@dsh-enhanced/assistant-actions 0.1.30

package/lib/broker-protocol.js

@@ -0,0 +1,786 @@
+import { createHash, createPrivateKey, createPublicKey, KeyObject, randomBytes, randomUUID, sign, verify } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+export const GITHUB_BROKER_PROTOCOL = 'assistant-actions/github-broker/v1';
+export const GITHUB_BROKER_REQUEST_MAX_BYTES = 8 * 1024 * 1024;
+export const GITHUB_BROKER_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+export const GITHUB_BROKER_DEFAULT_HELLO_TTL_MS = 30_000;
+const HELLO_DOMAIN = 'assistant-actions/github-broker/v1/server-hello\0';
+const REQUEST_DOMAIN = 'assistant-actions/github-broker/v1/client-request\0';
+const RESPONSE_DOMAIN = 'assistant-actions/github-broker/v1/server-response\0';
+const ADMIN_REQUEST_DOMAIN = 'assistant-actions/github-broker/v1/admin-request\0';
+const ADMIN_RESPONSE_DOMAIN = 'assistant-actions/github-broker/v1/admin-response\0';
+const MAX_CANONICAL_DEPTH = 64;
+const MAX_CANONICAL_NODES = 200_000;
+const DIGEST = /^[0-9a-f]{64}$/;
+const OID = /^[0-9a-f]{40,128}$/;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const INSTANCE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const REPOSITORY = /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const BRANCH = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const SENSITIVE_KEY = /^(?:access[_-]?token|api[_-]?key|authorization|cookie|credential|password|private[_-]?key|secret|token)$/i;
+const SENSITIVE_VALUE = /(?:authorization\s*:|bearer\s+|gh[opusr]_|github_pat_|-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----)/i;
+const ERROR_CODE = /^[a-z][a-z0-9-]{0,127}$/;
+export class BrokerProtocolError extends Error {
+    code;
+    constructor(code, message) {
+        super(`assistant-actions broker protocol: ${message}`);
+        this.name = 'BrokerProtocolError';
+        this.code = code;
+    }
+}
+function reject(code, message) { throw new BrokerProtocolError(code, message); }
+function record(value, label) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        reject('invalid-message', `${label} must be an object`);
+    if (Object.getPrototypeOf(value) !== Object.prototype || Object.getOwnPropertySymbols(value).length !== 0)
+        reject('invalid-message', `${label} must be a plain data object`);
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Object.values(descriptors).some(descriptor => !descriptor.enumerable || !('value' in descriptor)))
+        reject('invalid-message', `${label} must contain enumerable data fields only`);
+    return value;
+}
+function exact(value, keys, label) {
+    const output = record(value, label);
+    const actual = Object.keys(output).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        reject('unknown-field', `${label} has unknown or missing fields`);
+    return output;
+}
+function text(value, label, max = 256) {
+    if (typeof value !== 'string' || value.length < 1 || value.length > max || /[\p{Cc}]/u.test(value))
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function integer(value, label, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function digest(value, label) {
+    if (typeof value !== 'string' || !DIGEST.test(value))
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function base64url(value, label, bytes) {
+    if (typeof value !== 'string' || !BASE64URL.test(value))
+        reject('invalid-message', `${label} is invalid`);
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.length !== bytes || decoded.toString('base64url') !== value)
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function instance(value, label) {
+    if (typeof value !== 'string' || !INSTANCE.test(value))
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function oid(value, label) {
+    if (typeof value !== 'string' || !OID.test(value))
+        reject('invalid-message', `${label} is invalid`);
+    return value;
+}
+function canonical(value, state, depth) {
+    if (++state.nodes > MAX_CANONICAL_NODES || depth > MAX_CANONICAL_DEPTH)
+        reject('invalid-json', 'canonical JSON complexity exceeded');
+    if (value === null)
+        return 'null';
+    if (typeof value === 'boolean' || typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value) || Object.is(value, -0))
+            reject('invalid-json', 'only safe canonical integers are supported');
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        if (value.length > MAX_CANONICAL_NODES - state.nodes)
+            reject('invalid-json', 'canonical JSON complexity exceeded');
+        if (Object.getPrototypeOf(value) !== Array.prototype || Object.getOwnPropertySymbols(value).length !== 0)
+            reject('invalid-json', 'arrays must use the ordinary JSON shape');
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        if (Object.keys(descriptors).some(key => key !== 'length' && (!/^(?:0|[1-9][0-9]*)$/.test(key) || Number(key) >= value.length))
+            || Object.entries(descriptors).some(([key, descriptor]) => key !== 'length' && (!descriptor.enumerable || !('value' in descriptor))))
+            reject('invalid-json', 'arrays must be dense enumerable data values');
+        const entries = [];
+        for (let index = 0; index < value.length; index++) {
+            if (!Object.hasOwn(descriptors, String(index)))
+                reject('invalid-json', 'arrays must be dense enumerable data values');
+            entries.push(canonical(value[index], state, depth + 1));
+        }
+        return `[${entries.join(',')}]`;
+    }
+    if (typeof value !== 'object')
+        reject('invalid-json', 'unsupported JSON value');
+    const input = record(value, 'canonical JSON object');
+    const keys = Object.keys(input);
+    if (keys.length > MAX_CANONICAL_NODES - state.nodes)
+        reject('invalid-json', 'canonical JSON complexity exceeded');
+    keys.sort();
+    return `{${keys.map(key => {
+        if (SENSITIVE_KEY.test(key))
+            reject('secret-field', 'credentials are forbidden on the broker wire');
+        return `${JSON.stringify(key)}:${canonical(input[key], state, depth + 1)}`;
+    }).join(',')}}`;
+}
+/** RFC-8785-style deterministic JSON for this integer-only protocol. */
+export function canonicalBrokerJson(value) { return canonical(value, { nodes: 0 }, 0); }
+export function brokerDigest(value) { return createHash('sha256').update(canonicalBrokerJson(value)).digest('hex'); }
+function parseCanonicalJson(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        reject('invalid-json', 'frame is not valid UTF-8');
+    preflightJsonComplexity(source);
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        reject('invalid-json', 'frame is not valid JSON');
+    }
+    if (canonicalBrokerJson(value) !== source)
+        reject('non-canonical-json', 'frame JSON is not canonical');
+    return value;
+}
+/** Bound structural work before JSON.parse allocates an attacker-sized tree. */
+function preflightJsonComplexity(source) {
+    let depth = 0, tokens = 1, inString = false, escaped = false;
+    for (let index = 0; index < source.length; index++) {
+        const character = source[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (character === '\\')
+                escaped = true;
+            else if (character === '"')
+                inString = false;
+            continue;
+        }
+        if (character === '"') {
+            inString = true;
+            tokens++;
+        }
+        else if (character === '{' || character === '[') {
+            depth++;
+            tokens++;
+            if (depth > MAX_CANONICAL_DEPTH)
+                reject('invalid-json', 'canonical JSON complexity exceeded');
+        }
+        else if (character === '}' || character === ']')
+            depth--;
+        else if (character === ',')
+            tokens++;
+        if (tokens > MAX_CANONICAL_NODES || depth < 0)
+            reject('invalid-json', 'canonical JSON complexity exceeded');
+    }
+    if (inString || escaped || depth !== 0)
+        reject('invalid-json', 'frame is not valid JSON');
+}
+export function encodeBrokerFrame(value, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 0xffff_ffff)
+        reject('invalid-limit', 'frame limit is invalid');
+    const payload = Buffer.from(canonicalBrokerJson(value), 'utf8');
+    if (payload.length > maxBytes)
+        reject('frame-too-large', 'frame exceeds its byte limit');
+    const output = Buffer.allocUnsafe(payload.length + 4);
+    output.writeUInt32BE(payload.length, 0);
+    payload.copy(output, 4);
+    return output;
+}
+/** Incremental four-byte big-endian length-prefixed canonical JSON decoder. */
+export class BrokerFrameDecoder {
+    #maxBytes;
+    #maxFrames;
+    #header = Buffer.alloc(4);
+    #headerOffset = 0;
+    #payload;
+    #payloadOffset = 0;
+    #frames = 0;
+    constructor(maxBytes, maxFrames = 1) {
+        if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 0xffff_ffff || !Number.isSafeInteger(maxFrames) || maxFrames < 1)
+            reject('invalid-limit', 'decoder limits are invalid');
+        this.#maxBytes = maxBytes;
+        this.#maxFrames = maxFrames;
+    }
+    push(chunk) {
+        if (!(chunk instanceof Uint8Array))
+            reject('invalid-frame', 'frame chunk is invalid');
+        if (chunk.byteLength === 0)
+            return [];
+        if (this.#frames >= this.#maxFrames)
+            reject('trailing-data', 'bytes follow the final frame');
+        const output = [];
+        const input = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+        let offset = 0;
+        while (offset < input.length) {
+            if (this.#frames >= this.#maxFrames)
+                reject('trailing-data', 'bytes follow the final frame');
+            if (!this.#payload) {
+                const copied = input.copy(this.#header, this.#headerOffset, offset, Math.min(input.length, offset + 4 - this.#headerOffset));
+                this.#headerOffset += copied;
+                offset += copied;
+                if (this.#headerOffset < 4)
+                    continue;
+                const length = this.#header.readUInt32BE(0);
+                if (length === 0)
+                    reject('invalid-frame', 'empty frames are invalid');
+                if (length > this.#maxBytes)
+                    reject('frame-too-large', 'declared frame exceeds its byte limit');
+                this.#payload = Buffer.allocUnsafe(length);
+                this.#payloadOffset = 0;
+            }
+            const copied = input.copy(this.#payload, this.#payloadOffset, offset, Math.min(input.length, offset + this.#payload.length - this.#payloadOffset));
+            this.#payloadOffset += copied;
+            offset += copied;
+            if (this.#payloadOffset === this.#payload.length) {
+                output.push(parseCanonicalJson(this.#payload));
+                this.#frames++;
+                this.#headerOffset = 0;
+                this.#payload = undefined;
+                this.#payloadOffset = 0;
+            }
+        }
+        return output;
+    }
+    finish() {
+        if (this.#headerOffset !== 0 || this.#payload !== undefined)
+            reject('truncated-frame', 'connection ended during a frame');
+    }
+    get frameCount() { return this.#frames; }
+}
+function privateKey(value) {
+    let key;
+    try {
+        key = value instanceof KeyObject ? value : createPrivateKey(value);
+    }
+    catch {
+        reject('invalid-key', 'client private key is invalid');
+    }
+    if (key.type !== 'private' || key.asymmetricKeyType !== 'ed25519')
+        reject('invalid-key', 'client private key must be Ed25519');
+    return key;
+}
+function publicKey(value) {
+    let key;
+    try {
+        if (value instanceof KeyObject && value.type === 'public')
+            key = value;
+        else
+            key = createPublicKey(value);
+    }
+    catch {
+        reject('invalid-key', 'server public key is invalid');
+    }
+    if (key.type !== 'public' || key.asymmetricKeyType !== 'ed25519')
+        reject('invalid-key', 'server public key must be Ed25519');
+    return key;
+}
+function signingBytes(domain, value) { return Buffer.from(domain + canonicalBrokerJson(value), 'utf8'); }
+function signatureFor(domain, value, key) { return sign(null, signingBytes(domain, value), privateKey(key)).toString('base64url'); }
+function verifySignature(domain, value, signature, key) {
+    if (!verify(null, signingBytes(domain, value), publicKey(key), Buffer.from(signature, 'base64url')))
+        reject('invalid-signature', 'signature verification failed');
+}
+export function createBrokerServerHello(input, key) {
+    const unsigned = normalizeHelloUnsigned({ protocol: GITHUB_BROKER_PROTOCOL, type: 'server-hello', instanceId: input.instanceId, generation: input.generation, policyEpoch: input.policyEpoch, emergencyEpoch: input.emergencyEpoch, challenge: input.challenge ?? randomBytes(32).toString('base64url'), expiresAt: input.expiresAt });
+    return Object.freeze({ ...unsigned, signature: signatureFor(HELLO_DOMAIN, unsigned, key) });
+}
+function normalizeHelloUnsigned(value) {
+    const input = exact(value, ['protocol', 'type', 'instanceId', 'generation', 'policyEpoch', 'emergencyEpoch', 'challenge', 'expiresAt'], 'server hello');
+    if (input.protocol !== GITHUB_BROKER_PROTOCOL || input.type !== 'server-hello')
+        reject('wrong-protocol', 'server hello protocol is invalid');
+    return Object.freeze({ protocol: GITHUB_BROKER_PROTOCOL, type: 'server-hello', instanceId: instance(input.instanceId, 'hello.instanceId'), generation: integer(input.generation, 'hello.generation', 1), policyEpoch: integer(input.policyEpoch, 'hello.policyEpoch'), emergencyEpoch: integer(input.emergencyEpoch, 'hello.emergencyEpoch'), challenge: base64url(input.challenge, 'hello.challenge', 32), expiresAt: integer(input.expiresAt, 'hello.expiresAt', 1) });
+}
+export function verifyBrokerServerHello(value, key, options = {}) {
+    const input = exact(value, ['protocol', 'type', 'instanceId', 'generation', 'policyEpoch', 'emergencyEpoch', 'challenge', 'expiresAt', 'signature'], 'server hello');
+    const { signature: rawSignature, ...rawUnsigned } = input;
+    const unsigned = normalizeHelloUnsigned(rawUnsigned);
+    const signature = base64url(rawSignature, 'hello.signature', 64);
+    const now = options.now ?? Date.now(), maxTtlMs = options.maxTtlMs ?? GITHUB_BROKER_DEFAULT_HELLO_TTL_MS;
+    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(maxTtlMs) || maxTtlMs < 1 || unsigned.expiresAt <= now || unsigned.expiresAt - now > maxTtlMs)
+        reject('expired-hello', 'server hello is expired or has an excessive lifetime');
+    if (options.expectedInstanceId !== undefined && unsigned.instanceId !== options.expectedInstanceId)
+        reject('server-identity-mismatch', 'server instance does not match');
+    if (options.minimumGeneration !== undefined && unsigned.generation < options.minimumGeneration)
+        reject('server-identity-mismatch', 'server generation regressed');
+    verifySignature(HELLO_DOMAIN, unsigned, signature, key);
+    return Object.freeze({ ...unsigned, signature });
+}
+/**
+ * Canonical digest of the broker-authoritative grant, including fields that
+ * remain private to the broker. Host projections consume this issued digest;
+ * they must never attempt to reconstruct it from a reduced mirror.
+ */
+export function normalizeBrokerGrantAuthority(value) {
+    const input = exactOptional(value, ['protocol', 'id', 'revision', 'clientKeyId', 'owner', 'sessionId', 'destination', 'credentialId', 'expiresAt', 'maxActions', 'maxTotalBytes', 'maxCostUnits', 'allowedOperations', 'allowedInspectKinds', 'client', 'source', 'policyEpoch', 'emergencyEpoch'], ['verifiedDelivery'], 'broker grant');
+    if (input.protocol !== 'assistant-actions/external-github-grant/v1')
+        reject('wrong-protocol', 'broker grant protocol is invalid');
+    const normalizedOwner = owner(input.owner);
+    if (!isAbsolute(normalizedOwner.workspace) || resolve(normalizedOwner.workspace) !== normalizedOwner.workspace || normalizedOwner.workspace === '/')
+        reject('invalid-message', 'broker grant workspace is invalid');
+    const rawDestination = grantDestination(input.destination, 'broker grant destination');
+    const normalizedDestination = destination({ classification: rawDestination.classification, repository: rawDestination.repository, branch: rawDestination.branch, ...(rawDestination.baseBranch === undefined ? {} : { baseBranch: rawDestination.baseBranch }) });
+    if (!Array.isArray(rawDestination.paths) || rawDestination.paths.length < 1 || rawDestination.paths.length > 128 || !rawDestination.paths.every(validPath) || new Set(rawDestination.paths).size !== rawDestination.paths.length)
+        reject('invalid-message', 'broker grant paths are invalid');
+    if (!Array.isArray(input.allowedOperations) || input.allowedOperations.length < 1 || input.allowedOperations.length > 3 || input.allowedOperations.some(value => !['commit', 'inspect', 'pull-request'].includes(String(value))) || new Set(input.allowedOperations).size !== input.allowedOperations.length)
+        reject('invalid-message', 'broker grant operations are invalid');
+    if (!Array.isArray(input.allowedInspectKinds) || input.allowedInspectKinds.length > 6 || input.allowedInspectKinds.some(value => !['repository', 'branch', 'file', 'pull-request', 'checks', 'reviews'].includes(String(value))) || new Set(input.allowedInspectKinds).size !== input.allowedInspectKinds.length
+        || input.allowedOperations.includes('inspect') !== (input.allowedInspectKinds.length > 0))
+        reject('invalid-message', 'broker grant inspect kinds are invalid');
+    if (input.allowedInspectKinds.some(kind => ['pull-request', 'checks', 'reviews'].includes(String(kind)))
+        && (normalizedDestination.baseBranch === undefined || normalizedDestination.baseBranch === normalizedDestination.branch))
+        reject('invalid-message', 'broker grant base branch is required for pull request inspection');
+    if (input.allowedOperations.includes('pull-request') && (normalizedDestination.baseBranch === undefined || normalizedDestination.baseBranch === normalizedDestination.branch))
+        reject('invalid-message', 'broker grant base branch is required for pull request delivery');
+    const verifiedDelivery = input.verifiedDelivery === undefined ? undefined : deliveryMetadata(input.verifiedDelivery, 'broker grant verified delivery');
+    if (verifiedDelivery !== undefined && !input.allowedOperations.includes('commit'))
+        reject('invalid-message', 'broker grant verified delivery requires commit authority');
+    return Object.freeze({
+        protocol: 'assistant-actions/external-github-grant/v1', id: text(input.id, 'broker grant id'), revision: integer(input.revision, 'broker grant revision', 1), clientKeyId: instance(input.clientKeyId, 'broker grant clientKeyId'), owner: normalizedOwner, sessionId: text(input.sessionId, 'broker grant sessionId'),
+        destination: Object.freeze({ ...normalizedDestination, paths: Object.freeze([...rawDestination.paths]) }), credentialId: instance(input.credentialId, 'broker grant credentialId'), expiresAt: integer(input.expiresAt, 'broker grant expiresAt', 1),
+        maxActions: integer(input.maxActions, 'broker grant maxActions', 1, 10_000), maxTotalBytes: integer(input.maxTotalBytes, 'broker grant maxTotalBytes', 1, 64 * 1024 * 1024), maxCostUnits: integer(input.maxCostUnits, 'broker grant maxCostUnits'),
+        allowedOperations: Object.freeze([...input.allowedOperations]), allowedInspectKinds: Object.freeze([...input.allowedInspectKinds]), ...(verifiedDelivery === undefined ? {} : { verifiedDelivery }),
+        client: endpoint(input.client, 'assistant-actions-host', 'broker grant client'), source: dataSource(input.source), policyEpoch: integer(input.policyEpoch, 'broker grant policyEpoch'), emergencyEpoch: integer(input.emergencyEpoch, 'broker grant emergencyEpoch'),
+    });
+}
+export function brokerGrantAuthorityDigest(grant) {
+    return brokerDigest(normalizeBrokerGrantAuthority(grant));
+}
+export function createBrokerGrantProjection(grant) {
+    const value = normalizeBrokerGrantAuthority(grant);
+    return Object.freeze({ id: value.id, revision: value.revision, grantDigest: brokerGrantAuthorityDigest(value), owner: value.owner, sessionId: value.sessionId, destination: value.destination, expiresAt: value.expiresAt, maxActions: value.maxActions, maxTotalBytes: value.maxTotalBytes, source: value.source, maxCostUnits: value.maxCostUnits, allowedOperations: value.allowedOperations, allowedInspectKinds: value.allowedInspectKinds, ...(value.verifiedDelivery === undefined ? {} : { verifiedDelivery: value.verifiedDelivery }) });
+}
+export function normalizeBrokerGrantProjection(value) {
+    const input = exactOptional(value, ['id', 'revision', 'grantDigest', 'owner', 'sessionId', 'destination', 'expiresAt', 'maxActions', 'maxTotalBytes', 'source', 'maxCostUnits', 'allowedOperations', 'allowedInspectKinds'], ['verifiedDelivery'], 'broker grant projection');
+    const rawDestination = grantDestination(input.destination, 'broker grant projection destination');
+    const normalizedDestination = destination({ classification: rawDestination.classification, repository: rawDestination.repository, branch: rawDestination.branch, ...(rawDestination.baseBranch === undefined ? {} : { baseBranch: rawDestination.baseBranch }) });
+    if (!Array.isArray(rawDestination.paths) || rawDestination.paths.length < 1 || rawDestination.paths.length > 128 || !rawDestination.paths.every(validPath) || new Set(rawDestination.paths).size !== rawDestination.paths.length)
+        reject('invalid-message', 'broker grant projection paths are invalid');
+    if (!Array.isArray(input.allowedOperations) || input.allowedOperations.length < 1 || input.allowedOperations.length > 3 || input.allowedOperations.some(value => !['commit', 'inspect', 'pull-request'].includes(String(value))) || new Set(input.allowedOperations).size !== input.allowedOperations.length)
+        reject('invalid-message', 'broker grant projection operations are invalid');
+    if (!Array.isArray(input.allowedInspectKinds) || input.allowedInspectKinds.length > 6 || input.allowedInspectKinds.some(value => !['repository', 'branch', 'file', 'pull-request', 'checks', 'reviews'].includes(String(value))) || new Set(input.allowedInspectKinds).size !== input.allowedInspectKinds.length
+        || input.allowedOperations.includes('inspect') !== (input.allowedInspectKinds.length > 0))
+        reject('invalid-message', 'broker grant projection inspect kinds are invalid');
+    if (input.allowedInspectKinds.some(kind => ['pull-request', 'checks', 'reviews'].includes(String(kind)))
+        && (normalizedDestination.baseBranch === undefined || normalizedDestination.baseBranch === normalizedDestination.branch))
+        reject('invalid-message', 'broker grant projection base branch is required for pull request inspection');
+    if (input.allowedOperations.includes('pull-request') && (normalizedDestination.baseBranch === undefined || normalizedDestination.baseBranch === normalizedDestination.branch))
+        reject('invalid-message', 'broker grant projection base branch is required for pull request delivery');
+    const verifiedDelivery = input.verifiedDelivery === undefined ? undefined : deliveryMetadata(input.verifiedDelivery, 'broker grant projection verified delivery');
+    if (verifiedDelivery !== undefined && !input.allowedOperations.includes('commit'))
+        reject('invalid-message', 'broker grant projection verified delivery requires commit authority');
+    const normalizedOwner = owner(input.owner);
+    if (!isAbsolute(normalizedOwner.workspace) || resolve(normalizedOwner.workspace) !== normalizedOwner.workspace || normalizedOwner.workspace === '/')
+        reject('invalid-message', 'broker grant projection workspace is invalid');
+    return Object.freeze({ id: text(input.id, 'broker grant projection id'), revision: integer(input.revision, 'broker grant projection revision', 1), grantDigest: digest(input.grantDigest, 'broker grant projection digest'), owner: normalizedOwner, sessionId: text(input.sessionId, 'broker grant projection sessionId'), destination: Object.freeze({ ...normalizedDestination, paths: Object.freeze([...rawDestination.paths]) }), expiresAt: integer(input.expiresAt, 'broker grant projection expiresAt', 1), maxActions: integer(input.maxActions, 'broker grant projection maxActions', 1, 10_000), maxTotalBytes: integer(input.maxTotalBytes, 'broker grant projection maxTotalBytes', 1, 64 * 1024 * 1024), source: dataSource(input.source), maxCostUnits: integer(input.maxCostUnits, 'broker grant projection maxCostUnits'), allowedOperations: Object.freeze([...input.allowedOperations]), allowedInspectKinds: Object.freeze([...input.allowedInspectKinds]), ...(verifiedDelivery === undefined ? {} : { verifiedDelivery }) });
+}
+function validPath(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 1024 && !/[\\\p{Cc}]/u.test(value)
+        && value.split('/').every(part => part !== '' && part !== '.' && part !== '..' && part.toLowerCase() !== '.git');
+}
+function deliveryMetadata(value, label) {
+    const input = exactOptional(value, ['ownerRouteId', 'budgetId'], ['acceptance'], label);
+    if (input.acceptance !== undefined && input.acceptance !== 'goal-outcome' && input.acceptance !== 'goal-step')
+        reject('invalid-message', `${label} acceptance is invalid`);
+    return Object.freeze(input.acceptance === undefined ? { ownerRouteId: text(input.ownerRouteId, `${label} owner route`, 200), budgetId: text(input.budgetId, `${label} budget`, 200) } : { ownerRouteId: text(input.ownerRouteId, `${label} owner route`, 200), budgetId: text(input.budgetId, `${label} budget`, 200), acceptance: input.acceptance });
+}
+function dataSource(value) {
+    const input = exact(value, ['classification', 'provenanceDigest'], 'request.source');
+    if (!['public', 'internal', 'confidential', 'restricted'].includes(String(input.classification)))
+        reject('invalid-message', 'request source classification is invalid');
+    return Object.freeze({ classification: input.classification, provenanceDigest: digest(input.provenanceDigest, 'request.source.provenanceDigest') });
+}
+function validBranch(value, label) {
+    const branch = text(value, label, 255);
+    if (!BRANCH.test(branch) || branch.includes('..') || branch.startsWith('refs/') || branch.split('/').some(part => !part || part.startsWith('.') || part.endsWith('.') || part.endsWith('.lock')))
+        reject('invalid-message', `${label} is invalid`);
+    return branch;
+}
+function grantDestination(value, label) {
+    const input = record(value, label);
+    if (Object.keys(input).some(key => !['classification', 'repository', 'branch', 'baseBranch', 'paths'].includes(key))
+        || !Object.hasOwn(input, 'classification') || !Object.hasOwn(input, 'repository') || !Object.hasOwn(input, 'branch') || !Object.hasOwn(input, 'paths'))
+        reject('unknown-field', `${label} has unknown or missing fields`);
+    return input;
+}
+function destination(value) {
+    const input = record(value, 'request.destination');
+    if (Object.keys(input).some(key => !['classification', 'repository', 'branch', 'baseBranch'].includes(key))
+        || !Object.hasOwn(input, 'classification') || !Object.hasOwn(input, 'repository') || !Object.hasOwn(input, 'branch'))
+        reject('unknown-field', 'request.destination has unknown or missing fields');
+    if (input.classification !== 'github-repository' || typeof input.repository !== 'string' || input.repository.length > 256 || !REPOSITORY.test(input.repository))
+        reject('invalid-message', 'request destination repository is invalid');
+    const branch = validBranch(input.branch, 'request.destination.branch');
+    const baseBranch = input.baseBranch === undefined ? undefined : validBranch(input.baseBranch, 'request.destination.baseBranch');
+    return Object.freeze(baseBranch === undefined ? { classification: 'github-repository', repository: input.repository, branch } : { classification: 'github-repository', repository: input.repository, branch, baseBranch });
+}
+function endpoint(value, kind, label) {
+    const input = exact(value, ['kind', 'instanceId', 'generation'], label);
+    if (input.kind !== kind)
+        reject('invalid-message', `${label}.kind is invalid`);
+    return Object.freeze({ kind, instanceId: instance(input.instanceId, `${label}.instanceId`), generation: integer(input.generation, `${label}.generation`, 1) });
+}
+function budget(value) {
+    const input = exact(value, ['reservationId', 'actions', 'bytes', 'costMetric', 'maxCostUnits'], 'request.budget');
+    if (input.costMetric !== 'github-api-units')
+        reject('invalid-message', 'request budget cost metric is invalid');
+    return Object.freeze({ reservationId: text(input.reservationId, 'request.budget.reservationId'), actions: integer(input.actions, 'request.budget.actions', 1), bytes: integer(input.bytes, 'request.budget.bytes', 0), costMetric: 'github-api-units', maxCostUnits: integer(input.maxCostUnits, 'request.budget.maxCostUnits') });
+}
+function owner(value) {
+    const input = exact(value, ['principalDigest', 'principalRecordId', 'principalVersion', 'workspace', 'preset', 'bindingId', 'bindingVersion', 'bindingGeneration'], 'request.owner');
+    const workspace = text(input.workspace, 'request.owner.workspace', 4096);
+    if (!isAbsolute(workspace) || resolve(workspace) !== workspace || workspace === '/')
+        reject('invalid-message', 'request owner workspace is invalid');
+    return Object.freeze({ principalDigest: digest(input.principalDigest, 'request.owner.principalDigest'), principalRecordId: text(input.principalRecordId, 'request.owner.principalRecordId'), principalVersion: integer(input.principalVersion, 'request.owner.principalVersion', 1), workspace, preset: text(input.preset, 'request.owner.preset'), bindingId: text(input.bindingId, 'request.owner.bindingId'), bindingVersion: integer(input.bindingVersion, 'request.owner.bindingVersion', 1), bindingGeneration: integer(input.bindingGeneration, 'request.owner.bindingGeneration', 1) });
+}
+function commitPayload(value) {
+    const input = exact(value, ['expectedHeadOid', 'headline', 'files'], 'commit payload');
+    if (!Array.isArray(input.files) || input.files.length < 1 || input.files.length > 32)
+        reject('invalid-message', 'commit payload files are invalid');
+    const files = Object.freeze(input.files.map((value, index) => {
+        const file = exact(value, ['path', 'content'], `commit payload file ${index}`);
+        if (!validPath(file.path) || typeof file.content !== 'string' || Buffer.byteLength(file.content) > 1_048_576 || Buffer.from(file.content, 'utf8').toString('utf8') !== file.content)
+            reject('invalid-message', 'commit payload file is invalid');
+        return Object.freeze({ path: file.path, content: file.content });
+    }));
+    if (new Set(files.map(file => file.path)).size !== files.length)
+        reject('invalid-message', 'commit payload paths are not unique');
+    return Object.freeze({ expectedHeadOid: oid(input.expectedHeadOid, 'commit payload expectedHeadOid'), headline: text(input.headline, 'commit payload headline', 200), files });
+}
+function pullRequestPayload(value) {
+    const input = exact(value, ['expectedHeadOid', 'title', 'body'], 'pull request payload');
+    if (typeof input.body !== 'string' || Buffer.byteLength(input.body) > 65_536 || Buffer.from(input.body, 'utf8').toString('utf8') !== input.body)
+        reject('invalid-message', 'pull request payload body is invalid');
+    return Object.freeze({ expectedHeadOid: oid(input.expectedHeadOid, 'pull request payload expectedHeadOid'), title: text(input.title, 'pull request payload title', 200), body: input.body });
+}
+function inspectPayload(value) {
+    const input = record(value, 'inspect payload');
+    const kind = input.kind;
+    if (!['repository', 'branch', 'file', 'pull-request', 'checks', 'reviews'].includes(String(kind)))
+        reject('invalid-message', 'inspect kind is invalid');
+    const expected = kind === 'file' ? ['kind', 'path'] : ['pull-request', 'checks', 'reviews'].includes(String(kind)) ? ['kind', 'pullRequestNumber'] : ['kind'];
+    exact(input, expected, 'inspect payload');
+    if (kind === 'file') {
+        if (!validPath(input.path))
+            reject('invalid-message', 'inspect path is invalid');
+        return Object.freeze({ kind, path: input.path });
+    }
+    if (expected.length === 2)
+        return Object.freeze({ kind, pullRequestNumber: integer(input.pullRequestNumber, 'inspect pullRequestNumber', 1) });
+    return Object.freeze({ kind });
+}
+function normalizePayload(operation, value) {
+    if (operation === 'commit')
+        return commitPayload(value);
+    if (operation === 'inspect')
+        return inspectPayload(value);
+    if (operation === 'pull-request')
+        return pullRequestPayload(value);
+    reject('invalid-message', 'request operation is invalid');
+}
+const REQUEST_UNSIGNED_KEYS = ['protocol', 'type', 'requestId', 'challenge', 'client', 'broker', 'actionId', 'grantId', 'grantRevision', 'grantDigest', 'owner', 'sessionId', 'agentId', 'rootCallId', 'callId', 'operation', 'source', 'destination', 'payload', 'payloadDigest', 'deadline', 'policyEpoch', 'emergencyEpoch', 'budget', 'clientKeyId'];
+function normalizeRequestUnsigned(value) {
+    const input = exact(value, REQUEST_UNSIGNED_KEYS, 'client request');
+    if (input.protocol !== GITHUB_BROKER_PROTOCOL || input.type !== 'client-request')
+        reject('wrong-protocol', 'client request protocol is invalid');
+    const operation = input.operation;
+    const payload = normalizePayload(operation, input.payload);
+    const normalizedDestination = destination(input.destination);
+    if ((operation === 'inspect' && ['pull-request', 'checks', 'reviews'].includes(payload.kind) || operation === 'pull-request')
+        && (normalizedDestination.baseBranch === undefined || normalizedDestination.baseBranch === normalizedDestination.branch))
+        reject('invalid-message', 'request base branch is required for pull request inspection');
+    const payloadDigest = digest(input.payloadDigest, 'request.payloadDigest');
+    if (brokerDigest(payload) !== payloadDigest)
+        reject('digest-mismatch', 'request payload digest does not match');
+    return Object.freeze({
+        protocol: GITHUB_BROKER_PROTOCOL, type: 'client-request', requestId: text(input.requestId, 'request.requestId'), challenge: base64url(input.challenge, 'request.challenge', 32),
+        client: endpoint(input.client, 'assistant-actions-host', 'request.client'), broker: endpoint(input.broker, 'github-broker', 'request.broker'),
+        actionId: text(input.actionId, 'request.actionId'), grantId: text(input.grantId, 'request.grantId'), grantRevision: integer(input.grantRevision, 'request.grantRevision', 1), grantDigest: digest(input.grantDigest, 'request.grantDigest'),
+        owner: owner(input.owner), sessionId: text(input.sessionId, 'request.sessionId'), agentId: text(input.agentId, 'request.agentId'), rootCallId: text(input.rootCallId, 'request.rootCallId'), callId: text(input.callId, 'request.callId'), operation: operation, source: dataSource(input.source), destination: normalizedDestination, payload, payloadDigest,
+        deadline: integer(input.deadline, 'request.deadline', 1), policyEpoch: integer(input.policyEpoch, 'request.policyEpoch'), emergencyEpoch: integer(input.emergencyEpoch, 'request.emergencyEpoch'), budget: budget(input.budget), clientKeyId: instance(input.clientKeyId, 'request.clientKeyId'),
+    });
+}
+export function createBrokerClientRequest(input, hello, source, clientKeyId, key, requestId = randomUUID()) {
+    const unsigned = normalizeRequestUnsigned({ protocol: GITHUB_BROKER_PROTOCOL, type: 'client-request', requestId, challenge: hello.challenge, client: source, broker: { kind: 'github-broker', instanceId: hello.instanceId, generation: hello.generation }, ...input, payloadDigest: brokerDigest(input.payload), policyEpoch: hello.policyEpoch, emergencyEpoch: hello.emergencyEpoch, clientKeyId });
+    return Object.freeze({ ...unsigned, signature: signatureFor(REQUEST_DOMAIN, unsigned, key) });
+}
+export function verifyBrokerClientRequest(value, hello, key, options = {}) {
+    const input = exact(value, [...REQUEST_UNSIGNED_KEYS, 'signature'], 'client request');
+    const { signature: rawSignature, ...rawUnsigned } = input;
+    const unsigned = normalizeRequestUnsigned(rawUnsigned);
+    const signature = base64url(rawSignature, 'request.signature', 64);
+    const now = options.now ?? Date.now();
+    if (hello.expiresAt <= now)
+        reject('expired-hello', 'server hello expired before client request verification');
+    if (unsigned.deadline <= now)
+        reject('expired-request', 'client request deadline expired');
+    if (unsigned.challenge !== hello.challenge || unsigned.broker.instanceId !== hello.instanceId || unsigned.broker.generation !== hello.generation
+        || unsigned.policyEpoch !== hello.policyEpoch || unsigned.emergencyEpoch !== hello.emergencyEpoch)
+        reject('challenge-mismatch', 'client request is not bound to this server hello');
+    if (options.expectedClientKeyId !== undefined && unsigned.clientKeyId !== options.expectedClientKeyId)
+        reject('client-identity-mismatch', 'client key identity does not match');
+    verifySignature(REQUEST_DOMAIN, unsigned, signature, key);
+    return Object.freeze({ ...unsigned, signature });
+}
+/** Stable action semantics used by the durable actionId idempotency ledger. */
+export function brokerRequestDigest(request) {
+    return brokerDigest({
+        protocol: 'assistant-actions/github-broker-intent/v1', actionId: request.actionId, grantId: request.grantId, grantRevision: request.grantRevision, grantDigest: request.grantDigest,
+        owner: request.owner, sessionId: request.sessionId, operation: request.operation, source: request.source, destination: request.destination,
+        payload: request.payload, payloadDigest: request.payloadDigest, budget: request.budget, clientKeyId: request.clientKeyId,
+    });
+}
+/** Per-connection digest used only to bind a response to its exact signed request. */
+export function brokerWireRequestDigest(request) {
+    const { signature: _signature, ...unsigned } = request;
+    return brokerDigest(unsigned);
+}
+function successResult(value, request) {
+    const input = record(value, 'response result');
+    if (request.operation === 'commit') {
+        const result = exact(input, ['operation', 'repository', 'branch', 'parentOid', 'commitOid'], 'commit response result');
+        if (result.operation !== 'commit' || result.repository !== request.destination.repository || result.branch !== request.destination.branch)
+            reject('response-mismatch', 'commit response target does not match');
+        const payload = request.payload;
+        if (result.parentOid !== payload.expectedHeadOid)
+            reject('response-mismatch', 'commit response parent does not match');
+        return Object.freeze({ operation: 'commit', repository: result.repository, branch: result.branch, parentOid: oid(result.parentOid, 'response.parentOid'), commitOid: oid(result.commitOid, 'response.commitOid') });
+    }
+    if (request.operation === 'pull-request') {
+        const result = exact(input, ['operation', 'repository', 'branch', 'baseBranch', 'expectedHeadOid', 'pullRequestNumber'], 'pull request response result');
+        if (result.operation !== 'pull-request' || result.repository !== request.destination.repository || result.branch !== request.destination.branch || result.baseBranch !== request.destination.baseBranch)
+            reject('response-mismatch', 'pull request response target does not match');
+        const payload = request.payload;
+        if (result.expectedHeadOid !== payload.expectedHeadOid)
+            reject('response-mismatch', 'pull request response expected head does not match');
+        return Object.freeze({ operation: 'pull-request', repository: result.repository, branch: result.branch, baseBranch: validBranch(result.baseBranch, 'response.baseBranch'), expectedHeadOid: oid(result.expectedHeadOid, 'response.expectedHeadOid'), pullRequestNumber: integer(result.pullRequestNumber, 'response.pullRequestNumber', 1) });
+    }
+    const result = exact(input, ['operation', 'repository', 'branch', 'kind', 'observed', 'observedDigest'], 'inspect response result');
+    const payload = request.payload;
+    if (result.operation !== 'inspect' || result.repository !== request.destination.repository || result.branch !== request.destination.branch || result.kind !== payload.kind)
+        reject('response-mismatch', 'inspect response target does not match');
+    const observed = normalizeBrokerInspectObservation(payload, result.observed, request.destination);
+    const observedCanonical = canonicalBrokerJson(observed);
+    if (containsCredentialShapedValue(result.observed))
+        reject('secret-field', 'credential-shaped response value is forbidden');
+    const observedDigest = digest(result.observedDigest, 'response.observedDigest');
+    if (createHash('sha256').update(observedCanonical).digest('hex') !== observedDigest)
+        reject('digest-mismatch', 'response observation digest does not match');
+    return Object.freeze({ operation: 'inspect', repository: result.repository, branch: result.branch, kind: result.kind, observed, observedDigest });
+}
+function containsCredentialShapedValue(value) {
+    if (typeof value === 'string')
+        return SENSITIVE_VALUE.test(value);
+    if (Array.isArray(value))
+        return value.some(containsCredentialShapedValue);
+    if (value !== null && typeof value === 'object')
+        return Object.values(value).some(containsCredentialShapedValue);
+    return false;
+}
+function exactOptional(value, required, optional, label) {
+    const input = record(value, label), keys = Object.keys(input);
+    if (keys.length < required.length || keys.length > required.length + optional.length || required.some(key => !Object.hasOwn(input, key)) || keys.some(key => !required.includes(key) && !optional.includes(key)))
+        reject('unknown-field', `${label} has unknown or missing fields`);
+    return input;
+}
+function truth(value, label) { if (value !== true)
+    reject('invalid-message', `${label} must be true`); return true; }
+function boolean(value, label) { if (typeof value !== 'boolean')
+    reject('invalid-message', `${label} must be boolean`); return value; }
+function pullRequestScope(value, destination, expectedNumber, topLevel = false) {
+    const input = exact(value, topLevel ? ['number', 'state', 'merged', 'head', 'base', 'untrusted'] : ['number', 'state', 'merged', 'head', 'base'], 'pull request observation');
+    const head = exact(input.head, ['ref', 'sha', 'repo'], 'pull request head'), headRepo = exact(head.repo, ['full_name'], 'pull request head repository');
+    const base = exact(input.base, ['ref', 'repo'], 'pull request base'), baseRepo = exact(base.repo, ['full_name'], 'pull request base repository');
+    const number = integer(input.number, 'pull request number', 1), state = input.state;
+    if (expectedNumber !== undefined && number !== expectedNumber || !['open', 'closed'].includes(String(state)) || head.ref !== destination.branch || headRepo.full_name !== destination.repository || baseRepo.full_name !== destination.repository || destination.baseBranch === undefined || base.ref !== destination.baseBranch || head.ref === base.ref)
+        reject('response-mismatch', 'pull request observation scope does not match');
+    const output = Object.freeze({ number, state: state, merged: boolean(input.merged, 'pull request merged'), head: Object.freeze({ ref: validBranch(head.ref, 'pull request head ref'), sha: oid(head.sha, 'pull request head sha'), repo: Object.freeze({ full_name: text(headRepo.full_name, 'pull request head repository', 256) }) }), base: Object.freeze({ ref: validBranch(base.ref, 'pull request base ref'), repo: Object.freeze({ full_name: text(baseRepo.full_name, 'pull request base repository', 256) }) }) });
+    return topLevel ? Object.freeze({ ...output, untrusted: truth(input.untrusted, 'pull request untrusted') }) : output;
+}
+export function normalizeBrokerInspectObservation(payload, value, destination) {
+    if (payload.kind === 'repository') {
+        const input = exact(value, ['full_name', 'untrusted'], 'repository observation');
+        if (input.full_name !== destination.repository)
+            reject('response-mismatch', 'repository observation does not match');
+        return Object.freeze({ full_name: text(input.full_name, 'repository full_name', 256), untrusted: truth(input.untrusted, 'repository untrusted') });
+    }
+    if (payload.kind === 'branch') {
+        const input = exact(value, ['name', 'commit', 'untrusted'], 'branch observation'), commit = exact(input.commit, ['sha'], 'branch commit');
+        if (input.name !== destination.branch)
+            reject('response-mismatch', 'branch observation does not match');
+        return Object.freeze({ name: text(input.name, 'branch name', 255), commit: Object.freeze({ sha: oid(commit.sha, 'branch commit sha') }), untrusted: truth(input.untrusted, 'branch untrusted') });
+    }
+    if (payload.kind === 'file') {
+        const input = exact(value, ['path', 'sha', 'content', 'untrusted'], 'file observation');
+        if (!validPath(input.path) || input.path !== payload.path || typeof input.content !== 'string' || Buffer.byteLength(input.content) > 65_536 || Buffer.from(input.content, 'utf8').toString('utf8') !== input.content)
+            reject('response-mismatch', 'file observation does not match');
+        return Object.freeze({ path: input.path, sha: oid(input.sha, 'file observation sha'), content: input.content, untrusted: truth(input.untrusted, 'file untrusted') });
+    }
+    if (payload.kind === 'pull-request')
+        return pullRequestScope(value, destination, payload.pullRequestNumber, true);
+    const input = exact(value, ['pullRequest', 'headOid', 'items', 'truncated', 'untrusted'], `${payload.kind} observation`);
+    const pullRequest = pullRequestScope(input.pullRequest, destination, payload.pullRequestNumber);
+    const headOid = oid(input.headOid, `${payload.kind} headOid`);
+    if (headOid !== pullRequest.head.sha || !Array.isArray(input.items))
+        reject('response-mismatch', `${payload.kind} observation head does not match`);
+    const truncated = boolean(input.truncated, `${payload.kind} truncated`), untrusted = truth(input.untrusted, `${payload.kind} untrusted`);
+    if (payload.kind === 'checks') {
+        if (input.items.length > 20)
+            reject('invalid-message', 'checks observation is too large');
+        const items = Object.freeze(input.items.map((value, index) => {
+            const item = exact(value, ['id', 'name', 'status', 'conclusion', 'head_sha', 'app'], `check ${index}`), app = exact(item.app, ['id'], `check ${index} app`);
+            if (!['queued', 'in_progress', 'completed', 'waiting', 'requested', 'pending'].includes(String(item.status)) || item.conclusion !== null && typeof item.conclusion !== 'string' || item.head_sha !== headOid)
+                reject('invalid-message', 'check observation is invalid');
+            return Object.freeze({ id: integer(item.id, 'check id', 1), name: text(item.name, 'check name'), status: item.status, conclusion: item.conclusion, head_sha: oid(item.head_sha, 'check head sha'), app: Object.freeze({ id: integer(app.id, 'check app id', 1) }) });
+        }));
+        return Object.freeze({ pullRequest, headOid, items, truncated, untrusted });
+    }
+    if (input.items.length > 30)
+        reject('invalid-message', 'reviews observation is too large');
+    const items = Object.freeze(input.items.map((value, index) => {
+        const item = exactOptional(value, ['id', 'state', 'commit_id', 'user'], ['submitted_at'], `review ${index}`), user = exact(item.user, ['id'], `review ${index} user`);
+        if (!['APPROVED', 'CHANGES_REQUESTED', 'COMMENTED', 'DISMISSED', 'PENDING'].includes(String(item.state)) || item.submitted_at !== undefined && (typeof item.submitted_at !== 'string' || Number.isNaN(Date.parse(item.submitted_at))))
+            reject('invalid-message', 'review observation is invalid');
+        return Object.freeze({ id: integer(item.id, 'review id', 1), state: item.state, commit_id: oid(item.commit_id, 'review commit id'), user: Object.freeze({ id: integer(user.id, 'review user id', 1) }), ...(item.submitted_at === undefined ? {} : { submitted_at: item.submitted_at }) });
+    }));
+    return Object.freeze({ pullRequest, headOid, items, truncated, untrusted });
+}
+const RESPONSE_UNSIGNED_KEYS = ['protocol', 'type', 'requestId', 'actionId', 'instanceId', 'generation', 'challenge', 'requestDigest', 'status', 'dispatched', 'result', 'error', 'completedAt'];
+function normalizeResponseUnsigned(value, request) {
+    const input = exact(value, RESPONSE_UNSIGNED_KEYS, 'server response');
+    if (input.protocol !== GITHUB_BROKER_PROTOCOL || input.type !== 'server-response' || !['succeeded', 'failed', 'unknown'].includes(String(input.status)) || typeof input.dispatched !== 'boolean')
+        reject('wrong-protocol', 'server response protocol is invalid');
+    const status = input.status;
+    let result = null, error = null;
+    if (status === 'succeeded') {
+        if (input.dispatched !== true || input.error !== null)
+            reject('invalid-message', 'successful response state is invalid');
+        result = successResult(input.result, request);
+    }
+    else {
+        if (input.result !== null)
+            reject('invalid-message', 'non-success response must not carry a result');
+        const rawError = exact(input.error, ['code'], 'response error');
+        const code = text(rawError.code, 'response.error.code');
+        if (!ERROR_CODE.test(code))
+            reject('invalid-message', 'response error code is invalid');
+        error = Object.freeze({ code });
+        if (status === 'unknown' && input.dispatched !== true)
+            reject('invalid-message', 'unknown response must be post-dispatch');
+    }
+    return Object.freeze({ protocol: GITHUB_BROKER_PROTOCOL, type: 'server-response', requestId: text(input.requestId, 'response.requestId'), actionId: text(input.actionId, 'response.actionId'), instanceId: instance(input.instanceId, 'response.instanceId'), generation: integer(input.generation, 'response.generation', 1), challenge: base64url(input.challenge, 'response.challenge', 32), requestDigest: digest(input.requestDigest, 'response.requestDigest'), status, dispatched: input.dispatched, result, error, completedAt: integer(input.completedAt, 'response.completedAt', 1) });
+}
+export function createBrokerServerResponse(input, request, hello, key) {
+    const unsigned = normalizeResponseUnsigned({ protocol: GITHUB_BROKER_PROTOCOL, type: 'server-response', requestId: request.requestId, actionId: request.actionId, instanceId: hello.instanceId, generation: hello.generation, challenge: hello.challenge, requestDigest: brokerWireRequestDigest(request), ...input }, request);
+    return Object.freeze({ ...unsigned, signature: signatureFor(RESPONSE_DOMAIN, unsigned, key) });
+}
+export function verifyBrokerServerResponse(value, request, hello, key) {
+    const input = exact(value, [...RESPONSE_UNSIGNED_KEYS, 'signature'], 'server response');
+    const { signature: rawSignature, ...rawUnsigned } = input;
+    const unsigned = normalizeResponseUnsigned(rawUnsigned, request);
+    const signature = base64url(rawSignature, 'response.signature', 64);
+    if (unsigned.requestId !== request.requestId || unsigned.actionId !== request.actionId || unsigned.instanceId !== hello.instanceId || unsigned.generation !== hello.generation || unsigned.challenge !== hello.challenge || unsigned.requestDigest !== brokerWireRequestDigest(request))
+        reject('response-mismatch', 'server response is not bound to this request');
+    verifySignature(RESPONSE_DOMAIN, unsigned, signature, key);
+    return Object.freeze({ ...unsigned, signature });
+}
+function adminEndpoint(value) {
+    const input = exact(value, ['kind', 'instanceId', 'generation'], 'admin request source');
+    if (input.kind !== 'assistant-actions-admin')
+        reject('invalid-message', 'admin request source kind is invalid');
+    return Object.freeze({ kind: 'assistant-actions-admin', instanceId: instance(input.instanceId, 'admin source instanceId'), generation: integer(input.generation, 'admin source generation', 1) });
+}
+function adminBody(operation, value) {
+    if (operation === 'status') {
+        exact(value, [], 'status body');
+        return Object.freeze({});
+    }
+    if (operation === 'stop') {
+        const input = exact(value, ['expectedControlVersion', 'drainDeadline', 'reason'], 'stop body');
+        if (!['operator-request', 'security-response', 'maintenance'].includes(String(input.reason)))
+            reject('invalid-message', 'stop reason is invalid');
+        return Object.freeze({ expectedControlVersion: integer(input.expectedControlVersion, 'stop expectedControlVersion'), drainDeadline: integer(input.drainDeadline, 'stop drainDeadline', 1), reason: input.reason });
+    }
+    if (operation === 'resume') {
+        const input = exact(value, ['expectedControlVersion', 'expectedGeneration'], 'resume body');
+        return Object.freeze({ expectedControlVersion: integer(input.expectedControlVersion, 'resume expectedControlVersion'), expectedGeneration: integer(input.expectedGeneration, 'resume expectedGeneration', 1) });
+    }
+    if (operation === 'revoke') {
+        const input = exact(value, ['expectedControlVersion', 'grantId', 'grantRevision', 'grantDigest', 'policyEpoch', 'emergencyEpoch', 'reason'], 'revoke body');
+        if (!['operator-request', 'security-response', 'grant-replaced', 'grant-expired'].includes(String(input.reason)))
+            reject('invalid-message', 'revoke reason is invalid');
+        return Object.freeze({ expectedControlVersion: integer(input.expectedControlVersion, 'revoke expectedControlVersion'), grantId: text(input.grantId, 'revoke grantId'), grantRevision: integer(input.grantRevision, 'revoke grantRevision', 1), grantDigest: digest(input.grantDigest, 'revoke grantDigest'), policyEpoch: integer(input.policyEpoch, 'revoke policyEpoch'), emergencyEpoch: integer(input.emergencyEpoch, 'revoke emergencyEpoch'), reason: input.reason });
+    }
+    reject('invalid-message', 'admin operation is invalid');
+}
+const ADMIN_REQUEST_UNSIGNED_KEYS = ['protocol', 'type', 'requestId', 'nonce', 'challenge', 'source', 'destination', 'operation', 'body', 'deadline', 'adminKeyId'];
+function normalizeAdminRequestUnsigned(value) {
+    const input = exact(value, ADMIN_REQUEST_UNSIGNED_KEYS, 'admin request');
+    if (input.protocol !== GITHUB_BROKER_PROTOCOL || input.type !== 'admin-request')
+        reject('wrong-protocol', 'admin request protocol is invalid');
+    const operation = input.operation;
+    if (!['status', 'stop', 'resume', 'revoke'].includes(String(operation)))
+        reject('invalid-message', 'admin operation is invalid');
+    return Object.freeze({ protocol: GITHUB_BROKER_PROTOCOL, type: 'admin-request', requestId: text(input.requestId, 'admin requestId'), nonce: base64url(input.nonce, 'admin nonce', 32), challenge: base64url(input.challenge, 'admin challenge', 32), source: adminEndpoint(input.source), destination: endpoint(input.destination, 'github-broker', 'admin destination'), operation: operation, body: adminBody(operation, input.body), deadline: integer(input.deadline, 'admin deadline', 1), adminKeyId: instance(input.adminKeyId, 'admin keyId') });
+}
+export function createBrokerAdminRequest(input, hello, source, adminKeyId, key, requestId = randomUUID(), nonce = randomBytes(32).toString('base64url')) {
+    const unsigned = normalizeAdminRequestUnsigned({ protocol: GITHUB_BROKER_PROTOCOL, type: 'admin-request', requestId, nonce, challenge: hello.challenge, source, destination: { kind: 'github-broker', instanceId: hello.instanceId, generation: hello.generation }, ...input, adminKeyId });
+    return Object.freeze({ ...unsigned, signature: signatureFor(ADMIN_REQUEST_DOMAIN, unsigned, key) });
+}
+export function verifyBrokerAdminRequest(value, hello, key, options = {}) {
+    const input = exact(value, [...ADMIN_REQUEST_UNSIGNED_KEYS, 'signature'], 'admin request');
+    const { signature: rawSignature, ...rawUnsigned } = input;
+    const unsigned = normalizeAdminRequestUnsigned(rawUnsigned), signature = base64url(rawSignature, 'admin signature', 64);
+    const now = options.now ?? Date.now();
+    if (hello.expiresAt <= now)
+        reject('expired-hello', 'server hello expired before admin request verification');
+    if (unsigned.deadline <= now)
+        reject('expired-request', 'admin request deadline expired');
+    if (unsigned.challenge !== hello.challenge || unsigned.destination.instanceId !== hello.instanceId || unsigned.destination.generation !== hello.generation)
+        reject('challenge-mismatch', 'admin request is not bound to this server hello');
+    if (options.expectedAdminKeyId !== undefined && unsigned.adminKeyId !== options.expectedAdminKeyId)
+        reject('client-identity-mismatch', 'admin key identity does not match');
+    verifySignature(ADMIN_REQUEST_DOMAIN, unsigned, signature, key);
+    return Object.freeze({ ...unsigned, signature });
+}
+export function brokerAdminRequestDigest(request) { const { signature: _signature, ...unsigned } = request; return brokerDigest(unsigned); }
+function adminState(value) {
+    const input = exact(value, ['admission', 'generation', 'controlVersion', 'activeRequests', 'revocationEpoch'], 'admin state');
+    if (!['accepting', 'draining', 'stopped'].includes(String(input.admission)))
+        reject('invalid-message', 'admin admission state is invalid');
+    return Object.freeze({ admission: input.admission, generation: integer(input.generation, 'admin state generation', 1), controlVersion: integer(input.controlVersion, 'admin state controlVersion'), activeRequests: integer(input.activeRequests, 'admin state activeRequests'), revocationEpoch: integer(input.revocationEpoch, 'admin state revocationEpoch') });
+}
+const ADMIN_RESPONSE_UNSIGNED_KEYS = ['protocol', 'type', 'requestId', 'instanceId', 'generation', 'challenge', 'requestDigest', 'status', 'state', 'error', 'completedAt'];
+function normalizeAdminResponseUnsigned(value) {
+    const input = exact(value, ADMIN_RESPONSE_UNSIGNED_KEYS, 'admin response');
+    if (input.protocol !== GITHUB_BROKER_PROTOCOL || input.type !== 'admin-response' || !['succeeded', 'failed'].includes(String(input.status)))
+        reject('wrong-protocol', 'admin response protocol is invalid');
+    let error = null;
+    if (input.status === 'succeeded') {
+        if (input.error !== null)
+            reject('invalid-message', 'successful admin response has an error');
+    }
+    else {
+        const value = exact(input.error, ['code'], 'admin response error');
+        const code = text(value.code, 'admin response error code');
+        if (!ERROR_CODE.test(code))
+            reject('invalid-message', 'admin response error code is invalid');
+        error = Object.freeze({ code });
+    }
+    return Object.freeze({ protocol: GITHUB_BROKER_PROTOCOL, type: 'admin-response', requestId: text(input.requestId, 'admin response requestId'), instanceId: instance(input.instanceId, 'admin response instanceId'), generation: integer(input.generation, 'admin response generation', 1), challenge: base64url(input.challenge, 'admin response challenge', 32), requestDigest: digest(input.requestDigest, 'admin response requestDigest'), status: input.status, state: adminState(input.state), error, completedAt: integer(input.completedAt, 'admin response completedAt', 1) });
+}
+export function createBrokerAdminResponse(input, request, hello, key) {
+    const unsigned = normalizeAdminResponseUnsigned({ protocol: GITHUB_BROKER_PROTOCOL, type: 'admin-response', requestId: request.requestId, instanceId: hello.instanceId, generation: hello.generation, challenge: hello.challenge, requestDigest: brokerAdminRequestDigest(request), ...input });
+    return Object.freeze({ ...unsigned, signature: signatureFor(ADMIN_RESPONSE_DOMAIN, unsigned, key) });
+}
+export function verifyBrokerAdminResponse(value, request, hello, key) {
+    const input = exact(value, [...ADMIN_RESPONSE_UNSIGNED_KEYS, 'signature'], 'admin response');
+    const { signature: rawSignature, ...rawUnsigned } = input;
+    const unsigned = normalizeAdminResponseUnsigned(rawUnsigned), signature = base64url(rawSignature, 'admin response signature', 64);
+    if (unsigned.requestId !== request.requestId || unsigned.instanceId !== hello.instanceId || unsigned.generation !== hello.generation || unsigned.challenge !== hello.challenge || unsigned.requestDigest !== brokerAdminRequestDigest(request))
+        reject('response-mismatch', 'admin response is not bound to this request');
+    if (unsigned.state.generation !== unsigned.generation)
+        reject('response-mismatch', 'admin state generation does not match the response');
+    verifySignature(ADMIN_RESPONSE_DOMAIN, unsigned, signature, key);
+    return Object.freeze({ ...unsigned, signature });
+}
+//# sourceMappingURL=broker-protocol.js.map