@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/src/typescript-module.ts

@@ -0,0 +1,100 @@
+import { createRequire } from "node:module";
+
+const requireModule = createRequire(import.meta.url);
+
+/** The TypeScript compiler API surface the source-level lint rules parse with. */
+export type TypeScriptModule = typeof import("typescript");
+
+/**
+ * What a caller hands over as a compiler module. Typed structurally so the
+ * option does not depend on which `typescript` package the caller's own type
+ * resolution lands on: under a `typescript@7` pin `typeof import("typescript")`
+ * is the native shell's version module, not the compiler API. The members are
+ * optional for the same reason — the shell has none of them — and
+ * `isTypeScriptCompilerModule` decides at runtime whether the module can parse.
+ */
+export type TypeScriptCompilerModuleLike = {
+	readonly createSourceFile?: (...parameters: never[]) => unknown;
+	readonly ScriptTarget?: object;
+	readonly version?: string;
+};
+
+/**
+ * Package specifiers that may carry the compiler API, in resolution order.
+ *
+ * `typescript@7` (the Go-native toolchain) resolves but its JavaScript entry
+ * exports only `version`/`getExePath` — no `createSourceFile`, so the lint
+ * rules cannot parse with it. The compiler API of that generation is published
+ * as `@typescript/typescript6`, which is what a `typescript@7` dependency tree
+ * (for example the APIFuse monorepo root) installs alongside the shell.
+ */
+export const TYPESCRIPT_COMPILER_MODULE_SPECIFIERS = [
+	"typescript",
+	"@typescript/typescript6",
+] as const;
+
+/**
+ * True when `candidate` is a loaded module that exposes the parser the lint
+ * rules need. Internal (narrows to the `typescript` module type, which is not
+ * part of the package surface); `lintRuntimeBoundarySources` applies it to the
+ * caller-supplied option.
+ */
+export function isTypeScriptCompilerModule(candidate: unknown): candidate is TypeScriptModule {
+	return (
+		typeof candidate === "object" &&
+		candidate !== null &&
+		typeof (candidate as { createSourceFile?: unknown }).createSourceFile === "function" &&
+		typeof (candidate as { ScriptTarget?: unknown }).ScriptTarget === "object"
+	);
+}
+
+function describeCandidate(candidate: unknown): string {
+	if (typeof candidate === "object" && candidate !== null) {
+		const version = (candidate as { version?: unknown }).version;
+		if (typeof version === "string") return `resolved ${version} without a compiler API`;
+	}
+	return "resolved without a compiler API";
+}
+
+/**
+ * Resolve the compiler API through `load`, trying each specifier in order and
+ * accepting the first module that exposes `createSourceFile`. Exposed for the
+ * tests; production code uses `getTypeScript()`.
+ */
+export function loadTypeScriptModule(
+	load: (specifier: string) => unknown,
+	specifiers: readonly string[] = TYPESCRIPT_COMPILER_MODULE_SPECIFIERS,
+): TypeScriptModule {
+	const attempts: string[] = [];
+	for (const specifier of specifiers) {
+		let candidate: unknown;
+		try {
+			candidate = load(specifier);
+		} catch {
+			attempts.push(`${specifier}: not resolvable`);
+			continue;
+		}
+		if (isTypeScriptCompilerModule(candidate)) return candidate;
+		attempts.push(`${specifier}: ${describeCandidate(candidate)}`);
+	}
+	throw new Error(
+		`The provider source lint needs the TypeScript compiler API (createSourceFile) and none of the resolvable packages provide it — ${attempts.join("; ")}. Install typescript 6.x as a devDependency, or @typescript/typescript6 next to a typescript 7 toolchain, in the dependency tree that installs @apifuse/provider-sdk.`,
+	);
+}
+
+/**
+ * Lazily loaded TypeScript compiler API shared by the source-level lint rules.
+ *
+ * `typeof import(...)` keeps the type without emitting a static import: the
+ * typescript package is a devDependency of the SDK and only the CLI and the
+ * lint rules need it at runtime, which the typescript-import-boundary test
+ * enforces for production sources. Resolution starts at the installed SDK, so
+ * the caller's dependency tree must provide one of
+ * `TYPESCRIPT_COMPILER_MODULE_SPECIFIERS`.
+ */
+let typeScriptModule: TypeScriptModule | undefined;
+
+export function getTypeScript(): TypeScriptModule {
+	typeScriptModule ??= loadTypeScriptModule(requireModule);
+	return typeScriptModule;
+}

package/dist/choice-token.d.ts

@@ -1,24 +0,0 @@
-export type ProviderChoiceTokenPayload = Record<string, unknown>;
-export type ProviderChoiceTokenErrorReason = "invalid_shape" | "invalid_signature" | "invalid_payload" | "invalid_binding" | "stale";
-export declare class ProviderChoiceTokenError extends Error {
-    readonly reason: ProviderChoiceTokenErrorReason;
-    constructor(reason: ProviderChoiceTokenErrorReason, message: string);
-}
-export interface CreateProviderChoiceTokenOptions<TPayload extends ProviderChoiceTokenPayload> {
-    prefix: string;
-    payload: TPayload;
-    secret: string;
-}
-export interface ParseProviderChoiceTokenOptions {
-    token: string;
-    prefix: string;
-    secret: string;
-}
-export interface FreshProviderChoiceIssuedAtOptions {
-    ttlMs: number;
-    nowMs?: number;
-    futureToleranceMs?: number;
-}
-export declare function createProviderChoiceToken<TPayload extends ProviderChoiceTokenPayload>(options: CreateProviderChoiceTokenOptions<TPayload>): string;
-export declare function parseProviderChoiceToken(options: ParseProviderChoiceTokenOptions): ProviderChoiceTokenPayload;
-export declare function assertFreshProviderChoiceIssuedAt(issuedAtMs: unknown, options: FreshProviderChoiceIssuedAtOptions): number;

package/dist/choice-token.js

@@ -1,74 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-export class ProviderChoiceTokenError extends Error {
-    reason;
-    constructor(reason, message) {
-        super(message);
-        this.name = "ProviderChoiceTokenError";
-        this.reason = reason;
-    }
-}
-export function createProviderChoiceToken(options) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), iv);
-    const encryptedPayload = Buffer.concat([
-        cipher.update(JSON.stringify(options.payload), "utf8"),
-        cipher.final(),
-    ]).toString("base64url");
-    const authTag = cipher.getAuthTag().toString("base64url");
-    const encodedIv = iv.toString("base64url");
-    const signature = signProviderChoiceTokenBody(`${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`, options.secret);
-    return `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}.${signature}`;
-}
-export function parseProviderChoiceToken(options) {
-    const [actualPrefix, encodedIv, encryptedPayload, authTag, signature, ...extra] = options.token.split(".");
-    if (actualPrefix !== options.prefix ||
-        !encodedIv ||
-        !encryptedPayload ||
-        !authTag ||
-        !signature ||
-        extra.length > 0) {
-        throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-    }
-    const signedBody = `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`;
-    const expectedSignature = signProviderChoiceTokenBody(signedBody, options.secret);
-    const actualBuffer = Buffer.from(signature);
-    const expectedBuffer = Buffer.from(expectedSignature);
-    if (actualBuffer.length !== expectedBuffer.length ||
-        !timingSafeEqual(actualBuffer, expectedBuffer)) {
-        throw new ProviderChoiceTokenError("invalid_signature", "Provider choice token signature is invalid.");
-    }
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), Buffer.from(encodedIv, "base64url"));
-        decipher.setAuthTag(Buffer.from(authTag, "base64url"));
-        const decrypted = Buffer.concat([
-            decipher.update(Buffer.from(encryptedPayload, "base64url")),
-            decipher.final(),
-        ]).toString("utf8");
-        const parsed = JSON.parse(decrypted);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("payload is not an object");
-        }
-        return Object.fromEntries(Object.entries(parsed));
-    }
-    catch {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-}
-export function assertFreshProviderChoiceIssuedAt(issuedAtMs, options) {
-    const parsed = typeof issuedAtMs === "number" ? issuedAtMs : Number(issuedAtMs);
-    const nowMs = options.nowMs ?? Date.now();
-    const futureToleranceMs = options.futureToleranceMs ?? 30_000;
-    if (!Number.isFinite(parsed) ||
-        parsed <= 0 ||
-        nowMs - parsed > options.ttlMs ||
-        parsed - nowMs > futureToleranceMs) {
-        throw new ProviderChoiceTokenError("stale", "Provider choice token is stale.");
-    }
-    return parsed;
-}
-function choiceEncryptionKey(secret) {
-    return createHash("sha256").update(secret).digest();
-}
-function signProviderChoiceTokenBody(body, secret) {
-    return createHmac("sha256", secret).update(body).digest("base64url");
-}

package/dist/runtime/choice.d.ts

@@ -1,15 +0,0 @@
-import type { CredentialContext, EnvContext, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
-export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export type CreateProviderChoiceContextOptions = {
-    readonly providerId: string;
-    readonly env?: EnvContext;
-    readonly request?: ProviderRequestContext;
-    readonly credential?: CredentialContext;
-    readonly state?: ProviderRuntimeState;
-    readonly masterSecret?: string;
-    readonly kid?: string;
-};
-export declare function createProviderChoiceContext(options: CreateProviderChoiceContextOptions): ProviderChoiceContext;
-export declare function createTestProviderChoiceContext(options: Omit<CreateProviderChoiceContextOptions, "masterSecret"> & {
-    readonly masterSecret?: string;
-}): ProviderChoiceContext;

package/dist/runtime/choice.js

@@ -1,413 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "../choice-token.js";
-import { ProviderError } from "../errors.js";
-export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-const PRIMARY_CHOICE_TOKEN_KID = "v1";
-const MANAGED_CHOICE_TOKEN_VERSION = 1;
-export function createProviderChoiceContext(options) {
-    const kid = options.kid ?? PRIMARY_CHOICE_TOKEN_KID;
-    const resolveMasterSecret = () => resolveChoiceMasterSecret(options);
-    function issue(issueOptions) {
-        const issuedAtMs = issueOptions.nowMs ?? Date.now();
-        const keys = deriveManagedChoiceKeys({
-            masterSecret: resolveMasterSecret(),
-            providerId: options.providerId,
-            purpose: issueOptions.purpose,
-            kid,
-        });
-        const baseEnvelope = {
-            v: MANAGED_CHOICE_TOKEN_VERSION,
-            provider_id: options.providerId,
-            purpose: issueOptions.purpose,
-            issued_at_ms: issuedAtMs,
-            ttl_ms: issueOptions.ttlMs,
-            binding: createChoiceBinding({
-                keys,
-                options: issueOptions.bind,
-                request: options.request,
-                credential: options.credential,
-                required: true,
-            }),
-        };
-        const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
-        if (resolvedStorage.mode === "server") {
-            return issueServerStoredChoice({
-                baseEnvelope,
-                issueOptions,
-                storage: resolvedStorage.storage,
-                contextState: options.state,
-                kid,
-                keys,
-                issuedAtMs,
-            });
-        }
-        const envelope = {
-            ...baseEnvelope,
-            payload: issueOptions.payload,
-        };
-        return encryptManagedChoiceToken({
-            prefix: issueOptions.prefix,
-            kid,
-            envelope,
-            keys,
-        });
-    }
-    function parse(parseOptions) {
-        const [actualPrefix, tokenKid, encodedIv, encryptedPayload, authTag, signature] = parseManagedChoiceTokenParts(parseOptions.token);
-        if (actualPrefix !== parseOptions.prefix ||
-            tokenKid !== kid ||
-            !encodedIv ||
-            !encryptedPayload ||
-            !authTag ||
-            !signature) {
-            throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-        }
-        const keys = deriveManagedChoiceKeys({
-            masterSecret: resolveMasterSecret(),
-            providerId: options.providerId,
-            purpose: parseOptions.purpose,
-            kid: tokenKid,
-        });
-        const signedBody = [parseOptions.prefix, tokenKid, encodedIv, encryptedPayload, authTag].join(".");
-        assertManagedChoiceSignature({
-            signedBody,
-            signature,
-            signingKey: keys.signing,
-        });
-        const envelope = decryptManagedChoiceToken({
-            encodedIv,
-            encryptedPayload,
-            authTag,
-            encryptionKey: keys.encryption,
-        });
-        assertManagedChoiceEnvelope(envelope, {
-            providerId: options.providerId,
-            purpose: parseOptions.purpose,
-            ttlMs: parseOptions.ttlMs,
-            nowMs: parseOptions.nowMs,
-            futureToleranceMs: parseOptions.futureToleranceMs,
-        });
-        assertChoiceBindingMatches({
-            actual: envelope.binding,
-            expected: createChoiceBinding({
-                keys,
-                options: parseOptions.bind,
-                request: options.request,
-                credential: options.credential,
-                required: true,
-            }),
-        });
-        if (isServerChoiceHandlePayload(envelope.payload)) {
-            return parseServerStoredChoice({
-                handle: envelope.payload,
-                storage: parseOptions.storage,
-                contextState: options.state,
-            });
-        }
-        return envelope.payload;
-    }
-    return { issue, parse };
-}
-export function createTestProviderChoiceContext(options) {
-    return createProviderChoiceContext({
-        ...options,
-        masterSecret: options.masterSecret ?? "apifuse-test-provider-runtime-choice-token-master-secret",
-    });
-}
-function resolveChoiceMasterSecret(options) {
-    const configured = options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
-    const trimmed = configured?.trim();
-    if (trimmed)
-        return trimmed;
-    throw new ProviderError("Provider runtime choice-token master secret is not configured.", {
-        code: "CHOICE_TOKEN_MASTER_SECRET_NOT_CONFIGURED",
-        category: "internal_error",
-        retryable: false,
-        details: {
-            secret: PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
-        },
-    });
-}
-function deriveManagedChoiceKeys(input) {
-    return {
-        encryption: deriveManagedChoiceKey(input, "encryption"),
-        signing: deriveManagedChoiceKey(input, "signing"),
-        binding: deriveManagedChoiceKey(input, "binding"),
-    };
-}
-function deriveManagedChoiceKey(input, usage) {
-    return createHmac("sha256", input.masterSecret)
-        .update("apifuse-provider-choice-token")
-        .update("\0")
-        .update(input.providerId)
-        .update("\0")
-        .update(input.purpose)
-        .update("\0")
-        .update(input.kid)
-        .update("\0")
-        .update(usage)
-        .digest();
-}
-function encryptManagedChoiceToken(options) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", options.keys.encryption, iv);
-    const encryptedPayload = Buffer.concat([
-        cipher.update(JSON.stringify(options.envelope), "utf8"),
-        cipher.final(),
-    ]).toString("base64url");
-    const authTag = cipher.getAuthTag().toString("base64url");
-    const encodedIv = iv.toString("base64url");
-    const signedBody = [options.prefix, options.kid, encodedIv, encryptedPayload, authTag].join(".");
-    const signature = createHmac("sha256", options.keys.signing)
-        .update(signedBody)
-        .digest("base64url");
-    return `${signedBody}.${signature}`;
-}
-async function issueServerStoredChoice(options) {
-    const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
-    const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
-    if (payloadBytes > options.storage.maxValueBytes) {
-        throw new ProviderError("Provider choice payload exceeds state storage policy.", {
-            code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
-            category: "input_validation",
-            retryable: false,
-            details: {
-                maxValueBytes: options.storage.maxValueBytes,
-                payloadBytes,
-            },
-        });
-    }
-    const stateId = `choice_${randomBytes(16).toString("base64url")}`;
-    const digest = digestChoicePayload(serializedPayload);
-    const namespace = resolveChoiceStateNamespace({
-        storage: options.storage,
-        contextState: options.contextState,
-        ttlMs: options.issueOptions.ttlMs,
-    });
-    await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
-        ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
-    });
-    const envelope = {
-        ...options.baseEnvelope,
-        payload: {
-            storage: "server",
-            state_id: stateId,
-            payload_digest: digest,
-            created_at_ms: options.issuedAtMs,
-        },
-    };
-    return encryptManagedChoiceToken({
-        prefix: options.issueOptions.prefix,
-        kid: options.kid,
-        envelope,
-        keys: options.keys,
-    });
-}
-async function parseServerStoredChoice(options) {
-    const storage = resolveParseStorage(options.storage);
-    const namespace = resolveChoiceStateNamespace({
-        storage,
-        contextState: options.contextState,
-    });
-    const record = await namespace.get(optionsStateKey(options.handle.state_id));
-    if (!record) {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token state payload is missing.");
-    }
-    const serializedPayload = serializeChoicePayload(record.value);
-    assertPayloadDigestMatches({
-        actual: digestChoicePayload(serializedPayload),
-        expected: options.handle.payload_digest,
-    });
-    return record.value;
-}
-function resolveIssueStorage(storage, payload) {
-    if (!storage || storage.mode === "inline")
-        return { mode: "inline" };
-    if (storage.mode === "server")
-        return { mode: "server", storage };
-    const payloadBytes = Buffer.byteLength(serializeChoicePayload(payload), "utf8");
-    if (payloadBytes <= storage.maxInlineBytes)
-        return { mode: "inline" };
-    return { mode: "server", storage };
-}
-function resolveParseStorage(storage) {
-    if (!storage || storage.mode === "inline") {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token requires server-side choice storage.");
-    }
-    return storage;
-}
-function resolveChoiceStateNamespace(options) {
-    const state = options.storage.state ?? options.contextState;
-    if (!state) {
-        throw new ProviderError("Provider choice state storage is not available.", {
-            code: "CHOICE_STATE_UNAVAILABLE",
-            category: "internal_error",
-            retryable: false,
-        });
-    }
-    return state.namespace(options.storage.namespace, {
-        defaultTtl: stateTtl(options.storage, options.ttlMs),
-        maxTtl: stateTtl(options.storage, options.ttlMs),
-        maxEntries: options.storage.maxEntries,
-        maxValueBytes: options.storage.maxValueBytes,
-    });
-}
-function stateTtl(storage, ttlMs) {
-    return storage.ttl ?? `${ttlMs ?? 1}ms`;
-}
-function optionsStateKey(stateId) {
-    return stateId;
-}
-function serializeChoicePayload(payload) {
-    return JSON.stringify(payload);
-}
-function digestChoicePayload(serializedPayload) {
-    return createHash("sha256").update(serializedPayload).digest("base64url");
-}
-function isServerChoiceHandlePayload(value) {
-    return (value.storage === "server" &&
-        typeof value.state_id === "string" &&
-        typeof value.payload_digest === "string" &&
-        typeof value.created_at_ms === "number");
-}
-function assertPayloadDigestMatches(options) {
-    const actual = Buffer.from(options.actual);
-    const expected = Buffer.from(options.expected);
-    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token state payload digest is invalid.");
-    }
-}
-function parseManagedChoiceTokenParts(token) {
-    const parts = token.split(".");
-    if (parts.length !== 6) {
-        throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-    }
-    return [parts[0], parts[1], parts[2], parts[3], parts[4], parts[5]];
-}
-function assertManagedChoiceSignature(options) {
-    const expected = createHmac("sha256", options.signingKey)
-        .update(options.signedBody)
-        .digest("base64url");
-    const actualBuffer = Buffer.from(options.signature);
-    const expectedBuffer = Buffer.from(expected);
-    if (actualBuffer.length !== expectedBuffer.length ||
-        !timingSafeEqual(actualBuffer, expectedBuffer)) {
-        throw new ProviderChoiceTokenError("invalid_signature", "Provider choice token signature is invalid.");
-    }
-}
-function decryptManagedChoiceToken(options) {
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", options.encryptionKey, Buffer.from(options.encodedIv, "base64url"));
-        decipher.setAuthTag(Buffer.from(options.authTag, "base64url"));
-        const decrypted = Buffer.concat([
-            decipher.update(Buffer.from(options.encryptedPayload, "base64url")),
-            decipher.final(),
-        ]).toString("utf8");
-        const parsed = JSON.parse(decrypted);
-        if (!isManagedChoiceEnvelope(parsed)) {
-            throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-        }
-        return parsed;
-    }
-    catch (error) {
-        if (error instanceof ProviderChoiceTokenError) {
-            throw error;
-        }
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-}
-function isManagedChoiceEnvelope(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    if (!("payload" in value) || !isChoicePayload(value.payload))
-        return false;
-    return ("v" in value &&
-        value.v === MANAGED_CHOICE_TOKEN_VERSION &&
-        "provider_id" in value &&
-        typeof value.provider_id === "string" &&
-        "purpose" in value &&
-        typeof value.purpose === "string" &&
-        "issued_at_ms" in value &&
-        typeof value.issued_at_ms === "number" &&
-        "ttl_ms" in value &&
-        typeof value.ttl_ms === "number" &&
-        (!("binding" in value) || value.binding === undefined || isChoiceBinding(value.binding)));
-}
-function isChoicePayload(value) {
-    return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function isChoiceBinding(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    return ((!("connection_hash" in value) || typeof value.connection_hash === "string") &&
-        (!("credential_hash" in value) || typeof value.credential_hash === "string"));
-}
-function assertManagedChoiceEnvelope(envelope, options) {
-    if (envelope.provider_id !== options.providerId || envelope.purpose !== options.purpose) {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-    assertFreshProviderChoiceIssuedAt(envelope.issued_at_ms, {
-        // Clamp to the issuer's embedded TTL so a caller-supplied value cannot
-        // silently extend token validity past the deadline the issuer intended.
-        ttlMs: options.ttlMs != null ? Math.min(options.ttlMs, envelope.ttl_ms) : envelope.ttl_ms,
-        nowMs: options.nowMs,
-        futureToleranceMs: options.futureToleranceMs,
-    });
-}
-function createChoiceBinding(options) {
-    const connectionHash = options.options?.connection ? hashRequiredConnection(options) : undefined;
-    const credentialHash = options.options?.credentialKeys?.length
-        ? hashCredentialKeys(options)
-        : undefined;
-    if (!connectionHash && !credentialHash)
-        return undefined;
-    return {
-        ...(connectionHash ? { connection_hash: connectionHash } : {}),
-        ...(credentialHash ? { credential_hash: credentialHash } : {}),
-    };
-}
-function hashRequiredConnection(options) {
-    const connectionId = options.request?.connectionId;
-    if (!connectionId) {
-        if (!options.required)
-            return undefined;
-        throw new ProviderError("Provider choice tokens require connection context.", {
-            code: "CHOICE_CONTEXT_REQUIRED",
-            category: "input_validation",
-            retryable: false,
-        });
-    }
-    return createHmac("sha256", options.keys.binding)
-        .update("connection")
-        .update("\0")
-        .update(connectionId)
-        .digest("base64url");
-}
-function hashCredentialKeys(options) {
-    const credentialKeys = options.options?.credentialKeys ?? [];
-    const material = credentialKeys.map((key) => {
-        const value = options.credential?.get(key);
-        if (typeof value !== "string" || value.length === 0) {
-            throw new ProviderError("Provider choice tokens require configured credential binding.", {
-                code: "CHOICE_CONTEXT_REQUIRED",
-                category: "input_validation",
-                retryable: false,
-                details: { credentialKey: key },
-            });
-        }
-        return [key, value];
-    });
-    return createHmac("sha256", options.keys.binding)
-        .update("credential")
-        .update("\0")
-        .update(JSON.stringify(material))
-        .digest("base64url");
-}
-function assertChoiceBindingMatches(options) {
-    if (options.actual?.connection_hash !== options.expected?.connection_hash) {
-        throw new ProviderChoiceTokenError("invalid_binding", "Provider choice token connection binding is invalid.");
-    }
-    if (options.actual?.credential_hash !== options.expected?.credential_hash) {
-        throw new ProviderChoiceTokenError("invalid_binding", "Provider choice token credential binding is invalid.");
-    }
-}