@harperfast/harper 5.2.10 → 5.3.0-alpha.1

package/dist/security/authn/oidc/providers/githubActions.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * GitHub Actions provider profile (#2171).
+ *
+ * The only module that should know anything about GitHub. Its rules are deliberately stricter than
+ * npm's trusted-publishing model, and scoping them here means that strictness never constrains
+ * another issuer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubActionsProfile = void 0;
+exports.splitWorkflowPath = splitWorkflowPath;
+const hdbError_ts_1 = require("../../../../utility/errors/hdbError.js");
+/**
+ * Workflow references are `<owner>/<repo>/<path>@<ref>` and the ref is always a full `refs/...` name.
+ * Splitting on `@refs/` rather than the first or last `@` is exact, because a path segment cannot
+ * contain `/` — so this cannot occur inside the path, and a branch named `release@2` cannot fool it.
+ */
+const REF_QUALIFIER = '@refs/';
+/**
+ * GitHub's default audience is the repository owner's URL, shared by every repository under that
+ * owner, so accepting it would make a token minted by any repo in the org valid here — the one
+ * mistake the audience field exists to prevent.
+ */
+const SHARED_DEFAULT_AUDIENCE = /^https:\/\/github\.com\/[^/]+\/?$/i;
+/**
+ * Structural requirements on a policy's claim set, each guarding a distinct way a policy can be
+ * accidentally broad. Satisfying none of a row's claims admits, in order: any repository, any
+ * workflow in that repository, any branch that can be pushed to it.
+ *
+ * `repository_owner` is absent from the first row on purpose — it identifies an org, not a
+ * repository, so it would admit every repo in the org. `ref_type` is absent from the third for the
+ * same shape of reason: `ref_type: tag` still admits any tag, and anyone with push access can create
+ * one. A tag-triggered release pins `environment` and leans on GitHub's environment protection.
+ *
+ * `job_workflow_ref` pins the workflow (second row) but deliberately does NOT gate the ref (third).
+ * For a reusable workflow it names the workflow that RAN, not the caller that invoked it — the
+ * caller's ref lives in `workflow_ref`/`ref`. Its `@ref` suffix therefore describes the reusable
+ * workflow's own branch, which is constant however it is called, so accepting it as a ref gate would
+ * admit any branch of any caller repository that references that reusable workflow: precisely the
+ * hole the third row exists to close.
+ *
+ * `sub` is deliberately not accepted as a pin: it varies by trigger, and its format changed for
+ * repositories created after 2026-07-15 (immutable subjects embed owner and repo ids).
+ */
+const STRUCTURAL_REQUIREMENTS = [
+    {
+        requirement: 'pin the repository',
+        claims: ['repository_id', 'repository'],
+        because: ' (repository_id is immutable and survives renames)',
+    },
+    {
+        requirement: 'pin the workflow',
+        claims: ['workflow_ref', 'workflow_path', 'job_workflow_ref', 'job_workflow_path'],
+        because: '',
+    },
+    {
+        requirement: 'gate the ref',
+        claims: ['workflow_ref', 'ref', 'environment'],
+        because: ' — otherwise any branch that can be pushed to the repository can run the workflow and mint a token',
+    },
+];
+/** Returns undefined rather than guessing when the value is not a ref-qualified reference. */
+function splitWorkflowPath(workflowRef) {
+    if (typeof workflowRef !== 'string')
+        return undefined;
+    const qualifierIndex = workflowRef.indexOf(REF_QUALIFIER);
+    return qualifierIndex === -1 ? undefined : workflowRef.slice(0, qualifierIndex);
+}
+exports.githubActionsProfile = {
+    name: 'GitHub Actions',
+    assertPolicyIsSpecific(policyClaims) {
+        const constrained = new Set(Object.keys(policyClaims));
+        for (const { requirement, claims, because } of STRUCTURAL_REQUIREMENTS) {
+            if (!claims.some((claimName) => constrained.has(claimName))) {
+                throw new hdbError_ts_1.ClientError(`claims must ${requirement} with one of: ${claims.join(', ')}${because}`);
+            }
+        }
+    },
+    assertAudienceIsSpecific(audience) {
+        if (SHARED_DEFAULT_AUDIENCE.test(audience)) {
+            throw new hdbError_ts_1.ClientError(`'audience' must identify this instance, not '${audience}' — GitHub's default audience is shared ` +
+                `by every repository under an owner, so a token minted for any of them would be accepted here. ` +
+                `Use the instance URL the CI client targets.`);
+        }
+    },
+    /**
+     * Adds `workflow_path` / `job_workflow_path` — the workflow reference with the ref removed — so a
+     * policy can pin the workflow *file* while gating the ref some other way. A tag-triggered release
+     * cannot pin `workflow_ref`, because the tag is unknown when the policy is written.
+     *
+     * A claim the token actually carries is never displaced by one we synthesized.
+     */
+    normalizeClaims(payload) {
+        const claims = { ...payload };
+        for (const [source, derived] of [
+            ['workflow_ref', 'workflow_path'],
+            ['job_workflow_ref', 'job_workflow_path'],
+        ]) {
+            const path = splitWorkflowPath(payload[source]);
+            if (path !== undefined && claims[derived] === undefined)
+                claims[derived] = path;
+        }
+        return claims;
+    },
+    /**
+     * A `pull_request_target` run executes the base repository's workflow with its secrets while a
+     * fork controls the checked-out code. A plain `pull_request` run from a fork gets no
+     * `id-token: write` and so cannot mint at all, but `pull_request_target` can — so it is denied
+     * unless a policy constrains `event_name`, which is the explicit opt-in.
+     */
+    vetoClaims(claims, policyClaims) {
+        if (claims.event_name === 'pull_request_target' && policyClaims.event_name === undefined) {
+            return 'pull_request_target is denied unless the policy constrains event_name';
+        }
+        return undefined;
+    },
+    describePrincipal(claims) {
+        return [
+            claims.repository,
+            claims.workflow_ref ?? claims.workflow_path,
+            claims.environment && `environment=${claims.environment}`,
+            claims.run_id && `run=${claims.run_id}`,
+            claims.actor && `actor=${claims.actor}`,
+        ]
+            .filter(Boolean)
+            .join(' ');
+    },
+};
+//# sourceMappingURL=githubActions.js.map

package/dist/security/authn/oidc/providers/githubActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubActions.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/githubActions.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA2DH,8CAIC;AA7DD,wEAAqE;AAIrE;;;;GAIG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uBAAuB,GAAG;IAC/B;QACC,WAAW,EAAE,oBAAoB;QACjC,MAAM,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC;QACvC,OAAO,EAAE,oDAAoD;KAC7D;IACD;QACC,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;QAClF,OAAO,EAAE,EAAE;KACX;IACD;QACC,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,CAAC;QAC9C,OAAO,EAAE,oGAAoG;KAC7G;CACD,CAAC;AAEF,8FAA8F;AAC9F,SAAgB,iBAAiB,CAAC,WAAoB;IACrD,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACjF,CAAC;AAEY,QAAA,oBAAoB,GAA4B;IAC5D,IAAI,EAAE,gBAAgB;IAEtB,sBAAsB,CAAC,YAA6C;QACnE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,yBAAW,CAAC,eAAe,WAAW,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,wBAAwB,CAAC,QAAgB;QACxC,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,yBAAW,CACpB,gDAAgD,QAAQ,0CAA0C;gBACjG,gGAAgG;gBAChG,6CAA6C,CAC9C,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAoB;QACnC,MAAM,MAAM,GAAgB,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;YAC/B,CAAC,cAAc,EAAE,eAAe,CAAC;YACjC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SACzC,EAAE,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB,EAAE,YAA6C;QAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,qBAAqB,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1F,OAAO,uEAAuE,CAAC;QAChF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,iBAAiB,CAAC,MAAmB;QACpC,OAAO;YACN,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa;YAC3C,MAAM,CAAC,WAAW,IAAI,eAAe,MAAM,CAAC,WAAW,EAAE;YACzD,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE;YACvC,MAAM,CAAC,KAAK,IAAI,SAAS,MAAM,CAAC,KAAK,EAAE;SACvC;aACC,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;CACD,CAAC"}

package/dist/security/authn/oidc/providers/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Provider profiles for OIDC trusted publishing (#2171).
+ *
+ * Everything issuer-specific lives behind this interface, resolved by normalized issuer, so the core
+ * stays generic: a new workload-identity issuer is a profile, not a change to verification, matching,
+ * or storage. Issuers with no registered profile fall back to `generic`, which is strict rather than
+ * permissive — see its `assertPolicyIsSpecific`.
+ */
+import type { ClaimConstraint, TokenClaims } from '../types.ts';
+import { genericProfile } from './generic.ts';
+import { githubActionsProfile } from './githubActions.ts';
+export interface IdentityProviderProfile {
+    /** Shown in policy-validation errors and the audit trail. */
+    name: string;
+    /**
+     * Rejects a claim set too broad to be a safe policy for this issuer. Called at write time, when
+     * the reader is an administrator who can act on the message.
+     */
+    assertPolicyIsSpecific(policyClaims: Record<string, ClaimConstraint>): void;
+    /**
+     * Rejects an audience the issuer shares across principals — the mistake that makes an audience
+     * check meaningless. A no-op for issuers with no such default.
+     */
+    assertAudienceIsSpecific(audience: string): void;
+    /** Adds issuer-specific derived claims. Must never displace a claim the token actually carries. */
+    normalizeClaims(payload: TokenClaims): TokenClaims;
+    /** One-line principal description for the audit trail. */
+    describePrincipal(claims: TokenClaims): string;
+    /**
+     * A match-time veto applied after the policy's own constraints pass, for runs this issuer should
+     * refuse unless a policy opts in explicitly. Returns a reason to deny, or undefined to allow.
+     */
+    vetoClaims?(claims: TokenClaims, policyClaims: Record<string, ClaimConstraint>): string | undefined;
+}
+/** Never returns undefined: an unregistered issuer gets the strict generic profile. */
+export declare function profileForIssuer(issuer: string): IdentityProviderProfile;
+export { genericProfile, githubActionsProfile };

package/dist/security/authn/oidc/providers/index.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Provider profiles for OIDC trusted publishing (#2171).
+ *
+ * Everything issuer-specific lives behind this interface, resolved by normalized issuer, so the core
+ * stays generic: a new workload-identity issuer is a profile, not a change to verification, matching,
+ * or storage. Issuers with no registered profile fall back to `generic`, which is strict rather than
+ * permissive — see its `assertPolicyIsSpecific`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubActionsProfile = exports.genericProfile = void 0;
+exports.profileForIssuer = profileForIssuer;
+const generic_ts_1 = require("./generic.js");
+Object.defineProperty(exports, "genericProfile", { enumerable: true, get: function () { return generic_ts_1.genericProfile; } });
+const githubActions_ts_1 = require("./githubActions.js");
+Object.defineProperty(exports, "githubActionsProfile", { enumerable: true, get: function () { return githubActions_ts_1.githubActionsProfile; } });
+const PROFILES_BY_ISSUER = new Map([
+    ['https://token.actions.githubusercontent.com', githubActions_ts_1.githubActionsProfile],
+]);
+/** Never returns undefined: an unregistered issuer gets the strict generic profile. */
+function profileForIssuer(issuer) {
+    return PROFILES_BY_ISSUER.get(issuer) ?? generic_ts_1.genericProfile;
+}
+//# sourceMappingURL=index.js.map

package/dist/security/authn/oidc/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAwCH,4CAEC;AAvCD,6CAA8C;AAyCrC,+FAzCA,2BAAc,OAyCA;AAxCvB,yDAA0D;AAwCjC,qGAxChB,uCAAoB,OAwCgB;AAT7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAkC;IACnE,CAAC,6CAA6C,EAAE,uCAAoB,CAAC;CACrE,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,MAAc;IAC9C,OAAO,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,2BAAc,CAAC;AACzD,CAAC"}

package/dist/security/authn/oidc/tokenExchange.d.ts

@@ -0,0 +1,12 @@
+/** Drops the memo below so a test can install a different table. Not used in production. */
+export declare function clearTokenUseTableCache(): void;
+/**
+ * Exchanges a CI identity token for a short-lived Harper operation token. Unauthenticated by design —
+ * this operation *is* the authentication, the way create_authentication_tokens is against a password.
+ */
+export declare function exchangeOidcToken(req: any): Promise<{
+    operation_token: string;
+    expires_in: number;
+    username: any;
+    policy: string;
+}>;

package/dist/security/authn/oidc/tokenExchange.js

@@ -0,0 +1,306 @@
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearTokenUseTableCache = clearTokenUseTableCache;
+exports.exchangeOidcToken = exchangeOidcToken;
+// exchange_oidc_token — the unauthenticated half of OIDC trusted publishing (#2171).
+//
+// A CI runner presents an identity token minted by its provider. If it verifies against a stored
+// trust policy, Harper mints a short-lived operation token for the user that policy names. This is
+// the only unauthenticated operation that yields a credential, so it fails closed throughout and
+// refuses through rejectToken, which tells the caller nothing beyond "no".
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const joi_1 = __importDefault(require("joi"));
+const node_crypto_1 = require("node:crypto");
+const databases_ts_1 = require("../../../resources/databases.js");
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+const validationWrapper_ts_1 = require("../../../validation/validationWrapper.js");
+const logger_ts_1 = require("../../../utility/logging/logger.js");
+const harper_logger_ts_1 = __importDefault(require("../../../utility/logging/harper_logger.js"));
+const env = __importStar(require("../../../utility/environment/environmentManager.js"));
+const hdbTerms_ts_1 = require("../../../utility/hdbTerms.js");
+const user_ts_1 = require("../../user.js");
+const tokenAuthentication_ts_1 = require("../../tokenAuthentication.js");
+const identityToken_ts_1 = require("./identityToken.js");
+const claims_ts_1 = require("./claims.js");
+const jwks_ts_1 = require("./jwks.js");
+const index_ts_1 = require("./providers/index.js");
+const trustPolicyOperations_ts_1 = require("./trustPolicyOperations.js");
+const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
+const { AuthAuditLog } = harper_logger_ts_1.default;
+// Same stream and same switches as every other authentication event (security/auth.ts), so an
+// operator who turns on auth auditing sees OIDC exchanges alongside Basic, Bearer, and mTLS.
+const authEventLog = harper_logger_ts_1.default.forComponent('authentication').withTag('auth-event');
+/** Long enough to cover a slow deploy, short enough to be worthless by the time it reaches a log. */
+const EXCHANGED_TOKEN_LIFETIME_SECONDS = 3600;
+/** Keeps the replay record alive past the token's expiry by more than the verifier's clock leeway. */
+const REPLAY_RECORD_PADDING_MS = 120_000;
+/** Real identity tokens are ~1-2 KB; this bounds what we are willing to even parse. */
+const MAX_TOKEN_LENGTH = 8192;
+const TOKEN_USE_TABLE = 'hdb_oidc_token_use';
+/**
+ * Spent identity tokens, keyed by the fingerprint below and expiring with the token, so the table
+ * stays proportional to in-flight tokens rather than to deploy history and never holds a credential.
+ *
+ * Replicated like other system tables, which extends the check across the cluster — but replication
+ * is asynchronous, so two simultaneous replays against different nodes can both land. That race is
+ * not a privilege escalation: whoever holds the token could obtain one operation token regardless.
+ * What it stops is the realistic case, a token that leaks after a legitimate run and is reused
+ * inside its window.
+ *
+ * table() also registers into `databases.system`, so the lookup finds it after the first call.
+ */
+let tokenUseTable;
+/** Drops the memo below so a test can install a different table. Not used in production. */
+function clearTokenUseTableCache() {
+    tokenUseTable = undefined;
+}
+function getTokenUseTable() {
+    // Memoized per process, but `table()` is NOT skipped merely because the table already exists.
+    // The systemSchema stub and the 5.3.0 directive declare only the primary key — the `expiresAt`
+    // TTL is not expressible through CreateTableObject — so this call is what actually installs the
+    // TTL, layered on top of the bootstrap. Short-circuiting on existence would mean a table that
+    // arrived any other way (bootstrap, replication, restore, a manual create_table) never gets it,
+    // and replay records would then accumulate in a system table forever. hdb_certificate_cache
+    // does the same two-step for the same reason.
+    tokenUseTable ??= (0, databases_ts_1.table)({
+        table: TOKEN_USE_TABLE,
+        database: 'system',
+        // `audit: true` explicitly, NOT the default (which follows logging.auditLog). Auditing is the
+        // replication change feed (databases.ts: "auditing must be enabled for replication"), and
+        // replay records MUST replicate so a token spent on one node cannot be re-spent on another
+        // inside its window. Without this, an operator with logging.auditLog:false would silently lose
+        // cross-node replay protection. Its sibling hdb_oidc_trust is audited for the same reason.
+        audit: true,
+        attributes: [
+            { name: 'id', isPrimaryKey: true },
+            { name: 'policy_id' },
+            { name: 'used_at' },
+            { name: 'expiresAt', expiresAt: true, indexed: true },
+        ],
+    });
+    return tokenUseTable;
+}
+/**
+ * Records the exchange in the authentication audit stream. Emitted for failures as well as successes:
+ * a run repeatedly failing to authenticate is exactly what an audit trail is for.
+ */
+function auditExchange(req, username, status, detail) {
+    const logSuccessful = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGSUCCESSFUL) ?? false;
+    const logFailed = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGFAILED) ?? false;
+    if (status === hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS ? !logSuccessful : !logFailed)
+        return;
+    // serverHandlers injects baseRequest for NO_AUTH_OPERATIONS, so the transport details are here;
+    // they stay optional because an in-process caller (server.operation) has none.
+    const baseRequest = req?.baseRequest;
+    const log = new AuthAuditLog(username, status, hdbTerms_ts_1.AUTH_AUDIT_TYPES.AUTHENTICATION, 
+    // Same precedence as every other auth event (security/auth.ts): behind a load balancer —
+    // which is every Fabric and cloud deployment — `ip` is the proxy, so an audit trail for the
+    // one unauthenticated credential-minting operation would record the proxy, not the runner.
+    baseRequest?.headers?.['x-forwarded-for'] ?? baseRequest?.ip, baseRequest?.method, baseRequest?.pathname);
+    log.auth_strategy = 'oidc';
+    Object.assign(log, detail);
+    if (status === hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS)
+        authEventLog.info?.(log);
+    else
+        authEventLog.error?.(log);
+}
+/**
+ * Auditing must never change the outcome it is recording. The success emit sits inside the
+ * exchange's try, so a throw there would be caught and re-reported as a FAILURE for a request that
+ * actually succeeded; on the failure path a throw would replace the original error with the audit's.
+ * Swallowing here fixes both, and keeps the two call sites free of defensive wrapping.
+ */
+function auditExchangeSafely(req, username, status, detail) {
+    try {
+        auditExchange(req, username, status, detail);
+    }
+    catch (error) {
+        logger.warn?.(`Failed to emit OIDC exchange audit record: ${error.message}`);
+    }
+}
+/** Verifies each distinct audience at most once, so N policies sharing one cost one verification. */
+async function findMatchingPolicy(token, issuer, policies, profile) {
+    const claimsByAudience = new Map();
+    for (const policy of policies) {
+        // Re-validate specificity at exchange time. add_oidc_trust enforces these, but a stored row can
+        // arrive another way — replication from an older node that predates a check, or a restored/older
+        // system-DB backup — and the exchange must not trust that every row was validated when written.
+        // Skip (don't honor) any row that would be rejected for writing, so an under-specified policy
+        // (e.g. a repository pinned but no workflow/ref gate) can't mint a token. Fail closed.
+        try {
+            profile.assertAudienceIsSpecific(policy.audience);
+            profile.assertPolicyIsSpecific(policy.claims);
+        }
+        catch (error) {
+            logger.warn?.(`Ignoring trust policy '${policy.id}': ${error.message}`);
+            continue;
+        }
+        if (!claimsByAudience.has(policy.audience)) {
+            // verifyIdentityToken logs its own reason via rejectToken, but everything jwks.ts throws
+            // (unknown kid, unreachable host, non-2xx, oversized body, bad JSON, no usable keys) is
+            // thrown directly and would otherwise vanish here — the request then falls through to
+            // "no trust policy matched", which is actively misleading when a policy DID match and the
+            // failure was operational. Log every swallowed reason so an issuer outage is
+            // distinguishable from a misconfigured policy in the log.
+            const verified = await (0, identityToken_ts_1.verifyIdentityToken)(token, { issuer, audience: policy.audience }).catch((error) => {
+                logger.warn?.(`Verification failed for policy '${policy.id}' (audience '${policy.audience}'): ${error.message}`);
+                return undefined;
+            });
+            claimsByAudience.set(policy.audience, verified);
+        }
+        const claims = claimsByAudience.get(policy.audience);
+        if (!claims)
+            continue;
+        const mismatch = (0, claims_ts_1.matchTrustPolicyClaims)(claims, policy.claims) ?? profile.vetoClaims?.(claims, policy.claims);
+        if (!mismatch)
+            return { policy, claims };
+        logger.debug?.(`Trust policy '${policy.id}' did not match: ${mismatch}`);
+    }
+    return undefined;
+}
+/**
+ * Identifies a token for replay purposes: a hash of its SIGNED INPUT (`header.payload`), not of the
+ * whole token string. Keyed this way rather than on `issuer|jti` because not every issuer emits
+ * `jti` (Azure uses `uti`, others omit it), so this is strictly more general.
+ *
+ * Hashing the raw token instead would be bypassable, because the signature segment is covered by
+ * nothing. Base64url decoding ignores the surplus low bits of the final character, so for an RS256
+ * signature there are 16 distinct spellings of that segment that decode to identical bytes — every
+ * one of them passes `jwt.verify`, and every one hashes differently. One leaked identity token would
+ * buy 16 operation tokens. ES* issuers add a second, independent vector, since `s → n−s` is a
+ * different valid signature over the same input.
+ *
+ * The signed input has neither problem: it is exactly what the issuer asserted and what the
+ * signature covers, so every variant spelling and every malleable re-signing of one assertion
+ * collapses to one fingerprint. Hashed rather than stored so the table never holds a credential.
+ */
+function tokenFingerprint(token) {
+    // Not `slice(0, 2).join('.')` on a split of the whole token: lastIndexOf keeps this O(1) in the
+    // signature length and cannot silently succeed on a malformed token with too few segments —
+    // verifyIdentityToken has already established this is a well-formed three-segment JWT.
+    const signedInput = token.slice(0, token.lastIndexOf('.'));
+    return (0, node_crypto_1.createHash)('sha256').update(signedInput).digest('base64url');
+}
+/**
+ * Marks an identity token as spent, refusing one already recorded.
+ *
+ * Recorded before the token is minted: if minting then fails the credential is burned, costing a CI
+ * re-run, where the reverse ordering would leave a spendable token behind. The get-then-put is not
+ * atomic and deliberately does not depend on Harper's optimistic concurrency to make it so — see
+ * getTokenUseTable for why the race is tolerable.
+ */
+async function recordTokenUse(fingerprint, claims, policyId) {
+    const useTable = getTokenUseTable();
+    if (await useTable.get(fingerprint))
+        (0, identityToken_ts_1.rejectToken)(`token ${fingerprint.slice(0, 12)} has already been exchanged`);
+    await useTable.put({
+        id: fingerprint,
+        policy_id: policyId,
+        used_at: Date.now(),
+        expiresAt: claims.exp * 1000 + REPLAY_RECORD_PADDING_MS,
+    });
+}
+/**
+ * Exchanges a CI identity token for a short-lived Harper operation token. Unauthenticated by design —
+ * this operation *is* the authentication, the way create_authentication_tokens is against a password.
+ */
+async function exchangeOidcToken(req) {
+    const validation = (0, validationWrapper_ts_1.validateBySchema)(req, joi_1.default.object({ token: joi_1.default.string().min(1).max(MAX_TOKEN_LENGTH).required() }).unknown(true));
+    if (validation)
+        throw new hdbError_ts_1.ClientError(validation.message);
+    // Populated as identification progresses so a failure audits with whatever was established.
+    const audit = {};
+    let username;
+    try {
+        // Nothing is trusted from this decode; it only selects candidate policies, and the signature
+        // is then checked against the issuer those policies declare.
+        const unverified = jsonwebtoken_1.default.decode(req.token, { complete: true });
+        let issuer;
+        try {
+            issuer = (0, jwks_ts_1.normalizeIssuer)(unverified?.payload?.iss);
+        }
+        catch {
+            (0, identityToken_ts_1.rejectToken)('token has no usable iss claim');
+        }
+        audit.issuer = issuer;
+        const profile = (0, index_ts_1.profileForIssuer)(issuer);
+        audit.provider = profile.name;
+        const policies = await (0, trustPolicyOperations_ts_1.loadEnabledPolicies)(issuer);
+        if (policies.length === 0)
+            (0, identityToken_ts_1.rejectToken)(`no enabled trust policy for issuer ${issuer}`);
+        const matched = await findMatchingPolicy(req.token, issuer, policies, profile);
+        if (!matched)
+            (0, identityToken_ts_1.rejectToken)(`no trust policy matched a token from ${issuer}`);
+        const { policy, claims } = matched;
+        audit.oidc_policy = policy.id;
+        audit.principal = profile.describePrincipal(claims);
+        // Resolved before the token is spent, so a policy naming a deleted or deactivated user fails
+        // without burning a token the runner cannot re-mint.
+        const users = await (0, user_ts_1.getUsersWithRolesCache)();
+        const user = users?.get(policy.user);
+        if (!user)
+            (0, identityToken_ts_1.rejectToken)(`trust policy '${policy.id}' names user '${policy.user}', which does not exist`);
+        if (user.active === false)
+            (0, identityToken_ts_1.rejectToken)(`trust policy '${policy.id}' names inactive user '${policy.user}'`);
+        username = user.username;
+        const fingerprint = tokenFingerprint(req.token);
+        audit.token_fingerprint = fingerprint.slice(0, 12);
+        await recordTokenUse(fingerprint, claims, policy.id);
+        const operationToken = await (0, tokenAuthentication_ts_1.createOperationToken)({
+            username: user.username,
+            super_user: user.role?.permission?.super_user === true,
+            operations: policy.operations,
+        }, EXCHANGED_TOKEN_LIFETIME_SECONDS);
+        if (policy.operations?.length)
+            audit.scoped_operations = policy.operations;
+        logger.info?.(`OIDC exchange: policy '${policy.id}' authenticated '${user.username}' for ${audit.principal}`);
+        auditExchangeSafely(req, username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS, audit);
+        return {
+            operation_token: operationToken,
+            expires_in: EXCHANGED_TOKEN_LIFETIME_SECONDS,
+            username: user.username,
+            policy: policy.id,
+        };
+    }
+    catch (error) {
+        auditExchangeSafely(req, username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.FAILURE, audit);
+        throw error;
+    }
+}
+//# sourceMappingURL=tokenExchange.js.map

package/dist/security/authn/oidc/tokenExchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../../../security/authn/oidc/tokenExchange.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4Db,0DAEC;AAwKD,8CAqEC;AAzSD,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,2EAA2E;AAE3E,gEAA+B;AAC/B,8CAAsB;AACtB,6CAAyC;AACzC,kEAAoE;AACpE,qEAAkE;AAClE,mFAA4E;AAC5E,kEAAmE;AACnE,iGAAqE;AACrE,wFAA0E;AAC1E,8DAAkG;AAClG,2CAAuD;AACvD,yEAAoE;AACpE,yDAAsE;AACtE,2CAAqD;AACrD,uCAA4C;AAC5C,mDAAsF;AACtF,yEAAiE;AAGjE,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,0BAAY,CAAC;AACtC,8FAA8F;AAC9F,6FAA6F;AAC7F,MAAM,YAAY,GAAG,0BAAY,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAEvF,qGAAqG;AACrG,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAE9C,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,IAAI,aAAkB,CAAC;AAEvB,4FAA4F;AAC5F,SAAgB,uBAAuB;IACtC,aAAa,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB;IACxB,8FAA8F;IAC9F,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,8CAA8C;IAC9C,aAAa,KAAK,IAAA,oBAAK,EAAQ;QAC9B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,QAAQ;QAClB,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,+FAA+F;QAC/F,2FAA2F;QAC3F,KAAK,EAAE,IAAI;QACX,UAAU,EAAE;YACX,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAClC,EAAE,IAAI,EAAE,WAAW,EAAE;YACrB,EAAE,IAAI,EAAE,SAAS,EAAE;YACnB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;SACrD;KACD,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IAC7G,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;IAC5F,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;IACpF,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO;IAE/E,gGAAgG;IAChG,+EAA+E;IAC/E,MAAM,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;IACrC,MAAM,GAAG,GAAQ,IAAK,YAAoB,CACzC,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc;IAC/B,yFAAyF;IACzF,4FAA4F;IAC5F,2FAA2F;IAC3F,WAAW,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,WAAW,EAAE,EAAE,EAC5D,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,QAAQ,CACrB,CAAC;IACF,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;QAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;QAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAQ,EAAE,QAA4B,EAAE,MAAc,EAAE,MAA+B;IACnH,IAAI,CAAC;QACJ,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,kBAAkB,CAChC,KAAa,EACb,MAAc,EACd,QAA2B,EAC3B,OAAgC;IAEhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,CAAC;YACJ,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS;QACV,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,yFAAyF;YACzF,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,6EAA6E;YAC7E,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAmB,EAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxG,MAAM,CAAC,IAAI,EAAE,CACZ,mCAAmC,MAAM,CAAC,EAAE,gBAAgB,MAAM,CAAC,QAAQ,OAAQ,KAAe,CAAC,OAAO,EAAE,CAC5G,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,QAAQ,GAAG,IAAA,kCAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,CAAC,iBAAiB,MAAM,CAAC,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACtC,gGAAgG;IAChG,4FAA4F;IAC5F,uFAAuF;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,MAAmB,EAAE,QAAgB;IACvF,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,IAAA,8BAAW,EAAC,SAAS,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAEjH,MAAM,QAAQ,CAAC,GAAG,CAAC;QAClB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;QACnB,SAAS,EAAG,MAAM,CAAC,GAAc,GAAG,IAAI,GAAG,wBAAwB;KACnE,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAQ;IAC/C,MAAM,UAAU,GAAG,IAAA,uCAAgB,EAClC,GAAG,EACH,aAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACzF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,yBAAe,EAAE,UAAU,EAAE,OAAe,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACR,IAAA,8BAAW,EAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,OAAO,GAAG,IAAA,2BAAgB,EAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAA,8CAAmB,EAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,IAAA,8BAAW,EAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,IAAA,8BAAW,EAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAEpD,6FAA6F;QAC7F,qDAAqD;QACrD,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAsB,GAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,iBAAiB,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,IAAA,8BAAW,EAAC,iBAAiB,MAAM,CAAC,EAAE,0BAA0B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3G,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,IAAA,6CAAoB,EAChD;YACC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,KAAK,IAAI;YACtD,UAAU,EAAE,MAAM,CAAC,UAAU;SAC7B,EACD,gCAAgC,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM;YAAE,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC;QAE3E,MAAM,CAAC,IAAI,EAAE,CAAC,0BAA0B,MAAM,CAAC,EAAE,oBAAoB,IAAI,CAAC,QAAQ,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAErE,OAAO;YACN,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,gCAAgC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,EAAE;SACjB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC"}

package/dist/security/authn/oidc/trustPolicyOperations.d.ts

@@ -0,0 +1,49 @@
+import type { OidcTrustPolicy } from './types.ts';
+/**
+ * Why a stored row must not be honored, or undefined if it is usable.
+ *
+ * add_oidc_trust enforces all of this at write time, but a row can reach the table another way —
+ * replication from a node predating a check, a restored backup, a direct write to the system table —
+ * so the exchange re-runs the same validators rather than trusting that every row was validated when
+ * written. Two shapes in particular fail OPEN if merely normalized instead of rejected:
+ *
+ *   operations: 'deploy_component'  — a scalar rather than an array. hasOperationScope tests
+ *     Array.isArray, so the scope is silently dropped and the token is minted UNSCOPED, carrying the
+ *     policy user's entire role. A malformed narrowing must never widen.
+ *   enabled: 'false'                — a string. `row.enabled !== false` is true for it, so a policy
+ *     an operator meant to disable keeps minting tokens.
+ *
+ * Shares validateOperations and validateClaimConstraintShape with the add path deliberately: two
+ * implementations of "is this row valid" is how the write path and the read path drift apart.
+ */
+export declare function storedPolicyProblem(row: any): string | undefined;
+/**
+ * The policies the exchange will consider, narrowed to one issuer.
+ *
+ * Filtered inside the scan rather than by the caller: the exchange is unauthenticated and reaches
+ * here having done nothing but `jwt.decode`, so an anonymous caller presenting any syntactically
+ * valid JWT would otherwise drive a `toRecord()` allocation for every stored policy before anything
+ * has been verified. The scan itself stays — the table is administrator-sized, and an index here
+ * would buy little (see readPolicies) — but non-matching rows now cost nothing beyond the compare.
+ *
+ * A missing table yields no policies rather than throwing. On a node where the upgrade directive has
+ * not run, trustTable()'s descriptive ClientError would surface to an anonymous caller as a 400 with
+ * a body unlike the uniform 401 every other rejection returns, which both leaks node state and
+ * breaks the single-message property. The SU-only add/list/drop handlers still get that error, where
+ * it is the useful thing to say.
+ */
+export declare function loadEnabledPolicies(issuer: string): Promise<OidcTrustPolicy[]>;
+/**
+ * Creates or replaces a trust policy.
+ *
+ * Replace rather than merge: a partial update to a claim set is how an over-broad policy gets
+ * created by accident, and the whole point of `claims` is that every constraint in it was written
+ * deliberately.
+ */
+export declare function addOidcTrust(req: any): Promise<Record<string, unknown>>;
+export declare function listOidcTrust(req: any): Promise<{
+    policies: OidcTrustPolicy[];
+}>;
+export declare function dropOidcTrust(req: any): Promise<{
+    message: string;
+}>;