@indigoai-us/hq-cloud 6.18.44-alpha.8 → 6.18.44

package/dist/outposts/session-host-auth.test.js

@@ -1,284 +0,0 @@
-/**
- * Tests for who may talk to the session host.
- *
- * The desktop app opens every connection with the person's HQ ID token. The
- * host checks it the way any careful server would — signature against the
- * user pool's published keys, issuer, expiry, and that it is an ID token — and
- * then that it belongs to the box's owner. It needs no new dependency: Node's
- * own crypto verifies RS256.
- *
- * The box learns its owner and user pool from its OWN cached sign-in. An
- * Outpost signs in as a machine identity whose token names the owning person in
- * `custom:delegatedSub`; older boxes hold the person's own token. A company
- * agent box has no human owner, so nobody may drive sessions on it this way.
- */
-import { createSign, generateKeyPairSync } from "node:crypto";
-import { describe, expect, it } from "vitest";
-import { createCognitoIdTokenVerifier, resolveBoxIdentity, } from "./session-host-auth";
-const ISSUER = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_TestPool1";
-const OWNER_SUB = "11111111-2222-3333-4444-555555555555";
-const START_MS = Date.parse("2026-09-12T00:00:00.000Z");
-const START_S = Math.floor(START_MS / 1000);
-function makeKey(kid) {
-    const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
-    const exported = publicKey.export({ format: "jwk" });
-    return {
-        kid,
-        privateKey,
-        jwk: { kty: "RSA", n: String(exported.n), e: String(exported.e), kid, alg: "RS256", use: "sig" },
-    };
-}
-const KEY_A = makeKey("kid-a");
-const KEY_B = makeKey("kid-b");
-const IMPOSTOR = makeKey("kid-a"); // same key id as KEY_A, different key
-function b64url(input) {
-    return Buffer.from(input).toString("base64url");
-}
-function sign(claims, options = {}) {
-    const key = options.key ?? KEY_A;
-    const header = { alg: "RS256", kid: key.kid, ...options.header };
-    const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(claims))}`;
-    const signature = createSign("RSA-SHA256").update(input).sign(key.privateKey);
-    return `${input}.${b64url(signature)}`;
-}
-function idClaims(overrides = {}) {
-    return {
-        sub: OWNER_SUB,
-        email: "owner@example.com",
-        iss: ISSUER,
-        aud: "desktopclient123",
-        token_use: "id",
-        iat: START_S - 60,
-        exp: START_S + 3000,
-        ...overrides,
-    };
-}
-/** A fake JWKS endpoint whose key set can rotate or fail on demand. */
-function keyServer(initial) {
-    let keys = initial;
-    let failures = 0;
-    const urls = [];
-    return {
-        urls,
-        rotate(next) {
-            keys = next;
-        },
-        failNext(count = 1) {
-            failures = count;
-        },
-        fetchJwks: async (url) => {
-            urls.push(url);
-            if (failures > 0) {
-                failures -= 1;
-                throw new Error("getaddrinfo ENOTFOUND cognito-idp.us-east-1.amazonaws.com");
-            }
-            return { keys };
-        },
-    };
-}
-function setup(options = {}) {
-    const server = keyServer(options.keys ?? [KEY_A.jwk]);
-    let nowMs = START_MS;
-    const verify = createCognitoIdTokenVerifier({
-        issuer: ISSUER,
-        fetchJwks: server.fetchJwks,
-        now: () => nowMs,
-        audiences: options.audiences,
-    });
-    return {
-        verify,
-        server,
-        advance(ms) {
-            nowMs += ms;
-        },
-    };
-}
-describe("createCognitoIdTokenVerifier", () => {
-    it("accepts a valid ID token and says whose it is", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims()))).resolves.toEqual({
-            ok: true,
-            identity: { sub: OWNER_SUB, email: "owner@example.com" },
-        });
-    });
-    it("fetches the signing keys from the issuer's well-known address, once", async () => {
-        const { verify, server } = setup();
-        await verify(sign(idClaims()));
-        await verify(sign(idClaims({ email: "second@example.com" })));
-        expect(server.urls).toEqual([`${ISSUER}/.well-known/jwks.json`]);
-    });
-    it("refuses a token signed by a different key that claims the same key id", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims(), { key: IMPOSTOR }))).resolves.toEqual({
-            ok: false,
-            reason: "bad-signature",
-        });
-    });
-    it("refuses a token whose claims were edited after signing", async () => {
-        const { verify } = setup();
-        const [header, , signature] = sign(idClaims()).split(".");
-        const forged = `${header}.${b64url(JSON.stringify(idClaims({ sub: "someone-else" })))}.${signature}`;
-        await expect(verify(forged)).resolves.toEqual({ ok: false, reason: "bad-signature" });
-    });
-    it("refuses unsigned and shared-secret tokens outright", async () => {
-        const { verify } = setup();
-        const unsigned = `${b64url(JSON.stringify({ alg: "none", kid: "kid-a" }))}.${b64url(JSON.stringify(idClaims()))}.`;
-        await expect(verify(unsigned)).resolves.toEqual({ ok: false, reason: "bad-algorithm" });
-        await expect(verify(sign(idClaims(), { header: { alg: "HS256" } }))).resolves.toEqual({
-            ok: false,
-            reason: "bad-algorithm",
-        });
-    });
-    it("allows a minute of clock skew on expiry, and no more", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims({ exp: START_S - 30 })))).resolves.toMatchObject({ ok: true });
-        await expect(verify(sign(idClaims({ exp: START_S - 120 })))).resolves.toEqual({
-            ok: false,
-            reason: "expired",
-        });
-    });
-    it("refuses a token issued in the future beyond the skew", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims({ iat: START_S + 600 })))).resolves.toEqual({
-            ok: false,
-            reason: "not-yet-valid",
-        });
-    });
-    it("refuses a token from another user pool", async () => {
-        const { verify } = setup();
-        const other = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_SomeoneElse";
-        await expect(verify(sign(idClaims({ iss: other })))).resolves.toEqual({
-            ok: false,
-            reason: "wrong-issuer",
-        });
-    });
-    it("refuses an access token — only ID tokens are accepted", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims({ token_use: "access" })))).resolves.toEqual({
-            ok: false,
-            reason: "wrong-token-use",
-        });
-    });
-    it("checks the audience only when an allowlist is configured", async () => {
-        await expect(setup().verify(sign(idClaims({ aud: "any-client" })))).resolves.toMatchObject({
-            ok: true,
-        });
-        const strict = setup({ audiences: ["desktopclient123"] });
-        await expect(strict.verify(sign(idClaims()))).resolves.toMatchObject({ ok: true });
-        await expect(strict.verify(sign(idClaims({ aud: "other-client" })))).resolves.toEqual({
-            ok: false,
-            reason: "wrong-audience",
-        });
-    });
-    it("refuses a token without a subject", async () => {
-        const { verify } = setup();
-        await expect(verify(sign(idClaims({ sub: undefined })))).resolves.toEqual({
-            ok: false,
-            reason: "malformed",
-        });
-    });
-    it.each([
-        "",
-        "abc",
-        "a.b",
-        "a.b.c",
-        `${b64url("{}")}.${b64url("not json")}.sig`,
-        `${b64url("[]")}.${b64url("{}")}.sig`,
-    ])("refuses a token that is not three base64url JSON parts: %j", async (token) => {
-        const { verify } = setup();
-        await expect(verify(token)).resolves.toEqual({ ok: false, reason: "malformed" });
-    });
-    it("picks up a rotated key by fetching the key set again", async () => {
-        const { verify, server, advance } = setup();
-        await verify(sign(idClaims()));
-        server.rotate([KEY_A.jwk, KEY_B.jwk]);
-        advance(61_000);
-        await expect(verify(sign(idClaims(), { key: KEY_B }))).resolves.toMatchObject({ ok: true });
-        expect(server.urls).toHaveLength(2);
-    });
-    it("rate-limits fetches caused by unknown key ids", async () => {
-        const { verify, server } = setup();
-        await verify(sign(idClaims()));
-        const stranger = makeKey("kid-unknown");
-        await expect(verify(sign(idClaims(), { key: stranger }))).resolves.toEqual({
-            ok: false,
-            reason: "unknown-key",
-        });
-        await expect(verify(sign(idClaims(), { key: stranger }))).resolves.toEqual({
-            ok: false,
-            reason: "unknown-key",
-        });
-        expect(server.urls).toHaveLength(1);
-    });
-    it("reports an unreachable key server as a refusal, and tries again next time", async () => {
-        const { verify, server } = setup();
-        server.failNext();
-        await expect(verify(sign(idClaims()))).resolves.toEqual({
-            ok: false,
-            reason: "jwks-unavailable",
-        });
-        await expect(verify(sign(idClaims()))).resolves.toMatchObject({ ok: true });
-        expect(server.urls).toHaveLength(2);
-    });
-    it("never repeats the token back in a refusal", async () => {
-        const { verify } = setup();
-        const token = sign(idClaims(), { key: IMPOSTOR });
-        const verdict = await verify(token);
-        expect(verdict.ok).toBe(false);
-        expect(JSON.stringify(verdict)).not.toContain(token.split(".")[2]);
-    });
-});
-/** The box's own cached ID token — read locally, so it is decoded, not verified. */
-function boxToken(claims) {
-    return `${b64url(JSON.stringify({ alg: "RS256", kid: "kid-a" }))}.${b64url(JSON.stringify(claims))}.sig`;
-}
-describe("resolveBoxIdentity", () => {
-    const outpostClaims = {
-        sub: "machine-sub-0000",
-        iss: ISSUER,
-        token_use: "id",
-        "custom:entityType": "outpost",
-        "custom:entityUid": "out_01JOUTPOST00000000000000",
-        "custom:delegatedSub": OWNER_SUB,
-        "custom:delegatedEmail": "owner@example.com",
-    };
-    it("takes the owner from an Outpost machine token's delegated subject", () => {
-        expect(resolveBoxIdentity(boxToken(outpostClaims))).toEqual({
-            ok: true,
-            ownerSub: OWNER_SUB,
-            issuer: ISSUER,
-        });
-    });
-    it("finds no owner on an Outpost machine token without a delegated subject", () => {
-        const { "custom:delegatedSub": _dropped, ...claims } = outpostClaims;
-        expect(resolveBoxIdentity(boxToken(claims))).toEqual({ ok: false, reason: "no-owner" });
-    });
-    it("finds no owner on a company agent box", () => {
-        const claims = {
-            sub: "machine-sub-1111",
-            iss: ISSUER,
-            token_use: "id",
-            "custom:entityType": "agent",
-            "custom:entityUid": "agt_01J9AGENT0000000000000000",
-        };
-        expect(resolveBoxIdentity(boxToken(claims))).toEqual({ ok: false, reason: "no-owner" });
-    });
-    it("takes the owner from a person's own token on older boxes", () => {
-        expect(resolveBoxIdentity(boxToken({ sub: OWNER_SUB, iss: ISSUER, token_use: "id" }))).toEqual({ ok: true, ownerSub: OWNER_SUB, issuer: ISSUER });
-    });
-    it.each([undefined, "", "not-a-token", "a.b.c"])("reports a box that is not signed in: %j", (token) => {
-        expect(resolveBoxIdentity(token)).toEqual({ ok: false, reason: "not-signed-in" });
-    });
-    it.each([
-        "https://evil.example.com/us-east-1_TestPool1",
-        "http://cognito-idp.us-east-1.amazonaws.com/us-east-1_TestPool1",
-        "https://cognito-idp.us-east-1.amazonaws.com.evil.example/us-east-1_TestPool1",
-        "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_TestPool1/../other",
-    ])("refuses an issuer that is not a Cognito user pool: %s", (iss) => {
-        expect(resolveBoxIdentity(boxToken({ ...outpostClaims, iss }))).toEqual({
-            ok: false,
-            reason: "bad-issuer",
-        });
-    });
-});
-//# sourceMappingURL=session-host-auth.test.js.map

package/dist/outposts/session-host-auth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-host-auth.test.js","sourceRoot":"","sources":["../../src/outposts/session-host-auth.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,GAAG,iEAAiE,CAAC;AACjF,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAQ5C,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,GAAG;QACH,UAAU;QACV,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC;AAEzE,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAA+D,EAAE;IAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9E,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,YAAqC,EAAE;IACvD,OAAO;QACL,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,mBAAmB;QAC1B,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,kBAAkB;QACvB,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,OAAO,GAAG,EAAE;QACjB,GAAG,EAAE,OAAO,GAAG,IAAI;QACnB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,OAAc;IAC/B,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,IAAW;YAChB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,CAAC;YAChB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,CAAC,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,UAAkD,EAAE;IACjE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,QAAQ,CAAC;IACrB,MAAM,MAAM,GAAG,4BAA4B,CAAC;QAC1C,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,MAAM;QACN,OAAO,CAAC,EAAU;YAChB,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,AAAD,EAAG,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;QAErG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC;QAEnH,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpF,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC5E,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC5E,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,mEAAmE,CAAC;QAElF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7E,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpF,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,EAAE;QACF,KAAK;QACL,KAAK;QACL,OAAO;QACP,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM;QAC3C,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;KACtC,CAAC,CAAC,4DAA4D,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAE3B,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,oFAAoF;AACpF,SAAS,QAAQ,CAAC,MAA+B;IAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAC3G,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,kBAAkB;QACvB,GAAG,EAAE,MAAM;QACX,SAAS,EAAE,IAAI;QACf,mBAAmB,EAAE,SAAS;QAC9B,kBAAkB,EAAE,8BAA8B;QAClD,qBAAqB,EAAE,SAAS;QAChC,uBAAuB,EAAE,mBAAmB;KAC7C,CAAC;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1D,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;QAErE,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,kBAAkB;YACvB,GAAG,EAAE,MAAM;YACX,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,OAAO;YAC5B,kBAAkB,EAAE,+BAA+B;SACpD,CAAC;QAEF,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CACJ,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/E,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAC9C,yCAAyC,EACzC,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC;QACN,8CAA8C;QAC9C,gEAAgE;QAChE,8EAA8E;QAC9E,0EAA0E;KAC3E,CAAC,CAAC,uDAAuD,EAAE,CAAC,GAAG,EAAE,EAAE;QAClE,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/session-host-command.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Tests for `hq outposts session-host` — the box-side service entry point.
- *
- * It is hidden (it runs under systemd, not by hand), always listens on
- * loopback, and refuses to start unless the box is signed in to HQ with a
- * known owner — otherwise nobody could ever pass the hello check, and a
- * service that can never be used is better reported than left running.
- */
-export {};
-//# sourceMappingURL=session-host-command.test.d.ts.map

package/dist/outposts/session-host-command.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-host-command.test.d.ts","sourceRoot":"","sources":["../../src/outposts/session-host-command.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/outposts/session-host-command.test.js

@@ -1,180 +0,0 @@
-/**
- * Tests for `hq outposts session-host` — the box-side service entry point.
- *
- * It is hidden (it runs under systemd, not by hand), always listens on
- * loopback, and refuses to start unless the box is signed in to HQ with a
- * known owner — otherwise nobody could ever pass the hello check, and a
- * service that can never be used is better reported than left running.
- */
-import { Command } from "commander";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { createCognitoIdTokenVerifier } from "./session-host-auth";
-import { fetchSessionHostJwks, readBoxIdToken, registerSessionHostCommand, resolveSessionHostConfig, SESSION_HOST_JWKS_TIMEOUT_MS, } from "./session-host-command";
-import { DEFAULT_SESSION_HOST_PORT } from "./session-host-protocol";
-const ISSUER = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_TestPool1";
-const OWNER_SUB = "11111111-2222-3333-4444-555555555555";
-const HOME = "/home/ec2-user";
-afterEach(() => {
-    vi.restoreAllMocks();
-});
-function b64url(input) {
-    return Buffer.from(input).toString("base64url");
-}
-function idToken(claims) {
-    return `${b64url(JSON.stringify({ alg: "RS256", kid: "k" }))}.${b64url(JSON.stringify(claims))}.sig`;
-}
-const OUTPOST_TOKEN = idToken({
-    sub: "machine-sub-0000",
-    iss: ISSUER,
-    token_use: "id",
-    "custom:entityType": "outpost",
-    "custom:entityUid": "out_01JOUTPOST00000000000000",
-    "custom:delegatedSub": OWNER_SUB,
-});
-const AGENT_TOKEN = idToken({
-    sub: "machine-sub-1111",
-    iss: ISSUER,
-    token_use: "id",
-    "custom:entityType": "agent",
-    "custom:entityUid": "agt_01J9AGENT0000000000000000",
-});
-describe("resolveSessionHostConfig", () => {
-    it("defaults to loopback, the fixed port, and the box's HQ folder", () => {
-        expect(resolveSessionHostConfig({ idToken: OUTPOST_TOKEN, home: HOME, env: {} })).toEqual({
-            ok: true,
-            ownerSub: OWNER_SUB,
-            issuer: ISSUER,
-            host: "127.0.0.1",
-            port: DEFAULT_SESSION_HOST_PORT,
-            defaultCwd: "/home/ec2-user/hq",
-        });
-    });
-    it("uses HQ_ROOT for the default folder when it is set", () => {
-        expect(resolveSessionHostConfig({ idToken: OUTPOST_TOKEN, home: HOME, env: { HQ_ROOT: "/data/hq" } })).toMatchObject({ ok: true, defaultCwd: "/data/hq" });
-    });
-    it("takes a port and a folder from the command line", () => {
-        expect(resolveSessionHostConfig({
-            idToken: OUTPOST_TOKEN,
-            home: HOME,
-            env: {},
-            port: "47900",
-            cwd: "/home/ec2-user/work",
-        })).toMatchObject({ ok: true, port: 47900, defaultCwd: "/home/ec2-user/work" });
-    });
-    it.each(["0", "65536", "abc", "22.5", "-1", "", "47821abc"])("refuses the port %j", (port) => {
-        const result = resolveSessionHostConfig({ idToken: OUTPOST_TOKEN, home: HOME, env: {}, port });
-        expect(result.ok).toBe(false);
-        if (!result.ok)
-            expect(result.message).toMatch(/port/i);
-    });
-    it("refuses a folder that is not an absolute path", () => {
-        const result = resolveSessionHostConfig({ idToken: OUTPOST_TOKEN, home: HOME, env: {}, cwd: "hq" });
-        expect(result.ok).toBe(false);
-        if (!result.ok)
-            expect(result.message).toMatch(/folder/i);
-    });
-    it("refuses to start on a box that is not signed in", () => {
-        const result = resolveSessionHostConfig({ idToken: undefined, home: HOME, env: {} });
-        expect(result.ok).toBe(false);
-        if (!result.ok)
-            expect(result.message).toMatch(/sign/i);
-    });
-    it("refuses to start on a box with no owner, without printing its token", () => {
-        const result = resolveSessionHostConfig({ idToken: AGENT_TOKEN, home: HOME, env: {} });
-        expect(result.ok).toBe(false);
-        if (!result.ok) {
-            expect(result.message).toMatch(/owner/i);
-            expect(result.message).not.toContain(AGENT_TOKEN.split(".")[1]);
-        }
-    });
-});
-describe("readBoxIdToken", () => {
-    const PERSON_TOKEN = idToken({ sub: OWNER_SUB, iss: ISSUER, token_use: "id" });
-    const none = () => null;
-    it("uses the box's personal sign-in when it has one", async () => {
-        expect(await readBoxIdToken({
-            person: () => ({ idToken: PERSON_TOKEN }),
-            isMachine: () => true,
-            machine: async () => {
-                throw new Error("should not sign the machine in when a person is signed in");
-            },
-        })).toBe(PERSON_TOKEN);
-    });
-    it("falls back to the outpost's checked machine sign-in, which names the box's owner", async () => {
-        const token = await readBoxIdToken({
-            person: none,
-            isMachine: () => true,
-            machine: async () => ({ idToken: OUTPOST_TOKEN }),
-        });
-        expect(token).toBe(OUTPOST_TOKEN);
-        expect(resolveSessionHostConfig({ idToken: token, home: HOME, env: {} })).toMatchObject({ ok: true, ownerSub: OWNER_SUB });
-    });
-    it("is undefined when the box has no sign-in of either kind, or the machine sign-in fails", async () => {
-        expect(await readBoxIdToken({ person: none, isMachine: () => false, machine: async () => ({ idToken: OUTPOST_TOKEN }) })).toBeUndefined();
-        expect(await readBoxIdToken({
-            person: none,
-            isMachine: () => true,
-            machine: async () => {
-                throw new Error("network down");
-            },
-        })).toBeUndefined();
-    });
-});
-describe("registerSessionHostCommand", () => {
-    it("adds a hidden session-host command under outposts", () => {
-        const program = new Command();
-        const outposts = program.command("outposts");
-        registerSessionHostCommand(outposts, { version: "test" });
-        const command = outposts.commands.find((c) => c.name() === "session-host");
-        expect(command).toBeDefined();
-        expect(outposts.helpInformation()).not.toContain("session-host");
-        expect(command?.options.map((o) => o.long)).toEqual(expect.arrayContaining(["--port", "--cwd"]));
-    });
-});
-describe("session-host JWKS deadline", () => {
-    it("returns jwks-unavailable when the signing-key fetch stalls", async () => {
-        const timeoutController = new AbortController();
-        const timeoutSpy = vi
-            .spyOn(AbortSignal, "timeout")
-            .mockReturnValue(timeoutController.signal);
-        const fetchSpy = vi.spyOn(globalThis, "fetch").mockImplementation(async (_url, init) => {
-            expect(init?.signal).toBe(timeoutController.signal);
-            return new Promise((_resolve, reject) => {
-                init?.signal?.addEventListener("abort", () => reject(init.signal?.reason), { once: true });
-            });
-        });
-        const verify = createCognitoIdTokenVerifier({ issuer: ISSUER, fetchJwks: fetchSessionHostJwks });
-        const pending = verify(OUTPOST_TOKEN);
-        await vi.waitFor(() => expect(fetchSpy).toHaveBeenCalledOnce());
-        timeoutController.abort(new DOMException("The operation timed out", "TimeoutError"));
-        await expect(pending).resolves.toEqual({ ok: false, reason: "jwks-unavailable" });
-        expect(timeoutSpy).toHaveBeenCalledWith(SESSION_HOST_JWKS_TIMEOUT_MS);
-    });
-    it("returns jwks-unavailable when reading the signing-key body stalls", async () => {
-        const timeoutController = new AbortController();
-        const timeoutSpy = vi
-            .spyOn(AbortSignal, "timeout")
-            .mockReturnValue(timeoutController.signal);
-        let jsonReadStarted = false;
-        const fetchSpy = vi.spyOn(globalThis, "fetch").mockImplementation(async (_url, init) => {
-            expect(init?.signal).toBe(timeoutController.signal);
-            const signal = init?.signal;
-            const response = new Response(null, { status: 200 });
-            vi.spyOn(response, "json").mockImplementation(() => new Promise((_resolve, reject) => {
-                jsonReadStarted = true;
-                signal?.addEventListener("abort", () => reject(signal.reason), { once: true });
-            }));
-            return response;
-        });
-        const verify = createCognitoIdTokenVerifier({ issuer: ISSUER, fetchJwks: fetchSessionHostJwks });
-        const pending = verify(OUTPOST_TOKEN);
-        await vi.waitFor(() => {
-            expect(fetchSpy).toHaveBeenCalledOnce();
-            expect(jsonReadStarted).toBe(true);
-        });
-        timeoutController.abort(new DOMException("The operation timed out", "TimeoutError"));
-        await expect(pending).resolves.toEqual({ ok: false, reason: "jwks-unavailable" });
-        expect(timeoutSpy).toHaveBeenCalledWith(SESSION_HOST_JWKS_TIMEOUT_MS);
-    });
-});
-//# sourceMappingURL=session-host-command.test.js.map

package/dist/outposts/session-host-command.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-host-command.test.js","sourceRoot":"","sources":["../../src/outposts/session-host-command.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,MAAM,GAAG,iEAAiE,CAAC;AACjF,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,MAA+B;IAC9C,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AACvG,CAAC;AAED,MAAM,aAAa,GAAG,OAAO,CAAC;IAC5B,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,SAAS;IAC9B,kBAAkB,EAAE,8BAA8B;IAClD,qBAAqB,EAAE,SAAS;CACjC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,OAAO,CAAC;IAC1B,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,OAAO;IAC5B,kBAAkB,EAAE,+BAA+B;CACpD,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACxF,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,yBAAyB;YAC/B,UAAU,EAAE,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,wBAAwB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAC/F,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CACJ,wBAAwB,CAAC;YACvB,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,qBAAqB;SAC3B,CAAC,CACH,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3F,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAErF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAExB,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CACJ,MAAM,cAAc,CAAC;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACzC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;YACrB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC,CACH,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;YACjC,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;YACrB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,CACJ,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAClH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CACJ,MAAM,cAAc,CAAC;YACnB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;YACrB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC;SACF,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE7C,0BAA0B,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,cAAc,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CACjD,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,EAAE;aAClB,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;aAC7B,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACrF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,IAAI,OAAO,CAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAChD,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAC5B,OAAO,EACP,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEjG,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChE,iBAAiB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,EAAE;aAClB,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;aAC7B,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACrF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAC3C,GAAG,EAAE,CACH,IAAI,OAAO,CAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACxC,eAAe,GAAG,IAAI,CAAC;gBACvB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC,CAAC,CACL,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEjG,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC;YACxC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,iBAAiB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/session-host-connection.test.d.ts

@@ -1,18 +0,0 @@
-/**
- * Tests for one desktop connection to the session host.
- *
- * The host listens on the box's loopback address, reached only through the
- * Outpost's private port-forward. On the Mac that forward is a localhost port,
- * and a web page in a browser can send requests to localhost too. So the very
- * first line must be a JSON hello carrying the person's HQ sign-in, and nothing
- * else happens until it checks out:
- *   - a browser's HTTP request, or anything that is not a hello, is refused and
- *     the connection closed before any session is touched;
- *   - a valid sign-in that belongs to someone other than the box's owner is
- *     refused;
- *   - a connection that never says hello is closed.
- * After that, one connection can drive several sessions at once, and closing
- * it never stops a session.
- */
-export {};
-//# sourceMappingURL=session-host-connection.test.d.ts.map

package/dist/outposts/session-host-connection.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-host-connection.test.d.ts","sourceRoot":"","sources":["../../src/outposts/session-host-connection.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}