@devorash/node 0.1.0

package/dist/middleware.js

@@ -0,0 +1,374 @@
+/**
+ * Impersonation scope enforcement middleware
+ *
+ * Provides defense-in-depth by validating impersonation scope on the backend,
+ * blocking write operations in read-only mode even if the frontend SDK is bypassed.
+ *
+ * @module @devorash/node
+ */
+import { isWriteMethod, matchEndpointPattern, isAmbiguousRequestPath, getRawRequestPath, getPolicyMethods, getDenyMethods, joinMountedTarget, createErrorResponse, getErrorStatusCode, } from "@devorash/core";
+const AUTHORIZATION_SOURCES = new Set([
+    "standard",
+    "self_approved",
+    "self_approved_read",
+    "break_glass",
+]);
+/** Resolve the canonical actor/subject ids from either field-name convention. */
+export function resolveImpersonationIdentities(context) {
+    return {
+        actorId: context.actor?.id ?? context.impersonator?.id,
+        subjectId: context.subject?.id ?? context.targetUser?.id,
+    };
+}
+/**
+ * Check if methods match (considering wildcard)
+ */
+function methodsMatch(patternMethod, requestMethod) {
+    if (patternMethod === "*")
+        return true;
+    return patternMethod.toUpperCase() === requestMethod.toUpperCase();
+}
+function targetForms(target) {
+    const raw = getRawRequestPath(target);
+    let decoded = raw;
+    try {
+        decoded = decodeURIComponent(raw);
+    }
+    catch {
+        // Undecodable targets are rejected as ambiguous before any matching.
+    }
+    return { raw, decoded };
+}
+/** First deny rule matching any method against any form of any target. */
+function findBlockedEndpoint(targets, methods, blockedEndpoints) {
+    if (!blockedEndpoints || blockedEndpoints.length === 0)
+        return null;
+    const denyMethods = getDenyMethods(methods);
+    for (const endpoint of blockedEndpoints) {
+        if (!denyMethods.some((method) => methodsMatch(endpoint.method, method)))
+            continue;
+        for (const target of targets)
+            for (const candidate of [target.raw, target.decoded])
+                if (matchEndpointPattern(endpoint.pattern, candidate, {
+                    caseSensitive: false,
+                    ignoreTrailingSlash: true,
+                }))
+                    return endpoint;
+    }
+    return null;
+}
+/** A safe-read allow rule must match both forms of every routed target. */
+function isAllowlisted(targets, method, safeReadEndpoints) {
+    if (!safeReadEndpoints || safeReadEndpoints.length === 0)
+        return false;
+    return safeReadEndpoints.some((endpoint) => endpoint.method !== "*" &&
+        methodsMatch(endpoint.method, method) &&
+        targets.every((target) => matchEndpointPattern(endpoint.pattern, target.raw) &&
+            matchEndpointPattern(endpoint.pattern, target.decoded)));
+}
+/** The targets a request is judged on. */
+function requestTargets(req) {
+    const original = req.originalUrl ?? req.url ?? req.path;
+    const effective = req.routedUrls ?? [joinMountedTarget(req.baseUrl, req.url ?? req.path)];
+    return {
+        routed: [...new Set([original, ...effective])],
+        // Express strips the current router mount from req.url. Deny rules
+        // must also see that view, just as Python's mount-relative aliases do.
+        aliases: [...(req.aliasUrls ?? []), ...(req.baseUrl ? [req.url ?? req.path] : [])],
+    };
+}
+/**
+ * Create an impersonation guard middleware
+ *
+ * This middleware validates impersonation scope and blocks write operations
+ * in read-only mode. It provides defense-in-depth protection on the backend.
+ *
+ * Every request target the framework may dispatch on is judged: the original
+ * target, the effective target after rewrites/mounts, and any deny-only aliases.
+ * Policy patterns match the full client-visible path, including mount prefixes.
+ *
+ * Enforcement Priority:
+ * 1. Check blacklist first - if match, BLOCK (regardless of scope)
+ * 2. Run the application's isImpersonationAllowed hook
+ * 3. If scope is "write", ALLOW (blacklist already checked)
+ * 4. If scope is "read" and write method, check whitelist
+ * 5. If not in whitelist, BLOCK
+ */
+export function createImpersonationGuard(options) {
+    const { sdk, getImpersonationContext, onBlocked, blockedResponse = {}, showWarnings = process.env.NODE_ENV !== "production", enforceLiveness = true, livenessCacheTtlMs = 5_000, onLivenessUnavailable = "deny", isImpersonationAllowed, bridgePath, } = options;
+    if (onLivenessUnavailable !== "allow" && onLivenessUnavailable !== "deny")
+        throw new Error("Invalid liveness unavailable policy");
+    if (!Number.isFinite(livenessCacheTtlMs) || livenessCacheTtlMs < 0)
+        throw new Error("Invalid liveness cache TTL");
+    if (bridgePath !== undefined &&
+        (typeof bridgePath !== "string" ||
+            isAmbiguousRequestPath(bridgePath) ||
+            getRawRequestPath(bridgePath) !== bridgePath))
+        throw new Error("Invalid bridge path");
+    const responseMessage = blockedResponse.message ?? "This action is blocked during impersonation";
+    const responseErrorCode = blockedResponse.errorCode ?? "IMPERSONATION_SCOPE_VIOLATION";
+    // Per-guard cache of recent liveness results. `live: null` records an
+    // "unavailable" verdict for a short window so an outage costs one lookup per
+    // session per second instead of one blocked 5-second fetch per request.
+    const livenessCache = new Map();
+    const livenessInFlight = new Map();
+    const unavailableCacheMs = Math.min(1_000, livenessCacheTtlMs);
+    const maxCachedSessions = 1000;
+    function remember(sessionId, live) {
+        livenessCache.delete(sessionId);
+        livenessCache.set(sessionId, { live, checkedAt: performance.now() });
+        if (livenessCache.size > maxCachedSessions)
+            livenessCache.delete(livenessCache.keys().next().value);
+    }
+    /** Bounded single-flight lookups, including custom transports that stall. */
+    async function isSessionLive(sessionId) {
+        const now = performance.now();
+        const cached = livenessCache.get(sessionId);
+        if (cached) {
+            const ttl = cached.live === null ? unavailableCacheMs : livenessCacheTtlMs;
+            if (now - cached.checkedAt < ttl) {
+                livenessCache.delete(sessionId);
+                livenessCache.set(sessionId, cached);
+                return cached.live;
+            }
+            livenessCache.delete(sessionId);
+        }
+        const pending = livenessInFlight.get(sessionId);
+        if (pending)
+            return pending;
+        if (livenessInFlight.size >= 64)
+            return null;
+        const actual = Promise.resolve()
+            .then(() => sdk.getSessionStatus(sessionId))
+            .then((status) => (status == null ? null : status.valid === true))
+            .catch(() => null);
+        const lookup = new Promise((resolve) => {
+            let finished = false;
+            const timer = setTimeout(() => {
+                finished = true;
+                remember(sessionId, null);
+                resolve(null);
+            }, 5_000);
+            void actual.then((live) => {
+                clearTimeout(timer);
+                livenessInFlight.delete(sessionId);
+                if (!finished) {
+                    finished = true;
+                    remember(sessionId, live);
+                    resolve(live);
+                }
+            });
+        });
+        // A timed-out transport retains its slot until it actually settles. That
+        // prevents repeated requests from creating unbounded background work.
+        livenessInFlight.set(sessionId, lookup);
+        return lookup;
+    }
+    async function decide(req) {
+        const context = await getImpersonationContext(req);
+        // Only an explicit absence of impersonation passes through unchecked. A
+        // value of any other shape is an integration error and fails closed.
+        if (context === null || context === undefined)
+            return { allowed: true };
+        if (typeof context !== "object" || typeof context.isImpersonation !== "boolean")
+            return {
+                allowed: false,
+                status: 500,
+                error: "Invalid impersonation context",
+                errorCode: "INVALID_IMPERSONATION_CONTEXT",
+            };
+        if (!context.isImpersonation)
+            return { allowed: true };
+        const contextValidation = validateImpersonationContext(context);
+        if (!contextValidation.valid) {
+            const errorCode = contextValidation.expired
+                ? "IMPERSONATION_EXPIRED"
+                : "INVALID_IMPERSONATION_CONTEXT";
+            return {
+                allowed: false,
+                status: getErrorStatusCode(errorCode),
+                error: contextValidation.expired
+                    ? "Impersonation session expired"
+                    : "Invalid impersonation context",
+                errorCode,
+            };
+        }
+        const { routed, aliases } = requestTargets(req);
+        if ([...routed, ...aliases].some((target) => isAmbiguousRequestPath(target)))
+            return {
+                allowed: false,
+                status: getErrorStatusCode("IMPERSONATION_ENDPOINT_BLOCKED"),
+                error: "Ambiguous request path",
+                errorCode: "IMPERSONATION_ENDPOINT_BLOCKED",
+                blockedContext: context,
+            };
+        const routedForms = routed.map(targetForms);
+        const allForms = [...routedForms, ...aliases.map(targetForms)];
+        const displayPath = routedForms[routedForms.length - 1].decoded;
+        const methods = getPolicyMethods(req.method, req.headers, req.originalUrl ?? req.url);
+        // Optional server-side liveness: block sessions terminated/revoked before their expiry.
+        if (enforceLiveness && context.sessionId) {
+            const live = await isSessionLive(context.sessionId);
+            if (live === null && onLivenessUnavailable === "deny") {
+                // Distinct from "ended": the session may well be live, but it cannot
+                // be verified. Fail closed for impersonated traffic only.
+                return {
+                    allowed: false,
+                    status: 503,
+                    error: "Impersonation session liveness could not be verified",
+                    errorCode: "IMPERSONATION_LIVENESS_UNAVAILABLE",
+                };
+            }
+            if (live === false)
+                return {
+                    allowed: false,
+                    status: getErrorStatusCode("IMPERSONATION_SESSION_ENDED"),
+                    error: "Impersonation session is no longer active",
+                    errorCode: "IMPERSONATION_SESSION_ENDED",
+                    blockedContext: context,
+                    warning: `${req.method} ${displayPath} - session no longer live`,
+                };
+        }
+        const policy = await sdk.getScopeConfig();
+        if (!policy)
+            return {
+                allowed: false,
+                status: getErrorStatusCode("IMPERSONATION_POLICY_UNAVAILABLE"),
+                error: "Impersonation policy is temporarily unavailable",
+                errorCode: "IMPERSONATION_POLICY_UNAVAILABLE",
+            };
+        // 1. Deny rules FIRST - blocked regardless of scope, on any target/alias.
+        const blockedBy = findBlockedEndpoint(allForms, methods, policy.blockedEndpoints);
+        if (blockedBy)
+            return {
+                allowed: false,
+                status: blockedResponse.status ?? getErrorStatusCode("IMPERSONATION_ENDPOINT_BLOCKED"),
+                error: "This endpoint is blocked during impersonation",
+                errorCode: "IMPERSONATION_ENDPOINT_BLOCKED",
+                blockedContext: context,
+                warning: `${methods.join("/")} ${displayPath} - blacklisted (${blockedBy.method} ${blockedBy.pattern})`,
+            };
+        // 2. Application-specific semantic authorization.
+        if (isImpersonationAllowed && (await isImpersonationAllowed(req, context)) !== true)
+            return {
+                allowed: false,
+                status: blockedResponse.status ?? getErrorStatusCode("IMPERSONATION_ENDPOINT_BLOCKED"),
+                error: "This action is not permitted during impersonation",
+                errorCode: "IMPERSONATION_ENDPOINT_BLOCKED",
+                blockedContext: context,
+            };
+        // 3. Write scope allows everything that is not denied.
+        if (context.scope === "write")
+            return { allowed: true };
+        const writeMethods = methods.filter((method) => isWriteMethod(method));
+        if (writeMethods.length === 0)
+            return { allowed: true };
+        // 4. The browser-session bridge mints a Devora resume code for this
+        // already-authenticated, live session. It is not a customer write.
+        if (bridgePath &&
+            methods.length === 1 &&
+            methods[0] === "POST" &&
+            routedForms.every((target) => target.raw === bridgePath && target.decoded === bridgePath))
+            return { allowed: true };
+        // 5. Read scope: every write method must be allowlisted on every routed target.
+        if (writeMethods.every((method) => isAllowlisted(routedForms, method, policy.safeReadEndpoints)))
+            return { allowed: true };
+        return {
+            allowed: false,
+            status: blockedResponse.status ?? getErrorStatusCode(responseErrorCode),
+            error: responseMessage,
+            errorCode: responseErrorCode,
+            blockedContext: context,
+            warning: `${methods.join("/")} ${displayPath} - read-only impersonation`,
+        };
+    }
+    return async (req, res, next) => {
+        let verdict;
+        try {
+            verdict = await decide(req);
+        }
+        catch {
+            // Extractor, policy and hook failures must never hang the request or
+            // surface as an unhandled rejection (Express 4); they fail closed.
+            verdict = {
+                allowed: false,
+                status: 500,
+                error: "Impersonation guard failed",
+                errorCode: "INTERNAL_ERROR",
+            };
+        }
+        if (verdict.allowed) {
+            await next();
+            return;
+        }
+        if (verdict.blockedContext) {
+            if (showWarnings && verdict.warning)
+                console.warn(`[Devora] Blocked ${verdict.warning} (session: ${verdict.blockedContext.sessionId})`);
+            try {
+                onBlocked?.(req, verdict.blockedContext);
+            }
+            catch {
+                // Audit callbacks cannot change the decision.
+            }
+        }
+        res.status(verdict.status).json(createErrorResponse(verdict.error, verdict.errorCode));
+    };
+}
+/**
+ * Validate impersonation context
+ *
+ * Utility function to check if impersonation context is valid and not expired.
+ * Types are checked strictly; nothing is coerced.
+ */
+export function validateImpersonationContext(context) {
+    if (!context || typeof context !== "object") {
+        return { valid: false, error: "No impersonation context" };
+    }
+    if (context.isImpersonation !== true) {
+        return { valid: false, error: "Not an impersonation session" };
+    }
+    if (context.scope !== "read" && context.scope !== "write") {
+        return { valid: false, error: "Invalid scope" };
+    }
+    const identities = resolveImpersonationIdentities(context);
+    if (typeof identities.actorId !== "string" ||
+        !identities.actorId ||
+        typeof identities.subjectId !== "string" ||
+        !identities.subjectId) {
+        return { valid: false, error: "Missing impersonation actor or subject" };
+    }
+    if (context.authMethod !== "devora_impersonation") {
+        return { valid: false, error: "Invalid impersonation authentication method" };
+    }
+    if (!AUTHORIZATION_SOURCES.has(context.authorizationSource)) {
+        return { valid: false, error: "Invalid authorization source" };
+    }
+    if (typeof context.recordingAllowed !== "boolean") {
+        return { valid: false, error: "Missing recording authorization" };
+    }
+    if (typeof context.sessionId !== "string" || !context.sessionId) {
+        return { valid: false, error: "Missing session ID" };
+    }
+    // expiresAt must be an integer Unix timestamp in milliseconds (Date.now()).
+    // If your JWT uses seconds, convert it when extracting the context.
+    if (typeof context.expiresAt !== "number" || !Number.isSafeInteger(context.expiresAt)) {
+        return { valid: false, error: "Missing expiration" };
+    }
+    const YEAR_2000_MS = 946684800000;
+    if (context.expiresAt < YEAR_2000_MS) {
+        return { valid: false, error: "Expiration must be a Unix timestamp in milliseconds" };
+    }
+    if (Date.now() > context.expiresAt) {
+        return { valid: false, expired: true, error: "Impersonation session expired" };
+    }
+    return { valid: true };
+}
+/**
+ * Check if a request method is a write operation
+ *
+ * @deprecated Use isWriteMethod from @devorash/core instead
+ */
+export function isWriteOperation(method) {
+    return isWriteMethod(method.toUpperCase());
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACN,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAElB,MAAM,gBAAgB,CAAA;AAsEvB,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,aAAa;CACb,CAAC,CAAA;AAEF,iFAAiF;AACjF,MAAM,UAAU,8BAA8B,CAC7C,OAAwF;IAExF,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE;QACtD,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE;KACxD,CAAA;AACF,CAAC;AA6HD;;GAEG;AACH,SAAS,YAAY,CAAC,aAAqB,EAAE,aAAqB;IACjE,IAAI,aAAa,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO,aAAa,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CAAA;AACnE,CAAC;AAQD,SAAS,WAAW,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,IAAI,CAAC;QACJ,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAC3B,OAAsB,EACtB,OAAiB,EACjB,gBAAkC;IAElC,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IAC3C,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAE,SAAQ;QAClF,KAAK,MAAM,MAAM,IAAI,OAAO;YAC3B,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;gBACnD,IACC,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE;oBACjD,aAAa,EAAE,KAAK;oBACpB,mBAAmB,EAAE,IAAI;iBACzB,CAAC;oBAEF,OAAO,QAAQ,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CACrB,OAAsB,EACtB,MAAc,EACd,iBAAmC;IAEnC,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACtE,OAAO,iBAAiB,CAAC,IAAI,CAC5B,CAAC,QAAQ,EAAE,EAAE,CACZ,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACrC,OAAO,CAAC,KAAK,CACZ,CAAC,MAAM,EAAE,EAAE,CACV,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;YAClD,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CACvD,CACF,CAAA;AACF,CAAC;AAED,0CAA0C;AAC1C,SAAS,cAAc,CAAC,GAAsB;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAA;IACvD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACzF,OAAO;QACN,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QAC9C,mEAAmE;QACnE,uEAAuE;QACvE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KAClF,CAAA;AACF,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CACvC,OAA4C;IAE5C,MAAM,EACL,GAAG,EACH,uBAAuB,EACvB,SAAS,EACT,eAAe,GAAG,EAAE,EACpB,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EACpD,eAAe,GAAG,IAAI,EACtB,kBAAkB,GAAG,KAAK,EAC1B,qBAAqB,GAAG,MAAM,EAC9B,sBAAsB,EACtB,UAAU,GACV,GAAG,OAAO,CAAA;IACX,IAAI,qBAAqB,KAAK,OAAO,IAAI,qBAAqB,KAAK,MAAM;QACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,GAAG,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9C,IACC,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC9B,sBAAsB,CAAC,UAAU,CAAC;YAClC,iBAAiB,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC;QAE9C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,IAAI,6CAA6C,CAAA;IAChG,MAAM,iBAAiB,GAAG,eAAe,CAAC,SAAS,IAAI,+BAA+B,CAAA;IAEtF,sEAAsE;IACtE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuD,CAAA;IACpF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAA;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IAC9D,MAAM,iBAAiB,GAAG,IAAI,CAAA;IAE9B,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAoB;QACxD,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/B,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,IAAI,GAAG,iBAAiB;YACzC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAA;IAC1D,CAAC;IAED,6EAA6E;IAC7E,KAAK,UAAU,aAAa,CAAC,SAAiB;QAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAA;YAC1E,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAClC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAC/B,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBACpC,OAAO,MAAM,CAAC,IAAI,CAAA;YACnB,CAAC;YACD,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,gBAAgB,CAAC,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE;aAC9B,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aAC3C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;aACjE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACnB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YACtD,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,QAAQ,GAAG,IAAI,CAAA;gBACf,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,IAAI,CAAC,CAAA;YACd,CAAC,EAAE,KAAK,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,QAAQ,GAAG,IAAI,CAAA;oBACf,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;oBACzB,OAAO,CAAC,IAAI,CAAC,CAAA;gBACd,CAAC;YACF,CAAC,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;QACF,yEAAyE;QACzE,sEAAsE;QACtE,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACvC,OAAO,MAAM,CAAA;IACd,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAa;QAClC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAElD,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS;YAC9E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,+BAA+B;gBACtC,SAAS,EAAE,+BAA+B;aAC1C,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,eAAe;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEtD,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAA;QAC/D,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO;gBAC1C,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,+BAA+B,CAAA;YAClC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC;gBACrC,KAAK,EAAE,iBAAiB,CAAC,OAAO;oBAC/B,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,+BAA+B;gBAClC,SAAS;aACT,CAAA;QACF,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,CAAC,gCAAgC,CAAC;gBAC5D,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,gCAAgC;gBAC3C,cAAc,EAAE,OAAO;aACvB,CAAA;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAA;QAChE,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAErF,wFAAwF;QACxF,IAAI,eAAe,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACnD,IAAI,IAAI,KAAK,IAAI,IAAI,qBAAqB,KAAK,MAAM,EAAE,CAAC;gBACvD,qEAAqE;gBACrE,0DAA0D;gBAC1D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,sDAAsD;oBAC7D,SAAS,EAAE,oCAAoC;iBAC/C,CAAA;YACF,CAAC;YACD,IAAI,IAAI,KAAK,KAAK;gBACjB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kBAAkB,CAAC,6BAA6B,CAAC;oBACzD,KAAK,EAAE,2CAA2C;oBAClD,SAAS,EAAE,6BAA6B;oBACxC,cAAc,EAAE,OAAO;oBACvB,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,2BAA2B;iBAChE,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAA;QACzC,IAAI,CAAC,MAAM;YACV,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,CAAC,kCAAkC,CAAC;gBAC9D,KAAK,EAAE,iDAAiD;gBACxD,SAAS,EAAE,kCAAkC;aAC7C,CAAA;QAEF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACjF,IAAI,SAAS;YACZ,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,CAAC;gBACtF,KAAK,EAAE,+CAA+C;gBACtD,SAAS,EAAE,gCAAgC;gBAC3C,cAAc,EAAE,OAAO;gBACvB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,mBAAmB,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,GAAG;aACvG,CAAA;QAEF,kDAAkD;QAClD,IAAI,sBAAsB,IAAI,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;YAClF,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,CAAC;gBACtF,KAAK,EAAE,mDAAmD;gBAC1D,SAAS,EAAE,gCAAgC;gBAC3C,cAAc,EAAE,OAAO;aACvB,CAAA;QAEF,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEvD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEvD,oEAAoE;QACpE,mEAAmE;QACnE,IACC,UAAU;YACV,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM;YACrB,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC;YAEzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEzB,gFAAgF;QAChF,IACC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEzB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC;YACvE,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,iBAAiB;YAC5B,cAAc,EAAE,OAAO;YACvB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,4BAA4B;SACxE,CAAA;IACF,CAAC;IAED,OAAO,KAAK,EAAE,GAAa,EAAE,GAAuB,EAAE,IAAoB,EAAiB,EAAE;QAC5F,IAAI,OAAqB,CAAA;QACzB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,GAAG;gBACT,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,gBAAgB;aAC3B,CAAA;QACF,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,YAAY,IAAI,OAAO,CAAC,OAAO;gBAClC,OAAO,CAAC,IAAI,CACX,oBAAoB,OAAO,CAAC,OAAO,cAAc,OAAO,CAAC,cAAc,CAAC,SAAS,GAAG,CACpF,CAAA;YACF,IAAI,CAAC;gBACJ,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACR,8CAA8C;YAC/C,CAAC;QACF,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IACvF,CAAC,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAgD;IAK5F,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAA;IAC3D,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAA;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAA;IAC1D,IACC,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;QACtC,CAAC,UAAU,CAAC,OAAO;QACnB,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;QACxC,CAAC,UAAU,CAAC,SAAS,EACpB,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAA;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAA;IAC9E,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAA6B,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;IACrD,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;IACrD,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAA;IACjC,IAAI,OAAO,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAA;IACtF,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;IAC/E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,OAAO,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3C,CAAC"}

package/dist/replay-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Atomic replay protection shared by every application instance.
+ *
+ * `consume` must be an atomic insert-if-absent (for example Redis
+ * `SET key 1 NX PXAT expiresAt`, or a unique-key database insert) and must
+ * never evict an entry before `expiresAt`. A store that cannot guarantee this
+ * must throw; the SDK then fails closed with a 503.
+ */
+export interface ReplayStore {
+    /**
+     * Return true only for the first consumption of `requestId` within
+     * `namespace` before `expiresAt` (Unix milliseconds).
+     */
+    consume(namespace: string, requestId: string, expiresAt: number): Promise<boolean>;
+}
+/** Development-only implementation; production must supply a persistent store. */
+export declare class InMemoryReplayStore implements ReplayStore {
+    private readonly entries;
+    consume(namespace: string, requestId: string, expiresAt: number): Promise<boolean>;
+}
+//# sourceMappingURL=replay-store.d.ts.map

package/dist/replay-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-store.d.ts","sourceRoot":"","sources":["../src/replay-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B;;;OAGG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClF;AAED,kFAAkF;AAClF,qBAAa,mBAAoB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAE9C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASxF"}

package/dist/replay-store.js

@@ -0,0 +1,18 @@
+/** Development-only implementation; production must supply a persistent store. */
+export class InMemoryReplayStore {
+    entries = new Map();
+    async consume(namespace, requestId, expiresAt) {
+        if (!Number.isFinite(expiresAt))
+            throw new Error("Invalid replay expiry");
+        const now = Date.now();
+        for (const [id, expiry] of this.entries)
+            if (expiry <= now)
+                this.entries.delete(id);
+        const key = `${namespace}\n${requestId}`;
+        if (this.entries.has(key))
+            return false;
+        this.entries.set(key, expiresAt);
+        return true;
+    }
+}
+//# sourceMappingURL=replay-store.js.map

package/dist/replay-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-store.js","sourceRoot":"","sources":["../src/replay-store.ts"],"names":[],"mappings":"AAgBA,kFAAkF;AAClF,MAAM,OAAO,mBAAmB;IACd,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEpD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,SAAiB,EAAE,SAAiB;QACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,SAAS,EAAE,CAAA;QACxC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACZ,CAAC;CACD"}

package/dist/scope-config.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Scope configuration fetching and caching for backend SDK
+ *
+ * Fetches centrally managed whitelist and blacklist configuration from the Devora platform
+ * and caches it with automatic refresh.
+ *
+ * @module @devorash/node
+ */
+/**
+ * Scope endpoint configuration
+ */
+export interface ScopeEndpoint {
+    method: string;
+    pattern: string;
+}
+/**
+ * Scope configuration
+ */
+export interface ScopeConfig {
+    /** Whitelist: Safe endpoints allowed in read-only mode */
+    safeReadEndpoints: ScopeEndpoint[];
+    /** Blacklist: Endpoints blocked during ANY impersonation */
+    blockedEndpoints: ScopeEndpoint[];
+    /** Configuration version */
+    version: number;
+    /** When the cache expires (Unix ms) */
+    cachedUntil: number;
+}
+/**
+ * Scope config fetcher options
+ */
+export interface ScopeConfigFetcherOptions {
+    /** Public server API key identifier */
+    apiKey: string;
+    /**
+     * Returns fresh signature headers for `GET /api/sdk/scope-config` (request
+     * signing v3, customer-to-devora). The policy is not public; `devoraSDK`
+     * supplies this from its server secret.
+     */
+    signRequest: () => Record<string, string>;
+    /** Devora API origin (default: the origin baked into the SDK at build time) */
+    apiUrl?: string;
+    /** Enable debug logging */
+    debug?: boolean;
+    /**
+     * Cache TTL in milliseconds applied when a 304 revalidates an existing
+     * policy (default: 5 minutes, matching the server). A cached policy is served
+     * for at most `STALE_GRACE_MS` past its window when Devora is unreachable.
+     */
+    cacheTtlMs?: number;
+}
+/** How long a cached policy may be served past its window during an outage. */
+export declare const STALE_GRACE_MS: number;
+/**
+ * Create a scope config fetcher
+ *
+ * Handles fetching scope configuration from Devora API with caching
+ * and automatic background refresh.
+ */
+export declare function createScopeConfigFetcher(options: ScopeConfigFetcherOptions): {
+    getConfig: () => Promise<ScopeConfig | null>;
+    getCachedConfig: () => ScopeConfig | null;
+    refresh: () => Promise<ScopeConfig | null>;
+    stop: () => void;
+};
+//# sourceMappingURL=scope-config.d.ts.map

package/dist/scope-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-config.d.ts","sourceRoot":"","sources":["../src/scope-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2DH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,0DAA0D;IAC1D,iBAAiB,EAAE,aAAa,EAAE,CAAA;IAClC,4DAA4D;IAC5D,gBAAgB,EAAE,aAAa,EAAE,CAAA;IACjC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,+EAA+E;AAC/E,eAAO,MAAM,cAAc,QAAgB,CAAA;AAG3C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC7E,SAAS,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC5C,eAAe,EAAE,MAAM,WAAW,GAAG,IAAI,CAAA;IACzC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC1C,IAAI,EAAE,MAAM,IAAI,CAAA;CAChB,CAqJA"}