@nextera.one/axis-server-sdk 2.2.7 → 2.2.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{index-BAoKsEOu.d.ts → index-Dci5tlZE.d.ts} +24 -12
- package/dist/{index-BLK3AtRm.d.mts → index-DypvaTKs.d.mts} +24 -12
- package/dist/index.d.mts +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +402 -339
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +349 -286
- package/dist/index.mjs.map +1 -1
- package/dist/sensors/index.d.mts +3 -3
- package/dist/sensors/index.d.ts +3 -3
- package/dist/sensors/index.js +402 -339
- package/dist/sensors/index.js.map +1 -1
- package/dist/sensors/index.mjs +349 -286
- package/dist/sensors/index.mjs.map +1 -1
- package/package.json +7 -7
package/dist/sensors/index.mjs
CHANGED
|
@@ -585,7 +585,7 @@ function AxisRateLimit(config) {
|
|
|
585
585
|
return descriptor;
|
|
586
586
|
};
|
|
587
587
|
}
|
|
588
|
-
var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_RATE_LIMIT_KEY;
|
|
588
|
+
var AXIS_META_KEY, SENSITIVITY_METADATA_KEY, CONTRACT_METADATA_KEY, REQUIRED_PROOF_METADATA_KEY, AXIS_PUBLIC_KEY, AXIS_ANONYMOUS_KEY, AXIS_AUTHORIZED_KEY, AXIS_RATE_LIMIT_KEY;
|
|
589
589
|
var init_intent_policy_decorator = __esm({
|
|
590
590
|
"src/decorators/intent-policy.decorator.ts"() {
|
|
591
591
|
AXIS_META_KEY = "axis:axis";
|
|
@@ -594,6 +594,7 @@ var init_intent_policy_decorator = __esm({
|
|
|
594
594
|
REQUIRED_PROOF_METADATA_KEY = "axis:required_proof";
|
|
595
595
|
AXIS_PUBLIC_KEY = "axis:public";
|
|
596
596
|
AXIS_ANONYMOUS_KEY = "axis:anonymous";
|
|
597
|
+
AXIS_AUTHORIZED_KEY = "axis:authorized";
|
|
597
598
|
AXIS_RATE_LIMIT_KEY = "axis:rateLimit";
|
|
598
599
|
}
|
|
599
600
|
});
|
|
@@ -1619,6 +1620,271 @@ var init_axis_chain_executor = __esm({
|
|
|
1619
1620
|
}
|
|
1620
1621
|
});
|
|
1621
1622
|
|
|
1623
|
+
// src/security/scopes.ts
|
|
1624
|
+
function hasScope(scopes, required) {
|
|
1625
|
+
if (!Array.isArray(scopes) || scopes.length === 0) {
|
|
1626
|
+
return false;
|
|
1627
|
+
}
|
|
1628
|
+
if (scopes.includes(required)) {
|
|
1629
|
+
return true;
|
|
1630
|
+
}
|
|
1631
|
+
const [resource, id] = required.split(":");
|
|
1632
|
+
if (resource && id) {
|
|
1633
|
+
const wildcard = `${resource}:*`;
|
|
1634
|
+
if (scopes.includes(wildcard)) {
|
|
1635
|
+
return true;
|
|
1636
|
+
}
|
|
1637
|
+
}
|
|
1638
|
+
return false;
|
|
1639
|
+
}
|
|
1640
|
+
function parseScope(scope) {
|
|
1641
|
+
const parts = scope.split(":");
|
|
1642
|
+
if (parts.length !== 2) return null;
|
|
1643
|
+
return { resource: parts[0], id: parts[1] };
|
|
1644
|
+
}
|
|
1645
|
+
function canAccessResource(scopes, resourceType, resourceId) {
|
|
1646
|
+
const required = `${resourceType}:${resourceId}`;
|
|
1647
|
+
return hasScope(scopes, required);
|
|
1648
|
+
}
|
|
1649
|
+
var init_scopes = __esm({
|
|
1650
|
+
"src/security/scopes.ts"() {
|
|
1651
|
+
}
|
|
1652
|
+
});
|
|
1653
|
+
|
|
1654
|
+
// src/security/inline-capsule.ts
|
|
1655
|
+
function normalizeInlineCapsule(input) {
|
|
1656
|
+
if (!input || typeof input !== "object" || Array.isArray(input)) {
|
|
1657
|
+
return null;
|
|
1658
|
+
}
|
|
1659
|
+
const raw = input;
|
|
1660
|
+
const scopes = normalizeStringList(raw.scopes ?? raw.scope);
|
|
1661
|
+
return {
|
|
1662
|
+
id: normalizeScalar(raw.id),
|
|
1663
|
+
actorId: normalizeScalar(raw.actorId),
|
|
1664
|
+
intents: normalizeStringList(raw.intents),
|
|
1665
|
+
issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
|
|
1666
|
+
expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
|
|
1667
|
+
realm: normalizeScalar(raw.realm),
|
|
1668
|
+
node: normalizeScalar(raw.node),
|
|
1669
|
+
scopes,
|
|
1670
|
+
raw
|
|
1671
|
+
};
|
|
1672
|
+
}
|
|
1673
|
+
function inlineCapsuleAllowsIntent(capsule, intent) {
|
|
1674
|
+
if (!capsule.intents || capsule.intents.length === 0) {
|
|
1675
|
+
return false;
|
|
1676
|
+
}
|
|
1677
|
+
for (const pattern of capsule.intents) {
|
|
1678
|
+
if (pattern === "*" || pattern === intent) {
|
|
1679
|
+
return true;
|
|
1680
|
+
}
|
|
1681
|
+
if (pattern.endsWith(".*")) {
|
|
1682
|
+
const prefix = pattern.slice(0, -1);
|
|
1683
|
+
if (intent.startsWith(prefix)) {
|
|
1684
|
+
return true;
|
|
1685
|
+
}
|
|
1686
|
+
}
|
|
1687
|
+
}
|
|
1688
|
+
return false;
|
|
1689
|
+
}
|
|
1690
|
+
function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
|
|
1691
|
+
if (capsule.expiresAt === void 0) {
|
|
1692
|
+
return false;
|
|
1693
|
+
}
|
|
1694
|
+
return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
|
|
1695
|
+
}
|
|
1696
|
+
function resolvePolicyScopes(scopes, context) {
|
|
1697
|
+
return scopes.map(
|
|
1698
|
+
(scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
|
|
1699
|
+
const resolved = resolveTemplateExpression(expression.trim(), context);
|
|
1700
|
+
if (resolved === void 0 || resolved === null || resolved === "") {
|
|
1701
|
+
throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
|
|
1702
|
+
}
|
|
1703
|
+
return String(resolved);
|
|
1704
|
+
})
|
|
1705
|
+
);
|
|
1706
|
+
}
|
|
1707
|
+
function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
|
|
1708
|
+
if (!capsule.scopes || capsule.scopes.length === 0) {
|
|
1709
|
+
return false;
|
|
1710
|
+
}
|
|
1711
|
+
if (mode === "any") {
|
|
1712
|
+
return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
|
|
1713
|
+
}
|
|
1714
|
+
return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
|
|
1715
|
+
}
|
|
1716
|
+
function resolveTemplateExpression(expression, context) {
|
|
1717
|
+
if (expression === "intent") {
|
|
1718
|
+
return context.intent;
|
|
1719
|
+
}
|
|
1720
|
+
if (expression === "actorId") {
|
|
1721
|
+
return context.actorId;
|
|
1722
|
+
}
|
|
1723
|
+
if (expression === "chainId") {
|
|
1724
|
+
return context.chainId;
|
|
1725
|
+
}
|
|
1726
|
+
if (expression === "stepId") {
|
|
1727
|
+
return context.stepId;
|
|
1728
|
+
}
|
|
1729
|
+
if (expression.startsWith("body.")) {
|
|
1730
|
+
return getNestedValue(context.body, expression.slice(5));
|
|
1731
|
+
}
|
|
1732
|
+
return void 0;
|
|
1733
|
+
}
|
|
1734
|
+
function getNestedValue(value, path2) {
|
|
1735
|
+
if (!value || typeof value !== "object") {
|
|
1736
|
+
return void 0;
|
|
1737
|
+
}
|
|
1738
|
+
return path2.split(".").reduce((current, segment) => {
|
|
1739
|
+
if (!current || typeof current !== "object") {
|
|
1740
|
+
return void 0;
|
|
1741
|
+
}
|
|
1742
|
+
return current[segment];
|
|
1743
|
+
}, value);
|
|
1744
|
+
}
|
|
1745
|
+
function normalizeScalar(value) {
|
|
1746
|
+
if (typeof value === "string") {
|
|
1747
|
+
return value;
|
|
1748
|
+
}
|
|
1749
|
+
if (value instanceof Uint8Array) {
|
|
1750
|
+
return Buffer.from(value).toString("hex");
|
|
1751
|
+
}
|
|
1752
|
+
return void 0;
|
|
1753
|
+
}
|
|
1754
|
+
function normalizeStringList(value) {
|
|
1755
|
+
if (!value) {
|
|
1756
|
+
return void 0;
|
|
1757
|
+
}
|
|
1758
|
+
const list = Array.isArray(value) ? value : [value];
|
|
1759
|
+
const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
|
|
1760
|
+
return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
|
|
1761
|
+
}
|
|
1762
|
+
function normalizeTimestamp(value) {
|
|
1763
|
+
if (typeof value === "bigint") {
|
|
1764
|
+
return value;
|
|
1765
|
+
}
|
|
1766
|
+
if (typeof value === "number" && Number.isFinite(value)) {
|
|
1767
|
+
return BigInt(Math.trunc(value));
|
|
1768
|
+
}
|
|
1769
|
+
if (typeof value === "string" && value.trim().length > 0) {
|
|
1770
|
+
try {
|
|
1771
|
+
return BigInt(value);
|
|
1772
|
+
} catch {
|
|
1773
|
+
return void 0;
|
|
1774
|
+
}
|
|
1775
|
+
}
|
|
1776
|
+
return void 0;
|
|
1777
|
+
}
|
|
1778
|
+
var init_inline_capsule = __esm({
|
|
1779
|
+
"src/security/inline-capsule.ts"() {
|
|
1780
|
+
init_scopes();
|
|
1781
|
+
}
|
|
1782
|
+
});
|
|
1783
|
+
|
|
1784
|
+
// src/sensor/axis-sensor.ts
|
|
1785
|
+
function normalizeSensorDecision(sensorDecision) {
|
|
1786
|
+
if ("action" in sensorDecision) {
|
|
1787
|
+
switch (sensorDecision.action) {
|
|
1788
|
+
case "ALLOW":
|
|
1789
|
+
return {
|
|
1790
|
+
allow: true,
|
|
1791
|
+
riskScore: 0,
|
|
1792
|
+
reasons: [],
|
|
1793
|
+
meta: sensorDecision.meta
|
|
1794
|
+
};
|
|
1795
|
+
case "DENY":
|
|
1796
|
+
return {
|
|
1797
|
+
allow: false,
|
|
1798
|
+
riskScore: 100,
|
|
1799
|
+
reasons: [sensorDecision.code, sensorDecision.reason].filter(
|
|
1800
|
+
Boolean
|
|
1801
|
+
),
|
|
1802
|
+
meta: sensorDecision.meta,
|
|
1803
|
+
retryAfterMs: sensorDecision.retryAfterMs
|
|
1804
|
+
};
|
|
1805
|
+
case "THROTTLE":
|
|
1806
|
+
return {
|
|
1807
|
+
allow: false,
|
|
1808
|
+
riskScore: 50,
|
|
1809
|
+
reasons: ["RATE_LIMIT"],
|
|
1810
|
+
retryAfterMs: sensorDecision.retryAfterMs,
|
|
1811
|
+
meta: sensorDecision.meta
|
|
1812
|
+
};
|
|
1813
|
+
case "FLAG":
|
|
1814
|
+
return {
|
|
1815
|
+
allow: true,
|
|
1816
|
+
riskScore: sensorDecision.scoreDelta,
|
|
1817
|
+
reasons: sensorDecision.reasons,
|
|
1818
|
+
meta: sensorDecision.meta
|
|
1819
|
+
};
|
|
1820
|
+
}
|
|
1821
|
+
}
|
|
1822
|
+
return {
|
|
1823
|
+
allow: sensorDecision.allow,
|
|
1824
|
+
riskScore: sensorDecision.riskScore,
|
|
1825
|
+
reasons: sensorDecision.reasons,
|
|
1826
|
+
tags: sensorDecision.tags,
|
|
1827
|
+
meta: sensorDecision.meta,
|
|
1828
|
+
tighten: sensorDecision.tighten,
|
|
1829
|
+
retryAfterMs: sensorDecision.retryAfterMs
|
|
1830
|
+
};
|
|
1831
|
+
}
|
|
1832
|
+
var Decision, SensorDecisions;
|
|
1833
|
+
var init_axis_sensor = __esm({
|
|
1834
|
+
"src/sensor/axis-sensor.ts"() {
|
|
1835
|
+
Decision = /* @__PURE__ */ ((Decision2) => {
|
|
1836
|
+
Decision2["ALLOW"] = "ALLOW";
|
|
1837
|
+
Decision2["DENY"] = "DENY";
|
|
1838
|
+
Decision2["THROTTLE"] = "THROTTLE";
|
|
1839
|
+
Decision2["FLAG"] = "FLAG";
|
|
1840
|
+
return Decision2;
|
|
1841
|
+
})(Decision || {});
|
|
1842
|
+
SensorDecisions = {
|
|
1843
|
+
allow(meta, tags) {
|
|
1844
|
+
return {
|
|
1845
|
+
decision: "ALLOW" /* ALLOW */,
|
|
1846
|
+
allow: true,
|
|
1847
|
+
riskScore: 0,
|
|
1848
|
+
reasons: [],
|
|
1849
|
+
tags,
|
|
1850
|
+
meta
|
|
1851
|
+
};
|
|
1852
|
+
},
|
|
1853
|
+
deny(code, reason, meta) {
|
|
1854
|
+
return {
|
|
1855
|
+
decision: "DENY" /* DENY */,
|
|
1856
|
+
allow: false,
|
|
1857
|
+
riskScore: 100,
|
|
1858
|
+
code,
|
|
1859
|
+
reasons: [code, reason].filter(Boolean),
|
|
1860
|
+
meta
|
|
1861
|
+
};
|
|
1862
|
+
},
|
|
1863
|
+
throttle(retryAfterMs, meta) {
|
|
1864
|
+
return {
|
|
1865
|
+
decision: "THROTTLE" /* THROTTLE */,
|
|
1866
|
+
allow: false,
|
|
1867
|
+
riskScore: 50,
|
|
1868
|
+
retryAfterMs,
|
|
1869
|
+
code: "RATE_LIMIT",
|
|
1870
|
+
reasons: ["RATE_LIMIT"],
|
|
1871
|
+
meta
|
|
1872
|
+
};
|
|
1873
|
+
},
|
|
1874
|
+
flag(scoreDelta, reasons, meta) {
|
|
1875
|
+
return {
|
|
1876
|
+
decision: "FLAG" /* FLAG */,
|
|
1877
|
+
allow: true,
|
|
1878
|
+
riskScore: scoreDelta,
|
|
1879
|
+
scoreDelta,
|
|
1880
|
+
reasons,
|
|
1881
|
+
meta
|
|
1882
|
+
};
|
|
1883
|
+
}
|
|
1884
|
+
};
|
|
1885
|
+
}
|
|
1886
|
+
});
|
|
1887
|
+
|
|
1622
1888
|
// src/cce/cce.types.ts
|
|
1623
1889
|
var CCE_PROTOCOL_VERSION, CCE_DERIVATION, CCE_AES_KEY_BYTES, CCE_IV_BYTES, CCE_NONCE_BYTES, CCE_ERROR, CceError;
|
|
1624
1890
|
var init_cce_types = __esm({
|
|
@@ -1992,116 +2258,12 @@ function hexToBytes2(hex) {
|
|
|
1992
2258
|
for (let i = 0; i < bytes2.length; i++) {
|
|
1993
2259
|
bytes2[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
|
|
1994
2260
|
}
|
|
1995
|
-
return bytes2;
|
|
1996
|
-
}
|
|
1997
|
-
var init_cce_witness_observer = __esm({
|
|
1998
|
-
"src/cce/cce-witness.observer.ts"() {
|
|
1999
|
-
init_cce_crypto();
|
|
2000
|
-
init_cce_types();
|
|
2001
|
-
}
|
|
2002
|
-
});
|
|
2003
|
-
|
|
2004
|
-
// src/sensor/axis-sensor.ts
|
|
2005
|
-
function normalizeSensorDecision(sensorDecision) {
|
|
2006
|
-
if ("action" in sensorDecision) {
|
|
2007
|
-
switch (sensorDecision.action) {
|
|
2008
|
-
case "ALLOW":
|
|
2009
|
-
return {
|
|
2010
|
-
allow: true,
|
|
2011
|
-
riskScore: 0,
|
|
2012
|
-
reasons: [],
|
|
2013
|
-
meta: sensorDecision.meta
|
|
2014
|
-
};
|
|
2015
|
-
case "DENY":
|
|
2016
|
-
return {
|
|
2017
|
-
allow: false,
|
|
2018
|
-
riskScore: 100,
|
|
2019
|
-
reasons: [sensorDecision.code, sensorDecision.reason].filter(
|
|
2020
|
-
Boolean
|
|
2021
|
-
),
|
|
2022
|
-
meta: sensorDecision.meta,
|
|
2023
|
-
retryAfterMs: sensorDecision.retryAfterMs
|
|
2024
|
-
};
|
|
2025
|
-
case "THROTTLE":
|
|
2026
|
-
return {
|
|
2027
|
-
allow: false,
|
|
2028
|
-
riskScore: 50,
|
|
2029
|
-
reasons: ["RATE_LIMIT"],
|
|
2030
|
-
retryAfterMs: sensorDecision.retryAfterMs,
|
|
2031
|
-
meta: sensorDecision.meta
|
|
2032
|
-
};
|
|
2033
|
-
case "FLAG":
|
|
2034
|
-
return {
|
|
2035
|
-
allow: true,
|
|
2036
|
-
riskScore: sensorDecision.scoreDelta,
|
|
2037
|
-
reasons: sensorDecision.reasons,
|
|
2038
|
-
meta: sensorDecision.meta
|
|
2039
|
-
};
|
|
2040
|
-
}
|
|
2041
|
-
}
|
|
2042
|
-
return {
|
|
2043
|
-
allow: sensorDecision.allow,
|
|
2044
|
-
riskScore: sensorDecision.riskScore,
|
|
2045
|
-
reasons: sensorDecision.reasons,
|
|
2046
|
-
tags: sensorDecision.tags,
|
|
2047
|
-
meta: sensorDecision.meta,
|
|
2048
|
-
tighten: sensorDecision.tighten,
|
|
2049
|
-
retryAfterMs: sensorDecision.retryAfterMs
|
|
2050
|
-
};
|
|
2261
|
+
return bytes2;
|
|
2051
2262
|
}
|
|
2052
|
-
var
|
|
2053
|
-
|
|
2054
|
-
|
|
2055
|
-
|
|
2056
|
-
Decision2["ALLOW"] = "ALLOW";
|
|
2057
|
-
Decision2["DENY"] = "DENY";
|
|
2058
|
-
Decision2["THROTTLE"] = "THROTTLE";
|
|
2059
|
-
Decision2["FLAG"] = "FLAG";
|
|
2060
|
-
return Decision2;
|
|
2061
|
-
})(Decision || {});
|
|
2062
|
-
SensorDecisions = {
|
|
2063
|
-
allow(meta, tags) {
|
|
2064
|
-
return {
|
|
2065
|
-
decision: "ALLOW" /* ALLOW */,
|
|
2066
|
-
allow: true,
|
|
2067
|
-
riskScore: 0,
|
|
2068
|
-
reasons: [],
|
|
2069
|
-
tags,
|
|
2070
|
-
meta
|
|
2071
|
-
};
|
|
2072
|
-
},
|
|
2073
|
-
deny(code, reason, meta) {
|
|
2074
|
-
return {
|
|
2075
|
-
decision: "DENY" /* DENY */,
|
|
2076
|
-
allow: false,
|
|
2077
|
-
riskScore: 100,
|
|
2078
|
-
code,
|
|
2079
|
-
reasons: [code, reason].filter(Boolean),
|
|
2080
|
-
meta
|
|
2081
|
-
};
|
|
2082
|
-
},
|
|
2083
|
-
throttle(retryAfterMs, meta) {
|
|
2084
|
-
return {
|
|
2085
|
-
decision: "THROTTLE" /* THROTTLE */,
|
|
2086
|
-
allow: false,
|
|
2087
|
-
riskScore: 50,
|
|
2088
|
-
retryAfterMs,
|
|
2089
|
-
code: "RATE_LIMIT",
|
|
2090
|
-
reasons: ["RATE_LIMIT"],
|
|
2091
|
-
meta
|
|
2092
|
-
};
|
|
2093
|
-
},
|
|
2094
|
-
flag(scoreDelta, reasons, meta) {
|
|
2095
|
-
return {
|
|
2096
|
-
decision: "FLAG" /* FLAG */,
|
|
2097
|
-
allow: true,
|
|
2098
|
-
riskScore: scoreDelta,
|
|
2099
|
-
scoreDelta,
|
|
2100
|
-
reasons,
|
|
2101
|
-
meta
|
|
2102
|
-
};
|
|
2103
|
-
}
|
|
2104
|
-
};
|
|
2263
|
+
var init_cce_witness_observer = __esm({
|
|
2264
|
+
"src/cce/cce-witness.observer.ts"() {
|
|
2265
|
+
init_cce_crypto();
|
|
2266
|
+
init_cce_types();
|
|
2105
2267
|
}
|
|
2106
2268
|
});
|
|
2107
2269
|
|
|
@@ -2353,167 +2515,6 @@ var init_axis_error = __esm({
|
|
|
2353
2515
|
}
|
|
2354
2516
|
});
|
|
2355
2517
|
|
|
2356
|
-
// src/security/scopes.ts
|
|
2357
|
-
function hasScope(scopes, required) {
|
|
2358
|
-
if (!Array.isArray(scopes) || scopes.length === 0) {
|
|
2359
|
-
return false;
|
|
2360
|
-
}
|
|
2361
|
-
if (scopes.includes(required)) {
|
|
2362
|
-
return true;
|
|
2363
|
-
}
|
|
2364
|
-
const [resource, id] = required.split(":");
|
|
2365
|
-
if (resource && id) {
|
|
2366
|
-
const wildcard = `${resource}:*`;
|
|
2367
|
-
if (scopes.includes(wildcard)) {
|
|
2368
|
-
return true;
|
|
2369
|
-
}
|
|
2370
|
-
}
|
|
2371
|
-
return false;
|
|
2372
|
-
}
|
|
2373
|
-
function parseScope(scope) {
|
|
2374
|
-
const parts = scope.split(":");
|
|
2375
|
-
if (parts.length !== 2) return null;
|
|
2376
|
-
return { resource: parts[0], id: parts[1] };
|
|
2377
|
-
}
|
|
2378
|
-
function canAccessResource(scopes, resourceType, resourceId) {
|
|
2379
|
-
const required = `${resourceType}:${resourceId}`;
|
|
2380
|
-
return hasScope(scopes, required);
|
|
2381
|
-
}
|
|
2382
|
-
var init_scopes = __esm({
|
|
2383
|
-
"src/security/scopes.ts"() {
|
|
2384
|
-
}
|
|
2385
|
-
});
|
|
2386
|
-
|
|
2387
|
-
// src/security/inline-capsule.ts
|
|
2388
|
-
function normalizeInlineCapsule(input) {
|
|
2389
|
-
if (!input || typeof input !== "object" || Array.isArray(input)) {
|
|
2390
|
-
return null;
|
|
2391
|
-
}
|
|
2392
|
-
const raw = input;
|
|
2393
|
-
const scopes = normalizeStringList(raw.scopes ?? raw.scope);
|
|
2394
|
-
return {
|
|
2395
|
-
id: normalizeScalar(raw.id),
|
|
2396
|
-
actorId: normalizeScalar(raw.actorId),
|
|
2397
|
-
intents: normalizeStringList(raw.intents),
|
|
2398
|
-
issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
|
|
2399
|
-
expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
|
|
2400
|
-
realm: normalizeScalar(raw.realm),
|
|
2401
|
-
node: normalizeScalar(raw.node),
|
|
2402
|
-
scopes,
|
|
2403
|
-
raw
|
|
2404
|
-
};
|
|
2405
|
-
}
|
|
2406
|
-
function inlineCapsuleAllowsIntent(capsule, intent) {
|
|
2407
|
-
if (!capsule.intents || capsule.intents.length === 0) {
|
|
2408
|
-
return false;
|
|
2409
|
-
}
|
|
2410
|
-
for (const pattern of capsule.intents) {
|
|
2411
|
-
if (pattern === "*" || pattern === intent) {
|
|
2412
|
-
return true;
|
|
2413
|
-
}
|
|
2414
|
-
if (pattern.endsWith(".*")) {
|
|
2415
|
-
const prefix = pattern.slice(0, -1);
|
|
2416
|
-
if (intent.startsWith(prefix)) {
|
|
2417
|
-
return true;
|
|
2418
|
-
}
|
|
2419
|
-
}
|
|
2420
|
-
}
|
|
2421
|
-
return false;
|
|
2422
|
-
}
|
|
2423
|
-
function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
|
|
2424
|
-
if (capsule.expiresAt === void 0) {
|
|
2425
|
-
return false;
|
|
2426
|
-
}
|
|
2427
|
-
return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
|
|
2428
|
-
}
|
|
2429
|
-
function resolvePolicyScopes(scopes, context) {
|
|
2430
|
-
return scopes.map(
|
|
2431
|
-
(scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
|
|
2432
|
-
const resolved = resolveTemplateExpression(expression.trim(), context);
|
|
2433
|
-
if (resolved === void 0 || resolved === null || resolved === "") {
|
|
2434
|
-
throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
|
|
2435
|
-
}
|
|
2436
|
-
return String(resolved);
|
|
2437
|
-
})
|
|
2438
|
-
);
|
|
2439
|
-
}
|
|
2440
|
-
function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
|
|
2441
|
-
if (!capsule.scopes || capsule.scopes.length === 0) {
|
|
2442
|
-
return false;
|
|
2443
|
-
}
|
|
2444
|
-
if (mode === "any") {
|
|
2445
|
-
return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
|
|
2446
|
-
}
|
|
2447
|
-
return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
|
|
2448
|
-
}
|
|
2449
|
-
function resolveTemplateExpression(expression, context) {
|
|
2450
|
-
if (expression === "intent") {
|
|
2451
|
-
return context.intent;
|
|
2452
|
-
}
|
|
2453
|
-
if (expression === "actorId") {
|
|
2454
|
-
return context.actorId;
|
|
2455
|
-
}
|
|
2456
|
-
if (expression === "chainId") {
|
|
2457
|
-
return context.chainId;
|
|
2458
|
-
}
|
|
2459
|
-
if (expression === "stepId") {
|
|
2460
|
-
return context.stepId;
|
|
2461
|
-
}
|
|
2462
|
-
if (expression.startsWith("body.")) {
|
|
2463
|
-
return getNestedValue(context.body, expression.slice(5));
|
|
2464
|
-
}
|
|
2465
|
-
return void 0;
|
|
2466
|
-
}
|
|
2467
|
-
function getNestedValue(value, path2) {
|
|
2468
|
-
if (!value || typeof value !== "object") {
|
|
2469
|
-
return void 0;
|
|
2470
|
-
}
|
|
2471
|
-
return path2.split(".").reduce((current, segment) => {
|
|
2472
|
-
if (!current || typeof current !== "object") {
|
|
2473
|
-
return void 0;
|
|
2474
|
-
}
|
|
2475
|
-
return current[segment];
|
|
2476
|
-
}, value);
|
|
2477
|
-
}
|
|
2478
|
-
function normalizeScalar(value) {
|
|
2479
|
-
if (typeof value === "string") {
|
|
2480
|
-
return value;
|
|
2481
|
-
}
|
|
2482
|
-
if (value instanceof Uint8Array) {
|
|
2483
|
-
return Buffer.from(value).toString("hex");
|
|
2484
|
-
}
|
|
2485
|
-
return void 0;
|
|
2486
|
-
}
|
|
2487
|
-
function normalizeStringList(value) {
|
|
2488
|
-
if (!value) {
|
|
2489
|
-
return void 0;
|
|
2490
|
-
}
|
|
2491
|
-
const list = Array.isArray(value) ? value : [value];
|
|
2492
|
-
const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
|
|
2493
|
-
return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
|
|
2494
|
-
}
|
|
2495
|
-
function normalizeTimestamp(value) {
|
|
2496
|
-
if (typeof value === "bigint") {
|
|
2497
|
-
return value;
|
|
2498
|
-
}
|
|
2499
|
-
if (typeof value === "number" && Number.isFinite(value)) {
|
|
2500
|
-
return BigInt(Math.trunc(value));
|
|
2501
|
-
}
|
|
2502
|
-
if (typeof value === "string" && value.trim().length > 0) {
|
|
2503
|
-
try {
|
|
2504
|
-
return BigInt(value);
|
|
2505
|
-
} catch {
|
|
2506
|
-
return void 0;
|
|
2507
|
-
}
|
|
2508
|
-
}
|
|
2509
|
-
return void 0;
|
|
2510
|
-
}
|
|
2511
|
-
var init_inline_capsule = __esm({
|
|
2512
|
-
"src/security/inline-capsule.ts"() {
|
|
2513
|
-
init_scopes();
|
|
2514
|
-
}
|
|
2515
|
-
});
|
|
2516
|
-
|
|
2517
2518
|
// src/engine/intent.router.ts
|
|
2518
2519
|
var intent_router_exports = {};
|
|
2519
2520
|
__export(intent_router_exports, {
|
|
@@ -2590,23 +2591,23 @@ function normalizeChainConfig(decoratorConfig, intentConfig) {
|
|
|
2590
2591
|
var import_dto_schema, _IntentRouter, IntentRouter;
|
|
2591
2592
|
var init_intent_router = __esm({
|
|
2592
2593
|
"src/engine/intent.router.ts"() {
|
|
2593
|
-
init_cce_pipeline();
|
|
2594
|
-
init_axis_error();
|
|
2595
|
-
init_constants();
|
|
2596
|
-
init_capsule_policy_decorator();
|
|
2597
|
-
init_chain_decorator();
|
|
2598
|
-
import_dto_schema = __toESM(require_dto_schema_util());
|
|
2599
2594
|
init_handler_sensors_decorator();
|
|
2600
|
-
|
|
2601
|
-
init_intent_body_decorator();
|
|
2602
|
-
init_intent_policy_decorator();
|
|
2595
|
+
init_capsule_policy_decorator();
|
|
2603
2596
|
init_intent_sensors_decorator();
|
|
2604
|
-
|
|
2597
|
+
init_intent_policy_decorator();
|
|
2598
|
+
init_intent_body_decorator();
|
|
2605
2599
|
init_observer_decorator();
|
|
2600
|
+
init_handler_decorator();
|
|
2601
|
+
init_intent_decorator();
|
|
2602
|
+
init_chain_decorator();
|
|
2603
|
+
import_dto_schema = __toESM(require_dto_schema_util());
|
|
2606
2604
|
init_inline_capsule();
|
|
2607
|
-
init_axis_sensor();
|
|
2608
2605
|
init_axis_execution_context();
|
|
2606
|
+
init_axis_sensor();
|
|
2609
2607
|
init_axis_logger();
|
|
2608
|
+
init_cce_pipeline();
|
|
2609
|
+
init_axis_error();
|
|
2610
|
+
init_constants();
|
|
2610
2611
|
_IntentRouter = class _IntentRouter {
|
|
2611
2612
|
constructor(dependencyResolver, observerDispatcher, sensorRegistry) {
|
|
2612
2613
|
this.logger = createAxisLogger(_IntentRouter.name);
|
|
@@ -2642,6 +2643,8 @@ var init_intent_router = __esm({
|
|
|
2642
2643
|
this.publicIntents = /* @__PURE__ */ new Set();
|
|
2643
2644
|
/** Intents flagged as anonymous-session accessible */
|
|
2644
2645
|
this.anonymousIntents = /* @__PURE__ */ new Set();
|
|
2646
|
+
/** Intents flagged as authorized-session accessible */
|
|
2647
|
+
this.authorizedIntents = /* @__PURE__ */ new Set();
|
|
2645
2648
|
/** Per-intent rate limit config */
|
|
2646
2649
|
this.intentRateLimits = /* @__PURE__ */ new Map();
|
|
2647
2650
|
/** CCE handler registry */
|
|
@@ -3068,6 +3071,18 @@ var init_intent_router = __esm({
|
|
|
3068
3071
|
if (isAnonMethod || isAnonClass) {
|
|
3069
3072
|
this.anonymousIntents.add(intent);
|
|
3070
3073
|
}
|
|
3074
|
+
const isAuthorizedMethod = Reflect.getMetadata(
|
|
3075
|
+
AXIS_AUTHORIZED_KEY,
|
|
3076
|
+
proto,
|
|
3077
|
+
methodName
|
|
3078
|
+
);
|
|
3079
|
+
const isAuthorizedClass = Reflect.getMetadata(
|
|
3080
|
+
AXIS_AUTHORIZED_KEY,
|
|
3081
|
+
proto.constructor
|
|
3082
|
+
);
|
|
3083
|
+
if (isAuthorizedMethod || isAuthorizedClass) {
|
|
3084
|
+
this.authorizedIntents.add(intent);
|
|
3085
|
+
}
|
|
3071
3086
|
const rateLimit = Reflect.getMetadata(
|
|
3072
3087
|
AXIS_RATE_LIMIT_KEY,
|
|
3073
3088
|
proto,
|
|
@@ -3093,6 +3108,9 @@ var init_intent_router = __esm({
|
|
|
3093
3108
|
isAnonymous(intent) {
|
|
3094
3109
|
return this.anonymousIntents.has(intent);
|
|
3095
3110
|
}
|
|
3111
|
+
isAuthorized(intent) {
|
|
3112
|
+
return this.authorizedIntents.has(intent);
|
|
3113
|
+
}
|
|
3096
3114
|
getRateLimit(intent) {
|
|
3097
3115
|
return this.intentRateLimits.get(intent);
|
|
3098
3116
|
}
|
|
@@ -11116,15 +11134,52 @@ var require_chunk_hash_sensor = __commonJS({
|
|
|
11116
11134
|
var require_entropy_sensor = __commonJS({
|
|
11117
11135
|
"src/sensors/entropy.sensor.ts"(exports) {
|
|
11118
11136
|
"use strict";
|
|
11137
|
+
var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
|
|
11138
|
+
if (k2 === void 0) k2 = k;
|
|
11139
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
11140
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
11141
|
+
desc = { enumerable: true, get: function() {
|
|
11142
|
+
return m[k];
|
|
11143
|
+
} };
|
|
11144
|
+
}
|
|
11145
|
+
Object.defineProperty(o, k2, desc);
|
|
11146
|
+
}) : (function(o, m, k, k2) {
|
|
11147
|
+
if (k2 === void 0) k2 = k;
|
|
11148
|
+
o[k2] = m[k];
|
|
11149
|
+
}));
|
|
11150
|
+
var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
|
|
11151
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
11152
|
+
}) : function(o, v) {
|
|
11153
|
+
o["default"] = v;
|
|
11154
|
+
});
|
|
11119
11155
|
var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
|
|
11120
11156
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
11121
11157
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
11122
11158
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
11123
11159
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
11124
11160
|
};
|
|
11161
|
+
var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
|
|
11162
|
+
var ownKeys = function(o) {
|
|
11163
|
+
ownKeys = Object.getOwnPropertyNames || function(o2) {
|
|
11164
|
+
var ar = [];
|
|
11165
|
+
for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
|
|
11166
|
+
return ar;
|
|
11167
|
+
};
|
|
11168
|
+
return ownKeys(o);
|
|
11169
|
+
};
|
|
11170
|
+
return function(mod) {
|
|
11171
|
+
if (mod && mod.__esModule) return mod;
|
|
11172
|
+
var result = {};
|
|
11173
|
+
if (mod != null) {
|
|
11174
|
+
for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
11175
|
+
}
|
|
11176
|
+
__setModuleDefault(result, mod);
|
|
11177
|
+
return result;
|
|
11178
|
+
};
|
|
11179
|
+
})();
|
|
11125
11180
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
11126
11181
|
exports.EntropySensor = void 0;
|
|
11127
|
-
var crypto4 = __require("crypto");
|
|
11182
|
+
var crypto4 = __importStar(__require("crypto"));
|
|
11128
11183
|
var sensor_decorator_1 = (init_sensor_decorator(), __toCommonJS(sensor_decorator_exports));
|
|
11129
11184
|
var sensor_bands_1 = (init_sensor_bands(), __toCommonJS(sensor_bands_exports));
|
|
11130
11185
|
var constants_1 = (init_constants(), __toCommonJS(constants_exports));
|
|
@@ -11803,10 +11858,15 @@ var init_axis_schemas = __esm({
|
|
|
11803
11858
|
ScanBurstDecisionZ = SensorDecisionWithMetadataZ;
|
|
11804
11859
|
ProofKindZ = z2.enum([
|
|
11805
11860
|
"NONE",
|
|
11806
|
-
"
|
|
11861
|
+
"ANONYMOUS",
|
|
11807
11862
|
"PASSPORT",
|
|
11863
|
+
"CAPSULE",
|
|
11864
|
+
"JWT",
|
|
11865
|
+
"CONTRACT",
|
|
11866
|
+
"WITNESS",
|
|
11808
11867
|
"MTLS",
|
|
11809
|
-
"
|
|
11868
|
+
"DEVICE",
|
|
11869
|
+
"AUTHORIZED"
|
|
11810
11870
|
]);
|
|
11811
11871
|
AccessProfileZ = z2.enum(["PUBLIC", "PARTNER", "INTERNAL", "NODE"]);
|
|
11812
11872
|
ProofPresenceInputZ = z2.object({
|
|
@@ -11928,7 +11988,10 @@ var init_axis_schemas = __esm({
|
|
|
11928
11988
|
ip: z2.string().min(1)
|
|
11929
11989
|
});
|
|
11930
11990
|
ProtocolStrictInputZ = z2.object({
|
|
11931
|
-
rawBytes: z2.union([
|
|
11991
|
+
rawBytes: z2.union([
|
|
11992
|
+
z2.custom((v) => Buffer.isBuffer(v)),
|
|
11993
|
+
z2.instanceof(Uint8Array)
|
|
11994
|
+
]).optional(),
|
|
11932
11995
|
ip: z2.string().min(1),
|
|
11933
11996
|
path: z2.string().min(1),
|
|
11934
11997
|
contentLength: z2.number().int().nonnegative(),
|