@embassys/ambassador 0.0.0 → 0.2.7

package/dist/central-credential.js

@@ -0,0 +1,355 @@
+import { createHash, createPrivateKey, createPublicKey, } from "node:crypto";
+import { TextDecoder } from "node:util";
+const ACCESS_TOKEN_MAX_BYTES = 4_096;
+const PRIVATE_KEY_MAX_CHARACTERS = 1_024;
+const CREDENTIAL_MAX_BYTES = 8_192;
+const BASE64URL = /^[A-Za-z0-9_-]+$/u;
+const ASCII_TOKEN = /^[\x21-\x7e]+$/u;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+const RECORD_KEYS = ["access_token", "credential_format", "dpop_private_key_pkcs8"];
+export class CentralCredentialError extends Error {
+    constructor() {
+        super("The central credential is invalid");
+        this.name = "CentralCredentialError";
+    }
+}
+function invalid() {
+    throw new CentralCredentialError();
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+class StrictJsonParser {
+    text;
+    #index = 0;
+    #members = 0;
+    constructor(text) {
+        this.text = text;
+    }
+    parse() {
+        const result = this.#value(0);
+        this.#whitespace();
+        if (this.#index !== this.text.length)
+            invalid();
+        return result;
+    }
+    #value(depth) {
+        if (depth > 16)
+            invalid();
+        this.#whitespace();
+        const character = this.text[this.#index];
+        if (character === "{")
+            return this.#object(depth + 1);
+        if (character === "[")
+            return this.#array(depth + 1);
+        if (character === '"')
+            return this.#string();
+        if (this.text.startsWith("true", this.#index)) {
+            this.#index += 4;
+            return true;
+        }
+        if (this.text.startsWith("false", this.#index)) {
+            this.#index += 5;
+            return false;
+        }
+        if (this.text.startsWith("null", this.#index)) {
+            this.#index += 4;
+            return null;
+        }
+        return this.#number();
+    }
+    #object(depth) {
+        this.#index += 1;
+        this.#whitespace();
+        const result = {};
+        const names = new Set();
+        if (this.text[this.#index] === "}") {
+            this.#index += 1;
+            return result;
+        }
+        while (true) {
+            if (this.text[this.#index] !== '"')
+                invalid();
+            const name = this.#string();
+            if (names.has(name))
+                invalid();
+            names.add(name);
+            this.#members += 1;
+            if (this.#members > 128)
+                invalid();
+            this.#whitespace();
+            if (this.text[this.#index] !== ":")
+                invalid();
+            this.#index += 1;
+            result[name] = this.#value(depth);
+            this.#whitespace();
+            const separator = this.text[this.#index];
+            if (separator === "}") {
+                this.#index += 1;
+                return result;
+            }
+            if (separator !== ",")
+                invalid();
+            this.#index += 1;
+            this.#whitespace();
+        }
+    }
+    #array(depth) {
+        this.#index += 1;
+        this.#whitespace();
+        const result = [];
+        if (this.text[this.#index] === "]") {
+            this.#index += 1;
+            return result;
+        }
+        while (true) {
+            result.push(this.#value(depth));
+            if (result.length > 128)
+                invalid();
+            this.#whitespace();
+            const separator = this.text[this.#index];
+            if (separator === "]") {
+                this.#index += 1;
+                return result;
+            }
+            if (separator !== ",")
+                invalid();
+            this.#index += 1;
+        }
+    }
+    #string() {
+        const start = this.#index;
+        this.#index += 1;
+        let escaped = false;
+        while (this.#index < this.text.length) {
+            const character = this.text[this.#index];
+            this.#index += 1;
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (character === "\\") {
+                escaped = true;
+                continue;
+            }
+            if (character === '"') {
+                let value;
+                try {
+                    value = JSON.parse(this.text.slice(start, this.#index));
+                }
+                catch {
+                    invalid();
+                }
+                if (typeof value !== "string" || hasLoneSurrogate(value))
+                    invalid();
+                return value;
+            }
+            if (character !== undefined && character.charCodeAt(0) < 0x20)
+                invalid();
+        }
+        return invalid();
+    }
+    #number() {
+        const match = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/uy;
+        match.lastIndex = this.#index;
+        const parsed = match.exec(this.text);
+        if (parsed === null)
+            invalid();
+        this.#index = match.lastIndex;
+        const value = Number(parsed[0]);
+        if (!Number.isFinite(value))
+            invalid();
+        return value;
+    }
+    #whitespace() {
+        while ([9, 10, 13, 32].includes(this.text.charCodeAt(this.#index)))
+            this.#index += 1;
+    }
+}
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (next < 0xdc00 || next > 0xdfff)
+                return true;
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            return true;
+    }
+    return false;
+}
+function strictJson(text) {
+    return new StrictJsonParser(text).parse();
+}
+function decodeBase64url(value, maximumCharacters) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        (maximumCharacters !== undefined && value.length > maximumCharacters) ||
+        !BASE64URL.test(value)) {
+        invalid();
+    }
+    const decoded = Buffer.from(value, "base64url");
+    if (decoded.toString("base64url") !== value)
+        invalid();
+    return decoded;
+}
+function decodeJwtObject(segment) {
+    const bytes = decodeBase64url(segment, 6_000);
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return invalid();
+    }
+    const value = strictJson(text);
+    if (!isRecord(value))
+        invalid();
+    return value;
+}
+export function exactCentralPublicJwk(value) {
+    if (!isRecord(value))
+        invalid();
+    const keys = Object.keys(value).sort();
+    if (keys.length !== 4 ||
+        !["crv", "kty", "x", "y"].every((name, index) => keys[index] === name) ||
+        value.kty !== "EC" ||
+        value.crv !== "P-256" ||
+        typeof value.x !== "string" ||
+        typeof value.y !== "string" ||
+        decodeBase64url(value.x).byteLength !== 32 ||
+        decodeBase64url(value.y).byteLength !== 32) {
+        invalid();
+    }
+    return { kty: "EC", crv: "P-256", x: value.x, y: value.y };
+}
+export function centralJwkThumbprint(jwk) {
+    const exact = exactCentralPublicJwk(jwk);
+    return createHash("sha256")
+        .update(JSON.stringify({ crv: exact.crv, kty: exact.kty, x: exact.x, y: exact.y }), "utf8")
+        .digest("base64url");
+}
+function importPrivateKey(value) {
+    const bytes = decodeBase64url(value, PRIVATE_KEY_MAX_CHARACTERS);
+    let privateKey;
+    try {
+        privateKey = createPrivateKey({ key: bytes, format: "der", type: "pkcs8" });
+    }
+    catch {
+        return invalid();
+    }
+    if (privateKey.asymmetricKeyType !== "ec" ||
+        privateKey.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        invalid();
+    }
+    return privateKey;
+}
+function publicJwkFromPrivateKey(privateKey) {
+    let exported;
+    try {
+        exported = createPublicKey(privateKey).export({ format: "jwk" });
+    }
+    catch {
+        return invalid();
+    }
+    return exactCentralPublicJwk(exported);
+}
+function parseToken(accessToken, keyThumbprint, nowSeconds) {
+    if (!ASCII_TOKEN.test(accessToken) ||
+        Buffer.byteLength(accessToken, "ascii") > ACCESS_TOKEN_MAX_BYTES) {
+        invalid();
+    }
+    const parts = accessToken.split(".");
+    if (parts.length !== 3 || parts.some((part) => part.length === 0))
+        invalid();
+    const header = decodeJwtObject(parts[0]);
+    if (header.alg !== "HS256" || (header.typ !== undefined && header.typ !== "JWT"))
+        invalid();
+    const payload = decodeJwtObject(parts[1]);
+    if (typeof payload.sub !== "string" ||
+        payload.sub.length < 1 ||
+        payload.sub.length > 256 ||
+        typeof payload.email !== "string" ||
+        !EMAIL.test(payload.email) ||
+        !Number.isSafeInteger(payload.iat) ||
+        !Number.isSafeInteger(payload.exp) ||
+        !isRecord(payload.cnf) ||
+        typeof payload.cnf.jkt !== "string" ||
+        !BASE64URL.test(payload.cnf.jkt) ||
+        payload.cnf.jkt !== keyThumbprint) {
+        invalid();
+    }
+    const issuedAt = payload.iat;
+    const expiresAt = payload.exp;
+    const now = Math.floor(nowSeconds());
+    if (!Number.isSafeInteger(now) ||
+        now < 0 ||
+        issuedAt < 0 ||
+        expiresAt <= issuedAt ||
+        expiresAt <= now) {
+        invalid();
+    }
+    return {
+        subject: payload.sub,
+        email: payload.email,
+        issuedAt,
+        expiresAt,
+        keyThumbprint,
+    };
+}
+function recordFromUnknown(value) {
+    if (!isRecord(value))
+        invalid();
+    const keys = Object.keys(value).sort();
+    if (keys.length !== RECORD_KEYS.length ||
+        !RECORD_KEYS.every((name, index) => keys[index] === name) ||
+        value.credential_format !== 1 ||
+        typeof value.access_token !== "string" ||
+        typeof value.dpop_private_key_pkcs8 !== "string") {
+        invalid();
+    }
+    return {
+        credential_format: 1,
+        access_token: value.access_token,
+        dpop_private_key_pkcs8: value.dpop_private_key_pkcs8,
+    };
+}
+export function serializeCentralCredential(record) {
+    const exact = recordFromUnknown(record);
+    const serialized = JSON.stringify(exact);
+    if (Buffer.byteLength(serialized, "utf8") > CREDENTIAL_MAX_BYTES)
+        invalid();
+    return serialized;
+}
+export function parseCentralCredential(value, nowSeconds = () => Date.now() / 1_000) {
+    let parsed = value;
+    if (typeof value === "string") {
+        if (Buffer.byteLength(value, "utf8") > CREDENTIAL_MAX_BYTES)
+            invalid();
+        parsed = strictJson(value);
+    }
+    const record = recordFromUnknown(parsed);
+    const privateKey = importPrivateKey(record.dpop_private_key_pkcs8);
+    const publicJwk = publicJwkFromPrivateKey(privateKey);
+    const keyThumbprint = centralJwkThumbprint(publicJwk);
+    const token = parseToken(record.access_token, keyThumbprint, nowSeconds);
+    const serialized = serializeCentralCredential(record);
+    return { record, serialized, privateKey, publicJwk, keyThumbprint, token };
+}
+export function createCentralCredentialRecord(accessToken, key) {
+    const record = {
+        credential_format: 1,
+        access_token: accessToken,
+        dpop_private_key_pkcs8: key.privateKeyPkcs8,
+    };
+    const loaded = parseCentralCredential(record, () => {
+        const payload = decodeJwtObject(accessToken.split(".")[1] ?? "");
+        return typeof payload.iat === "number" ? payload.iat : 0;
+    });
+    if (loaded.keyThumbprint !== key.thumbprint)
+        invalid();
+    return record;
+}
+//# sourceMappingURL=central-credential.js.map

package/dist/central-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"central-credential.js","sourceRoot":"","sources":["../src/central-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,GAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE,wBAAwB,CAAU,CAAC;AAuC7F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,SAAS,OAAO;IACd,MAAM,IAAI,sBAAsB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,gBAAgB;IAIS,IAAI;IAHjC,MAAM,GAAG,CAAC,CAAC;IACX,QAAQ,GAAG,CAAC,CAAC;IAEb,YAA6B,IAAY;oBAAZ,IAAI;IAAW,CAAC;IAE7C,KAAK;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1D,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;gBAAE,OAAO,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,KAAK,GAAG,wDAAwD,CAAC;QACvE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW;QACT,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACvF,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,iBAA0B;IACjE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,iBAAiB,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC;QACrE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QACtE,KAAK,CAAC,GAAG,KAAK,IAAI;QAClB,KAAK,CAAC,GAAG,KAAK,OAAO;QACrB,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ;QAC3B,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE;QAC1C,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EAC1C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAqB;IACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;SAC1F,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACjE,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,IACE,UAAU,CAAC,iBAAiB,KAAK,IAAI;QACrC,UAAU,CAAC,oBAAoB,EAAE,UAAU,KAAK,YAAY,EAC5D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAqB;IACpD,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CACjB,WAAmB,EACnB,aAAqB,EACrB,UAAwB;IAExB,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9B,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,sBAAsB,EAChE,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IACpD,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QACxB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ;QACnC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,aAAa,EACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAa,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAa,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACrC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;QAC1B,GAAG,GAAG,CAAC;QACP,QAAQ,GAAG,CAAC;QACZ,SAAS,IAAI,QAAQ;QACrB,SAAS,IAAI,GAAG,EAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ;QACR,SAAS;QACT,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAClC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QACzD,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,sBAAsB,KAAK,QAAQ,EAChD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAA+B;IACxE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB;QAAE,OAAO,EAAE,CAAC;IAC5E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAiD,EACjD,UAAU,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;IAEnD,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB;YAAE,OAAO,EAAE,CAAC;QACvE,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,GAAuB;IAEvB,MAAM,MAAM,GAA4B;QACtC,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,WAAW;QACzB,sBAAsB,EAAE,GAAG,CAAC,eAAe;KAC5C,CAAC;IACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/central-enrollment.d.ts

@@ -0,0 +1,31 @@
+import { type CentralCredentialRecord } from "./central-credential.js";
+import type { CentralToolDefinition } from "./mcp-contract.js";
+export type CentralEnrollmentErrorCode = "central_enrollment_contract_failed" | "central_enrollment_outcome_uncertain" | "central_rate_limited" | "central_verification_credential_invalid" | "central_verification_response_unsafe" | "registration_conflict" | "verification_failed";
+export declare class CentralEnrollmentError extends Error {
+    readonly code: CentralEnrollmentErrorCode;
+    constructor(code: CentralEnrollmentErrorCode);
+}
+export interface CentralEnrollmentClientOptions {
+    readonly centralOrigin: string;
+    readonly fetch?: typeof fetch;
+    readonly deadlineMs?: number;
+    readonly deadlineSignal?: (milliseconds: number) => AbortSignal;
+    readonly nowSeconds?: () => number;
+}
+export interface VerificationEnrollmentSuccess {
+    readonly credential: CentralCredentialRecord;
+    readonly localResult: {
+        readonly verified: true;
+        readonly agent_id: string;
+        readonly email: string;
+        readonly message: "Email verified successfully.";
+    };
+}
+export declare const REST_BOOTSTRAP_TOOLS: readonly CentralToolDefinition[];
+export declare class CentralEnrollmentClient {
+    #private;
+    constructor(options: CentralEnrollmentClientOptions);
+    register(arguments_: unknown, signal?: AbortSignal): Promise<Record<string, string>>;
+    resend(arguments_: unknown, signal?: AbortSignal): Promise<Record<string, string>>;
+    verify(arguments_: unknown, signal?: AbortSignal): Promise<VerificationEnrollmentSuccess>;
+}

package/dist/central-enrollment.js

@@ -0,0 +1,278 @@
+import { createCentralCredentialRecord, parseCentralCredential, } from "./central-credential.js";
+import { assertNoCentralCredentialFields, CentralJsonError, isCentralRecord, readCentralJson, } from "./central-json.js";
+import { generateDpopKeyMaterial } from "./dpop.js";
+const DEFAULT_DEADLINE_MS = 30_000;
+const RESPONSE_MAX_BYTES = 64 * 1024;
+const EMAIL = /^[\w.-]+@[\w.-]+\.\w+$/u;
+const CODE = /^\d{6}$/u;
+const AGENT_ID = /^[A-Za-z0-9._~-]{1,256}$/u;
+export class CentralEnrollmentError extends Error {
+    code;
+    constructor(code) {
+        super("Central enrollment failed");
+        this.code = code;
+        this.name = "CentralEnrollmentError";
+    }
+}
+function schema(properties, required) {
+    return { type: "object", properties, required: [...required], additionalProperties: false };
+}
+export const REST_BOOTSTRAP_TOOLS = [
+    {
+        name: "register_agent",
+        description: "Register an email identity with the central service.",
+        inputSchema: schema({
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            display_name: { type: "string", minLength: 1, maxLength: 128 },
+            delivery: {
+                oneOf: [
+                    {
+                        type: "object",
+                        properties: { mode: { const: "direct" } },
+                        required: ["mode"],
+                        additionalProperties: false,
+                    },
+                    {
+                        type: "object",
+                        properties: {
+                            mode: { const: "webhook" },
+                            url: { type: "string", minLength: 1, maxLength: 2_048 },
+                            secret_env: {
+                                type: "string",
+                                pattern: "^[A-Za-z_][A-Za-z0-9_]*$",
+                            },
+                        },
+                        required: ["mode", "url", "secret_env"],
+                        additionalProperties: false,
+                    },
+                ],
+            },
+        }, ["email"]),
+    },
+    {
+        name: "verify_email",
+        description: "Verify the six-digit code sent to the registered email.",
+        inputSchema: schema({
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            code: { type: "string", pattern: "^[0-9]{6}$" },
+        }, ["email", "code"]),
+    },
+    {
+        name: "resend_verification",
+        description: "Send a new verification code to an unverified email identity.",
+        inputSchema: schema({ email: { type: "string", minLength: 3, maxLength: 254 } }, ["email"]),
+    },
+];
+function failure(code) {
+    return new CentralEnrollmentError(code);
+}
+function exactOrigin(value) {
+    let origin;
+    try {
+        origin = new URL(value);
+    }
+    catch {
+        throw failure("central_enrollment_contract_failed");
+    }
+    const loopback = ["127.0.0.1", "::1", "localhost"].includes(origin.hostname);
+    if ((origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback)) ||
+        origin.username !== "" ||
+        origin.password !== "" ||
+        origin.pathname !== "/" ||
+        origin.search !== "" ||
+        origin.hash !== "") {
+        throw failure("central_enrollment_contract_failed");
+    }
+    return origin;
+}
+function exactKeys(value, required, optional = []) {
+    if (!isCentralRecord(value))
+        return false;
+    const allowed = new Set([...required, ...optional]);
+    return (required.every((name) => Object.hasOwn(value, name)) &&
+        Object.keys(value).every((name) => allowed.has(name)));
+}
+function email(value) {
+    if (typeof value !== "string" || value.length > 254 || !EMAIL.test(value)) {
+        throw failure("central_enrollment_contract_failed");
+    }
+    return value;
+}
+function safeString(value, maximum) {
+    if (typeof value !== "string" || value.length < 1 || value.length > maximum) {
+        throw failure("central_enrollment_contract_failed");
+    }
+    return value;
+}
+function noStore(headers) {
+    return (headers
+        .get("cache-control")
+        ?.split(",")
+        .some((directive) => directive.trim().toLowerCase() === "no-store") === true);
+}
+async function cancel(response) {
+    await response.body?.cancel().catch(() => undefined);
+}
+export class CentralEnrollmentClient {
+    #origin;
+    #fetch;
+    #deadlineMs;
+    #deadlineSignal;
+    #nowSeconds;
+    constructor(options) {
+        this.#origin = exactOrigin(options.centralOrigin);
+        this.#fetch = options.fetch ?? globalThis.fetch;
+        this.#deadlineMs = options.deadlineMs ?? DEFAULT_DEADLINE_MS;
+        this.#deadlineSignal = options.deadlineSignal ?? AbortSignal.timeout;
+        this.#nowSeconds = options.nowSeconds ?? (() => Date.now() / 1_000);
+        if (!Number.isSafeInteger(this.#deadlineMs) || this.#deadlineMs < 1) {
+            throw failure("central_enrollment_contract_failed");
+        }
+    }
+    async register(arguments_, signal) {
+        if (!exactKeys(arguments_, ["email"], ["display_name"])) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        const requestEmail = email(arguments_.email);
+        const displayName = arguments_.display_name === undefined ? undefined : safeString(arguments_.display_name, 128);
+        const response = await this.#post("/api/register_agent", { email: requestEmail, ...(displayName === undefined ? {} : { display_name: displayName }) }, signal);
+        if (response.status === 409) {
+            await cancel(response);
+            throw failure("registration_conflict");
+        }
+        const result = await this.#success(response);
+        if (!exactKeys(result, ["agent_id", "email", "message"]) ||
+            typeof result.agent_id !== "string" ||
+            !AGENT_ID.test(result.agent_id) ||
+            result.email !== requestEmail ||
+            typeof result.message !== "string" ||
+            result.message.length < 1 ||
+            result.message.length > 512) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        assertNoCentralCredentialFields(result);
+        return { agent_id: result.agent_id, email: requestEmail, message: result.message };
+    }
+    async resend(arguments_, signal) {
+        if (!exactKeys(arguments_, ["email"])) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        const response = await this.#post("/api/resend_verification", { email: email(arguments_.email) }, signal);
+        const result = await this.#success(response);
+        if (!exactKeys(result, ["message"]) ||
+            typeof result.message !== "string" ||
+            result.message.length < 1 ||
+            result.message.length > 512) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        assertNoCentralCredentialFields(result);
+        return { message: result.message };
+    }
+    async verify(arguments_, signal) {
+        if (!exactKeys(arguments_, ["email", "code"])) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        const requestEmail = email(arguments_.email);
+        if (typeof arguments_.code !== "string" || !CODE.test(arguments_.code)) {
+            throw failure("central_enrollment_contract_failed");
+        }
+        const key = generateDpopKeyMaterial();
+        const response = await this.#post("/api/verify_email", { email: requestEmail, code: arguments_.code, jwk: key.publicJwk }, signal);
+        if (response.status >= 400 && response.status < 500) {
+            await cancel(response);
+            throw failure(response.status === 429 ? "central_rate_limited" : "verification_failed");
+        }
+        if (!response.ok || !noStore(response.headers) || response.headers.has("set-cookie")) {
+            await cancel(response);
+            throw failure("central_verification_response_unsafe");
+        }
+        let result;
+        try {
+            result = await readCentralJson(response, RESPONSE_MAX_BYTES);
+        }
+        catch {
+            throw failure("central_verification_response_unsafe");
+        }
+        if (!exactKeys(result, ["agent_id", "email", "token", "message"], ["jkt"]) ||
+            typeof result.agent_id !== "string" ||
+            !AGENT_ID.test(result.agent_id) ||
+            result.email !== requestEmail ||
+            typeof result.token !== "string" ||
+            typeof result.message !== "string" ||
+            (result.jkt !== undefined && result.jkt !== key.thumbprint)) {
+            throw failure("central_verification_credential_invalid");
+        }
+        let credential;
+        try {
+            credential = createCentralCredentialRecord(result.token, key);
+            const loaded = parseCentralCredential(credential, this.#nowSeconds);
+            if (loaded.token.subject !== result.agent_id ||
+                loaded.token.email !== requestEmail ||
+                loaded.keyThumbprint !== key.thumbprint) {
+                throw new Error("binding mismatch");
+            }
+            assertNoCentralCredentialFields({
+                agent_id: result.agent_id,
+                email: result.email,
+                message: result.message,
+            });
+        }
+        catch {
+            throw failure("central_verification_credential_invalid");
+        }
+        return {
+            credential,
+            localResult: {
+                verified: true,
+                agent_id: result.agent_id,
+                email: requestEmail,
+                message: "Email verified successfully.",
+            },
+        };
+    }
+    async #post(path, body, signal) {
+        let deadline;
+        try {
+            deadline = this.#deadlineSignal(this.#deadlineMs);
+        }
+        catch {
+            throw failure("central_enrollment_contract_failed");
+        }
+        const requestSignal = signal === undefined ? deadline : AbortSignal.any([signal, deadline]);
+        try {
+            return await this.#fetch(new URL(path, this.#origin), {
+                method: "POST",
+                headers: { "accept-encoding": "identity", "content-type": "application/json" },
+                body: JSON.stringify(body),
+                credentials: "omit",
+                redirect: "manual",
+                signal: requestSignal,
+            });
+        }
+        catch {
+            throw failure("central_enrollment_outcome_uncertain");
+        }
+    }
+    async #success(response) {
+        if (response.status === 429) {
+            await cancel(response);
+            throw failure("central_rate_limited");
+        }
+        if (!response.ok ||
+            response.status < 200 ||
+            response.status >= 300 ||
+            response.headers.has("set-cookie")) {
+            await cancel(response);
+            throw failure("central_enrollment_contract_failed");
+        }
+        try {
+            return await readCentralJson(response, RESPONSE_MAX_BYTES);
+        }
+        catch (error) {
+            if (error instanceof CentralJsonError)
+                throw failure("central_enrollment_contract_failed");
+            throw failure("central_enrollment_contract_failed");
+        }
+    }
+}
+//# sourceMappingURL=central-enrollment.js.map