permdock 0.0.0 → 0.2.0

package/dist/hosted-DJQw46hn.js

@@ -0,0 +1,266 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { T as isForbiddenKey, c as getResource, g as isSelfParented, i as findPermission, k as splitPath } from "./permissions-DVoF6dMt.js";
+import { c as indexPolicy, i as declaredRoleNames, m as role, o as deny, r as completeGrant, t as allow, v as normalizeWhere } from "./policy-xyWg7QdR.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { S as findRole, T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/core/hosted.ts
+function memoryPolicySource(document = null) {
+	const current = document === null ? null : parsePolicyDocument(document);
+	return Object.freeze({
+		current: () => current,
+		refresh: () => Promise.resolve()
+	});
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function rejectUnsafe(value) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const item of value) rejectUnsafe(item);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
+		rejectUnsafe(value[key]);
+	}
+}
+/** Validates the document envelope; per-grant checks happen at merge time. */
+function parsePolicyDocument(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
+	const copy = JSON.parse(JSON.stringify(input));
+	rejectUnsafe(copy);
+	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
+	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
+	return freezeDeep(copy);
+}
+const COMPARISONS = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains"
+]);
+function safePath(path) {
+	if (typeof path !== "string" || path.length === 0) return false;
+	return splitPath(path).every((segment) => !isForbiddenKey(segment));
+}
+function portableValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
+	if (Array.isArray(value)) return value.every(portableValue);
+	if (!isRecord(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	if (keys[0] === "ref") return safePath(value["ref"]);
+	return keys[0] === "date" && typeof value["date"] === "string";
+}
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+function isPortableCondition(value) {
+	if (!isRecord(value) || typeof value["op"] !== "string") return false;
+	const op = value["op"];
+	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
+	switch (op) {
+		case "in":
+		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
+		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
+		case "and":
+		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
+		case "not": return isPortableCondition(value["condition"]);
+		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
+		default: return false;
+	}
+}
+function approvalRank(approval) {
+	if (approval === void 0) return;
+	if (approval === "human") return {
+		distinct: true,
+		stale: false,
+		quorum: 1,
+		ttl: Number.POSITIVE_INFINITY,
+		escalates: false
+	};
+	return {
+		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
+		distinct: approval.distinct !== false,
+		stale: approval.staleOn === "resource-change",
+		quorum: approval.quorum ?? 1,
+		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
+		escalates: approval.escalation !== void 0
+	};
+}
+/** A hosted approval must meet every approval a code allow requires on the permission. */
+function approvalAtLeast(hosted, code) {
+	const mine = approvalRank(hosted);
+	for (const required of code) {
+		const theirs = approvalRank(required);
+		if (theirs === void 0) continue;
+		if (mine === void 0) return false;
+		if (theirs.distinct && !mine.distinct) return false;
+		if (theirs.stale && !mine.stale) return false;
+		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
+		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
+		if (mine.escalates && !theirs.escalates) return false;
+	}
+	return true;
+}
+/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+function undeclaredKind(_grantee) {
+	return false;
+}
+function declaredGrantee(policy, grantee, permissionResource) {
+	switch (grantee.kind) {
+		case "role": return declaredRoleNames(policy).has(grantee.role);
+		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
+		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
+		case "anyone":
+		case "authenticated":
+		case "actor":
+		case "assurance":
+		case "inherit": return false;
+		default: return undeclaredKind(grantee);
+	}
+}
+/** Approvers are declared roles, plans or relations, or any authenticated human. */
+function approvalAcceptable(policy, approval, permissionResource) {
+	if (approval === void 0 || approval === "human") return true;
+	if (!isRecord(approval)) return false;
+	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
+	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
+	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
+	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
+	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
+	const escalation = approval["escalation"];
+	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
+	if (approval["by"] === void 0) return true;
+	return granteesAcceptable(policy, approval["by"], permissionResource);
+}
+function granteesAcceptable(policy, raw, permissionResource) {
+	if (raw === void 0) return false;
+	const items = flattenGrantee(raw);
+	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
+}
+function buildGrant(policy, document, raw) {
+	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return {
+		ok: false,
+		reason: "unknown-permission"
+	};
+	if (!policy.hostable.includes(permission.key)) return {
+		ok: false,
+		reason: "not-hostable"
+	};
+	const to = flattenGrantee(raw["to"]);
+	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
+		ok: false,
+		reason: "unknown-grantee"
+	};
+	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
+		ok: false,
+		reason: "non-portable"
+	};
+	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
+		ok: false,
+		reason: "invalid"
+	};
+	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const effect = raw["effect"] ?? "allow";
+	const options = compact({
+		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
+		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
+		approval: raw["approval"],
+		fields: raw["fields"]
+	});
+	let built;
+	try {
+		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
+		if (roleItem === null) {
+			const partial = (effect === "allow" ? allow : deny)(permission, {
+				...options,
+				to
+			});
+			built = completeGrant(partial);
+		} else {
+			const binding = policy.rolesByName.get(roleItem.role);
+			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
+			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
+			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
+			built = first;
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid"
+		};
+	}
+	if (effect === "allow") {
+		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
+		if (!approvalAtLeast(built.approval, codeApprovals)) return {
+			ok: false,
+			reason: "weaker-approval"
+		};
+	}
+	return {
+		ok: true,
+		grant: freezeDeep({
+			...built,
+			hosted: {
+				document: document.fingerprint,
+				grant: raw["id"]
+			}
+		})
+	};
+}
+/**
+* The code policy plus the hosted grants that pass every rule. Hosted
+* allows OR with code allows and any deny still wins, so a hosted grant can
+* never override a code deny; one that fails a rule is dropped, not thrown.
+*/
+function mergeHostedGrants(policy, document) {
+	if (document === null || document.grants.length === 0) return {
+		policy,
+		dropped: []
+	};
+	const merged = [];
+	const dropped = [];
+	for (const raw of document.grants) {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) {
+			merged.push(result.grant);
+			continue;
+		}
+		dropped.push(freezeDeep({
+			kind: "hosted-grant-dropped",
+			document: document.fingerprint,
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			reason: result.reason
+		}));
+	}
+	if (merged.length === 0) return {
+		policy,
+		dropped
+	};
+	const grants = [...policy.grants, ...merged];
+	return {
+		policy: freezeDeep({
+			...policy,
+			grants,
+			index: indexPolicy(policy.roles, grants, policy.vocabulary),
+			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
+		}),
+		dropped
+	};
+}
+//#endregion
+export { parsePolicyDocument as i, memoryPolicySource as n, mergeHostedGrants as r, isPortableCondition as t };

package/dist/http-BIhmLfCc.js

@@ -0,0 +1,95 @@
+import { i as parsedBody, r as headersFrom, t as firstHeader } from "./http-SO7qGttf.js";
+//#region src/node/http.ts
+function toRequest(req, stream = req) {
+	const host = firstHeader(req.headers.host) ?? "localhost";
+	const url = `${req.protocol ?? "http"}://${host}${req.originalUrl ?? req.url ?? "/"}`;
+	const headers = headersFrom(req.headers);
+	const method = req.method ?? "GET";
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const parsed = parsedBody(req.body, headers);
+	if (parsed !== void 0) return new Request(url, {
+		method,
+		headers,
+		body: parsed
+	});
+	if (stream === null) return new Request(url, {
+		method,
+		headers
+	});
+	const init = {
+		method,
+		headers,
+		body: incomingBody(stream),
+		duplex: "half"
+	};
+	return new Request(url, init);
+}
+function chunkOf(chunk) {
+	return typeof chunk === "string" ? Buffer.from(chunk) : new Uint8Array(chunk);
+}
+/**
+* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the
+* Web body is consumed, so a later body parser (multer, `express.json()`)
+* still sees the whole stream.
+*/
+function incomingBody(req) {
+	return new ReadableStream({ pull(controller) {
+		return new Promise((resolve) => {
+			const drain = () => {
+				const chunk = req.read();
+				if (chunk !== null) {
+					controller.enqueue(chunkOf(chunk));
+					return true;
+				}
+				if (req.readableEnded) {
+					controller.close();
+					return true;
+				}
+				return false;
+			};
+			if (drain()) {
+				resolve();
+				return;
+			}
+			const cleanup = () => {
+				req.off("readable", onReadable);
+				req.off("end", onEnd);
+				req.off("error", onError);
+			};
+			const onReadable = () => {
+				if (drain()) {
+					cleanup();
+					resolve();
+				}
+			};
+			const onEnd = () => {
+				cleanup();
+				controller.close();
+				resolve();
+			};
+			const onError = (err) => {
+				cleanup();
+				controller.error(err);
+				resolve();
+			};
+			req.on("readable", onReadable);
+			req.once("end", onEnd);
+			req.once("error", onError);
+		});
+	} }, { highWaterMark: 0 });
+}
+async function sendResponse(res, response) {
+	res.statusCode = response.status;
+	for (const [key, value] of response.headers.entries()) res.setHeader(key, value);
+	const body = Buffer.from(await response.arrayBuffer());
+	res.end(body);
+}
+const fromResponse = sendResponse;
+function isServerResponse(value) {
+	return typeof value === "object" && value !== null && "setHeader" in value && typeof value.setHeader === "function" && "end" in value;
+}
+//#endregion
+export { toRequest as i, isServerResponse as n, sendResponse as r, fromResponse as t };

package/dist/http-DPuDaChb.d.ts

@@ -0,0 +1,13 @@
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/node/http.d.ts
+type NodeRequest = IncomingMessage & {
+  readonly originalUrl?: string;
+  readonly protocol?: string;
+  readonly body?: unknown;
+};
+declare function toRequest(req: NodeRequest, stream?: IncomingMessage | null): Request;
+declare function sendResponse(res: ServerResponse, response: Response): Promise<void>;
+declare const fromResponse: typeof sendResponse;
+declare function isServerResponse(value: unknown): value is ServerResponse;
+//#endregion
+export { toRequest as a, sendResponse as i, fromResponse as n, isServerResponse as r, NodeRequest as t };

package/dist/http-SO7qGttf.js

@@ -0,0 +1,44 @@
+//#region src/server/http.ts
+/** Node-style headers (`IncomingHttpHeaders`, Fastify's) as Fetch `Headers`; repeated values stay separate. */
+function headersFrom(source) {
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(source)) {
+		if (typeof value === "string") {
+			headers.set(key, value);
+			continue;
+		}
+		for (const item of value ?? []) headers.append(key, item);
+	}
+	return headers;
+}
+function firstHeader(value) {
+	if (typeof value === "string") return value.length > 0 ? value : void 0;
+	return value?.[0];
+}
+/**
+* A body a framework already parsed, as the text a Fetch `Request` carries.
+* A non-string body is serialised as JSON and, without a `content-type`,
+* labelled `application/json` on `headers`.
+*/
+function parsedBody(body, headers) {
+	if (body === void 0) return;
+	if (typeof body === "string") return body;
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	return JSON.stringify(body);
+}
+/** The Fetch `Request` an RPC context carries as `request` or `req`. */
+function requestFromContext(context) {
+	if ("request" in context && context.request instanceof Request) return context.request;
+	if ("req" in context && context.req instanceof Request) return context.req;
+}
+/** Whether the caller sent credentials, which turns a `401` into a `WWW-Authenticate` challenge. */
+function hasCredentials(request) {
+	return request.headers.has("authorization");
+}
+/** The Problem Details `detail` of `cause`, or `fallback` when it has none. */
+function problemMessage(cause, fallback) {
+	if (cause !== null && typeof cause === "object" && "detail" in cause && typeof cause.detail === "string" && cause.detail.length > 0) return cause.detail;
+	return fallback;
+}
+//#endregion
+export { problemMessage as a, parsedBody as i, hasCredentials as n, requestFromContext as o, headersFrom as r, firstHeader as t };

package/dist/ids-DC4V4CFu.js

@@ -0,0 +1,18 @@
+//#region src/core/ids.ts
+/**
+* The canonical text of a scope or object id: a non-empty string as is, a
+* finite number or a bigint as its decimal text (a `bigint` key column read
+* through supabase-js arrives as a number), anything else none.
+*/
+function idText(value) {
+	if (typeof value === "string") return value === "" ? void 0 : value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value === "bigint") return String(value);
+}
+/** Whether two ids are the same id once both are read as text; a missing id matches nothing. */
+function sameId(left, right) {
+	const text = idText(left);
+	return text !== void 0 && text === idText(right);
+}
+//#endregion
+export { sameId as n, idText as t };

package/dist/index-A0YNL8jZ.d.ts

@@ -0,0 +1,177 @@
+import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-CFZAr_Al.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+//#region src/scim/types.d.ts
+declare const SCIM_CONTENT_TYPE = "application/scim+json";
+declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+declare const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+declare const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+declare const ROLES_EXTENSION = "urn:permdock:scim:schemas:extension:roles:1.0";
+type DirectoryMeta = {
+  readonly created: string;
+  readonly lastModified: string;
+  readonly location?: string;
+  readonly resourceType?: "User" | "Group";
+};
+type DirectoryEmail = {
+  readonly value: string;
+  readonly primary?: boolean;
+  readonly type?: string;
+};
+type DirectoryUser = {
+  readonly id: string;
+  readonly externalId?: string;
+  readonly userName: string;
+  readonly active: boolean;
+  readonly emails?: readonly DirectoryEmail[];
+  readonly meta: DirectoryMeta;
+};
+type DirectoryGroupMember = {
+  readonly value: string;
+};
+type DirectoryGroup = {
+  readonly id: string;
+  readonly externalId?: string;
+  readonly displayName: string;
+  readonly members: readonly DirectoryGroupMember[];
+  readonly roles?: readonly string[];
+  readonly meta: DirectoryMeta;
+};
+type ScimCompareOp = "eq" | "ne" | "co" | "sw";
+type ScimFilter = {
+  readonly op: ScimCompareOp;
+  readonly attribute: string;
+  readonly value: string | boolean;
+} | {
+  readonly op: "pr";
+  readonly attribute: string;
+} | {
+  readonly op: "and" | "or";
+  readonly filters: readonly ScimFilter[];
+};
+type ScimPage = {
+  readonly startIndex?: number;
+  readonly count?: number;
+  readonly cursor?: string;
+};
+type ScimPageResult<T> = {
+  readonly Resources: readonly T[];
+  readonly totalResults: number;
+  readonly startIndex?: number;
+  readonly itemsPerPage?: number;
+  readonly nextCursor?: string;
+};
+type ScimPatchOp = {
+  readonly op: "add" | "replace" | "remove";
+  readonly path?: string;
+  readonly value?: unknown;
+};
+type DirectoryStore = {
+  getUser(tenant: string, id: string): Promise<DirectoryUser | null>;
+  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryUser>>;
+  putUser(tenant: string, user: DirectoryUser): Promise<DirectoryUser>;
+  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryUser>;
+  deleteUser(tenant: string, id: string): Promise<void>;
+  getGroup(tenant: string, id: string): Promise<DirectoryGroup | null>;
+  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup(tenant: string, group: DirectoryGroup): Promise<DirectoryGroup>;
+  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): Promise<DirectoryGroup>;
+  deleteGroup(tenant: string, id: string): Promise<void>;
+  groupsFor(tenant: string, userId: string): Promise<readonly DirectoryGroup[]>;
+};
+type ScimTokenOptions = {
+  readonly hash: "sha256";
+  readonly lookup: (tenant: string) => string | undefined | Promise<string | undefined>;
+};
+type DirectoryChange = {
+  readonly tenant: string;
+  readonly userIds: readonly string[];
+  /** `session-revoked` when a user was deactivated or deleted; `changed` otherwise. */
+  readonly kind: "session-revoked" | "changed";
+};
+type ScimHandlerOptions = {
+  readonly store: DirectoryStore;
+  readonly tenant: string | ((request: Request) => string | Promise<string>);
+  readonly token?: ScimTokenOptions;
+  readonly verifier?: TokenVerifier;
+  readonly audience?: string;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly assignable?: readonly string[];
+  readonly sink?: DecisionSink;
+  readonly onChange?: (change: DirectoryChange) => void | Promise<void>;
+  /**
+   * Publishes for each affected user's id, `externalId` and `userName`:
+   * `session-revoked` when a user is deactivated (`active: false`) or
+   * deleted, so open connections end; `changed` otherwise, so they revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly onUnknownRole?: (name: string) => void;
+};
+type DirectoryMembershipMatch = "externalId" | "userName" | "either";
+type DirectoryMembershipSourceOptions = {
+  readonly match?: DirectoryMembershipMatch;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly assignable?: readonly string[];
+  readonly onUnknownRole?: (name: string) => void;
+};
+declare class DirectoryUniquenessError extends Error {
+  override readonly name = "DirectoryUniquenessError";
+  readonly code: "uniqueness";
+  constructor(message?: string);
+}
+declare class DirectoryNotFoundError extends Error {
+  override readonly name = "DirectoryNotFoundError";
+  readonly code: "not-found";
+  constructor(message?: string);
+}
+//#endregion
+//#region src/scim/auth.d.ts
+type ScimCredential = {
+  readonly kind: "token";
+} | {
+  readonly kind: "jwt";
+  readonly iss?: string;
+};
+type ScimAuthResult = {
+  readonly ok: true;
+  readonly credential: ScimCredential;
+} | {
+  readonly ok: false;
+  readonly status: 401 | 403;
+};
+declare function authenticateScim(input: {
+  readonly request: Request;
+  readonly tenant: string;
+  readonly audience?: string;
+  readonly token?: ScimTokenOptions;
+  readonly verifier?: TokenVerifier;
+}): Promise<ScimAuthResult>;
+declare function sha256Hex(value: string): string;
+//#endregion
+//#region src/scim/discovery.d.ts
+declare function serviceProviderConfig(): Record<string, unknown>;
+declare function resourceTypes(): readonly Record<string, unknown>[];
+declare function schemas(): readonly Record<string, unknown>[];
+//#endregion
+//#region src/scim/filter.d.ts
+declare function parseScimFilter(input: string): ScimFilter | undefined;
+declare function matchFilter(target: DirectoryUser | DirectoryGroup | Record<string, unknown>, filter: ScimFilter | undefined): boolean;
+declare function filterSupported(filter: ScimFilter): boolean;
+//#endregion
+//#region src/scim/handler.d.ts
+declare function scimHandler(options: ScimHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/scim/route.d.ts
+declare function tenantFromPath(request: Request): string;
+//#endregion
+//#region src/scim/patch.d.ts
+declare function normalizePatchOps(ops: readonly unknown[]): readonly ScimPatchOp[] | undefined;
+//#endregion
+//#region src/scim/source.d.ts
+declare function directoryMembershipSource(store: DirectoryStore, options?: DirectoryMembershipSourceOptions): MembershipSource;
+//#endregion
+//#region src/scim/store.d.ts
+declare function memoryDirectoryStore(): DirectoryStore;
+//#endregion
+export { ScimPageResult as A, LIST_SCHEMA as C, ScimFilter as D, SCIM_CONTENT_TYPE as E, ScimTokenOptions as M, USER_SCHEMA as N, ScimHandlerOptions as O, GROUP_SCHEMA as S, ROLES_EXTENSION as T, DirectoryNotFoundError as _, scimHandler as a, DirectoryUser as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryMembershipSourceOptions as g, DirectoryGroup as h, tenantFromPath as i, ScimPatchOp as j, ScimPage as k, resourceTypes as l, DirectoryChange as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryStore as v, PATCH_SCHEMA as w, ERROR_SCHEMA as x, DirectoryUniquenessError as y };

package/dist/index-CtE07CBF.d.ts

@@ -0,0 +1,6 @@
+import { C as Policy, Nr as Principal } from "./policy-CFZAr_Al.js";
+import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-9AWO9EGt.js";
+//#region src/ssf/create.d.ts
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
+//#endregion
+export { createPermDock as t };