@cotal-ai/auth 0.48.2 → 0.50.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-admin.d.ts +4 -0
- package/dist/auth-admin.d.ts.map +1 -1
- package/dist/auth-admin.js +18 -12
- package/dist/auth-admin.js.map +1 -1
- package/dist/authority-client.d.ts +2 -5
- package/dist/authority-client.d.ts.map +1 -1
- package/dist/authority-client.js +10 -17
- package/dist/authority-client.js.map +1 -1
- package/dist/index.d.ts +3 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -1
- package/dist/index.js.map +1 -1
- package/dist/manager-admin-authorization.d.ts +17 -0
- package/dist/manager-admin-authorization.d.ts.map +1 -0
- package/dist/manager-admin-authorization.js +91 -0
- package/dist/manager-admin-authorization.js.map +1 -0
- package/dist/manager-authority.d.ts.map +1 -1
- package/dist/manager-authority.js +41 -7
- package/dist/manager-authority.js.map +1 -1
- package/dist/manager-goal-index.d.ts +17 -0
- package/dist/manager-goal-index.d.ts.map +1 -0
- package/dist/manager-goal-index.js +80 -0
- package/dist/manager-goal-index.js.map +1 -0
- package/dist/provider.d.ts.map +1 -1
- package/dist/provider.js +128 -2
- package/dist/provider.js.map +1 -1
- package/dist/records-scanner.d.ts +17 -9
- package/dist/records-scanner.d.ts.map +1 -1
- package/dist/records-scanner.js +131 -10
- package/dist/records-scanner.js.map +1 -1
- package/dist/retained-manager-validation.d.ts +27 -0
- package/dist/retained-manager-validation.d.ts.map +1 -0
- package/dist/retained-manager-validation.js +139 -0
- package/dist/retained-manager-validation.js.map +1 -0
- package/dist/service.d.ts +67 -1
- package/dist/service.d.ts.map +1 -1
- package/dist/service.js +128 -10
- package/dist/service.js.map +1 -1
- package/package.json +4 -4
package/dist/auth-admin.d.ts
CHANGED
|
@@ -10,6 +10,10 @@ export declare function authAdminListenerGrants(space: string, connId: string, r
|
|
|
10
10
|
publish: string[];
|
|
11
11
|
subscribe: string[];
|
|
12
12
|
};
|
|
13
|
+
/** The terminal rail's operation-identity authorization. The requester credential pins the target
|
|
14
|
+
* in the subject, while this check binds the body operation to that broker-authenticated target.
|
|
15
|
+
* Run it before any gate/head read so a foreign operation id is a full no-op. */
|
|
16
|
+
export declare function authorizeRetirementOperation(targetLifecycleUid: string, opId: string): void;
|
|
13
17
|
export interface AuthAdminListener {
|
|
14
18
|
close(): Promise<void>;
|
|
15
19
|
}
|
package/dist/auth-admin.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAwEA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AAyDD;;iFAEiF;AACjF,wBAAgB,4BAA4B,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI3F;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuL7B"}
|
package/dist/auth-admin.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { Kvm } from "@nats-io/kv";
|
|
2
|
-
import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, assertLifecycleToken, deriveReplySubject, endpointToken, epAuthBucket, epClassQueueGroup, epResponderReplyPattern, assertCommandToken, spacePrefix, mintLifecycleUid, parseEpSubject, principalKey, retirementFrontierStreams, serveIssuanceGateKv, } from "@cotal-ai/core";
|
|
2
|
+
import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, assertLifecycleToken, deriveReplySubject, endpointToken, epAuthBucket, epClassQueueGroup, epResponderReplyPattern, assertCommandToken, spacePrefix, mintLifecycleUid, managedRetirementOpId, parseEpSubject, principalKey, retirementFrontierStreams, serveIssuanceGateKv, } from "@cotal-ai/core";
|
|
3
3
|
import { openAuthorityClient } from "./authority-client.js";
|
|
4
4
|
import { runAgentRetirementBarrier } from "./retirement-barrier.js";
|
|
5
5
|
import { observeGate, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
|
|
@@ -68,10 +68,8 @@ function parseRetireArgs(raw) {
|
|
|
68
68
|
typeof a.serveEpoch !== "number" || !Number.isInteger(a.serveEpoch) || a.serveEpoch < 0)
|
|
69
69
|
throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape} (serveEpoch a non-negative integer)`);
|
|
70
70
|
return {
|
|
71
|
-
// opId is OPERATION IDENTITY, not an authz input:
|
|
72
|
-
//
|
|
73
|
-
// subject counterpart to be cross-checked against (the subject's nonce varies per request,
|
|
74
|
-
// which is the opposite property), and it authorizes nothing.
|
|
71
|
+
// opId is OPERATION IDENTITY, not an authz input: the terminal rail independently derives it
|
|
72
|
+
// from the broker-pinned lifecycle target below. This parse only enforces the token grammar.
|
|
75
73
|
opId: assertLifecycleToken(a.opId, "opId"),
|
|
76
74
|
// LOOKUP COORDINATES, not authz inputs: they select WHICH gate row to read. The row they
|
|
77
75
|
// select must then survive the principal cross-check below, so naming a foreign row buys a
|
|
@@ -81,6 +79,14 @@ function parseRetireArgs(raw) {
|
|
|
81
79
|
serveEpoch: a.serveEpoch,
|
|
82
80
|
};
|
|
83
81
|
}
|
|
82
|
+
/** The terminal rail's operation-identity authorization. The requester credential pins the target
|
|
83
|
+
* in the subject, while this check binds the body operation to that broker-authenticated target.
|
|
84
|
+
* Run it before any gate/head read so a foreign operation id is a full no-op. */
|
|
85
|
+
export function authorizeRetirementOperation(targetLifecycleUid, opId) {
|
|
86
|
+
const expected = managedRetirementOpId(targetLifecycleUid);
|
|
87
|
+
if (opId !== expected)
|
|
88
|
+
throw new EpEnvelopeError("permission-denied", `retireLifecycle operation ${opId} is not the derived terminal operation ${expected} for lifecycle ${targetLifecycleUid}; nothing was applied`);
|
|
89
|
+
}
|
|
84
90
|
/**
|
|
85
91
|
* Open the rail: subscribe the auth-admin control subtree on a dedicated minimal listener
|
|
86
92
|
* credential and serve `retireLifecycle`. Every executing right stays with the injected
|
|
@@ -166,13 +172,9 @@ export async function openAuthAdminListener(opts) {
|
|
|
166
172
|
// resume racing the rail) share ONE runAgentRetirementBarrier, so the barrier body never dual-executes
|
|
167
173
|
// (dual contain/drain mutating past a frontier the other task closes). A joiner awaits the same result.
|
|
168
174
|
//
|
|
169
|
-
// The flight
|
|
170
|
-
//
|
|
171
|
-
//
|
|
172
|
-
// barrier's durable intent-coordinate check (retirement-barrier.ts), and receive A's `ok:true` naming B
|
|
173
|
-
// — freeing B's alias over a still-live principal (the exact alias-reuse class #1 exists to close). So a
|
|
174
|
-
// same-opId join whose coordinates differ is REFUSED as a full no-op; only a coordinate-IDENTICAL
|
|
175
|
-
// request (the intended nudge/retry) joins the in-flight barrier.
|
|
175
|
+
// The flight remains BOUND to its operation coordinates (owner, actor, lifecycleUid) as defense in
|
|
176
|
+
// depth. The rail now derives one opId per target before this map, so different lifecycles cannot
|
|
177
|
+
// collide here. A coordinate-identical nudge, retry, or boot race still joins the one barrier run.
|
|
176
178
|
const barrierFlight = new Map();
|
|
177
179
|
const handle = async (request, body) => {
|
|
178
180
|
if (request.command !== EP_CMD_RETIRE_LIFECYCLE)
|
|
@@ -195,6 +197,10 @@ export async function openAuthAdminListener(opts) {
|
|
|
195
197
|
if (req.op !== "retireLifecycle")
|
|
196
198
|
return { ok: false, error: `op "${String(req.op)}" not supported on the auth admin service` };
|
|
197
199
|
const args = parseRetireArgs(req.args);
|
|
200
|
+
// TARGET comes from the broker-authorized subject. Bind the body's opId to it BEFORE the serve
|
|
201
|
+
// gate, lifecycle head, intent, or barrier is touched, so mint-time validation is not the only
|
|
202
|
+
// fence and the same target can never start a second durable terminal operation.
|
|
203
|
+
authorizeRetirementOperation(target.lifecycleUid, args.opId);
|
|
198
204
|
// THE RAIL-TIME REGISTRATION RE-CHECK (fresh, leader-served, fail-closed) — P2 item 3 (3b-3):
|
|
199
205
|
// the requesting manager instance's SERVE GRANT must be current. Read the serve-issuance gate
|
|
200
206
|
// (registration-record-derived, REPLACING the old name-derived manager-lease holder check): the
|
package/dist/auth-admin.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;mGACmG;AACnG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,aAAa,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC;AACzH,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,OAAO;QACL,OAAO,EAAE;YACP,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,qFAAqF;YACrF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,6FAA6F;QAC7F,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,CAAC;KACjG,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnF;;;;;sGAKsG;AACtG,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4HAA4H,CAAC,CAAC;IACjL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,sDAAsD,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,8DAA8D;QAC9D,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,mCAAmC;QACnC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,4FAA4F;IAC5F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClE,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,yFAAyF;gBACzF,wFAAwF;gBACxF,yEAAyE;gBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,+EAA+E;oBAC/E,iFAAiF;oBACjF,GAAG,CAAC,sDAAsD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAoB,MAAM,CAAC;gBACxC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,GAAG,cAAc,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAsB,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC7B,IAAI,KAAmE,CAAC;gBACxE,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,4FAA4F;gBAC5F,oFAAoF;gBACpF,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,MAAM,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,yGAAyG;IACzG,qGAAqG;IACrG,uGAAuG;IACvG,wGAAwG;IACxG,yGAAyG;IACzG,kGAAkG;IAClG,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,IAAgB,EAAyE,EAAE;QACzI,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,OAAO,sCAAsC,EAAE,CAAC;QACjG,mFAAmF;QACnF,+FAA+F;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2FAA2F,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjH,uFAAuF;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,GAAmD,CAAC;QACxD,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,+FAA+F;QAC/F,yDAAyD;QACzD,8FAA8F;QAC9F,gGAAgG;QAChG,uDAAuD;QACvD,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,4FAA4F;QAC5F,6FAA6F;QAC7F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2BAA2B;QAC3B,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,qDAAqD;QACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,EAAE,CAAC;QAC3f,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QACpP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAE1R,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;YACvH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QAC1Y,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAClJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;mGACmG;AACnG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,aAAa,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC;AACzH,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,OAAO;QACL,OAAO,EAAE;YACP,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,qFAAqF;YACrF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,6FAA6F;QAC7F,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,CAAC;KACjG,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnF;;;;;sGAKsG;AACtG,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4HAA4H,CAAC,CAAC;IACjL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,sDAAsD,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,mCAAmC;QACnC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,kBAA0B,EAAE,IAAY;IACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,QAAQ;QACnB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,IAAI,0CAA0C,QAAQ,kBAAkB,kBAAkB,uBAAuB,CAAC,CAAC;AACnM,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,4FAA4F;IAC5F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClE,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,yFAAyF;gBACzF,wFAAwF;gBACxF,yEAAyE;gBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,+EAA+E;oBAC/E,iFAAiF;oBACjF,GAAG,CAAC,sDAAsD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAoB,MAAM,CAAC;gBACxC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,GAAG,cAAc,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAsB,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC7B,IAAI,KAAmE,CAAC;gBACxE,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,4FAA4F;gBAC5F,oFAAoF;gBACpF,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,MAAM,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,IAAgB,EAAyE,EAAE;QACzI,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,OAAO,sCAAsC,EAAE,CAAC;QACjG,mFAAmF;QACnF,+FAA+F;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2FAA2F,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjH,uFAAuF;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,GAAmD,CAAC;QACxD,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,+FAA+F;QAC/F,+FAA+F;QAC/F,iFAAiF;QACjF,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7D,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,+FAA+F;QAC/F,yDAAyD;QACzD,8FAA8F;QAC9F,gGAAgG;QAChG,uDAAuD;QACvD,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,4FAA4F;QAC5F,6FAA6F;QAC7F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2BAA2B;QAC3B,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,qDAAqD;QACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,EAAE,CAAC;QAC3f,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QACpP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAE1R,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;YACvH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QAC1Y,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAClJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
* service restart; there is no file-only fallback.
|
|
26
26
|
*/
|
|
27
27
|
import { type NatsConnection } from "@nats-io/transport-node";
|
|
28
|
-
import {
|
|
28
|
+
import { remoteManagerRegistrationProof, type PlaneConnTuple } from "@cotal-ai/core";
|
|
29
29
|
import { type ConnectReader } from "./connect-reader.js";
|
|
30
30
|
/** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
|
|
31
31
|
* in-memory credential that closes with the service — never an unbounded persisted one). */
|
|
@@ -61,10 +61,7 @@ export declare function remoteManagerIssuerGrants(space: string, connId: string)
|
|
|
61
61
|
publish: string[];
|
|
62
62
|
subscribe: string[];
|
|
63
63
|
};
|
|
64
|
-
|
|
65
|
-
* owner, instance, lifecycle, every caller-generated nkey, and the canonical manager artifact
|
|
66
|
-
* digests; replay against another lifecycle or artifact set cannot pass. */
|
|
67
|
-
export declare function remoteManagerRegistrationProof(owner: string, request: RemoteManagerAuthorityRequest): string;
|
|
64
|
+
export { remoteManagerRegistrationProof };
|
|
68
65
|
/**
|
|
69
66
|
* The BARRIER EXECUTOR's scoped credential grant (SPEC 13.9): the lifecycle-barrier surface —
|
|
70
67
|
* exactly what the takeover barrier (and its retirement sibling) reaches through the sealed
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,
|
|
1
|
+
{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyN,8BAA8B,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5S,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B/G;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAgBnH;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CAqDlC"}
|
package/dist/authority-client.js
CHANGED
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
import { connect, jwtAuthenticator } from "@nats-io/transport-node";
|
|
28
28
|
import { encodeUser } from "@nats-io/jwt";
|
|
29
29
|
import { fromPublic, fromSeed } from "@nats-io/nkeys";
|
|
30
|
-
import { EpEnvelopeError, assertInboxConnId, endpointToken, epAuthBucket, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors,
|
|
30
|
+
import { EpEnvelopeError, assertInboxConnId, endpointToken, epAuthBucket, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof } from "@cotal-ai/core";
|
|
31
31
|
import { authConnectReaderGrants, openConnectReader } from "./connect-reader.js";
|
|
32
32
|
/** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
|
|
33
33
|
* in-memory credential that closes with the service — never an unbounded persisted one). */
|
|
@@ -87,26 +87,19 @@ export function remoteManagerIssuerGrants(space, connId) {
|
|
|
87
87
|
return {
|
|
88
88
|
publish: [
|
|
89
89
|
...base.publish,
|
|
90
|
+
// The typed activation phase mints the manager instance's endpoint-serve credential through
|
|
91
|
+
// serveIssuanceGateKv. That fence stages one `epcred.manager.<instance>.<credential>` row and
|
|
92
|
+
// revision-touches the matching `epgate.manager.<instance>` row. The host issuer serves many
|
|
93
|
+
// manager instances, so the instance tail is necessarily open, but the endpoint label stays
|
|
94
|
+
// fixed to `manager`: no participant credential receives these rows, and no other endpoint's
|
|
95
|
+
// issuance family is reachable through this server-side connection.
|
|
96
|
+
`$KV.${epAuthBucket(space)}.epgate.manager.>`,
|
|
97
|
+
`$KV.${epAuthBucket(space)}.epcred.manager.>`,
|
|
90
98
|
],
|
|
91
99
|
subscribe: base.subscribe,
|
|
92
100
|
};
|
|
93
101
|
}
|
|
94
|
-
|
|
95
|
-
* owner, instance, lifecycle, every caller-generated nkey, and the canonical manager artifact
|
|
96
|
-
* digests; replay against another lifecycle or artifact set cannot pass. */
|
|
97
|
-
export function remoteManagerRegistrationProof(owner, request) {
|
|
98
|
-
const artifactDigests = request.operation === "session" ? [] : (request.contractArtifacts ?? []).map((value) => rawDigest(JSON.stringify(value)));
|
|
99
|
-
return rawDigest(JSON.stringify({
|
|
100
|
-
v: 1,
|
|
101
|
-
space: request.space,
|
|
102
|
-
owner,
|
|
103
|
-
instanceId: request.instanceId,
|
|
104
|
-
lifecycleUid: request.managerLifecycleUid,
|
|
105
|
-
actors: remoteManagerActors(request.instanceId),
|
|
106
|
-
identities: request.identities,
|
|
107
|
-
artifactDigests,
|
|
108
|
-
}));
|
|
109
|
-
}
|
|
102
|
+
export { remoteManagerRegistrationProof };
|
|
110
103
|
/**
|
|
111
104
|
* The BARRIER EXECUTOR's scoped credential grant (SPEC 13.9): the lifecycle-barrier surface —
|
|
112
105
|
* exactly what the takeover barrier (and its retirement sibling) reaches through the sealed
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,
|
|
1
|
+
{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAuB,MAAM,gBAAgB,CAAC;AAC5S,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;SAC9C;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -8,10 +8,12 @@ export { calloutPermissions, type AclResolver } from "./permissions.js";
|
|
|
8
8
|
export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
|
|
9
9
|
export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
|
|
10
10
|
export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
|
|
11
|
-
export { runAuthService, openAuthAuthorityPlane, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
|
|
11
|
+
export { runAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
|
|
12
12
|
export { remoteManagerIssuerGrants } from "./authority-client.js";
|
|
13
13
|
export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
|
|
14
14
|
export { issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest, type IssueRemoteManagerAuthorityArgs } from "./manager-authority.js";
|
|
15
|
+
export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, type AuthorizeRemoteRetainedAgentValidationArgs, } from "./retained-manager-validation.js";
|
|
16
|
+
export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
|
|
15
17
|
export { cotalAuthProvider } from "./provider.js";
|
|
16
18
|
import "./commands.js";
|
|
17
19
|
export { openSessionAuthStore, kvSessionLedger, sessionRedemptionHooks, closeSession, sweepSessions, kvServeIssuanceGate, type SessionAuthStore, type EndpointGateRow, type SessionSigner, type SessionHookDeps, type SessionCloser } from "./session-ledger.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5Q,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC/I,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -8,7 +8,7 @@ export { calloutPermissions } from "./permissions.js";
|
|
|
8
8
|
export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
|
|
9
9
|
export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
|
|
10
10
|
export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
|
|
11
|
-
export { runAuthService, openAuthAuthorityPlane, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
|
|
11
|
+
export { runAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
|
|
12
12
|
export { remoteManagerIssuerGrants } from "./authority-client.js";
|
|
13
13
|
// The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
|
|
14
14
|
// shape-proved reader, and the pure connect-credential check the production composition runs.
|
|
@@ -16,6 +16,8 @@ export { remoteManagerIssuerGrants } from "./authority-client.js";
|
|
|
16
16
|
// package-internal — the sealed plane is its only production door; smokes import the modules.
|
|
17
17
|
export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, } from "./connect-reader.js";
|
|
18
18
|
export { issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest } from "./manager-authority.js";
|
|
19
|
+
export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, } from "./retained-manager-validation.js";
|
|
20
|
+
export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
|
|
19
21
|
export { cotalAuthProvider } from "./provider.js"; // self-registers the "auth-provider" extension
|
|
20
22
|
import "./commands.js"; // self-registers `login` / `logout` / `actor` / `auth-service` into the core Registry
|
|
21
23
|
// NB: writeEndpointGate (the D14 endpoint-registration stand-in) is deliberately NOT
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AAC5Q,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAwC,MAAM,wBAAwB,CAAC;AAC/I,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import { type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAdminAuthorizationResult } from "@cotal-ai/core";
|
|
2
|
+
export declare function parseRemoteManagerAdminAuthorizationRequest(raw: unknown): RemoteManagerAdminAuthorizationRequest;
|
|
3
|
+
export declare function authorizeRemoteManagerAdmin(args: {
|
|
4
|
+
request: RemoteManagerAdminAuthorizationRequest;
|
|
5
|
+
space: string;
|
|
6
|
+
managerOwner: string;
|
|
7
|
+
managerScope: string[];
|
|
8
|
+
proofSecret: string | Uint8Array;
|
|
9
|
+
dir: string;
|
|
10
|
+
observeManagerGate: (instanceId: string) => Promise<{
|
|
11
|
+
state: "open" | "frozen" | "retired";
|
|
12
|
+
principal: string;
|
|
13
|
+
processEpoch: number;
|
|
14
|
+
registrationRevision: number;
|
|
15
|
+
} | null>;
|
|
16
|
+
}): Promise<RemoteManagerAdminAuthorizationResult>;
|
|
17
|
+
//# sourceMappingURL=manager-admin-authorization.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"manager-admin-authorization.d.ts","sourceRoot":"","sources":["../src/manager-admin-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC3C,MAAM,gBAAgB,CAAC;AAQxB,wBAAgB,2CAA2C,CAAC,GAAG,EAAE,OAAO,GAAG,sCAAsC,CAwChH;AAED,wBAAsB,2BAA2B,CAAC,IAAI,EAAE;IACtD,OAAO,EAAE,sCAAsC,CAAC;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAClD,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;KAC7G,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAuBjD"}
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
import { EpEnvelopeError, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, remoteManagerActors, } from "@cotal-ai/core";
|
|
2
|
+
import { timingSafeEqual } from "node:crypto";
|
|
3
|
+
import { findActorUnified } from "./ledger.js";
|
|
4
|
+
import { remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
|
|
5
|
+
const identityNames = ["supervisor", "executor", "serve", "goalWriter", "sessionLedger"];
|
|
6
|
+
const bad = (message) => { throw new EpEnvelopeError("bad-request", `manager admin authorization request ${message}`); };
|
|
7
|
+
export function parseRemoteManagerAdminAuthorizationRequest(raw) {
|
|
8
|
+
if (raw === null || typeof raw !== "object" || Array.isArray(raw))
|
|
9
|
+
bad("must be an object");
|
|
10
|
+
const o = raw;
|
|
11
|
+
const fields = ["v", "kind", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "identities", "caller"];
|
|
12
|
+
for (const key of Object.keys(o))
|
|
13
|
+
if (!fields.includes(key))
|
|
14
|
+
bad(`carries unknown field ${JSON.stringify(key)} (the protocol is closed)`);
|
|
15
|
+
if (o.v !== 1 || o.kind !== "manager-admin-authorization")
|
|
16
|
+
bad('must carry { v: 1, kind: "manager-admin-authorization" }');
|
|
17
|
+
for (const key of ["space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof"])
|
|
18
|
+
if (typeof o[key] !== "string" || o[key].length === 0)
|
|
19
|
+
bad(`requires non-empty ${key}`);
|
|
20
|
+
assertValidOwnerToken(o.actor);
|
|
21
|
+
assertLifecycleToken(o.instanceId, "manager admin authorization instanceId");
|
|
22
|
+
assertLifecycleToken(o.managerLifecycleUid, "manager admin authorization lifecycleUid");
|
|
23
|
+
if (!/^[A-Za-z0-9_-]{22,64}$/.test(o.requestId))
|
|
24
|
+
bad("requestId must be a 22-64 character idempotency token");
|
|
25
|
+
if (!/^sha256:[0-9a-f]{64}$/.test(o.registrationProof))
|
|
26
|
+
bad("requires a sha256 registrationProof");
|
|
27
|
+
if (typeof o.serveEpoch !== "number" || !Number.isSafeInteger(o.serveEpoch) || o.serveEpoch < 0)
|
|
28
|
+
bad("serveEpoch must be a non-negative safe integer");
|
|
29
|
+
if (o.identities === null || typeof o.identities !== "object" || Array.isArray(o.identities))
|
|
30
|
+
bad("requires identities");
|
|
31
|
+
const rawIds = o.identities;
|
|
32
|
+
if (Object.keys(rawIds).sort().join(",") !== [...identityNames].sort().join(","))
|
|
33
|
+
bad(`identities must contain exactly ${identityNames.join(", ")}`);
|
|
34
|
+
const identities = {};
|
|
35
|
+
for (const name of identityNames) {
|
|
36
|
+
const item = rawIds[name];
|
|
37
|
+
if (item === null || typeof item !== "object" || Array.isArray(item) || Object.keys(item).join(",") !== "id")
|
|
38
|
+
bad(`identities.${name} must be exactly { id }`);
|
|
39
|
+
const id = item.id;
|
|
40
|
+
if (typeof id !== "string" || !/^U[A-Z2-7]{55}$/.test(id))
|
|
41
|
+
bad(`identities.${name}.id must be a user nkey`);
|
|
42
|
+
identities[name] = { id: id };
|
|
43
|
+
}
|
|
44
|
+
if (o.caller === null || typeof o.caller !== "object" || Array.isArray(o.caller))
|
|
45
|
+
bad("requires caller");
|
|
46
|
+
const caller = o.caller;
|
|
47
|
+
if (Object.keys(caller).sort().join(",") !== "actor,lifecycleUid,owner")
|
|
48
|
+
bad("caller must contain exactly owner, actor, lifecycleUid");
|
|
49
|
+
for (const key of ["owner", "actor", "lifecycleUid"])
|
|
50
|
+
if (typeof caller[key] !== "string" || caller[key].length === 0)
|
|
51
|
+
bad(`requires non-empty caller.${key}`);
|
|
52
|
+
assertDerivedOwnerToken(caller.owner);
|
|
53
|
+
assertValidOwnerToken(caller.actor);
|
|
54
|
+
assertLifecycleToken(caller.lifecycleUid, "manager admin authorization caller lifecycleUid");
|
|
55
|
+
return {
|
|
56
|
+
v: 1, kind: "manager-admin-authorization", space: o.space, actor: o.actor,
|
|
57
|
+
instanceId: o.instanceId, managerLifecycleUid: o.managerLifecycleUid,
|
|
58
|
+
requestId: o.requestId, registrationProof: o.registrationProof,
|
|
59
|
+
serveEpoch: o.serveEpoch, identities,
|
|
60
|
+
caller: { owner: caller.owner, actor: caller.actor, lifecycleUid: caller.lifecycleUid },
|
|
61
|
+
};
|
|
62
|
+
}
|
|
63
|
+
export async function authorizeRemoteManagerAdmin(args) {
|
|
64
|
+
const request = parseRemoteManagerAdminAuthorizationRequest(args.request);
|
|
65
|
+
if (request.space !== args.space)
|
|
66
|
+
throw new EpEnvelopeError("permission-denied", `manager admin authorization names space ${request.space}, not this host space ${args.space}`);
|
|
67
|
+
if (!args.managerScope.includes("supervise"))
|
|
68
|
+
throw new EpEnvelopeError("permission-denied", 'manager admin authorization needs manager scope "supervise"');
|
|
69
|
+
const actors = remoteManagerActors(request.instanceId);
|
|
70
|
+
const gate = await args.observeManagerGate(request.instanceId);
|
|
71
|
+
if (!gate || gate.state !== "open")
|
|
72
|
+
throw new EpEnvelopeError("failed-precondition", `manager admin authorization found no current open manager gate for instance ${request.instanceId}`);
|
|
73
|
+
const expectedPrincipal = `${args.managerOwner}.${actors.serve}`;
|
|
74
|
+
if (gate.principal !== expectedPrincipal)
|
|
75
|
+
throw new EpEnvelopeError("permission-denied", `manager admin authorization gate belongs to ${gate.principal}, not ${expectedPrincipal}`);
|
|
76
|
+
if (gate.processEpoch !== request.serveEpoch)
|
|
77
|
+
throw new EpEnvelopeError("conflict", `manager admin authorization serve epoch ${request.serveEpoch} is stale; current is ${gate.processEpoch}`);
|
|
78
|
+
const proof = remoteManagerCurrentRegistrationProof(args.proofSecret, args.managerOwner, request, gate);
|
|
79
|
+
if (!timingSafeEqual(Buffer.from(request.registrationProof), Buffer.from(proof)))
|
|
80
|
+
throw new EpEnvelopeError("permission-denied", "manager admin authorization proof does not match the current host registration");
|
|
81
|
+
// A valid current-manager request gets one non-oracular decision. The authoritative unified row is
|
|
82
|
+
// read fresh for every call. Absence, revocation, a narrowed scope, owner drift, and lifecycle drift
|
|
83
|
+
// are all the same `false`; corrupt/unreadable state throws and therefore fails the operation closed.
|
|
84
|
+
let authorized = false;
|
|
85
|
+
if (request.caller.owner === args.managerOwner) {
|
|
86
|
+
const row = findActorUnified(args.dir, request.caller.owner, request.caller.actor);
|
|
87
|
+
authorized = row?.lifecycleUid === request.caller.lifecycleUid && row.scope.includes("admin");
|
|
88
|
+
}
|
|
89
|
+
return { ...request, owner: args.managerOwner, authorized };
|
|
90
|
+
}
|
|
91
|
+
//# sourceMappingURL=manager-admin-authorization.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"manager-admin-authorization.js","sourceRoot":"","sources":["../src/manager-admin-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AAEzF,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,CAAU,CAAC;AAClG,MAAM,GAAG,GAAG,CAAC,OAAe,EAAS,EAAE,GAAG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,uCAAuC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAExI,MAAM,UAAU,2CAA2C,CAAC,GAAY;IACtE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5J,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1I,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,6BAA6B;QAAE,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC3H,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,mBAAmB,CAAU;QAClH,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC1F,qBAAqB,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IACzC,oBAAoB,CAAC,CAAC,CAAC,UAAoB,EAAE,wCAAwC,CAAC,CAAC;IACvF,oBAAoB,CAAC,CAAC,CAAC,mBAA6B,EAAE,0CAA0C,CAAC,CAAC;IAClG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC;QAAE,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACxH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAA2B,CAAC;QAAE,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAC7G,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAAE,GAAG,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,CAAC,CAAC,UAAqC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrJ,MAAM,UAAU,GAAG,EAA0D,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,cAAc,IAAI,yBAAyB,CAAC,CAAC;QACzK,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,cAAc,IAAI,yBAAyB,CAAC,CAAC;QAC5G,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAiC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0BAA0B;QAAE,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACvI,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAU;QAC3D,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC3G,uBAAuB,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IAChD,qBAAqB,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;IAC9C,oBAAoB,CAAC,MAAM,CAAC,YAAsB,EAAE,iDAAiD,CAAC,CAAC;IACvG,OAAO;QACL,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe;QAC7F,UAAU,EAAE,CAAC,CAAC,UAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAA6B;QACxF,SAAS,EAAE,CAAC,CAAC,SAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAA2B;QAClF,UAAU,EAAE,CAAC,CAAC,UAAoB,EAAE,UAAU;QAC9C,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAe,EAAE,YAAY,EAAE,MAAM,CAAC,YAAsB,EAAE;KACtH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAUjD;IACC,MAAM,OAAO,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,2CAA2C,OAAO,CAAC,KAAK,yBAAyB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChL,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6DAA6D,CAAC,CAAC;IAC5J,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,+EAA+E,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1L,MAAM,iBAAiB,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACjE,IAAI,IAAI,CAAC,SAAS,KAAK,iBAAiB;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,+CAA+C,IAAI,CAAC,SAAS,SAAS,iBAAiB,EAAE,CAAC,CAAC;IACpL,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,2CAA2C,OAAO,CAAC,UAAU,yBAAyB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/L,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,gFAAgF,CAAC,CAAC;IAEnI,mGAAmG;IACnG,qGAAqG;IACrG,sGAAsG;IACtG,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,UAAU,GAAG,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manager-authority.d.ts","sourceRoot":"","sources":["../src/manager-authority.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"manager-authority.d.ts","sourceRoot":"","sources":["../src/manager-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,mBAAmB,EACnB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,gBAAgB,CAAC;AAExB,0FAA0F;AAC1F,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,6BAA6B,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;mEAC+D;IAC/D,KAAK,EAAE,CAAC,IAAI,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC/C,OAAO,EAAE,6BAA6B,CAAC;KACxC,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9G,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,OAAO,GAAG,6BAA6B,CAmF9F;AAED,yFAAyF;AACzF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA4ChI"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { EpEnvelopeError, assertLifecycleToken, remoteManagerActors, } from "@cotal-ai/core";
|
|
1
|
+
import { EpEnvelopeError, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, managedRetirementOpId, remoteManagerActors, } from "@cotal-ai/core";
|
|
2
2
|
function requestError(what) {
|
|
3
3
|
throw new EpEnvelopeError("bad-request", `manager-service authority request ${what}`);
|
|
4
4
|
}
|
|
@@ -7,14 +7,14 @@ export function parseRemoteManagerAuthorityRequest(raw) {
|
|
|
7
7
|
if (raw === null || typeof raw !== "object" || Array.isArray(raw))
|
|
8
8
|
requestError("must be an object");
|
|
9
9
|
const o = raw;
|
|
10
|
-
const allowed = new Set(["v", "kind", "operation", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "session", "contractArtifacts", "identities"]);
|
|
10
|
+
const allowed = new Set(["v", "kind", "operation", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "session", "retirement", "contractArtifacts", "identities"]);
|
|
11
11
|
for (const key of Object.keys(o))
|
|
12
12
|
if (!allowed.has(key))
|
|
13
13
|
requestError(`carries unknown field ${JSON.stringify(key)} (the protocol is closed)`);
|
|
14
14
|
if (o.v !== 1 || o.kind !== "manager-service-authority")
|
|
15
15
|
requestError('must carry { v: 1, kind: "manager-service-authority" }');
|
|
16
|
-
if (o.operation !== "prepare" && o.operation !== "activate" && o.operation !== "renew" && o.operation !== "session")
|
|
17
|
-
requestError('operation must be "prepare", "activate", "renew", or "
|
|
16
|
+
if (o.operation !== "prepare" && o.operation !== "activate" && o.operation !== "renew" && o.operation !== "session" && o.operation !== "retire")
|
|
17
|
+
requestError('operation must be "prepare", "activate", "renew", "session", or "retire"');
|
|
18
18
|
for (const key of ["space", "actor", "instanceId", "managerLifecycleUid", "requestId"])
|
|
19
19
|
if (typeof o[key] !== "string" || o[key].length === 0)
|
|
20
20
|
requestError(`requires non-empty ${key}`);
|
|
@@ -24,11 +24,11 @@ export function parseRemoteManagerAuthorityRequest(raw) {
|
|
|
24
24
|
requestError("requestId must be a 22-64 character idempotency token");
|
|
25
25
|
if (o.operation === "prepare" && (o.registrationProof !== undefined || o.contractArtifacts !== undefined))
|
|
26
26
|
requestError("prepare must not carry registrationProof or contractArtifacts");
|
|
27
|
-
if ((o.operation === "activate" || o.operation === "renew" || o.operation === "session") && (typeof o.registrationProof !== "string" || !/^sha256:[0-9a-f]{64}$/.test(o.registrationProof)))
|
|
27
|
+
if ((o.operation === "activate" || o.operation === "renew" || o.operation === "session" || o.operation === "retire") && (typeof o.registrationProof !== "string" || !/^sha256:[0-9a-f]{64}$/.test(o.registrationProof)))
|
|
28
28
|
requestError(`${o.operation} requires a sha256 registrationProof`);
|
|
29
29
|
if (o.operation === "activate" && (!Array.isArray(o.contractArtifacts) || o.contractArtifacts.length === 0 || o.contractArtifacts.length > 64))
|
|
30
30
|
requestError("activate requires 1-64 canonical manager contractArtifacts");
|
|
31
|
-
if ((o.operation === "renew" || o.operation === "session") && o.contractArtifacts !== undefined)
|
|
31
|
+
if ((o.operation === "renew" || o.operation === "session" || o.operation === "retire") && o.contractArtifacts !== undefined)
|
|
32
32
|
requestError(`${o.operation} must not carry contractArtifacts`);
|
|
33
33
|
if (o.operation === "session") {
|
|
34
34
|
const s = o.session;
|
|
@@ -39,6 +39,34 @@ export function parseRemoteManagerAuthorityRequest(raw) {
|
|
|
39
39
|
}
|
|
40
40
|
else if (o.session !== undefined)
|
|
41
41
|
requestError(`${o.operation} must not carry session`);
|
|
42
|
+
let retirement;
|
|
43
|
+
if (o.operation === "retire") {
|
|
44
|
+
const r = o.retirement;
|
|
45
|
+
if (!r || Object.keys(r).sort().join(",") !== "id,opId,serveEpoch,target")
|
|
46
|
+
requestError("retire requires retirement exactly { id, target, opId, serveEpoch }");
|
|
47
|
+
const target = r.target;
|
|
48
|
+
if (typeof r.id !== "string" || !/^U[A-Z2-7]{55}$/.test(r.id) ||
|
|
49
|
+
!target || Object.keys(target).sort().join(",") !== "actor,lifecycleUid,owner" ||
|
|
50
|
+
typeof target.owner !== "string" || typeof target.actor !== "string" || typeof target.lifecycleUid !== "string" ||
|
|
51
|
+
typeof r.opId !== "string" || typeof r.serveEpoch !== "number" || !Number.isSafeInteger(r.serveEpoch) || r.serveEpoch < 0)
|
|
52
|
+
requestError("retire requires a requester user nkey, exact target, lifecycle opId, and non-negative safe serveEpoch");
|
|
53
|
+
assertLifecycleToken(target.lifecycleUid, "manager authority retirement target lifecycleUid");
|
|
54
|
+
assertLifecycleToken(r.opId, "manager authority retirement opId");
|
|
55
|
+
if (r.opId !== managedRetirementOpId(target.lifecycleUid))
|
|
56
|
+
requestError(`retire opId must be the managed lifecycle's derived terminal operation id for ${target.lifecycleUid}`);
|
|
57
|
+
retirement = {
|
|
58
|
+
id: r.id,
|
|
59
|
+
target: {
|
|
60
|
+
owner: assertDerivedOwnerToken(target.owner),
|
|
61
|
+
actor: assertValidOwnerToken(target.actor),
|
|
62
|
+
lifecycleUid: target.lifecycleUid,
|
|
63
|
+
},
|
|
64
|
+
opId: r.opId,
|
|
65
|
+
serveEpoch: r.serveEpoch,
|
|
66
|
+
};
|
|
67
|
+
}
|
|
68
|
+
else if (o.retirement !== undefined)
|
|
69
|
+
requestError(`${o.operation} must not carry retirement`);
|
|
42
70
|
const ids = o.identities;
|
|
43
71
|
if (ids === null || typeof ids !== "object" || Array.isArray(ids))
|
|
44
72
|
requestError("requires identities");
|
|
@@ -67,6 +95,7 @@ export function parseRemoteManagerAuthorityRequest(raw) {
|
|
|
67
95
|
requestId: o.requestId,
|
|
68
96
|
...(typeof o.registrationProof === "string" ? { registrationProof: o.registrationProof } : {}),
|
|
69
97
|
...(o.session && typeof o.session === "object" ? { session: o.session } : {}),
|
|
98
|
+
...(retirement ? { retirement } : {}),
|
|
70
99
|
...(Array.isArray(o.contractArtifacts) ? { contractArtifacts: o.contractArtifacts } : {}),
|
|
71
100
|
identities,
|
|
72
101
|
};
|
|
@@ -78,6 +107,8 @@ export async function issueRemoteManagerAuthority(args) {
|
|
|
78
107
|
throw new EpEnvelopeError("permission-denied", 'manager-service authority needs scope "supervise"; spawn/admin do not imply it');
|
|
79
108
|
const actors = remoteManagerActors(r.instanceId);
|
|
80
109
|
const ids = Object.values(r.identities).map((identity) => identity.id);
|
|
110
|
+
if (r.retirement)
|
|
111
|
+
ids.push(r.retirement.id);
|
|
81
112
|
if (new Set(ids).size !== ids.length)
|
|
82
113
|
throw new EpEnvelopeError("bad-request", "manager-service identities must be distinct; one nkey cannot collapse separate authority lifetimes");
|
|
83
114
|
const issued = await args.issue({ owner: args.owner, actors, request: r });
|
|
@@ -88,7 +119,9 @@ export async function issueRemoteManagerAuthority(args) {
|
|
|
88
119
|
? ["serve", "goalWriter", "sessionLedger"]
|
|
89
120
|
: r.operation === "session"
|
|
90
121
|
? ["sessionServing"]
|
|
91
|
-
:
|
|
122
|
+
: r.operation === "retire"
|
|
123
|
+
? ["retirementRequester"]
|
|
124
|
+
: ["supervisor", "executor", "serve", "goalWriter", "sessionLedger"];
|
|
92
125
|
for (const name of required)
|
|
93
126
|
if (!(name in credentials))
|
|
94
127
|
throw new EpEnvelopeError("internal", `manager-service ${r.operation} did not issue required credential ${name}`);
|
|
@@ -105,6 +138,7 @@ export async function issueRemoteManagerAuthority(args) {
|
|
|
105
138
|
lifecycleUid: r.managerLifecycleUid,
|
|
106
139
|
requestId: r.requestId,
|
|
107
140
|
...(r.registrationProof ? { registrationProof: r.registrationProof } : {}),
|
|
141
|
+
...(r.retirement ? { retirement: r.retirement } : {}),
|
|
108
142
|
issuedAt,
|
|
109
143
|
expiresAt: Math.min(...exps),
|
|
110
144
|
actors,
|