@noodleseed/one 0.93.0 → 0.95.0

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-refresh.js

@@ -0,0 +1,165 @@
+export function requireFirebaseCaller(request, provider) {
+    const caller = request.caller;
+    if (caller === undefined ||
+        caller.identityKind !== 'customer' ||
+        caller.identityProvider !== provider ||
+        caller.audience === undefined) {
+        throw new Error('delegated credential requires a matching customer caller');
+    }
+    return caller;
+}
+export function requireFirebaseProvider(provider) {
+    if (provider === undefined || provider !== 'firebase') {
+        throw new Error('unsupported delegated credential provider');
+    }
+}
+export function requireMicrosoftDelegatedBinding(binding) {
+    const delegated = binding.delegated;
+    if (delegated?.provider !== 'microsoft' ||
+        delegated.tokenUrl === undefined ||
+        delegated.clientId === undefined) {
+        throw new Error('Microsoft delegated OAuth is not configured');
+    }
+    return delegated;
+}
+export function requireMicrosoftCaller(request) {
+    const caller = request.caller;
+    if (caller === undefined ||
+        caller.identityProvider !== 'microsoft' ||
+        caller.audience === undefined) {
+        throw new Error('delegated Microsoft credential requires a matching Microsoft caller');
+    }
+    return caller;
+}
+export async function fetchFirebaseRefreshToken(input) {
+    const params = new URLSearchParams();
+    params.set('grant_type', 'refresh_token');
+    params.set('refresh_token', input.refreshToken);
+    const response = await input.fetchImpl(`https://securetoken.googleapis.com/v1/token?key=${encodeURIComponent(input.apiKey)}`, {
+        method: 'POST',
+        headers: {
+            accept: 'application/json',
+            'content-type': 'application/x-www-form-urlencoded',
+            'user-agent': 'noodle-borg/0.0',
+        },
+        body: params.toString(),
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`Firebase refresh failed with status ${response.status}`);
+    const json = (await response.json());
+    if (typeof json.id_token !== 'string' || json.id_token.length === 0) {
+        throw new Error('Firebase refresh response did not include id_token');
+    }
+    if (typeof json.refresh_token !== 'string' || json.refresh_token.length === 0) {
+        throw new Error('Firebase refresh response did not include refresh_token');
+    }
+    const expiresIn = typeof json.expires_in === 'string'
+        ? Number.parseInt(json.expires_in, 10)
+        : typeof json.expires_in === 'number'
+            ? json.expires_in
+            : 3600;
+    return {
+        idToken: json.id_token,
+        refreshToken: json.refresh_token,
+        expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600,
+    };
+}
+export async function fetchMicrosoftRefreshToken(input) {
+    const params = new URLSearchParams();
+    params.set('grant_type', 'refresh_token');
+    params.set('refresh_token', input.refreshToken);
+    if (input.scopes !== undefined && input.scopes.length > 0) {
+        params.set('scope', input.scopes.join(' '));
+    }
+    const headers = {
+        accept: 'application/json',
+        'content-type': 'application/x-www-form-urlencoded',
+        'user-agent': 'noodle-borg/0.0',
+    };
+    if (input.authMethod === 'client_secret_basic') {
+        headers.authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString('base64')}`;
+    }
+    else {
+        params.set('client_id', input.clientId);
+        params.set('client_secret', input.clientSecret);
+    }
+    const response = await input.fetchImpl(input.tokenUrl, {
+        method: 'POST',
+        headers,
+        body: params.toString(),
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`Microsoft refresh failed with status ${response.status}`);
+    const json = (await response.json());
+    if (typeof json.access_token !== 'string' || json.access_token.length === 0) {
+        throw new Error('Microsoft refresh response did not include access_token');
+    }
+    const refreshToken = typeof json.refresh_token === 'string' && json.refresh_token.length > 0
+        ? json.refresh_token
+        : undefined;
+    const expiresIn = typeof json.expires_in === 'string'
+        ? Number.parseInt(json.expires_in, 10)
+        : typeof json.expires_in === 'number'
+            ? json.expires_in
+            : 3600;
+    return {
+        accessToken: json.access_token,
+        ...(refreshToken !== undefined ? { refreshToken } : {}),
+        expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600,
+    };
+}
+export async function exchangeFirebaseTokenForSessionCookie(input) {
+    const response = await input.fetchImpl(input.sessionUrl, {
+        method: 'POST',
+        headers: {
+            accept: 'application/json',
+            'content-type': 'application/json',
+            'user-agent': 'noodle-borg/0.0',
+        },
+        body: JSON.stringify({ [input.tokenField]: input.idToken }),
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`delegated session endpoint failed with status ${response.status}`);
+    const cookies = extractSetCookieHeaders(response.headers);
+    const cookie = cookies.map(cookiePair).filter(Boolean).join('; ');
+    if (cookie.length === 0)
+        throw new Error('delegated session endpoint did not return a cookie');
+    const expiresAt = cookieExpiry(cookies, input.now);
+    return {
+        kind: 'cookie',
+        cookie,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+    };
+}
+function extractSetCookieHeaders(headers) {
+    const maybeHeaders = headers;
+    const values = maybeHeaders.getSetCookie?.();
+    if (values !== undefined && values.length > 0)
+        return values;
+    const single = headers.get('set-cookie');
+    return single === null ? [] : [single];
+}
+function cookiePair(setCookie) {
+    return setCookie.split(';', 1)[0]?.trim() ?? '';
+}
+function cookieExpiry(setCookies, now) {
+    const expiries = setCookies
+        .map((value) => maxAgeExpiry(value, now))
+        .filter((value) => value !== undefined);
+    if (expiries.length === 0)
+        return undefined;
+    return Math.min(...expiries);
+}
+function maxAgeExpiry(setCookie, now) {
+    const match = /(?:^|;)\s*max-age=(\d+)/i.exec(setCookie);
+    if (match === null)
+        return undefined;
+    const seconds = Number.parseInt(match[1] ?? '', 10);
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    return now + seconds * 1000;
+}
+//# sourceMappingURL=credential-broker-delegated-refresh.js.map

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-broker-delegated-refresh.js","sourceRoot":"","sources":["../src/credential-broker-delegated-refresh.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,QAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,YAAY,KAAK,UAAU;QAClC,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QACpC,MAAM,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAkF,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA4B;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,gCAAgC,CAC9C,OAAsB;IAEtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,IACE,SAAS,EAAE,QAAQ,KAAK,WAAW;QACnC,SAAS,CAAC,QAAQ,KAAK,SAAS;QAChC,SAAS,CAAC,QAAQ,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAsC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA0B;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,gBAAgB,KAAK,WAAW;QACvC,MAAM,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAkF,CAAC;AAC5F,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAI/C;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CACpC,mDAAmD,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EACrF;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;YACnD,YAAY,EAAE,iBAAiB;SAChC;QACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtC,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,mCAAmC;QACnD,YAAY,EAAE,iBAAiB;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QAC/C,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/G,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtC,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,KAM3D;IACC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,iBAAiB;SAChC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM;QACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,MAAM,YAAY,GAAG,OAAsD,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,UAA6B,EAAE,GAAW;IAC9D,MAAM,QAAQ,GAAG,UAAU;SACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC;AAC9B,CAAC"}

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-token-exchange.d.ts

@@ -0,0 +1,18 @@
+import type { SecretBinding } from '@noodle-borg/connector-defs';
+import { type CredentialRequest, type DownstreamCredential } from '@noodle-borg/runtime';
+import { type DelegatedExchangeOptions } from './delegated-token-exchange.js';
+import type { ConfigScope, ConfigStore } from './store.js';
+export interface DelegatedTokenExchangeBrokerOptions {
+    /** Platform signer/issuer + deployment identity for `delegatedTokenExchange` (ADR 0152). */
+    readonly delegatedExchange?: DelegatedExchangeOptions;
+    readonly fetchImpl?: typeof fetch;
+    readonly now?: () => number;
+}
+export declare class DelegatedTokenExchangeBroker {
+    #private;
+    constructor(store: ConfigStore, scope: ConfigScope, options: DelegatedTokenExchangeBrokerOptions, delegatedCache: Map<string, DownstreamCredential & {
+        expiresAt: number;
+    }>, delegatedInflight: Map<string, Promise<DownstreamCredential>>);
+    getCredential(binding: SecretBinding, request: CredentialRequest): Promise<DownstreamCredential>;
+}
+//# sourceMappingURL=credential-broker-delegated-token-exchange.d.ts.map

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-broker-delegated-token-exchange.d.ts","sourceRoot":"","sources":["../src/credential-broker-delegated-token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,mCAAmC;IAClD,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,4BAA4B;;gBAQrC,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,mCAAmC,EAC5C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EACzE,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IASzD,aAAa,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,oBAAoB,CAAC;CAiGjC"}

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-token-exchange.js

@@ -0,0 +1,112 @@
+import { CredentialUnavailableError, } from '@noodle-borg/runtime';
+import { copyCustomerRouteBinding, routeBoundCredentialKey } from './credential-route-key.js';
+import { fetchDelegatedTokenExchange, requireExchangeCaller, signExchangeAssertion, } from './delegated-token-exchange.js';
+import { resolveManagedVariablesInString } from './managed-config-expressions.js';
+export class DelegatedTokenExchangeBroker {
+    #delegatedCache;
+    #delegatedInflight;
+    #store;
+    #scope;
+    #options;
+    constructor(store, scope, options, delegatedCache, delegatedInflight) {
+        this.#store = store;
+        this.#scope = scope;
+        this.#options = options;
+        this.#delegatedCache = delegatedCache;
+        this.#delegatedInflight = delegatedInflight;
+    }
+    async getCredential(binding, request) {
+        const options = this.#options.delegatedExchange;
+        const declared = binding.tokenExchange;
+        if (options === undefined || declared === undefined) {
+            throw new CredentialUnavailableError('credential_not_configured', {
+                fix: 'Configure delegatedTokenExchange for this connector and deployment.',
+                next: ['noodle auth doctor'],
+            });
+        }
+        const caller = requireExchangeCaller(request);
+        const cacheKey = routeBoundCredentialKey([
+            'tokenExchange',
+            caller.audience,
+            caller.customerIssuer,
+            caller.subject,
+            request.connectorId,
+            request.operation,
+            declared.scopes?.join(' ') ?? '',
+        ].join('\u0000'), request.route);
+        const now = this.#now();
+        const cached = this.#delegatedCache.get(cacheKey);
+        if (cached !== undefined && cached.expiresAt > now) {
+            if (cached.kind === 'cookie')
+                throw new Error('cached delegated credential type mismatch');
+            return { token: cached.token };
+        }
+        const inflight = this.#delegatedInflight.get(cacheKey);
+        if (inflight !== undefined)
+            return inflight;
+        const promise = (async () => {
+            if (binding.secretRef === undefined) {
+                throw new CredentialUnavailableError('credential_not_configured', {
+                    fix: 'Configure the delegated token exchange client secret reference.',
+                    next: ['noodle auth doctor'],
+                });
+            }
+            const secrets = await this.#store.resolveConfigValues('secret', this.#scope);
+            const clientSecret = secrets[binding.secretRef];
+            if (clientSecret === undefined) {
+                throw new CredentialUnavailableError('credential_not_configured', {
+                    fix: 'Set the managed secret required by delegated token exchange.',
+                    next: ['noodle auth doctor'],
+                });
+            }
+            const resolved = await this.#resolveTokenExchangeBinding(declared);
+            const audience = resolved.audience ?? resolved.tokenUrl;
+            const assertion = await signExchangeAssertion({
+                options,
+                caller,
+                audience,
+                nowMs: this.#now(),
+                ...(request.route === undefined ? {} : { route: copyCustomerRouteBinding(request.route) }),
+            });
+            let result;
+            try {
+                result = await fetchDelegatedTokenExchange({
+                    binding: resolved,
+                    clientSecret,
+                    assertion,
+                    fetchImpl: this.#options.fetchImpl ?? fetch,
+                });
+            }
+            catch {
+                throw new CredentialUnavailableError('credential_exchange_failed', {
+                    fix: 'Verify the customer token endpoint, client credentials, audience, and scopes.',
+                    next: ['noodle auth doctor --live'],
+                });
+            }
+            if (result.expiresIn !== undefined) {
+                this.#delegatedCache.set(cacheKey, {
+                    token: result.token,
+                    expiresAt: this.#now() + Math.max(1, result.expiresIn - 300) * 1000,
+                });
+            }
+            return { token: result.token };
+        })().finally(() => this.#delegatedInflight.delete(cacheKey));
+        this.#delegatedInflight.set(cacheKey, promise);
+        return promise;
+    }
+    async #resolveTokenExchangeBinding(declared) {
+        const variables = await this.#store.resolveConfigValues('variable', this.#scope);
+        return {
+            ...declared,
+            tokenUrl: resolveManagedVariablesInString(declared.tokenUrl, variables),
+            clientId: resolveManagedVariablesInString(declared.clientId, variables),
+            ...(declared.audience !== undefined
+                ? { audience: resolveManagedVariablesInString(declared.audience, variables) }
+                : {}),
+        };
+    }
+    #now() {
+        return this.#options.now?.() ?? Date.now();
+    }
+}
+//# sourceMappingURL=credential-broker-delegated-token-exchange.js.map

package/node_modules/@noodle-borg/service/dist/credential-broker-delegated-token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-broker-delegated-token-exchange.js","sourceRoot":"","sources":["../src/credential-broker-delegated-token-exchange.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,0BAA0B,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAEL,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAUlF,MAAM,OAAO,4BAA4B;IAC9B,eAAe,CAA4D;IAC3E,kBAAkB,CAA6C;IAC/D,MAAM,CAAc;IACpB,MAAM,CAAc;IACpB,QAAQ,CAAsC;IAEvD,YACE,KAAkB,EAClB,KAAkB,EAClB,OAA4C,EAC5C,cAAyE,EACzE,iBAA6D;QAE7D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAsB,EACtB,OAA0B;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,EAAE;gBAChE,GAAG,EAAE,qEAAqE;gBAC1E,IAAI,EAAE,CAAC,oBAAoB,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,uBAAuB,CACtC;YACE,eAAe;YACf,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,OAAO;YACd,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,SAAS;YACjB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;SACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAChB,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAmC,EAAE;YACzD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,EAAE;oBAChE,GAAG,EAAE,iEAAiE;oBACtE,IAAI,EAAE,CAAC,oBAAoB,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,EAAE;oBAChE,GAAG,EAAE,8DAA8D;oBACnE,IAAI,EAAE,CAAC,oBAAoB,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC;gBAC5C,OAAO;gBACP,MAAM;gBACN,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;aAC3F,CAAC,CAAC;YACH,IAAI,MAA+D,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,2BAA2B,CAAC;oBACzC,OAAO,EAAE,QAAQ;oBACjB,YAAY;oBACZ,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,0BAA0B,CAAC,4BAA4B,EAAE;oBACjE,GAAG,EAAE,+EAA+E;oBACpF,IAAI,EAAE,CAAC,2BAA2B,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,QAAqD;QAErD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjF,OAAO;YACL,GAAG,QAAQ;YACX,QAAQ,EAAE,+BAA+B,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YACvE,QAAQ,EAAE,+BAA+B,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;YACvE,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,+BAA+B,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/credential-broker.d.ts

@@ -1,31 +1,13 @@
-import type { RuntimeArtifact } from '@noodle-borg/compiler';
 import type { SecretBinding } from '@noodle-borg/connector-defs';
-import { type CredentialBroker, type CredentialRequest, type DelegatedCredentialProbe, type DownstreamCredential } from '@noodle-borg/runtime';
-import { type DelegatedExchangeOptions } from './delegated-token-exchange.js';
-import type { ExternalCredentialExchangeOptions } from './external-credential-exchange.js';
-import { type GoogleWorkloadIdentityOptions } from './google-workload-identity.js';
-import type { OAuthStore } from './oauth/store.js';
-import type { ConfigScope, ConfigStore, SecretEnvelope, TenantAuthConfig } from './store.js';
-export interface ManagedConfigBrokerOptions {
-    readonly artifact?: RuntimeArtifact;
-    readonly delegatedCredentialStore?: Pick<OAuthStore, 'getDelegatedCredential' | 'putDelegatedCredential'>;
-    readonly serverAuth?: TenantAuthConfig;
-    readonly openCustomerCredential?: (credential: SecretEnvelope) => Promise<string>;
-    readonly sealCustomerCredential?: (credential: string) => Promise<SecretEnvelope>;
-    /** Platform signer/issuer + deployment identity for `delegatedTokenExchange` (ADR 0152). */
-    readonly delegatedExchange?: DelegatedExchangeOptions;
-    /** Deployment-owned account credential exchange; distinct from ADR 0152 end-user delegation. */
-    readonly externalCredentialExchange?: ExternalCredentialExchangeOptions;
-    /** Keyless Google WIF exchange using the platform's OIDC issuer and deployment identity. */
-    readonly googleWorkloadIdentity?: GoogleWorkloadIdentityOptions;
-    readonly fetchImpl?: typeof fetch;
-    readonly now?: () => number;
-}
+import { type CredentialBroker, type CredentialProbeRouteResolver, type CredentialRequest, type DelegatedCredentialProbe, type DownstreamCredential } from '@noodle-borg/runtime';
+import type { ManagedConfigBrokerOptions } from './managed-config-broker-options.js';
+import type { ConfigScope, ConfigStore } from './store.js';
+export type { ManagedConfigBrokerOptions } from './managed-config-broker-options.js';
 export declare class ManagedConfigBroker implements CredentialBroker {
     #private;
     constructor(bindings: readonly SecretBinding[], store: ConfigStore, scope: ConfigScope, options?: ManagedConfigBrokerOptions);
     getCredential(request: CredentialRequest): Promise<DownstreamCredential>;
-    probeDelegatedCredentials(caller: NonNullable<CredentialRequest['caller']>): Promise<readonly DelegatedCredentialProbe[]>;
-    probeServiceCredentials(): Promise<readonly DelegatedCredentialProbe[]>;
+    probeDelegatedCredentials(caller: NonNullable<CredentialRequest['caller']>, resolveRoute?: CredentialProbeRouteResolver, customerIssuer?: string): Promise<readonly DelegatedCredentialProbe[]>;
+    probeServiceCredentials(resolveRoute?: CredentialProbeRouteResolver): Promise<readonly DelegatedCredentialProbe[]>;
 }
 //# sourceMappingURL=credential-broker.d.ts.map

package/node_modules/@noodle-borg/service/dist/credential-broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-broker.d.ts","sourceRoot":"","sources":["../src/credential-broker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAGtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAE1B,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EACL,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,IAAI,CACtC,UAAU,EACV,wBAAwB,GAAG,wBAAwB,CACpD,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,gGAAgG;IAChG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;IACxE,4FAA4F;IAC5F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,6BAA6B,CAAC;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,mBAAoB,YAAW,gBAAgB;;gBAexD,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,0BAA+B;IA0BpC,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAkExE,yBAAyB,CAC7B,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAC/C,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;IAUzC,uBAAuB,IAAI,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;CAoX9E"}
+{"version":3,"file":"credential-broker.d.ts","sourceRoot":"","sources":["../src/credential-broker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EAGtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAE1B,MAAM,sBAAsB,CAAC;AA4B9B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAErF,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAErF,qBAAa,mBAAoB,YAAW,gBAAgB;;gBAgBxD,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,0BAA+B;IAiCpC,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoExE,yBAAyB,CAC7B,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAChD,YAAY,CAAC,EAAE,4BAA4B,EAC3C,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;IAYzC,uBAAuB,CAC3B,YAAY,CAAC,EAAE,4BAA4B,GAC1C,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC;CAqShD"}