@cotal-ai/auth 0.66.1 → 0.68.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-admin.js +1 -1
- package/dist/auth-admin.js.map +1 -1
- package/dist/credential-ledger.js +3 -3
- package/dist/credential-ledger.js.map +1 -1
- package/dist/idp.d.ts +3 -1
- package/dist/idp.d.ts.map +1 -1
- package/dist/idp.js +3 -2
- package/dist/idp.js.map +1 -1
- package/dist/issuer.d.ts +4 -2
- package/dist/issuer.d.ts.map +1 -1
- package/dist/issuer.js +11 -6
- package/dist/issuer.js.map +1 -1
- package/dist/managed-agent-enrollment.d.ts +2 -7
- package/dist/managed-agent-enrollment.d.ts.map +1 -1
- package/dist/managed-agent-enrollment.js.map +1 -1
- package/dist/manager-admin-authorization.d.ts +2 -6
- package/dist/manager-admin-authorization.d.ts.map +1 -1
- package/dist/manager-admin-authorization.js +2 -17
- package/dist/manager-admin-authorization.js.map +1 -1
- package/dist/manager-authority.d.ts +13 -18
- package/dist/manager-authority.d.ts.map +1 -1
- package/dist/manager-authority.js +61 -49
- package/dist/manager-authority.js.map +1 -1
- package/dist/manager-contract.d.ts +1 -1
- package/dist/manager-contract.d.ts.map +1 -1
- package/dist/manager-contract.js +2 -4
- package/dist/manager-contract.js.map +1 -1
- package/dist/manager-goal-index.d.ts +2 -6
- package/dist/manager-goal-index.d.ts.map +1 -1
- package/dist/manager-goal-index.js +2 -17
- package/dist/manager-goal-index.js.map +1 -1
- package/dist/manager-maintenance.d.ts +2 -6
- package/dist/manager-maintenance.d.ts.map +1 -1
- package/dist/manager-maintenance.js +2 -18
- package/dist/manager-maintenance.js.map +1 -1
- package/dist/permissions.js +2 -0
- package/dist/permissions.js.map +1 -1
- package/dist/platform-control.d.ts +2 -5
- package/dist/platform-control.d.ts.map +1 -1
- package/dist/platform-control.js.map +1 -1
- package/dist/provider.d.ts.map +1 -1
- package/dist/provider.js +13 -5
- package/dist/provider.js.map +1 -1
- package/dist/retained-manager-validation.d.ts +2 -6
- package/dist/retained-manager-validation.d.ts.map +1 -1
- package/dist/retained-manager-validation.js +2 -18
- package/dist/retained-manager-validation.js.map +1 -1
- package/dist/retirement-barrier.js +4 -4
- package/dist/retirement-barrier.js.map +1 -1
- package/dist/service.d.ts +1 -5
- package/dist/service.d.ts.map +1 -1
- package/dist/service.js +72 -66
- package/dist/service.js.map +1 -1
- package/dist/token.d.ts +15 -2
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +31 -5
- package/dist/token.js.map +1 -1
- package/package.json +4 -3
package/dist/token.js
CHANGED
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
* token would quietly disable it).
|
|
19
19
|
*/
|
|
20
20
|
import { decodeProtectedHeader, jwtVerify } from "jose";
|
|
21
|
-
import { assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken } from "@cotal-ai/core";
|
|
21
|
+
import { assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, credentialLifetime } from "@cotal-ai/core";
|
|
22
22
|
/** Current normative token-shape version. Bump only with a SPEC change; validators reject
|
|
23
23
|
* anything else (older = downgrade, newer = from-the-future misconfig). */
|
|
24
24
|
export const USER_TOKEN_VER = 1;
|
|
@@ -33,11 +33,11 @@ export const MAX_TOKEN_TTL_SEC = 900;
|
|
|
33
33
|
* instead of `agent`. A closed enum on BOTH the mint and validate side — an unknown view fails
|
|
34
34
|
* closed, never falls back to a profile. Deliberately NOT a generic `view=<profile>` passthrough:
|
|
35
35
|
* most profiles are daemon/provisioning surfaces that must never become human-requestable. */
|
|
36
|
-
export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller"];
|
|
36
|
+
export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller", "transfer-writer"];
|
|
37
37
|
/** Views the public exchange face will mint (still ledger-gated). Every other
|
|
38
38
|
* {@link USER_TOKEN_VIEWS} value stays loopback-only. An actor-secret exchange may request
|
|
39
39
|
* only manager-caller, which narrows its existing command authority to one instance. */
|
|
40
|
-
export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller", "session-caller"];
|
|
40
|
+
export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller", "session-caller", "transfer-writer"];
|
|
41
41
|
/** The ONE central view policy table: which ledger capability each view's exchange requires (and
|
|
42
42
|
* the callout re-asserts, defense in depth). `admin` = operator authority (god-view read +
|
|
43
43
|
* destructive space writes); `deployer` is spawn-grade — deploying YOUR OWN team's manifest rides
|
|
@@ -54,7 +54,16 @@ export const VIEW_REQUIRED_SCOPE = {
|
|
|
54
54
|
// #2312: no ledger scope. The grant itself is the authority: the auth plane verifies the redeemed
|
|
55
55
|
// `session.<id>` row names THIS principal as holder, at the exchange and again at the callout mint.
|
|
56
56
|
"session-caller": undefined,
|
|
57
|
+
// #1499: the bytes a carried resume uploads are announced by `transcript-receive`, a
|
|
58
|
+
// `manager.admin` row, so writing them needs the same scope.
|
|
59
|
+
"transfer-writer": "admin",
|
|
57
60
|
};
|
|
61
|
+
/** The longest a bearer of `view` may live. A transfer-writer bearer is the user-mode form of the
|
|
62
|
+
* one-shot `transfer-writer` credential, so it carries that profile's five minutes, and so does the
|
|
63
|
+
* broker credential the callout binds to the bearer's expiry. */
|
|
64
|
+
export function viewTtlCapSec(view) {
|
|
65
|
+
return view === "transfer-writer" ? credentialLifetime("transfer-writer").defaultTtlSeconds : MAX_TOKEN_TTL_SEC;
|
|
66
|
+
}
|
|
58
67
|
/** A KV-safe key segment: the ledger's `cred.` key alphabet. Kept local to the validator (not
|
|
59
68
|
* imported from the credential ledger) so the trust boundary carries no KV dependency. */
|
|
60
69
|
const CREDENTIAL_ID_SEGMENT = /^[A-Za-z0-9_-]+$/;
|
|
@@ -82,6 +91,19 @@ export function assertSessionClaim(v) {
|
|
|
82
91
|
if (typeof o[k] !== "number" || !Number.isSafeInteger(o[k]) || o[k] < 0)
|
|
83
92
|
throw new Error(`user token: act.session.${k} is not an unsigned integer`);
|
|
84
93
|
}
|
|
94
|
+
export function assertTransferWriterClaim(v) {
|
|
95
|
+
const o = v;
|
|
96
|
+
if (!o || typeof o !== "object" || Array.isArray(o))
|
|
97
|
+
throw new Error("user token: act.transferWriter must be an object");
|
|
98
|
+
for (const k of Object.keys(o))
|
|
99
|
+
if (!["instanceId", "hex"].includes(k))
|
|
100
|
+
throw new Error(`user token: act.transferWriter carries the unknown field "${k}"`);
|
|
101
|
+
if (typeof o.instanceId !== "string")
|
|
102
|
+
throw new Error("user token: act.transferWriter.instanceId must be a string token");
|
|
103
|
+
assertLifecycleToken(o.instanceId, "user token act.transferWriter.instanceId");
|
|
104
|
+
if (typeof o.hex !== "string" || !/^[0-9a-f]{64}$/.test(o.hex))
|
|
105
|
+
throw new Error("user token: act.transferWriter.hex is not a sha256 hex digest");
|
|
106
|
+
}
|
|
85
107
|
/** Validate a user bearer token. Returns the reduced, validated claims or THROWS — there is no
|
|
86
108
|
* partially-valid result and no fallback (a validation failure at the callout is a denied
|
|
87
109
|
* connection). */
|
|
@@ -113,7 +135,7 @@ export async function validateUserToken(token, opts) {
|
|
|
113
135
|
// sails through exp/nbf checks, giving it an effective validity far beyond the cap and quietly
|
|
114
136
|
// defeating the short-lived-token revocation lever. So: iat may not be in the future, and exp
|
|
115
137
|
// may not sit further than the cap from now.
|
|
116
|
-
const maxTtl = opts.maxTtlSec ?? MAX_TOKEN_TTL_SEC;
|
|
138
|
+
const maxTtl = Math.min(opts.maxTtlSec ?? MAX_TOKEN_TTL_SEC, viewTtlCapSec(payload.act?.view));
|
|
117
139
|
const tol = opts.clockToleranceSec ?? 5;
|
|
118
140
|
const now = Math.floor(Date.now() / 1000);
|
|
119
141
|
if (payload.iat > now + tol)
|
|
@@ -166,6 +188,10 @@ export async function validateUserToken(token, opts) {
|
|
|
166
188
|
throw new Error('user token: act.session is valid only with view "session-caller"');
|
|
167
189
|
assertSessionClaim(act.session);
|
|
168
190
|
}
|
|
191
|
+
if ((act.view === "transfer-writer") !== (act.transferWriter !== undefined))
|
|
192
|
+
throw new Error('user token: view "transfer-writer" and act.transferWriter come together or not at all');
|
|
193
|
+
if (act.transferWriter !== undefined)
|
|
194
|
+
assertTransferWriterClaim(act.transferWriter);
|
|
169
195
|
// Lifecycle claim (SPEC 13.1): grammar-asserted when present. Presence/absence POLICY lives at the
|
|
170
196
|
// connect boundary (ledgerAuthorizeConnect requires it on EVERY bearer, views included) and the
|
|
171
197
|
// mint boundary (the idp bridge and the agent exchange stamp it from the grant row); the validator
|
|
@@ -190,7 +216,7 @@ export async function validateUserToken(token, opts) {
|
|
|
190
216
|
owner,
|
|
191
217
|
space: opts.audience,
|
|
192
218
|
scope,
|
|
193
|
-
act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId, ...(act.session ? { session: act.session } : {}) },
|
|
219
|
+
act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId, ...(act.session ? { session: act.session } : {}), ...(act.transferWriter ? { transferWriter: act.transferWriter } : {}) },
|
|
194
220
|
credentialId: act.credentialId,
|
|
195
221
|
ver: USER_TOKEN_VER,
|
|
196
222
|
exp: payload.exp,
|
package/dist/token.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE1H;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;AAGvL;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAA6C,CAAC;AAE7K;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;IAC3B,qFAAqF;IACrF,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF;;kEAEkE;AAClE,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,iBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACnH,CAAC;AAmED;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;IAC3J,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC1H,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnJ,CAAC;AAgBD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,iBAAiB,EAAE,aAAa,CAAE,OAAO,CAAC,GAAkC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/H,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpF,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpU,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cotal-ai/auth",
|
|
3
3
|
"description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.68.0",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -18,8 +18,9 @@
|
|
|
18
18
|
}
|
|
19
19
|
},
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@cotal-ai/core": "0.
|
|
22
|
-
"@cotal-ai/
|
|
21
|
+
"@cotal-ai/core": "0.68.0",
|
|
22
|
+
"@cotal-ai/lang": "0.68.0",
|
|
23
|
+
"@cotal-ai/workspace": "0.68.0",
|
|
23
24
|
"@nats-io/jwt": "0.0.10-5",
|
|
24
25
|
"@nats-io/nkeys": "^2.0.3",
|
|
25
26
|
"@nats-io/transport-node": "^3.4.0",
|