@nextera.one/axis-server-sdk 2.2.7 → 2.2.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -585,7 +585,7 @@ function AxisRateLimit(config) {
585
585
  return descriptor;
586
586
  };
587
587
  }
588
- var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_RATE_LIMIT_KEY;
588
+ var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_AUTHORIZED_KEY, AXIS_RATE_LIMIT_KEY;
589
589
  var init_intent_policy_decorator = __esm({
590
590
  "src/decorators/intent-policy.decorator.ts"() {
591
591
  AXIS_META_KEY = "axis:axis";
@@ -594,6 +594,7 @@ var init_intent_policy_decorator = __esm({
594
594
  REQUIRED_PROOF_METADATA_KEY = "axis:required_proof";
595
595
  AXIS_PUBLIC_KEY = "axis:public";
596
596
  AXIS_ANONYMOUS_KEY = "axis:anonymous";
597
+ AXIS_AUTHORIZED_KEY = "axis:authorized";
597
598
  AXIS_RATE_LIMIT_KEY = "axis:rateLimit";
598
599
  }
599
600
  });
@@ -1619,6 +1620,271 @@ var init_axis_chain_executor = __esm({
1619
1620
  }
1620
1621
  });
1621
1622
 
1623
+ // src/security/scopes.ts
1624
+ function hasScope(scopes, required) {
1625
+ if (!Array.isArray(scopes) || scopes.length === 0) {
1626
+ return false;
1627
+ }
1628
+ if (scopes.includes(required)) {
1629
+ return true;
1630
+ }
1631
+ const [resource, id] = required.split(":");
1632
+ if (resource && id) {
1633
+ const wildcard = `${resource}:*`;
1634
+ if (scopes.includes(wildcard)) {
1635
+ return true;
1636
+ }
1637
+ }
1638
+ return false;
1639
+ }
1640
+ function parseScope(scope) {
1641
+ const parts = scope.split(":");
1642
+ if (parts.length !== 2) return null;
1643
+ return { resource: parts[0], id: parts[1] };
1644
+ }
1645
+ function canAccessResource(scopes, resourceType, resourceId) {
1646
+ const required = `${resourceType}:${resourceId}`;
1647
+ return hasScope(scopes, required);
1648
+ }
1649
+ var init_scopes = __esm({
1650
+ "src/security/scopes.ts"() {
1651
+ }
1652
+ });
1653
+
1654
+ // src/security/inline-capsule.ts
1655
+ function normalizeInlineCapsule(input) {
1656
+ if (!input || typeof input !== "object" || Array.isArray(input)) {
1657
+ return null;
1658
+ }
1659
+ const raw = input;
1660
+ const scopes = normalizeStringList(raw.scopes ?? raw.scope);
1661
+ return {
1662
+ id: normalizeScalar(raw.id),
1663
+ actorId: normalizeScalar(raw.actorId),
1664
+ intents: normalizeStringList(raw.intents),
1665
+ issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
1666
+ expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
1667
+ realm: normalizeScalar(raw.realm),
1668
+ node: normalizeScalar(raw.node),
1669
+ scopes,
1670
+ raw
1671
+ };
1672
+ }
1673
+ function inlineCapsuleAllowsIntent(capsule, intent) {
1674
+ if (!capsule.intents || capsule.intents.length === 0) {
1675
+ return false;
1676
+ }
1677
+ for (const pattern of capsule.intents) {
1678
+ if (pattern === "*" || pattern === intent) {
1679
+ return true;
1680
+ }
1681
+ if (pattern.endsWith(".*")) {
1682
+ const prefix = pattern.slice(0, -1);
1683
+ if (intent.startsWith(prefix)) {
1684
+ return true;
1685
+ }
1686
+ }
1687
+ }
1688
+ return false;
1689
+ }
1690
+ function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
1691
+ if (capsule.expiresAt === void 0) {
1692
+ return false;
1693
+ }
1694
+ return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
1695
+ }
1696
+ function resolvePolicyScopes(scopes, context) {
1697
+ return scopes.map(
1698
+ (scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
1699
+ const resolved = resolveTemplateExpression(expression.trim(), context);
1700
+ if (resolved === void 0 || resolved === null || resolved === "") {
1701
+ throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
1702
+ }
1703
+ return String(resolved);
1704
+ })
1705
+ );
1706
+ }
1707
+ function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
1708
+ if (!capsule.scopes || capsule.scopes.length === 0) {
1709
+ return false;
1710
+ }
1711
+ if (mode === "any") {
1712
+ return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
1713
+ }
1714
+ return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
1715
+ }
1716
+ function resolveTemplateExpression(expression, context) {
1717
+ if (expression === "intent") {
1718
+ return context.intent;
1719
+ }
1720
+ if (expression === "actorId") {
1721
+ return context.actorId;
1722
+ }
1723
+ if (expression === "chainId") {
1724
+ return context.chainId;
1725
+ }
1726
+ if (expression === "stepId") {
1727
+ return context.stepId;
1728
+ }
1729
+ if (expression.startsWith("body.")) {
1730
+ return getNestedValue(context.body, expression.slice(5));
1731
+ }
1732
+ return void 0;
1733
+ }
1734
+ function getNestedValue(value, path2) {
1735
+ if (!value || typeof value !== "object") {
1736
+ return void 0;
1737
+ }
1738
+ return path2.split(".").reduce((current, segment) => {
1739
+ if (!current || typeof current !== "object") {
1740
+ return void 0;
1741
+ }
1742
+ return current[segment];
1743
+ }, value);
1744
+ }
1745
+ function normalizeScalar(value) {
1746
+ if (typeof value === "string") {
1747
+ return value;
1748
+ }
1749
+ if (value instanceof Uint8Array) {
1750
+ return Buffer.from(value).toString("hex");
1751
+ }
1752
+ return void 0;
1753
+ }
1754
+ function normalizeStringList(value) {
1755
+ if (!value) {
1756
+ return void 0;
1757
+ }
1758
+ const list = Array.isArray(value) ? value : [value];
1759
+ const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
1760
+ return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
1761
+ }
1762
+ function normalizeTimestamp(value) {
1763
+ if (typeof value === "bigint") {
1764
+ return value;
1765
+ }
1766
+ if (typeof value === "number" && Number.isFinite(value)) {
1767
+ return BigInt(Math.trunc(value));
1768
+ }
1769
+ if (typeof value === "string" && value.trim().length > 0) {
1770
+ try {
1771
+ return BigInt(value);
1772
+ } catch {
1773
+ return void 0;
1774
+ }
1775
+ }
1776
+ return void 0;
1777
+ }
1778
+ var init_inline_capsule = __esm({
1779
+ "src/security/inline-capsule.ts"() {
1780
+ init_scopes();
1781
+ }
1782
+ });
1783
+
1784
+ // src/sensor/axis-sensor.ts
1785
+ function normalizeSensorDecision(sensorDecision) {
1786
+ if ("action" in sensorDecision) {
1787
+ switch (sensorDecision.action) {
1788
+ case "ALLOW":
1789
+ return {
1790
+ allow: true,
1791
+ riskScore: 0,
1792
+ reasons: [],
1793
+ meta: sensorDecision.meta
1794
+ };
1795
+ case "DENY":
1796
+ return {
1797
+ allow: false,
1798
+ riskScore: 100,
1799
+ reasons: [sensorDecision.code, sensorDecision.reason].filter(
1800
+ Boolean
1801
+ ),
1802
+ meta: sensorDecision.meta,
1803
+ retryAfterMs: sensorDecision.retryAfterMs
1804
+ };
1805
+ case "THROTTLE":
1806
+ return {
1807
+ allow: false,
1808
+ riskScore: 50,
1809
+ reasons: ["RATE_LIMIT"],
1810
+ retryAfterMs: sensorDecision.retryAfterMs,
1811
+ meta: sensorDecision.meta
1812
+ };
1813
+ case "FLAG":
1814
+ return {
1815
+ allow: true,
1816
+ riskScore: sensorDecision.scoreDelta,
1817
+ reasons: sensorDecision.reasons,
1818
+ meta: sensorDecision.meta
1819
+ };
1820
+ }
1821
+ }
1822
+ return {
1823
+ allow: sensorDecision.allow,
1824
+ riskScore: sensorDecision.riskScore,
1825
+ reasons: sensorDecision.reasons,
1826
+ tags: sensorDecision.tags,
1827
+ meta: sensorDecision.meta,
1828
+ tighten: sensorDecision.tighten,
1829
+ retryAfterMs: sensorDecision.retryAfterMs
1830
+ };
1831
+ }
1832
+ var Decision, SensorDecisions;
1833
+ var init_axis_sensor = __esm({
1834
+ "src/sensor/axis-sensor.ts"() {
1835
+ Decision = /* @__PURE__ */ ((Decision2) => {
1836
+ Decision2["ALLOW"] = "ALLOW";
1837
+ Decision2["DENY"] = "DENY";
1838
+ Decision2["THROTTLE"] = "THROTTLE";
1839
+ Decision2["FLAG"] = "FLAG";
1840
+ return Decision2;
1841
+ })(Decision || {});
1842
+ SensorDecisions = {
1843
+ allow(meta, tags) {
1844
+ return {
1845
+ decision: "ALLOW" /* ALLOW */,
1846
+ allow: true,
1847
+ riskScore: 0,
1848
+ reasons: [],
1849
+ tags,
1850
+ meta
1851
+ };
1852
+ },
1853
+ deny(code, reason, meta) {
1854
+ return {
1855
+ decision: "DENY" /* DENY */,
1856
+ allow: false,
1857
+ riskScore: 100,
1858
+ code,
1859
+ reasons: [code, reason].filter(Boolean),
1860
+ meta
1861
+ };
1862
+ },
1863
+ throttle(retryAfterMs, meta) {
1864
+ return {
1865
+ decision: "THROTTLE" /* THROTTLE */,
1866
+ allow: false,
1867
+ riskScore: 50,
1868
+ retryAfterMs,
1869
+ code: "RATE_LIMIT",
1870
+ reasons: ["RATE_LIMIT"],
1871
+ meta
1872
+ };
1873
+ },
1874
+ flag(scoreDelta, reasons, meta) {
1875
+ return {
1876
+ decision: "FLAG" /* FLAG */,
1877
+ allow: true,
1878
+ riskScore: scoreDelta,
1879
+ scoreDelta,
1880
+ reasons,
1881
+ meta
1882
+ };
1883
+ }
1884
+ };
1885
+ }
1886
+ });
1887
+
1622
1888
  // src/cce/cce.types.ts
1623
1889
  var CCE_PROTOCOL_VERSION, CCE_DERIVATION, CCE_AES_KEY_BYTES, CCE_IV_BYTES, CCE_NONCE_BYTES, CCE_ERROR, CceError;
1624
1890
  var init_cce_types = __esm({
@@ -1992,116 +2258,12 @@ function hexToBytes2(hex) {
1992
2258
  for (let i = 0; i < bytes2.length; i++) {
1993
2259
  bytes2[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
1994
2260
  }
1995
- return bytes2;
1996
- }
1997
- var init_cce_witness_observer = __esm({
1998
- "src/cce/cce-witness.observer.ts"() {
1999
- init_cce_crypto();
2000
- init_cce_types();
2001
- }
2002
- });
2003
-
2004
- // src/sensor/axis-sensor.ts
2005
- function normalizeSensorDecision(sensorDecision) {
2006
- if ("action" in sensorDecision) {
2007
- switch (sensorDecision.action) {
2008
- case "ALLOW":
2009
- return {
2010
- allow: true,
2011
- riskScore: 0,
2012
- reasons: [],
2013
- meta: sensorDecision.meta
2014
- };
2015
- case "DENY":
2016
- return {
2017
- allow: false,
2018
- riskScore: 100,
2019
- reasons: [sensorDecision.code, sensorDecision.reason].filter(
2020
- Boolean
2021
- ),
2022
- meta: sensorDecision.meta,
2023
- retryAfterMs: sensorDecision.retryAfterMs
2024
- };
2025
- case "THROTTLE":
2026
- return {
2027
- allow: false,
2028
- riskScore: 50,
2029
- reasons: ["RATE_LIMIT"],
2030
- retryAfterMs: sensorDecision.retryAfterMs,
2031
- meta: sensorDecision.meta
2032
- };
2033
- case "FLAG":
2034
- return {
2035
- allow: true,
2036
- riskScore: sensorDecision.scoreDelta,
2037
- reasons: sensorDecision.reasons,
2038
- meta: sensorDecision.meta
2039
- };
2040
- }
2041
- }
2042
- return {
2043
- allow: sensorDecision.allow,
2044
- riskScore: sensorDecision.riskScore,
2045
- reasons: sensorDecision.reasons,
2046
- tags: sensorDecision.tags,
2047
- meta: sensorDecision.meta,
2048
- tighten: sensorDecision.tighten,
2049
- retryAfterMs: sensorDecision.retryAfterMs
2050
- };
2261
+ return bytes2;
2051
2262
  }
2052
- var Decision, SensorDecisions;
2053
- var init_axis_sensor = __esm({
2054
- "src/sensor/axis-sensor.ts"() {
2055
- Decision = /* @__PURE__ */ ((Decision2) => {
2056
- Decision2["ALLOW"] = "ALLOW";
2057
- Decision2["DENY"] = "DENY";
2058
- Decision2["THROTTLE"] = "THROTTLE";
2059
- Decision2["FLAG"] = "FLAG";
2060
- return Decision2;
2061
- })(Decision || {});
2062
- SensorDecisions = {
2063
- allow(meta, tags) {
2064
- return {
2065
- decision: "ALLOW" /* ALLOW */,
2066
- allow: true,
2067
- riskScore: 0,
2068
- reasons: [],
2069
- tags,
2070
- meta
2071
- };
2072
- },
2073
- deny(code, reason, meta) {
2074
- return {
2075
- decision: "DENY" /* DENY */,
2076
- allow: false,
2077
- riskScore: 100,
2078
- code,
2079
- reasons: [code, reason].filter(Boolean),
2080
- meta
2081
- };
2082
- },
2083
- throttle(retryAfterMs, meta) {
2084
- return {
2085
- decision: "THROTTLE" /* THROTTLE */,
2086
- allow: false,
2087
- riskScore: 50,
2088
- retryAfterMs,
2089
- code: "RATE_LIMIT",
2090
- reasons: ["RATE_LIMIT"],
2091
- meta
2092
- };
2093
- },
2094
- flag(scoreDelta, reasons, meta) {
2095
- return {
2096
- decision: "FLAG" /* FLAG */,
2097
- allow: true,
2098
- riskScore: scoreDelta,
2099
- scoreDelta,
2100
- reasons,
2101
- meta
2102
- };
2103
- }
2104
- };
2263
+ var init_cce_witness_observer = __esm({
2264
+ "src/cce/cce-witness.observer.ts"() {
2265
+ init_cce_crypto();
2266
+ init_cce_types();
2105
2267
  }
2106
2268
  });
2107
2269
 
@@ -2353,167 +2515,6 @@ var init_axis_error = __esm({
2353
2515
  }
2354
2516
  });
2355
2517
 
2356
- // src/security/scopes.ts
2357
- function hasScope(scopes, required) {
2358
- if (!Array.isArray(scopes) || scopes.length === 0) {
2359
- return false;
2360
- }
2361
- if (scopes.includes(required)) {
2362
- return true;
2363
- }
2364
- const [resource, id] = required.split(":");
2365
- if (resource && id) {
2366
- const wildcard = `${resource}:*`;
2367
- if (scopes.includes(wildcard)) {
2368
- return true;
2369
- }
2370
- }
2371
- return false;
2372
- }
2373
- function parseScope(scope) {
2374
- const parts = scope.split(":");
2375
- if (parts.length !== 2) return null;
2376
- return { resource: parts[0], id: parts[1] };
2377
- }
2378
- function canAccessResource(scopes, resourceType, resourceId) {
2379
- const required = `${resourceType}:${resourceId}`;
2380
- return hasScope(scopes, required);
2381
- }
2382
- var init_scopes = __esm({
2383
- "src/security/scopes.ts"() {
2384
- }
2385
- });
2386
-
2387
- // src/security/inline-capsule.ts
2388
- function normalizeInlineCapsule(input) {
2389
- if (!input || typeof input !== "object" || Array.isArray(input)) {
2390
- return null;
2391
- }
2392
- const raw = input;
2393
- const scopes = normalizeStringList(raw.scopes ?? raw.scope);
2394
- return {
2395
- id: normalizeScalar(raw.id),
2396
- actorId: normalizeScalar(raw.actorId),
2397
- intents: normalizeStringList(raw.intents),
2398
- issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
2399
- expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
2400
- realm: normalizeScalar(raw.realm),
2401
- node: normalizeScalar(raw.node),
2402
- scopes,
2403
- raw
2404
- };
2405
- }
2406
- function inlineCapsuleAllowsIntent(capsule, intent) {
2407
- if (!capsule.intents || capsule.intents.length === 0) {
2408
- return false;
2409
- }
2410
- for (const pattern of capsule.intents) {
2411
- if (pattern === "*" || pattern === intent) {
2412
- return true;
2413
- }
2414
- if (pattern.endsWith(".*")) {
2415
- const prefix = pattern.slice(0, -1);
2416
- if (intent.startsWith(prefix)) {
2417
- return true;
2418
- }
2419
- }
2420
- }
2421
- return false;
2422
- }
2423
- function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
2424
- if (capsule.expiresAt === void 0) {
2425
- return false;
2426
- }
2427
- return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
2428
- }
2429
- function resolvePolicyScopes(scopes, context) {
2430
- return scopes.map(
2431
- (scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
2432
- const resolved = resolveTemplateExpression(expression.trim(), context);
2433
- if (resolved === void 0 || resolved === null || resolved === "") {
2434
- throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
2435
- }
2436
- return String(resolved);
2437
- })
2438
- );
2439
- }
2440
- function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
2441
- if (!capsule.scopes || capsule.scopes.length === 0) {
2442
- return false;
2443
- }
2444
- if (mode === "any") {
2445
- return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
2446
- }
2447
- return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
2448
- }
2449
- function resolveTemplateExpression(expression, context) {
2450
- if (expression === "intent") {
2451
- return context.intent;
2452
- }
2453
- if (expression === "actorId") {
2454
- return context.actorId;
2455
- }
2456
- if (expression === "chainId") {
2457
- return context.chainId;
2458
- }
2459
- if (expression === "stepId") {
2460
- return context.stepId;
2461
- }
2462
- if (expression.startsWith("body.")) {
2463
- return getNestedValue(context.body, expression.slice(5));
2464
- }
2465
- return void 0;
2466
- }
2467
- function getNestedValue(value, path2) {
2468
- if (!value || typeof value !== "object") {
2469
- return void 0;
2470
- }
2471
- return path2.split(".").reduce((current, segment) => {
2472
- if (!current || typeof current !== "object") {
2473
- return void 0;
2474
- }
2475
- return current[segment];
2476
- }, value);
2477
- }
2478
- function normalizeScalar(value) {
2479
- if (typeof value === "string") {
2480
- return value;
2481
- }
2482
- if (value instanceof Uint8Array) {
2483
- return Buffer.from(value).toString("hex");
2484
- }
2485
- return void 0;
2486
- }
2487
- function normalizeStringList(value) {
2488
- if (!value) {
2489
- return void 0;
2490
- }
2491
- const list = Array.isArray(value) ? value : [value];
2492
- const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
2493
- return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
2494
- }
2495
- function normalizeTimestamp(value) {
2496
- if (typeof value === "bigint") {
2497
- return value;
2498
- }
2499
- if (typeof value === "number" && Number.isFinite(value)) {
2500
- return BigInt(Math.trunc(value));
2501
- }
2502
- if (typeof value === "string" && value.trim().length > 0) {
2503
- try {
2504
- return BigInt(value);
2505
- } catch {
2506
- return void 0;
2507
- }
2508
- }
2509
- return void 0;
2510
- }
2511
- var init_inline_capsule = __esm({
2512
- "src/security/inline-capsule.ts"() {
2513
- init_scopes();
2514
- }
2515
- });
2516
-
2517
2518
  // src/engine/intent.router.ts
2518
2519
  var intent_router_exports = {};
2519
2520
  __export(intent_router_exports, {
@@ -2590,23 +2591,23 @@ function normalizeChainConfig(decoratorConfig, intentConfig) {
2590
2591
  var import_dto_schema, _IntentRouter, IntentRouter;
2591
2592
  var init_intent_router = __esm({
2592
2593
  "src/engine/intent.router.ts"() {
2593
- init_cce_pipeline();
2594
- init_axis_error();
2595
- init_constants();
2596
- init_capsule_policy_decorator();
2597
- init_chain_decorator();
2598
- import_dto_schema = __toESM(require_dto_schema_util());
2599
2594
  init_handler_sensors_decorator();
2600
- init_handler_decorator();
2601
- init_intent_body_decorator();
2602
- init_intent_policy_decorator();
2595
+ init_capsule_policy_decorator();
2603
2596
  init_intent_sensors_decorator();
2604
- init_intent_decorator();
2597
+ init_intent_policy_decorator();
2598
+ init_intent_body_decorator();
2605
2599
  init_observer_decorator();
2600
+ init_handler_decorator();
2601
+ init_intent_decorator();
2602
+ init_chain_decorator();
2603
+ import_dto_schema = __toESM(require_dto_schema_util());
2606
2604
  init_inline_capsule();
2607
- init_axis_sensor();
2608
2605
  init_axis_execution_context();
2606
+ init_axis_sensor();
2609
2607
  init_axis_logger();
2608
+ init_cce_pipeline();
2609
+ init_axis_error();
2610
+ init_constants();
2610
2611
  _IntentRouter = class _IntentRouter {
2611
2612
  constructor(dependencyResolver, observerDispatcher, sensorRegistry) {
2612
2613
  this.logger = createAxisLogger(_IntentRouter.name);
@@ -2642,6 +2643,8 @@ var init_intent_router = __esm({
2642
2643
  this.publicIntents = /* @__PURE__ */ new Set();
2643
2644
  /** Intents flagged as anonymous-session accessible */
2644
2645
  this.anonymousIntents = /* @__PURE__ */ new Set();
2646
+ /** Intents flagged as authorized-session accessible */
2647
+ this.authorizedIntents = /* @__PURE__ */ new Set();
2645
2648
  /** Per-intent rate limit config */
2646
2649
  this.intentRateLimits = /* @__PURE__ */ new Map();
2647
2650
  /** CCE handler registry */
@@ -3068,6 +3071,18 @@ var init_intent_router = __esm({
3068
3071
  if (isAnonMethod || isAnonClass) {
3069
3072
  this.anonymousIntents.add(intent);
3070
3073
  }
3074
+ const isAuthorizedMethod = Reflect.getMetadata(
3075
+ AXIS_AUTHORIZED_KEY,
3076
+ proto,
3077
+ methodName
3078
+ );
3079
+ const isAuthorizedClass = Reflect.getMetadata(
3080
+ AXIS_AUTHORIZED_KEY,
3081
+ proto.constructor
3082
+ );
3083
+ if (isAuthorizedMethod || isAuthorizedClass) {
3084
+ this.authorizedIntents.add(intent);
3085
+ }
3071
3086
  const rateLimit = Reflect.getMetadata(
3072
3087
  AXIS_RATE_LIMIT_KEY,
3073
3088
  proto,
@@ -3093,6 +3108,9 @@ var init_intent_router = __esm({
3093
3108
  isAnonymous(intent) {
3094
3109
  return this.anonymousIntents.has(intent);
3095
3110
  }
3111
+ isAuthorized(intent) {
3112
+ return this.authorizedIntents.has(intent);
3113
+ }
3096
3114
  getRateLimit(intent) {
3097
3115
  return this.intentRateLimits.get(intent);
3098
3116
  }
@@ -11116,15 +11134,52 @@ var require_chunk_hash_sensor = __commonJS({
11116
11134
  var require_entropy_sensor = __commonJS({
11117
11135
  "src/sensors/entropy.sensor.ts"(exports) {
11118
11136
  "use strict";
11137
+ var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
11138
+ if (k2 === void 0) k2 = k;
11139
+ var desc = Object.getOwnPropertyDescriptor(m, k);
11140
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
11141
+ desc = { enumerable: true, get: function() {
11142
+ return m[k];
11143
+ } };
11144
+ }
11145
+ Object.defineProperty(o, k2, desc);
11146
+ }) : (function(o, m, k, k2) {
11147
+ if (k2 === void 0) k2 = k;
11148
+ o[k2] = m[k];
11149
+ }));
11150
+ var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
11151
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
11152
+ }) : function(o, v) {
11153
+ o["default"] = v;
11154
+ });
11119
11155
  var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
11120
11156
  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
11121
11157
  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
11122
11158
  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
11123
11159
  return c > 3 && r && Object.defineProperty(target, key, r), r;
11124
11160
  };
11161
+ var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
11162
+ var ownKeys = function(o) {
11163
+ ownKeys = Object.getOwnPropertyNames || function(o2) {
11164
+ var ar = [];
11165
+ for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
11166
+ return ar;
11167
+ };
11168
+ return ownKeys(o);
11169
+ };
11170
+ return function(mod) {
11171
+ if (mod && mod.__esModule) return mod;
11172
+ var result = {};
11173
+ if (mod != null) {
11174
+ for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
11175
+ }
11176
+ __setModuleDefault(result, mod);
11177
+ return result;
11178
+ };
11179
+ })();
11125
11180
  Object.defineProperty(exports, "__esModule", { value: true });
11126
11181
  exports.EntropySensor = void 0;
11127
- var crypto4 = __require("crypto");
11182
+ var crypto4 = __importStar(__require("crypto"));
11128
11183
  var sensor_decorator_1 = (init_sensor_decorator(), __toCommonJS(sensor_decorator_exports));
11129
11184
  var sensor_bands_1 = (init_sensor_bands(), __toCommonJS(sensor_bands_exports));
11130
11185
  var constants_1 = (init_constants(), __toCommonJS(constants_exports));
@@ -11803,10 +11858,15 @@ var init_axis_schemas = __esm({
11803
11858
  ScanBurstDecisionZ = SensorDecisionWithMetadataZ;
11804
11859
  ProofKindZ = z2.enum([
11805
11860
  "NONE",
11806
- "CAPSULE",
11861
+ "ANONYMOUS",
11807
11862
  "PASSPORT",
11863
+ "CAPSULE",
11864
+ "JWT",
11865
+ "CONTRACT",
11866
+ "WITNESS",
11808
11867
  "MTLS",
11809
- "JWT"
11868
+ "DEVICE",
11869
+ "AUTHORIZED"
11810
11870
  ]);
11811
11871
  AccessProfileZ = z2.enum(["PUBLIC", "PARTNER", "INTERNAL", "NODE"]);
11812
11872
  ProofPresenceInputZ = z2.object({
@@ -11928,7 +11988,10 @@ var init_axis_schemas = __esm({
11928
11988
  ip: z2.string().min(1)
11929
11989
  });
11930
11990
  ProtocolStrictInputZ = z2.object({
11931
- rawBytes: z2.union([z2.custom((v) => Buffer.isBuffer(v)), z2.instanceof(Uint8Array)]).optional(),
11991
+ rawBytes: z2.union([
11992
+ z2.custom((v) => Buffer.isBuffer(v)),
11993
+ z2.instanceof(Uint8Array)
11994
+ ]).optional(),
11932
11995
  ip: z2.string().min(1),
11933
11996
  path: z2.string().min(1),
11934
11997
  contentLength: z2.number().int().nonnegative(),