@authsec/sdk 4.0.0

package/dist/spiffe/workload-api-client.js

@@ -0,0 +1,355 @@
+"use strict";
+/**
+ * SPIFFE Workload API - gRPC Client
+ * Mirrors Python WorkloadAPIClient
+ *
+ * Client library for workloads to fetch SVIDs from the gRPC Workload API.
+ * Supports streaming X.509-SVIDs with automatic rotation.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadAPIClient = void 0;
+const grpc = __importStar(require("@grpc/grpc-js"));
+const protoLoader = __importStar(require("@grpc/proto-loader"));
+const path = __importStar(require("node:path"));
+// Load proto definition at runtime
+// __dirname works in CJS; for ESM, users would need to set AUTHSEC_PROTO_PATH
+const PROTO_PATH = process.env.AUTHSEC_PROTO_PATH ??
+    path.join(__dirname, 'proto', 'workload.proto');
+const packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+    keepCase: true,
+    longs: String,
+    enums: String,
+    defaults: true,
+    oneofs: true,
+});
+const protoDescriptor = grpc.loadPackageDefinition(packageDefinition);
+const SpiffeWorkloadAPIService = protoDescriptor.spiffe.workload.SpiffeWorkloadAPI;
+class WorkloadAPIClient {
+    socketPath;
+    logger;
+    // Current SVID data
+    spiffeId = null;
+    certificate = null;
+    privateKey = null;
+    trustBundle = null;
+    // gRPC client
+    client = null;
+    streamCall = null;
+    running = false;
+    constructor(options) {
+        this.socketPath =
+            options?.socketPath ?? '/tmp/spire-agent/public/api.sock';
+        this.logger = options?.logger ?? {
+            info: console.log,
+            error: console.error,
+            debug: () => { },
+        };
+    }
+    /** Connect to the Workload API */
+    async connect() {
+        this.logger.info('Connecting to gRPC Workload API');
+        this.logger.info(`  Socket: ${this.socketPath}`);
+        let target;
+        if (this.socketPath.startsWith('tcp://')) {
+            // TCP socket (Windows, VMs, K8s service endpoints)
+            target = this.socketPath.replace('tcp://', '');
+            this.logger.info(`  Using TCP socket: ${target}`);
+        }
+        else if (this.socketPath.startsWith('unix://')) {
+            // Unix socket with unix:// prefix
+            const unixPath = this.socketPath.replace('unix://', '');
+            target = `unix:${unixPath}`;
+            this.logger.info(`  Using Unix socket: ${unixPath}`);
+        }
+        else {
+            // Standard Unix socket path
+            target = `unix:${this.socketPath}`;
+            this.logger.info('  Using Unix socket');
+        }
+        this.client = new SpiffeWorkloadAPIService(target, grpc.credentials.createInsecure());
+        this.logger.info('Connected to Workload API');
+    }
+    /** Disconnect from Workload API */
+    async disconnect() {
+        this.running = false;
+        if (this.streamCall) {
+            this.streamCall.cancel();
+            this.streamCall = null;
+        }
+        if (this.client) {
+            this.client.close();
+            this.client = null;
+        }
+        this.logger.info('Disconnected from Workload API');
+    }
+    /** Build gRPC metadata from environment variables */
+    buildMetadata() {
+        const metadata = new grpc.Metadata();
+        // For TCP sockets, send PID
+        if (this.socketPath.startsWith('tcp://')) {
+            metadata.set('x-pid', String(process.pid));
+            this.logger.debug(`Sending PID ${process.pid} in gRPC metadata`);
+        }
+        // Kubernetes metadata
+        const k8sVars = [
+            ['POD_NAMESPACE', 'x-k8s-namespace'],
+            ['POD_NAME', 'x-k8s-pod-name'],
+            ['POD_UID', 'x-k8s-pod-uid'],
+            ['SERVICE_ACCOUNT', 'x-k8s-service-account'],
+            ['POD_LABEL_APP', 'x-k8s-pod-label-app'],
+        ];
+        for (const [envVar, metaKey] of k8sVars) {
+            const value = process.env[envVar];
+            if (value) {
+                metadata.set(metaKey, value);
+                this.logger.debug(`Sending ${metaKey}: ${value}`);
+            }
+        }
+        // Docker metadata
+        const dockerVars = [
+            ['DOCKER_CONTAINER_ID', 'x-docker-container-id'],
+            ['DOCKER_CONTAINER_NAME', 'x-docker-container-name'],
+            ['DOCKER_IMAGE_NAME', 'x-docker-image-name'],
+        ];
+        for (const [envVar, metaKey] of dockerVars) {
+            const value = process.env[envVar];
+            if (value) {
+                metadata.set(metaKey, value);
+                this.logger.debug(`Sending ${metaKey}: ${value}`);
+            }
+        }
+        // Docker labels as metadata (prefixed with DOCKER_LABEL_)
+        for (const [key, value] of Object.entries(process.env)) {
+            if (key.startsWith('DOCKER_LABEL_') && value) {
+                const labelName = key.slice('DOCKER_LABEL_'.length).toLowerCase();
+                metadata.set(`x-docker-label-${labelName}`, value);
+                this.logger.debug(`Sending Docker label ${labelName}: ${value}`);
+            }
+        }
+        return metadata;
+    }
+    /**
+     * Fetch X.509-SVID once (single request/response).
+     * @returns true if successful, false otherwise
+     */
+    async fetchX509SvidOnce() {
+        try {
+            if (!this.client) {
+                await this.connect();
+            }
+            const metadata = this.buildMetadata();
+            return new Promise((resolve) => {
+                const stream = this.client.FetchX509SVID({}, metadata);
+                stream.on('data', (response) => {
+                    if (response.svids && response.svids.length > 0) {
+                        const svid = response.svids[0];
+                        this.spiffeId = svid.spiffe_id;
+                        this.certificate =
+                            typeof svid.x509_svid === 'string'
+                                ? svid.x509_svid
+                                : Buffer.from(svid.x509_svid).toString('utf-8');
+                        this.privateKey =
+                            typeof svid.x509_svid_key === 'string'
+                                ? svid.x509_svid_key
+                                : Buffer.from(svid.x509_svid_key).toString('utf-8');
+                        this.trustBundle =
+                            typeof svid.bundle === 'string'
+                                ? svid.bundle
+                                : Buffer.from(svid.bundle).toString('utf-8');
+                        this.logger.info('Fetched X.509-SVID');
+                        this.logger.info(`  SPIFFE ID: ${this.spiffeId}`);
+                        this.logger.info('  Certificate issued and ready to use');
+                        this.logger.info('  Trust Bundle received from agent');
+                        stream.cancel();
+                        resolve(true);
+                    }
+                    else {
+                        this.logger.error('No SVIDs in response');
+                        stream.cancel();
+                        resolve(false);
+                    }
+                });
+                stream.on('error', (err) => {
+                    if (err.code !== grpc.status.CANCELLED) {
+                        this.logger.error(`gRPC error fetching SVID: ${err.code} - ${err.details ?? err.message}`);
+                    }
+                    resolve(false);
+                });
+            });
+        }
+        catch (e) {
+            this.logger.error(`Failed to fetch SVID: ${e.message ?? e}`);
+            return false;
+        }
+    }
+    /**
+     * Start streaming X.509-SVID updates.
+     * @param onUpdate Optional callback called when SVID is updated
+     */
+    async startStreaming(onUpdate) {
+        this.running = true;
+        if (!this.client) {
+            await this.connect();
+        }
+        this.logger.info('Starting X.509-SVID stream...');
+        const metadata = this.buildMetadata();
+        this.streamCall = this.client.FetchX509SVID({}, metadata);
+        this.streamCall.on('data', async (response) => {
+            if (!this.running)
+                return;
+            if (response.svids && response.svids.length > 0) {
+                const svid = response.svids[0];
+                this.spiffeId = svid.spiffe_id;
+                this.certificate =
+                    typeof svid.x509_svid === 'string'
+                        ? svid.x509_svid
+                        : Buffer.from(svid.x509_svid).toString('utf-8');
+                this.privateKey =
+                    typeof svid.x509_svid_key === 'string'
+                        ? svid.x509_svid_key
+                        : Buffer.from(svid.x509_svid_key).toString('utf-8');
+                this.trustBundle =
+                    typeof svid.bundle === 'string'
+                        ? svid.bundle
+                        : Buffer.from(svid.bundle).toString('utf-8');
+                this.logger.info('Received SVID update');
+                this.logger.info(`  SPIFFE ID: ${this.spiffeId}`);
+                this.logger.info('  Certificate refreshed from agent');
+                this.logger.info('  Trust Bundle updated');
+                if (onUpdate) {
+                    await onUpdate(this);
+                }
+            }
+        });
+        this.streamCall.on('error', (err) => {
+            if (err.code !== grpc.status.CANCELLED) {
+                this.logger.error(`gRPC stream error: ${err.code} - ${err.details ?? err.message}`);
+            }
+        });
+        this.streamCall.on('end', () => {
+            this.logger.info('SVID stream ended');
+        });
+    }
+    /**
+     * Fetch JWT-SVID.
+     * @param audience List of audiences for the JWT
+     * @param spiffeId Optional SPIFFE ID (defaults to workload's identity)
+     * @returns JWT token or null
+     */
+    async fetchJwtSvid(audience, spiffeId) {
+        try {
+            if (!this.client) {
+                await this.connect();
+            }
+            return new Promise((resolve) => {
+                this.client.FetchJWTSVID({ audience, spiffe_id: spiffeId ?? '' }, (err, response) => {
+                    if (err) {
+                        this.logger.error(`gRPC error fetching JWT-SVID: ${err.code} - ${err.details ?? err.message}`);
+                        resolve(null);
+                        return;
+                    }
+                    if (response.svids && response.svids.length > 0) {
+                        const jwtSvid = response.svids[0];
+                        this.logger.info('Fetched JWT-SVID');
+                        this.logger.info(`  SPIFFE ID: ${jwtSvid.spiffe_id}`);
+                        this.logger.info(`  Audience: ${audience}`);
+                        resolve(jwtSvid.svid);
+                    }
+                    else {
+                        this.logger.error('No JWT-SVIDs in response');
+                        resolve(null);
+                    }
+                });
+            });
+        }
+        catch (e) {
+            this.logger.error(`Failed to fetch JWT-SVID: ${e.message ?? e}`);
+            return null;
+        }
+    }
+    /**
+     * Validate JWT-SVID.
+     * @param token JWT token to validate
+     * @param audience Expected audience
+     * @returns Validation result with spiffe_id and claims, or null if invalid
+     */
+    async validateJwtSvid(token, audience) {
+        try {
+            if (!this.client) {
+                await this.connect();
+            }
+            return new Promise((resolve) => {
+                this.client.ValidateJWTSVID({ svid: token, audience }, (err, response) => {
+                    if (err) {
+                        this.logger.error(`gRPC error validating JWT-SVID: ${err.code} - ${err.details ?? err.message}`);
+                        resolve(null);
+                        return;
+                    }
+                    this.logger.info('JWT-SVID validated');
+                    this.logger.info(`  SPIFFE ID: ${response.spiffe_id}`);
+                    resolve({
+                        spiffeId: response.spiffe_id,
+                        claims: response.claims ?? {},
+                    });
+                });
+            });
+        }
+        catch (e) {
+            this.logger.error(`Failed to validate JWT-SVID: ${e.message ?? e}`);
+            return null;
+        }
+    }
+    /**
+     * Get mTLS configuration for HTTP clients.
+     * @returns Object with cert, key, and caBundle, or null if not available
+     */
+    getMtlsConfig() {
+        if (!this.certificate || !this.privateKey || !this.trustBundle) {
+            return null;
+        }
+        return {
+            cert: this.certificate,
+            key: this.privateKey,
+            caBundle: this.trustBundle,
+        };
+    }
+    /** Check if SVID is available */
+    hasSvid() {
+        return this.spiffeId !== null;
+    }
+}
+exports.WorkloadAPIClient = WorkloadAPIClient;
+//# sourceMappingURL=workload-api-client.js.map

package/dist/spiffe/workload-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-api-client.js","sourceRoot":"","sources":["../../src/spiffe/workload-api-client.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AACtC,gEAAkD;AAClD,gDAAkC;AAElC,mCAAmC;AACnC,8EAA8E;AAC9E,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAElD,MAAM,iBAAiB,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE;IACzD,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAQ,CAAC;AAC7E,MAAM,wBAAwB,GAC5B,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;AAEpD,MAAa,iBAAiB;IACpB,UAAU,CAAS;IACnB,MAAM,CAAuD;IAErE,oBAAoB;IACpB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,WAAW,GAAkB,IAAI,CAAC;IAClC,UAAU,GAAkB,IAAI,CAAC;IACjC,WAAW,GAAkB,IAAI,CAAC;IAElC,cAAc;IACN,MAAM,GAAQ,IAAI,CAAC;IACnB,UAAU,GAAQ,IAAI,CAAC;IACvB,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,OAGX;QACC,IAAI,CAAC,UAAU;YACb,OAAO,EAAE,UAAU,IAAI,kCAAkC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI;YAC/B,IAAI,EAAE,OAAO,CAAC,GAAG;YACjB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;SAChB,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEjD,IAAI,MAAc,CAAC;QAEnB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,mDAAmD;YACnD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,kCAAkC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,QAAQ,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,MAAM,GAAG,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,wBAAwB,CACxC,MAAM,EACN,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAClC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAErB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACrD,CAAC;IAED,qDAAqD;IAC7C,aAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAErC,4BAA4B;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;QACnE,CAAC;QAED,sBAAsB;QACtB,MAAM,OAAO,GAA4B;YACvC,CAAC,eAAe,EAAE,iBAAiB,CAAC;YACpC,CAAC,UAAU,EAAE,gBAAgB,CAAC;YAC9B,CAAC,SAAS,EAAE,eAAe,CAAC;YAC5B,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;YAC5C,CAAC,eAAe,EAAE,qBAAqB,CAAC;SACzC,CAAC;QAEF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,UAAU,GAA4B;YAC1C,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;YAChD,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;YACpD,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;SAC7C,CAAC;QAEF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAEtC,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAEvD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,QAAa,EAAE,EAAE;oBAClC,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;wBAC/B,IAAI,CAAC,WAAW;4BACd,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gCAChC,CAAC,CAAC,IAAI,CAAC,SAAS;gCAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACpD,IAAI,CAAC,UAAU;4BACb,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;gCACpC,CAAC,CAAC,IAAI,CAAC,aAAa;gCACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACxD,IAAI,CAAC,WAAW;4BACd,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gCAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;gCACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBAEjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;wBAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;wBAEvD,MAAM,CAAC,MAAM,EAAE,CAAC;wBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;wBAC1C,MAAM,CAAC,MAAM,EAAE,CAAC;wBAChB,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;oBAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6BAA6B,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CACxE,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,QAAuD;QAEvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAa,EAAE,EAAE;YACjD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAE1B,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC/B,IAAI,CAAC,WAAW;oBACd,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;wBAChC,CAAC,CAAC,IAAI,CAAC,SAAS;wBAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,CAAC,UAAU;oBACb,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;wBACpC,CAAC,CAAC,IAAI,CAAC,aAAa;wBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACxD,IAAI,CAAC,WAAW;oBACd,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;wBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;wBACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAEjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAE3C,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sBAAsB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,QAAkB,EAClB,QAAiB;QAEjB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAED,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;gBAC5C,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,EACvC,CAAC,GAAQ,EAAE,QAAa,EAAE,EAAE;oBAC1B,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iCAAiC,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAC5E,CAAC;wBACF,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;wBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;wBACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;wBAC5C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;wBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,QAAgB;QAEhB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,CACzB,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EACzB,CAAC,GAAQ,EAAE,QAAa,EAAE,EAAE;oBAC1B,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mCAAmC,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAC9E,CAAC;wBACF,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;oBACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;oBAEvD,OAAO,CAAC;wBACN,QAAQ,EAAE,QAAQ,CAAC,SAAS;wBAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,aAAa;QAKX,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,QAAQ,EAAE,IAAI,CAAC,WAAW;SAC3B,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;CACF;AA5WD,8CA4WC"}

package/dist/spiffe/workload-svid.d.ts

@@ -0,0 +1,44 @@
+/**
+ * WorkloadSVID - SVID data container with certificate file management
+ * Mirrors Python WorkloadSVID dataclass
+ */
+import * as tls from 'node:tls';
+export declare class WorkloadSVID {
+    spiffeId: string;
+    certificate: string;
+    privateKey: string;
+    trustBundle: string;
+    certDir: string;
+    certFilePath: string | null;
+    keyFilePath: string | null;
+    caFilePath: string | null;
+    constructor(options: {
+        spiffeId: string;
+        certificate: string;
+        privateKey: string;
+        trustBundle: string;
+        certDir?: string;
+    });
+    /** Write certificates to persistent files for mTLS */
+    private writeCertsToFiles;
+    /** Atomically write content to file */
+    private atomicWrite;
+    /**
+     * Create TLS options for server (e.g., Express HTTPS).
+     * Returns options suitable for `https.createServer(options, app)`.
+     */
+    createTlsOptionsForServer(): tls.SecureContextOptions & {
+        requestCert: boolean;
+        rejectUnauthorized: boolean;
+    };
+    /**
+     * Create TLS options for client (e.g., fetch with custom agent).
+     * Returns options suitable for `https.Agent(options)`.
+     */
+    createTlsOptionsForClient(): tls.SecureContextOptions & {
+        rejectUnauthorized: boolean;
+    };
+    /** Refresh SVID data (called during renewal) */
+    refresh(certificate: string, privateKey: string, trustBundle: string): void;
+}
+//# sourceMappingURL=workload-svid.d.ts.map

package/dist/spiffe/workload-svid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-svid.d.ts","sourceRoot":"","sources":["../../src/spiffe/workload-svid.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,qBAAa,YAAY;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAEhB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAQ;IACnC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAErB,OAAO,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAUD,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAsBzB,uCAAuC;IACvC,OAAO,CAAC,WAAW;IAenB;;;OAGG;IACH,yBAAyB,IAAI,GAAG,CAAC,oBAAoB,GAAG;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE;IAc7G;;;OAGG;IACH,yBAAyB,IAAI,GAAG,CAAC,oBAAoB,GAAG;QAAE,kBAAkB,EAAE,OAAO,CAAA;KAAE;IAavF,gDAAgD;IAChD,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;CAO5E"}

package/dist/spiffe/workload-svid.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * WorkloadSVID - SVID data container with certificate file management
+ * Mirrors Python WorkloadSVID dataclass
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadSVID = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+class WorkloadSVID {
+    spiffeId;
+    certificate;
+    privateKey;
+    trustBundle;
+    certDir;
+    certFilePath = null;
+    keyFilePath = null;
+    caFilePath = null;
+    constructor(options) {
+        this.spiffeId = options.spiffeId;
+        this.certificate = options.certificate;
+        this.privateKey = options.privateKey;
+        this.trustBundle = options.trustBundle;
+        this.certDir = options.certDir ?? path.join(os.tmpdir(), 'spiffe-certs');
+        this.writeCertsToFiles();
+    }
+    /** Write certificates to persistent files for mTLS */
+    writeCertsToFiles() {
+        fs.mkdirSync(this.certDir, { recursive: true });
+        if (!this.certFilePath) {
+            this.certFilePath = path.join(this.certDir, 'svid.crt');
+            this.keyFilePath = path.join(this.certDir, 'svid.key');
+            this.caFilePath = path.join(this.certDir, 'ca.crt');
+        }
+        this.atomicWrite(this.certFilePath, this.certificate);
+        this.atomicWrite(this.keyFilePath, this.privateKey);
+        this.atomicWrite(this.caFilePath, this.trustBundle);
+        // Set restrictive permissions on private key
+        fs.chmodSync(this.keyFilePath, 0o600);
+        console.log('Certificates written to disk:');
+        console.log(`  Cert: ${this.certFilePath}`);
+        console.log(`  Key: ${this.keyFilePath}`);
+        console.log(`  CA: ${this.caFilePath}`);
+    }
+    /** Atomically write content to file */
+    atomicWrite(filePath, content) {
+        const tempPath = filePath + '.tmp';
+        try {
+            fs.writeFileSync(tempPath, content, { encoding: 'utf-8', flush: true });
+            fs.renameSync(tempPath, filePath);
+        }
+        catch (e) {
+            try {
+                fs.unlinkSync(tempPath);
+            }
+            catch {
+                // ignore cleanup error
+            }
+            throw e;
+        }
+    }
+    /**
+     * Create TLS options for server (e.g., Express HTTPS).
+     * Returns options suitable for `https.createServer(options, app)`.
+     */
+    createTlsOptionsForServer() {
+        if (!this.certFilePath || !this.keyFilePath || !this.caFilePath) {
+            throw new Error('Certificates not initialized');
+        }
+        return {
+            cert: fs.readFileSync(this.certFilePath, 'utf-8'),
+            key: fs.readFileSync(this.keyFilePath, 'utf-8'),
+            ca: fs.readFileSync(this.caFilePath, 'utf-8'),
+            requestCert: true,
+            rejectUnauthorized: true,
+        };
+    }
+    /**
+     * Create TLS options for client (e.g., fetch with custom agent).
+     * Returns options suitable for `https.Agent(options)`.
+     */
+    createTlsOptionsForClient() {
+        if (!this.certFilePath || !this.keyFilePath || !this.caFilePath) {
+            throw new Error('Certificates not initialized');
+        }
+        return {
+            cert: fs.readFileSync(this.certFilePath, 'utf-8'),
+            key: fs.readFileSync(this.keyFilePath, 'utf-8'),
+            ca: fs.readFileSync(this.caFilePath, 'utf-8'),
+            rejectUnauthorized: true,
+        };
+    }
+    /** Refresh SVID data (called during renewal) */
+    refresh(certificate, privateKey, trustBundle) {
+        this.certificate = certificate;
+        this.privateKey = privateKey;
+        this.trustBundle = trustBundle;
+        this.writeCertsToFiles();
+        console.log(`SVID refreshed: ${this.spiffeId}`);
+    }
+}
+exports.WorkloadSVID = WorkloadSVID;
+//# sourceMappingURL=workload-svid.js.map

package/dist/spiffe/workload-svid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-svid.js","sourceRoot":"","sources":["../../src/spiffe/workload-svid.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,4CAA8B;AAC9B,gDAAkC;AAClC,4CAA8B;AAG9B,MAAa,YAAY;IACvB,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,OAAO,CAAS;IAEhB,YAAY,GAAkB,IAAI,CAAC;IACnC,WAAW,GAAkB,IAAI,CAAC;IAClC,UAAU,GAAkB,IAAI,CAAC;IAEjC,YAAY,OAMX;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QAEzE,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,sDAAsD;IAC9C,iBAAiB;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACxD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAErD,6CAA6C;QAC7C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAY,EAAE,KAAK,CAAC,CAAC;QAEvC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,uCAAuC;IAC/B,WAAW,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;QACnC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,yBAAyB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;YACjD,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;YAC/C,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;YAC7C,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,yBAAyB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;YACjD,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;YAC/C,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;YAC7C,kBAAkB,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,OAAO,CAAC,WAAmB,EAAE,UAAkB,EAAE,WAAmB;QAClE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AA7GD,oCA6GC"}

package/dist/types.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared TypeScript types for AuthSec SDK
+ */
+/** MCP content item returned by tool handlers */
+export interface McpContent {
+    type: string;
+    text: string;
+}
+/** Async tool handler function (no session) */
+export type ToolHandler = (arguments_: Record<string, any>) => Promise<McpContent[]>;
+/** Async tool handler function (with session) */
+export type ToolHandlerWithSession = (arguments_: Record<string, any>, session: SimpleSession) => Promise<McpContent[]>;
+/** RBAC requirements for a protected tool */
+export interface RbacRequirements {
+    roles: string[];
+    groups: string[];
+    resources: string[];
+    scopes: string[];
+    permissions: string[];
+    requireAll: boolean;
+}
+/** Tool definition with metadata (returned by decorator functions) */
+export interface ToolDefinition {
+    /** The wrapped handler function */
+    handler: (arguments_: Record<string, any>) => Promise<McpContent[]>;
+    /** Tool name */
+    name: string;
+    /** Tool description */
+    description?: string;
+    /** MCP-compliant JSON schema for input */
+    inputSchema?: Record<string, any>;
+    /** Whether this tool is protected by AuthSec */
+    isProtected: boolean;
+    /** RBAC requirements (only for protected tools) */
+    rbacRequirements?: RbacRequirements;
+}
+/** Session object passed to protected tool handlers */
+export declare class SimpleSession {
+    sessionId: string;
+    accessToken: string | null;
+    tenantId: string | null;
+    userId: string | null;
+    orgId: string | null;
+    constructor(sessionId: string, userInfo: Record<string, any>);
+}
+/** User info extracted from JWT / auth service */
+export interface UserInfo {
+    email?: string;
+    tenant_id?: string;
+    user_id?: string;
+    org_id?: string;
+    access_token?: string;
+    roles?: string[];
+    groups?: string[];
+    scopes?: string[] | string;
+    scope?: string[] | string;
+    resources?: string[];
+    permissions?: string[];
+    [key: string]: any;
+}
+/** Service credentials returned by ServiceAccessSDK */
+export interface ServiceCredentials {
+    serviceId: string;
+    serviceName: string;
+    serviceType: string;
+    authType: string;
+    url: string;
+    credentials: Record<string, any>;
+    metadata: Record<string, string>;
+    retrievedAt: string;
+}
+/** SDK configuration */
+export interface AuthSecConfig {
+    clientId: string | null;
+    appName: string | null;
+    authServiceUrl: string;
+    servicesBaseUrl: string;
+    timeout: number;
+    retries: number;
+    spireSocketPath: string | null;
+    spireEnabled: boolean;
+}
+/** MCP JSON-RPC message */
+export interface McpMessage {
+    jsonrpc: string;
+    id?: string | number | null;
+    method?: string;
+    params?: Record<string, any>;
+    result?: any;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAErF,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAAG,CACnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/B,OAAO,EAAE,aAAa,KACnB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAE3B,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACpE,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,gDAAgD;IAChD,WAAW,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,uDAAuD;AACvD,qBAAa,aAAa;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;gBAET,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAO7D;AAED,kDAAkD;AAClD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAwB;AACxB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C"}