@n8n/engine 0.17.0 → 0.18.1

package/dist/auth/action-token.d.ts

@@ -0,0 +1,7 @@
+import { type SharedSecretTokenSpec } from './shared-secret-token';
+export type ActionScope = 'lifecycle-events:write';
+export declare const ACTION_TOKEN: SharedSecretTokenSpec;
+export declare class InvalidActionTokenError extends Error {
+}
+export declare function mintActionToken(secret: string, scope: ActionScope): string;
+export declare function verifyActionToken(secret: string, token: string, requiredScope: ActionScope): void;

package/dist/auth/action-token.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidActionTokenError = exports.ACTION_TOKEN = void 0;
+exports.mintActionToken = mintActionToken;
+exports.verifyActionToken = verifyActionToken;
+const zod_1 = require("zod");
+const shared_secret_token_1 = require("./shared-secret-token");
+exports.ACTION_TOKEN = Object.freeze({
+    issuer: 'n8n-engine-dp',
+    audience: 'n8n-cp',
+    ttlSeconds: 60,
+    clockToleranceSeconds: 30,
+});
+const actionClaimsSchema = zod_1.z.object({
+    scope: zod_1.z.enum(['lifecycle-events:write']),
+    iat: zod_1.z.number().int(),
+    exp: zod_1.z.number().int(),
+});
+class InvalidActionTokenError extends Error {
+}
+exports.InvalidActionTokenError = InvalidActionTokenError;
+function mintActionToken(secret, scope) {
+    return (0, shared_secret_token_1.signSharedSecretToken)(exports.ACTION_TOKEN, secret, { scope });
+}
+function verifyActionToken(secret, token, requiredScope) {
+    const claims = (0, shared_secret_token_1.verifySharedSecretToken)(exports.ACTION_TOKEN, secret, token, actionClaimsSchema);
+    if (!claims || claims.scope !== requiredScope)
+        throw new InvalidActionTokenError();
+}
+//# sourceMappingURL=action-token.js.map

package/dist/auth/action-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-token.js","sourceRoot":"","sources":["../../src/auth/action-token.ts"],"names":[],"mappings":";;;;;AAAA,6BAAwB;AAExB,+DAI+B;AAclB,QAAA,YAAY,GAA0B,MAAM,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,EAAE;IACd,qBAAqB,EAAE,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,6BAAqC,SAAQ,KAAK;CAAG;;AAGrD,yBAAgC,MAAc,EAAE,KAAkB;IACjE,OAAO,IAAA,2CAAqB,EAAC,QAAA,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC;AAMD,2BAAkC,MAAc,EAAE,KAAa,EAAE,aAA0B;IAC1F,MAAM,MAAM,GAAG,IAAA,6CAAuB,EAAC,QAAA,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AACpF,CAAC"}

package/dist/auth/authenticate.d.ts

@@ -1,3 +1,4 @@
 import type { RequestHandler } from 'express';
 import type { IdentityVerifier } from './identity.types';
-export declare function createAuthenticationMiddleware(verifier: IdentityVerifier): RequestHandler;
+import { type EngineLogger } from '../logging';
+export declare function createAuthenticationMiddleware(verifier: IdentityVerifier, logger?: EngineLogger): RequestHandler;

package/dist/auth/authenticate.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAuthenticationMiddleware = createAuthenticationMiddleware;
+const logging_1 = require("../logging");
 const error_response_1 = require("../server/error-response");
 const BEARER_PREFIX = /^bearer /i;
-function createAuthenticationMiddleware(verifier) {
+function createAuthenticationMiddleware(verifier, logger = (0, logging_1.createConsoleLogger)()) {
     return (req, res, next) => {
         const reject = (reason) => {
             const path = req.originalUrl.split('?')[0];
-            console.warn(`engine: rejected ${req.method} ${path} - ${reason}`);
+            logger.warn(`rejected ${req.method} ${path} - ${reason}`);
             (0, error_response_1.fail)(res, 401, { error: 'unauthenticated' });
         };
         const header = req.header('authorization');

package/dist/auth/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":";;;AAGA,6DAAgD;AAEhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAGlC,wCAA+C,QAA0B;IACxE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAEzB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;YACnE,IAAA,qBAAI,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACJ,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzB,OAAO;QACR,CAAC;QAED,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":";;;AAGA,wCAAoE;AACpE,6DAAgD;AAEhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAGlC,wCACC,QAA0B,EAC1B,MAAM,GAAiB,IAAA,6BAAmB,GAAE;IAE5C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAEzB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;YAEvC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;YAC1D,IAAA,qBAAI,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACJ,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzB,OAAO;QACR,CAAC;QAED,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}

package/dist/auth/identity-token.d.ts

@@ -1,9 +1,7 @@
 import type { AuthenticatedCaller, IdentityVerifier } from './identity.types';
-export declare const IDENTITY_ISSUER = "n8n-cp";
-export declare const IDENTITY_AUDIENCE = "n8n-engine-dp";
-export declare const IDENTITY_TOKEN_TTL_SECONDS = 60;
-export declare const IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
-export declare const MIN_SECRET_LENGTH = 32;
+import { MIN_SECRET_LENGTH, type SharedSecretTokenSpec } from './shared-secret-token';
+export { MIN_SECRET_LENGTH };
+export declare const IDENTITY_TOKEN: SharedSecretTokenSpec;
 export declare class InvalidIdentityTokenError extends Error {
 }
 export declare function mintIdentityToken(secret: string, caller: AuthenticatedCaller): string;

package/dist/auth/identity-token.js

@@ -1,17 +1,16 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SharedSecretIdentityVerifier = exports.InvalidIdentityTokenError = exports.MIN_SECRET_LENGTH = exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = exports.IDENTITY_TOKEN_TTL_SECONDS = exports.IDENTITY_AUDIENCE = exports.IDENTITY_ISSUER = void 0;
+exports.SharedSecretIdentityVerifier = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN = exports.MIN_SECRET_LENGTH = void 0;
 exports.mintIdentityToken = mintIdentityToken;
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const zod_1 = require("zod");
-exports.IDENTITY_ISSUER = 'n8n-cp';
-exports.IDENTITY_AUDIENCE = 'n8n-engine-dp';
-exports.IDENTITY_TOKEN_TTL_SECONDS = 60;
-exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
-exports.MIN_SECRET_LENGTH = 32;
+const shared_secret_token_1 = require("./shared-secret-token");
+Object.defineProperty(exports, "MIN_SECRET_LENGTH", { enumerable: true, get: function () { return shared_secret_token_1.MIN_SECRET_LENGTH; } });
+exports.IDENTITY_TOKEN = Object.freeze({
+    issuer: 'n8n-cp',
+    audience: 'n8n-engine-dp',
+    ttlSeconds: 60,
+    clockToleranceSeconds: 30,
+});
 const identityClaimsSchema = zod_1.z.object({
     sub: zod_1.z.string().min(1),
     tenant_id: zod_1.z.string().min(1),
@@ -22,44 +21,24 @@ class InvalidIdentityTokenError extends Error {
 }
 exports.InvalidIdentityTokenError = InvalidIdentityTokenError;
 function mintIdentityToken(secret, caller) {
-    return jsonwebtoken_1.default.sign({ sub: caller.cpId, tenant_id: caller.tenantId }, secret, {
-        algorithm: 'HS256',
-        issuer: exports.IDENTITY_ISSUER,
-        audience: exports.IDENTITY_AUDIENCE,
-        expiresIn: exports.IDENTITY_TOKEN_TTL_SECONDS,
+    return (0, shared_secret_token_1.signSharedSecretToken)(exports.IDENTITY_TOKEN, secret, {
+        sub: caller.cpId,
+        tenant_id: caller.tenantId,
     });
 }
 class SharedSecretIdentityVerifier {
     secret;
     constructor(secret) {
         this.secret = secret;
-        if (!secret || secret.length < exports.MIN_SECRET_LENGTH) {
-            throw new Error(`Identity verifier secret must be at least ${exports.MIN_SECRET_LENGTH} chars`);
+        if (!secret || secret.length < shared_secret_token_1.MIN_SECRET_LENGTH) {
+            throw new Error(`Identity verifier secret must be at least ${shared_secret_token_1.MIN_SECRET_LENGTH} chars`);
         }
     }
     verify(token) {
-        const now = Math.floor(Date.now() / 1000);
-        let claims;
-        try {
-            claims = jsonwebtoken_1.default.verify(token, this.secret, {
-                algorithms: ['HS256'],
-                issuer: exports.IDENTITY_ISSUER,
-                audience: exports.IDENTITY_AUDIENCE,
-                maxAge: exports.IDENTITY_TOKEN_TTL_SECONDS,
-                clockTolerance: exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS,
-                clockTimestamp: now,
-            });
-        }
-        catch {
-            throw new InvalidIdentityTokenError();
-        }
-        const parsed = identityClaimsSchema.safeParse(claims);
-        if (!parsed.success)
-            throw new InvalidIdentityTokenError();
-        if (parsed.data.iat > now + exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS) {
+        const claims = (0, shared_secret_token_1.verifySharedSecretToken)(exports.IDENTITY_TOKEN, this.secret, token, identityClaimsSchema);
+        if (!claims)
             throw new InvalidIdentityTokenError();
-        }
-        return { cpId: parsed.data.sub, tenantId: parsed.data.tenant_id };
+        return { cpId: claims.sub, tenantId: claims.tenant_id };
     }
 }
 exports.SharedSecretIdentityVerifier = SharedSecretIdentityVerifier;

package/dist/auth/identity-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-token.js","sourceRoot":"","sources":["../../src/auth/identity-token.ts"],"names":[],"mappings":";;;;;;;AAAA,gEAA+B;AAC/B,6BAAwB;AAIX,QAAA,eAAe,GAAG,QAAQ,CAAC;AAC3B,QAAA,iBAAiB,GAAG,eAAe,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAChC,QAAA,sCAAsC,GAAG,EAAE,CAAC;AAC5C,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,+BAAuC,SAAQ,KAAK;CAAG;;AAGvD,2BAAkC,MAAc,EAAE,MAA2B;IAC5E,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE;QACzE,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,QAAA,eAAe;QACvB,QAAQ,EAAE,QAAA,iBAAiB;QAC3B,SAAS,EAAE,QAAA,0BAA0B;KACrC,CAAC,CAAC;AACJ,CAAC;AAGD;IAC8B,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;QAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,QAAA,iBAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAA,iBAAiB,QAAQ,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAIJ,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvC,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,QAAA,eAAe;gBACvB,QAAQ,EAAE,QAAA,iBAAiB;gBAC3B,MAAM,EAAE,QAAA,0BAA0B;gBAClC,cAAc,EAAE,QAAA,sCAAsC;gBACtD,cAAc,EAAE,GAAG;aACnB,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,QAAA,sCAAsC,EAAE,CAAC;YACpE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACnE,CAAC;CACD"}
+{"version":3,"file":"identity-token.js","sourceRoot":"","sources":["../../src/auth/identity-token.ts"],"names":[],"mappings":";;;;AAAA,6BAAwB;AAGxB,+DAK+B;kGAJ9B,uCAAiB;AASL,QAAA,cAAc,GAA0B,MAAM,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,eAAe;IACzB,UAAU,EAAE,EAAE;IACd,qBAAqB,EAAE,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC;AAGH,+BAAuC,SAAQ,KAAK;CAAG;;AAGvD,2BAAkC,MAAc,EAAE,MAA2B;IAC5E,OAAO,IAAA,2CAAqB,EAAC,QAAA,cAAc,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;AACJ,CAAC;AAGD;IAC8B,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;QAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,uCAAiB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,uCAAiB,QAAQ,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,MAAM,MAAM,GAAG,IAAA,6CAAuB,EACrC,QAAA,cAAc,EACd,IAAI,CAAC,MAAM,EACX,KAAK,EACL,oBAAoB,CACpB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QAEnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;CACD"}

package/dist/auth/index.d.ts

@@ -1,3 +1,5 @@
 export { createAuthenticationMiddleware } from './authenticate';
-export { IDENTITY_AUDIENCE, IDENTITY_ISSUER, IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS, IDENTITY_TOKEN_TTL_SECONDS, InvalidIdentityTokenError, MIN_SECRET_LENGTH, mintIdentityToken, SharedSecretIdentityVerifier, } from './identity-token';
+export { ACTION_TOKEN, InvalidActionTokenError, mintActionToken, verifyActionToken, } from './action-token';
+export type { ActionScope } from './action-token';
+export { IDENTITY_TOKEN, InvalidIdentityTokenError, MIN_SECRET_LENGTH, mintIdentityToken, SharedSecretIdentityVerifier, } from './identity-token';
 export type { AuthenticatedCaller, IdentityVerifier } from './identity.types';

package/dist/auth/index.js

@@ -1,13 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SharedSecretIdentityVerifier = exports.mintIdentityToken = exports.MIN_SECRET_LENGTH = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN_TTL_SECONDS = exports.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS = exports.IDENTITY_ISSUER = exports.IDENTITY_AUDIENCE = exports.createAuthenticationMiddleware = void 0;
+exports.SharedSecretIdentityVerifier = exports.mintIdentityToken = exports.MIN_SECRET_LENGTH = exports.InvalidIdentityTokenError = exports.IDENTITY_TOKEN = exports.verifyActionToken = exports.mintActionToken = exports.InvalidActionTokenError = exports.ACTION_TOKEN = exports.createAuthenticationMiddleware = void 0;
 var authenticate_1 = require("./authenticate");
 Object.defineProperty(exports, "createAuthenticationMiddleware", { enumerable: true, get: function () { return authenticate_1.createAuthenticationMiddleware; } });
+var action_token_1 = require("./action-token");
+Object.defineProperty(exports, "ACTION_TOKEN", { enumerable: true, get: function () { return action_token_1.ACTION_TOKEN; } });
+Object.defineProperty(exports, "InvalidActionTokenError", { enumerable: true, get: function () { return action_token_1.InvalidActionTokenError; } });
+Object.defineProperty(exports, "mintActionToken", { enumerable: true, get: function () { return action_token_1.mintActionToken; } });
+Object.defineProperty(exports, "verifyActionToken", { enumerable: true, get: function () { return action_token_1.verifyActionToken; } });
 var identity_token_1 = require("./identity-token");
-Object.defineProperty(exports, "IDENTITY_AUDIENCE", { enumerable: true, get: function () { return identity_token_1.IDENTITY_AUDIENCE; } });
-Object.defineProperty(exports, "IDENTITY_ISSUER", { enumerable: true, get: function () { return identity_token_1.IDENTITY_ISSUER; } });
-Object.defineProperty(exports, "IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN_CLOCK_TOLERANCE_SECONDS; } });
-Object.defineProperty(exports, "IDENTITY_TOKEN_TTL_SECONDS", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN_TTL_SECONDS; } });
+Object.defineProperty(exports, "IDENTITY_TOKEN", { enumerable: true, get: function () { return identity_token_1.IDENTITY_TOKEN; } });
 Object.defineProperty(exports, "InvalidIdentityTokenError", { enumerable: true, get: function () { return identity_token_1.InvalidIdentityTokenError; } });
 Object.defineProperty(exports, "MIN_SECRET_LENGTH", { enumerable: true, get: function () { return identity_token_1.MIN_SECRET_LENGTH; } });
 Object.defineProperty(exports, "mintIdentityToken", { enumerable: true, get: function () { return identity_token_1.mintIdentityToken; } });

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,+CAAgE;AAAvD,8HAAA,8BAA8B,OAAA;AACvC,mDAS0B;AARzB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,wIAAA,sCAAsC,OAAA;AACtC,4HAAA,0BAA0B,OAAA;AAC1B,2HAAA,yBAAyB,OAAA;AACzB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,8HAAA,4BAA4B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,+CAAgE;AAAvD,8HAAA,8BAA8B,OAAA;AACvC,+CAKwB;AAJvB,4GAAA,YAAY,OAAA;AACZ,uHAAA,uBAAuB,OAAA;AACvB,+GAAA,eAAe,OAAA;AACf,iHAAA,iBAAiB,OAAA;AAGlB,mDAM0B;AALzB,gHAAA,cAAc,OAAA;AACd,2HAAA,yBAAyB,OAAA;AACzB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,8HAAA,4BAA4B,OAAA"}

package/dist/auth/shared-secret-token.d.ts

@@ -0,0 +1,12 @@
+import type { z } from 'zod';
+export declare const MIN_SECRET_LENGTH = 32;
+export interface SharedSecretTokenSpec {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly ttlSeconds: number;
+    readonly clockToleranceSeconds: number;
+}
+export declare function signSharedSecretToken(spec: SharedSecretTokenSpec, secret: string, claims: object): string;
+export declare function verifySharedSecretToken<T extends {
+    iat: number;
+}>(spec: SharedSecretTokenSpec, secret: string, token: string, schema: z.ZodType<T>): T | undefined;

package/dist/auth/shared-secret-token.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_SECRET_LENGTH = void 0;
+exports.signSharedSecretToken = signSharedSecretToken;
+exports.verifySharedSecretToken = verifySharedSecretToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+exports.MIN_SECRET_LENGTH = 32;
+function signSharedSecretToken(spec, secret, claims) {
+    return jsonwebtoken_1.default.sign(claims, secret, {
+        algorithm: 'HS256',
+        issuer: spec.issuer,
+        audience: spec.audience,
+        expiresIn: spec.ttlSeconds,
+    });
+}
+function verifySharedSecretToken(spec, secret, token, schema) {
+    if (!secret || secret.length < exports.MIN_SECRET_LENGTH)
+        return undefined;
+    const now = Math.floor(Date.now() / 1000);
+    let claims;
+    try {
+        claims = jsonwebtoken_1.default.verify(token, secret, {
+            algorithms: ['HS256'],
+            issuer: spec.issuer,
+            audience: spec.audience,
+            maxAge: spec.ttlSeconds,
+            clockTolerance: spec.clockToleranceSeconds,
+            clockTimestamp: now,
+        });
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = schema.safeParse(claims);
+    if (!parsed.success)
+        return undefined;
+    if (parsed.data.iat > now + spec.clockToleranceSeconds)
+        return undefined;
+    return parsed.data;
+}
+//# sourceMappingURL=shared-secret-token.js.map

package/dist/auth/shared-secret-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-token.js","sourceRoot":"","sources":["../../src/auth/shared-secret-token.ts"],"names":[],"mappings":";;;;;;;;AAAA,gEAA+B;AAOlB,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAUpC,+BACC,IAA2B,EAC3B,MAAc,EACd,MAAc;IAEd,OAAO,sBAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE;QAC/B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC1B,CAAC,CAAC;AACJ,CAAC;AAUD,iCACC,IAA2B,EAC3B,MAAc,EACd,KAAa,EACb,MAAoB;IAEpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,QAAA,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAEnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAIJ,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;YAClC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,cAAc,EAAE,IAAI,CAAC,qBAAqB;YAC1C,cAAc,EAAE,GAAG;SACnB,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAGtC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,qBAAqB;QAAE,OAAO,SAAS,CAAC;IAEzE,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC"}