session, it just answers directly instead of bouncing the
+     * browser onward. That is the safe failure, so a client that never registers
+     * one is not broken, only less convenient.
+     */
+    postLogoutRedirectUris?: string[];
+}
+/** Client credentials from a request. */
+export interface ClientCredentials {
+    /** Client identifier presented by the request. */
+    clientId: string;
+    /** Client secret, present only for confidential clients. */
+    clientSecret?: string;
+}

package/esm/models/client.js

@@ -0,0 +1 @@
+export {};

package/esm/models/device-authorization.d.ts

@@ -0,0 +1,30 @@
+import type { ClientInterface } from "./client.js";
+import type { AbstractScope, BasicScope } from "./scope.js";
+/**
+ * Device authorization request stored by the service.
+ *
+ * Contains all the information needed to complete the device flow
+ * once the user has authorized the request.
+ */
+export interface DeviceAuthorization<Client extends ClientInterface, User, Scope extends AbstractScope = BasicScope> {
+    /** The device verification code. */
+    deviceCode: string;
+    /** The user verification code (displayed to the user). */
+    userCode: string;
+    /** When the codes expire. */
+    expiresAt: Date;
+    /** The client that initiated the request. */
+    client: Client;
+    /** The scope requested by the client. */
+    scope?: Scope | null;
+    /** The minimum polling interval in seconds. */
+    interval: number;
+    /** Whether the user has authorized the request. */
+    authorized?: boolean;
+    /** The user who authorized the request (set after authorization). */
+    user?: User;
+    /** Whether the request was denied. */
+    denied?: boolean;
+    /** The last time the client polled for this code. */
+    lastPolled?: Date;
+}

package/esm/models/device-authorization.js

@@ -0,0 +1 @@
+export {};

package/esm/models/responses.d.ts

@@ -0,0 +1,93 @@
+/**
+ * OAuth2 error codes as defined in RFC 6749 and extensions.
+ *
+ * Includes the RFC 6750 Section 3.1 bearer-token error codes
+ * (`invalid_token`, `insufficient_scope`) emitted by resource servers, in
+ * addition to the RFC 6749 Section 5.2 / Section 4.1.2.1 codes and the RFC
+ * 8628 device-flow codes.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
+ */
+export type OAuth2ErrorCode = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "unsupported_response_type" | "unsupported_token_type" | "invalid_scope" | "invalid_token" | "insufficient_scope" | "access_denied" | "server_error" | "temporarily_unavailable" | "authorization_pending" | "slow_down" | "expired_token";
+/**
+ * Standard OAuth2 error response.
+ *
+ * Returned by OAuth2 endpoints when an error occurs.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export interface ErrorResponse {
+    /** Error code from {@linkcode OAuth2ErrorCode}. */
+    error: OAuth2ErrorCode;
+    /** Human-readable error description. */
+    error_description?: string;
+    /** URI to a page with additional error information. */
+    error_uri?: string;
+}
+/**
+ * OAuth2 Authorization Server Metadata as defined in RFC 8414.
+ *
+ * Describes the configuration of an OAuth2 authorization server,
+ * typically served at `/.well-known/oauth-authorization-server`.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414#section-2
+ */
+export interface AuthorizationServerMetadata {
+    /** Authorization server's issuer identifier (URL). */
+    issuer: string;
+    /** URL of the authorization endpoint. */
+    authorization_endpoint?: string;
+    /** URL of the token endpoint. */
+    token_endpoint?: string;
+    /** Supported client authentication methods at the token endpoint. */
+    token_endpoint_auth_methods_supported?: string[];
+    /**
+     * URL of the token introspection endpoint (RFC 7662). Named
+     * `introspection_endpoint` per the RFC 8414 / IANA metadata registry.
+     */
+    introspection_endpoint?: string;
+    /** URL of the token revocation endpoint (RFC 7009). */
+    revocation_endpoint?: string;
+    /** URL of the device authorization endpoint (RFC 8628). */
+    device_authorization_endpoint?: string;
+    /** URL of the OIDC userinfo endpoint (OpenID Connect Discovery). */
+    userinfo_endpoint?: string;
+    /** URL of the OIDC RP-initiated logout (end-session) endpoint. */
+    end_session_endpoint?: string;
+    /** Supported PKCE code challenge methods. */
+    code_challenge_methods_supported?: string[];
+    /** Scopes supported by the authorization server. */
+    scopes_supported?: string[];
+    /** Supported response types. */
+    response_types_supported?: string[];
+    /** Supported grant types. */
+    grant_types_supported?: string[];
+    /** URL of the JWKS document (OIDC Discovery / RFC 8414). */
+    jwks_uri?: string;
+    /** JWS algorithms supported for id_token signing (OIDC Discovery). */
+    id_token_signing_alg_values_supported?: string[];
+    /** Subject identifier types supported (OIDC Discovery). */
+    subject_types_supported?: string[];
+}
+/**
+ * Device authorization response as defined in RFC 8628.
+ *
+ * Returned by the device authorization endpoint for the device flow.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+ */
+export interface DeviceAuthorizationResponse {
+    /** Device verification code. */
+    device_code: string;
+    /** User verification code to be displayed to the user. */
+    user_code: string;
+    /** Verification URI the user should visit. */
+    verification_uri: string;
+    /** Verification URI with user_code embedded (optional convenience). */
+    verification_uri_complete?: string;
+    /** Lifetime in seconds of the device and user codes. */
+    expires_in: number;
+    /** Minimum polling interval in seconds. */
+    interval?: number;
+}

package/esm/models/responses.js

@@ -0,0 +1 @@
+export {};

package/esm/models/scope.d.ts

@@ -0,0 +1,81 @@
+/** NQCHAR as defined in RFC 6749. */
+export declare const NQCHAR: RegExp;
+/** Regex for validating a scope string. */
+export declare const SCOPE: RegExp;
+/** Regex for extracting scope tokens. */
+export declare const SCOPE_TOKEN: RegExp;
+/**
+ * Base class for OAuth2 scope implementations.
+ *
+ * Provides the contract that the authorization server, grants, and adapters
+ * rely on. Users who want a custom scope type (e.g. one that enforces a
+ * fixed vocabulary, or one that encodes hierarchical scopes) can extend
+ * this class; the framework only requires a constructor that accepts an
+ * optional scope string and the instance methods declared here.
+ *
+ * The default implementation is {@link BasicScope}; it stores a set of
+ * space-delimited NQCHAR tokens per RFC 6749 Section 3.3.
+ */
+export declare abstract class AbstractScope {
+    /** Deletes all scope tokens from this scope. */
+    abstract clear(): this;
+    /** Adds all scope tokens in the passed in scope to this scope. */
+    abstract add(scope: AbstractScope | string): this;
+    /** Removes all scope tokens in the passed in scope from this scope. */
+    abstract remove(scope: AbstractScope | string): this;
+    /** Checks that this scope has all scope tokens in the passed in scope. */
+    abstract has(scope: AbstractScope | string): boolean;
+    /** Checks that this scope is equal to the passed in scope. */
+    abstract equals(scope: AbstractScope | string): boolean;
+    /** Returns the number of scope tokens. */
+    abstract get size(): number;
+    /** Converts the scope to a string representation. */
+    abstract toString(): string;
+    /** Converts the scope to a JSON representation. */
+    abstract toJSON(): string;
+    /** Returns an iterator over the scope's tokens in insertion order. */
+    abstract [Symbol.iterator](): IterableIterator<string>;
+}
+/**
+ * Constructor for a scope type. The framework only needs `new Scope(text)`
+ * to parse scope strings from incoming requests; static helpers like
+ * `from` / `union` / `intersection` remain specific to {@link BasicScope}
+ * and are not part of this contract.
+ */
+export type ScopeConstructor<S extends AbstractScope = BasicScope> = new (scope?: string) => S;
+/** A basic implementation of OAuth2 scope. */
+export declare class BasicScope extends AbstractScope {
+    private stringCache?;
+    private tokens;
+    /**
+     * Parses a space-delimited scope string into its tokens.
+     *
+     * @throws {InvalidScopeError} If `scope` contains characters outside the
+     * RFC 6749 NQCHAR set.
+     */
+    constructor(scope?: string);
+    /** Creates a new scope from a scope. */
+    static from(scope: BasicScope | string): BasicScope;
+    /** Creates a new scope with all scope tokens from both scopes. */
+    static union(a: BasicScope | string, b: BasicScope | string): BasicScope;
+    /** Creates a new scope with all scope tokens that are present in both scopes. */
+    static intersection(a: BasicScope | string, b: BasicScope | string): BasicScope;
+    /** Deletes all scope tokens from this scope. */
+    clear(): this;
+    /** Adds all scope tokens in the passed in scope to this scope. */
+    add(scope: AbstractScope | string): this;
+    /** Removes all scope tokens in the passed in scope from this scope. */
+    remove(scope: AbstractScope | string): this;
+    /** Checks that this scope has all scope tokens in the passed in scope. */
+    has(scope: AbstractScope | string): boolean;
+    /** Checks that this scope is equal to the passed in scope. */
+    equals(scope: AbstractScope | string): boolean;
+    /** Returns the number of scope tokens. */
+    get size(): number;
+    /** Converts the scope to a string representation. */
+    toString(): string;
+    /** Converts the scope to a JSON representation. */
+    toJSON(): string;
+    /** Iterates the scope's tokens in insertion order. */
+    [Symbol.iterator](): IterableIterator<string>;
+}