@nextera.one/axis-server-sdk 0.8.0 → 0.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +53 -9
  2. package/dist/index.d.ts +53 -9
  3. package/dist/index.js +59 -0
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +56 -0
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +1 -1
package/dist/index.d.mts CHANGED
@@ -1,4 +1,4 @@
1
- import { AxisFrame } from './core/index.mjs';
1
+ import { AxisFrame as AxisFrame$1 } from './core/index.mjs';
2
2
  export { AXIS_MAGIC, AXIS_VERSION, AxisBinaryFrame, AxisFrameZ, TLV as AxisTlvType, BodyProfile, ERR_BAD_SIGNATURE, ERR_CONTRACT_VIOLATION, ERR_INVALID_PACKET, ERR_REPLAY_DETECTED, FLAG_BODY_TLV, FLAG_CHAIN_REQ, FLAG_HAS_WITNESS, MAX_BODY_LEN, MAX_FRAME_LEN, MAX_HDR_LEN, MAX_SIG_LEN, NCERT_ALG, NCERT_EXP, NCERT_ISSUER_KID, NCERT_KID, NCERT_NBF, NCERT_NODE_ID, NCERT_PAYLOAD, NCERT_PUB, NCERT_SCOPE, NCERT_SIG, PROOF_CAPSULE, PROOF_JWT, PROOF_LOOM, PROOF_MTLS, PROOF_NONE, PROOF_WITNESS, ProofType, TLV, TLV_ACTOR_ID, TLV_AUD, TLV_BODY_ARR, TLV_BODY_OBJ, TLV_CAPSULE, TLV_EFFECT, TLV_ERROR_CODE, TLV_ERROR_MSG, TLV_INDEX, TLV_INTENT, TLV_KID, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT, TLV_NODE, TLV_NODE_CERT_HASH, TLV_NODE_KID, TLV_NONCE, TLV_OFFSET, TLV_OK, TLV_PID, TLV_PREV_HASH, TLV_PROOF_REF, TLV_PROOF_TYPE, TLV_REALM, TLV_RECEIPT_HASH, TLV_RID, TLV_SHA256_CHUNK, TLV_TRACE_ID, TLV_TS, TLV_UPLOAD_ID, computeReceiptHash, computeSignaturePayload, decodeArray, decodeFrame, decodeObject, decodeTLVs, decodeTLVsList, decodeVarint, encodeFrame, encodeTLVs, encodeVarint, generateEd25519KeyPair, getSignTarget, sha256, signFrame, varintLength, verifyFrameSignature } from './core/index.mjs';
3
3
  import 'zod';
4
4
 
@@ -29,7 +29,7 @@ declare class IntentRouter {
29
29
  private handlers;
30
30
  register(intent: string, handler: any): void;
31
31
  registerHandler(instance: any): void;
32
- route(frame: AxisFrame): Promise<AxisEffect>;
32
+ route(frame: AxisFrame$1): Promise<AxisEffect>;
33
33
  private recordLatency;
34
34
  }
35
35
 
@@ -307,12 +307,12 @@ declare function b64urlDecodeString(str: string, encoding?: BufferEncoding): str
307
307
  declare function canonicalJson(value: any): string;
308
308
  declare function canonicalJsonExcluding(obj: Record<string, any>, exclude: string[]): string;
309
309
 
310
- type AxisAlg = 'EdDSA' | 'ES256' | 'RS256';
310
+ type AxisAlg$1 = 'EdDSA' | 'ES256' | 'RS256';
311
311
  type CapsuleStatus = 'ACTIVE' | 'CONSUMED' | 'REVOKED' | 'EXPIRED';
312
312
  type CapsuleMode = 'SINGLE_USE' | 'MULTI_USE';
313
313
  type KeyStatus = 'ACTIVE' | 'GRACE' | 'REVOKED' | 'RETIRED';
314
- interface AxisSig {
315
- alg: AxisAlg;
314
+ interface AxisSig$1 {
315
+ alg: AxisAlg$1;
316
316
  kid: string;
317
317
  value: string;
318
318
  }
@@ -324,7 +324,7 @@ interface AxisPacket$1<T = any> {
324
324
  actorId: string;
325
325
  opcode: string;
326
326
  body: T;
327
- sig: AxisSig;
327
+ sig: AxisSig$1;
328
328
  }
329
329
  interface AxisCapsuleConstraints {
330
330
  maxAmount?: number;
@@ -364,7 +364,7 @@ interface AxisCapsulePayload {
364
364
  }
365
365
  interface AxisCapsule {
366
366
  payload: AxisCapsulePayload;
367
- sig: AxisSig;
367
+ sig: AxisSig$1;
368
368
  }
369
369
  interface CapsuleIssueBody {
370
370
  intent: string;
@@ -396,7 +396,7 @@ interface CapsuleRevokeBody {
396
396
  capsuleId: string;
397
397
  reason: string;
398
398
  }
399
- interface AxisResponse<T = any> {
399
+ interface AxisResponse$1<T = any> {
400
400
  ok: boolean;
401
401
  pid: string;
402
402
  decisionId: string;
@@ -546,6 +546,26 @@ type AxisPacket = {
546
546
  };
547
547
  declare function buildPacket(hdr: Buffer, body: Buffer, sig: Buffer, flags?: number): AxisPacket;
548
548
 
549
+ type AxisAlg = Extract<AxisAlg$1, 'EdDSA'>;
550
+ type AxisSig = AxisSig$1 & {
551
+ alg: AxisAlg;
552
+ };
553
+ interface AxisFrame<T = any> {
554
+ v: 1;
555
+ pid: string;
556
+ nonce: string;
557
+ ts: number;
558
+ actorId: string;
559
+ aud?: string;
560
+ opcode: string;
561
+ headers: Map<number, Uint8Array>;
562
+ body: T;
563
+ sig: AxisSig;
564
+ }
565
+ type AxisResponse<T = any> = AxisResponse$1<T> & {
566
+ policyRefs?: string[];
567
+ riskScore?: number;
568
+ };
549
569
  interface AxisObservedContext {
550
570
  ip?: string;
551
571
  ua?: string;
@@ -703,6 +723,27 @@ type Capability = keyof typeof CAPABILITIES;
703
723
  declare const PROOF_CAPABILITIES: Record<number, Capability[]>;
704
724
  declare const INTENT_REQUIREMENTS: Record<string, Capability[]>;
705
725
 
726
+ interface RiskSignal {
727
+ type: string;
728
+ severity: 'low' | 'medium' | 'high' | 'critical';
729
+ value: any;
730
+ message: string;
731
+ }
732
+ declare enum RiskDecision {
733
+ ALLOW = "ALLOW",
734
+ THROTTLE = "THROTTLE",
735
+ STEP_UP = "STEP_UP",
736
+ WITNESS = "WITNESS",
737
+ DENY = "DENY"
738
+ }
739
+ interface RiskEvaluation {
740
+ decision: RiskDecision;
741
+ reason?: string;
742
+ retryAfterMs?: number;
743
+ confidence: number;
744
+ signals: RiskSignal[];
745
+ }
746
+
706
747
  declare const AXIS_OPCODES: Set<string>;
707
748
  declare function isKnownOpcode(op: string): boolean;
708
749
  declare function isAdminOpcode(op: string): boolean;
@@ -737,4 +778,7 @@ interface IntentDefinition {
737
778
  deprecated?: boolean;
738
779
  }
739
780
 
740
- export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, type ActorKeyRecord, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, type AxisCrudHandler, type AxisEffect, type AxisHandler, type AxisHandlerInit, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, type AxisPostSensor, type AxisPreSensor, type AxisRequestContext, type AxisResponse, type AxisSensor, type AxisSensorInit, type AxisSig, CAPABILITIES, type Capability, type CapsuleBatchBody, type CapsuleBatchResult, type CapsuleIssueBody, type CapsuleIssueResult, type CapsuleMode, type CapsuleRecord, type CapsuleRevokeBody, type CapsuleStatus, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, Handler, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_TIMEOUTS, Intent, type IntentDefinition, type IntentExecBody, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, type IssuerKeyRecord, type KeyStatus, PROOF_CAPABILITIES, type ReceiptEffect, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, type SensorDecision, SensorDecisions, type SensorInput, type SensorMinifiedDecision, type SensorPhaseMetadata, type TickWindow, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildPacket, buildReceiptHash, buildTLVs, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, classifyIntent, decodeAxis1Frame, encVarint, encodeAxis1Frame, hasScope, isAdminOpcode, isKnownOpcode, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseScope, resolveTimeout, sensitivityName, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, varintU };
781
+ declare function validateFrameShape(frame: any): boolean;
782
+ declare function isTimestampValid(ts: number, skewSeconds?: number): boolean;
783
+
784
+ export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, type ActorKeyRecord, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg$1 as AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, type AxisCrudHandler, type AxisEffect, type AxisHandler, type AxisHandlerInit, type AxisAlg as AxisJsonAlg, type AxisFrame as AxisJsonFrame, type AxisResponse as AxisJsonResponse, type AxisSig as AxisJsonSig, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, type AxisPostSensor, type AxisPreSensor, type AxisRequestContext, type AxisResponse$1 as AxisResponse, type AxisSensor, type AxisSensorInit, type AxisSig$1 as AxisSig, CAPABILITIES, type Capability, type CapsuleBatchBody, type CapsuleBatchResult, type CapsuleIssueBody, type CapsuleIssueResult, type CapsuleMode, type CapsuleRecord, type CapsuleRevokeBody, type CapsuleStatus, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, Handler, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_TIMEOUTS, Intent, type IntentDefinition, type IntentExecBody, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, type IssuerKeyRecord, type KeyStatus, PROOF_CAPABILITIES, type ReceiptEffect, RiskDecision, type RiskEvaluation, type RiskSignal, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, type SensorDecision, SensorDecisions, type SensorInput, type SensorMinifiedDecision, type SensorPhaseMetadata, type TickWindow, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildPacket, buildReceiptHash, buildTLVs, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, classifyIntent, decodeAxis1Frame, encVarint, encodeAxis1Frame, hasScope, isAdminOpcode, isKnownOpcode, isTimestampValid, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseScope, resolveTimeout, sensitivityName, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, validateFrameShape, varintU };
package/dist/index.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { AxisFrame } from './core/index.js';
1
+ import { AxisFrame as AxisFrame$1 } from './core/index.js';
2
2
  export { AXIS_MAGIC, AXIS_VERSION, AxisBinaryFrame, AxisFrameZ, TLV as AxisTlvType, BodyProfile, ERR_BAD_SIGNATURE, ERR_CONTRACT_VIOLATION, ERR_INVALID_PACKET, ERR_REPLAY_DETECTED, FLAG_BODY_TLV, FLAG_CHAIN_REQ, FLAG_HAS_WITNESS, MAX_BODY_LEN, MAX_FRAME_LEN, MAX_HDR_LEN, MAX_SIG_LEN, NCERT_ALG, NCERT_EXP, NCERT_ISSUER_KID, NCERT_KID, NCERT_NBF, NCERT_NODE_ID, NCERT_PAYLOAD, NCERT_PUB, NCERT_SCOPE, NCERT_SIG, PROOF_CAPSULE, PROOF_JWT, PROOF_LOOM, PROOF_MTLS, PROOF_NONE, PROOF_WITNESS, ProofType, TLV, TLV_ACTOR_ID, TLV_AUD, TLV_BODY_ARR, TLV_BODY_OBJ, TLV_CAPSULE, TLV_EFFECT, TLV_ERROR_CODE, TLV_ERROR_MSG, TLV_INDEX, TLV_INTENT, TLV_KID, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT, TLV_NODE, TLV_NODE_CERT_HASH, TLV_NODE_KID, TLV_NONCE, TLV_OFFSET, TLV_OK, TLV_PID, TLV_PREV_HASH, TLV_PROOF_REF, TLV_PROOF_TYPE, TLV_REALM, TLV_RECEIPT_HASH, TLV_RID, TLV_SHA256_CHUNK, TLV_TRACE_ID, TLV_TS, TLV_UPLOAD_ID, computeReceiptHash, computeSignaturePayload, decodeArray, decodeFrame, decodeObject, decodeTLVs, decodeTLVsList, decodeVarint, encodeFrame, encodeTLVs, encodeVarint, generateEd25519KeyPair, getSignTarget, sha256, signFrame, varintLength, verifyFrameSignature } from './core/index.js';
3
3
  import 'zod';
4
4
 
@@ -29,7 +29,7 @@ declare class IntentRouter {
29
29
  private handlers;
30
30
  register(intent: string, handler: any): void;
31
31
  registerHandler(instance: any): void;
32
- route(frame: AxisFrame): Promise<AxisEffect>;
32
+ route(frame: AxisFrame$1): Promise<AxisEffect>;
33
33
  private recordLatency;
34
34
  }
35
35
 
@@ -307,12 +307,12 @@ declare function b64urlDecodeString(str: string, encoding?: BufferEncoding): str
307
307
  declare function canonicalJson(value: any): string;
308
308
  declare function canonicalJsonExcluding(obj: Record<string, any>, exclude: string[]): string;
309
309
 
310
- type AxisAlg = 'EdDSA' | 'ES256' | 'RS256';
310
+ type AxisAlg$1 = 'EdDSA' | 'ES256' | 'RS256';
311
311
  type CapsuleStatus = 'ACTIVE' | 'CONSUMED' | 'REVOKED' | 'EXPIRED';
312
312
  type CapsuleMode = 'SINGLE_USE' | 'MULTI_USE';
313
313
  type KeyStatus = 'ACTIVE' | 'GRACE' | 'REVOKED' | 'RETIRED';
314
- interface AxisSig {
315
- alg: AxisAlg;
314
+ interface AxisSig$1 {
315
+ alg: AxisAlg$1;
316
316
  kid: string;
317
317
  value: string;
318
318
  }
@@ -324,7 +324,7 @@ interface AxisPacket$1<T = any> {
324
324
  actorId: string;
325
325
  opcode: string;
326
326
  body: T;
327
- sig: AxisSig;
327
+ sig: AxisSig$1;
328
328
  }
329
329
  interface AxisCapsuleConstraints {
330
330
  maxAmount?: number;
@@ -364,7 +364,7 @@ interface AxisCapsulePayload {
364
364
  }
365
365
  interface AxisCapsule {
366
366
  payload: AxisCapsulePayload;
367
- sig: AxisSig;
367
+ sig: AxisSig$1;
368
368
  }
369
369
  interface CapsuleIssueBody {
370
370
  intent: string;
@@ -396,7 +396,7 @@ interface CapsuleRevokeBody {
396
396
  capsuleId: string;
397
397
  reason: string;
398
398
  }
399
- interface AxisResponse<T = any> {
399
+ interface AxisResponse$1<T = any> {
400
400
  ok: boolean;
401
401
  pid: string;
402
402
  decisionId: string;
@@ -546,6 +546,26 @@ type AxisPacket = {
546
546
  };
547
547
  declare function buildPacket(hdr: Buffer, body: Buffer, sig: Buffer, flags?: number): AxisPacket;
548
548
 
549
+ type AxisAlg = Extract<AxisAlg$1, 'EdDSA'>;
550
+ type AxisSig = AxisSig$1 & {
551
+ alg: AxisAlg;
552
+ };
553
+ interface AxisFrame<T = any> {
554
+ v: 1;
555
+ pid: string;
556
+ nonce: string;
557
+ ts: number;
558
+ actorId: string;
559
+ aud?: string;
560
+ opcode: string;
561
+ headers: Map<number, Uint8Array>;
562
+ body: T;
563
+ sig: AxisSig;
564
+ }
565
+ type AxisResponse<T = any> = AxisResponse$1<T> & {
566
+ policyRefs?: string[];
567
+ riskScore?: number;
568
+ };
549
569
  interface AxisObservedContext {
550
570
  ip?: string;
551
571
  ua?: string;
@@ -703,6 +723,27 @@ type Capability = keyof typeof CAPABILITIES;
703
723
  declare const PROOF_CAPABILITIES: Record<number, Capability[]>;
704
724
  declare const INTENT_REQUIREMENTS: Record<string, Capability[]>;
705
725
 
726
+ interface RiskSignal {
727
+ type: string;
728
+ severity: 'low' | 'medium' | 'high' | 'critical';
729
+ value: any;
730
+ message: string;
731
+ }
732
+ declare enum RiskDecision {
733
+ ALLOW = "ALLOW",
734
+ THROTTLE = "THROTTLE",
735
+ STEP_UP = "STEP_UP",
736
+ WITNESS = "WITNESS",
737
+ DENY = "DENY"
738
+ }
739
+ interface RiskEvaluation {
740
+ decision: RiskDecision;
741
+ reason?: string;
742
+ retryAfterMs?: number;
743
+ confidence: number;
744
+ signals: RiskSignal[];
745
+ }
746
+
706
747
  declare const AXIS_OPCODES: Set<string>;
707
748
  declare function isKnownOpcode(op: string): boolean;
708
749
  declare function isAdminOpcode(op: string): boolean;
@@ -737,4 +778,7 @@ interface IntentDefinition {
737
778
  deprecated?: boolean;
738
779
  }
739
780
 
740
- export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, type ActorKeyRecord, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, type AxisCrudHandler, type AxisEffect, type AxisHandler, type AxisHandlerInit, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, type AxisPostSensor, type AxisPreSensor, type AxisRequestContext, type AxisResponse, type AxisSensor, type AxisSensorInit, type AxisSig, CAPABILITIES, type Capability, type CapsuleBatchBody, type CapsuleBatchResult, type CapsuleIssueBody, type CapsuleIssueResult, type CapsuleMode, type CapsuleRecord, type CapsuleRevokeBody, type CapsuleStatus, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, Handler, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_TIMEOUTS, Intent, type IntentDefinition, type IntentExecBody, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, type IssuerKeyRecord, type KeyStatus, PROOF_CAPABILITIES, type ReceiptEffect, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, type SensorDecision, SensorDecisions, type SensorInput, type SensorMinifiedDecision, type SensorPhaseMetadata, type TickWindow, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildPacket, buildReceiptHash, buildTLVs, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, classifyIntent, decodeAxis1Frame, encVarint, encodeAxis1Frame, hasScope, isAdminOpcode, isKnownOpcode, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseScope, resolveTimeout, sensitivityName, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, varintU };
781
+ declare function validateFrameShape(frame: any): boolean;
782
+ declare function isTimestampValid(ts: number, skewSeconds?: number): boolean;
783
+
784
+ export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, type ActorKeyRecord, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg$1 as AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, type AxisCrudHandler, type AxisEffect, type AxisHandler, type AxisHandlerInit, type AxisAlg as AxisJsonAlg, type AxisFrame as AxisJsonFrame, type AxisResponse as AxisJsonResponse, type AxisSig as AxisJsonSig, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, type AxisPostSensor, type AxisPreSensor, type AxisRequestContext, type AxisResponse$1 as AxisResponse, type AxisSensor, type AxisSensorInit, type AxisSig$1 as AxisSig, CAPABILITIES, type Capability, type CapsuleBatchBody, type CapsuleBatchResult, type CapsuleIssueBody, type CapsuleIssueResult, type CapsuleMode, type CapsuleRecord, type CapsuleRevokeBody, type CapsuleStatus, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, Handler, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_TIMEOUTS, Intent, type IntentDefinition, type IntentExecBody, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, type IssuerKeyRecord, type KeyStatus, PROOF_CAPABILITIES, type ReceiptEffect, RiskDecision, type RiskEvaluation, type RiskSignal, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, type SensorDecision, SensorDecisions, type SensorInput, type SensorMinifiedDecision, type SensorPhaseMetadata, type TickWindow, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildPacket, buildReceiptHash, buildTLVs, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, classifyIntent, decodeAxis1Frame, encVarint, encodeAxis1Frame, hasScope, isAdminOpcode, isKnownOpcode, isTimestampValid, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseScope, resolveTimeout, sensitivityName, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, validateFrameShape, varintU };
package/dist/index.js CHANGED
@@ -91,6 +91,7 @@ __export(index_exports, {
91
91
  PROOF_NONE: () => PROOF_NONE,
92
92
  PROOF_WITNESS: () => PROOF_WITNESS,
93
93
  ProofType: () => ProofType,
94
+ RiskDecision: () => RiskDecision,
94
95
  Schema2002_PasskeyLoginOptionsRes: () => Schema2002_PasskeyLoginOptionsRes,
95
96
  Schema2011_PasskeyLoginVerifyReq: () => Schema2011_PasskeyLoginVerifyReq,
96
97
  Schema2012_PasskeyLoginVerifyRes: () => Schema2012_PasskeyLoginVerifyRes,
@@ -160,6 +161,7 @@ __export(index_exports, {
160
161
  hasScope: () => hasScope,
161
162
  isAdminOpcode: () => isAdminOpcode,
162
163
  isKnownOpcode: () => isKnownOpcode,
164
+ isTimestampValid: () => isTimestampValid,
163
165
  nonce16: () => nonce16,
164
166
  normalizeSensorDecision: () => normalizeSensorDecision,
165
167
  packPasskeyLoginOptionsReq: () => packPasskeyLoginOptionsReq,
@@ -178,6 +180,7 @@ __export(index_exports, {
178
180
  unpackPasskeyLoginVerifyReq: () => unpackPasskeyLoginVerifyReq,
179
181
  unpackPasskeyRegisterOptionsReq: () => unpackPasskeyRegisterOptionsReq,
180
182
  utf8: () => utf8,
183
+ validateFrameShape: () => validateFrameShape,
181
184
  varintLength: () => varintLength,
182
185
  varintU: () => varintU,
183
186
  verifyFrameSignature: () => verifyFrameSignature
@@ -2109,6 +2112,16 @@ var INTENT_REQUIREMENTS = {
2109
2112
  "admin.*": ["admin"]
2110
2113
  };
2111
2114
 
2115
+ // src/risk/index.ts
2116
+ var RiskDecision = /* @__PURE__ */ ((RiskDecision2) => {
2117
+ RiskDecision2["ALLOW"] = "ALLOW";
2118
+ RiskDecision2["THROTTLE"] = "THROTTLE";
2119
+ RiskDecision2["STEP_UP"] = "STEP_UP";
2120
+ RiskDecision2["WITNESS"] = "WITNESS";
2121
+ RiskDecision2["DENY"] = "DENY";
2122
+ return RiskDecision2;
2123
+ })(RiskDecision || {});
2124
+
2112
2125
  // src/core/opcodes.ts
2113
2126
  var AXIS_OPCODES = /* @__PURE__ */ new Set([
2114
2127
  "CAPSULE.ISSUE",
@@ -2228,6 +2241,49 @@ function resolveTimeout(intent) {
2228
2241
  }
2229
2242
  return DEFAULT_TIMEOUT;
2230
2243
  }
2244
+
2245
+ // src/core/frame-validator.ts
2246
+ function validateFrameShape(frame) {
2247
+ if (!frame || typeof frame !== "object") {
2248
+ return false;
2249
+ }
2250
+ if (frame.v !== 1) {
2251
+ return false;
2252
+ }
2253
+ const requiredStrings = ["pid", "nonce", "actorId", "opcode"];
2254
+ for (const key of requiredStrings) {
2255
+ if (typeof frame[key] !== "string" || frame[key].length < 6) {
2256
+ return false;
2257
+ }
2258
+ }
2259
+ if (typeof frame.ts !== "number" || !Number.isFinite(frame.ts)) {
2260
+ return false;
2261
+ }
2262
+ if (frame.aud !== void 0 && (typeof frame.aud !== "string" || frame.aud.length === 0)) {
2263
+ return false;
2264
+ }
2265
+ if (!frame.sig || typeof frame.sig !== "object") {
2266
+ return false;
2267
+ }
2268
+ if (frame.sig.alg !== "EdDSA") {
2269
+ return false;
2270
+ }
2271
+ if (typeof frame.sig.kid !== "string" || frame.sig.kid.length < 8) {
2272
+ return false;
2273
+ }
2274
+ if (typeof frame.sig.value !== "string" || frame.sig.value.length < 32) {
2275
+ return false;
2276
+ }
2277
+ if (typeof frame.body !== "object" || frame.body === null) {
2278
+ return false;
2279
+ }
2280
+ return true;
2281
+ }
2282
+ function isTimestampValid(ts, skewSeconds = 120) {
2283
+ const now = Math.floor(Date.now() / 1e3);
2284
+ const diff = Math.abs(now - ts);
2285
+ return diff <= skewSeconds;
2286
+ }
2231
2287
  // Annotate the CommonJS export names for ESM import in node:
2232
2288
  0 && (module.exports = {
2233
2289
  ATS1_HDR,
@@ -2284,6 +2340,7 @@ function resolveTimeout(intent) {
2284
2340
  PROOF_NONE,
2285
2341
  PROOF_WITNESS,
2286
2342
  ProofType,
2343
+ RiskDecision,
2287
2344
  Schema2002_PasskeyLoginOptionsRes,
2288
2345
  Schema2011_PasskeyLoginVerifyReq,
2289
2346
  Schema2012_PasskeyLoginVerifyRes,
@@ -2353,6 +2410,7 @@ function resolveTimeout(intent) {
2353
2410
  hasScope,
2354
2411
  isAdminOpcode,
2355
2412
  isKnownOpcode,
2413
+ isTimestampValid,
2356
2414
  nonce16,
2357
2415
  normalizeSensorDecision,
2358
2416
  packPasskeyLoginOptionsReq,
@@ -2371,6 +2429,7 @@ function resolveTimeout(intent) {
2371
2429
  unpackPasskeyLoginVerifyReq,
2372
2430
  unpackPasskeyRegisterOptionsReq,
2373
2431
  utf8,
2432
+ validateFrameShape,
2374
2433
  varintLength,
2375
2434
  varintU,
2376
2435
  verifyFrameSignature