@nextera.one/axis-server-sdk 2.2.1 → 2.2.2

package/dist/cce/index.d.ts

@@ -0,0 +1,162 @@
+import { C as CceCapsuleClaims, a as CceExecutionContext, b as CceRequestEnvelope } from '../cce-pipeline-DbGBSsCG.js';
+export { c as CCE_AES_KEY_BYTES, d as CCE_DERIVATION, e as CCE_ERROR, f as CCE_IV_BYTES, g as CCE_NONCE_BYTES, h as CCE_PROTOCOL_VERSION, i as CCE_TAG_BYTES, j as CceAlgorithm, k as CceAlgorithmDescriptor, l as CceAxisSigner, m as CceClientKeyEncryptor, n as CceConstraints, o as CceEncryptedKey, p as CceEncryptedPayload, q as CceError, r as CceErrorCode, s as CceHandler, t as CceHandlerContext, u as CceHandlerResult, v as CceKdfAlgorithm, w as CceKemAlgorithm, x as CcePipelineConfig, y as CcePipelineResult, z as CcePolicyContext, A as CcePolicyDecision, B as CcePolicyEvaluator, D as CceResponseEnvelope, E as CceResponseOptions, F as CceResponseStatus, G as CceSignature, H as CceVerificationState, I as CceWitnessRecord, J as CceWitnessStore, K as InMemoryCceWitnessStore, L as buildCceErrorResponse, M as buildCceResponse, N as buildWitnessRecord, O as executeCcePipeline, P as extractVerificationState } from '../cce-pipeline-DbGBSsCG.js';
+import { A as AxisSensor, S as SensorInput, a as SensorDecision } from '../axis-sensor-GBEI3Fab.js';
+
+interface CceDerivationInput {
+    axisLocalSecret: string;
+    capsule: CceCapsuleClaims;
+    requestNonce: string;
+    responseNonce?: string;
+}
+declare function deriveRequestExecutionKey(input: CceDerivationInput): Uint8Array;
+declare function deriveResponseExecutionKey(input: CceDerivationInput & {
+    responseNonce: string;
+}): Uint8Array;
+declare function deriveWitnessKey(input: CceDerivationInput): Uint8Array;
+declare function buildExecutionContext(input: CceDerivationInput, requestId: string): CceExecutionContext;
+declare function generateCceNonce(): string;
+
+interface CceAxisKeyProvider {
+    unwrapKey(encryptedKeyB64: string, algorithm: string, axisKid: string, ephemeralPkB64?: string): Promise<Uint8Array | null>;
+}
+interface CceAesGcmProvider {
+    decrypt(key: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array | null>;
+}
+interface CcePayloadValidatorResult {
+    ok: boolean;
+    intent?: string;
+    code?: string;
+    reason?: string;
+}
+interface CcePayloadValidator {
+    validate(plaintext: Uint8Array, envelope: CceRequestEnvelope): Promise<CcePayloadValidatorResult>;
+}
+declare class CcePayloadDecryptionSensor implements AxisSensor {
+    private readonly keyProvider;
+    private readonly aesProvider;
+    private readonly maxPayloadBytes;
+    private readonly payloadValidator?;
+    readonly name = "cce.payload.decryption";
+    readonly order = 145;
+    readonly phase: "POST_DECODE";
+    constructor(keyProvider: CceAxisKeyProvider, aesProvider: CceAesGcmProvider, maxPayloadBytes?: number, payloadValidator?: CcePayloadValidator | undefined);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare function aesGcmEncrypt(key: Uint8Array, plaintext: Uint8Array, aad?: Uint8Array): {
+    iv: Uint8Array;
+    ciphertext: Uint8Array;
+    tag: Uint8Array;
+};
+declare function aesGcmDecrypt(key: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Uint8Array | null;
+declare function generateAesKey(): Uint8Array;
+declare function generateIv(): Uint8Array;
+declare function base64UrlEncode(bytes: Uint8Array): string;
+declare function base64UrlDecode(input: string): Uint8Array;
+declare function hashPayload(payload: Uint8Array): string;
+
+declare const nodeAesGcmProvider: CceAesGcmProvider;
+
+declare class CceEnvelopeValidationSensor implements AxisSensor {
+    readonly name = "cce.envelope.validation";
+    readonly order = 5;
+    readonly phase: "PRE_DECODE";
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+interface CceClientKeyResolver {
+    resolve(kid: string): Promise<{
+        publicKeyHex: string;
+        alg: string;
+    } | null>;
+}
+interface CceSignatureVerifier {
+    verify(message: Uint8Array, signatureHex: string, publicKeyHex: string, alg: string): Promise<boolean>;
+}
+declare class CceClientSignatureSensor implements AxisSensor {
+    private readonly keyResolver;
+    private readonly signatureVerifier;
+    readonly name = "cce.client.signature";
+    readonly order = 45;
+    readonly phase: "POST_DECODE";
+    constructor(keyResolver: CceClientKeyResolver, signatureVerifier: CceSignatureVerifier);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+interface CceIssuerKeyResolver {
+    resolve(kid: string): Promise<{
+        publicKeyHex: string;
+    } | null>;
+}
+interface CceCapsuleSignatureVerifier {
+    verify(claims: Omit<CceCapsuleClaims, "issuer_sig">, signature: {
+        alg: string;
+        kid: string;
+        value: string;
+    }, publicKeyHex: string): Promise<boolean>;
+}
+declare class CceCapsuleVerificationSensor implements AxisSensor {
+    private readonly issuerKeyResolver;
+    private readonly capsuleVerifier;
+    readonly name = "cce.capsule.verification";
+    readonly order = 50;
+    readonly phase: "POST_DECODE";
+    constructor(issuerKeyResolver: CceIssuerKeyResolver, capsuleVerifier: CceCapsuleSignatureVerifier);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare class CceTpsWindowSensor implements AxisSensor {
+    private readonly skewMs;
+    readonly name = "cce.tps.window";
+    readonly order = 92;
+    readonly phase: "POST_DECODE";
+    constructor(skewMs?: number);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare class CceAudienceIntentBindingSensor implements AxisSensor {
+    private readonly axisAudience;
+    readonly name = "cce.audience.intent.binding";
+    readonly order = 95;
+    readonly phase: "POST_DECODE";
+    constructor(axisAudience: string);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+interface CceReplayStore {
+    checkAndMark(key: string, ttlMs: number): Promise<boolean>;
+    isCapsuleConsumed(capsuleId: string): Promise<boolean>;
+    markCapsuleConsumed(capsuleId: string, ttlMs: number): Promise<void>;
+    isCapsuleRevoked(capsuleId: string): Promise<boolean>;
+}
+declare class InMemoryCceReplayStore implements CceReplayStore {
+    private nonces;
+    private consumed;
+    private revoked;
+    checkAndMark(key: string, ttlMs: number): Promise<boolean>;
+    isCapsuleConsumed(capsuleId: string): Promise<boolean>;
+    markCapsuleConsumed(capsuleId: string, _ttlMs: number): Promise<void>;
+    isCapsuleRevoked(capsuleId: string): Promise<boolean>;
+    revoke(capsuleId: string): void;
+    private cleanup;
+}
+declare class CceReplayProtectionSensor implements AxisSensor {
+    private readonly replayStore;
+    readonly name = "cce.replay.protection";
+    readonly order = 98;
+    readonly phase: "POST_DECODE";
+    private readonly nonceTtlMs;
+    constructor(replayStore: CceReplayStore, options?: {
+        nonceTtlMs?: number;
+    });
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+export { type CceAesGcmProvider, CceAudienceIntentBindingSensor, type CceAxisKeyProvider, CceCapsuleClaims, type CceCapsuleSignatureVerifier, CceCapsuleVerificationSensor, type CceClientKeyResolver, CceClientSignatureSensor, type CceDerivationInput, CceEnvelopeValidationSensor, CceExecutionContext, type CceIssuerKeyResolver, CcePayloadDecryptionSensor, type CcePayloadValidator, type CcePayloadValidatorResult, CceReplayProtectionSensor, type CceReplayStore, CceRequestEnvelope, type CceSignatureVerifier, CceTpsWindowSensor, InMemoryCceReplayStore, aesGcmDecrypt, aesGcmEncrypt, base64UrlDecode, base64UrlEncode, buildExecutionContext, deriveRequestExecutionKey, deriveResponseExecutionKey, deriveWitnessKey, generateAesKey, generateCceNonce, generateIv, hashPayload, nodeAesGcmProvider };