@atlasauth/backend 0.30.0 → 0.31.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.30.0",
+  "version": "0.31.1",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -12,6 +12,10 @@
       "types": "./dist/rp.d.ts",
       "default": "./dist/rp.js"
     },
+    "./pca": {
+      "types": "./dist/pca-entry.d.ts",
+      "default": "./dist/pca-entry.js"
+    },
     "./testing": {
       "types": "./dist/testing.d.ts",
       "default": "./dist/testing.js"
@@ -33,12 +37,12 @@
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
     "@noble/curves": "^1.9.1",
-    "@atlasauth/authz": "0.3.0",
-    "@atlasauth/pca": "0.1.0"
+    "@atlasauth/authz": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^5.6.3",
-    "vitest": "^2.1.4"
+    "vitest": "^2.1.4",
+    "@atlasauth/pca": "^0.4.3"
   },
   "publishConfig": {
     "access": "public"
@@ -58,6 +62,14 @@
   "bugs": {
     "url": "https://github.com/alphajew420/ssoly/issues"
   },
+  "peerDependencies": {
+    "@atlasauth/pca": "^0.4.3"
+  },
+  "peerDependenciesMeta": {
+    "@atlasauth/pca": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",

package/dist/pca/require-pca.d.ts

@@ -1,47 +0,0 @@
-import { type Capability, type PCActn, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
-import { type PcaContext, type PcaVerdict } from './verify';
-/** Framework-agnostic request shape: anything with headers and (optionally) a parsed/raw body. */
-export interface PcaRequestLike {
-    headers: Record<string, string | string[] | undefined> | {
-        get(name: string): string | null;
-    };
-    body?: unknown;
-}
-/** Per-holder replay + budget state. Implement over Redis/DB; the in-memory one is for tests/single node. */
-export interface PcaStateStore {
-    get(key: string): Promise<{
-        budget?: TrustBudget;
-        lastCounter?: number;
-    } | undefined>;
-    put(key: string, state: {
-        budget?: TrustBudget;
-        lastCounter?: number;
-    }): Promise<void>;
-}
-export declare function memoryPcaStore(): PcaStateStore;
-export interface RequirePcaOptions {
-    /** Resolve the Root Intent Grant from the PCActn's `grant_ref`. null = unknown grant. */
-    resolveGrant: (grantRef: string, pcactn: PCActn) => Promise<Capability | null>;
-    hooks?: VerifyHooks;
-    extract?: (req: PcaRequestLike) => PCActn | string | null;
-    /** Anti-replay counter + budget persistence. Without it counters are not checked (surfaced in checks). */
-    budgetStore?: PcaStateStore;
-    /** Build verification context (params, plan, risk) per request. */
-    context?: (req: PcaRequestLike, pcactn: PCActn) => PcaContext | Promise<PcaContext>;
-    now?: () => number;
-    /** WWW-Authenticate realm (default "pca"). */
-    realm?: string;
-}
-export type PcaGuardResult = {
-    ok: true;
-    verdict: PcaVerdict;
-    pcactn: PCActn;
-} | {
-    ok: false;
-    status: 401 | 403;
-    verdict: PcaVerdict;
-    wwwAuthenticate?: string;
-};
-/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
-export declare function defaultExtract(req: PcaRequestLike): PCActn | string | null;
-export declare function requirePCA(opts: RequirePcaOptions): (req: PcaRequestLike) => Promise<PcaGuardResult>;

package/dist/pca/require-pca.js

@@ -1,121 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.memoryPcaStore = memoryPcaStore;
-exports.defaultExtract = defaultExtract;
-exports.requirePCA = requirePCA;
-const pca_1 = require("@atlasauth/pca");
-const verify_1 = require("./verify");
-function memoryPcaStore() {
-    const m = new Map();
-    return { get: async (k) => m.get(k), put: async (k, v) => void m.set(k, v) };
-}
-function header(req, name) {
-    const h = req.headers;
-    if (typeof h.get === 'function')
-        return h.get(name) ?? undefined;
-    const v = h[name] ?? h[name.toLowerCase()];
-    return Array.isArray(v) ? v[0] : v;
-}
-function fromB64u(s) {
-    const b = s.replace(/-/g, '+').replace(/_/g, '/');
-    return Buffer.from(b, 'base64').toString('utf8');
-}
-/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
-function defaultExtract(req) {
-    const h = header(req, 'pca-action');
-    if (h)
-        return fromB64u(h.trim());
-    let b = req.body;
-    if (typeof b === 'string') {
-        try {
-            b = JSON.parse(b);
-        }
-        catch {
-            return null;
-        }
-    }
-    const x = b?.pcactn;
-    if (typeof x === 'string' || (x !== null && typeof x === 'object'))
-        return x;
-    return null;
-}
-const denyVerdict = (reason) => ({
-    allow: false,
-    r: 1,
-    requiredThreshold: { t: 3, proof: 'strong', optimisticAllowed: false },
-    checks: { pcactn: 'fail' },
-    reasons: [reason],
-});
-function requirePCA(opts) {
-    const realm = opts.realm ?? 'pca';
-    const challenge = (error) => `PCA realm="${realm}"${error ? `, error="${error}"` : ''}, hint="send PCA-Action: <base64url PCActn> or JSON body {pcactn}"`;
-    const unauth = (reason, error = 'invalid_request') => ({
-        ok: false,
-        status: 401,
-        verdict: denyVerdict(reason),
-        wwwAuthenticate: challenge(error),
-    });
-    return async (req) => {
-        try {
-            let raw;
-            try {
-                raw = (opts.extract ?? defaultExtract)(req);
-            }
-            catch (e) {
-                return unauth(`unreadable PCActn: ${e.message}`);
-            }
-            if (raw === null || raw === undefined)
-                return unauth('no PCActn presented', 'missing_pcactn');
-            let p;
-            try {
-                p = typeof raw === 'string' ? (0, pca_1.decodePCActn)(raw) : raw;
-            }
-            catch (e) {
-                return unauth(`undecodable PCActn: ${e.message}`, 'invalid_pcactn');
-            }
-            if (p === null || typeof p !== 'object' || typeof p.grant_ref !== 'string') {
-                return unauth('malformed PCActn', 'invalid_pcactn');
-            }
-            const grant = await opts.resolveGrant(p.grant_ref, p);
-            if (!grant)
-                return unauth('unknown grant_ref', 'unknown_grant');
-            const now = opts.now?.() ?? Date.now();
-            const leafHolder = p.cap_chain?.[p.cap_chain.length - 1]?.holder;
-            const key = `${grant.id}:${leafHolder ?? ''}`;
-            const state = opts.budgetStore && leafHolder ? await opts.budgetStore.get(key) : undefined;
-            const ctx = { ...(await opts.context?.(req, p)) };
-            if (state?.budget && ctx.budget === undefined)
-                ctx.budget = state.budget;
-            const verdict = await (0, verify_1.verifyPCActn)(p, { grant, hooks: opts.hooks, now, context: ctx });
-            // Anti-replay (Appendix A step 5): strictly increasing per holder.
-            if (opts.budgetStore) {
-                if (state?.lastCounter !== undefined && !(p.counter > state.lastCounter)) {
-                    verdict.allow = false;
-                    verdict.checks.counter = 'fail';
-                    verdict.reasons.push(`counter: ${String(p.counter)} is not greater than last seen ${state.lastCounter} (replay)`);
-                }
-                else if (verdict.checks.counter === 'pass') {
-                    verdict.checks.counter = 'pass';
-                }
-            }
-            else if (verdict.checks.counter === 'pass') {
-                verdict.checks.counter = 'not-enforced';
-            }
-            if (!verdict.allow) {
-                // A bad signature / chain is an authentication failure; policy denial is authorization.
-                const authnFailed = ['version', 'cap_chain', 'leaf_signature', 'malformed', 'grant_ref'].some((c) => verdict.checks[c] === 'fail');
-                return authnFailed
-                    ? { ok: false, status: 401, verdict, wwwAuthenticate: challenge('invalid_pcactn') }
-                    : { ok: false, status: 403, verdict };
-            }
-            if (opts.budgetStore && leafHolder) {
-                await opts.budgetStore.put(key, { budget: verdict.budget ?? state?.budget, lastCounter: p.counter });
-            }
-            return { ok: true, verdict, pcactn: p };
-        }
-        catch (e) {
-            return { ok: false, status: 403, verdict: denyVerdict(`guard error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`) };
-        }
-    };
-}
-//# sourceMappingURL=require-pca.js.map

package/dist/pca/require-pca.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"require-pca.js","sourceRoot":"","sources":["../../src/pca/require-pca.ts"],"names":[],"mappings":";;AAeA,wCAGC;AAiCD,wCAcC;AAUD,gCAuEC;AAlJD,wCAAgH;AAChH,qCAA0E;AAc1E,SAAgB,cAAc;IAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAoBD,SAAS,MAAM,CAAC,GAAmB,EAAE,IAAY;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,GAAmB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAI,CAA6C,EAAE,MAAM,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,CAAoB,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK;IACZ,CAAC,EAAE,CAAC;IACJ,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACtE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,SAAgB,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CACnC,cAAc,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,oEAAoE,CAAC;IAC/H,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAK,GAAG,iBAAiB,EAAkB,EAAE,CAAC,CAAC;QAC7E,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC;QAC5B,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC;KAClC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,GAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YAC9F,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3E,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC;YACjE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,GAAG,GAAe,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAEzE,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAY,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvF,mEAAmE;YACnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;oBAChC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,KAAK,CAAC,WAAW,WAAW,CAAC,CAAC;gBACpH,CAAC;qBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;oBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBAClC,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,wFAAwF;gBACxF,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAC3F,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CACpC,CAAC;gBACF,OAAO,WAAW;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE;oBACnF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACtI,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/pca/verify.d.ts

@@ -1,36 +0,0 @@
-import { type Capability, type CheckStatus, type PCActn, type PlanNode, type RequiredThreshold, type RiskInputs, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
-/**
- * Resource-server side Proof-Carrying Authority verifier (spec §4, §7, Appendix A).
- * Deterministic and offline; never throws (any internal error becomes a fail-closed verdict).
- */
-export interface PcaContext {
-    /** Plaintext action params. If given they MUST hash to `action.params_digest`; needed by predicates. */
-    params?: Record<string, unknown>;
-    subject?: Record<string, unknown>;
-    env?: Record<string, unknown>;
-    /** The committed plan, if the RS knows it. Its Merkle root must equal `plan.root`. */
-    plan?: PlanNode[];
-    /** Risk inputs the RS can vouch for. Missing ones fail closed (worst case) except `taint`, see below. */
-    risk?: Partial<RiskInputs>;
-    /** Current trust budget for the leaf holder. Absent = a full budget (`budget` check reports not-enforced). */
-    budget?: TrustBudget;
-    recentActionTimes?: number[];
-}
-export interface VerifyPCActnOptions {
-    grant: Capability;
-    hooks?: VerifyHooks;
-    /** epoch ms (default Date.now()) */
-    now?: number;
-    context?: PcaContext;
-}
-export interface PcaVerdict {
-    allow: boolean;
-    /** Recomputed risk score in [0,1]. */
-    r: number;
-    requiredThreshold: RequiredThreshold;
-    checks: Record<string, CheckStatus>;
-    reasons: string[];
-    /** Budget after the decision (leaked, and debited when auto-admitted). Persist it on allow. */
-    budget?: TrustBudget;
-}
-export declare function verifyPCActn(pcactn: PCActn | string, opts: VerifyPCActnOptions): Promise<PcaVerdict>;

package/dist/pca/verify.js

@@ -1,136 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyPCActn = verifyPCActn;
-const pca_1 = require("@atlasauth/pca");
-const WORST_THRESHOLD = { t: 3, proof: 'strong', optimisticAllowed: false };
-function failClosed(reason, checks = {}) {
-    return {
-        allow: false,
-        r: 1,
-        requiredThreshold: WORST_THRESHOLD,
-        checks: { ...checks, malformed: 'fail' },
-        reasons: [reason],
-    };
-}
-async function verifyPCActn(pcactn, opts) {
-    try {
-        let p;
-        try {
-            p = typeof pcactn === 'string' ? (0, pca_1.decodePCActn)(pcactn) : pcactn;
-        }
-        catch (e) {
-            return failClosed(`undecodable PCActn: ${e.message}`);
-        }
-        if (p === null || typeof p !== 'object')
-            return failClosed('PCActn is not an object');
-        const now = opts.now ?? Date.now();
-        const ctx = opts.context ?? {};
-        const core = await (0, pca_1.verifyPCActnCore)(p, { grant: opts.grant, nowEpoch: now, hooks: opts.hooks });
-        const checks = { ...core.checks };
-        const reasons = [];
-        if (!core.allow && core.reason)
-            reasons.push(core.reason);
-        const fail = (name, why) => {
-            checks[name] = 'fail';
-            reasons.push(`${name}: ${why}`);
-        };
-        // grant_ref binds the object to this grant
-        if (p.grant_ref === opts.grant.id)
-            checks.grant_ref = 'pass';
-        else
-            fail('grant_ref', 'does not reference the supplied grant');
-        // params plaintext must open the committed digest
-        if (ctx.params !== undefined) {
-            if ((0, pca_1.hashCanonical)(ctx.params) === p.action?.params_digest)
-                checks.params_digest = 'pass';
-            else
-                fail('params_digest', 'supplied params do not hash to action.params_digest');
-        }
-        else
-            checks.params_digest = 'not-enforced';
-        // the RS's own copy of the plan must be the committed one
-        if (ctx.plan) {
-            if ((0, pca_1.merkleRoot)(ctx.plan.map(pca_1.planNodeLeaf)) === p.plan?.root)
-                checks.plan_root_authorized = 'pass';
-            else
-                fail('plan_root_authorized', 'known plan does not match plan.root');
-        }
-        const chain = Array.isArray(p.cap_chain) ? p.cap_chain : [];
-        const leaf = chain[chain.length - 1];
-        const depth = Math.max(0, chain.length - 1);
-        const now0 = now;
-        const budgetIn = ctx.budget ?? { B: Number.POSITIVE_INFINITY, tau: now0, asOf: now0 };
-        checks.budget = ctx.budget ? 'pass' : 'not-enforced';
-        // Taint: the agent's claim, used only as a default input (RS-supplied risk.taint wins).
-        const claimedTaint = p.provenance?.taint_level;
-        const risk = { ...ctx.risk };
-        if (risk.taint === undefined && typeof claimedTaint === 'number')
-            risk.taint = claimedTaint;
-        const reversibility = p.action?.reversibility_class;
-        const bMaxProbe = decideBudget(opts.grant, budgetIn, ctx.budget === undefined);
-        const d = (0, pca_1.decide)({
-            grant: opts.grant,
-            action: {
-                action: { verb: p.action?.verb, resource: p.action?.resource, params: ctx.params, reversibility_class: reversibility },
-                subject: ctx.subject,
-                env: ctx.env,
-            },
-            plan: ctx.plan,
-            nodeId: p.plan?.node_id,
-            risk,
-            budget: bMaxProbe,
-            now,
-            caveatContext: { delegationDepth: depth, recentActionTimes: ctx.recentActionTimes },
-        });
-        // Caveats added by delegation hops (beyond the root's) are conjunctive too.
-        if (leaf) {
-            const extra = leaf.caveats.slice(opts.grant.caveats.length);
-            const cv = (0, pca_1.evaluateCaveats)(extra, {
-                now,
-                blastRadius: risk.blastRadius,
-                reversibilityClass: reversibility,
-                delegationDepth: depth,
-                recentActionTimes: ctx.recentActionTimes,
-            });
-            if (cv.ok)
-                checks.delegated_caveats = 'pass';
-            else
-                fail('delegated_caveats', `delegation caveat(s) not satisfied: ${cv.failed.join(', ')}`);
-        }
-        if (d.releaseGuardianShare)
-            checks.policy = 'pass';
-        else {
-            checks.policy = 'fail';
-            reasons.push(...d.reasons.map((x) => `policy: ${x}`));
-        }
-        if (d.releaseGuardianShare) {
-            // informational reasons (step-up, assumed worst case) are kept even when released
-            reasons.push(...d.reasons.map((x) => `policy: ${x}`));
-        }
-        // Threshold: t > 1 needs a proof we can only get from an enforced threshold hook.
-        const th = checks.threshold;
-        if (d.requiredThreshold.t > 1 && d.releaseGuardianShare && th !== 'pass') {
-            fail('threshold', th === 'fail'
-                ? `t=${d.requiredThreshold.t} required and the threshold proof was rejected`
-                : `t=${d.requiredThreshold.t} (${d.requiredThreshold.proof}) required but no threshold verifier is enforced`);
-        }
-        const allow = !Object.values(checks).includes('fail') && d.releaseGuardianShare && core.allow;
-        if (allow) {
-            return { allow, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons, budget: ctx.budget ? d.budget : undefined };
-        }
-        if (reasons.length === 0)
-            reasons.push('denied');
-        return { allow: false, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons };
-    }
-    catch (e) {
-        return failClosed(`verifier error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`);
-    }
-}
-/** Without a caller-supplied budget, use a full budget (grant's bMax) so absence does not itself deny. */
-function decideBudget(grant, b, absent) {
-    if (!absent)
-        return b;
-    const bMax = (0, pca_1.readEnvelope)(grant)?.risk_policy.bMax;
-    return { ...b, B: typeof bMax === 'number' && Number.isFinite(bMax) ? bMax : 0 };
-}
-//# sourceMappingURL=verify.js.map

package/dist/pca/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/pca/verify.ts"],"names":[],"mappings":";;AAsEA,oCA+GC;AArLD,wCAiBwB;AAyCxB,MAAM,eAAe,GAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAE/F,SAAS,UAAU,CAAC,MAAc,EAAE,SAAsC,EAAE;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,CAAC,EAAE,CAAC;QACJ,iBAAiB,EAAE,eAAe;QAClC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;QACxC,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,IAAyB;IACnF,IAAI,CAAC;QACH,IAAI,CAAS,CAAC;QACd,IAAI,CAAC;YACH,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,MAAM,GAAgC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;YACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,2CAA2C;QAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;;YACxD,IAAI,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;QAEhE,kDAAkD;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAA,mBAAa,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;;gBACpF,IAAI,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;QACpF,CAAC;;YAAM,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC;QAE7C,0DAA0D;QAC1D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,IAAA,gBAAU,EAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI;gBAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC;;gBAC7F,IAAI,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC;QACjB,MAAM,QAAQ,GAAgB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAErD,wFAAwF;QACxF,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC;QAC/C,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;QAE5F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,IAAA,YAAM,EAAC;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE;gBACN,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE;gBACtH,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO;YACvB,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,GAAG;YACH,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE;SACpF,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,qBAAe,EAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,aAAa;gBACjC,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,EAAE;gBAAE,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;;gBACxC,IAAI,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,CAAC,oBAAoB;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;aAC9C,CAAC;YACJ,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC3B,kFAAkF;YAClF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,kFAAkF;QAClF,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzE,IAAI,CACF,WAAW,EACX,EAAE,KAAK,MAAM;gBACX,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,gDAAgD;gBAC5E,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,kDAAkD,CAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GACT,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC;QAClF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/H,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,YAAY,CAAC,KAAiB,EAAE,CAAc,EAAE,MAAe;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAY,EAAC,KAAK,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC;IACnD,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC"}