@kynver-app/runtime 0.2.78 → 0.2.88

package/dist/dispatch-claim-authorization.js

@@ -0,0 +1 @@
+import{createPublicKey as A,verify as x}from"node:crypto";import{createHash as m,createPublicKey as T,verify as v}from"node:crypto";function f(t){return JSON.stringify(u(t))}function u(t){if(Array.isArray(t))return t.map(u);if(t&&typeof t=="object"){let e={};for(let r of Object.keys(t).sort())e[r]=u(t[r]);return e}return t}function l(t){if(!t)return null;let e=t.trim();if(!e)return null;if(/^[0-9a-fA-F]{64}$/.test(e))return new Uint8Array(e.match(/.{2}/g).map(r=>parseInt(r,16)));try{let r=Buffer.from(e,"base64");if(r.length===32)return new Uint8Array(r)}catch{}return null}function c(t=process.env){if(t.NODE_ENV==="production")return!1;let e=t.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"||e==="on"?!0:t.NODE_ENV==="test"||t.VITEST==="true"}var N=Buffer.from("302a300506032b6570032100","hex"),d="ca-6297fb8e1773",h={[d]:"16ae5cb2a61f8c94cf1b86e8258f9c2f2ff6aba5e6136250a422209b6e866881","ca-456fd128f3b3":"f29cbd559410c2578d7f9732ccd86570073355ccdb36af0d1b7dff15908466e7"};function I(t){return`ca-${m("sha256").update(Buffer.from(t)).digest("hex").slice(0,12)}`}function p(t,e=process.env){let r=l(e.KYNVER_COMMAND_AUTH_PUBLIC_KEY);if(r)return I(r)!==t?null:r;let o=h[t];return!o||t===d&&!c(e)?null:l(o)}var k=/\[execution-mode:\s*(write|read[_-]?only)\s*\]/gi,b=/<!--\s*harness-contract:\s*(\{[\s\S]*?\})\s*-->/gi;function y(t){let e=typeof t.description=="string"?t.description:"",r=typeof t.executorRef=="string"?t.executorRef:"",i=[...e.matchAll(k)].at(-1)?.[1]?.toLowerCase();if(i)return i==="write"?"write":"read_only";if(/(?:^|:)read[_-]?only(?:$|:)/i.test(r))return"read_only";for(let s of e.matchAll(b))try{let a=JSON.parse(s[1]);if(a.readOnly===!0||a.executionMode==="read_only")return"read_only"}catch{}return"write"}var U=1,_=120,C=["write","read_only","land_pr","verify_live"],P=["agentOsId","attempt","exp","kind","leaseOwner","leaseToken","operationClass","repoIdentity","requestNonce","taskId","tenantId","v"],O=/^[A-Za-z0-9_-]{22,64}$/,g=/^[a-z0-9.-]+(?::\d+)?(?:\/[A-Za-z0-9._~-]+){2,}$/;function V(t){if(!t||typeof t!="object"||Array.isArray(t))return null;let e=t;return Object.keys(e).sort().join(",")!=="repoIdentity,requestNonce,v"||e.v!==1||typeof e.repoIdentity!="string"||e.repoIdentity.length>512||!g.test(e.repoIdentity)||typeof e.requestNonce!="string"||!O.test(e.requestNonce)?null:{v:1,repoIdentity:e.repoIdentity,requestNonce:e.requestNonce}}function H(t){let e=t.trim();if(!e||e.includes("\0")||/\s/.test(e))return null;let r,o,i=/^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(e);if(/^[a-z][a-z0-9+.-]*:\/\//i.test(e)){let n;try{n=new URL(e)}catch{return null}if(!["https:","http:","ssh:","git:","git+ssh:","ssh+git:"].includes(n.protocol))return null;r=n.port?`${n.hostname}:${n.port}`:n.hostname,o=decodeURIComponent(n.pathname)}else if(i&&!/^[A-Za-z]$/.test(i[1]))r=i[1],o=i[2];else return null;r=r.toLowerCase().replace(/\.$/,"");let s=o.replace(/\/+$/,"").replace(/\.git$/i,"").split("/").filter(Boolean);if(s.length<2||s.some(n=>n==="."||n===".."))return null;let a=`${r}/${s.join("/")}`;return g.test(a)&&a.length<=512?a:null}function q(t){let e=t.task??{};return t.landPrDispatch===!0||e.executor==="land_pr"?"land_pr":e.executor==="verify_live"?"verify_live":y(e)==="read_only"?"read_only":"write"}function R(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;let e=t;if(Object.keys(e).sort().join(",")!=="payload,publicKeyId,signature"||typeof e.signature!="string"||!e.signature||typeof e.publicKeyId!="string"||!e.publicKeyId)return!1;let r=e.payload;if(!r||typeof r!="object"||Array.isArray(r)||Object.keys(r).sort().join(",")!==[...P].join(",")||r.v!==1||r.kind!=="dispatch_claim")return!1;for(let o of["tenantId","agentOsId","taskId","leaseOwner","leaseToken","repoIdentity","requestNonce"])if(typeof r[o]!="string"||!r[o])return!1;return!(typeof r.attempt!="number"||!Number.isInteger(r.attempt)||r.attempt<0||typeof r.exp!="number"||!Number.isFinite(r.exp)||!C.includes(r.operationClass))}var w=Buffer.from("302a300506032b6570032100","hex");function F(t,e,r=process.env,o=Math.floor(Date.now()/1e3)){if(!R(t))return{ok:!1,code:"malformed",reason:"malformed dispatch claim authorization"};let i=t.payload;for(let n of Object.keys(e))if(i[n]!==e[n])return{ok:!1,code:"binding_mismatch",reason:`${n} mismatch`};if(i.exp<=o)return{ok:!1,code:"expired",reason:"authorization expired"};if(i.exp>o+_+60)return{ok:!1,code:"malformed",reason:"authorization lifetime exceeds the allowed window"};let s=p(t.publicKeyId,r);if(!s)return{ok:!1,code:"unknown_key",reason:`no verification key for publicKeyId "${t.publicKeyId}"`};let a=Buffer.from(t.signature,"base64url");if(a.length!==64)return{ok:!1,code:"bad_signature",reason:"not a 64-byte Ed25519 signature"};try{let n=A({key:Buffer.concat([w,Buffer.from(s)]),format:"der",type:"spki"});return x(null,Buffer.from(f(i),"utf8"),n,a)?{ok:!0,payload:i}:{ok:!1,code:"bad_signature",reason:"Ed25519 signature mismatch"}}catch(n){return{ok:!1,code:"bad_signature",reason:`signature verification failed: ${n.message}`}}}export{_ as DISPATCH_CLAIM_AUTHORIZATION_TTL_SEC,U as DISPATCH_CLAIM_AUTHORIZATION_VERSION,C as DISPATCH_OPERATION_CLASSES,H as canonicalRepoIdentity,q as deriveDispatchOperationClass,R as isSignedDispatchClaimAuthorizationShape,V as parseDispatchClaimAuthorizationRequest,F as verifyDispatchClaimAuthorization};