@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/async-work/workflow.js

@@ -0,0 +1,225 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { asyncWorkDigest, asyncWorkIdentity, canonicalAsyncJson, compareAsyncStrings, failAsyncWork, requireAsyncIdentifier, requireAsyncInteger, requireAsyncNumber, requireCanonicalAsyncTimestamp, } from './contract.js';
+export const ASYNC_WORKFLOW_DEFINITION_VERSION = 1;
+export const ASYNC_WORKFLOW_CALLBACK_VERSION = 1;
+export function createWorkflowDefinition(input) {
+    if (!Array.isArray(input.steps) ||
+        input.steps.length === 0 ||
+        input.steps.length > 1000) {
+        failAsyncWork('async-input-invalid', '/steps', 'must contain from one through 1000 workflow steps');
+    }
+    const identifiers = new Set();
+    const steps = input.steps.map((step, index) => {
+        const stepId = requireAsyncIdentifier(step.stepId, `/steps/${index}/stepId`);
+        if (identifiers.has(stepId)) {
+            failAsyncWork('async-input-invalid', `/steps/${index}/stepId`, 'must be unique');
+        }
+        identifiers.add(stepId);
+        return Object.assign(Object.assign({}, (step.compensationStepId
+            ? {
+                compensationStepId: requireAsyncIdentifier(step.compensationStepId, `/steps/${index}/compensationStepId`),
+            }
+            : {})), { estimatedCostUsd: requireAsyncNumber(step.estimatedCostUsd, `/steps/${index}/estimatedCostUsd`, 0, 1000000), maximumAttempts: requireAsyncInteger(step.maximumAttempts, `/steps/${index}/maximumAttempts`, 1, 100), stepId, timeoutSeconds: requireAsyncInteger(step.timeoutSeconds, `/steps/${index}/timeoutSeconds`, 1, 31536000) });
+    });
+    for (const [index, step] of steps.entries()) {
+        if (step.compensationStepId !== undefined &&
+            (step.compensationStepId === step.stepId ||
+                !identifiers.has(step.compensationStepId))) {
+            failAsyncWork('async-input-invalid', `/steps/${index}/compensationStepId`, 'must name a different declared workflow step');
+        }
+    }
+    return {
+        dataClassification: requireAsyncIdentifier(input.dataClassification, '/dataClassification'),
+        estimatedFailureCostUsd: requireAsyncNumber(input.estimatedFailureCostUsd, '/estimatedFailureCostUsd', 0, 10000000),
+        estimatedNormalCostUsd: requireAsyncNumber(input.estimatedNormalCostUsd, '/estimatedNormalCostUsd', 0, 10000000),
+        inputContract: requireAsyncIdentifier(input.inputContract, '/inputContract'),
+        retentionDays: requireAsyncInteger(input.retentionDays, '/retentionDays', 1, 3650),
+        steps,
+        version: ASYNC_WORKFLOW_DEFINITION_VERSION,
+        workflow: requireAsyncIdentifier(input.workflow, '/workflow'),
+        workflowVersion: requireAsyncInteger(input.workflowVersion, '/workflowVersion', 1, Number.MAX_SAFE_INTEGER),
+    };
+}
+/**
+ * In-flight executions always resolve their recorded workflow version. A new
+ * deployment cannot silently reinterpret old state using the newest handler.
+ */
+export function selectWorkflowVersion(input) {
+    const workflow = requireAsyncIdentifier(input.execution.workflow, '/execution/workflow');
+    const workflowVersion = requireAsyncInteger(input.execution.workflowVersion, '/execution/workflowVersion', 1, Number.MAX_SAFE_INTEGER);
+    if (!Array.isArray(input.definitions) || input.definitions.length > 100) {
+        failAsyncWork('async-input-invalid', '/definitions', 'must contain at most 100 workflow versions');
+    }
+    const matches = input.definitions.filter((definition) => definition.workflow === workflow &&
+        definition.workflowVersion === workflowVersion);
+    if (matches.length !== 1) {
+        failAsyncWork('async-workflow-version-unsupported', '/execution/workflowVersion', matches.length === 0
+            ? 'has no exact deployed definition'
+            : 'has multiple deployed definitions');
+    }
+    return createWorkflowDefinition(matches[0]);
+}
+function callbackSignature(encodedClaims, secret) {
+    return createHmac('sha256', secret).update(encodedClaims, 'utf8').digest();
+}
+function requireCallbackSecret(value, pointer) {
+    const length = typeof value === 'string'
+        ? Buffer.byteLength(value, 'utf8')
+        : value instanceof Uint8Array
+            ? value.byteLength
+            : 0;
+    if (length < 16 || length > 4096) {
+        failAsyncWork('async-input-invalid', pointer, 'must contain from 16 through 4096 secret bytes');
+    }
+    return value;
+}
+export function createWorkflowCallbackToken(input) {
+    const claims = {
+        callbackId: requireAsyncIdentifier(input.claims.callbackId, '/claims/callbackId'),
+        executionId: requireAsyncIdentifier(input.claims.executionId, '/claims/executionId'),
+        expiresAt: requireCanonicalAsyncTimestamp(input.claims.expiresAt, '/claims/expiresAt'),
+        nonce: requireAsyncIdentifier(input.claims.nonce, '/claims/nonce'),
+        version: ASYNC_WORKFLOW_CALLBACK_VERSION,
+        workflow: requireAsyncIdentifier(input.claims.workflow, '/claims/workflow'),
+        workflowVersion: requireAsyncInteger(input.claims.workflowVersion, '/claims/workflowVersion', 1, Number.MAX_SAFE_INTEGER),
+    };
+    const encodedClaims = Buffer.from(canonicalAsyncJson(claims), 'utf8').toString('base64url');
+    const secret = requireCallbackSecret(input.secret, '/secret');
+    return `${encodedClaims}.${callbackSignature(encodedClaims, secret).toString('base64url')}`;
+}
+export function verifyWorkflowCallbackToken(input) {
+    const now = requireCanonicalAsyncTimestamp(input.now, '/now');
+    if (typeof input.token !== 'string' ||
+        input.token.length === 0 ||
+        input.token.length > 4096 ||
+        !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.token)) {
+        failAsyncWork('async-workflow-callback-invalid', '/token', 'must be a bounded signed callback capability');
+    }
+    const [encodedClaims, encodedSignature] = input.token.split('.');
+    let signature;
+    let rawClaims;
+    try {
+        signature = Buffer.from(encodedSignature, 'base64url');
+        rawClaims = JSON.parse(Buffer.from(encodedClaims, 'base64url').toString('utf8'));
+    }
+    catch (_a) {
+        failAsyncWork('async-workflow-callback-invalid', '/token', 'contains malformed claims or signature');
+    }
+    const secret = requireCallbackSecret(input.secret, '/secret');
+    const expectedSignature = callbackSignature(encodedClaims, secret);
+    if (signature.length !== expectedSignature.length ||
+        !timingSafeEqual(signature, expectedSignature)) {
+        failAsyncWork('async-workflow-callback-invalid', '/token', 'signature is invalid');
+    }
+    if (!rawClaims || typeof rawClaims !== 'object' || Array.isArray(rawClaims)) {
+        failAsyncWork('async-workflow-callback-invalid', '/token/claims', 'must be an object');
+    }
+    const value = rawClaims;
+    if (value.version !== ASYNC_WORKFLOW_CALLBACK_VERSION) {
+        failAsyncWork('async-workflow-callback-invalid', '/token/claims/version', 'must be one');
+    }
+    const claims = {
+        callbackId: requireAsyncIdentifier(value.callbackId, '/token/claims/callbackId'),
+        executionId: requireAsyncIdentifier(value.executionId, '/token/claims/executionId'),
+        expiresAt: requireCanonicalAsyncTimestamp(value.expiresAt, '/token/claims/expiresAt'),
+        nonce: requireAsyncIdentifier(value.nonce, '/token/claims/nonce'),
+        version: ASYNC_WORKFLOW_CALLBACK_VERSION,
+        workflow: requireAsyncIdentifier(value.workflow, '/token/claims/workflow'),
+        workflowVersion: requireAsyncInteger(value.workflowVersion, '/token/claims/workflowVersion', 1, Number.MAX_SAFE_INTEGER),
+    };
+    if (canonicalAsyncJson(rawClaims) !== canonicalAsyncJson(claims)) {
+        failAsyncWork('async-workflow-callback-invalid', '/token/claims', 'contains unsupported or non-canonical claims');
+    }
+    const expected = {
+        callbackId: requireAsyncIdentifier(input.expected.callbackId, '/expected/callbackId'),
+        executionId: requireAsyncIdentifier(input.expected.executionId, '/expected/executionId'),
+        workflow: requireAsyncIdentifier(input.expected.workflow, '/expected/workflow'),
+        workflowVersion: requireAsyncInteger(input.expected.workflowVersion, '/expected/workflowVersion', 1, Number.MAX_SAFE_INTEGER),
+    };
+    if (claims.callbackId !== expected.callbackId ||
+        claims.executionId !== expected.executionId ||
+        claims.workflow !== expected.workflow ||
+        claims.workflowVersion !== expected.workflowVersion) {
+        failAsyncWork('async-workflow-callback-invalid', '/token/claims', 'does not bind the expected workflow execution and callback');
+    }
+    if (Date.parse(now) >= Date.parse(claims.expiresAt)) {
+        failAsyncWork('async-workflow-callback-invalid', '/token/claims/expiresAt', 'callback capability expired');
+    }
+    const tokenDigest = asyncWorkDigest(input.token);
+    return {
+        callbackClaimKey: asyncWorkIdentity('workflow-callback-claim-v1', [
+            claims.executionId,
+            claims.callbackId,
+            claims.nonce,
+        ]),
+        claims,
+        tokenDigest,
+    };
+}
+export function requestWorkflowCancellation(input) {
+    if (!['running', 'waiting', 'cancellation-requested'].includes(input.status)) {
+        failAsyncWork('async-input-invalid', '/status', 'only a running or waiting workflow can request cancellation');
+    }
+    return {
+        actor: requireAsyncIdentifier(input.actor, '/actor'),
+        executionId: requireAsyncIdentifier(input.executionId, '/executionId'),
+        reason: requireAsyncIdentifier(input.reason, '/reason'),
+        requestedAt: requireCanonicalAsyncTimestamp(input.requestedAt, '/requestedAt'),
+        status: 'cancellation-requested',
+        workflow: requireAsyncIdentifier(input.workflow, '/workflow'),
+    };
+}
+export function createCompensationPlan(input) {
+    const definition = createWorkflowDefinition(input.definition);
+    const executionId = requireAsyncIdentifier(input.executionId, '/executionId');
+    const authorizationId = requireAsyncIdentifier(input.authorizationId, '/authorizationId');
+    const reason = requireAsyncIdentifier(input.reason, '/reason');
+    if (!Array.isArray(input.completedStepIds) ||
+        input.completedStepIds.length > definition.steps.length) {
+        failAsyncWork('async-input-invalid', '/completedStepIds', 'cannot exceed the declared workflow steps');
+    }
+    const stepsById = new Map(definition.steps.map((step) => [step.stepId, step]));
+    const completed = input.completedStepIds.map((stepId, index) => {
+        const normalized = requireAsyncIdentifier(stepId, `/completedStepIds/${index}`);
+        if (!stepsById.has(normalized)) {
+            failAsyncWork('async-input-invalid', `/completedStepIds/${index}`, 'must name a declared workflow step');
+        }
+        return normalized;
+    });
+    if (new Set(completed).size !== completed.length) {
+        failAsyncWork('async-input-invalid', '/completedStepIds', 'must not contain duplicates');
+    }
+    const actions = [...completed]
+        .reverse()
+        .flatMap((stepId) => {
+        var _a;
+        const compensationStepId = (_a = stepsById.get(stepId)) === null || _a === void 0 ? void 0 : _a.compensationStepId;
+        if (!compensationStepId)
+            return [];
+        return [
+            {
+                compensationStepId,
+                idempotencyKey: asyncWorkIdentity('workflow-compensation-v1', [
+                    executionId,
+                    stepId,
+                    compensationStepId,
+                ]),
+                originalStepId: stepId,
+            },
+        ];
+    });
+    const material = {
+        actions,
+        authorizationId,
+        executionId,
+        reason,
+        workflow: definition.workflow,
+        workflowVersion: definition.workflowVersion,
+    };
+    return Object.assign(Object.assign({}, material), { planDigest: asyncWorkDigest(material) });
+}
+export function workflowDefinitionDigest(definition) {
+    const normalized = createWorkflowDefinition(definition);
+    return asyncWorkDigest(Object.assign(Object.assign({}, normalized), { steps: [...normalized.steps].sort((left, right) => compareAsyncStrings(left.stepId, right.stepId)) }));
+}
+//# sourceMappingURL=workflow.js.map

package/src/async-work/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/async-work/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAU,CAAC;AAC5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAU,CAAC;AAsB1D,MAAM,UAAU,wBAAwB,CACtC,KAA4C;IAE5C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAK,EAC1B,CAAC;QACD,aAAa,CACX,qBAAqB,EACrB,QAAQ,EACR,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAkB,EAAE;QAC5D,MAAM,MAAM,GAAG,sBAAsB,CACnC,IAAI,CAAC,MAAM,EACX,UAAU,KAAK,SAAS,CACzB,CAAC;QACF,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,aAAa,CACX,qBAAqB,EACrB,UAAU,KAAK,SAAS,EACxB,gBAAgB,CACjB,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,uCACK,CAAC,IAAI,CAAC,kBAAkB;YACzB,CAAC,CAAC;gBACE,kBAAkB,EAAE,sBAAsB,CACxC,IAAI,CAAC,kBAAkB,EACvB,UAAU,KAAK,qBAAqB,CACrC;aACF;YACH,CAAC,CAAC,EAAE,CAAC,KACP,gBAAgB,EAAE,kBAAkB,CAClC,IAAI,CAAC,gBAAgB,EACrB,UAAU,KAAK,mBAAmB,EAClC,CAAC,EACD,OAAS,CACV,EACD,eAAe,EAAE,mBAAmB,CAClC,IAAI,CAAC,eAAe,EACpB,UAAU,KAAK,kBAAkB,EACjC,CAAC,EACD,GAAG,CACJ,EACD,MAAM,EACN,cAAc,EAAE,mBAAmB,CACjC,IAAI,CAAC,cAAc,EACnB,UAAU,KAAK,iBAAiB,EAChC,CAAC,EACD,QAAU,CACX,IACD;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IACE,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACrC,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,MAAM;gBACtC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAC5C,CAAC;YACD,aAAa,CACX,qBAAqB,EACrB,UAAU,KAAK,qBAAqB,EACpC,8CAA8C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,sBAAsB,CACxC,KAAK,CAAC,kBAAkB,EACxB,qBAAqB,CACtB;QACD,uBAAuB,EAAE,kBAAkB,CACzC,KAAK,CAAC,uBAAuB,EAC7B,0BAA0B,EAC1B,CAAC,EACD,QAAU,CACX;QACD,sBAAsB,EAAE,kBAAkB,CACxC,KAAK,CAAC,sBAAsB,EAC5B,yBAAyB,EACzB,CAAC,EACD,QAAU,CACX;QACD,aAAa,EAAE,sBAAsB,CACnC,KAAK,CAAC,aAAa,EACnB,gBAAgB,CACjB;QACD,aAAa,EAAE,mBAAmB,CAChC,KAAK,CAAC,aAAa,EACnB,gBAAgB,EAChB,CAAC,EACD,IAAI,CACL;QACD,KAAK;QACL,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC7D,eAAe,EAAE,mBAAmB,CAClC,KAAK,CAAC,eAAe,EACrB,kBAAkB,EAClB,CAAC,EACD,MAAM,CAAC,gBAAgB,CACxB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,qBAAqB,CACtB,CAAC;IACF,MAAM,eAAe,GAAG,mBAAmB,CACzC,KAAK,CAAC,SAAS,CAAC,eAAe,EAC/B,4BAA4B,EAC5B,CAAC,EACD,MAAM,CAAC,gBAAgB,CACxB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxE,aAAa,CACX,qBAAqB,EACrB,cAAc,EACd,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CACtC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAChC,UAAU,CAAC,eAAe,KAAK,eAAe,CACjD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,aAAa,CACX,oCAAoC,EACpC,4BAA4B,EAC5B,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,mCAAmC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAYD,SAAS,iBAAiB,CACxB,aAAqB,EACrB,MAA2B;IAE3B,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA0B,EAC1B,OAAe;IAEf,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;QAClC,CAAC,CAAC,KAAK,YAAY,UAAU;YAC3B,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,IAAK,EAAE,CAAC;QAClC,aAAa,CACX,qBAAqB,EACrB,OAAO,EACP,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG3C;IACC,MAAM,MAAM,GAA6B;QACvC,UAAU,EAAE,sBAAsB,CAChC,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,oBAAoB,CACrB;QACD,WAAW,EAAE,sBAAsB,CACjC,KAAK,CAAC,MAAM,CAAC,WAAW,EACxB,qBAAqB,CACtB;QACD,SAAS,EAAE,8BAA8B,CACvC,KAAK,CAAC,MAAM,CAAC,SAAS,EACtB,mBAAmB,CACpB;QACD,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC3E,eAAe,EAAE,mBAAmB,CAClC,KAAK,CAAC,MAAM,CAAC,eAAe,EAC5B,yBAAyB,EACzB,CAAC,EACD,MAAM,CAAC,gBAAgB,CACxB;KACF,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,kBAAkB,CAAC,MAAM,CAAC,EAC1B,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9D,OAAO,GAAG,aAAa,IAAI,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC1E,WAAW,CACZ,EAAE,CAAC;AACN,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAU3C;IAKC,MAAM,GAAG,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,IACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAK;QAC1B,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACrD,CAAC;QACD,aAAa,CACX,iCAAiC,EACjC,QAAQ,EACR,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACvD,SAAS,GAAG,IAAI,CAAC,KAAK,CACpB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACzD,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,aAAa,CACX,iCAAiC,EACjC,QAAQ,EACR,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,IACE,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;QAC7C,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAC9C,CAAC;QACD,aAAa,CACX,iCAAiC,EACjC,QAAQ,EACR,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,aAAa,CACX,iCAAiC,EACjC,eAAe,EACf,mBAAmB,CACpB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,SAA8C,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B,EAAE,CAAC;QACtD,aAAa,CACX,iCAAiC,EACjC,uBAAuB,EACvB,aAAa,CACd,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA6B;QACvC,UAAU,EAAE,sBAAsB,CAChC,KAAK,CAAC,UAAU,EAChB,0BAA0B,CAC3B;QACD,WAAW,EAAE,sBAAsB,CACjC,KAAK,CAAC,WAAW,EACjB,2BAA2B,CAC5B;QACD,SAAS,EAAE,8BAA8B,CACvC,KAAK,CAAC,SAAS,EACf,yBAAyB,CAC1B;QACD,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACjE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC;QAC1E,eAAe,EAAE,mBAAmB,CAClC,KAAK,CAAC,eAAe,EACrB,+BAA+B,EAC/B,CAAC,EACD,MAAM,CAAC,gBAAgB,CACxB;KACF,CAAC;IACF,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,aAAa,CACX,iCAAiC,EACjC,eAAe,EACf,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,sBAAsB,CAChC,KAAK,CAAC,QAAQ,CAAC,UAAU,EACzB,sBAAsB,CACvB;QACD,WAAW,EAAE,sBAAsB,CACjC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAC1B,uBAAuB,CACxB;QACD,QAAQ,EAAE,sBAAsB,CAC9B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EACvB,oBAAoB,CACrB;QACD,eAAe,EAAE,mBAAmB,CAClC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAC9B,2BAA2B,EAC3B,CAAC,EACD,MAAM,CAAC,gBAAgB,CACxB;KACF,CAAC;IACF,IACE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe,EACnD,CAAC;QACD,aAAa,CACX,iCAAiC,EACjC,eAAe,EACf,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,aAAa,CACX,iCAAiC,EACjC,yBAAyB,EACzB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO;QACL,gBAAgB,EAAE,iBAAiB,CAAC,4BAA4B,EAAE;YAChE,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,KAAK;SACb,CAAC;QACF,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC;AAmBD,MAAM,UAAU,2BAA2B,CAAC,KAO3C;IACC,IACE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EACxE,CAAC;QACD,aAAa,CACX,qBAAqB,EACrB,SAAS,EACT,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,WAAW,EAAE,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC;QACtE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;QACvD,WAAW,EAAE,8BAA8B,CACzC,KAAK,CAAC,WAAW,EACjB,cAAc,CACf;QACD,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC9D,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,sBAAsB,CAAC,KAMtC;IASC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,sBAAsB,CAC5C,KAAK,CAAC,eAAe,EACrB,kBAAkB,CACnB,CAAC;IACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EACvD,CAAC;QACD,aAAa,CACX,qBAAqB,EACrB,mBAAmB,EACnB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAU,CAAC,CAC7D,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,UAAU,GAAG,sBAAsB,CACvC,MAAM,EACN,qBAAqB,KAAK,EAAE,CAC7B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,aAAa,CACX,qBAAqB,EACrB,qBAAqB,KAAK,EAAE,EAC5B,oCAAoC,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACjD,aAAa,CACX,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;SAC3B,OAAO,EAAE;SACT,OAAO,CAAC,CAAC,MAAM,EAAkC,EAAE;;QAClD,MAAM,kBAAkB,GAAG,MAAA,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,kBAAkB,CAAC;QACrE,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO;YACL;gBACE,kBAAkB;gBAClB,cAAc,EAAE,iBAAiB,CAAC,0BAA0B,EAAE;oBAC5D,WAAW;oBACX,MAAM;oBACN,kBAAkB;iBACnB,CAAC;gBACF,cAAc,EAAE,MAAM;aACvB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAG;QACf,OAAO;QACP,eAAe;QACf,WAAW;QACX,MAAM;QACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC;IACF,uCACK,QAAQ,KACX,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,IACrC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAgC;IAEhC,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,eAAe,iCACjB,UAAU,KACb,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChD,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAC/C,IACD,CAAC;AACL,CAAC"}

package/src/auth-backend.d.ts

@@ -1,5 +1,6 @@
 import { BetterAuthConfig, AuthenticatedSession, type AuthPolicy, type Principal, type PrincipalKind } from './auth.js';
 import { type JWTVerifyGetKey } from 'jose';
+import type { Logger } from './logging.js';
 /**
  * Verifies a Cognito JWT token and returns a typed session.
  * Uses the Cognito JWKS endpoint for validation.
@@ -9,6 +10,12 @@ export interface CognitoJwtVerifier {
 }
 export type CognitoTokenUse = 'access' | 'any' | 'id';
 export interface CognitoJwtVerifierOptions {
+    /**
+     * Exact app-client IDs accepted by this API. Defaults to the configured
+     * primary web client. Add a generated confidential-client ID only on APIs
+     * that expose its M2M scopes.
+     */
+    acceptedClientIds?: readonly string[];
     clockToleranceSeconds?: number;
     jwks?: JWTVerifyGetKey;
     onJwksError?: (error: unknown) => void;
@@ -30,10 +37,13 @@ export interface AuthGuardEvent {
  * flow through the runtime response helpers unchanged.
  */
 export interface AuthGuard {
-    authorize(event: AuthGuardEvent): Promise<Principal>;
-    authorizeToken(token: string | null | undefined): Promise<Principal>;
+    authorize(event: AuthGuardEvent, observation?: AuthGuardObservation): Promise<Principal>;
+    authorizeToken(token: string | null | undefined, observation?: AuthGuardObservation): Promise<Principal>;
     verifier: CognitoJwtVerifier;
 }
+export interface AuthGuardObservation {
+    logger?: Pick<Logger, 'error'>;
+}
 export interface CreateAuthGuardOptions {
     allowedKinds?: PrincipalKind[];
     config: BetterAuthConfig;

package/src/auth-backend.js

@@ -1,8 +1,8 @@
 import { __awaiter } from "tslib";
 import { assertPrincipalKind, AuthError, authErrorCodes, isAuthError, sessionFromCognitoToken, toPrincipal, } from './auth.js';
 import { createRemoteJWKSet, jwtVerify, } from 'jose';
-function hasExpectedAudience(payload, clientId) {
-    return (payload.aud === clientId ||
+function hasExpectedAudience(payload, clientIds) {
+    return clientIds.some((clientId) => payload.aud === clientId ||
         (Array.isArray(payload.aud) && payload.aud.includes(clientId)) ||
         payload.client_id === clientId);
 }
@@ -27,12 +27,22 @@ function isJwksAvailabilityError(error) {
         ['ERR_JWKS_INVALID', 'ERR_JWKS_TIMEOUT'].includes((_a = joseErrorCode(error)) !== null && _a !== void 0 ? _a : ''));
 }
 export function createCognitoJwtVerifier(config, options = {}) {
-    var _a, _b;
+    var _a, _b, _c;
     const clockToleranceSeconds = (_a = options.clockToleranceSeconds) !== null && _a !== void 0 ? _a : 30;
     if (!Number.isFinite(clockToleranceSeconds) || clockToleranceSeconds < 0) {
         throw new Error('JWT clock tolerance must be a non-negative number.');
     }
-    const jwks = (_b = options.jwks) !== null && _b !== void 0 ? _b : createRemoteJWKSet(new URL(`${config.issuerUrl}/.well-known/jwks.json`));
+    const acceptedClientIds = (_b = options.acceptedClientIds) !== null && _b !== void 0 ? _b : [config.clientId];
+    if (acceptedClientIds.length === 0 ||
+        acceptedClientIds.some((clientId) => typeof clientId !== 'string' ||
+            clientId.trim() !== clientId ||
+            clientId.length === 0 ||
+            clientId.length > 256 ||
+            /[\r\n]/.test(clientId)) ||
+        new Set(acceptedClientIds).size !== acceptedClientIds.length) {
+        throw new Error('Accepted Cognito client IDs must be a non-empty unique bounded set.');
+    }
+    const jwks = (_c = options.jwks) !== null && _c !== void 0 ? _c : createRemoteJWKSet(new URL(`${config.issuerUrl}/.well-known/jwks.json`));
     return {
         verify(token) {
             return __awaiter(this, void 0, void 0, function* () {
@@ -51,18 +61,11 @@ export function createCognitoJwtVerifier(config, options = {}) {
                 }
                 catch (error) {
                     if (isJwksAvailabilityError(error)) {
-                        const report = (_a = options.onJwksError) !== null && _a !== void 0 ? _a : ((cause) => {
-                            var _a;
-                            return console.error('[runtime/auth-backend] Cognito JWKS verification is unavailable.', {
-                                code: (_a = joseErrorCode(cause)) !== null && _a !== void 0 ? _a : 'ERR_JWKS_FETCH',
-                                issuer: config.issuerUrl,
-                            });
-                        });
-                        report(error);
+                        (_a = options.onJwksError) === null || _a === void 0 ? void 0 : _a.call(options, error);
                     }
                     throw error;
                 }
-                if (!hasExpectedAudience(payload, config.clientId)) {
+                if (!hasExpectedAudience(payload, acceptedClientIds)) {
                     throw new Error('Invalid audience');
                 }
                 if (!payload.sub) {
@@ -114,8 +117,9 @@ function getHeader(headers, name) {
 export function createAuthGuard(options) {
     var _a, _b, _c;
     const verifier = (_a = options.verifier) !== null && _a !== void 0 ? _a : createCognitoJwtVerifier(options.config, Object.assign(Object.assign({}, options.verifierOptions), { tokenUse: (_c = (_b = options.verifierOptions) === null || _b === void 0 ? void 0 : _b.tokenUse) !== null && _c !== void 0 ? _c : 'access' }));
-    function authorizeToken(token) {
-        return __awaiter(this, void 0, void 0, function* () {
+    function authorizeToken(token_1) {
+        return __awaiter(this, arguments, void 0, function* (token, observation = {}) {
+            var _a, _b;
             if (!token) {
                 throw new AuthError({
                     code: authErrorCodes.unauthenticated,
@@ -131,6 +135,14 @@ export function createAuthGuard(options) {
                 if (isAuthError(error)) {
                     throw error;
                 }
+                if (isJwksAvailabilityError(error)) {
+                    (_a = observation.logger) === null || _a === void 0 ? void 0 : _a.error('Cognito JWKS verification unavailable', {
+                        attributes: {
+                            errorCode: (_b = joseErrorCode(error)) !== null && _b !== void 0 ? _b : 'ERR_JWKS_FETCH',
+                        },
+                        outcome: 'failure',
+                    });
+                }
                 throw new AuthError({
                     code: authErrorCodes.invalidToken,
                     message: 'Invalid or expired token',
@@ -145,10 +157,10 @@ export function createAuthGuard(options) {
         });
     }
     return {
-        authorize(event) {
-            return __awaiter(this, void 0, void 0, function* () {
+        authorize(event_1) {
+            return __awaiter(this, arguments, void 0, function* (event, observation = {}) {
                 const token = extractBearerToken(getHeader(event.headers, 'authorization'));
-                return authorizeToken(token);
+                return authorizeToken(token, observation);
             });
         },
         authorizeToken,

package/src/auth-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-backend.js","sourceRoot":"","sources":["../../../../packages/runtime/src/auth-backend.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,cAAc,EAEd,WAAW,EACX,uBAAuB,EACvB,WAAW,GAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,SAAS,GAGV,MAAM,MAAM,CAAC;AA4Bd,SAAS,mBAAmB,CAC1B,OAA0B,EAC1B,QAAgB;IAEhB,OAAO,CACL,OAAO,CAAC,GAAG,KAAK,QAAQ;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,CAAC,SAAS,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;;IAC7C,OAAO,CACL,KAAK,YAAY,SAAS;QAC1B,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC/C,MAAA,aAAa,CAAC,KAAK,CAAC,mCAAI,EAAE,CAC3B,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAwB,EACxB,UAAqC,EAAE;;IAEvC,MAAM,qBAAqB,GAAG,MAAA,OAAO,CAAC,qBAAqB,mCAAI,EAAE,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GACR,MAAA,OAAO,CAAC,IAAI,mCACZ,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC;IAE3E,OAAO;QACC,MAAM,CAAC,KAAa;;;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,CAAC;gBAED,IAAI,OAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAoB,KAAK,EAAE,IAAI,EAAE;wBAC7D,UAAU,EAAE,CAAC,OAAO,CAAC;wBACrB,cAAc,EAAE,qBAAqB;wBACrC,MAAM,EAAE,MAAM,CAAC,SAAS;qBACzB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnC,MAAM,MAAM,GACV,MAAA,OAAO,CAAC,WAAW,mCACnB,CAAC,CAAC,KAAc,EAAE,EAAE;;4BAClB,OAAA,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE;gCACE,IAAI,EAAE,MAAA,aAAa,CAAC,KAAK,CAAC,mCAAI,gBAAgB;gCAC9C,MAAM,EAAE,MAAM,CAAC,SAAS;6BACzB,CACF,CAAA;yBAAA,CAAC,CAAC;wBACP,MAAM,CAAC,KAAK,CAAC,CAAC;oBAChB,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,KAAK,CAAC;gBAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,OAAO,uBAAuB,CAAC;oBAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,CAAC;oBAC/C,gBAAgB,EAAE,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;oBAC5D,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAClE,CAAC;AAyBD,SAAS,SAAS,CAChB,OAAkC,EAClC,IAAY;IAEZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,SAAS,CAC3C,CAAC;IAEF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA+B;;IAC7D,MAAM,QAAQ,GACZ,MAAA,OAAO,CAAC,QAAQ,mCAChB,wBAAwB,CAAC,OAAO,CAAC,MAAM,kCAClC,OAAO,CAAC,eAAe,KAC1B,QAAQ,EAAE,MAAA,MAAA,OAAO,CAAC,eAAe,0CAAE,QAAQ,mCAAI,QAAQ,IACvD,CAAC;IAEL,SAAe,cAAc,CAC3B,KAAgC;;YAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,cAAc,CAAC,eAAe;oBACpC,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,cAAc,CAAC,YAAY;oBACjC,OAAO,EAAE,0BAA0B;oBACnC,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAEvD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;KAAA;IAED,OAAO;QACC,SAAS,CAAC,KAAqB;;gBACnC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAC1C,CAAC;gBACF,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;SAAA;QACD,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-backend.js","sourceRoot":"","sources":["../../../../packages/runtime/src/auth-backend.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,cAAc,EAEd,WAAW,EACX,uBAAuB,EACvB,WAAW,GAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,SAAS,GAGV,MAAM,MAAM,CAAC;AAmCd,SAAS,mBAAmB,CAC1B,OAA0B,EAC1B,SAA4B;IAE5B,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,QAAQ,EAAE,EAAE,CACX,OAAO,CAAC,GAAG,KAAK,QAAQ;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,CAAC,SAAS,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD,CAAC;IACF,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;;IAC7C,OAAO,CACL,KAAK,YAAY,SAAS;QAC1B,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAC/C,MAAA,aAAa,CAAC,KAAK,CAAC,mCAAI,EAAE,CAC3B,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAwB,EACxB,UAAqC,EAAE;;IAEvC,MAAM,qBAAqB,GAAG,MAAA,OAAO,CAAC,qBAAqB,mCAAI,EAAE,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAA,OAAO,CAAC,iBAAiB,mCAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,IACE,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC9B,iBAAiB,CAAC,IAAI,CACpB,CAAC,QAAQ,EAAE,EAAE,CACX,OAAO,QAAQ,KAAK,QAAQ;YAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,QAAQ;YAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,QAAQ,CAAC,MAAM,GAAG,GAAG;YACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC1B;QACD,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,MAAA,OAAO,CAAC,IAAI,mCACZ,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC;IAE3E,OAAO;QACC,MAAM,CAAC,KAAa;;;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,CAAC;gBAED,IAAI,OAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAoB,KAAK,EAAE,IAAI,EAAE;wBAC7D,UAAU,EAAE,CAAC,OAAO,CAAC;wBACrB,cAAc,EAAE,qBAAqB;wBACrC,MAAM,EAAE,MAAM,CAAC,SAAS;qBACzB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnC,MAAA,OAAO,CAAC,WAAW,wDAAG,KAAK,CAAC,CAAC;oBAC/B,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,KAAK,CAAC;gBAC3C,IAAI,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,OAAO,uBAAuB,CAAC;oBAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,CAAC;oBAC/C,gBAAgB,EAAE,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;oBAC5D,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC,CAAC;YACL,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAClE,CAAC;AAmCD,SAAS,SAAS,CAChB,OAAkC,EAClC,IAAY;IAEZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,SAAS,CAC3C,CAAC;IAEF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA+B;;IAC7D,MAAM,QAAQ,GACZ,MAAA,OAAO,CAAC,QAAQ,mCAChB,wBAAwB,CAAC,OAAO,CAAC,MAAM,kCAClC,OAAO,CAAC,eAAe,KAC1B,QAAQ,EAAE,MAAA,MAAA,OAAO,CAAC,eAAe,0CAAE,QAAQ,mCAAI,QAAQ,IACvD,CAAC;IAEL,SAAe,cAAc;6DAC3B,KAAgC,EAChC,cAAoC,EAAE;;YAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,cAAc,CAAC,eAAe;oBACpC,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAA,WAAW,CAAC,MAAM,0CAAE,KAAK,CAAC,uCAAuC,EAAE;wBACjE,UAAU,EAAE;4BACV,SAAS,EAAE,MAAA,aAAa,CAAC,KAAK,CAAC,mCAAI,gBAAgB;yBACpD;wBACD,OAAO,EAAE,SAAS;qBACnB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC;oBAClB,IAAI,EAAE,cAAc,CAAC,YAAY;oBACjC,OAAO,EAAE,0BAA0B;oBACnC,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAEvD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;KAAA;IAED,OAAO;QACC,SAAS;iEACb,KAAqB,EACrB,cAAoC,EAAE;gBAEtC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAC1C,CAAC;gBACF,OAAO,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC;SAAA;QACD,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/src/authorization/admission.d.ts

@@ -0,0 +1,30 @@
+import type { PrincipalKind } from '../auth.js';
+import type { RequestActor } from '../request-context.js';
+import { type AuthorizationDecision, type AuthorizationPrincipal } from './model.js';
+export interface CoarseAdmissionRule {
+    allRoles?: readonly string[];
+    allScopes?: readonly string[];
+    anyRole?: readonly string[];
+    anyScope?: readonly string[];
+    kinds: readonly PrincipalKind[];
+    subjectTypes?: readonly RequestActor['type'][];
+}
+export interface CoarseAdmission {
+    /**
+     * Alternatives let one operation explicitly admit the current human
+     * kind/role path or an OAuth-scoped M2M path. A missing or empty set denies.
+     */
+    anyOf: readonly CoarseAdmissionRule[];
+}
+export interface CoarseAdmissionAllow {
+    decision: 'allow';
+}
+export type CoarseAdmissionDecision = CoarseAdmissionAllow | Extract<AuthorizationDecision, {
+    decision: 'deny';
+}>;
+export declare function defineCoarseAdmission(admission: CoarseAdmission): CoarseAdmission;
+/**
+ * Coarse admission never substitutes for domain policy. The result says only
+ * whether the principal may proceed to the Slice-owned evaluator.
+ */
+export declare function evaluateCoarseAdmission(principal: AuthorizationPrincipal, admission: CoarseAdmission): CoarseAdmissionDecision;

package/src/authorization/admission.js

@@ -0,0 +1,87 @@
+import { denyAuthorization, } from './model.js';
+const POLICY_VERSION = 'coarse-admission-v1';
+function normalizeValues(values, label) {
+    if (values === undefined)
+        return undefined;
+    const normalized = values.map((value) => value.trim());
+    if (normalized.length === 0 ||
+        normalized.some((value) => !value || value.length > 256 || /[\r\n]/.test(value)) ||
+        new Set(normalized).size !== normalized.length) {
+        throw new Error(`[runtime/authorization] ${label} must contain unique bounded values.`);
+    }
+    return Object.freeze(normalized);
+}
+export function defineCoarseAdmission(admission) {
+    if (!Array.isArray(admission.anyOf) || admission.anyOf.length === 0) {
+        throw new Error('[runtime/authorization] Coarse admission requires at least one explicit alternative.');
+    }
+    const alternatives = admission.anyOf.map((rule, index) => {
+        if (!Array.isArray(rule.kinds) ||
+            rule.kinds.length === 0 ||
+            new Set(rule.kinds).size !== rule.kinds.length ||
+            rule.kinds.some((kind) => !['admin', 'agent', 'customer'].includes(kind))) {
+            throw new Error(`[runtime/authorization] Coarse admission alternative ${index} requires unique PrincipalKind values.`);
+        }
+        if (rule.subjectTypes !== undefined &&
+            (rule.subjectTypes.length === 0 ||
+                new Set(rule.subjectTypes).size !== rule.subjectTypes.length ||
+                rule.subjectTypes.some((type) => !['service', 'system', 'user'].includes(type)))) {
+            throw new Error(`[runtime/authorization] Coarse admission alternative ${index} has invalid subject types.`);
+        }
+        return Object.freeze({
+            allRoles: normalizeValues(rule.allRoles, 'allRoles'),
+            allScopes: normalizeValues(rule.allScopes, 'allScopes'),
+            anyRole: normalizeValues(rule.anyRole, 'anyRole'),
+            anyScope: normalizeValues(rule.anyScope, 'anyScope'),
+            kinds: Object.freeze([...rule.kinds]),
+            subjectTypes: rule.subjectTypes
+                ? Object.freeze([...rule.subjectTypes])
+                : undefined,
+        });
+    });
+    return Object.freeze({ anyOf: Object.freeze(alternatives) });
+}
+function evaluateRule(principal, rule) {
+    if (!rule.kinds.includes(principal.kind) ||
+        (rule.subjectTypes !== undefined &&
+            !rule.subjectTypes.includes(principal.actor.type))) {
+        return 'kind';
+    }
+    if ((rule.allRoles !== undefined &&
+        !rule.allRoles.every((role) => principal.roles.includes(role))) ||
+        (rule.anyRole !== undefined &&
+            !rule.anyRole.some((role) => principal.roles.includes(role)))) {
+        return 'role';
+    }
+    if ((rule.allScopes !== undefined &&
+        !rule.allScopes.every((scope) => principal.scopes.includes(scope))) ||
+        (rule.anyScope !== undefined &&
+            !rule.anyScope.some((scope) => principal.scopes.includes(scope)))) {
+        return 'scope';
+    }
+    return 'allow';
+}
+/**
+ * Coarse admission never substitutes for domain policy. The result says only
+ * whether the principal may proceed to the Slice-owned evaluator.
+ */
+export function evaluateCoarseAdmission(principal, admission) {
+    let normalized;
+    try {
+        normalized = defineCoarseAdmission(admission);
+    }
+    catch (_a) {
+        return denyAuthorization('admission-kind-denied', POLICY_VERSION);
+    }
+    const progress = normalized.anyOf.map((rule) => evaluateRule(principal, rule));
+    if (progress.includes('allow'))
+        return { decision: 'allow' };
+    if (progress.includes('scope')) {
+        return denyAuthorization('admission-scope-denied', POLICY_VERSION);
+    }
+    if (progress.includes('role')) {
+        return denyAuthorization('admission-role-denied', POLICY_VERSION);
+    }
+    return denyAuthorization('admission-kind-denied', POLICY_VERSION);
+}
+//# sourceMappingURL=admission.js.map

package/src/authorization/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/admission.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AA0BpB,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,SAAS,eAAe,CACtB,MAAqC,EACrC,KAAa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAChE;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,sCAAsC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CACtC,CAAC,IAAyB,EAAE,KAAa,EAAE,EAAE;QAC3C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,CAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpE,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,wCAAwC,CACtG,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAC7B,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM;gBAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnE,CAAC,EACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,6BAA6B,CAC3F,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;YACpD,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;YACvD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;YACjD,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;YACpD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAID,SAAS,YAAY,CACnB,SAAiC,EACjC,IAAyB;IAEzB,IACE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QACpC,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;YAC9B,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IACE,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;QAC1B,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAC/D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IACE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC1B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiC,EACjC,SAA0B;IAE1B,IAAI,UAA2B,CAAC;IAChC,IAAI,CAAC;QACH,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAC9B,CAAC;IACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,iBAAiB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,iBAAiB,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,iBAAiB,CAAC,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC"}

package/src/authorization/approval.d.ts

@@ -0,0 +1,99 @@
+import type { RequestActor } from '../request-context.js';
+import { type AuthorizationDecision, type AuthorizationPrincipal } from './model.js';
+export declare const APPROVAL_REQUEST_SCHEMA_VERSION: 1;
+export declare const DEFAULT_MAX_APPROVAL_TTL_SECONDS: number;
+export interface ApprovalResourceReference {
+    id?: string;
+    type: string;
+}
+export interface ApprovalDigestInput<Action extends string = string> {
+    action: Action;
+    command: unknown;
+    resource: ApprovalResourceReference;
+}
+export interface ApprovalActorReference {
+    actorId: string;
+    authorityMode: 'delegated' | 'direct' | 'machine';
+    effectiveHumanId?: string;
+    subjectType: RequestActor['type'];
+}
+export interface ApprovalDecisionRecord {
+    at: string;
+    decidedBy: ApprovalActorReference;
+    outcome: 'approved' | 'rejected';
+    reasonReference: string;
+}
+export interface ApprovalExecutionRecord {
+    completedAt?: string;
+    executionId: string;
+    startedAt: string;
+}
+export interface ApprovalRequest<Action extends string = string> {
+    action: Action;
+    author: ApprovalActorReference;
+    decision?: ApprovalDecisionRecord;
+    execution?: ApprovalExecutionRecord;
+    expiresAt: string;
+    id: string;
+    policyVersion: string;
+    requestDigest: string;
+    requestedAt: string;
+    resource: ApprovalResourceReference;
+    revision: number;
+    schemaVersion: typeof APPROVAL_REQUEST_SCHEMA_VERSION;
+    slice: string;
+    status: 'approved' | 'executed' | 'executing' | 'expired' | 'pending' | 'rejected';
+}
+export interface CreateApprovalRequestInput<Action extends string = string> extends ApprovalDigestInput<Action> {
+    author: AuthorizationPrincipal;
+    expiresAt: string;
+    now: string;
+    policyVersion: string;
+    slice: string;
+}
+export interface DecideApprovalRequestInput {
+    approver: AuthorizationPrincipal;
+    expectedRequestDigest: string;
+    now: string;
+    outcome: 'approved' | 'rejected';
+    reasonReference: string;
+    requiredPolicyVersion: string;
+}
+export interface ApprovalTransitionResult<Action extends string = string> {
+    decision: AuthorizationDecision;
+    request: ApprovalRequest<Action>;
+}
+export interface BeginApprovalExecutionInput<Action extends string = string> extends ApprovalDigestInput<Action> {
+    executionId?: string;
+    now: string;
+    requiredPolicyVersion: string;
+}
+export interface CompleteApprovalExecutionInput {
+    executionId: string;
+    now: string;
+    requiredPolicyVersion: string;
+}
+/**
+ * Binds approval to the exact action, safe resource reference, and canonical
+ * command. The command itself is never retained on the approval record.
+ */
+export declare function digestApprovalRequest<Action extends string>(input: ApprovalDigestInput<Action>): string;
+export declare function toApprovalActorReference(principal: AuthorizationPrincipal): ApprovalActorReference;
+export declare function createApprovalRequest<Action extends string>(input: CreateApprovalRequestInput<Action>): ApprovalRequest<Action>;
+export declare function expireApprovalRequest<Action extends string>(request: ApprovalRequest<Action>, now: string): ApprovalRequest<Action>;
+/**
+ * Enforces direct-human, non-author review. A human who authored through a
+ * delegated agent remains the effective author and cannot approve through a
+ * different session.
+ */
+export declare function decideApprovalRequest<Action extends string>(request: ApprovalRequest<Action>, input: DecideApprovalRequestInput): ApprovalTransitionResult<Action>;
+export declare function authorizeApprovalExecution<Action extends string>(request: ApprovalRequest<Action>, input: ApprovalDigestInput<Action> & {
+    now: string;
+    requiredPolicyVersion: string;
+}): AuthorizationDecision;
+/**
+ * Claims an approved command before its protected effect. Persist this
+ * revision with compare-and-set, then execute idempotently under executionId.
+ */
+export declare function beginApprovalExecution<Action extends string>(request: ApprovalRequest<Action>, input: BeginApprovalExecutionInput<Action>): ApprovalTransitionResult<Action>;
+export declare function completeApprovalExecution<Action extends string>(request: ApprovalRequest<Action>, input: CompleteApprovalExecutionInput): ApprovalTransitionResult<Action>;