@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/authorization/evaluator.js

@@ -0,0 +1,199 @@
+import { __awaiter } from "tslib";
+import { evaluateCoarseAdmission } from './admission.js';
+import { assertAuthorizationAllowed } from './errors.js';
+import { allowAuthorization, denyAuthorization, } from './model.js';
+const UNAVAILABLE_POLICY_VERSION = 'unavailable';
+const POLICY_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function isPolicyVersion(value) {
+    return (typeof value === 'string' &&
+        POLICY_VERSION_PATTERN.test(value) &&
+        value.trim() === value);
+}
+const PRINCIPAL_KINDS = ['admin', 'agent', 'customer'];
+const SUBJECT_TYPES = ['service', 'system', 'user'];
+const MAX_PRINCIPAL_VALUES = 128;
+function isBoundedText(value, maximumLength = 256) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= maximumLength &&
+        value.trim() === value &&
+        !/[\r\n]/.test(value));
+}
+function isBoundedUniqueTextList(value) {
+    return (Array.isArray(value) &&
+        value.length <= MAX_PRINCIPAL_VALUES &&
+        value.every((entry) => isBoundedText(entry)) &&
+        new Set(value).size === value.length);
+}
+function validPrincipal(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const principal = value;
+    if (principal.actor === null ||
+        typeof principal.actor !== 'object' ||
+        !isBoundedText(principal.actor.id) ||
+        !SUBJECT_TYPES.includes(principal.actor.type) ||
+        principal.subject === null ||
+        typeof principal.subject !== 'object' ||
+        !isBoundedText(principal.subject.id) ||
+        !SUBJECT_TYPES.includes(principal.subject.type) ||
+        principal.actor.id !== principal.subject.id ||
+        principal.actor.type !== principal.subject.type ||
+        !PRINCIPAL_KINDS.includes(principal.kind) ||
+        !isBoundedUniqueTextList(principal.roles) ||
+        !isBoundedUniqueTextList(principal.scopes) ||
+        (principal.audience !== undefined && !isBoundedText(principal.audience)) ||
+        principal.authority === null ||
+        typeof principal.authority !== 'object') {
+        return false;
+    }
+    const authority = principal.authority;
+    if (authority.mode === 'direct') {
+        return principal.actor.type === 'user';
+    }
+    if (authority.mode === 'machine') {
+        return (principal.kind === 'agent' &&
+            principal.actor.type === 'service' &&
+            isBoundedText(principal.audience) &&
+            principal.audience === principal.actor.id &&
+            isBoundedText(authority.machineIdentityId));
+    }
+    if (authority.mode === 'delegated') {
+        return (principal.kind === 'agent' &&
+            principal.actor.type === 'service' &&
+            isBoundedText(principal.audience) &&
+            principal.audience === principal.actor.id &&
+            isBoundedText(authority.delegationId) &&
+            authority.delegatedBy !== null &&
+            typeof authority.delegatedBy === 'object' &&
+            authority.delegatedBy.type === 'user' &&
+            isBoundedText(authority.delegatedBy.id));
+    }
+    return false;
+}
+function validInput(input) {
+    return (input !== null &&
+        typeof input === 'object' &&
+        isBoundedText(input.action) &&
+        validPrincipal(input.principal) &&
+        input.resource !== null &&
+        typeof input.resource === 'object' &&
+        !Array.isArray(input.resource) &&
+        isBoundedText(input.resource.type, 128) &&
+        (input.resource.id === undefined || isBoundedText(input.resource.id)) &&
+        input.resource.attributes !== null &&
+        typeof input.resource.attributes === 'object' &&
+        !Array.isArray(input.resource.attributes) &&
+        input.context !== null &&
+        typeof input.context === 'object' &&
+        !Array.isArray(input.context) &&
+        typeof input.context.now === 'string' &&
+        Number.isFinite(Date.parse(input.context.now)) &&
+        isBoundedText(input.context.stage, 63) &&
+        input.context.facts !== null &&
+        typeof input.context.facts === 'object' &&
+        !Array.isArray(input.context.facts));
+}
+function validObligation(value) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        typeof value.kind !== 'string') {
+        return false;
+    }
+    const obligation = value;
+    return (obligation.kind.trim() === obligation.kind &&
+        obligation.kind.length > 0 &&
+        obligation.kind.length <= 128 &&
+        !/[\r\n]/.test(obligation.kind) &&
+        (obligation.reference === undefined ||
+            (typeof obligation.reference === 'string' &&
+                obligation.reference.trim() === obligation.reference &&
+                obligation.reference.length > 0 &&
+                obligation.reference.length <= 256 &&
+                !/[\r\n]/.test(obligation.reference))));
+}
+function projectPolicyResult(result, policyVersion) {
+    var _a;
+    if ((result === null || result === void 0 ? void 0 : result.decision) === 'allow' &&
+        (result.obligations === undefined ||
+            (Array.isArray(result.obligations) &&
+                result.obligations.every(validObligation)))) {
+        return allowAuthorization(policyVersion, (_a = result.obligations) !== null && _a !== void 0 ? _a : []);
+    }
+    if ((result === null || result === void 0 ? void 0 : result.decision) === 'deny') {
+        return denyAuthorization('domain-authorization-denied', policyVersion);
+    }
+    return denyAuthorization('authorization-unavailable', policyVersion);
+}
+export function defineAuthorizationPolicy(policy) {
+    if (!isPolicyVersion(policy.version) ||
+        typeof policy.evaluate !== 'function') {
+        throw new Error('[runtime/authorization] Authorization policy requires a bounded version and evaluator.');
+    }
+    return Object.freeze({
+        evaluate: policy.evaluate,
+        version: policy.version,
+    });
+}
+/**
+ * Wraps Slice-owned policy with explicit admission and fail-closed behavior.
+ * Only the literal typed allow result authorizes; falsey, ambiguous, thrown,
+ * stale, or unavailable evaluation returns a stable denial.
+ */
+export function createAuthorizationEvaluator(options) {
+    var _a;
+    const version = isPolicyVersion((_a = options.policy) === null || _a === void 0 ? void 0 : _a.version)
+        ? options.policy.version
+        : UNAVAILABLE_POLICY_VERSION;
+    const evaluate = (input) => __awaiter(this, void 0, void 0, function* () {
+        let decision;
+        if (!validInput(input)) {
+            decision = denyAuthorization('policy-input-invalid', version);
+        }
+        else {
+            const admission = evaluateCoarseAdmission(input.principal, options.admission);
+            if (admission.decision === 'deny') {
+                decision = Object.assign(Object.assign({}, admission), { policyVersion: version });
+            }
+            else if (options.requiredPolicyVersion !== undefined &&
+                options.requiredPolicyVersion !== version) {
+                decision = denyAuthorization('policy-stale', version);
+            }
+            else if (options.policy === undefined ||
+                !isPolicyVersion(options.policy.version) ||
+                typeof options.policy.evaluate !== 'function') {
+                decision = denyAuthorization('authorization-unavailable', version);
+            }
+            else {
+                try {
+                    decision = projectPolicyResult(yield options.policy.evaluate(input), version);
+                }
+                catch (_a) {
+                    decision = denyAuthorization('authorization-unavailable', version);
+                }
+            }
+        }
+        if (options.decisionSink) {
+            try {
+                yield options.decisionSink({ decision, input });
+            }
+            catch (_b) {
+                return denyAuthorization('authorization-unavailable', version);
+            }
+        }
+        return decision;
+    });
+    return Object.freeze({
+        authorize(input) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const decision = yield evaluate(input);
+                assertAuthorizationAllowed(decision);
+                return decision;
+            });
+        },
+        evaluate,
+        policyVersion: version,
+    });
+}
+//# sourceMappingURL=evaluator.js.map

package/src/authorization/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/evaluator.ts"],"names":[],"mappings":";AAAA,OAAO,EAAE,uBAAuB,EAAwB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAOlB,MAAM,YAAY,CAAC;AA8CpB,MAAM,0BAA0B,GAAG,aAAa,CAAC;AACjD,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAEpE,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAChE,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAC7D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAc,EAAE,aAAa,GAAG,GAAG;IACxD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,aAAa;QAC7B,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,oBAAoB;QACpC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAwC,CAAC;IAC3D,IACE,SAAS,CAAC,KAAK,KAAK,IAAI;QACxB,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;QACnC,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7C,SAAS,CAAC,OAAO,KAAK,IAAI;QAC1B,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE;QAC3C,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI;QAC/C,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QACzC,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC;QACzC,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC;QAC1C,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxE,SAAS,CAAC,SAAS,KAAK,IAAI;QAC5B,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,EACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YAClC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE;YACzC,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,OAAO;YAC1B,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YAClC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE;YACzC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC;YACrC,SAAS,CAAC,WAAW,KAAK,IAAI;YAC9B,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;YACzC,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM;YACrC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,QAAQ,KAAK,IAAI;QACvB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QACvC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,IAAI;QAClC,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ;QAC7C,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,KAAK,CAAC,OAAO,KAAK,IAAI;QACtB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ;QACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAAiC,CAAC,IAAI,KAAK,QAAQ,EAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAgC,CAAC;IACpD,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,IAAI;QAC1C,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG;QAC7B,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC/B,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;gBACvC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,SAAS;gBACpD,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/B,UAAU,CAAC,SAAS,CAAC,MAAM,IAAI,GAAG;gBAClC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA6C,EAC7C,aAAqB;;IAErB,IACE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,MAAK,OAAO;QAC5B,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;gBAChC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAC/C,CAAC;QACD,OAAO,kBAAkB,CACvB,aAAa,EACb,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,MAAK,MAAM,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,iBAAiB,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAIvC,MAA8C;IAE9C,IACE,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAI1C,OAA+D;;IAE/D,MAAM,OAAO,GAAG,eAAe,CAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,OAAO,CAAC;QACtD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QACxB,CAAC,CAAC,0BAA0B,CAAC;IAE/B,MAAM,QAAQ,GAAG,CACf,KAAY,EACgC,EAAE;QAC9C,IAAI,QAA2C,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,GAAG,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,uBAAuB,CACvC,KAAK,CAAC,SAAS,EACf,OAAO,CAAC,SAAS,CAClB,CAAC;YACF,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAClC,QAAQ,mCACH,SAAS,KACZ,aAAa,EAAE,OAAO,GACvB,CAAC;YACJ,CAAC;iBAAM,IACL,OAAO,CAAC,qBAAqB,KAAK,SAAS;gBAC3C,OAAO,CAAC,qBAAqB,KAAK,OAAO,EACzC,CAAC;gBACD,QAAQ,GAAG,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;iBAAM,IACL,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxC,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU,EAC7C,CAAC;gBACD,QAAQ,GAAG,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,QAAQ,GAAG,mBAAmB,CAC5B,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpC,OAAO,CACR,CAAC;gBACJ,CAAC;gBAAC,WAAM,CAAC;oBACP,QAAQ,GAAG,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAA,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACb,SAAS,CAAC,KAAY;;gBAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACvC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,QAAQ,CAAC;YAClB,CAAC;SAAA;QACD,QAAQ;QACR,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;AACL,CAAC"}

package/src/authorization/index.d.ts

@@ -0,0 +1,14 @@
+export * from './admission.js';
+export * from './approval.js';
+export * from './audit.js';
+export * from './delegation.js';
+export * from './errors.js';
+export * from './evaluator.js';
+export * from './machine.js';
+export * from './machine-token.js';
+export * from './model.js';
+export declare const authorizationContract: {
+    readonly exportPath: "@empire-builder-kit/runtime/authorization";
+    readonly packageName: "@empire-builder-kit/runtime";
+    readonly responseProfile: "ebk-app-v1";
+};

package/src/authorization/index.js

@@ -0,0 +1,15 @@
+export * from './admission.js';
+export * from './approval.js';
+export * from './audit.js';
+export * from './delegation.js';
+export * from './errors.js';
+export * from './evaluator.js';
+export * from './machine.js';
+export * from './machine-token.js';
+export * from './model.js';
+export const authorizationContract = {
+    exportPath: '@empire-builder-kit/runtime/authorization',
+    packageName: '@empire-builder-kit/runtime',
+    responseProfile: 'ebk-app-v1',
+};
+//# sourceMappingURL=index.js.map

package/src/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,UAAU,EAAE,2CAA2C;IACvD,WAAW,EAAE,6BAA6B;IAC1C,eAAe,EAAE,YAAY;CACrB,CAAC"}

package/src/authorization/machine-token.d.ts

@@ -0,0 +1,87 @@
+import { RuntimeError } from '../response.js';
+export declare const MACHINE_TOKEN_ERROR_CODES: {
+    readonly invalid: "machine_token_invalid";
+    readonly invalidated: "machine_token_invalidated";
+    readonly unavailable: "machine_token_unavailable";
+};
+export type MachineTokenErrorCode = (typeof MACHINE_TOKEN_ERROR_CODES)[keyof typeof MACHINE_TOKEN_ERROR_CODES];
+export interface MachineClientSecret {
+    /**
+     * Secret material exists only in the resolver/exchange call frame. The
+     * provider never caches it or includes it in snapshots and errors.
+     */
+    value: string;
+}
+export type MachineClientSecretResolver = () => Promise<MachineClientSecret>;
+export interface MachineTokenExchangeInput {
+    audience: string;
+    clientId: string;
+    clientSecret: string;
+    scopes: readonly string[];
+}
+export interface MachineTokenExchangeResult {
+    accessToken: string;
+    audience: string;
+    expiresAt: number;
+    scopes: readonly string[];
+    tokenType: 'Bearer';
+}
+export type MachineTokenExchange = (input: MachineTokenExchangeInput) => Promise<MachineTokenExchangeResult>;
+export interface MachineAccessToken {
+    accessToken: string;
+    audience: string;
+    expiresAt: number;
+    scopes: readonly string[];
+    tokenType: 'Bearer';
+}
+export interface MachineTokenAuditSnapshot {
+    audience: string;
+    cacheState: 'empty' | 'expired' | 'ready' | 'refresh-required' | 'refreshing';
+    cachedExpiresAt?: number;
+    generation: number;
+    invalidationCount: number;
+    lastErrorCode?: MachineTokenErrorCode;
+    lastInvalidatedAt?: number;
+    lastRefreshedAt?: number;
+    machineIdentityId: string;
+    scopes: readonly string[];
+}
+export interface MachineTokenProviderOptions {
+    audience: string;
+    clientId: string;
+    exchange: MachineTokenExchange;
+    machineIdentityId: string;
+    /**
+     * Testable epoch-seconds clock. Defaults to Date.now().
+     */
+    now?: () => number;
+    refreshBeforeSeconds?: number;
+    resolveClientSecret: MachineClientSecretResolver;
+    scopes: readonly string[];
+}
+export interface MachineTokenProvider {
+    auditSnapshot(): MachineTokenAuditSnapshot;
+    getToken(): Promise<MachineAccessToken>;
+    /**
+     * Invalidates the cache and any in-flight generation. A subsequent getToken
+     * resolves the secret again.
+     */
+    invalidate(): void;
+    /**
+     * Secret rotation is an explicit invalidation boundary. The next getToken
+     * obtains the rotated value through resolveClientSecret.
+     */
+    rotate(): void;
+}
+export declare class MachineTokenProviderError extends RuntimeError {
+    readonly machineTokenCode: MachineTokenErrorCode;
+    constructor(machineTokenCode: MachineTokenErrorCode);
+}
+export declare function isMachineTokenProviderError(error: unknown): error is MachineTokenProviderError;
+/**
+ * Creates a client-credentials token cache with an exact audience/scope
+ * contract. Only a literal, validated exchange result is cached. Missing,
+ * malformed, thrown, expired, rotated, or generation-stale results fail
+ * closed with response-safe errors.
+ */
+export declare function createMachineTokenProvider(options: MachineTokenProviderOptions): MachineTokenProvider;

package/src/authorization/machine-token.js

@@ -0,0 +1,201 @@
+import { __awaiter } from "tslib";
+import { RuntimeError } from '../response.js';
+import { isBoundedSafeReference } from '../safe-reference.js';
+export const MACHINE_TOKEN_ERROR_CODES = {
+    invalid: 'machine_token_invalid',
+    invalidated: 'machine_token_invalidated',
+    unavailable: 'machine_token_unavailable',
+};
+const TOKEN_MAX_BYTES = 64 * 1024;
+const DEFAULT_REFRESH_BEFORE_SECONDS = 60;
+const MAX_REFRESH_BEFORE_SECONDS = 60 * 60;
+export class MachineTokenProviderError extends RuntimeError {
+    constructor(machineTokenCode) {
+        super({
+            code: machineTokenCode,
+            expose: true,
+            message: machineTokenCode === MACHINE_TOKEN_ERROR_CODES.invalidated
+                ? 'Machine access token refresh was invalidated'
+                : machineTokenCode === MACHINE_TOKEN_ERROR_CODES.invalid
+                    ? 'Machine access token response is invalid'
+                    : 'Machine access token is temporarily unavailable',
+            retryable: true,
+            status: 503,
+        });
+        this.machineTokenCode = machineTokenCode;
+        this.name = 'MachineTokenProviderError';
+    }
+}
+export function isMachineTokenProviderError(error) {
+    return error instanceof MachineTokenProviderError;
+}
+function safeReference(value, label) {
+    const normalized = value.trim();
+    if (!isBoundedSafeReference(normalized)) {
+        throw new Error(`[runtime/authorization] Machine token ${label} must be a bounded safe reference.`);
+    }
+    return normalized;
+}
+function normalizeScopes(scopes) {
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+        throw new Error('[runtime/authorization] Machine token scopes must be a non-empty exact set.');
+    }
+    const normalized = scopes.map((scope) => safeReference(scope, 'scope'));
+    if (new Set(normalized).size !== normalized.length) {
+        throw new Error('[runtime/authorization] Machine token scopes must be a non-empty exact set.');
+    }
+    return Object.freeze(normalized.sort((left, right) => left < right ? -1 : left > right ? 1 : 0));
+}
+function sameScopes(expected, actual) {
+    if (!Array.isArray(actual) ||
+        actual.length !== expected.length ||
+        new Set(actual).size !== actual.length) {
+        return false;
+    }
+    const normalized = [...actual].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+    return expected.every((scope, index) => scope === normalized[index]);
+}
+function accessTokenIsValid(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        Buffer.byteLength(value, 'utf8') <= TOKEN_MAX_BYTES &&
+        /^[A-Za-z0-9._~+/-]+=*$/.test(value));
+}
+function finiteNow(now) {
+    const value = now();
+    if (!Number.isFinite(value) || value < 0) {
+        throw new MachineTokenProviderError(MACHINE_TOKEN_ERROR_CODES.unavailable);
+    }
+    return value;
+}
+/**
+ * Creates a client-credentials token cache with an exact audience/scope
+ * contract. Only a literal, validated exchange result is cached. Missing,
+ * malformed, thrown, expired, rotated, or generation-stale results fail
+ * closed with response-safe errors.
+ */
+export function createMachineTokenProvider(options) {
+    var _a, _b;
+    const audience = safeReference(options.audience, 'audience');
+    const clientId = safeReference(options.clientId, 'client id');
+    const machineIdentityId = safeReference(options.machineIdentityId, 'machine identity id');
+    const scopes = normalizeScopes(options.scopes);
+    const refreshBeforeSeconds = (_a = options.refreshBeforeSeconds) !== null && _a !== void 0 ? _a : DEFAULT_REFRESH_BEFORE_SECONDS;
+    if (!Number.isSafeInteger(refreshBeforeSeconds) ||
+        refreshBeforeSeconds < 0 ||
+        refreshBeforeSeconds > MAX_REFRESH_BEFORE_SECONDS ||
+        typeof options.resolveClientSecret !== 'function' ||
+        typeof options.exchange !== 'function') {
+        throw new Error(`[runtime/authorization] Machine token refresh window must be from 0 through ${MAX_REFRESH_BEFORE_SECONDS} seconds and callbacks are required.`);
+    }
+    const now = (_b = options.now) !== null && _b !== void 0 ? _b : (() => Date.now() / 1000);
+    let cached;
+    let generation = 0;
+    let invalidationCount = 0;
+    let lastErrorCode;
+    let lastInvalidatedAt;
+    let lastRefreshedAt;
+    let inFlight;
+    const requiresRefresh = (token, at) => at + refreshBeforeSeconds >= token.expiresAt;
+    const fail = (code) => {
+        lastErrorCode = code;
+        throw new MachineTokenProviderError(code);
+    };
+    const refresh = (refreshGeneration) => __awaiter(this, void 0, void 0, function* () {
+        let secretValue;
+        let result;
+        try {
+            const secret = yield options.resolveClientSecret();
+            if (!secret ||
+                typeof secret.value !== 'string' ||
+                secret.value.length === 0) {
+                return fail(MACHINE_TOKEN_ERROR_CODES.unavailable);
+            }
+            secretValue = secret.value;
+            result = yield options.exchange({
+                audience,
+                clientId,
+                clientSecret: secretValue,
+                scopes,
+            });
+        }
+        catch (error) {
+            if (isMachineTokenProviderError(error))
+                throw error;
+            return fail(MACHINE_TOKEN_ERROR_CODES.unavailable);
+        }
+        finally {
+            secretValue = undefined;
+        }
+        const refreshedAt = finiteNow(now);
+        if (refreshGeneration !== generation) {
+            return fail(MACHINE_TOKEN_ERROR_CODES.invalidated);
+        }
+        if (!result ||
+            result.audience !== audience ||
+            result.tokenType !== 'Bearer' ||
+            !sameScopes(scopes, result.scopes) ||
+            !accessTokenIsValid(result.accessToken) ||
+            !Number.isFinite(result.expiresAt) ||
+            result.expiresAt <= refreshedAt) {
+            return fail(MACHINE_TOKEN_ERROR_CODES.invalid);
+        }
+        const token = Object.freeze({
+            accessToken: result.accessToken,
+            audience,
+            expiresAt: result.expiresAt,
+            scopes,
+            tokenType: 'Bearer',
+        });
+        cached = token;
+        lastErrorCode = undefined;
+        lastRefreshedAt = refreshedAt;
+        return token;
+    });
+    const invalidate = () => {
+        generation += 1;
+        invalidationCount += 1;
+        cached = undefined;
+        inFlight = undefined;
+        lastInvalidatedAt = finiteNow(now);
+    };
+    return Object.freeze({
+        auditSnapshot() {
+            const at = finiteNow(now);
+            const cacheState = inFlight
+                ? 'refreshing'
+                : !cached
+                    ? 'empty'
+                    : cached.expiresAt <= at
+                        ? 'expired'
+                        : requiresRefresh(cached, at)
+                            ? 'refresh-required'
+                            : 'ready';
+            return Object.freeze(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ audience,
+                cacheState }, (cached ? { cachedExpiresAt: cached.expiresAt } : {})), { generation,
+                invalidationCount }), (lastErrorCode ? { lastErrorCode } : {})), (lastInvalidatedAt !== undefined ? { lastInvalidatedAt } : {})), (lastRefreshedAt !== undefined ? { lastRefreshedAt } : {})), { machineIdentityId,
+                scopes }));
+        },
+        getToken() {
+            const at = finiteNow(now);
+            if (cached && !requiresRefresh(cached, at)) {
+                return Promise.resolve(cached);
+            }
+            if ((inFlight === null || inFlight === void 0 ? void 0 : inFlight.generation) === generation)
+                return inFlight.promise;
+            const refreshGeneration = generation;
+            const promise = refresh(refreshGeneration);
+            const flight = { generation: refreshGeneration, promise };
+            inFlight = flight;
+            const clear = () => {
+                if (inFlight === flight)
+                    inFlight = undefined;
+            };
+            void promise.then(clear, clear);
+            return promise;
+        },
+        invalidate,
+        rotate: invalidate,
+    });
+}
+//# sourceMappingURL=machine-token.js.map

package/src/authorization/machine-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-token.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/machine-token.ts"],"names":[],"mappings":";AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,OAAO,EAAE,uBAAuB;IAChC,WAAW,EAAE,2BAA2B;IACxC,WAAW,EAAE,2BAA2B;CAChC,CAAC;AAoFX,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IACzD,YAAqB,gBAAuC;QAC1D,KAAK,CAAC;YACJ,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EACL,gBAAgB,KAAK,yBAAyB,CAAC,WAAW;gBACxD,CAAC,CAAC,8CAA8C;gBAChD,CAAC,CAAC,gBAAgB,KAAK,yBAAyB,CAAC,OAAO;oBACtD,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,iDAAiD;YACzD,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QAZgB,qBAAgB,GAAhB,gBAAgB,CAAuB;QAa1D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,OAAO,KAAK,YAAY,yBAAyB,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,oCAAoC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9B,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,QAA2B,EAC3B,MAAyB;IAEzB,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,eAAe;QACnD,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAiB;IAClC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAoC;;IAEpC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,aAAa,CACrC,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,CACtB,CAAC;IACF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,oBAAoB,GACxB,MAAA,OAAO,CAAC,oBAAoB,mCAAI,8BAA8B,CAAC;IACjE,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,oBAAoB,CAAC;QAC3C,oBAAoB,GAAG,CAAC;QACxB,oBAAoB,GAAG,0BAA0B;QACjD,OAAO,OAAO,CAAC,mBAAmB,KAAK,UAAU;QACjD,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,0BAA0B,sCAAsC,CAChJ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAK,CAAC,CAAC;IAEtD,IAAI,MAAsC,CAAC;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,aAAgD,CAAC;IACrD,IAAI,iBAAqC,CAAC;IAC1C,IAAI,eAAmC,CAAC;IACxC,IAAI,QAKS,CAAC;IAEd,MAAM,eAAe,GAAG,CAAC,KAAyB,EAAE,EAAU,EAAW,EAAE,CACzE,EAAE,GAAG,oBAAoB,IAAI,KAAK,CAAC,SAAS,CAAC;IAE/C,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAS,EAAE;QAClD,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CACd,iBAAyB,EACI,EAAE;QAC/B,IAAI,WAA+B,CAAC;QACpC,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACnD,IACE,CAAC,MAAM;gBACP,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EACzB,CAAC;gBACD,OAAO,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;YACD,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;gBAC9B,QAAQ;gBACR,QAAQ;gBACR,YAAY,EAAE,WAAW;gBACzB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,2BAA2B,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpD,OAAO,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,iBAAiB,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,IACE,CAAC,MAAM;YACP,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAClC,MAAM,CAAC,SAAS,IAAI,WAAW,EAC/B,CAAC;YACD,OAAO,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM;YACN,SAAS,EAAE,QAAiB;SAC7B,CAAC,CAAC;QACH,MAAM,GAAG,KAAK,CAAC;QACf,aAAa,GAAG,SAAS,CAAC;QAC1B,eAAe,GAAG,WAAW,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC,CAAA,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,UAAU,IAAI,CAAC,CAAC;QAChB,iBAAiB,IAAI,CAAC,CAAC;QACvB,MAAM,GAAG,SAAS,CAAC;QACnB,QAAQ,GAAG,SAAS,CAAC;QACrB,iBAAiB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa;YACX,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,UAAU,GAA4C,QAAQ;gBAClE,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,CAAC,MAAM;oBACP,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE;wBACtB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;4BAC3B,CAAC,CAAC,kBAAkB;4BACpB,CAAC,CAAC,OAAO,CAAC;YAClB,OAAO,MAAM,CAAC,MAAM,uFAClB,QAAQ;gBACR,UAAU,IACP,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KACxD,UAAU;gBACV,iBAAiB,KACd,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACxC,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC9D,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7D,iBAAiB;gBACjB,MAAM,IACN,CAAC;QACL,CAAC;QACD,QAAQ;YACN,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,MAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;YAEjE,MAAM,iBAAiB,GAAG,UAAU,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;YAC1D,QAAQ,GAAG,MAAM,CAAC;YAClB,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,QAAQ,KAAK,MAAM;oBAAE,QAAQ,GAAG,SAAS,CAAC;YAChD,CAAC,CAAC;YACF,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,UAAU;QACV,MAAM,EAAE,UAAU;KACnB,CAAC,CAAC;AACL,CAAC"}

package/src/authorization/machine.d.ts

@@ -0,0 +1,32 @@
+import type { Principal } from '../auth.js';
+import { type AuthorizationPrincipal } from './model.js';
+export interface MachineIdentityDefinition {
+    /**
+     * The exact confidential-client audience registered for this capability.
+     */
+    audience: string;
+    capability: string;
+    machineIdentityId: string;
+    requiredScopes: readonly string[];
+    slice: string;
+}
+export interface MachineIdentity {
+    audience: string;
+    capability: string;
+    machineIdentityId: string;
+    principal: AuthorizationPrincipal & {
+        authority: {
+            machineIdentityId: string;
+            mode: 'machine';
+        };
+        kind: 'agent';
+    };
+    scopes: readonly string[];
+    slice: string;
+}
+/**
+ * Binds an authenticated Cognito client-credentials Principal to one
+ * application capability. No client secret or access token enters the result.
+ */
+export declare function createMachineIdentity(principal: Principal, definition: MachineIdentityDefinition): MachineIdentity;
+export declare function createMachineAuthorizationPrincipal(principal: Principal, definition: MachineIdentityDefinition): MachineIdentity['principal'];

package/src/authorization/machine.js

@@ -0,0 +1,41 @@
+import { isBoundedSafeReference } from '../safe-reference.js';
+import { composeAuthorizationPrincipal, } from './model.js';
+const SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+/**
+ * Binds an authenticated Cognito client-credentials Principal to one
+ * application capability. No client secret or access token enters the result.
+ */
+export function createMachineIdentity(principal, definition) {
+    const requiredScopes = definition.requiredScopes.map((scope) => scope.trim());
+    if (principal.kind !== 'agent' ||
+        principal.session.subject.type !== 'service' ||
+        !principal.audience ||
+        principal.id !== principal.audience ||
+        principal.audience !== definition.audience ||
+        !isBoundedSafeReference(definition.machineIdentityId) ||
+        !isBoundedSafeReference(definition.capability) ||
+        !SAFE_NAME.test(definition.slice) ||
+        requiredScopes.length === 0 ||
+        requiredScopes.some((scope) => !isBoundedSafeReference(scope) ||
+            !principal.scopes.includes(scope) ||
+            scope.length > 256) ||
+        new Set(requiredScopes).size !== requiredScopes.length) {
+        throw new Error('[runtime/authorization] Machine identity must be a distinct agent service principal with exact audience and required scopes.');
+    }
+    const authorizationPrincipal = composeAuthorizationPrincipal(principal, {
+        machineIdentityId: definition.machineIdentityId,
+        mode: 'machine',
+    });
+    return Object.freeze({
+        audience: definition.audience,
+        capability: definition.capability,
+        machineIdentityId: definition.machineIdentityId,
+        principal: authorizationPrincipal,
+        scopes: Object.freeze([...requiredScopes]),
+        slice: definition.slice,
+    });
+}
+export function createMachineAuthorizationPrincipal(principal, definition) {
+    return createMachineIdentity(principal, definition).principal;
+}
+//# sourceMappingURL=machine.js.map

package/src/authorization/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/machine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,6BAA6B,GAE9B,MAAM,YAAY,CAAC;AA4BpB,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAoB,EACpB,UAAqC;IAErC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,IACE,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;QAC5C,CAAC,SAAS,CAAC,QAAQ;QACnB,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,QAAQ;QACnC,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;QAC1C,CAAC,sBAAsB,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACrD,CAAC,sBAAsB,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACjC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,cAAc,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAC9B,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjC,KAAK,CAAC,MAAM,GAAG,GAAG,CACrB;QACD,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IAED,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,IAAI,EAAE,SAAS;KAChB,CAAiC,CAAC;IAEnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC;QAC1C,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,SAAoB,EACpB,UAAqC;IAErC,OAAO,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC"}