@noodleseed/one 0.102.0 → 0.102.2

package/dist/devtools-delegated-exchange-authority.js

@@ -0,0 +1,288 @@
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { link, mkdir, open, rename, unlink } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { createStaticSigningKeyProvider } from '@noodle-borg/auth';
+import { exportPKCS8, generateKeyPair } from 'jose';
+const KEY_FILE_NAME = 'delegated-exchange-signing-key.pem';
+const TRUST_STATE_FILE_NAME = 'delegated-exchange-last-issuer';
+const MAX_KEY_BYTES = 16 * 1024;
+const MAX_TRUST_STATE_BYTES = 512;
+const WINNER_FINALIZATION_ATTEMPTS = 20;
+const WINNER_FINALIZATION_RETRY_MS = 5;
+const PRIVATE_JWK_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth'];
+export class LocalDevtoolsDelegatedExchangeAuthorityError extends Error {
+    code;
+    path;
+    constructor(path, kind = 'key') {
+        super(`Local delegated-exchange ${kind} is unsafe or unreadable. Stop Devtools, secure or remove ${JSON.stringify(path)}, then start again and update development endpoint trust.`);
+        this.name = 'LocalDevtoolsDelegatedExchangeAuthorityError';
+        this.code =
+            kind === 'key'
+                ? 'local_delegated_exchange_key_invalid'
+                : 'local_delegated_exchange_trust_state_invalid';
+        this.path = path;
+    }
+}
+class TransientWinnerFinalizationError extends Error {
+}
+export function createLocalDevtoolsDelegatedExchangeAuthority(projectRoot) {
+    const directory = join(projectRoot, '.noodle', 'devtools');
+    const keyPath = join(directory, KEY_FILE_NAME);
+    const trustStatePath = join(directory, TRUST_STATE_FILE_NAME);
+    let resolution;
+    let trust;
+    return {
+        resolve() {
+            resolution ??= resolveAuthority(directory, keyPath, trustStatePath)
+                .then(({ authority, trustDocument }) => {
+                trust = trustDocument;
+                return authority;
+            })
+                .catch((error) => {
+                throw toSafeError(keyPath, error);
+            });
+            return resolution;
+        },
+        trustDocument() {
+            return trust;
+        },
+    };
+}
+async function resolveAuthority(directory, keyPath, trustStatePath) {
+    await ensureOwnerOnlyDirectory(directory);
+    let previousIssuer;
+    try {
+        previousIssuer = await readPreviousIssuer(trustStatePath);
+    }
+    catch (error) {
+        throw toSafeTrustStateError(trustStatePath, error);
+    }
+    let privateKeyPem;
+    try {
+        privateKeyPem = await loadExistingKeyWithTransientRetry(keyPath);
+    }
+    catch (error) {
+        if (!isErrno(error, 'ENOENT')) {
+            throw error;
+        }
+        privateKeyPem = await createOrLoadWinningKey(directory, keyPath);
+    }
+    const resolved = await buildResolvedAuthority(privateKeyPem);
+    const trustChanged = previousIssuer !== undefined && previousIssuer !== resolved.trustDocument.issuer;
+    await persistCurrentIssuer(directory, trustStatePath, resolved.trustDocument.issuer);
+    return {
+        authority: resolved.authority,
+        trustDocument: Object.freeze({ ...resolved.trustDocument, trustChanged }),
+    };
+}
+async function readPreviousIssuer(trustStatePath) {
+    let handle;
+    try {
+        handle = await open(trustStatePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            (metadata.mode & 0o077) !== 0 ||
+            metadata.size === 0 ||
+            metadata.size > MAX_TRUST_STATE_BYTES ||
+            metadata.nlink !== 1) {
+            throw new Error('unsafe trust state file');
+        }
+        const issuer = await handle.readFile('utf8');
+        if (!/^urn:noodleseed:devtools:[A-Za-z0-9_-]{1,256}$/u.test(issuer)) {
+            throw new Error('invalid trust state');
+        }
+        return issuer;
+    }
+    catch (error) {
+        if (isErrno(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function persistCurrentIssuer(directory, trustStatePath, issuer) {
+    const temporaryPath = join(directory, `.${TRUST_STATE_FILE_NAME}.${process.pid}.${randomUUID()}.tmp`);
+    let handle;
+    let temporaryExists = false;
+    try {
+        handle = await open(temporaryPath, 'wx', 0o600);
+        temporaryExists = true;
+        await handle.writeFile(issuer, 'utf8');
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await rename(temporaryPath, trustStatePath);
+        temporaryExists = false;
+    }
+    finally {
+        await handle?.close();
+        if (temporaryExists) {
+            try {
+                await unlink(temporaryPath);
+            }
+            catch {
+                // The outer operation already fails closed; do not replace it with raw cleanup diagnostics.
+            }
+        }
+    }
+}
+async function ensureOwnerOnlyDirectory(directory) {
+    await ensureDirectoryWithoutFollowingSymlink(dirname(directory), false);
+    await ensureDirectoryWithoutFollowingSymlink(directory, true);
+}
+async function ensureDirectoryWithoutFollowingSymlink(directory, requireOwnerOnly) {
+    try {
+        await mkdir(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!isErrno(error, 'EEXIST')) {
+            throw error;
+        }
+    }
+    let handle;
+    try {
+        handle = await open(directory, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_DIRECTORY);
+        const metadata = await handle.stat();
+        if (!metadata.isDirectory() || (requireOwnerOnly && (metadata.mode & 0o077) !== 0)) {
+            throw new Error('unsafe directory');
+        }
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function loadExistingKeyWithTransientRetry(keyPath) {
+    for (let attempt = 0; attempt < WINNER_FINALIZATION_ATTEMPTS; attempt += 1) {
+        try {
+            return await readSecureKeyFile(keyPath);
+        }
+        catch (error) {
+            if (!(error instanceof TransientWinnerFinalizationError)) {
+                throw error;
+            }
+            if (attempt === WINNER_FINALIZATION_ATTEMPTS - 1) {
+                throw error;
+            }
+            await delay(WINNER_FINALIZATION_RETRY_MS);
+        }
+    }
+    throw new TransientWinnerFinalizationError();
+}
+async function readSecureKeyFile(keyPath) {
+    let handle;
+    try {
+        handle = await open(keyPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            (metadata.mode & 0o077) !== 0 ||
+            metadata.size > MAX_KEY_BYTES ||
+            metadata.nlink < 1) {
+            throw new Error('unsafe key file');
+        }
+        if (metadata.nlink > 1) {
+            throw new TransientWinnerFinalizationError();
+        }
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function createOrLoadWinningKey(directory, keyPath) {
+    const pair = await generateKeyPair('RS256', { extractable: true });
+    const privateKeyPem = await exportPKCS8(pair.privateKey);
+    const temporaryPath = join(directory, `.${KEY_FILE_NAME}.${process.pid}.${randomUUID()}.tmp`);
+    let handle;
+    let temporaryExists = false;
+    try {
+        handle = await open(temporaryPath, 'wx', 0o600);
+        temporaryExists = true;
+        await handle.writeFile(privateKeyPem, 'utf8');
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        try {
+            await link(temporaryPath, keyPath);
+        }
+        catch (error) {
+            if (!isErrno(error, 'EEXIST')) {
+                throw error;
+            }
+            await unlink(temporaryPath);
+            temporaryExists = false;
+            return await loadExistingKeyWithTransientRetry(keyPath);
+        }
+        await unlink(temporaryPath);
+        temporaryExists = false;
+        return privateKeyPem;
+    }
+    finally {
+        await handle?.close();
+        if (temporaryExists) {
+            try {
+                await unlink(temporaryPath);
+            }
+            catch {
+                // The outer operation already fails closed; do not replace it with raw cleanup diagnostics.
+            }
+        }
+    }
+}
+async function buildResolvedAuthority(privateKeyPem) {
+    const signer = await createStaticSigningKeyProvider({ privateKeyPem });
+    const published = await signer.publicJwks();
+    const sourceKey = published.keys[0];
+    if (published.keys.length !== 1 || !isSafePublicSigningKey(sourceKey)) {
+        throw new Error('unsafe public signing key');
+    }
+    const publicKey = Object.freeze({
+        kty: sourceKey.kty,
+        n: sourceKey.n,
+        e: sourceKey.e,
+        kid: sourceKey.kid,
+        alg: 'RS256',
+        use: 'sig',
+    });
+    const keys = Object.freeze([publicKey]);
+    const jwks = Object.freeze({ keys });
+    const issuer = `urn:noodleseed:devtools:${sourceKey.kid}`;
+    const trustDocument = Object.freeze({ issuer, jwks, trustChanged: false });
+    return {
+        authority: { issuer, signer },
+        trustDocument,
+    };
+}
+function isSafePublicSigningKey(key) {
+    if (key?.kty !== 'RSA' ||
+        typeof key.n !== 'string' ||
+        typeof key.e !== 'string' ||
+        typeof key.kid !== 'string' ||
+        key.kid.length === 0 ||
+        key.alg !== 'RS256' ||
+        key.use !== 'sig') {
+        return false;
+    }
+    return PRIVATE_JWK_MEMBERS.every((member) => !(member in key));
+}
+function isErrno(error, code) {
+    return error?.code === code;
+}
+function toSafeError(keyPath, error) {
+    if (error instanceof LocalDevtoolsDelegatedExchangeAuthorityError) {
+        return error;
+    }
+    return new LocalDevtoolsDelegatedExchangeAuthorityError(keyPath);
+}
+function toSafeTrustStateError(trustStatePath, error) {
+    if (error instanceof LocalDevtoolsDelegatedExchangeAuthorityError) {
+        return error;
+    }
+    return new LocalDevtoolsDelegatedExchangeAuthorityError(trustStatePath, 'trust state');
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//# sourceMappingURL=devtools-delegated-exchange-authority.js.map

package/dist/devtools-delegated-exchange-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-exchange-authority.js","sourceRoot":"","sources":["../src/devtools-delegated-exchange-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAmB,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAgC,MAAM,MAAM,CAAC;AAElF,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAC3D,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAC/D,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AACvC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC;AAa9E,MAAM,OAAO,4CAA6C,SAAQ,KAAK;IAC5D,IAAI,CAEsC;IAC1C,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAA8B,KAAK;QAC3D,KAAK,CACH,4BAA4B,IAAI,6DAA6D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2DAA2D,CAC7K,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8CAA8C,CAAC;QAC3D,IAAI,CAAC,IAAI;YACP,IAAI,KAAK,KAAK;gBACZ,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,8CAA8C,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,gCAAiC,SAAQ,KAAK;CAAG;AAEvD,MAAM,UAAU,6CAA6C,CAC3D,WAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC9D,IAAI,UAAuD,CAAC;IAC5D,IAAI,KAA8D,CAAC;IAEnE,OAAO;QACL,OAAO;YACL,UAAU,KAAK,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC;iBAChE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE;gBACrC,KAAK,GAAG,aAAa,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACL,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,aAAa;YACX,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,OAAe,EACf,cAAsB;IAKtB,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,aAAa,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,YAAY,GAChB,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;IACnF,MAAM,oBAAoB,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACrF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,cAAsB;IACtD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CACjB,cAAc,EACd,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;YAClB,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7B,QAAQ,CAAC,IAAI,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,GAAG,qBAAqB;YACrC,QAAQ,CAAC,KAAK,KAAK,CAAC,EACpB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,cAAsB,EACtB,MAAc;IAEd,MAAM,aAAa,GAAG,IAAI,CACxB,SAAS,EACT,IAAI,qBAAqB,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAC/D,CAAC;IACF,IAAI,MAA8B,CAAC;IACnC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAC5C,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4FAA4F;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IACvD,MAAM,sCAAsC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,sCAAsC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,SAAiB,EACjB,gBAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CACjB,SAAS,EACT,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,WAAW,CAClE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,OAAe;IAC9D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,4BAA4B,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,gCAAgC,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,OAAO,KAAK,4BAA4B,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,gCAAgC,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;YAClB,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7B,QAAQ,CAAC,IAAI,GAAG,aAAa;YAC7B,QAAQ,CAAC,KAAK,GAAG,CAAC,EAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,aAAa,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9F,IAAI,MAA8B,CAAC;IACnC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,eAAe,GAAG,KAAK,CAAC;YACxB,OAAO,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,eAAe,GAAG,KAAK,CAAC;QACxB,OAAO,aAAa,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4FAA4F;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAIzD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAkB,CAAC;IACtD,MAAM,MAAM,GAAG,2BAA2B,SAAS,CAAC,GAAG,EAAE,CAAC;IAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO;QACL,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAC7B,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAoB;IAClD,IACE,GAAG,EAAE,GAAG,KAAK,KAAK;QAClB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QACpB,GAAG,CAAC,GAAG,KAAK,OAAO;QACnB,GAAG,CAAC,GAAG,KAAK,KAAK,EACjB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAQ,KAA2C,EAAE,IAAI,KAAK,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,KAAc;IAEd,IAAI,KAAK,YAAY,4CAA4C,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,4CAA4C,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAC5B,cAAsB,EACtB,KAAc;IAEd,IAAI,KAAK,YAAY,4CAA4C,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,4CAA4C,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/devtools-delegated-exchange-state.d.ts

@@ -0,0 +1,22 @@
+import type { LocalDevtoolsDelegatedExchangeBindingProjection, LocalDevtoolsDelegatedExchangeSuccess } from '@noodle-borg/service';
+import type { JSONWebKeySet } from 'jose';
+import type { LocalDevtoolsDelegatedExchangeTrustDocument } from './devtools-delegated-exchange-authority.js';
+export interface DevtoolsDelegatedExchangeStatus {
+    readonly issuer: string;
+    readonly jwks: JSONWebKeySet;
+    readonly trustChanged: boolean;
+    readonly bindings: readonly {
+        readonly bindingKey: string;
+        readonly connectorId: string;
+        readonly operation?: string;
+        readonly verified: boolean;
+    }[];
+}
+interface DevtoolsDelegatedExchangeState {
+    snapshot(): DevtoolsDelegatedExchangeStatus | undefined;
+    replace(trust: LocalDevtoolsDelegatedExchangeTrustDocument | undefined, projections: readonly LocalDevtoolsDelegatedExchangeBindingProjection[]): void;
+    markVerified(event: LocalDevtoolsDelegatedExchangeSuccess): void;
+}
+export declare function createDevtoolsDelegatedExchangeState(): DevtoolsDelegatedExchangeState;
+export {};
+//# sourceMappingURL=devtools-delegated-exchange-state.d.ts.map

package/dist/devtools-delegated-exchange-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-exchange-state.d.ts","sourceRoot":"","sources":["../src/devtools-delegated-exchange-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,+CAA+C,EAC/C,qCAAqC,EACtC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,4CAA4C,CAAC;AAE9G,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;CACL;AAED,UAAU,8BAA8B;IACtC,QAAQ,IAAI,+BAA+B,GAAG,SAAS,CAAC;IACxD,OAAO,CACL,KAAK,EAAE,2CAA2C,GAAG,SAAS,EAC9D,WAAW,EAAE,SAAS,+CAA+C,EAAE,GACtE,IAAI,CAAC;IACR,YAAY,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAAC;CAClE;AAED,wBAAgB,oCAAoC,IAAI,8BAA8B,CAkDrF"}

package/dist/devtools-delegated-exchange-state.js

@@ -0,0 +1,58 @@
+export function createDevtoolsDelegatedExchangeState() {
+    let current;
+    return {
+        snapshot() {
+            return current === undefined ? undefined : cloneAndFreeze(current);
+        },
+        replace(trust, projections) {
+            if (projections.length === 0) {
+                current = undefined;
+                return;
+            }
+            if (trust === undefined) {
+                throw new Error('delegated-exchange projections require a resolved trust document');
+            }
+            const previous = current;
+            const sameIssuer = previous?.issuer === trust.issuer;
+            const verified = new Set();
+            if (sameIssuer && previous !== undefined) {
+                for (const binding of previous.bindings) {
+                    if (binding.verified)
+                        verified.add(binding.bindingKey);
+                }
+            }
+            current = cloneAndFreeze({
+                issuer: trust.issuer,
+                jwks: trust.jwks,
+                trustChanged: trust.trustChanged || (previous !== undefined && !sameIssuer),
+                bindings: projections.map((projection) => ({
+                    bindingKey: projection.bindingKey,
+                    connectorId: projection.connectorId,
+                    ...(projection.operation === undefined ? {} : { operation: projection.operation }),
+                    verified: verified.has(projection.bindingKey),
+                })),
+            });
+        },
+        markVerified(event) {
+            if (current === undefined ||
+                !current.bindings.some((binding) => binding.bindingKey === event.bindingKey)) {
+                return;
+            }
+            current = cloneAndFreeze({
+                ...current,
+                bindings: current.bindings.map((binding) => binding.bindingKey === event.bindingKey ? { ...binding, verified: true } : binding),
+            });
+        },
+    };
+}
+function cloneAndFreeze(value) {
+    return deepFreeze(structuredClone(value));
+}
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null)
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+//# sourceMappingURL=devtools-delegated-exchange-state.js.map

package/dist/devtools-delegated-exchange-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-exchange-state.js","sourceRoot":"","sources":["../src/devtools-delegated-exchange-state.ts"],"names":[],"mappings":"AA4BA,MAAM,UAAU,oCAAoC;IAClD,IAAI,OAAoD,CAAC;IAEzD,OAAO;QACL,QAAQ;YACN,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,WAAW;YACxB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,GAAG,SAAS,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC;YACzB,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;YACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,IAAI,UAAU,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACxC,IAAI,OAAO,CAAC,QAAQ;wBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,cAAc,CAAC;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC;gBAC3E,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBACzC,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;oBAClF,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;iBAC9C,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QACD,YAAY,CAAC,KAAK;YAChB,IACE,OAAO,KAAK,SAAS;gBACrB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,EAC5E,CAAC;gBACD,OAAO;YACT,CAAC;YACD,OAAO,GAAG,cAAc,CAAC;gBACvB,GAAG,OAAO;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CACnF;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAI,KAAQ;IACjC,OAAO,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/devtools-delegated-exchange-ui.d.ts

@@ -0,0 +1,5 @@
+/** Browser-only projection of local delegated-exchange trust and per-binding test progress. */
+export declare const DEVTOOLS_DELEGATED_EXCHANGE_STYLES = "\n.local-delegated-exchange{\n  position:relative;\n  z-index:21;\n  flex:none;\n  margin:0 14px 8px;\n  overflow:hidden;\n  border:1px solid var(--nd-border);\n  border-radius:16px;\n  background:rgba(255,255,255,.025);\n}\n.local-delegated-exchange summary{\n  display:flex;\n  min-height:42px;\n  align-items:center;\n  justify-content:space-between;\n  gap:12px;\n  padding:10px 12px;\n  cursor:pointer;\n  list-style:none;\n}\n.local-delegated-exchange summary::-webkit-details-marker{display:none}\n.local-delegated-exchange__title{display:flex;min-width:0;align-items:center;gap:9px}\n.local-delegated-exchange__title strong{font-size:11.5px;font-weight:640}\n.local-delegated-exchange__summary{color:var(--nd-faint);font-size:10px}\n.local-delegated-exchange__chevron{color:var(--nd-faint);font-size:10px;transition:transform .18s ease}\n.local-delegated-exchange[open] .local-delegated-exchange__chevron{transform:rotate(90deg)}\n.local-delegated-exchange__body{\n  display:grid;\n  grid-template-columns:minmax(0,1fr) minmax(0,1.2fr);\n  gap:12px;\n  padding:2px 12px 12px;\n  border-top:1px solid var(--nd-border);\n}\n.local-delegated-exchange__trust,.local-delegated-exchange__bindings{\n  display:flex;\n  min-width:0;\n  flex-direction:column;\n  gap:8px;\n  padding-top:11px;\n}\n.local-delegated-exchange__label{\n  color:var(--nd-faint);\n  font-size:9px;\n  font-weight:650;\n  letter-spacing:.09em;\n  text-transform:uppercase;\n}\n.local-delegated-exchange pre{\n  max-height:150px;\n  margin:0;\n  padding:9px;\n  overflow:auto;\n  border-radius:10px;\n  background:rgba(0,0,0,.5);\n  color:#d4d4d8;\n  font:10px/1.55 var(--nd-mono);\n  white-space:pre-wrap;\n  word-break:break-all;\n}\n.local-delegated-exchange__warning,\n.local-delegated-exchange__clarification,\n.local-delegated-exchange__rotation{\n  margin:0;\n  color:var(--nd-muted);\n  font-size:10px;\n  line-height:1.5;\n}\n.local-delegated-exchange__warning,.local-delegated-exchange__rotation{color:var(--nd-warning)}\n.local-delegated-exchange__rotation[hidden]{display:none}\n.local-delegated-exchange__copy{align-self:flex-start}\n.local-delegated-exchange__binding{\n  display:grid;\n  grid-template-columns:minmax(0,1fr) auto;\n  gap:5px 10px;\n  padding:8px 9px;\n  border-radius:10px;\n  background:rgba(0,0,0,.28);\n}\n.local-delegated-exchange__binding-name{overflow:hidden;color:#e4e4e7;font:10.5px var(--nd-mono);text-overflow:ellipsis;white-space:nowrap}\n.local-delegated-exchange__binding-key{grid-column:1/-1;overflow:hidden;color:var(--nd-faint);font:9px var(--nd-mono);text-overflow:ellipsis;white-space:nowrap}\n.local-delegated-exchange__state{font-size:9.5px;font-weight:620;white-space:nowrap}\n.local-delegated-exchange__state--required{color:var(--nd-warning)}\n.local-delegated-exchange__state--ready{color:#fdba74}\n.local-delegated-exchange__state--verified{color:var(--nd-success)}\n@media (max-width:760px){\n  .local-delegated-exchange__body{grid-template-columns:1fr}\n}\n@media (prefers-reduced-motion:reduce){\n  .local-delegated-exchange__chevron{transition:none}\n}\n";
+export declare const DEVTOOLS_DELEGATED_EXCHANGE_HTML: string;
+export declare const DEVTOOLS_DELEGATED_EXCHANGE_CLIENT_JS: string;
+//# sourceMappingURL=devtools-delegated-exchange-ui.d.ts.map

package/dist/devtools-delegated-exchange-ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-exchange-ui.d.ts","sourceRoot":"","sources":["../src/devtools-delegated-exchange-ui.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,eAAO,MAAM,kCAAkC,qhGA2F9C,CAAC;AAEF,eAAO,MAAM,gCAAgC,QAkBf,CAAC;AAG/B,eAAO,MAAM,qCAAqC,QAStC,CAAC"}

package/dist/devtools-delegated-exchange-ui.js

@@ -0,0 +1,123 @@
+/** Browser-only projection of local delegated-exchange trust and per-binding test progress. */
+export const DEVTOOLS_DELEGATED_EXCHANGE_STYLES = `
+.local-delegated-exchange{
+  position:relative;
+  z-index:21;
+  flex:none;
+  margin:0 14px 8px;
+  overflow:hidden;
+  border:1px solid var(--nd-border);
+  border-radius:16px;
+  background:rgba(255,255,255,.025);
+}
+.local-delegated-exchange summary{
+  display:flex;
+  min-height:42px;
+  align-items:center;
+  justify-content:space-between;
+  gap:12px;
+  padding:10px 12px;
+  cursor:pointer;
+  list-style:none;
+}
+.local-delegated-exchange summary::-webkit-details-marker{display:none}
+.local-delegated-exchange__title{display:flex;min-width:0;align-items:center;gap:9px}
+.local-delegated-exchange__title strong{font-size:11.5px;font-weight:640}
+.local-delegated-exchange__summary{color:var(--nd-faint);font-size:10px}
+.local-delegated-exchange__chevron{color:var(--nd-faint);font-size:10px;transition:transform .18s ease}
+.local-delegated-exchange[open] .local-delegated-exchange__chevron{transform:rotate(90deg)}
+.local-delegated-exchange__body{
+  display:grid;
+  grid-template-columns:minmax(0,1fr) minmax(0,1.2fr);
+  gap:12px;
+  padding:2px 12px 12px;
+  border-top:1px solid var(--nd-border);
+}
+.local-delegated-exchange__trust,.local-delegated-exchange__bindings{
+  display:flex;
+  min-width:0;
+  flex-direction:column;
+  gap:8px;
+  padding-top:11px;
+}
+.local-delegated-exchange__label{
+  color:var(--nd-faint);
+  font-size:9px;
+  font-weight:650;
+  letter-spacing:.09em;
+  text-transform:uppercase;
+}
+.local-delegated-exchange pre{
+  max-height:150px;
+  margin:0;
+  padding:9px;
+  overflow:auto;
+  border-radius:10px;
+  background:rgba(0,0,0,.5);
+  color:#d4d4d8;
+  font:10px/1.55 var(--nd-mono);
+  white-space:pre-wrap;
+  word-break:break-all;
+}
+.local-delegated-exchange__warning,
+.local-delegated-exchange__clarification,
+.local-delegated-exchange__rotation{
+  margin:0;
+  color:var(--nd-muted);
+  font-size:10px;
+  line-height:1.5;
+}
+.local-delegated-exchange__warning,.local-delegated-exchange__rotation{color:var(--nd-warning)}
+.local-delegated-exchange__rotation[hidden]{display:none}
+.local-delegated-exchange__copy{align-self:flex-start}
+.local-delegated-exchange__binding{
+  display:grid;
+  grid-template-columns:minmax(0,1fr) auto;
+  gap:5px 10px;
+  padding:8px 9px;
+  border-radius:10px;
+  background:rgba(0,0,0,.28);
+}
+.local-delegated-exchange__binding-name{overflow:hidden;color:#e4e4e7;font:10.5px var(--nd-mono);text-overflow:ellipsis;white-space:nowrap}
+.local-delegated-exchange__binding-key{grid-column:1/-1;overflow:hidden;color:var(--nd-faint);font:9px var(--nd-mono);text-overflow:ellipsis;white-space:nowrap}
+.local-delegated-exchange__state{font-size:9.5px;font-weight:620;white-space:nowrap}
+.local-delegated-exchange__state--required{color:var(--nd-warning)}
+.local-delegated-exchange__state--ready{color:#fdba74}
+.local-delegated-exchange__state--verified{color:var(--nd-success)}
+@media (max-width:760px){
+  .local-delegated-exchange__body{grid-template-columns:1fr}
+}
+@media (prefers-reduced-motion:reduce){
+  .local-delegated-exchange__chevron{transition:none}
+}
+`;
+export const DEVTOOLS_DELEGATED_EXCHANGE_HTML = '<details id="local-delegated-exchange" class="local-delegated-exchange">' +
+    '<summary><span class="local-delegated-exchange__title"><span class="status-dot" aria-hidden="true"></span>' +
+    '<strong>Local delegated exchange</strong><span id="local-delegated-exchange-summary" class="local-delegated-exchange__summary" aria-live="polite" aria-atomic="true">Loading status…</span></span>' +
+    '<span class="local-delegated-exchange__chevron" aria-hidden="true">▸</span></summary>' +
+    '<div class="local-delegated-exchange__body">' +
+    '<section class="local-delegated-exchange__trust" aria-label="Development trust">' +
+    '<p class="local-delegated-exchange__warning"><strong>Development only.</strong> Never trust this issuer in production.</p>' +
+    '<p class="local-delegated-exchange__clarification">Your OIDC IdP needs no additional signing-key change.</p>' +
+    '<p id="local-delegated-exchange-rotation" class="local-delegated-exchange__rotation" hidden>Issuer or key changed. Update development endpoint trust before testing again.</p>' +
+    '<span class="local-delegated-exchange__label">Issuer</span><pre id="local-delegated-exchange-issuer"></pre>' +
+    '<span class="local-delegated-exchange__label">Public JWKS</span><pre id="local-delegated-exchange-jwks"></pre>' +
+    '<button id="local-delegated-exchange-copy" class="copy-action local-delegated-exchange__copy" type="button" disabled>' +
+    '<span class="copy-action__label">Copy trust JSON</span></button>' +
+    '</section>' +
+    '<section class="local-delegated-exchange__bindings" aria-label="Delegated bindings">' +
+    '<span class="local-delegated-exchange__label">Bindings</span>' +
+    '<div id="local-delegated-exchange-bindings" aria-live="polite" aria-atomic="true"></div>' +
+    '</section></div></details>';
+// Plain browser script. It receives only the safe projection from the capability-protected parent route.
+export const DEVTOOLS_DELEGATED_EXCHANGE_CLIENT_JS = [
+    'var localDelegatedExchangeSummary=document.getElementById("local-delegated-exchange-summary"); var localDelegatedExchangeIssuer=document.getElementById("local-delegated-exchange-issuer"); var localDelegatedExchangeJwks=document.getElementById("local-delegated-exchange-jwks"); var localDelegatedExchangeBindings=document.getElementById("local-delegated-exchange-bindings"); var localDelegatedExchangeRotation=document.getElementById("local-delegated-exchange-rotation"); var localDelegatedExchangeCopy=document.getElementById("local-delegated-exchange-copy");',
+    'var localDelegatedExchangeStatus=null; var localDelegatedExchangeTrustJson=""; var localDelegatedExchangeFingerprint="";',
+    'function localDelegatedExchangeState(status,binding){ if(!status.customerSignedIn)return {label:"Customer sign-in required",kind:"required"}; if(status.trustChanged||!binding.verified)return {label:"Local assertion ready",kind:"ready"}; return {label:"Exchange verified",kind:"verified"}; }',
+    'function paintLocalDelegatedExchangeStatus(status){ var fingerprint=JSON.stringify([status.issuer,status.jwks,status.customerSignedIn,status.trustChanged,status.bindings]); if(fingerprint===localDelegatedExchangeFingerprint)return; localDelegatedExchangeFingerprint=fingerprint; localDelegatedExchangeStatus=status; localDelegatedExchangeTrustJson=JSON.stringify({issuer:localDelegatedExchangeStatus.issuer,jwks:localDelegatedExchangeStatus.jwks},null,2); localDelegatedExchangeIssuer.textContent=status.issuer; localDelegatedExchangeJwks.textContent=JSON.stringify(status.jwks,null,2); localDelegatedExchangeRotation.hidden=!status.trustChanged; localDelegatedExchangeCopy.disabled=false; while(localDelegatedExchangeBindings.firstChild)localDelegatedExchangeBindings.removeChild(localDelegatedExchangeBindings.firstChild); var verified=0; status.bindings.forEach(function(binding){ var state=localDelegatedExchangeState(status,binding); if(state.kind==="verified")verified+=1; var row=document.createElement("div"); row.className="local-delegated-exchange__binding"; var name=document.createElement("span"); name.className="local-delegated-exchange__binding-name"; name.textContent=binding.connectorId+(binding.operation?" · "+binding.operation:""); var stateView=document.createElement("span"); stateView.className="local-delegated-exchange__state local-delegated-exchange__state--"+state.kind; stateView.textContent=state.label; var key=document.createElement("span"); key.className="local-delegated-exchange__binding-key"; key.textContent=binding.bindingKey; row.appendChild(name); row.appendChild(stateView); row.appendChild(key); localDelegatedExchangeBindings.appendChild(row); }); localDelegatedExchangeSummary.textContent=status.customerSignedIn?verified+" of "+status.bindings.length+" verified":"Customer sign-in required"; }',
+    'function refreshLocalDelegatedExchangeStatus(){ return fetch("/delegated-exchange/status",{headers:{"x-noodle-devtools-capability":RPC_CAPABILITY}}).then(function(r){if(!r.ok)throw new Error("status unavailable");return r.json();}).then(paintLocalDelegatedExchangeStatus).catch(function(){}); }',
+    'localDelegatedExchangeCopy.addEventListener("click",function(){ if(localDelegatedExchangeStatus)copyText(localDelegatedExchangeTrustJson,localDelegatedExchangeCopy,"trust JSON"); });',
+    'refreshLocalDelegatedExchangeStatus();',
+    'setInterval(refreshLocalDelegatedExchangeStatus,2000);',
+].join('\n');
+//# sourceMappingURL=devtools-delegated-exchange-ui.js.map

package/dist/devtools-delegated-exchange-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-delegated-exchange-ui.js","sourceRoot":"","sources":["../src/devtools-delegated-exchange-ui.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2FjD,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,0EAA0E;IAC1E,4GAA4G;IAC5G,oMAAoM;IACpM,uFAAuF;IACvF,8CAA8C;IAC9C,kFAAkF;IAClF,4HAA4H;IAC5H,8GAA8G;IAC9G,gLAAgL;IAChL,6GAA6G;IAC7G,gHAAgH;IAChH,uHAAuH;IACvH,kEAAkE;IAClE,YAAY;IACZ,sFAAsF;IACtF,+DAA+D;IAC/D,0FAA0F;IAC1F,4BAA4B,CAAC;AAE/B,yGAAyG;AACzG,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,ijBAAijB;IACjjB,0HAA0H;IAC1H,oSAAoS;IACpS,+yDAA+yD;IAC/yD,wSAAwS;IACxS,wLAAwL;IACxL,wCAAwC;IACxC,wDAAwD;CACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/devtools-harness.d.ts

@@ -30,5 +30,6 @@ export declare function harnessHtml(options: {
     readonly rpcCapability?: string;
     readonly secureWidgets?: boolean;
     readonly authRequired?: boolean;
+    readonly localDelegatedExchangeRequired?: boolean;
 }): string;
 //# sourceMappingURL=devtools-harness.d.ts.map

package/dist/devtools-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devtools-harness.d.ts","sourceRoot":"","sources":["../src/devtools-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtF;AAgBD,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,MAAM,CA+CT;AAUD,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAMD,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,MAAM,CAgIT"}
+{"version":3,"file":"devtools-harness.d.ts","sourceRoot":"","sources":["../src/devtools-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwBH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtF;AAgBD,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,MAAM,CA+CT;AAUD,+GAA+G;AAC/G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAMD,oCAAoC;AACpC,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;CACnD,GAAG,MAAM,CAuIT"}

package/dist/devtools-harness.js

@@ -8,6 +8,7 @@
  */
 import { DEVTOOLS_AUTH_CLIENT_JS, DEVTOOLS_AUTH_GATE_HTML, DEVTOOLS_AUTH_SESSION_HTML, DEVTOOLS_AUTH_STYLES, } from './devtools-auth-ui.js';
 import { DEVTOOLS_FAVICON_DATA_URI, DEVTOOLS_SHADER_SCRIPT, DEVTOOLS_WORDMARK, } from './devtools-brand.js';
+import { DEVTOOLS_DELEGATED_EXCHANGE_CLIENT_JS, DEVTOOLS_DELEGATED_EXCHANGE_HTML, DEVTOOLS_DELEGATED_EXCHANGE_STYLES, } from './devtools-delegated-exchange-ui.js';
 import { DEVTOOLS_DESIGN_CLIENT_JS, DEVTOOLS_DESIGN_HTML } from './devtools-design.js';
 import { DEVTOOLS_JSON_CLIENT_JS, DEVTOOLS_JSON_STYLES } from './devtools-json.js';
 import { CLAUDE_MARK, GEMINI_MARK, OPENAI_MARK } from './devtools-provider-logos.js';
@@ -111,7 +112,8 @@ export function harnessHtml(options) {
     const client = HARNESS_CLIENT_JS.replace('__INITIAL_THEME__', options.theme === 'dark' ? 'dark' : 'light')
         .replace('__INITIAL_DEVICE__', options.device === 'mobile' ? 'mobile' : 'desktop')
         .replace('__RPC_CAPABILITY__', jsonForScript(options.rpcCapability ?? ''))
-        .replace('__SECURE_WIDGETS__', options.secureWidgets ? 'true' : 'false');
+        .replace('__SECURE_WIDGETS__', options.secureWidgets ? 'true' : 'false')
+        .replace('__LOCAL_DELEGATED_EXCHANGE_REQUIRED__', options.localDelegatedExchangeRequired ? 'true' : 'false');
     const designAttributes = options.secureWidgets
         ? ' disabled aria-disabled="true" title="Design mode is unavailable for authenticated previews"'
         : '';
@@ -124,6 +126,7 @@ export function harnessHtml(options) {
         DEVTOOLS_STYLES +
         DEVTOOLS_JSON_STYLES +
         (options.authRequired ? DEVTOOLS_AUTH_STYLES : '') +
+        (options.localDelegatedExchangeRequired ? DEVTOOLS_DELEGATED_EXCHANGE_STYLES : '') +
         `</style></head><body${bodyClass}>` +
         '<canvas id="ns-canvas" aria-hidden="true"></canvas>' +
         '<div class="ambient-fallback" aria-hidden="true"></div>' +
@@ -150,6 +153,7 @@ export function harnessHtml(options) {
         (options.authRequired ? DEVTOOLS_AUTH_SESSION_HTML : '') +
         '<button id="toggle-activity" class="rail-toggle rail-toggle--activity" type="button" aria-label="Open MCP calls" aria-controls="log" aria-expanded="false">' +
         '<span class="status-dot" aria-hidden="true"></span><span>Activity</span></button></header>' +
+        (options.localDelegatedExchangeRequired ? DEVTOOLS_DELEGATED_EXCHANGE_HTML : '') +
         (options.authRequired ? DEVTOOLS_AUTH_GATE_HTML : '') +
         '<div id="preview-view">' +
         '<div id="controls" class="controls">' +
@@ -226,6 +230,7 @@ export function harnessHtml(options) {
         DEVTOOLS_DESIGN_CLIENT_JS +
         '\n' +
         client +
+        (options.localDelegatedExchangeRequired ? `\n${DEVTOOLS_DELEGATED_EXCHANGE_CLIENT_JS}` : '') +
         (options.authRequired ? `\n${DEVTOOLS_AUTH_CLIENT_JS}` : '') +
         '</script><script>' +
         DEVTOOLS_SHADER_SCRIPT +
@@ -236,7 +241,7 @@ const HARNESS_CLIENT_JS = [
     calculateRangeProgress.toString(),
     isAutoSafeTool.toString(),
     parseWidgetToolCallMessage.toString(),
-    'var RPC_CAPABILITY=__RPC_CAPABILITY__; var SECURE_WIDGETS=__SECURE_WIDGETS__;',
+    'var RPC_CAPABILITY=__RPC_CAPABILITY__; var SECURE_WIDGETS=__SECURE_WIDGETS__; var LOCAL_DELEGATED_EXCHANGE_REQUIRED=__LOCAL_DELEGATED_EXCHANGE_REQUIRED__;',
     'var frame=document.getElementById("frame");',
     'var empty=document.getElementById("empty");',
     'var themeToggle=document.getElementById("theme-toggle");',
@@ -301,7 +306,7 @@ const HARNESS_CLIENT_JS = [
     'function section(label,value){ var w=document.createElement("div"); var h=document.createElement("div"); h.className="log__label"; h.textContent=label; var pre=document.createElement("pre"); renderJson(pre,value); w.appendChild(h); w.appendChild(pre); return w; }',
     'function addLog(e){ var ol=document.getElementById("log-list"); var li=document.createElement("li"); li.className="log log--"+(e.status==="error"?"error":"ok"); var has=(e.request!==undefined||e.response!==undefined); var head=document.createElement(has?"button":"div"); if(has){ head.type="button"; head.setAttribute("aria-expanded","false"); } head.className="log__head"; var chev=document.createElement("span"); chev.className="chev"; chev.textContent=has?"▸":""; var m=document.createElement("span"); m.className="m "+e.status; m.textContent=e.method; var n=document.createElement("span"); n.className="log__sum"; n.textContent=(e.name?e.name+" ":"")+e.summary; var d=document.createElement("span"); d.className="d"; d.textContent=e.durationMs+"ms"; head.appendChild(chev); head.appendChild(m); head.appendChild(n); head.appendChild(d); var detail=document.createElement("div"); detail.className="log__detail"; if(has){ head.addEventListener("click", function(){ var open=li.classList.toggle("open"); head.setAttribute("aria-expanded",open?"true":"false"); chev.textContent=open?"▾":"▸"; if(open&&!detail.dataset.built){ if(e.request!==undefined) detail.appendChild(section("input",e.request)); if(e.response!==undefined) detail.appendChild(section("output",e.response)); detail.dataset.built="1"; } }); } li.appendChild(head); li.appendChild(detail); ol.insertBefore(li, ol.firstChild); }',
     'try{ var es=new EventSource("/rpc/log"); es.onmessage=function(ev){ try{ addLog(JSON.parse(ev.data)); }catch(e){} }; }catch(e){}',
-    'try{ var rs=new EventSource("/reload"); rs.onmessage=function(ev){ if(ev.data==="hard"){window.location.reload();return;} refreshTools(); if(current) loadWidget(current, currentArgs, currentResourceUri); }; }catch(e){}',
+    'try{ var rs=new EventSource("/reload"); rs.onmessage=function(ev){ if(ev.data==="hard"||LOCAL_DELEGATED_EXCHANGE_REQUIRED){window.location.reload();return;} refreshTools(); if(current) loadWidget(current, currentArgs, currentResourceUri); }; }catch(e){}',
     // Preview | Chat | Design mode toggle.
     'var previewView=document.getElementById("preview-view"); var chatView=document.getElementById("chat-view"); var designView=document.getElementById("design-view");',
     'var modePreview=document.getElementById("mode-preview"); var modeChat=document.getElementById("mode-chat"); var modeDesign=document.getElementById("mode-design");',