@nextera.one/axis-server-sdk 2.2.7 → 2.2.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{index-BAoKsEOu.d.ts → index-Dci5tlZE.d.ts} +24 -12
- package/dist/{index-BLK3AtRm.d.mts → index-DypvaTKs.d.mts} +24 -12
- package/dist/index.d.mts +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +402 -339
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +349 -286
- package/dist/index.mjs.map +1 -1
- package/dist/sensors/index.d.mts +3 -3
- package/dist/sensors/index.d.ts +3 -3
- package/dist/sensors/index.js +402 -339
- package/dist/sensors/index.js.map +1 -1
- package/dist/sensors/index.mjs +349 -286
- package/dist/sensors/index.mjs.map +1 -1
- package/package.json +7 -7
package/dist/index.mjs
CHANGED
|
@@ -260,7 +260,7 @@ function AxisRateLimit(config) {
|
|
|
260
260
|
return descriptor;
|
|
261
261
|
};
|
|
262
262
|
}
|
|
263
|
-
var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_RATE_LIMIT_KEY;
|
|
263
|
+
var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_AUTHORIZED_KEY, AXIS_RATE_LIMIT_KEY;
|
|
264
264
|
var init_intent_policy_decorator = __esm({
|
|
265
265
|
"src/decorators/intent-policy.decorator.ts"() {
|
|
266
266
|
AXIS_META_KEY = "axis:axis";
|
|
@@ -269,6 +269,7 @@ var init_intent_policy_decorator = __esm({
|
|
|
269
269
|
REQUIRED_PROOF_METADATA_KEY = "axis:required_proof";
|
|
270
270
|
AXIS_PUBLIC_KEY = "axis:public";
|
|
271
271
|
AXIS_ANONYMOUS_KEY = "axis:anonymous";
|
|
272
|
+
AXIS_AUTHORIZED_KEY = "axis:authorized";
|
|
272
273
|
AXIS_RATE_LIMIT_KEY = "axis:rateLimit";
|
|
273
274
|
}
|
|
274
275
|
});
|
|
@@ -1471,6 +1472,271 @@ var init_axis_chain_executor = __esm({
|
|
|
1471
1472
|
}
|
|
1472
1473
|
});
|
|
1473
1474
|
|
|
1475
|
+
// src/security/scopes.ts
|
|
1476
|
+
function hasScope(scopes, required) {
|
|
1477
|
+
if (!Array.isArray(scopes) || scopes.length === 0) {
|
|
1478
|
+
return false;
|
|
1479
|
+
}
|
|
1480
|
+
if (scopes.includes(required)) {
|
|
1481
|
+
return true;
|
|
1482
|
+
}
|
|
1483
|
+
const [resource, id] = required.split(":");
|
|
1484
|
+
if (resource && id) {
|
|
1485
|
+
const wildcard = `${resource}:*`;
|
|
1486
|
+
if (scopes.includes(wildcard)) {
|
|
1487
|
+
return true;
|
|
1488
|
+
}
|
|
1489
|
+
}
|
|
1490
|
+
return false;
|
|
1491
|
+
}
|
|
1492
|
+
function parseScope(scope) {
|
|
1493
|
+
const parts = scope.split(":");
|
|
1494
|
+
if (parts.length !== 2) return null;
|
|
1495
|
+
return { resource: parts[0], id: parts[1] };
|
|
1496
|
+
}
|
|
1497
|
+
function canAccessResource(scopes, resourceType, resourceId) {
|
|
1498
|
+
const required = `${resourceType}:${resourceId}`;
|
|
1499
|
+
return hasScope(scopes, required);
|
|
1500
|
+
}
|
|
1501
|
+
var init_scopes = __esm({
|
|
1502
|
+
"src/security/scopes.ts"() {
|
|
1503
|
+
}
|
|
1504
|
+
});
|
|
1505
|
+
|
|
1506
|
+
// src/security/inline-capsule.ts
|
|
1507
|
+
function normalizeInlineCapsule(input) {
|
|
1508
|
+
if (!input || typeof input !== "object" || Array.isArray(input)) {
|
|
1509
|
+
return null;
|
|
1510
|
+
}
|
|
1511
|
+
const raw = input;
|
|
1512
|
+
const scopes = normalizeStringList(raw.scopes ?? raw.scope);
|
|
1513
|
+
return {
|
|
1514
|
+
id: normalizeScalar(raw.id),
|
|
1515
|
+
actorId: normalizeScalar(raw.actorId),
|
|
1516
|
+
intents: normalizeStringList(raw.intents),
|
|
1517
|
+
issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
|
|
1518
|
+
expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
|
|
1519
|
+
realm: normalizeScalar(raw.realm),
|
|
1520
|
+
node: normalizeScalar(raw.node),
|
|
1521
|
+
scopes,
|
|
1522
|
+
raw
|
|
1523
|
+
};
|
|
1524
|
+
}
|
|
1525
|
+
function inlineCapsuleAllowsIntent(capsule, intent) {
|
|
1526
|
+
if (!capsule.intents || capsule.intents.length === 0) {
|
|
1527
|
+
return false;
|
|
1528
|
+
}
|
|
1529
|
+
for (const pattern of capsule.intents) {
|
|
1530
|
+
if (pattern === "*" || pattern === intent) {
|
|
1531
|
+
return true;
|
|
1532
|
+
}
|
|
1533
|
+
if (pattern.endsWith(".*")) {
|
|
1534
|
+
const prefix = pattern.slice(0, -1);
|
|
1535
|
+
if (intent.startsWith(prefix)) {
|
|
1536
|
+
return true;
|
|
1537
|
+
}
|
|
1538
|
+
}
|
|
1539
|
+
}
|
|
1540
|
+
return false;
|
|
1541
|
+
}
|
|
1542
|
+
function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
|
|
1543
|
+
if (capsule.expiresAt === void 0) {
|
|
1544
|
+
return false;
|
|
1545
|
+
}
|
|
1546
|
+
return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
|
|
1547
|
+
}
|
|
1548
|
+
function resolvePolicyScopes(scopes, context) {
|
|
1549
|
+
return scopes.map(
|
|
1550
|
+
(scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
|
|
1551
|
+
const resolved = resolveTemplateExpression(expression.trim(), context);
|
|
1552
|
+
if (resolved === void 0 || resolved === null || resolved === "") {
|
|
1553
|
+
throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
|
|
1554
|
+
}
|
|
1555
|
+
return String(resolved);
|
|
1556
|
+
})
|
|
1557
|
+
);
|
|
1558
|
+
}
|
|
1559
|
+
function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
|
|
1560
|
+
if (!capsule.scopes || capsule.scopes.length === 0) {
|
|
1561
|
+
return false;
|
|
1562
|
+
}
|
|
1563
|
+
if (mode === "any") {
|
|
1564
|
+
return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
|
|
1565
|
+
}
|
|
1566
|
+
return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
|
|
1567
|
+
}
|
|
1568
|
+
function resolveTemplateExpression(expression, context) {
|
|
1569
|
+
if (expression === "intent") {
|
|
1570
|
+
return context.intent;
|
|
1571
|
+
}
|
|
1572
|
+
if (expression === "actorId") {
|
|
1573
|
+
return context.actorId;
|
|
1574
|
+
}
|
|
1575
|
+
if (expression === "chainId") {
|
|
1576
|
+
return context.chainId;
|
|
1577
|
+
}
|
|
1578
|
+
if (expression === "stepId") {
|
|
1579
|
+
return context.stepId;
|
|
1580
|
+
}
|
|
1581
|
+
if (expression.startsWith("body.")) {
|
|
1582
|
+
return getNestedValue(context.body, expression.slice(5));
|
|
1583
|
+
}
|
|
1584
|
+
return void 0;
|
|
1585
|
+
}
|
|
1586
|
+
function getNestedValue(value, path2) {
|
|
1587
|
+
if (!value || typeof value !== "object") {
|
|
1588
|
+
return void 0;
|
|
1589
|
+
}
|
|
1590
|
+
return path2.split(".").reduce((current, segment) => {
|
|
1591
|
+
if (!current || typeof current !== "object") {
|
|
1592
|
+
return void 0;
|
|
1593
|
+
}
|
|
1594
|
+
return current[segment];
|
|
1595
|
+
}, value);
|
|
1596
|
+
}
|
|
1597
|
+
function normalizeScalar(value) {
|
|
1598
|
+
if (typeof value === "string") {
|
|
1599
|
+
return value;
|
|
1600
|
+
}
|
|
1601
|
+
if (value instanceof Uint8Array) {
|
|
1602
|
+
return Buffer.from(value).toString("hex");
|
|
1603
|
+
}
|
|
1604
|
+
return void 0;
|
|
1605
|
+
}
|
|
1606
|
+
function normalizeStringList(value) {
|
|
1607
|
+
if (!value) {
|
|
1608
|
+
return void 0;
|
|
1609
|
+
}
|
|
1610
|
+
const list = Array.isArray(value) ? value : [value];
|
|
1611
|
+
const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
|
|
1612
|
+
return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
|
|
1613
|
+
}
|
|
1614
|
+
function normalizeTimestamp(value) {
|
|
1615
|
+
if (typeof value === "bigint") {
|
|
1616
|
+
return value;
|
|
1617
|
+
}
|
|
1618
|
+
if (typeof value === "number" && Number.isFinite(value)) {
|
|
1619
|
+
return BigInt(Math.trunc(value));
|
|
1620
|
+
}
|
|
1621
|
+
if (typeof value === "string" && value.trim().length > 0) {
|
|
1622
|
+
try {
|
|
1623
|
+
return BigInt(value);
|
|
1624
|
+
} catch {
|
|
1625
|
+
return void 0;
|
|
1626
|
+
}
|
|
1627
|
+
}
|
|
1628
|
+
return void 0;
|
|
1629
|
+
}
|
|
1630
|
+
var init_inline_capsule = __esm({
|
|
1631
|
+
"src/security/inline-capsule.ts"() {
|
|
1632
|
+
init_scopes();
|
|
1633
|
+
}
|
|
1634
|
+
});
|
|
1635
|
+
|
|
1636
|
+
// src/sensor/axis-sensor.ts
|
|
1637
|
+
function normalizeSensorDecision(sensorDecision) {
|
|
1638
|
+
if ("action" in sensorDecision) {
|
|
1639
|
+
switch (sensorDecision.action) {
|
|
1640
|
+
case "ALLOW":
|
|
1641
|
+
return {
|
|
1642
|
+
allow: true,
|
|
1643
|
+
riskScore: 0,
|
|
1644
|
+
reasons: [],
|
|
1645
|
+
meta: sensorDecision.meta
|
|
1646
|
+
};
|
|
1647
|
+
case "DENY":
|
|
1648
|
+
return {
|
|
1649
|
+
allow: false,
|
|
1650
|
+
riskScore: 100,
|
|
1651
|
+
reasons: [sensorDecision.code, sensorDecision.reason].filter(
|
|
1652
|
+
Boolean
|
|
1653
|
+
),
|
|
1654
|
+
meta: sensorDecision.meta,
|
|
1655
|
+
retryAfterMs: sensorDecision.retryAfterMs
|
|
1656
|
+
};
|
|
1657
|
+
case "THROTTLE":
|
|
1658
|
+
return {
|
|
1659
|
+
allow: false,
|
|
1660
|
+
riskScore: 50,
|
|
1661
|
+
reasons: ["RATE_LIMIT"],
|
|
1662
|
+
retryAfterMs: sensorDecision.retryAfterMs,
|
|
1663
|
+
meta: sensorDecision.meta
|
|
1664
|
+
};
|
|
1665
|
+
case "FLAG":
|
|
1666
|
+
return {
|
|
1667
|
+
allow: true,
|
|
1668
|
+
riskScore: sensorDecision.scoreDelta,
|
|
1669
|
+
reasons: sensorDecision.reasons,
|
|
1670
|
+
meta: sensorDecision.meta
|
|
1671
|
+
};
|
|
1672
|
+
}
|
|
1673
|
+
}
|
|
1674
|
+
return {
|
|
1675
|
+
allow: sensorDecision.allow,
|
|
1676
|
+
riskScore: sensorDecision.riskScore,
|
|
1677
|
+
reasons: sensorDecision.reasons,
|
|
1678
|
+
tags: sensorDecision.tags,
|
|
1679
|
+
meta: sensorDecision.meta,
|
|
1680
|
+
tighten: sensorDecision.tighten,
|
|
1681
|
+
retryAfterMs: sensorDecision.retryAfterMs
|
|
1682
|
+
};
|
|
1683
|
+
}
|
|
1684
|
+
var Decision, SensorDecisions;
|
|
1685
|
+
var init_axis_sensor = __esm({
|
|
1686
|
+
"src/sensor/axis-sensor.ts"() {
|
|
1687
|
+
Decision = /* @__PURE__ */ ((Decision2) => {
|
|
1688
|
+
Decision2["ALLOW"] = "ALLOW";
|
|
1689
|
+
Decision2["DENY"] = "DENY";
|
|
1690
|
+
Decision2["THROTTLE"] = "THROTTLE";
|
|
1691
|
+
Decision2["FLAG"] = "FLAG";
|
|
1692
|
+
return Decision2;
|
|
1693
|
+
})(Decision || {});
|
|
1694
|
+
SensorDecisions = {
|
|
1695
|
+
allow(meta, tags) {
|
|
1696
|
+
return {
|
|
1697
|
+
decision: "ALLOW" /* ALLOW */,
|
|
1698
|
+
allow: true,
|
|
1699
|
+
riskScore: 0,
|
|
1700
|
+
reasons: [],
|
|
1701
|
+
tags,
|
|
1702
|
+
meta
|
|
1703
|
+
};
|
|
1704
|
+
},
|
|
1705
|
+
deny(code, reason, meta) {
|
|
1706
|
+
return {
|
|
1707
|
+
decision: "DENY" /* DENY */,
|
|
1708
|
+
allow: false,
|
|
1709
|
+
riskScore: 100,
|
|
1710
|
+
code,
|
|
1711
|
+
reasons: [code, reason].filter(Boolean),
|
|
1712
|
+
meta
|
|
1713
|
+
};
|
|
1714
|
+
},
|
|
1715
|
+
throttle(retryAfterMs, meta) {
|
|
1716
|
+
return {
|
|
1717
|
+
decision: "THROTTLE" /* THROTTLE */,
|
|
1718
|
+
allow: false,
|
|
1719
|
+
riskScore: 50,
|
|
1720
|
+
retryAfterMs,
|
|
1721
|
+
code: "RATE_LIMIT",
|
|
1722
|
+
reasons: ["RATE_LIMIT"],
|
|
1723
|
+
meta
|
|
1724
|
+
};
|
|
1725
|
+
},
|
|
1726
|
+
flag(scoreDelta, reasons, meta) {
|
|
1727
|
+
return {
|
|
1728
|
+
decision: "FLAG" /* FLAG */,
|
|
1729
|
+
allow: true,
|
|
1730
|
+
riskScore: scoreDelta,
|
|
1731
|
+
scoreDelta,
|
|
1732
|
+
reasons,
|
|
1733
|
+
meta
|
|
1734
|
+
};
|
|
1735
|
+
}
|
|
1736
|
+
};
|
|
1737
|
+
}
|
|
1738
|
+
});
|
|
1739
|
+
|
|
1474
1740
|
// src/cce/cce.types.ts
|
|
1475
1741
|
var CCE_PROTOCOL_VERSION, CCE_DERIVATION, CCE_AES_KEY_BYTES, CCE_IV_BYTES, CCE_NONCE_BYTES, CCE_ERROR, CceError;
|
|
1476
1742
|
var init_cce_types = __esm({
|
|
@@ -1844,116 +2110,12 @@ function hexToBytes2(hex) {
|
|
|
1844
2110
|
for (let i = 0; i < bytes2.length; i++) {
|
|
1845
2111
|
bytes2[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
|
|
1846
2112
|
}
|
|
1847
|
-
return bytes2;
|
|
1848
|
-
}
|
|
1849
|
-
var init_cce_witness_observer = __esm({
|
|
1850
|
-
"src/cce/cce-witness.observer.ts"() {
|
|
1851
|
-
init_cce_crypto();
|
|
1852
|
-
init_cce_types();
|
|
1853
|
-
}
|
|
1854
|
-
});
|
|
1855
|
-
|
|
1856
|
-
// src/sensor/axis-sensor.ts
|
|
1857
|
-
function normalizeSensorDecision(sensorDecision) {
|
|
1858
|
-
if ("action" in sensorDecision) {
|
|
1859
|
-
switch (sensorDecision.action) {
|
|
1860
|
-
case "ALLOW":
|
|
1861
|
-
return {
|
|
1862
|
-
allow: true,
|
|
1863
|
-
riskScore: 0,
|
|
1864
|
-
reasons: [],
|
|
1865
|
-
meta: sensorDecision.meta
|
|
1866
|
-
};
|
|
1867
|
-
case "DENY":
|
|
1868
|
-
return {
|
|
1869
|
-
allow: false,
|
|
1870
|
-
riskScore: 100,
|
|
1871
|
-
reasons: [sensorDecision.code, sensorDecision.reason].filter(
|
|
1872
|
-
Boolean
|
|
1873
|
-
),
|
|
1874
|
-
meta: sensorDecision.meta,
|
|
1875
|
-
retryAfterMs: sensorDecision.retryAfterMs
|
|
1876
|
-
};
|
|
1877
|
-
case "THROTTLE":
|
|
1878
|
-
return {
|
|
1879
|
-
allow: false,
|
|
1880
|
-
riskScore: 50,
|
|
1881
|
-
reasons: ["RATE_LIMIT"],
|
|
1882
|
-
retryAfterMs: sensorDecision.retryAfterMs,
|
|
1883
|
-
meta: sensorDecision.meta
|
|
1884
|
-
};
|
|
1885
|
-
case "FLAG":
|
|
1886
|
-
return {
|
|
1887
|
-
allow: true,
|
|
1888
|
-
riskScore: sensorDecision.scoreDelta,
|
|
1889
|
-
reasons: sensorDecision.reasons,
|
|
1890
|
-
meta: sensorDecision.meta
|
|
1891
|
-
};
|
|
1892
|
-
}
|
|
1893
|
-
}
|
|
1894
|
-
return {
|
|
1895
|
-
allow: sensorDecision.allow,
|
|
1896
|
-
riskScore: sensorDecision.riskScore,
|
|
1897
|
-
reasons: sensorDecision.reasons,
|
|
1898
|
-
tags: sensorDecision.tags,
|
|
1899
|
-
meta: sensorDecision.meta,
|
|
1900
|
-
tighten: sensorDecision.tighten,
|
|
1901
|
-
retryAfterMs: sensorDecision.retryAfterMs
|
|
1902
|
-
};
|
|
2113
|
+
return bytes2;
|
|
1903
2114
|
}
|
|
1904
|
-
var
|
|
1905
|
-
|
|
1906
|
-
|
|
1907
|
-
|
|
1908
|
-
Decision2["ALLOW"] = "ALLOW";
|
|
1909
|
-
Decision2["DENY"] = "DENY";
|
|
1910
|
-
Decision2["THROTTLE"] = "THROTTLE";
|
|
1911
|
-
Decision2["FLAG"] = "FLAG";
|
|
1912
|
-
return Decision2;
|
|
1913
|
-
})(Decision || {});
|
|
1914
|
-
SensorDecisions = {
|
|
1915
|
-
allow(meta, tags) {
|
|
1916
|
-
return {
|
|
1917
|
-
decision: "ALLOW" /* ALLOW */,
|
|
1918
|
-
allow: true,
|
|
1919
|
-
riskScore: 0,
|
|
1920
|
-
reasons: [],
|
|
1921
|
-
tags,
|
|
1922
|
-
meta
|
|
1923
|
-
};
|
|
1924
|
-
},
|
|
1925
|
-
deny(code, reason, meta) {
|
|
1926
|
-
return {
|
|
1927
|
-
decision: "DENY" /* DENY */,
|
|
1928
|
-
allow: false,
|
|
1929
|
-
riskScore: 100,
|
|
1930
|
-
code,
|
|
1931
|
-
reasons: [code, reason].filter(Boolean),
|
|
1932
|
-
meta
|
|
1933
|
-
};
|
|
1934
|
-
},
|
|
1935
|
-
throttle(retryAfterMs, meta) {
|
|
1936
|
-
return {
|
|
1937
|
-
decision: "THROTTLE" /* THROTTLE */,
|
|
1938
|
-
allow: false,
|
|
1939
|
-
riskScore: 50,
|
|
1940
|
-
retryAfterMs,
|
|
1941
|
-
code: "RATE_LIMIT",
|
|
1942
|
-
reasons: ["RATE_LIMIT"],
|
|
1943
|
-
meta
|
|
1944
|
-
};
|
|
1945
|
-
},
|
|
1946
|
-
flag(scoreDelta, reasons, meta) {
|
|
1947
|
-
return {
|
|
1948
|
-
decision: "FLAG" /* FLAG */,
|
|
1949
|
-
allow: true,
|
|
1950
|
-
riskScore: scoreDelta,
|
|
1951
|
-
scoreDelta,
|
|
1952
|
-
reasons,
|
|
1953
|
-
meta
|
|
1954
|
-
};
|
|
1955
|
-
}
|
|
1956
|
-
};
|
|
2115
|
+
var init_cce_witness_observer = __esm({
|
|
2116
|
+
"src/cce/cce-witness.observer.ts"() {
|
|
2117
|
+
init_cce_crypto();
|
|
2118
|
+
init_cce_types();
|
|
1957
2119
|
}
|
|
1958
2120
|
});
|
|
1959
2121
|
|
|
@@ -2205,167 +2367,6 @@ var init_axis_error = __esm({
|
|
|
2205
2367
|
}
|
|
2206
2368
|
});
|
|
2207
2369
|
|
|
2208
|
-
// src/security/scopes.ts
|
|
2209
|
-
function hasScope(scopes, required) {
|
|
2210
|
-
if (!Array.isArray(scopes) || scopes.length === 0) {
|
|
2211
|
-
return false;
|
|
2212
|
-
}
|
|
2213
|
-
if (scopes.includes(required)) {
|
|
2214
|
-
return true;
|
|
2215
|
-
}
|
|
2216
|
-
const [resource, id] = required.split(":");
|
|
2217
|
-
if (resource && id) {
|
|
2218
|
-
const wildcard = `${resource}:*`;
|
|
2219
|
-
if (scopes.includes(wildcard)) {
|
|
2220
|
-
return true;
|
|
2221
|
-
}
|
|
2222
|
-
}
|
|
2223
|
-
return false;
|
|
2224
|
-
}
|
|
2225
|
-
function parseScope(scope) {
|
|
2226
|
-
const parts = scope.split(":");
|
|
2227
|
-
if (parts.length !== 2) return null;
|
|
2228
|
-
return { resource: parts[0], id: parts[1] };
|
|
2229
|
-
}
|
|
2230
|
-
function canAccessResource(scopes, resourceType, resourceId) {
|
|
2231
|
-
const required = `${resourceType}:${resourceId}`;
|
|
2232
|
-
return hasScope(scopes, required);
|
|
2233
|
-
}
|
|
2234
|
-
var init_scopes = __esm({
|
|
2235
|
-
"src/security/scopes.ts"() {
|
|
2236
|
-
}
|
|
2237
|
-
});
|
|
2238
|
-
|
|
2239
|
-
// src/security/inline-capsule.ts
|
|
2240
|
-
function normalizeInlineCapsule(input) {
|
|
2241
|
-
if (!input || typeof input !== "object" || Array.isArray(input)) {
|
|
2242
|
-
return null;
|
|
2243
|
-
}
|
|
2244
|
-
const raw = input;
|
|
2245
|
-
const scopes = normalizeStringList(raw.scopes ?? raw.scope);
|
|
2246
|
-
return {
|
|
2247
|
-
id: normalizeScalar(raw.id),
|
|
2248
|
-
actorId: normalizeScalar(raw.actorId),
|
|
2249
|
-
intents: normalizeStringList(raw.intents),
|
|
2250
|
-
issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
|
|
2251
|
-
expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
|
|
2252
|
-
realm: normalizeScalar(raw.realm),
|
|
2253
|
-
node: normalizeScalar(raw.node),
|
|
2254
|
-
scopes,
|
|
2255
|
-
raw
|
|
2256
|
-
};
|
|
2257
|
-
}
|
|
2258
|
-
function inlineCapsuleAllowsIntent(capsule, intent) {
|
|
2259
|
-
if (!capsule.intents || capsule.intents.length === 0) {
|
|
2260
|
-
return false;
|
|
2261
|
-
}
|
|
2262
|
-
for (const pattern of capsule.intents) {
|
|
2263
|
-
if (pattern === "*" || pattern === intent) {
|
|
2264
|
-
return true;
|
|
2265
|
-
}
|
|
2266
|
-
if (pattern.endsWith(".*")) {
|
|
2267
|
-
const prefix = pattern.slice(0, -1);
|
|
2268
|
-
if (intent.startsWith(prefix)) {
|
|
2269
|
-
return true;
|
|
2270
|
-
}
|
|
2271
|
-
}
|
|
2272
|
-
}
|
|
2273
|
-
return false;
|
|
2274
|
-
}
|
|
2275
|
-
function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
|
|
2276
|
-
if (capsule.expiresAt === void 0) {
|
|
2277
|
-
return false;
|
|
2278
|
-
}
|
|
2279
|
-
return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
|
|
2280
|
-
}
|
|
2281
|
-
function resolvePolicyScopes(scopes, context) {
|
|
2282
|
-
return scopes.map(
|
|
2283
|
-
(scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
|
|
2284
|
-
const resolved = resolveTemplateExpression(expression.trim(), context);
|
|
2285
|
-
if (resolved === void 0 || resolved === null || resolved === "") {
|
|
2286
|
-
throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
|
|
2287
|
-
}
|
|
2288
|
-
return String(resolved);
|
|
2289
|
-
})
|
|
2290
|
-
);
|
|
2291
|
-
}
|
|
2292
|
-
function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
|
|
2293
|
-
if (!capsule.scopes || capsule.scopes.length === 0) {
|
|
2294
|
-
return false;
|
|
2295
|
-
}
|
|
2296
|
-
if (mode === "any") {
|
|
2297
|
-
return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
|
|
2298
|
-
}
|
|
2299
|
-
return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
|
|
2300
|
-
}
|
|
2301
|
-
function resolveTemplateExpression(expression, context) {
|
|
2302
|
-
if (expression === "intent") {
|
|
2303
|
-
return context.intent;
|
|
2304
|
-
}
|
|
2305
|
-
if (expression === "actorId") {
|
|
2306
|
-
return context.actorId;
|
|
2307
|
-
}
|
|
2308
|
-
if (expression === "chainId") {
|
|
2309
|
-
return context.chainId;
|
|
2310
|
-
}
|
|
2311
|
-
if (expression === "stepId") {
|
|
2312
|
-
return context.stepId;
|
|
2313
|
-
}
|
|
2314
|
-
if (expression.startsWith("body.")) {
|
|
2315
|
-
return getNestedValue(context.body, expression.slice(5));
|
|
2316
|
-
}
|
|
2317
|
-
return void 0;
|
|
2318
|
-
}
|
|
2319
|
-
function getNestedValue(value, path2) {
|
|
2320
|
-
if (!value || typeof value !== "object") {
|
|
2321
|
-
return void 0;
|
|
2322
|
-
}
|
|
2323
|
-
return path2.split(".").reduce((current, segment) => {
|
|
2324
|
-
if (!current || typeof current !== "object") {
|
|
2325
|
-
return void 0;
|
|
2326
|
-
}
|
|
2327
|
-
return current[segment];
|
|
2328
|
-
}, value);
|
|
2329
|
-
}
|
|
2330
|
-
function normalizeScalar(value) {
|
|
2331
|
-
if (typeof value === "string") {
|
|
2332
|
-
return value;
|
|
2333
|
-
}
|
|
2334
|
-
if (value instanceof Uint8Array) {
|
|
2335
|
-
return Buffer.from(value).toString("hex");
|
|
2336
|
-
}
|
|
2337
|
-
return void 0;
|
|
2338
|
-
}
|
|
2339
|
-
function normalizeStringList(value) {
|
|
2340
|
-
if (!value) {
|
|
2341
|
-
return void 0;
|
|
2342
|
-
}
|
|
2343
|
-
const list = Array.isArray(value) ? value : [value];
|
|
2344
|
-
const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
|
|
2345
|
-
return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
|
|
2346
|
-
}
|
|
2347
|
-
function normalizeTimestamp(value) {
|
|
2348
|
-
if (typeof value === "bigint") {
|
|
2349
|
-
return value;
|
|
2350
|
-
}
|
|
2351
|
-
if (typeof value === "number" && Number.isFinite(value)) {
|
|
2352
|
-
return BigInt(Math.trunc(value));
|
|
2353
|
-
}
|
|
2354
|
-
if (typeof value === "string" && value.trim().length > 0) {
|
|
2355
|
-
try {
|
|
2356
|
-
return BigInt(value);
|
|
2357
|
-
} catch {
|
|
2358
|
-
return void 0;
|
|
2359
|
-
}
|
|
2360
|
-
}
|
|
2361
|
-
return void 0;
|
|
2362
|
-
}
|
|
2363
|
-
var init_inline_capsule = __esm({
|
|
2364
|
-
"src/security/inline-capsule.ts"() {
|
|
2365
|
-
init_scopes();
|
|
2366
|
-
}
|
|
2367
|
-
});
|
|
2368
|
-
|
|
2369
2370
|
// src/engine/intent.router.ts
|
|
2370
2371
|
var intent_router_exports = {};
|
|
2371
2372
|
__export(intent_router_exports, {
|
|
@@ -2442,23 +2443,23 @@ function normalizeChainConfig(decoratorConfig, intentConfig) {
|
|
|
2442
2443
|
var import_dto_schema, _IntentRouter, IntentRouter;
|
|
2443
2444
|
var init_intent_router = __esm({
|
|
2444
2445
|
"src/engine/intent.router.ts"() {
|
|
2445
|
-
init_cce_pipeline();
|
|
2446
|
-
init_axis_error();
|
|
2447
|
-
init_constants();
|
|
2448
|
-
init_capsule_policy_decorator();
|
|
2449
|
-
init_chain_decorator();
|
|
2450
|
-
import_dto_schema = __toESM(require_dto_schema_util());
|
|
2451
2446
|
init_handler_sensors_decorator();
|
|
2452
|
-
|
|
2453
|
-
init_intent_body_decorator();
|
|
2454
|
-
init_intent_policy_decorator();
|
|
2447
|
+
init_capsule_policy_decorator();
|
|
2455
2448
|
init_intent_sensors_decorator();
|
|
2456
|
-
|
|
2449
|
+
init_intent_policy_decorator();
|
|
2450
|
+
init_intent_body_decorator();
|
|
2457
2451
|
init_observer_decorator();
|
|
2452
|
+
init_handler_decorator();
|
|
2453
|
+
init_intent_decorator();
|
|
2454
|
+
init_chain_decorator();
|
|
2455
|
+
import_dto_schema = __toESM(require_dto_schema_util());
|
|
2458
2456
|
init_inline_capsule();
|
|
2459
|
-
init_axis_sensor();
|
|
2460
2457
|
init_axis_execution_context();
|
|
2458
|
+
init_axis_sensor();
|
|
2461
2459
|
init_axis_logger();
|
|
2460
|
+
init_cce_pipeline();
|
|
2461
|
+
init_axis_error();
|
|
2462
|
+
init_constants();
|
|
2462
2463
|
_IntentRouter = class _IntentRouter {
|
|
2463
2464
|
constructor(dependencyResolver, observerDispatcher, sensorRegistry) {
|
|
2464
2465
|
this.logger = createAxisLogger(_IntentRouter.name);
|
|
@@ -2494,6 +2495,8 @@ var init_intent_router = __esm({
|
|
|
2494
2495
|
this.publicIntents = /* @__PURE__ */ new Set();
|
|
2495
2496
|
/** Intents flagged as anonymous-session accessible */
|
|
2496
2497
|
this.anonymousIntents = /* @__PURE__ */ new Set();
|
|
2498
|
+
/** Intents flagged as authorized-session accessible */
|
|
2499
|
+
this.authorizedIntents = /* @__PURE__ */ new Set();
|
|
2497
2500
|
/** Per-intent rate limit config */
|
|
2498
2501
|
this.intentRateLimits = /* @__PURE__ */ new Map();
|
|
2499
2502
|
/** CCE handler registry */
|
|
@@ -2920,6 +2923,18 @@ var init_intent_router = __esm({
|
|
|
2920
2923
|
if (isAnonMethod || isAnonClass) {
|
|
2921
2924
|
this.anonymousIntents.add(intent);
|
|
2922
2925
|
}
|
|
2926
|
+
const isAuthorizedMethod = Reflect.getMetadata(
|
|
2927
|
+
AXIS_AUTHORIZED_KEY,
|
|
2928
|
+
proto,
|
|
2929
|
+
methodName
|
|
2930
|
+
);
|
|
2931
|
+
const isAuthorizedClass = Reflect.getMetadata(
|
|
2932
|
+
AXIS_AUTHORIZED_KEY,
|
|
2933
|
+
proto.constructor
|
|
2934
|
+
);
|
|
2935
|
+
if (isAuthorizedMethod || isAuthorizedClass) {
|
|
2936
|
+
this.authorizedIntents.add(intent);
|
|
2937
|
+
}
|
|
2923
2938
|
const rateLimit = Reflect.getMetadata(
|
|
2924
2939
|
AXIS_RATE_LIMIT_KEY,
|
|
2925
2940
|
proto,
|
|
@@ -2945,6 +2960,9 @@ var init_intent_router = __esm({
|
|
|
2945
2960
|
isAnonymous(intent) {
|
|
2946
2961
|
return this.anonymousIntents.has(intent);
|
|
2947
2962
|
}
|
|
2963
|
+
isAuthorized(intent) {
|
|
2964
|
+
return this.authorizedIntents.has(intent);
|
|
2965
|
+
}
|
|
2948
2966
|
getRateLimit(intent) {
|
|
2949
2967
|
return this.intentRateLimits.get(intent);
|
|
2950
2968
|
}
|
|
@@ -10730,15 +10748,52 @@ var require_chunk_hash_sensor = __commonJS({
|
|
|
10730
10748
|
var require_entropy_sensor = __commonJS({
|
|
10731
10749
|
"src/sensors/entropy.sensor.ts"(exports) {
|
|
10732
10750
|
"use strict";
|
|
10751
|
+
var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
|
|
10752
|
+
if (k2 === void 0) k2 = k;
|
|
10753
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
10754
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
10755
|
+
desc = { enumerable: true, get: function() {
|
|
10756
|
+
return m[k];
|
|
10757
|
+
} };
|
|
10758
|
+
}
|
|
10759
|
+
Object.defineProperty(o, k2, desc);
|
|
10760
|
+
}) : (function(o, m, k, k2) {
|
|
10761
|
+
if (k2 === void 0) k2 = k;
|
|
10762
|
+
o[k2] = m[k];
|
|
10763
|
+
}));
|
|
10764
|
+
var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
|
|
10765
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
10766
|
+
}) : function(o, v) {
|
|
10767
|
+
o["default"] = v;
|
|
10768
|
+
});
|
|
10733
10769
|
var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
|
|
10734
10770
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
10735
10771
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
10736
10772
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
10737
10773
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
10738
10774
|
};
|
|
10775
|
+
var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
|
|
10776
|
+
var ownKeys = function(o) {
|
|
10777
|
+
ownKeys = Object.getOwnPropertyNames || function(o2) {
|
|
10778
|
+
var ar = [];
|
|
10779
|
+
for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
|
|
10780
|
+
return ar;
|
|
10781
|
+
};
|
|
10782
|
+
return ownKeys(o);
|
|
10783
|
+
};
|
|
10784
|
+
return function(mod) {
|
|
10785
|
+
if (mod && mod.__esModule) return mod;
|
|
10786
|
+
var result = {};
|
|
10787
|
+
if (mod != null) {
|
|
10788
|
+
for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
10789
|
+
}
|
|
10790
|
+
__setModuleDefault(result, mod);
|
|
10791
|
+
return result;
|
|
10792
|
+
};
|
|
10793
|
+
})();
|
|
10739
10794
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
10740
10795
|
exports.EntropySensor = void 0;
|
|
10741
|
-
var crypto4 = __require("crypto");
|
|
10796
|
+
var crypto4 = __importStar(__require("crypto"));
|
|
10742
10797
|
var sensor_decorator_1 = (init_sensor_decorator(), __toCommonJS(sensor_decorator_exports));
|
|
10743
10798
|
var sensor_bands_1 = (init_sensor_bands(), __toCommonJS(sensor_bands_exports));
|
|
10744
10799
|
var constants_1 = (init_constants(), __toCommonJS(constants_exports));
|
|
@@ -11417,10 +11472,15 @@ var init_axis_schemas = __esm({
|
|
|
11417
11472
|
ScanBurstDecisionZ = SensorDecisionWithMetadataZ;
|
|
11418
11473
|
ProofKindZ = z2.enum([
|
|
11419
11474
|
"NONE",
|
|
11420
|
-
"
|
|
11475
|
+
"ANONYMOUS",
|
|
11421
11476
|
"PASSPORT",
|
|
11477
|
+
"CAPSULE",
|
|
11478
|
+
"JWT",
|
|
11479
|
+
"CONTRACT",
|
|
11480
|
+
"WITNESS",
|
|
11422
11481
|
"MTLS",
|
|
11423
|
-
"
|
|
11482
|
+
"DEVICE",
|
|
11483
|
+
"AUTHORIZED"
|
|
11424
11484
|
]);
|
|
11425
11485
|
AccessProfileZ = z2.enum(["PUBLIC", "PARTNER", "INTERNAL", "NODE"]);
|
|
11426
11486
|
ProofPresenceInputZ = z2.object({
|
|
@@ -11542,7 +11602,10 @@ var init_axis_schemas = __esm({
|
|
|
11542
11602
|
ip: z2.string().min(1)
|
|
11543
11603
|
});
|
|
11544
11604
|
ProtocolStrictInputZ = z2.object({
|
|
11545
|
-
rawBytes: z2.union([
|
|
11605
|
+
rawBytes: z2.union([
|
|
11606
|
+
z2.custom((v) => Buffer.isBuffer(v)),
|
|
11607
|
+
z2.instanceof(Uint8Array)
|
|
11608
|
+
]).optional(),
|
|
11546
11609
|
ip: z2.string().min(1),
|
|
11547
11610
|
path: z2.string().min(1),
|
|
11548
11611
|
contentLength: z2.number().int().nonnegative(),
|