@openagentid/scim

interface AgentExtension {
    readonly parentDid: string;
    readonly conformanceLevel: ConformanceLevel;
    readonly scopes: readonly string[];
    readonly lineageDepth: number;
    readonly createdVia: string;
    readonly keypairFingerprint: string;
}

declare class AgentProvisioner {
    constructor(config: ProvisionerConfig);
    createAgent(params: CreateAgentParams): Promise<AgentRecord>;
    replaceAgent(did: string, params: CreateAgentParams): Promise<AgentRecord>;
    updateAgent(did: string, record: AgentRecord): Promise<AgentRecord>;
    deprovisionAgent(did: string): Promise<void>;
    findByDid(did: string): Promise<AgentRecord | undefined>;
    findByUserName(userName: string): Promise<AgentRecord | undefined>;
    listAgents(): Promise<readonly AgentRecord[]>;
}

interface AgentRecord {
    readonly did: string;
    readonly userName: string;
    readonly displayName: string;
    readonly active: boolean;
    readonly parentDid: string;
    readonly conformanceLevel: ConformanceLevel;
    readonly scopes: readonly string[];
    readonly lineageDepth: number;
    readonly createdVia: string;
    readonly keypairFingerprint: string;
    readonly createdAt: string;
    readonly updatedAt: string;
    readonly version: string;
    readonly externalId?: string;
}

interface AgentStore {
    list(): Promise<readonly AgentRecord[]>;
    findByDid(did: string): Promise<AgentRecord | undefined>;
    findByUserName(userName: string): Promise<AgentRecord | undefined>;
    findByExternalId(externalId: string): Promise<AgentRecord | undefined>;
    create(record: AgentRecord): Promise<AgentRecord>;
    update(did: string, record: AgentRecord): Promise<AgentRecord>;
    delete(did: string): Promise<void>;
    countActive(): Promise<number>;
}

declare function agentToScimResource(agent: AgentRecord, baseUrl: string): ScimAgentResource;

declare function applyPatchOperations(record: AgentRecord, operations: readonly PatchOperation[]): AgentRecord;

type ArsenalSessionInvalidator = (did: string) => Promise<void>;

interface AttributeFilter {
    readonly type: 'attribute';
    readonly attribute: string;
    readonly op: FilterOp;
    readonly value: string | boolean | number | null;
}

interface AuditEvent {
    readonly type: 'agent.created' | 'agent.updated' | 'agent.deprovisioned';
    readonly did: string;
    readonly timestamp: string;
    readonly details: Record<string, unknown>;
}

type AuditSink = (event: AuditEvent) => void | Promise<void>;

declare function buildResourceTypes(baseUrl: string): readonly Record<string, unknown>[];

declare function buildSchemas(): readonly Record<string, unknown>[];

declare function buildServiceProviderConfig(baseUrl: string): Record<string, unknown>;

type ConformanceLevel = 'L0' | 'L1' | 'L2';

type CreateAgentFromScimInput = z.infer<typeof createAgentFromScimSchema>;

declare const createAgentFromScimSchema: z.ZodObject<{
    schemas: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
    externalId: z.ZodOptional<z.ZodString>;
    userName: z.ZodString;
    displayName: z.ZodOptional<z.ZodString>;
    active: z.ZodDefault<z.ZodBoolean>;
    "urn:openagent:scim:1.0:Agent": z.ZodObject<{
        parentDid: z.ZodString;
        conformanceLevel: z.ZodDefault<z.ZodEnum<[
            "L0",
            "L1",
            "L2"
        ]>>;
        scopes: z.ZodArray<z.ZodString, "many">;
        lineageDepth: z.ZodOptional<z.ZodNumber>;
        createdVia: z.ZodOptional<z.ZodString>;
        keypairFingerprint: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        parentDid: string;
        conformanceLevel: "L0" | "L1" | "L2";
        scopes: string[];
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    }, {
        parentDid: string;
        scopes: string[];
        conformanceLevel?: "L0" | "L1" | "L2" | undefined;
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    }>;
}, "strip", z.ZodTypeAny, {
    "urn:openagent:scim:1.0:Agent": {
        parentDid: string;
        conformanceLevel: "L0" | "L1" | "L2";
        scopes: string[];
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    };
    schemas: string[];
    userName: string;
    active: boolean;
    displayName?: string | undefined;
    externalId?: string | undefined;
}, {
    "urn:openagent:scim:1.0:Agent": {
        parentDid: string;
        scopes: string[];
        conformanceLevel?: "L0" | "L1" | "L2" | undefined;
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    };
    schemas: string[];
    userName: string;
    displayName?: string | undefined;
    active?: boolean | undefined;
    externalId?: string | undefined;
}>;

interface CreateAgentParams {
    readonly userName: string;
    readonly displayName?: string;
    readonly parentDid: string;
    readonly conformanceLevel: ConformanceLevel;
    readonly scopes: readonly string[];
    readonly externalId?: string;
}

declare function createScimRouter(routerConfig?: ScimRouterConfig): ScimRouter;

type DelegationCascadeRevoker = (did: string) => Promise<void>;

type DidRevoker = (did: string) => Promise<void>;

type FilterOp = 'eq' | 'ne' | 'co' | 'sw' | 'ew' | 'pr' | 'gt' | 'ge' | 'lt' | 'le';

declare class InMemoryAgentStore implements AgentStore {
    list(): Promise<readonly AgentRecord[]>;
    findByDid(did: string): Promise<AgentRecord | undefined>;
    findByUserName(userName: string): Promise<AgentRecord | undefined>;
    findByExternalId(externalId: string): Promise<AgentRecord | undefined>;
    create(record: AgentRecord): Promise<AgentRecord>;
    update(did: string, record: AgentRecord): Promise<AgentRecord>;
    delete(did: string): Promise<void>;
    countActive(): Promise<number>;
}

interface Logger {
    debug(msg: string, fields?: Record<string, unknown>): void;
    info(msg: string, fields?: Record<string, unknown>): void;
    warn(msg: string, fields?: Record<string, unknown>): void;
    error(msg: string, fields?: Record<string, unknown>): void;
}

interface LogicalFilter {
    readonly type: 'and' | 'or';
    readonly filters: readonly ParsedFilter[];
}

declare function matchesFilter(record: AgentRecord, filter: ParsedFilter | undefined): boolean;

declare const OPENAGENT_AGENT_SCHEMA: "urn:openagent:scim:1.0:Agent";

declare function paginateResults<T>(items: readonly T[], params: PaginationParams): ScimListResponse<T>;

interface PaginationParams {
    readonly startIndex: number;
    readonly count: number;
}

declare function parseCreateInput(body: unknown): CreateAgentFromScimInput;

type ParsedFilter = AttributeFilter | LogicalFilter;

declare function parseFilter(filterStr: string | undefined | null): ParsedFilter | undefined;

declare function parsePagination(searchParams: URLSearchParams, maxPageSize: number): PaginationParams;

declare function parsePatchRequest(body: unknown): PatchRequest;

declare function parseReplaceInput(body: unknown): ReplaceAgentFromScimInput;

interface PatchOperation {
    readonly op: 'add' | 'replace' | 'remove';
    readonly path?: string;
    readonly value?: unknown;
}

interface PatchRequest {
    readonly schemas: readonly string[];
    readonly Operations: readonly PatchOperation[];
}

interface ProvisionerConfig {
    readonly store: AgentStore;
    readonly namespace: string;
    readonly logger: Logger;
    readonly auditSink?: AuditSink;
    readonly revokeDidDocument?: DidRevoker;
    readonly cascadeRevokeDelegations?: DelegationCascadeRevoker;
    readonly invalidateArsenalSessions?: ArsenalSessionInvalidator;
}

declare class ProvisionerError extends Error {
    readonly code: ProvisionerErrorCode;
    constructor(message: string, code: ProvisionerErrorCode);
}

type ReplaceAgentFromScimInput = z.infer<typeof replaceAgentFromScimSchema>;

interface ResolvedScimConfig {
    readonly namespace: string;
    readonly bearerTokens: readonly string[];
    readonly baseUrl: string;
    readonly maxPageSize: number;
    readonly logger: Logger;
}

declare function resolveScimConfig(config?: ScimBridgeConfig): ResolvedScimConfig;

declare const SCIM_ERROR_SCHEMA: "urn:ietf:params:scim:api:messages:2.0:Error";

declare const SCIM_LIST_RESPONSE_SCHEMA: "urn:ietf:params:scim:api:messages:2.0:ListResponse";

declare const SCIM_PATCH_OP_SCHEMA: "urn:ietf:params:scim:api:messages:2.0:PatchOp";

declare const SCIM_RESOURCE_TYPE_SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:ResourceType";

declare const SCIM_SCHEMA_SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:Schema";

declare const SCIM_SPC_SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";

declare const SCIM_USER_SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:User";

interface ScimAgentResource {
    readonly schemas: readonly string[];
    readonly id: string;
    readonly externalId?: string;
    readonly userName: string;
    readonly displayName: string;
    readonly active: boolean;
    readonly meta: ScimMeta;
    readonly [OPENAGENT_AGENT_SCHEMA]: AgentExtension;
}

interface ScimBridgeConfig {
    readonly namespace?: string;
    readonly bearerTokens?: readonly string[];
    readonly baseUrl?: string;
    readonly maxPageSize?: number;
    readonly logger?: Logger;
}

interface ScimErrorResponse {
    readonly schemas: readonly string[];
    readonly status: string;
    readonly scimType?: string;
    readonly detail: string;
}

declare class ScimFilterError extends Error {
    constructor(message: string);
}

interface ScimListResponse<T> {
    readonly schemas: readonly string[];
    readonly totalResults: number;
    readonly startIndex: number;
    readonly itemsPerPage: number;
    readonly Resources: readonly T[];
}

interface ScimMeta {
    readonly resourceType: string;
    readonly created: string;
    readonly lastModified: string;
    readonly location: string;
    readonly version: string;
}

declare class ScimPatchError extends Error {
    constructor(message: string);
}

interface ScimRouter {
    handle(request: Request): Promise<Response>;
}

interface ScimRouterConfig extends ScimBridgeConfig {
    readonly store?: AgentStore;
    readonly auditSink?: AuditSink;
    readonly revokeDidDocument?: DidRevoker;
    readonly cascadeRevokeDelegations?: DelegationCascadeRevoker;
    readonly invalidateArsenalSessions?: ArsenalSessionInvalidator;
}

declare const silentLogger: Logger;

declare class StoreError extends Error {
    readonly code: StoreErrorCode;
    constructor(message: string, code: StoreErrorCode);
}

type StoreErrorCode = 'NOT_FOUND' | 'CONFLICT' | 'INTERNAL';

declare const VERSION = "0.1.1";

type ProvisionerErrorCode = 'NOT_FOUND' | 'CONFLICT' | 'VALIDATION';

declare const replaceAgentFromScimSchema: z.ZodObject<{
    schemas: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
    externalId: z.ZodOptional<z.ZodString>;
    userName: z.ZodString;
    displayName: z.ZodOptional<z.ZodString>;
    active: z.ZodDefault<z.ZodBoolean>;
    "urn:openagent:scim:1.0:Agent": z.ZodObject<{
        parentDid: z.ZodString;
        conformanceLevel: z.ZodDefault<z.ZodEnum<[
            "L0",
            "L1",
            "L2"
        ]>>;
        scopes: z.ZodArray<z.ZodString, "many">;
        lineageDepth: z.ZodOptional<z.ZodNumber>;
        createdVia: z.ZodOptional<z.ZodString>;
        keypairFingerprint: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        parentDid: string;
        conformanceLevel: "L0" | "L1" | "L2";
        scopes: string[];
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    }, {
        parentDid: string;
        scopes: string[];
        conformanceLevel?: "L0" | "L1" | "L2" | undefined;
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    }>;
}, "strip", z.ZodTypeAny, {
    "urn:openagent:scim:1.0:Agent": {
        parentDid: string;
        conformanceLevel: "L0" | "L1" | "L2";
        scopes: string[];
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    };
    schemas: string[];
    userName: string;
    active: boolean;
    displayName?: string | undefined;
    externalId?: string | undefined;
}, {
    "urn:openagent:scim:1.0:Agent": {
        parentDid: string;
        scopes: string[];
        conformanceLevel?: "L0" | "L1" | "L2" | undefined;
        lineageDepth?: number | undefined;
        createdVia?: string | undefined;
        keypairFingerprint?: string | undefined;
    };
    schemas: string[];
    userName: string;
    displayName?: string | undefined;
    active?: boolean | undefined;
    externalId?: string | undefined;
}>;

sha512-RuFR244IbG3EOWSxReZMrzE0PLt1FX9z8MLqwGxcrnfsP7JiYM7WiJSmCXtM5WxgqS+PZvS8zgHlJyLLo5n2iw==