@apifuse/provider-sdk 2.2.0-beta.60 → 2.2.0-beta.62

package/dist/choice-token.js

@@ -1,74 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-export class ProviderChoiceTokenError extends Error {
-    reason;
-    constructor(reason, message) {
-        super(message);
-        this.name = "ProviderChoiceTokenError";
-        this.reason = reason;
-    }
-}
-export function createProviderChoiceToken(options) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), iv);
-    const encryptedPayload = Buffer.concat([
-        cipher.update(JSON.stringify(options.payload), "utf8"),
-        cipher.final(),
-    ]).toString("base64url");
-    const authTag = cipher.getAuthTag().toString("base64url");
-    const encodedIv = iv.toString("base64url");
-    const signature = signProviderChoiceTokenBody(`${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`, options.secret);
-    return `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}.${signature}`;
-}
-export function parseProviderChoiceToken(options) {
-    const [actualPrefix, encodedIv, encryptedPayload, authTag, signature, ...extra] = options.token.split(".");
-    if (actualPrefix !== options.prefix ||
-        !encodedIv ||
-        !encryptedPayload ||
-        !authTag ||
-        !signature ||
-        extra.length > 0) {
-        throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-    }
-    const signedBody = `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`;
-    const expectedSignature = signProviderChoiceTokenBody(signedBody, options.secret);
-    const actualBuffer = Buffer.from(signature);
-    const expectedBuffer = Buffer.from(expectedSignature);
-    if (actualBuffer.length !== expectedBuffer.length ||
-        !timingSafeEqual(actualBuffer, expectedBuffer)) {
-        throw new ProviderChoiceTokenError("invalid_signature", "Provider choice token signature is invalid.");
-    }
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), Buffer.from(encodedIv, "base64url"));
-        decipher.setAuthTag(Buffer.from(authTag, "base64url"));
-        const decrypted = Buffer.concat([
-            decipher.update(Buffer.from(encryptedPayload, "base64url")),
-            decipher.final(),
-        ]).toString("utf8");
-        const parsed = JSON.parse(decrypted);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("payload is not an object");
-        }
-        return Object.fromEntries(Object.entries(parsed));
-    }
-    catch {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-}
-export function assertFreshProviderChoiceIssuedAt(issuedAtMs, options) {
-    const parsed = typeof issuedAtMs === "number" ? issuedAtMs : Number(issuedAtMs);
-    const nowMs = options.nowMs ?? Date.now();
-    const futureToleranceMs = options.futureToleranceMs ?? 30_000;
-    if (!Number.isFinite(parsed) ||
-        parsed <= 0 ||
-        nowMs - parsed > options.ttlMs ||
-        parsed - nowMs > futureToleranceMs) {
-        throw new ProviderChoiceTokenError("stale", "Provider choice token is stale.");
-    }
-    return parsed;
-}
-function choiceEncryptionKey(secret) {
-    return createHash("sha256").update(secret).digest();
-}
-function signProviderChoiceTokenBody(body, secret) {
-    return createHmac("sha256", secret).update(body).digest("base64url");
-}

package/dist/runtime/choice-wordlist.d.ts

@@ -1,9 +0,0 @@
-export declare const CHOICE_WORDLIST_SIZE = 1296;
-export declare const CHOICE_WORD_ENTROPY_BITS: number;
-export declare const STANDARD_CHOICE_WORD_COUNT = 4;
-export declare const HIGH_CHOICE_WORD_COUNT = 5;
-export declare const STANDARD_CHOICE_ENTROPY_BITS: number;
-export declare const HIGH_CHOICE_ENTROPY_BITS: number;
-export declare const EFF_SHORT_WORDLIST_2: readonly string[];
-export declare function choiceWordAt(index: number): string;
-export declare function isChoiceWord(value: string): boolean;

package/dist/runtime/choice.d.ts

@@ -1,27 +0,0 @@
-import type { CredentialContext, EnvContext, ProviderChoiceConsumeMode, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
-export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export type ProviderChoiceTelemetryEvent = {
-    readonly providerId: string;
-    readonly purpose: string;
-    readonly operation: "parse" | "consume";
-    readonly format: "word" | "legacy";
-    readonly outcome: "success" | "not-found" | "invalid" | "unsupported" | "error";
-    readonly consumeMode: ProviderChoiceConsumeMode;
-    readonly consumed: boolean;
-    readonly replay: boolean;
-};
-export type CreateProviderChoiceContextOptions = {
-    readonly providerId: string;
-    readonly env?: EnvContext;
-    readonly request?: ProviderRequestContext;
-    readonly credential?: CredentialContext;
-    readonly state?: ProviderRuntimeState;
-    readonly masterSecret?: string;
-    readonly kid?: string;
-    /** Receives allowlisted metadata only; token and payload values are never included. */
-    readonly onTelemetry?: (event: ProviderChoiceTelemetryEvent) => void;
-};
-export declare function createProviderChoiceContext(options: CreateProviderChoiceContextOptions): ProviderChoiceContext;
-export declare function createTestProviderChoiceContext(options: Omit<CreateProviderChoiceContextOptions, "masterSecret"> & {
-    readonly masterSecret?: string;
-}): ProviderChoiceContext;