@cotal-ai/auth 0.85.0 → 0.87.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authority-client.d.ts +3 -2
- package/dist/authority-client.d.ts.map +1 -1
- package/dist/authority-client.js +4 -2
- package/dist/authority-client.js.map +1 -1
- package/dist/callout.d.ts +10 -2
- package/dist/callout.d.ts.map +1 -1
- package/dist/callout.js +9 -2
- package/dist/callout.js.map +1 -1
- package/dist/idp.d.ts +19 -4
- package/dist/idp.d.ts.map +1 -1
- package/dist/idp.js +19 -1
- package/dist/idp.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/native-issuance.d.ts +62 -0
- package/dist/native-issuance.d.ts.map +1 -0
- package/dist/native-issuance.js +102 -0
- package/dist/native-issuance.js.map +1 -0
- package/dist/permissions.d.ts +6 -5
- package/dist/permissions.d.ts.map +1 -1
- package/dist/permissions.js +2 -2
- package/dist/permissions.js.map +1 -1
- package/dist/provider.js +2 -1
- package/dist/provider.js.map +1 -1
- package/dist/service.d.ts +38 -1
- package/dist/service.d.ts.map +1 -1
- package/dist/service.js +157 -28
- package/dist/service.js.map +1 -1
- package/dist/store.d.ts.map +1 -1
- package/dist/store.js +21 -8
- package/dist/store.js.map +1 -1
- package/package.json +4 -4
|
@@ -40,8 +40,9 @@ export declare const AUTHORITY_CLIENT_TTL_SEC: number;
|
|
|
40
40
|
* record reads), and records `DIRECT.GET` (the records bucket is Direct-capable and its KV
|
|
41
41
|
* reads here only feed revision-pinned CASes, which a stale read LOSES — fail-closed).
|
|
42
42
|
* - `$KV` writes on EXACTLY the issuance keys: auth `gate.` / `cred.` / `bysrc.` (the gate CAS
|
|
43
|
-
* fence and the mint's rows)
|
|
44
|
-
*
|
|
43
|
+
* fence and the mint's rows), auth `natkey.` (the callout's create-only native-key issuance
|
|
44
|
+
* evidence) and records `lifecycle.` / `uid.` (the alias head and the space-global uid
|
|
45
|
+
* reservation). No `srcgate.`/`stage.`/`session.` writes: root issuance
|
|
45
46
|
* presents no handles and runs no takeover; barriers are NOT this credential's job.
|
|
46
47
|
*
|
|
47
48
|
* Named residuals (D32 class, not pretend-confined): `STREAM.MSG.GET` is body-selected, so this
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD
|
|
1
|
+
{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA2B/G;AAED;gEACgE;AAChE,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjI;AAED,oGAAoG;AACpG,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAKhI;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;kFAGkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC1J;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CA0E7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA0DlC"}
|
package/dist/authority-client.js
CHANGED
|
@@ -43,8 +43,9 @@ export const AUTHORITY_CLIENT_TTL_SEC = 15 * 60;
|
|
|
43
43
|
* record reads), and records `DIRECT.GET` (the records bucket is Direct-capable and its KV
|
|
44
44
|
* reads here only feed revision-pinned CASes, which a stale read LOSES — fail-closed).
|
|
45
45
|
* - `$KV` writes on EXACTLY the issuance keys: auth `gate.` / `cred.` / `bysrc.` (the gate CAS
|
|
46
|
-
* fence and the mint's rows)
|
|
47
|
-
*
|
|
46
|
+
* fence and the mint's rows), auth `natkey.` (the callout's create-only native-key issuance
|
|
47
|
+
* evidence) and records `lifecycle.` / `uid.` (the alias head and the space-global uid
|
|
48
|
+
* reservation). No `srcgate.`/`stage.`/`session.` writes: root issuance
|
|
48
49
|
* presents no handles and runs no takeover; barriers are NOT this credential's job.
|
|
49
50
|
*
|
|
50
51
|
* Named residuals (D32 class, not pretend-confined): `STREAM.MSG.GET` is body-selected, so this
|
|
@@ -74,6 +75,7 @@ export function authorityWriterGrants(space, connId) {
|
|
|
74
75
|
`$KV.${epAuthBucket(space)}.gate.>`,
|
|
75
76
|
`$KV.${epAuthBucket(space)}.cred.>`,
|
|
76
77
|
`$KV.${epAuthBucket(space)}.bysrc.>`,
|
|
78
|
+
`$KV.${epAuthBucket(space)}.natkey.>`,
|
|
77
79
|
`$KV.${recordsBucket(space)}.lifecycle.>`,
|
|
78
80
|
`$KV.${recordsBucket(space)}.uid.>`,
|
|
79
81
|
],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAElG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAwED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAElG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAwED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/callout.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { JWTVerifyGetKey, CryptoKey } from "jose";
|
|
2
2
|
import { type ValidatedUserToken } from "./token.js";
|
|
3
|
+
import type { NativeIssuanceRecorder } from "./native-issuance.js";
|
|
3
4
|
/** The one subject the callout serves (ADR-26). */
|
|
4
5
|
export declare const AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
|
|
5
6
|
/** The trust material of the dedicated auth-callout account. */
|
|
@@ -87,8 +88,15 @@ export interface StartAuthCalloutOpts {
|
|
|
87
88
|
* the NATS-minted `req.user_nkey` — the builder scopes the private reply inbox `_INBOX_<connId>.>` on
|
|
88
89
|
* it. The client picks and passes this nonce because neither it nor this callout knows the per-connect
|
|
89
90
|
* nkey pre-connect; core's `assertInboxConnId` rejects a nonce with subject metacharacters, so it
|
|
90
|
-
* cannot widen the grant. An absent/invalid nonce makes the builder throw → a signed deny.
|
|
91
|
-
|
|
91
|
+
* cannot widen the grant. An absent/invalid nonce makes the builder throw → a signed deny.
|
|
92
|
+
* `readerId` is core's `calloutReaderId` of this connection, which keys the observer and admin
|
|
93
|
+
* profiles' history-reader deletes: the client chooses the nonce, so the nonce cannot key them. */
|
|
94
|
+
permissionsFor: (t: ValidatedUserToken, connId: string, readerId: string) => Record<string, unknown> | Promise<Record<string, unknown>>;
|
|
95
|
+
/** REQUIRED: durably record the minted JWT's broker user key (`req.user_nkey`) against the validated
|
|
96
|
+
* principal BEFORE the response leaves (SPEC 13.1 `natkey.`). Awaited; a throw becomes the signed
|
|
97
|
+
* deny and the minted JWT is never sent. A thrown record write may still have landed: evidence of
|
|
98
|
+
* an issuance, never proof a client received the JWT or the connection was accepted. */
|
|
99
|
+
recordIssuance: NativeIssuanceRecorder;
|
|
92
100
|
/** Diagnostics sink (default: console.error). Never carries bearer contents. */
|
|
93
101
|
log?: (line: string) => void;
|
|
94
102
|
/** Audit hook fired on each successful mint, BEFORE the response is sent — the minted user JWT
|
package/dist/callout.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"callout.d.ts","sourceRoot":"","sources":["../src/callout.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"callout.d.ts","sourceRoot":"","sources":["../src/callout.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAazD,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,6GAA6G;IAC7G,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7F,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED;;mGAEmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;oEAEoE;AACpE,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAgD1F;AAED;sEACsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CAClF;AACD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACnD,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,8FAA8F;IAC9F,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,KAAK,EAAE;QAAE,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D;+FAC2F;IAC3F,cAAc,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;;;;;4FAOwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;wGAOoG;IACpG,cAAc,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxI;;;6FAGyF;IACzF,cAAc,EAAE,sBAAsB,CAAC;IACvC,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;8FAE0F;IAC1F,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1E;AAED;uFACuF;AACvF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CA2I3G"}
|
package/dist/callout.js
CHANGED
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
*/
|
|
25
25
|
import { Algorithms, decode, encodeAccount, encodeAuthorizationResponse, encodeUser, fmtCreds, } from "@nats-io/jwt";
|
|
26
26
|
import { createAccount, createCurve, fromCurveSeed, fromPublic, fromSeed } from "@nats-io/nkeys";
|
|
27
|
-
import { assertInboxConnId, newIdentity, principalKey, principalTags, token } from "@cotal-ai/core";
|
|
27
|
+
import { assertInboxConnId, calloutReaderId, newIdentity, principalKey, principalTags, token } from "@cotal-ai/core";
|
|
28
28
|
import { validateUserToken } from "./token.js";
|
|
29
29
|
import { SESSION_EXP } from "./permissions.js";
|
|
30
30
|
/** The one subject the callout serves (ADR-26). */
|
|
@@ -94,6 +94,8 @@ export function startAuthCallout(nc, opts) {
|
|
|
94
94
|
const userSigner = fromSeed(new TextEncoder().encode(opts.dataAccount.signingSeed));
|
|
95
95
|
if (!opts.space)
|
|
96
96
|
throw new Error("auth callout: space is required");
|
|
97
|
+
if (typeof opts.recordIssuance !== "function")
|
|
98
|
+
throw new Error("auth callout: recordIssuance is required - refusing to start a callout whose successes leave no native-key issuance evidence");
|
|
97
99
|
const log = opts.log ?? ((l) => console.error(l));
|
|
98
100
|
const enc = (s) => new TextEncoder().encode(s);
|
|
99
101
|
const dec = (u) => new TextDecoder().decode(u);
|
|
@@ -172,7 +174,11 @@ export function startAuthCallout(nc, opts) {
|
|
|
172
174
|
// injected permissionsFor hook (which could be any implementation). assertInboxConnId throws on a
|
|
173
175
|
// missing/wildcard name → the catch below turns it into a signed deny (fail-closed).
|
|
174
176
|
const inboxNonce = assertInboxConnId(req.connect_opts?.name ?? "");
|
|
175
|
-
|
|
177
|
+
// The history-reader deletes key on what the SERVER assigned this connection, never on the
|
|
178
|
+
// nonce: a client that named another connection's nonce would otherwise be granted the
|
|
179
|
+
// deletes of that connection's readers. A request without a client id throws → signed deny.
|
|
180
|
+
const readerId = calloutReaderId(req.server_id.id, req.client_info?.id);
|
|
181
|
+
const { [SESSION_EXP]: sessionExp, ...perms } = await opts.permissionsFor(validated, inboxNonce, readerId);
|
|
176
182
|
// #2312: a session-caller connection carries EXACTLY the static arm's expiry, the grant's,
|
|
177
183
|
// and only when the permission builder vouched for it from the live session row.
|
|
178
184
|
const exp = validated.act.view === "session-caller" ? sessionExp : validated.exp;
|
|
@@ -188,6 +194,7 @@ export function startAuthCallout(nc, opts) {
|
|
|
188
194
|
// `authorized_user` here. The name is the principal name-form (JetStream-safe), a stable label.
|
|
189
195
|
const { key, name } = principalKey(validated.owner, validated.act.actor);
|
|
190
196
|
const userJwt = await encodeUser(name, fromPublic(req.user_nkey), fromPublic(opts.dataAccount.pub), { ...perms, tags: principalTags(validated.owner, validated.act.actor) }, { signer: userSigner, exp });
|
|
197
|
+
await opts.recordIssuance({ userNkey: req.user_nkey, token: validated, connId: inboxNonce, iat: decode(userJwt).iat, exp });
|
|
191
198
|
opts.onMint?.({ jwt: userJwt, principal: key, exp });
|
|
192
199
|
await respond({ jwt: userJwt });
|
|
193
200
|
}
|
package/dist/callout.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"callout.js","sourceRoot":"","sources":["../src/callout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,UAAU,EACV,MAAM,EACN,aAAa,EACb,2BAA2B,EAC3B,UAAU,EACV,QAAQ,GAET,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"callout.js","sourceRoot":"","sources":["../src/callout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,UAAU,EACV,MAAM,EACN,aAAa,EACb,2BAA2B,EAC3B,UAAU,EACV,QAAQ,GAET,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAErH,OAAO,EAAE,iBAAiB,EAA2B,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C,8FAA8F;AAC9F,gGAAgG;AAChG,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;CAC/D,CAAC;AAyBX;;oEAEoE;AACpE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA4B;IAClE,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAC;IACzJ,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAC5B,GAAG,EACH;QACE,MAAM,EAAE,EAAE,GAAG,mBAAmB,EAAE;QAClC,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,aAAa,EAAE;YACb,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,gBAAgB,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YACpC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE;SACzB;KACF,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC;IACpB,iGAAiG;IACjG,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,yFAAyF;IACzF,6CAA6C;IAC7C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE;QACrG,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;QACtC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE;KACpD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACf,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE;QACxG,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;QACpB,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;KACrB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEf,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;QAClJ,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzF,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE;KAC5D,CAAC;AACJ,CAAC;AA0DD;uFACuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,EAAqB,EAAE,IAA0B;IAChF,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACnJ,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,4BAA4B;IAChG,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IAC/L,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM;QACjC,GAAG,CAAC,gNAAgN,CAAC,CAAC;IAExN,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEhF,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YAC5B,8EAA8E;YAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,wGAAwG,CAAC,CAAC;gBAC9G,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC7C,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACxD,MAAM,GAAG,MAAM,CAAuB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC;YAC9F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,gEAAgE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnH,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAI,MAA0C,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC1C,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,yFAAyF;YACzF,4FAA4F;YAC5F,0BAA0B;YAC1B,MAAM,MAAM,GAAI,MAA2B,CAAC,GAAG,CAAC;YAChD,IAAI,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,6FAA6F,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,+DAA+D,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACtC,qFAAqF;gBACrF,oDAAoD;gBACpD,GAAG,CAAC,mFAAmF,CAAC,CAAC;gBACzF,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,IAAsC,EAAE,EAAE;gBAC/D,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAC5C,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EACzB,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAC5B,cAAc,EACd,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EACjD,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAC7B,CAAC;gBACF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC;YAEF,4FAA4F;YAC5F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;gBAC5C,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE;oBAChD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;oBACnB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;oBACzB,QAAQ,EAAE,IAAI,CAAC,KAAK;iBACrB,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBACrC,mGAAmG;gBACnG,kGAAkG;gBAClG,gGAAgG;gBAChG,kGAAkG;gBAClG,mGAAmG;gBACnG,2FAA2F;gBAC3F,gGAAgG;gBAChG,mGAAmG;gBACnG,gGAAgG;gBAChG,kGAAkG;gBAClG,qFAAqF;gBACrF,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACnE,2FAA2F;gBAC3F,uFAAuF;gBACvF,4FAA4F;gBAC5F,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAY,CAAC,CAAC;gBAClF,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC3G,2FAA2F;gBAC3F,iFAAiF;gBACjF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;gBACjF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC3H,+FAA+F;gBAC/F,+FAA+F;gBAC/F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,4FAA4F;gBAC5F,mFAAmF;gBACnF,gGAAgG;gBAChG,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,IAAI,EACJ,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EACzB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EACvE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAC5B,CAAC;gBACF,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5H,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,MAAM,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,wBAAwB,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC;oBACH,0FAA0F;oBAC1F,2FAA2F;oBAC3F,wFAAwF;oBACxF,6FAA6F;oBAC7F,8FAA8F;oBAC9F,mFAAmF;oBACnF,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,EAAE,EAAE,CAAC;oBACZ,GAAG,CAAC,+CAA+C,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;2GAE2G;AAC3G,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC;SACL,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,+BAA+B;SACtD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,sBAAsB;SAC7C,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,sBAAsB;SAC7C,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,WAAW;SAChC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;AACxE,CAAC"}
|
package/dist/idp.d.ts
CHANGED
|
@@ -94,14 +94,29 @@ export interface IdpBridge {
|
|
|
94
94
|
transferWriter?: UserTokenTransferWriter;
|
|
95
95
|
}): Promise<ExchangeResult>;
|
|
96
96
|
}
|
|
97
|
+
/** Verified IdP claims. Optional password provenance is retained only when well-shaped;
|
|
98
|
+
* ordinary exchanges do not require it or gain consent authority from it. */
|
|
99
|
+
export interface VerifiedIdpToken {
|
|
100
|
+
sub: string;
|
|
101
|
+
exp: number;
|
|
102
|
+
auth_time?: number;
|
|
103
|
+
amr?: readonly string[];
|
|
104
|
+
}
|
|
97
105
|
/** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
|
|
98
106
|
* posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
|
|
99
107
|
* lifetime is the IdP's session policy — but it must expire and must not be post-dated). The `exp` is
|
|
100
108
|
* returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life. */
|
|
101
|
-
export declare function verifyIdpToken(token: string, idp: IdpConfig): Promise<
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
109
|
+
export declare function verifyIdpToken(token: string, idp: IdpConfig): Promise<VerifiedIdpToken>;
|
|
110
|
+
/** A private-result consent proof, not consent or permission to read any result. */
|
|
111
|
+
export interface ToolResultHumanProof {
|
|
112
|
+
readonly sub: string;
|
|
113
|
+
readonly exp: number;
|
|
114
|
+
readonly authTime: number;
|
|
115
|
+
}
|
|
116
|
+
/** Verify the pinned signed proof before applying the consent-only, five-minute password rule.
|
|
117
|
+
* The host clock returns integer milliseconds and is read after verification;
|
|
118
|
+
* no rounding or JWT tolerance widens this window. */
|
|
119
|
+
export declare function verifyToolResultHumanProof(token: string, idp: IdpConfig, now?: () => number): Promise<ToolResultHumanProof>;
|
|
105
120
|
/** Build an {@link IdpBridge}. Misconfig fails HERE, at construction — an empty pin would
|
|
106
121
|
* otherwise fail closed on every exchange with a far worse operator signal. */
|
|
107
122
|
export declare function createIdpBridge(opts: CreateIdpBridgeOpts): IdpBridge;
|
package/dist/idp.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA6E,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhL;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;qFAIiF;IACjF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kGAC8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF;;;;;;;;;;2FAUuF;IACvF,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;yCAIqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACjF;mGAC2F;QAC3F,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzG,yFAAyF;QACzF,cAAc,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;;;qGAGqG;AACrG,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA6E,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhL;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;qFAIiF;IACjF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kGAC8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF;;;;;;;;;;2FAUuF;IACvF,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;yCAIqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACjF;mGAC2F;QAC3F,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzG,yFAAyF;QACzF,cAAc,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;6EAC6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED;;;qGAGqG;AACrG,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+B7F;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;sDAEsD;AACtD,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,MAAiB,GAC1D,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;AAwCD;gFACgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAuFpE"}
|
package/dist/idp.js
CHANGED
|
@@ -59,7 +59,25 @@ export async function verifyIdpToken(token, idp) {
|
|
|
59
59
|
throw new Error("idp token: iat is in the future");
|
|
60
60
|
if (typeof payload.sub !== "string" || !payload.sub)
|
|
61
61
|
throw new Error("idp token: sub must be a non-empty string user id - no coercion at a trust boundary");
|
|
62
|
-
return {
|
|
62
|
+
return {
|
|
63
|
+
sub: payload.sub, exp: payload.exp,
|
|
64
|
+
...(typeof payload.auth_time === "number" && Number.isSafeInteger(payload.auth_time) && payload.auth_time >= 0
|
|
65
|
+
? { auth_time: payload.auth_time } : {}),
|
|
66
|
+
...(Array.isArray(payload.amr) && payload.amr.length > 0 && payload.amr.every(method => typeof method === "string" && method.length > 0)
|
|
67
|
+
? { amr: Object.freeze([...payload.amr]) } : {}),
|
|
68
|
+
};
|
|
69
|
+
}
|
|
70
|
+
/** Verify the pinned signed proof before applying the consent-only, five-minute password rule.
|
|
71
|
+
* The host clock returns integer milliseconds and is read after verification;
|
|
72
|
+
* no rounding or JWT tolerance widens this window. */
|
|
73
|
+
export async function verifyToolResultHumanProof(token, idp, now = Date.now) {
|
|
74
|
+
const verified = await verifyIdpToken(token, idp);
|
|
75
|
+
const at = verified.auth_time;
|
|
76
|
+
const ms = now();
|
|
77
|
+
if (!Number.isSafeInteger(ms) || ms < 0 || at === undefined || at * 1000 > ms || ms - at * 1000 > 300_000 ||
|
|
78
|
+
!verified.amr?.includes("pwd") || verified.exp * 1000 <= ms)
|
|
79
|
+
throw new Error("tool-result consent requires a fresh signed password proof");
|
|
80
|
+
return Object.freeze({ sub: verified.sub, exp: verified.exp, authTime: at });
|
|
63
81
|
}
|
|
64
82
|
/**
|
|
65
83
|
* The re-grant an elevated-view refusal points the operator at.
|
package/dist/idp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;AAChL,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;AAChL,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAkGtD;;;qGAGqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,GAAc;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAsB,EAAE;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IAEH,yFAAyF;IACzF,+FAA+F;IAC/F,6FAA6F;IAC7F,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1H,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;QAClC,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC;YAC5G,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACtI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AASD;;sDAEsD;AACtD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EAAE,GAAc,EAAE,MAAoB,IAAI,CAAC,GAAG;IAE3D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO;QACrG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,KAAiB,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QACxE,OAAO,CACL,qGAAqG;YACrG,4FAA4F;YAC5F,qFAAqF;YACrF,kFAAkF;YAClF,IAAI,IAAI,wFAAwF,CACjG,CAAC;IACJ,OAAO,CACL,2FAA2F;QAC3F,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE;YAC7B,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,gGAAgG;QAChG,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAC3C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU;QAClD,MAAM,IAAI,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC/P,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAChC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,+FAA+F;YAC/F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAChC,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YACtH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,oFAAoF;gBACpF,yFAAyF;gBACzF,mFAAmF;gBACnF,mBAAmB;gBACnB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrG,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC3D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,IAAI,uBAAuB,IAAI,oFAAoF,IAAI,kDAAkD;wBACnL,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAC/C,CAAC;YACN,CAAC;YACD,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;gBAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,KAAK,iFAAiF,CAC/H,CAAC;YACJ,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,IAAI,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,OAAqC,CAAC;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACjI,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACjG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,wFAAwF;YACxF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,13 +5,13 @@ export type { PlatformControlAssignment } from "@cotal-ai/core";
|
|
|
5
5
|
export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, type CalloutAuth, type CalloutProvisionInput, type CalloutConnection, type CalloutMsg, type StartAuthCalloutOpts, } from "./callout.js";
|
|
6
6
|
export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, PUBLIC_EXCHANGE_VIEWS, VIEW_REQUIRED_SCOPE, type UserTokenActor, type UserTokenView, type ValidatedUserToken, type ValidateUserTokenOpts, } from "./token.js";
|
|
7
7
|
export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, type SigningKey, type SerializedSigningKey, type IssueClaims, type UserTokenIssuer, type CreateIssuerOpts, } from "./issuer.js";
|
|
8
|
-
export { createIdpBridge, verifyIdpToken, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
|
|
8
|
+
export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, type VerifiedIdpToken, type ToolResultHumanProof, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
|
|
9
9
|
export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, hasIdpSessions, saveIdpSession, deleteIdpSession, deleteIdpSpaceCatalog, hasIdpSpaceCatalog, prepareIdpSpaceCatalogs, requireIdpSession, normalizeIdpUrl, probeIdpJwks, type IdpSession, type DeviceLoginOpts, type DeviceLoginPrompt, } from "./login.js";
|
|
10
10
|
export { calloutPermissions, type AclResolver, type UserCallerIssuer } from "./permissions.js";
|
|
11
11
|
export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
|
|
12
12
|
export { AUTH_PROVIDER_NAME, authCalloutKey, authInstanceKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
|
|
13
13
|
export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
|
|
14
|
-
export { runAuthService, startAuthService, type AuthServiceHandle, type PublicFaceInput, type PlatformControlInput, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, type ManagerServiceAuthorityCtx, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
|
|
14
|
+
export { runAuthService, startAuthService, type AuthServiceHandle, type PublicFaceInput, type PlatformControlInput, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, type ManagerServiceAuthorityCtx, handleToolResultHumanProof, type ToolResultHumanProofCtx, TOOL_RESULT_HUMAN_PROOF_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
|
|
15
15
|
export { remoteManagerIssuerGrants } from "./authority-client.js";
|
|
16
16
|
export { PLANE_CLAIM_REFUSED, PLANE_CLAIM_KEY, readPlaneClaim, planeClaimRefusal, type PlaneClaimRefusal, type PlaneClaimRow } from "./plane-claim.js";
|
|
17
17
|
export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,KAAK,4BAA4B,EAAE,KAAK,kCAAkC,EAAE,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC7L,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,KAAK,4BAA4B,EAAE,KAAK,kCAAkC,EAAE,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC7L,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EAAE,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5iB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKvJ,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,EACxC,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,sCAAsC,EAC3C,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,yCAAyC,EAC9C,KAAK,yCAAyC,EAC9C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC;AAYjC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -4,13 +4,13 @@ export { parsePlatformSupervisorAuthorityRequest } from "./platform-supervisor.j
|
|
|
4
4
|
export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, } from "./callout.js";
|
|
5
5
|
export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, PUBLIC_EXCHANGE_VIEWS, VIEW_REQUIRED_SCOPE, } from "./token.js";
|
|
6
6
|
export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, } from "./issuer.js";
|
|
7
|
-
export { createIdpBridge, verifyIdpToken, } from "./idp.js";
|
|
7
|
+
export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, } from "./idp.js";
|
|
8
8
|
export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, hasIdpSessions, saveIdpSession, deleteIdpSession, deleteIdpSpaceCatalog, hasIdpSpaceCatalog, prepareIdpSpaceCatalogs, requireIdpSession, normalizeIdpUrl, probeIdpJwks, } from "./login.js";
|
|
9
9
|
export { calloutPermissions } from "./permissions.js";
|
|
10
10
|
export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
|
|
11
11
|
export { AUTH_PROVIDER_NAME, authCalloutKey, authInstanceKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
|
|
12
12
|
export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
|
|
13
|
-
export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
|
|
13
|
+
export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, handleToolResultHumanProof, TOOL_RESULT_HUMAN_PROOF_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
|
|
14
14
|
export { remoteManagerIssuerGrants } from "./authority-client.js";
|
|
15
15
|
export { PLANE_CLAIM_REFUSED, PLANE_CLAIM_KEY, readPlaneClaim, planeClaimRefusal } from "./plane-claim.js";
|
|
16
16
|
// The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAA4G,MAAM,0BAA0B,CAAC;AAE7L,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAA4G,MAAM,0BAA0B,CAAC;AAE7L,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,GAQ3B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2E,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAmC,0BAA0B,EAAgC,4BAA4B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AAC5iB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAA8C,MAAM,kBAAkB,CAAC;AACvJ,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAgE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,GAMzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,GAS/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Native-key issuance evidence (SPEC 13.1 `natkey.`): one create-only row per callout success,
|
|
3
|
+
* keyed by the broker-generated per-connection user public key and bound to the validated
|
|
4
|
+
* bearer's own signed, row-checked claims. It is what lets a later revocation name the exact
|
|
5
|
+
* native key a lifecycle was issued under. It is evidence of an issuance only: a row whose write
|
|
6
|
+
* threw, or whose JWT was never answered, proves nothing about a client or an accepted connection.
|
|
7
|
+
*
|
|
8
|
+
* Coverage is honest and partial: connections admitted before this record existed, responders
|
|
9
|
+
* that do not write it, and static (non-callout) JWTs have no row and are never inferred.
|
|
10
|
+
*/
|
|
11
|
+
import type { KV } from "@nats-io/kv";
|
|
12
|
+
import { type ValidatedUserToken } from "./token.js";
|
|
13
|
+
import { type LifecycleRegistry } from "./lifecycle-registry.js";
|
|
14
|
+
/** The closed v1 record. `connId` is the client's inbox nonce: an attribute, never an identity. */
|
|
15
|
+
export interface NativeIssuanceRecord {
|
|
16
|
+
v: 1;
|
|
17
|
+
space: string;
|
|
18
|
+
owner: string;
|
|
19
|
+
actor: string;
|
|
20
|
+
lifecycleUid: string;
|
|
21
|
+
credentialId: string;
|
|
22
|
+
view: string;
|
|
23
|
+
connId: string;
|
|
24
|
+
/** The minted inner JWT's own `iat` and `exp` (seconds); a session-caller's is its grant's. */
|
|
25
|
+
iat: number;
|
|
26
|
+
exp: number;
|
|
27
|
+
}
|
|
28
|
+
/** One callout success, handed to the recorder after the mint and before the response. */
|
|
29
|
+
export interface NativeIssuance {
|
|
30
|
+
userNkey: string;
|
|
31
|
+
token: ValidatedUserToken;
|
|
32
|
+
connId: string;
|
|
33
|
+
iat: number;
|
|
34
|
+
exp: number;
|
|
35
|
+
}
|
|
36
|
+
export type NativeIssuanceRecorder = (issuance: NativeIssuance) => Promise<void>;
|
|
37
|
+
/** Build the record from the validated token alone: never from a fresh alias lookup. */
|
|
38
|
+
export declare function nativeIssuanceRecord(space: string, i: NativeIssuance): NativeIssuanceRecord;
|
|
39
|
+
/** Parse a stored row; anything but the closed v1 shape refuses. */
|
|
40
|
+
export declare function parseNativeIssuanceRecord(raw: unknown): NativeIssuanceRecord;
|
|
41
|
+
/**
|
|
42
|
+
* The callout recorder: create-only write in the auth bucket (an existing row for the key, under
|
|
43
|
+
* any lifecycle, refuses), then `fence` re-reads the lifecycle and credential authority in the
|
|
44
|
+
* same stream. Any throw is the caller's signed deny; a row written before a throw stays as
|
|
45
|
+
* harmless evidence of an issuance that was never released.
|
|
46
|
+
*/
|
|
47
|
+
export declare function makeNativeIssuanceRecorder(registry: LifecycleRegistry, fence: (t: ValidatedUserToken) => Promise<void>): NativeIssuanceRecorder;
|
|
48
|
+
/** Leader-read one key's evidence (the auth bucket is not Direct-capable). Absent is `undefined`. */
|
|
49
|
+
export declare function readNativeIssuance(kv: KV, userNkey: string): Promise<NativeIssuanceRecord | undefined>;
|
|
50
|
+
/**
|
|
51
|
+
* Remove the rows whose minted JWT expired more than the clock tolerance ago (a session-caller's
|
|
52
|
+
* row carries its grant's expiry, so it lives as long as that grant). The walk is the leader-served
|
|
53
|
+
* `STREAM.MSG.GET` `next_by_subj` read over `natkey.` (no consumer: none may be created on the auth
|
|
54
|
+
* bucket), and each removal is a KV purge pinned to the exact sequence read. A row that does not
|
|
55
|
+
* parse throws: corrupt evidence is the caller's fault to surface, never a skipped row. The purge
|
|
56
|
+
* marker carries the bucket's own marker TTL, so it expires too.
|
|
57
|
+
*/
|
|
58
|
+
export declare function pruneNativeIssuance(registry: LifecycleRegistry, nowSec: number): Promise<{
|
|
59
|
+
live: number;
|
|
60
|
+
pruned: number;
|
|
61
|
+
}>;
|
|
62
|
+
//# sourceMappingURL=native-issuance.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"native-issuance.d.ts","sourceRoot":"","sources":["../src/native-issuance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAejF,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,oBAAoB,CAQ3F;AAED,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAW5E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAQ/I;AAED,qGAAqG;AACrG,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAI5G;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBhI"}
|