@codespar/sdk 0.10.11 → 0.12.0

package/dist/internal/fetch.js

@@ -0,0 +1,57 @@
+// LIMITATION: aborting/timing out only closes the client connection.
+// It does NOT undo an upstream side effect the backend already
+// dispatched (e.g. a Pix transfer / NF-e issuance). HTTP has no
+// out-of-band cancel; the server only learns the socket closed. True
+// cancellation of a side-effecting call needs a backend cancel
+// endpoint or idempotency key. Tracked separately (not in R3).
+import { mergeSignals, timeoutSignal } from "./abort.js";
+import { TimeoutError } from "../errors.js";
+/**
+ * Fail-fast validation for an effective per-call timeout (ms). Mirrors
+ * the Python client's normalize_timeout so both SDKs reject the same
+ * bad inputs (0, negative, NaN, Infinity, non-number) before a request
+ * starts, instead of producing an unpredictable timer.
+ */
+export function validateTimeout(ms) {
+    if (typeof ms !== "number" ||
+        Number.isNaN(ms) ||
+        !Number.isFinite(ms) ||
+        ms <= 0) {
+        throw new Error(`timeout must be a positive, finite number of milliseconds, got ${String(ms)}`);
+    }
+}
+/**
+ * fetch() with a TOTAL timeout that covers body consumption too.
+ *
+ * The `consume` callback reads the body (`res.json()`/`res.text()`)
+ * while the timeout signal is still armed — a backend that returns
+ * headers and then stalls the body still hits the timeout instead of
+ * hanging forever. The timeout fires a TimeoutError; the caller's own
+ * signal aborting re-throws that signal's reason verbatim (a standard
+ * AbortError), so the two causes stay distinguishable.
+ */
+export async function fetchWithTimeout(url, init, opts, consume) {
+    validateTimeout(opts.timeout);
+    const t = timeoutSignal(opts.timeout);
+    const merged = mergeSignals([t.signal, opts.signal]);
+    try {
+        const res = await fetch(url, { ...init, signal: merged.signal });
+        // Body read stays inside the timeout/abort budget.
+        return await consume(res);
+    }
+    catch (err) {
+        // Caller cancellation takes priority and propagates verbatim.
+        if (opts.signal?.aborted)
+            throw opts.signal.reason;
+        // Otherwise, if our timeout fired, surface a typed TimeoutError.
+        if (t.signal.aborted)
+            throw new TimeoutError(opts.timeout);
+        // Unrelated failure (network/DNS/etc.) — rethrow as-is.
+        throw err;
+    }
+    finally {
+        t.clear();
+        merged.cleanup();
+    }
+}
+//# sourceMappingURL=fetch.js.map

package/dist/internal/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/internal/fetch.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,+DAA+D;AAC/D,gEAAgE;AAChE,qEAAqE;AACrE,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,EAAE,IAAI,CAAC,EACP,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,MAAM,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,IAAiC,EACjC,IAA+C,EAC/C,OAAsC;IAEtC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,mDAAmD;QACnD,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8DAA8D;QAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACnD,iEAAiE;QACjE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,wDAAwD;QACxD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/mandate/index.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The signed mandate fields. The two V3-only fields (`principal_kyc_ref`,
+ * `agent_kid`) are absent on V2 mandates and required on V3.
+ */
+export interface MandateFields {
+    format_version: number;
+    id: string;
+    agent_id: string;
+    type: "payment" | "subscription" | "delegation";
+    /** Decimal string without trailing zeros (e.g. "5000", "99.5"). */
+    amount: string;
+    currency: string;
+    /** ASCII-only, sorted lexicographically before encoding. */
+    purposes: string[];
+    /** UNIX seconds. */
+    expires_at: number;
+    max_amount?: string | null;
+    parent_id?: string | null;
+    denomination?: string | null;
+    secret_version: number;
+    /** V3-only. Reference to the proofed CPF/CNPJ (Celcoin KYC) the agent acts for. */
+    principal_kyc_ref?: string | null;
+    /** V3-only. The agent key id (`<agent_did>#<n>`) that signed this mandate. */
+    agent_kid?: string | null;
+}
+/** A decoded presentation token: the signed fields plus the signature envelope. */
+export interface DecodedMandateToken {
+    mandate: MandateFields;
+    /** The org-HMAC hex digest. Present on every version; NOT offline-verifiable
+     *  (it needs the org secret) — carried through for completeness. */
+    signature: string;
+    /** V3 envelope: Ed25519 signature by the agent key (base64url). */
+    agent_sig?: string;
+    /** V3 envelope: Ed25519 signature by the platform issuer key (base64url). */
+    issuer_sig?: string;
+    /** V3 envelope: the agent key id (`<agent_did>#<n>`) that produced agent_sig. */
+    kid?: string;
+}
+export type MandateDecodeResult = {
+    ok: true;
+    token: DecodedMandateToken;
+} | {
+    ok: false;
+    error: "invalid_payload" | "mandate_format_unsupported";
+};
+/**
+ * Decode a signed presentation token: base64url UTF-8 JSON of the mandate fields
+ * plus `signature` and — for V3 — the `agent_sig` / `issuer_sig` / `kid`
+ * envelope. Splits the envelope from the signed fields so `mandate` is exactly
+ * the field set the signatures cover. Does not verify anything.
+ */
+export declare function decodeMandateToken(token: string): MandateDecodeResult;
+/**
+ * Reconstruct the canonical signing string the Ed25519 signatures cover.
+ *
+ * Field order (V3 = 14 fields, 13 `:` separators): V2's 12 fields then the two
+ * V3-only fields (principal_kyc_ref, agent_kid). Absent optionals render empty
+ * so the separator count is invariant. `purposes` is comma-joined after a
+ * lexicographic sort with escaping (`\` → `\\` first, then `,` → `\,`). Colons
+ * inside `agent_kid` (from `did:web`) are emitted verbatim — the string is a
+ * one-way serialization, never re-split. The V3 tail is appended only for
+ * `format_version >= 3`, so a V2 mandate reconstructs to its 12-field form.
+ */
+export declare function reconstructSigningString(f: Record<string, unknown>): string;
+/**
+ * Verify an Ed25519 signature (base64url) over a signing string with only the
+ * raw 32-byte public key. Returns false — never throws — on malformed input.
+ */
+export declare function verifyEd25519(signingString: string, signatureB64url: string, pub: Buffer): boolean;
+/** Strip the `#<fragment>` from an agent key id to recover the bare agent DID. */
+export declare function agentDidFromKid(kid: string): string;
+/** Per-signature outcome. `skipped` = present but no key supplied to check it. */
+export type SignatureStatus = "verified" | "failed" | "skipped" | "absent";
+export interface SignatureCheck {
+    present: boolean;
+    status: SignatureStatus;
+    /** The key id associated with the signature (agent kid; issuer has none). */
+    kid?: string;
+}
+export interface VerifyMandateOptions {
+    /** Raw 32-byte Ed25519 agent public key — hex string or bytes. */
+    agentPublicKey?: string | Uint8Array;
+    /** Raw 32-byte Ed25519 issuer (platform) public key — hex string or bytes. */
+    issuerPublicKey?: string | Uint8Array;
+}
+export interface MandateVerification {
+    /** True iff at least one carried signature verified and none failed. */
+    verified: boolean;
+    mandate: MandateFields;
+    /** The bare agent DID (kid without its `#fragment`), when present. */
+    agentDid?: string;
+    /** The agent key id from the envelope, when present. */
+    kid?: string;
+    agent: SignatureCheck;
+    issuer: SignatureCheck;
+}
+/**
+ * Offline-verify a V3 mandate presentation token against supplied public keys.
+ *
+ * Pure and network-free: you pass the agent and/or issuer public keys (from
+ * their did:web documents) and it checks the signatures the token carries. A
+ * signature with a supplied key that validates is `verified`; a supplied key
+ * that fails is `failed`; a carried signature with no supplied key is `skipped`;
+ * a signature the token doesn't carry is `absent`. `verified` is true iff at
+ * least one signature verified and none failed.
+ *
+ * Throws only on a token that cannot be decoded (so a caller can distinguish a
+ * malformed token from a well-formed but unverified one).
+ */
+export declare function verifyMandateToken(token: string, opts?: VerifyMandateOptions): MandateVerification;
+//# sourceMappingURL=index.d.ts.map

package/dist/mandate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IAChD,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oBAAoB;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB;wEACoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,GAAG,4BAA4B,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAmCrE;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA0B3E;AAiBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAWT;AAcD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CA2BrB"}

package/dist/mandate/index.js

@@ -0,0 +1,217 @@
+/**
+ * `@codespar/sdk/mandate` — offline V3 mandate verification.
+ *
+ * A third party holding only a presentation token and a raw Ed25519 public key
+ * (from the agent's did:web document) can reconstruct the exact signing string
+ * and verify the agent + issuer signatures with `node:crypto` alone — no
+ * CodeSpar API call. This is the programmatic form of `codespar mandate verify`.
+ *
+ * Isolation: this lives on its own subpath export so the main SDK client stays
+ * free of `node:crypto` (edge/bundler safe). Import it explicitly:
+ *
+ * ```ts
+ * import { verifyMandateToken } from "@codespar/sdk/mandate";
+ * const res = verifyMandateToken(token, { agentPublicKey, issuerPublicKey });
+ * if (!res.verified) throw new Error("mandate signature invalid");
+ * ```
+ *
+ * The byte format is frozen by the shared `canonical.v3.fixture.json` (the same
+ * freeze the enterprise codec and the CLI pin), so all three impls stay in lock
+ * step. `node:crypto` is a Node builtin, not an npm dependency — the SDK's
+ * zero-runtime-dependency guarantee is intact.
+ */
+import { createPublicKey, verify as nodeVerify } from "node:crypto";
+/**
+ * Decode a signed presentation token: base64url UTF-8 JSON of the mandate fields
+ * plus `signature` and — for V3 — the `agent_sig` / `issuer_sig` / `kid`
+ * envelope. Splits the envelope from the signed fields so `mandate` is exactly
+ * the field set the signatures cover. Does not verify anything.
+ */
+export function decodeMandateToken(token) {
+    let raw;
+    try {
+        raw = JSON.parse(Buffer.from(token, "base64url").toString("utf8"));
+    }
+    catch {
+        return { ok: false, error: "invalid_payload" };
+    }
+    if (!raw || typeof raw !== "object") {
+        return { ok: false, error: "invalid_payload" };
+    }
+    const r = raw;
+    const version = r["format_version"];
+    if (typeof version !== "number" || !Number.isInteger(version) || version < 2) {
+        return { ok: false, error: "mandate_format_unsupported" };
+    }
+    if (!isValidMandateFields(r)) {
+        return { ok: false, error: "invalid_payload" };
+    }
+    const { signature, agent_sig, issuer_sig, kid, ...fields } = r;
+    if (typeof signature !== "string") {
+        return { ok: false, error: "invalid_payload" };
+    }
+    const decoded = { mandate: fields, signature };
+    if (typeof agent_sig === "string")
+        decoded.agent_sig = agent_sig;
+    if (typeof issuer_sig === "string")
+        decoded.issuer_sig = issuer_sig;
+    if (typeof kid === "string")
+        decoded.kid = kid;
+    return { ok: true, token: decoded };
+}
+function isValidMandateFields(r) {
+    if (typeof r["format_version"] !== "number")
+        return false;
+    if (typeof r["id"] !== "string")
+        return false;
+    if (typeof r["agent_id"] !== "string")
+        return false;
+    if (!["payment", "subscription", "delegation"].includes(r["type"]))
+        return false;
+    if (typeof r["amount"] !== "string")
+        return false;
+    if (typeof r["currency"] !== "string")
+        return false;
+    if (!Array.isArray(r["purposes"]))
+        return false;
+    if (typeof r["expires_at"] !== "number")
+        return false;
+    if (typeof r["secret_version"] !== "number")
+        return false;
+    if (r["format_version"] === 3) {
+        if (typeof r["principal_kyc_ref"] !== "string")
+            return false;
+        if (typeof r["agent_kid"] !== "string")
+            return false;
+    }
+    return true;
+}
+/**
+ * Reconstruct the canonical signing string the Ed25519 signatures cover.
+ *
+ * Field order (V3 = 14 fields, 13 `:` separators): V2's 12 fields then the two
+ * V3-only fields (principal_kyc_ref, agent_kid). Absent optionals render empty
+ * so the separator count is invariant. `purposes` is comma-joined after a
+ * lexicographic sort with escaping (`\` → `\\` first, then `,` → `\,`). Colons
+ * inside `agent_kid` (from `did:web`) are emitted verbatim — the string is a
+ * one-way serialization, never re-split. The V3 tail is appended only for
+ * `format_version >= 3`, so a V2 mandate reconstructs to its 12-field form.
+ */
+export function reconstructSigningString(f) {
+    const esc = (s) => s.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
+    const purposes = (f["purposes"] ?? [])
+        .slice()
+        .sort()
+        .map(esc)
+        .join(",");
+    const version = Number(f["format_version"]);
+    const parts = [
+        String(f["format_version"]),
+        f["id"],
+        f["agent_id"],
+        f["type"],
+        f["amount"],
+        f["currency"],
+        purposes,
+        String(f["expires_at"]),
+        f["max_amount"] ?? "",
+        f["parent_id"] ?? "",
+        f["denomination"] ?? "",
+        String(f["secret_version"]),
+    ];
+    if (version >= 3) {
+        parts.push(f["principal_kyc_ref"] ?? "", f["agent_kid"] ?? "");
+    }
+    return parts.join(":");
+}
+// A raw Ed25519 public key becomes an SPKI KeyObject by prefixing the fixed
+// RFC 8410 header. This is the exact wrapper a bare third-party verifier uses.
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function publicKeyFromRaw(pub) {
+    if (pub.length !== 32) {
+        throw new Error(`Ed25519 public key must be 32 bytes, got ${pub.length}`);
+    }
+    return createPublicKey({
+        key: Buffer.concat([ED25519_SPKI_PREFIX, pub]),
+        format: "der",
+        type: "spki",
+    });
+}
+/**
+ * Verify an Ed25519 signature (base64url) over a signing string with only the
+ * raw 32-byte public key. Returns false — never throws — on malformed input.
+ */
+export function verifyEd25519(signingString, signatureB64url, pub) {
+    try {
+        return nodeVerify(null, Buffer.from(signingString, "utf8"), publicKeyFromRaw(pub), Buffer.from(signatureB64url, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Coerce a hex string (with/without 0x) or raw bytes into a 32-byte key, or null. */
+function toPubkey(key) {
+    if (key === undefined)
+        return null;
+    if (typeof key === "string") {
+        const clean = key.trim().toLowerCase().replace(/^0x/, "");
+        if (clean.length !== 64 || !/^[0-9a-f]+$/.test(clean))
+            return null;
+        return Buffer.from(clean, "hex");
+    }
+    const buf = Buffer.from(key);
+    return buf.length === 32 ? buf : null;
+}
+/** Strip the `#<fragment>` from an agent key id to recover the bare agent DID. */
+export function agentDidFromKid(kid) {
+    const hash = kid.indexOf("#");
+    return hash === -1 ? kid : kid.slice(0, hash);
+}
+/**
+ * Offline-verify a V3 mandate presentation token against supplied public keys.
+ *
+ * Pure and network-free: you pass the agent and/or issuer public keys (from
+ * their did:web documents) and it checks the signatures the token carries. A
+ * signature with a supplied key that validates is `verified`; a supplied key
+ * that fails is `failed`; a carried signature with no supplied key is `skipped`;
+ * a signature the token doesn't carry is `absent`. `verified` is true iff at
+ * least one signature verified and none failed.
+ *
+ * Throws only on a token that cannot be decoded (so a caller can distinguish a
+ * malformed token from a well-formed but unverified one).
+ */
+export function verifyMandateToken(token, opts = {}) {
+    const decoded = decodeMandateToken(token);
+    if (!decoded.ok) {
+        throw new Error(`cannot decode mandate token: ${decoded.error}`);
+    }
+    const t = decoded.token;
+    const m = t.mandate;
+    const signingString = reconstructSigningString(m);
+    const kid = t.kid ?? m.agent_kid ?? undefined;
+    const agentDid = kid ? agentDidFromKid(kid) : undefined;
+    const agent = checkSignature(signingString, t.agent_sig, toPubkey(opts.agentPublicKey), kid);
+    const issuer = checkSignature(signingString, t.issuer_sig, toPubkey(opts.issuerPublicKey), undefined);
+    const anyVerified = agent.status === "verified" || issuer.status === "verified";
+    const anyFailed = agent.status === "failed" || issuer.status === "failed";
+    const result = {
+        verified: anyVerified && !anyFailed,
+        mandate: m,
+        agent,
+        issuer,
+    };
+    if (agentDid)
+        result.agentDid = agentDid;
+    if (kid)
+        result.kid = kid;
+    return result;
+}
+function checkSignature(signingString, sig, pub, kid) {
+    if (!sig)
+        return { present: false, status: "absent", ...(kid ? { kid } : {}) };
+    if (!pub)
+        return { present: true, status: "skipped", ...(kid ? { kid } : {}) };
+    const ok = verifyEd25519(signingString, sig, pub);
+    return { present: true, status: ok ? "verified" : "failed", ...(kid ? { kid } : {}) };
+}
+//# sourceMappingURL=index.js.map

package/dist/mandate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mandate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAC;AA8CpF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,CAK5D,CAAC;IACF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,OAAO,EAAE,MAAuB,EAAE,SAAS,EAAE,CAAC;IACrF,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IACjE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,CAA0B;IACtD,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC7D,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAA0B;IACjE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,CAAE,CAAC,CAAC,UAAU,CAAc,IAAI,EAAE,CAAC;SACjD,KAAK,EAAE;SACP,IAAI,EAAE;SACN,GAAG,CAAC,GAAG,CAAC;SACR,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAc;QACvB,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;QACP,CAAC,CAAC,UAAU,CAAC;QACb,CAAC,CAAC,MAAM,CAAC;QACT,CAAC,CAAC,QAAQ,CAAC;QACX,CAAC,CAAC,UAAU,CAAC;QACb,QAAQ;QACR,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE;QACrB,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;QACpB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;QACvB,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;KAC5B,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,eAAuB,EACvB,GAAW;IAEX,IAAI,CAAC;QACH,OAAO,UAAU,CACf,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAClC,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAAoC;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AA+BD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,MAAM,aAAa,GAAG,wBAAwB,CAAC,CAAuC,CAAC,CAAC;IAExF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExD,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IAEtG,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;IAE1E,MAAM,MAAM,GAAwB;QAClC,QAAQ,EAAE,WAAW,IAAI,CAAC,SAAS;QACnC,OAAO,EAAE,CAAC;QACV,KAAK;QACL,MAAM;KACP,CAAC;IACF,IAAI,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzC,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,aAAqB,EACrB,GAAuB,EACvB,GAAkB,EAClB,GAAuB;IAEvB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,EAAE,GAAG,aAAa,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC"}

package/dist/session.d.ts

@@ -1,13 +1,14 @@
 /**
  * Session implementation for the CodeSpar managed runtime.
  */
-import type { SessionConfig } from "./types.js";
+import type { SessionConfig, CallOptions } from "./types.js";
 import type { Session } from "@codespar/types";
 interface SessionDeps {
     baseUrl: string;
     apiKey: string;
     projectId?: string;
+    timeout: number;
 }
-export declare function createSession(userId: string, config: SessionConfig, deps: SessionDeps): Promise<Session>;
+export declare function createSession(userId: string, config: SessionConfig, deps: SessionDeps, createOpts?: CallOptions): Promise<Session>;
 export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAQ,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACV,OAAO,EA4BR,MAAM,iBAAiB,CAAC;AAEzB,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoCD,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,OAAO,CAAC,CAodlB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAQ,WAAW,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,KAAK,EACV,OAAO,EA4BR,MAAM,iBAAiB,CAAC;AAEzB,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AA6CD,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,EACjB,UAAU,CAAC,EAAE,WAAW,GACvB,OAAO,CAAC,OAAO,CAAC,CA6iBlB"}