@kindgi/api 0.1.4 → 0.1.5

package/dist/service-account-binding.d.ts

@@ -0,0 +1,108 @@
+import type { ProjectRole } from '@kindgi/platform';
+import type { Cursor, Result, TenantId, Timestamp } from '@kindgi/types';
+/**
+ * Service accounts: named, non-human principals (`service_account:<id>`)
+ * for an app, a pipeline or a schedule's runs. A service account holds
+ * its own grants, set when it's created and changed by a tenant admin,
+ * and acts through API keys minted for it (`POST /v1/tokens` with `for`),
+ * several at once for rotation. Every route needs a tenant admin.
+ *
+ * Grants are written before a call answers, so a key minted for a new
+ * account works on its first request. Unregistering an account is a
+ * tombstone: its grants go, its keys stop working, and it stays readable.
+ */
+/**
+ * What a service account may do: tenant admin, tenant member (read the
+ * tenant's settings), or a role on one project. Unlike a person, an
+ * account isn't a tenant member unless it's granted that.
+ */
+export type ServiceAccountGrant = {
+    readonly kind: 'tenant-admin';
+} | {
+    readonly kind: 'tenant-member';
+} | {
+    readonly kind: 'project';
+    readonly projectId: string;
+    readonly role: ProjectRole;
+};
+/** A grant to remove: tenant admin, tenant member, or whatever role the account has on a project. */
+export type ServiceAccountGrantTarget = {
+    readonly kind: 'tenant-admin';
+} | {
+    readonly kind: 'tenant-member';
+} | {
+    readonly kind: 'project';
+    readonly projectId: string;
+};
+export interface ServiceAccount {
+    readonly serviceAccountId: string;
+    readonly tenantId: TenantId;
+    /** Unique among the tenant's active accounts, e.g. `acme-ci`. */
+    readonly name: string;
+    readonly description?: string;
+    /** Its grants, at the time of the read. */
+    readonly grants: readonly ServiceAccountGrant[];
+    /** Who created it: `user:<id>` or `service_account:<id>`. */
+    readonly createdBy?: string;
+    readonly createdAt: Timestamp;
+    /** Set once unregistered: no grants, and its keys no longer work. */
+    readonly unregisteredAt?: Timestamp;
+}
+export interface ServiceAccountCreateInput {
+    readonly tenantId: TenantId;
+    readonly name: string;
+    readonly description?: string;
+    /** Written with the account, before `create` returns. */
+    readonly grants: readonly ServiceAccountGrant[];
+    readonly createdBy?: string;
+}
+export interface ServiceAccountRef {
+    readonly tenantId: TenantId;
+    readonly serviceAccountId: string;
+}
+/** A change to an account, and who made it: `user:<id>` or `service_account:<id>`. */
+export interface ServiceAccountChange extends ServiceAccountRef {
+    readonly by?: string;
+}
+export interface ServiceAccountListInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    /** Unregistered accounts too (default: active only). */
+    readonly includeUnregistered?: boolean;
+}
+export type ServiceAccountErrorCode = 
+/** An active account of the tenant already has this name. */
+'service-account-name-taken' | 'service-account-not-found'
+/** A grant for an unregistered account. */
+ | 'service-account-unregistered'
+/** A grant names a project the tenant doesn't have. */
+ | 'project-not-found';
+export interface ServiceAccountError {
+    readonly code: ServiceAccountErrorCode;
+    readonly message: string;
+}
+export interface ServiceAccountBinding {
+    create(input: ServiceAccountCreateInput): Promise<Result<ServiceAccount, ServiceAccountError>>;
+    /** Unregistered accounts too, or `null`. */
+    get(input: ServiceAccountRef): Promise<ServiceAccount | null>;
+    /** Oldest first. */
+    list(input: ServiceAccountListInput): Promise<{
+        readonly data: readonly ServiceAccount[];
+        readonly nextCursor?: Cursor;
+    }>;
+    /**
+     * Add a grant (a no-op when held). A project role replaces the
+     * account's role on that project. Not for an unregistered account.
+     */
+    grant(input: ServiceAccountChange & {
+        readonly grant: ServiceAccountGrant;
+    }): Promise<Result<ServiceAccount, ServiceAccountError>>;
+    /** Remove a grant (a no-op when not held). */
+    ungrant(input: ServiceAccountChange & {
+        readonly grant: ServiceAccountGrantTarget;
+    }): Promise<Result<ServiceAccount, ServiceAccountError>>;
+    /** Tombstone the account: its grants go and its keys stop working. Idempotent. */
+    unregister(input: ServiceAccountChange): Promise<Result<ServiceAccount, ServiceAccountError>>;
+}
+//# sourceMappingURL=service-account-binding.d.ts.map

package/dist/service-account-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-binding.d.ts","sourceRoot":"","sources":["../src/service-account-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzF,qGAAqG;AACrG,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,MAAM,uBAAuB;AACjC,6DAA6D;AAC3D,4BAA4B,GAC5B,2BAA2B;AAC7B,2CAA2C;GACzC,8BAA8B;AAChC,uDAAuD;GACrD,mBAAmB,CAAC;AAExB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC/F,4CAA4C;IAC5C,GAAG,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB;IACpB,IAAI,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC;QAC5C,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;QACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IACH;;;OAGG;IACH,KAAK,CACH,KAAK,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,GACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxD,8CAA8C;IAC9C,OAAO,CACL,KAAK,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAA;KAAE,GAC1E,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxD,kFAAkF;IAClF,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC/F"}

package/dist/service-account-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=service-account-binding.js.map

package/dist/service-account-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-binding.js","sourceRoot":"","sources":["../src/service-account-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/session-store-binding.d.ts

@@ -9,15 +9,19 @@ import type { Cursor, SessionId, TenantId, Timestamp, UserId } from '@kindgi/typ
  * `POST /v1/auth/callback/:providerId` exchanges the authorization code
  * for provider tokens, fetches the userinfo, and calls
  * `SessionStoreBinding.create` to persist the resulting session; the
- * route then hands the caller an opaque framework-issued token
- * (`kgi_sk_<sessionId>`) that never leaks the provider access-token or
- * refresh-token to the client.
+ * route then hands the caller an opaque session token (`kgi_sk_…`) that
+ * never leaks the provider access-token or refresh-token to the client.
  *
- * The bearer-auth middleware routes session-token requests through
- * `get(tenantId, sessionId)`; the resolver hot path runs on every
- * authenticated request that carries a session token, so implementations
- * SHOULD keep `get` cheap (e.g. a single indexed lookup by id and
- * expiry, or a cache).
+ * A store that implements `resolveToken` owns the token: `create` mints it
+ * (returned once, as `token`), the store keeps only a hash, and the
+ * bearer-auth middleware hands every `kgi_sk_` token to `resolveToken`.
+ * A store without it gets the older token, `kgi_sk_<sessionId>`, which
+ * the middleware resolves through `get` with `MULTI_TENANT_LOOKUP`;
+ * anyone who can read such a store's session ids can use the sessions.
+ *
+ * The resolver hot path runs on every authenticated request that carries
+ * a session token, so implementations SHOULD keep it cheap (a single
+ * indexed lookup, or a cache).
  */
 export interface SessionStoreBinding {
     create(input: SessionCreateInput): Promise<SessionCreateOutput>;
@@ -25,6 +29,21 @@ export interface SessionStoreBinding {
     list(input: SessionListInput): Promise<SessionPage>;
     revoke(input: SessionRevokeInput): Promise<SessionRevokeOutcome>;
     revokeAllForUser(input: SessionRevokeAllForUserInput): Promise<SessionRevokeAllForUserOutcome>;
+    /**
+     * The session a token names, or `null` when it names none: an unknown,
+     * malformed or tampered token, or one in a format this store didn't
+     * mint. The store reads the token's tenant from the token itself and
+     * looks only in that tenant, comparing a hash of the token with what it
+     * stored (in constant time); nothing is read across tenants before the
+     * token is authenticated.
+     *
+     * A revoked, rotated or expired session is still returned (with
+     * `revokedAt`, `rotatedAt`, `expiresAt`): the middleware says which.
+     *
+     * When present, the middleware never calls `get` with
+     * `MULTI_TENANT_LOOKUP`, and `create` must return `token`.
+     */
+    readonly resolveToken?: (input: SessionResolveTokenInput) => Promise<Session | null>;
     /**
      * Update the session's `lastActiveAt` marker. Called by the auth
      * middleware on each successful authenticated request (throttled, by
@@ -32,18 +51,39 @@ export interface SessionStoreBinding {
      * doesn't hot-spot under load). Absent = the middleware only enforces absolute
      * TTL; inactivity timeout is disabled.
      *
-     * The tenant sentinel `MULTI_TENANT_LOOKUP` is honored the same way
-     * as `get` — the middleware doesn't know the tenant ahead of time.
+     * The middleware passes the session's own tenant. A store without
+     * `resolveToken` must also honor the sentinel `MULTI_TENANT_LOOKUP`,
+     * as `get` does.
      */
     readonly touch?: (input: SessionTouchInput) => Promise<SessionTouchOutcome>;
+    /**
+     * End every live session one provider opened, in one tenant: the console
+     * sessions an API key opened (`api-token:<tokenId>`, from token sign-in)
+     * when it's revoked; an identity provider's sign-ins when it's removed.
+     * Absent → those sessions run until they expire.
+     */
+    readonly revokeByProvider?: (input: SessionRevokeByProviderInput) => Promise<SessionRevokeAllForUserOutcome>;
+}
+export interface SessionRevokeByProviderInput {
+    readonly tenantId: TenantId;
+    /** The `providerId` the sessions were created with. */
+    readonly providerId: string;
+}
+export interface SessionResolveTokenInput {
+    /** The whole token, as the caller sent it (`kgi_sk_…`). */
+    readonly token: string;
 }
 export interface SessionCreateInput {
     readonly tenantId: TenantId;
     readonly userId: UserId;
     /** ProviderId of the `IdentityProviderBinding` that authenticated the user. */
     readonly providerId: string;
-    /** Opaque provider access-token — server-side only. */
-    readonly accessToken: string;
+    /**
+     * Opaque provider access-token, server-side only. Absent when the
+     * deployment keeps no identity-provider tokens (a sign-in that only
+     * establishes who the person is).
+     */
+    readonly accessToken?: string;
     /** Opaque provider refresh-token — server-side only, may be absent. */
     readonly refreshToken?: string;
     readonly expiresAt: Timestamp;
@@ -54,6 +94,13 @@ export interface SessionCreateInput {
 export interface SessionCreateOutput {
     readonly sessionId: SessionId;
     readonly expiresAt: Timestamp;
+    /**
+     * The session token the store minted, returned this once (the store
+     * keeps only its hash). Required from a store that implements
+     * `resolveToken`; absent from an older store, whose token is
+     * `kgi_sk_<sessionId>`.
+     */
+    readonly token?: string;
 }
 export interface SessionGetInput {
     readonly tenantId: TenantId;
@@ -88,7 +135,8 @@ export interface Session {
     readonly tenantId: TenantId;
     readonly userId: UserId;
     readonly providerId: string;
-    readonly accessToken: string;
+    /** Absent when the deployment keeps no identity-provider tokens. */
+    readonly accessToken?: string;
     readonly refreshToken?: string;
     readonly expiresAt: Timestamp;
     readonly scopes: readonly string[];

package/dist/session-store-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store-binding.d.ts","sourceRoot":"","sources":["../src/session-store-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC/F;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"session-store-binding.d.ts","sourceRoot":"","sources":["../src/session-store-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC/F;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACrF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,KAAK,EAAE,4BAA4B,KAChC,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/signed-export.d.ts

@@ -0,0 +1,89 @@
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { ExportSigningAlgorithm, ExportSigningBinding, ExportSigningError } from '@kindgi/crypto';
+import type { ProjectId, TenantId } from '@kindgi/types';
+import type { Context } from 'hono';
+import type { AppEnv } from './types.js';
+export type SignedExportKind = 'audit-bundle' | 'provenance' | 'compliance';
+/** The audit-event kind each signed export is recorded under. */
+export declare const EXPORT_SIGNED_EVENT_KIND = "export-signed";
+/** What every signed export answers, before its subject field (`approvalId`, `runId`, `tenantId`). */
+export interface SignedExportEnvelope {
+    readonly kind: SignedExportKind;
+    /** Base64 of the signed bytes: the body, as sorted-key JSON. */
+    readonly bundle: string;
+    readonly bundleSchemaVersion: string;
+    /** The signing key's algorithm: `ed25519`, or `ecdsa-p256-sha256` for a KMS without Ed25519. */
+    readonly algorithm: ExportSigningAlgorithm;
+    readonly signingKeyId: string;
+    /**
+     * Base64 of the signature over the `bundle` bytes: 64 bytes either way,
+     * Ed25519's, or ECDSA P-256's as IEEE P1363 `r‖s`.
+     */
+    readonly signature: string;
+    /** The signing key's public half, PEM SPKI. Check it against `GET /v1/export-signing-keys`. */
+    readonly publicKey: string;
+    readonly canonicalization: 'sorted-key-json';
+    /** The same instant as the signed body's `exportedAt`. */
+    readonly exportedAt: string;
+}
+export interface SignExportInput {
+    readonly signer: ExportSigningBinding;
+    readonly kind: SignedExportKind;
+    readonly bundleSchemaVersion: string;
+    /** The body without `bundleSchemaVersion` and `exportedAt`: both are added, and signed. */
+    readonly body: Readonly<Record<string, unknown>>;
+    readonly signingKeyId?: string;
+    readonly now?: () => Date;
+    /** Record the export (an `export-signed` audit event) before answering. */
+    readonly record?: {
+        readonly auditEvents: AuditEventBinding;
+        readonly tenantId: TenantId;
+        readonly projectId?: ProjectId;
+        readonly runId?: string;
+        readonly actor: string;
+        /** The exported thing: `{ approvalId }`, `{ runId }`, or the compliance filter. */
+        readonly subject: Readonly<Record<string, unknown>>;
+    };
+}
+export type SignExportError = ExportSigningError | {
+    readonly code: 'persistence-error';
+    readonly message: string;
+};
+/** Sign an export's body and, when asked, record it. */
+export declare function signExport(input: SignExportInput): Promise<{
+    readonly kind: 'ok';
+    readonly value: SignedExportEnvelope;
+} | {
+    readonly kind: 'err';
+    readonly error: SignExportError;
+}>;
+/**
+ * An export request's body: JSON, an object, or nothing at all (read as
+ * `{}`, so `curl -X POST` and a bodiless POST work).
+ */
+export declare function readExportBody(c: Context<AppEnv>): Promise<{
+    readonly kind: 'ok';
+    readonly value: Record<string, unknown>;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+}>;
+/** `signingKeyId`, when the body names one: a non-empty string. */
+export declare function parseSigningKeyId(body: Readonly<Record<string, unknown>>): {
+    readonly kind: 'ok';
+    readonly value: string | undefined;
+} | {
+    readonly kind: 'err';
+    readonly message: string;
+};
+/** `404 signing-not-configured`: this deployment has no export signing key. */
+export declare function signingNotConfigured(c: Context<AppEnv>, what: string): Response;
+/**
+ * A `signExport` failure as the route answers it: `404
+ * signing-key-not-found`, `500 persistence-error`, or `500` with
+ * `failureCode` (each route keeps the code it answered before).
+ */
+export declare function signExportFailure(c: Context<AppEnv>, error: SignExportError, failureCode: 'export-key-error' | 'compliance-export-failed'): Response;
+/** The caller as an audit actor: `user:<id>`, `service_account:<tokenId>`, or `service_account:unknown`. */
+export declare function exportActor(c: Context<AppEnv>): string;
+//# sourceMappingURL=signed-export.d.ts.map

package/dist/signed-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-export.d.ts","sourceRoot":"","sources":["../src/signed-export.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EACV,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,YAAY,GAAG,YAAY,CAAC;AAE5E,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD,sGAAsG;AACtG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC7C,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,mFAAmF;QACnF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,wDAAwD;AACxD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,GACrB,OAAO,CACN;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAC5D,CAyBA;AAoCD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GACjB,OAAO,CACN;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CACrD,CAaA;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAErC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAarD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAW/E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAClB,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,kBAAkB,GAAG,0BAA0B,GAC3D,QAAQ,CAsBV;AAED,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAMtD"}

package/dist/signed-export.js

@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Signed exports: one envelope and one signing path for the three
+ * exports a deployment signs (an approval's audit bundle, a run's
+ * provenance, compliance evidence).
+ *
+ * The envelope carries the exact bytes that were signed (`bundle`,
+ * base64 of the sorted-key JSON body), so a verifier checks those bytes
+ * and never re-serializes anything. `exportedAt` is inside the signed
+ * body, and the envelope's copy is the same value.
+ *
+ * Each export is recorded as an `export-signed` audit event (who, what,
+ * which key, the bundle's SHA-256) when the app has an audit-event
+ * binding. Recording comes before the bundle is returned: a bundle the
+ * record couldn't be written for isn't handed out.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { canonicalize } from '@kindgi/schema';
+import { statusFor, toWireError } from './errors.js';
+/** The audit-event kind each signed export is recorded under. */
+export const EXPORT_SIGNED_EVENT_KIND = 'export-signed';
+/** Sign an export's body and, when asked, record it. */
+export async function signExport(input) {
+    const exportedAt = (input.now?.() ?? new Date()).toISOString();
+    const body = { ...input.body, bundleSchemaVersion: input.bundleSchemaVersion, exportedAt };
+    const bytes = new TextEncoder().encode(canonicalize(body));
+    const signed = await input.signer.sign(bytes, input.signingKeyId !== undefined ? { keyId: input.signingKeyId } : undefined);
+    if (signed.kind === 'err')
+        return signed;
+    const envelope = {
+        kind: input.kind,
+        bundle: Buffer.from(bytes).toString('base64'),
+        bundleSchemaVersion: input.bundleSchemaVersion,
+        algorithm: signed.value.key.algorithm,
+        signingKeyId: signed.value.key.keyId,
+        signature: Buffer.from(signed.value.signature).toString('base64'),
+        publicKey: signed.value.key.publicKeyPem,
+        canonicalization: 'sorted-key-json',
+        exportedAt,
+    };
+    if (input.record !== undefined) {
+        const recorded = await recordExport(input.record, envelope, bytes);
+        if (recorded !== undefined)
+            return { kind: 'err', error: recorded };
+    }
+    return { kind: 'ok', value: envelope };
+}
+async function recordExport(record, envelope, bytes) {
+    const event = {
+        id: randomUUID(),
+        tenantId: record.tenantId,
+        ...(record.projectId !== undefined && { projectId: record.projectId }),
+        kind: EXPORT_SIGNED_EVENT_KIND,
+        timestamp: envelope.exportedAt,
+        actor: record.actor,
+        ...(record.runId !== undefined && { runId: record.runId }),
+        outcome: 'succeeded',
+        payload: {
+            v: 1,
+            doc: {
+                exportKind: envelope.kind,
+                subject: record.subject,
+                signingKeyId: envelope.signingKeyId,
+                bundleSha256: createHash('sha256').update(bytes).digest('hex'),
+                bundleSchemaVersion: envelope.bundleSchemaVersion,
+                exportedAt: envelope.exportedAt,
+            },
+        },
+    };
+    const appended = await record.auditEvents.append([event]);
+    if (appended.kind === 'ok')
+        return undefined;
+    return {
+        code: 'persistence-error',
+        message: `The export was signed, but recording it failed, so it isn't returned: ${appended.error.message}. Try again.`,
+    };
+}
+/**
+ * An export request's body: JSON, an object, or nothing at all (read as
+ * `{}`, so `curl -X POST` and a bodiless POST work).
+ */
+export async function readExportBody(c) {
+    const text = await c.req.text();
+    if (text.trim() === '')
+        return { kind: 'ok', value: {} };
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return { kind: 'err', message: 'Request body must be valid JSON' };
+    }
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return { kind: 'err', message: 'Request body must be an object' };
+    }
+    return { kind: 'ok', value: body };
+}
+/** `signingKeyId`, when the body names one: a non-empty string. */
+export function parseSigningKeyId(body) {
+    if (!('signingKeyId' in body) || body.signingKeyId === undefined) {
+        return { kind: 'ok', value: undefined };
+    }
+    const raw = body.signingKeyId;
+    if (typeof raw !== 'string' || raw.length === 0) {
+        return {
+            kind: 'err',
+            message: 'Field `signingKeyId` must be a non-empty string when present; leave it out to sign with the active key.',
+        };
+    }
+    return { kind: 'ok', value: raw };
+}
+/** `404 signing-not-configured`: this deployment has no export signing key. */
+export function signingNotConfigured(c, what) {
+    c.status(statusFor('signing-not-configured'));
+    return c.json(toWireError({
+        code: 'signing-not-configured',
+        message: `This deployment doesn't sign exports, so ${what} are unavailable: it has no export signing key. On the Kindgi runtime, set KINDGI_EXPORT_SIGNING_KEY_PATH, KINDGI_EXPORT_SIGNING_KEY or KINDGI_EXPORT_SIGNING_KMS_KEY.`,
+    }, c.get('requestId')));
+}
+/**
+ * A `signExport` failure as the route answers it: `404
+ * signing-key-not-found`, `500 persistence-error`, or `500` with
+ * `failureCode` (each route keeps the code it answered before).
+ */
+export function signExportFailure(c, error, failureCode) {
+    const requestId = c.get('requestId');
+    if (error.code === 'signing-key-not-found') {
+        c.status(statusFor('signing-key-not-found'));
+        return c.json(toWireError({ code: 'signing-key-not-found', message: error.message, signingKeyId: error.keyId }, requestId));
+    }
+    if (error.code === 'persistence-error') {
+        c.status(statusFor('persistence-error'));
+        return c.json(toWireError({ code: 'persistence-error', message: error.message }, requestId));
+    }
+    c.status(statusFor(failureCode));
+    return c.json(toWireError({ code: failureCode, message: `Signing the export failed: ${error.message}` }, requestId));
+}
+/** The caller as an audit actor: `user:<id>`, `service_account:<tokenId>`, or `service_account:unknown`. */
+export function exportActor(c) {
+    const userId = c.get('userId');
+    if (userId !== undefined)
+        return `user:${userId}`;
+    const tokenId = c.get('tokenId');
+    if (tokenId !== undefined)
+        return `service_account:${tokenId}`;
+    return 'service_account:unknown';
+}
+//# sourceMappingURL=signed-export.js.map

package/dist/signed-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-export.js","sourceRoot":"","sources":["../src/signed-export.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQrD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAKrD,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AA+CxD,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAsB;IAKtB,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CACpC,KAAK,EACL,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7E,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,QAAQ,GAAyB;QACrC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS;QACrC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK;QACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY;QACxC,gBAAgB,EAAE,iBAAiB;QACnC,UAAU;KACX,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA8C,EAC9C,QAA8B,EAC9B,KAAiB;IAEjB,MAAM,KAAK,GAAe;QACxB,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACtE,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,QAAQ,CAAC,UAAkC;QACtD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE;YACP,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE;gBACH,UAAU,EAAE,QAAQ,CAAC,IAAI;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9D,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;SACF;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,yEAAyE,QAAQ,CAAC,KAAK,CAAC,OAAO,cAAc;KACvH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAkB;IAKlB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAA+B,EAAE,CAAC;AAChE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAC/B,IAAuC;IAIvC,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EACL,yGAAyG;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,CAAkB,EAAE,IAAY;IACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAU,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,4CAA4C,IAAI,wKAAwK;KAClO,EACD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAkB,EAClB,KAAsB,EACtB,WAA4D;IAE5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,EACpF,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE,EAAE,EAC7E,SAAS,CACV,CACF,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,WAAW,CAAC,CAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,MAA2B,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,mBAAmB,OAA4B,EAAE,CAAC;IACpF,OAAO,yBAAyB,CAAC;AACnC,CAAC"}