@oaath/server 0.1.0

package/dist/challenge-AGTmUfj2.js

@@ -0,0 +1,71 @@
+import { b as relayFailure, m as timestamp } from "./records-Bgr-9PUh.js";
+//#region src/clock.ts
+/**
+* Injected clock. Expiry is never read from `Date.now()` directly, so tests and
+* deployments own time.
+*
+* @author taek <leekt216@gmail.com>
+*/
+function relayNow(clock) {
+	let value;
+	try {
+		value = clock.now();
+	} catch {
+		return relayFailure("relay_internal", "injected clock failed");
+	}
+	return timestamp(value, "clock time", "relay_internal");
+}
+//#endregion
+//#region src/authorization/challenge.ts
+/**
+* PKCE S256 challenge verification and the relay's random/digest primitives.
+*
+* Only WebCrypto and base64url are used, so this file stays platform-neutral.
+* The verifier is never stored: the store holds the S256 challenge, and consume
+* recomputes it.
+*
+* @author taek <leekt216@gmail.com>
+*/
+/** RFC 7636 code verifier: 43-128 unreserved characters. */
+const CODE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;
+const IDENTIFIER_BYTES = 32;
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+/** 256 bits of CSPRNG output, base64url encoded. */
+function randomIdentifier() {
+	return base64Url(crypto.getRandomValues(new Uint8Array(IDENTIFIER_BYTES)));
+}
+async function sha256Base64Url(value) {
+	let digest;
+	try {
+		digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+	} catch {
+		return relayFailure("relay_internal", "WebCrypto SHA-256 is unavailable");
+	}
+	return base64Url(new Uint8Array(digest));
+}
+function timingSafeEqualText(left, right) {
+	if (left.length !== right.length) return false;
+	let difference = 0;
+	for (let index = 0; index < left.length; index += 1) difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+	return difference === 0;
+}
+/**
+* True only when `codeVerifier` is a well-formed RFC 7636 verifier whose S256
+* digest equals the stored challenge. Any malformed input is a mismatch.
+*/
+async function verifyPkceS256(codeVerifier, storedCodeChallenge) {
+	if (!CODE_VERIFIER.test(codeVerifier)) return false;
+	return timingSafeEqualText(await sha256Base64Url(codeVerifier), storedCodeChallenge);
+}
+/** True when the value can be a stored S256 challenge (43 base64url characters). */
+function isCodeChallengeS256(value) {
+	return /^[A-Za-z0-9_-]{43}$/u.test(value);
+}
+//#endregion
+export { relayNow as a, verifyPkceS256 as i, randomIdentifier as n, sha256Base64Url as r, isCodeChallengeS256 as t };
+
+//# sourceMappingURL=challenge-AGTmUfj2.js.map

package/dist/challenge-AGTmUfj2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-AGTmUfj2.js","names":[],"sources":["../src/clock.ts","../src/authorization/challenge.ts"],"sourcesContent":["/**\n * Injected clock. Expiry is never read from `Date.now()` directly, so tests and\n * deployments own time.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport { relayFailure } from \"./relay/errors.js\";\nimport { timestamp } from \"./store/records.js\";\n\nexport interface RelayClock {\n  /** Milliseconds since the Unix epoch as a non-negative safe integer. */\n  now(): number;\n}\n\nexport function relayNow(clock: RelayClock): number {\n  let value: unknown;\n  try {\n    value = clock.now();\n  } catch {\n    return relayFailure(\"relay_internal\", \"injected clock failed\");\n  }\n  return timestamp(value, \"clock time\", \"relay_internal\");\n}\n","/**\n * PKCE S256 challenge verification and the relay's random/digest primitives.\n *\n * Only WebCrypto and base64url are used, so this file stays platform-neutral.\n * The verifier is never stored: the store holds the S256 challenge, and consume\n * recomputes it.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport { relayFailure } from \"../relay/errors.js\";\n\n/** RFC 7636 code verifier: 43-128 unreserved characters. */\nconst CODE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;\n\nconst IDENTIFIER_BYTES = 32;\n\nfunction base64Url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\n\n/** 256 bits of CSPRNG output, base64url encoded. */\nexport function randomIdentifier(): string {\n  return base64Url(crypto.getRandomValues(new Uint8Array(IDENTIFIER_BYTES)));\n}\n\nexport async function sha256Base64Url(value: string): Promise<string> {\n  let digest: ArrayBuffer;\n  try {\n    digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  } catch {\n    return relayFailure(\"relay_internal\", \"WebCrypto SHA-256 is unavailable\");\n  }\n  return base64Url(new Uint8Array(digest));\n}\n\nfunction timingSafeEqualText(left: string, right: string): boolean {\n  // Both operands are base64url digests, so length is not itself a secret.\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * True only when `codeVerifier` is a well-formed RFC 7636 verifier whose S256\n * digest equals the stored challenge. Any malformed input is a mismatch.\n */\nexport async function verifyPkceS256(\n  codeVerifier: string,\n  storedCodeChallenge: string,\n): Promise<boolean> {\n  if (!CODE_VERIFIER.test(codeVerifier)) return false;\n  return timingSafeEqualText(await sha256Base64Url(codeVerifier), storedCodeChallenge);\n}\n\n/** True when the value can be a stored S256 challenge (43 base64url characters). */\nexport function isCodeChallengeS256(value: string): boolean {\n  return /^[A-Za-z0-9_-]{43}$/u.test(value);\n}\n"],"mappings":";;;;;;;;AAeA,SAAgB,SAAS,OAA2B;CAClD,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,IAAI;CACpB,QAAQ;EACN,OAAO,aAAa,kBAAkB,uBAAuB;CAC/D;CACA,OAAO,UAAU,OAAO,cAAc,gBAAgB;AACxD;;;;;;;;;;;;;ACVA,MAAM,gBAAgB;AAEtB,MAAM,mBAAmB;AAEzB,SAAS,UAAU,OAA2B;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,EAAE;AAClF;;AAGA,SAAgB,mBAA2B;CACzC,OAAO,UAAU,OAAO,gBAAgB,IAAI,WAAW,gBAAgB,CAAC,CAAC;AAC3E;AAEA,eAAsB,gBAAgB,OAAgC;CACpE,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;CAChF,QAAQ;EACN,OAAO,aAAa,kBAAkB,kCAAkC;CAC1E;CACA,OAAO,UAAU,IAAI,WAAW,MAAM,CAAC;AACzC;AAEA,SAAS,oBAAoB,MAAc,OAAwB;CAEjE,IAAI,KAAK,WAAW,MAAM,QAAQ,OAAO;CACzC,IAAI,aAAa;CACjB,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAChD,cAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;CAE/D,OAAO,eAAe;AACxB;;;;;AAMA,eAAsB,eACpB,cACA,qBACkB;CAClB,IAAI,CAAC,cAAc,KAAK,YAAY,GAAG,OAAO;CAC9C,OAAO,oBAAoB,MAAM,gBAAgB,YAAY,GAAG,mBAAmB;AACrF;;AAGA,SAAgB,oBAAoB,OAAwB;CAC1D,OAAO,uBAAuB,KAAK,KAAK;AAC1C"}

package/dist/decision-dEe9n108.d.ts

@@ -0,0 +1,53 @@
+import { i as RelayClock, n as RelayCaller } from "./authentication-HUYWk5Y2.js";
+import { t as RelayStore } from "./interface-WwvwWs8e.js";
+//#region src/security/kms.d.ts
+/**
+ * Deployment-owned encryption port.
+ *
+ * The relay stores only the opaque reference this port returns. It never sees a
+ * key, and plaintext never reaches the store.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+interface RelayKms {
+  /** Resolves to an opaque bounded string reference for the ciphertext. */
+  encrypt(plaintext: string): Promise<unknown>;
+  /** Resolves to the plaintext for a reference this port previously returned. */
+  decrypt(ciphertextRef: string): Promise<unknown>;
+}
+//#endregion
+//#region src/authorization/decision.d.ts
+type AuthorizationDecisionCommand =
+/** The owner approves and hands over the artifact the client will claim once. */
+Readonly<{
+  outcome: "approved";
+  artifact: string;
+}> | Readonly<{
+  outcome: "rejected";
+}>;
+interface SubmitAuthorizationDecisionInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  readonly kms: RelayKms;
+  /** Authenticated `owner` caller; only the bound subject may decide. */
+  readonly caller: RelayCaller;
+  readonly requestId: string;
+  readonly command: AuthorizationDecisionCommand;
+  readonly codeTtlMs: number;
+}
+type SubmittedAuthorizationDecision = Readonly<{
+  outcome: "approved";
+  decidedAt: number;
+  /** Released exactly once, here. Only its SHA-256 is stored. */
+  code: string;
+  artifactId: string;
+  redirectUri: string;
+  codeExpiresAt: number;
+}> | Readonly<{
+  outcome: "rejected";
+  decidedAt: number;
+}>;
+declare function submitAuthorizationDecision(input: SubmitAuthorizationDecisionInput): Promise<SubmittedAuthorizationDecision>;
+//#endregion
+export { RelayKms as a, submitAuthorizationDecision as i, SubmitAuthorizationDecisionInput as n, SubmittedAuthorizationDecision as r, AuthorizationDecisionCommand as t };
+//# sourceMappingURL=decision-dEe9n108.d.ts.map

package/dist/decision-dEe9n108.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-dEe9n108.d.ts","names":[],"sources":["../src/security/kms.ts","../src/authorization/decision.ts"],"mappings":";;;;;;;;;;;UASiB;;EAEf,QAAQ,oBAAoB;;EAE5B,QAAQ,wBAAwB;;;;KCoCtB;;AAEV;EAAW;EAAqB;KAAsB;EAAW;;UAElD;WACN,OAAO;WACP,OAAO;WACP,KAAK;;WAEL,QAAQ;WACR;WACA,SAAS;WACT;;KAGC,iCACR;EACE;EACA;;EAEA;EACA;EACA;EACA;KAEF;EAAW;EAAqB;;iBAEd,4BACpB,OAAO,mCACN,QAAQ"}

package/dist/index.d.ts

@@ -0,0 +1,335 @@
+import { i as RelayClock, n as RelayCaller, r as RelayCallerRole, t as RelayAuthentication } from "./authentication-HUYWk5Y2.js";
+import { a as AuthorizationDecisionRecord, c as OAATH_AUTHORIZATION_CODE_RECORD_VERSION, d as OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, i as AuthorizationDecisionOutcome, l as OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, n as RelayTransaction, o as AuthorizationRequestRecord, r as AuthorizationCodeRecord, s as EncryptedArtifactRecord, t as RelayStore, u as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION } from "./interface-WwvwWs8e.js";
+import { a as RelayKms, i as submitAuthorizationDecision, n as SubmitAuthorizationDecisionInput, r as SubmittedAuthorizationDecision, t as AuthorizationDecisionCommand } from "./decision-dEe9n108.js";
+//#region src/relay/errors.d.ts
+/**
+ * Closed relay failure codes and their stable HTTP projection.
+ *
+ * Machine decisions and wire responses use these codes only. `Error.message`
+ * exists for local diagnostics and never reaches a response body.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+type RelayErrorCode =
+/** Wire input is missing, malformed, oversized, or contains unknown fields. */
+"relay_request_invalid" |
+/** The deployment authentication port did not authenticate the caller. */
+"relay_unauthenticated" |
+/** Authenticated caller may not act in the required role. */
+"relay_forbidden" |
+/** Route, or a record the caller is entitled to see, does not exist. */
+"relay_not_found" |
+/** Route exists with a different method. */
+"relay_method_not_allowed" |
+/** The authorization request or code is past its injected-clock expiry. */
+"relay_expired" |
+/** The authorization request already reached a terminal decision. */
+"relay_already_decided" |
+/** The one-time authorization code was already consumed. */
+"relay_code_already_consumed" |
+/** The one-time encrypted artifact was already claimed. */
+"relay_artifact_already_claimed" |
+/**
+ * Authorization code redemption failed. One code for every reason it can
+ * fail — unknown code, another client's code, wrong redirect URI, wrong PKCE
+ * verifier — so the endpoint never confirms that a guessed code was correct.
+ * A code that existed is burned.
+ */
+"relay_code_invalid" |
+/** The optional deployment limiter rejected the call. */
+"relay_rate_limited" |
+/** A durable record could not be read as the current schema version. */
+"relay_record_unreadable" |
+/** The KMS port was unavailable or returned an unusable result. */
+"relay_kms_unavailable" |
+/** The store failed before any state change could have been committed. */
+"relay_store_unavailable" |
+/**
+ * The store could not prove whether a transition committed. The caller must
+ * treat the transition as neither applied nor retryable: an ambiguous commit
+ * never authorizes resubmission.
+ */
+"relay_state_ambiguous" |
+/**
+ * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the constructed APNs payload
+ * exceeded Apple's 4096-byte limit, so nothing was sent.
+ */
+"relay_apns_payload_too_large" |
+/**
+ * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the injected Apple credential
+ * capability is not a usable P-256 signing key, key id, team id, or topic.
+ */
+"relay_apns_credentials_invalid" |
+/** A deployment-injected chain execution port failed or answered unusably. */
+"relay_chain_unavailable" |
+/** The Grant's capability is durably invalidated; nothing more executes here. */
+"relay_capability_invalidated" |
+/** An invariant the relay owns was violated. */
+"relay_internal";
+/**
+ * Status projection. `relay_state_ambiguous` is deliberately 500 and not 503,
+ * because 503 invites the retry that an ambiguous commit forbids.
+ */
+declare const RELAY_ERROR_STATUS: Readonly<Record<RelayErrorCode, number>>;
+declare class OaathRelayError extends Error {
+  readonly code: RelayErrorCode;
+  constructor(code: RelayErrorCode, message: string);
+}
+//#endregion
+//#region src/artifact/claim.d.ts
+interface ClaimEncryptedArtifactInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  readonly kms: RelayKms;
+  /** Authenticated `client` caller; only the bound client may claim. */
+  readonly caller: RelayCaller;
+  /** Released only by a successful code consume. */
+  readonly artifactId: string;
+}
+interface ClaimedEncryptedArtifact {
+  readonly requestId: string;
+  readonly artifact: string;
+}
+declare function claimEncryptedArtifact(input: ClaimEncryptedArtifactInput): Promise<ClaimedEncryptedArtifact>;
+//#endregion
+//#region src/artifact/encrypt.d.ts
+/**
+ * Encrypts an approval artifact and returns the opaque reference to store.
+ * A port that echoes plaintext is rejected: the store must never hold it.
+ */
+declare function sealArtifact(kms: RelayKms, plaintext: string): Promise<string>;
+/** Opens a reference this KMS previously sealed. Called only after the claim commits. */
+declare function openArtifact(kms: RelayKms, ciphertextRef: string): Promise<string>;
+//#endregion
+//#region src/authorization/challenge.d.ts
+/**
+ * True only when `codeVerifier` is a well-formed RFC 7636 verifier whose S256
+ * digest equals the stored challenge. Any malformed input is a mismatch.
+ */
+declare function verifyPkceS256(codeVerifier: string, storedCodeChallenge: string): Promise<boolean>;
+/** True when the value can be a stored S256 challenge (43 base64url characters). */
+declare function isCodeChallengeS256(value: string): boolean;
+//#endregion
+//#region src/authorization/code.d.ts
+interface ConsumeAuthorizationCodeInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  /** Authenticated `client` caller; only the bound client may consume. */
+  readonly caller: RelayCaller;
+  readonly code: string;
+  readonly codeVerifier: string;
+  readonly redirectUri: string;
+}
+interface ConsumedAuthorizationCode {
+  readonly requestId: string;
+  /** One-time claim handle for the encrypted artifact. */
+  readonly artifactId: string;
+}
+declare function consumeAuthorizationCode(input: ConsumeAuthorizationCodeInput): Promise<ConsumedAuthorizationCode>;
+//#endregion
+//#region src/authorization/request.d.ts
+interface CreateAuthorizationRequestInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  /** Authenticated `client` caller; it owns `clientId` and `subject`. */
+  readonly caller: RelayCaller;
+  readonly redirectUri: string;
+  readonly codeChallenge: string;
+  readonly requestedScope: string;
+  readonly requestTtlMs: number;
+}
+interface CreatedAuthorizationRequest {
+  readonly requestId: string;
+  readonly expiresAt: number;
+}
+interface AuthorizationState {
+  readonly requestId: string;
+  readonly clientId: string;
+  readonly redirectUri: string;
+  readonly requestedScope: string;
+  readonly expiresAt: number;
+  readonly expired: boolean;
+  readonly decision: Readonly<{
+    outcome: AuthorizationDecisionOutcome;
+    decidedAt: number;
+  }> | null;
+}
+declare function createAuthorizationRequest(input: CreateAuthorizationRequestInput): Promise<CreatedAuthorizationRequest>;
+interface FetchAuthorizationRequestInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  /** Authenticated `owner` caller; only the bound subject may read the request. */
+  readonly caller: RelayCaller;
+  readonly requestId: string;
+}
+/** Read for the approving owner. */
+declare function fetchAuthorizationRequest(input: FetchAuthorizationRequestInput): Promise<AuthorizationState>;
+//#endregion
+//#region src/authorization/resume.d.ts
+interface ResumeAuthorizationInput {
+  readonly store: RelayStore;
+  readonly clock: RelayClock;
+  /** Freshly authenticated `client` caller; only the bound client may resume. */
+  readonly caller: RelayCaller;
+  readonly requestId: string;
+}
+declare function resumeAuthorization(input: ResumeAuthorizationInput): Promise<AuthorizationState>;
+//#endregion
+//#region src/security/rate-limit.d.ts
+/**
+ * Optional deployment-owned limiter port.
+ *
+ * There is no default limiter: an unset port means no limiting, and the relay
+ * never invents a policy the deployment did not choose. A limiter that fails is
+ * treated as `limited`, because an unreadable limiter is not permission.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+interface RelayRateLimitInput {
+  /** Stable route name, never a credential-bearing URL. */
+  readonly route: string;
+  readonly clientId: string | null;
+}
+interface RelayRateLimiter {
+  /** Resolves to `"allowed"` or `"limited"`. Anything else is `limited`. */
+  check(input: RelayRateLimitInput): Promise<unknown>;
+}
+//#endregion
+//#region src/session-signer/kms-provider.d.ts
+interface SessionSignerIdentity {
+  readonly clientId: string;
+  readonly subject: string;
+  readonly deviceId: string;
+}
+interface SessionSignerSignRequest extends SessionSignerIdentity {
+  /** The exact 32-byte hash to sign; never a message to interpret. */
+  readonly hash: `0x${string}`;
+}
+interface RelaySessionSignerProvider {
+  /**
+   * The operator credential for one authenticated identity, creating the key
+   * on first use. Idempotent: the same identity always answers the same
+   * credential.
+   */
+  readonly credential: (request: Readonly<SessionSignerIdentity>) => Promise<unknown>;
+  /** One ECDSA signature over one exact hash, under that identity's key. */
+  readonly sign: (request: Readonly<SessionSignerSignRequest>) => Promise<unknown>;
+}
+declare function createKmsSessionSignerProvider(input: {
+  readonly kms: RelayKms;
+}): RelaySessionSignerProvider;
+//#endregion
+//#region src/relay/handler.d.ts
+/**
+ * One deployment-injected chain execution surface the relay serves to clients.
+ * Each port takes exactly one captured request value and answers with the
+ * evidence it owns; the relay never interprets the payload beyond exact wire
+ * hygiene, so port meaning stays with its SDK owner.
+ */
+interface RelayChainPort {
+  readonly chainId: number;
+  readonly reads: (request: unknown) => Promise<unknown>;
+  readonly observation: (request: unknown) => Promise<unknown>;
+  readonly bundler: (request: unknown) => Promise<unknown>;
+  readonly quote: (request: unknown) => Promise<unknown>;
+  /** Opens, sends, and settles one submission in one call; never retried here. */
+  readonly submission: (request: unknown) => Promise<unknown>;
+  /** Finalized per-grant usage evidence, or null when this chain serves none. */
+  readonly usage: ((request: unknown) => Promise<unknown>) | null;
+  readonly feePayer: Readonly<{
+    address: `0x${string}`;
+    balance: string;
+  }> | null;
+  /** Authenticated commitment to one exact ERC-7902 static paymaster, or null. */
+  readonly staticPaymasterConfigurationHash: `0x${string}` | null;
+}
+/** The identity facts `GET /bootstrap` serves; chains derive from `chains`. */
+interface RelayBootstrapConfiguration {
+  readonly application: unknown;
+  readonly userHandle: string;
+  readonly account: unknown;
+  readonly ownerValidator: `0x${string}` | null;
+}
+/**
+ * Remote session-key custody, declared once for the deployment: the mode and
+ * provider identity are served through the bootstrap document, and the same
+ * provider answers the `/session-signers` routes. For `oaath_hosted` the
+ * provider is typically `createKmsSessionSignerProvider`; for
+ * `application_backend` it is the deployment's own authenticated port to the
+ * integrating application's signer — never a client-supplied endpoint.
+ */
+interface RelaySessionSignerConfiguration {
+  readonly mode: "application_backend" | "oaath_hosted";
+  readonly providerId: string;
+  readonly provider: Readonly<RelaySessionSignerProvider>;
+}
+/** Authenticated identity and one opaque ERC-7677 params tuple. */
+interface RelayPaymasterServiceRequest {
+  readonly caller: Readonly<{
+    clientId: string;
+    subject: string;
+  }>;
+  readonly params: unknown;
+  readonly signal: AbortSignal;
+}
+/**
+ * One deployment-owned paymaster provider. The relay exposes only these two
+ * closed ERC-7677 operations and invokes the selected method once.
+ */
+interface RelayPaymasterServiceProvider {
+  readonly getPaymasterStubData: (request: Readonly<RelayPaymasterServiceRequest>) => Promise<unknown>;
+  readonly getPaymasterData: (request: Readonly<RelayPaymasterServiceRequest>) => Promise<unknown>;
+}
+interface RelayPaymasterServiceConfiguration {
+  readonly chainId: number;
+  readonly providerId: string;
+  /** Hard response deadline; the provider also receives its abort signal. */
+  readonly requestTimeoutMs: number;
+  readonly provider: Readonly<RelayPaymasterServiceProvider>;
+}
+interface RelayHandlerOptions {
+  readonly store: RelayStore;
+  readonly authentication: RelayAuthentication;
+  readonly kms: RelayKms;
+  readonly clock: RelayClock;
+  /** Optional. There is no default limiter. */
+  readonly rateLimit?: RelayRateLimiter;
+  readonly requestTtlMs?: number;
+  readonly codeTtlMs?: number;
+  readonly maxBodyBytes?: number;
+  /** Optional URL-only bootstrap surface; requires `chains` as well. */
+  readonly bootstrap?: Readonly<RelayBootstrapConfiguration>;
+  /** Optional chain execution relays; required when `bootstrap` is served. */
+  readonly chains?: readonly Readonly<RelayChainPort>[];
+  /** Optional remote session-key custody; requires `bootstrap` as well. */
+  readonly sessionSigner?: Readonly<RelaySessionSignerConfiguration>;
+  /**
+   * Optional deployment-owned paymaster services, at most one per chain.
+   * Configuration requires both bootstrap and a deployment rate limiter.
+   */
+  readonly paymasterServices?: readonly Readonly<RelayPaymasterServiceConfiguration>[];
+}
+type RelayHandler = (request: Request) => Promise<Response>;
+declare function createRelayHandler(options: RelayHandlerOptions): RelayHandler;
+//#endregion
+//#region src/security/redact.d.ts
+/**
+ * Bounded credential and URL redaction for diagnostics only.
+ *
+ * Nothing here shapes a response or a machine decision. Its only job is to make
+ * an adopter's log line safe and finite: no authorization code, verifier, token,
+ * artifact, ciphertext, credential-bearing URL, or unbounded provider blob.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+declare const REDACTED = "[redacted]";
+/** Keeps scheme, host, and path. Drops userinfo, query, and fragment. */
+declare function redactUrl(value: unknown): string;
+/** Returns a bounded, credential-free projection safe to hand to a logger. */
+declare function redactForLog(value: unknown): unknown;
+//#endregion
+//#region src/store/memory.d.ts
+declare function createMemoryRelayStore(): RelayStore;
+//#endregion
+export { type AuthorizationCodeRecord, type AuthorizationDecisionCommand, type AuthorizationDecisionOutcome, type AuthorizationDecisionRecord, type AuthorizationRequestRecord, type AuthorizationState, type ClaimEncryptedArtifactInput, type ClaimedEncryptedArtifact, type ConsumeAuthorizationCodeInput, type ConsumedAuthorizationCode, type CreateAuthorizationRequestInput, type CreatedAuthorizationRequest, type EncryptedArtifactRecord, type FetchAuthorizationRequestInput, OAATH_AUTHORIZATION_CODE_RECORD_VERSION, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, OaathRelayError, REDACTED, RELAY_ERROR_STATUS, type RelayAuthentication, type RelayCaller, type RelayCallerRole, type RelayClock, type RelayErrorCode, type RelayHandler, type RelayHandlerOptions, type RelayKms, type RelayPaymasterServiceConfiguration, type RelayPaymasterServiceProvider, type RelayPaymasterServiceRequest, type RelayRateLimitInput, type RelayRateLimiter, type RelaySessionSignerConfiguration, type RelaySessionSignerProvider, type RelayStore, type RelayTransaction, type ResumeAuthorizationInput, type SessionSignerIdentity, type SessionSignerSignRequest, type SubmitAuthorizationDecisionInput, type SubmittedAuthorizationDecision, claimEncryptedArtifact, consumeAuthorizationCode, createAuthorizationRequest, createKmsSessionSignerProvider, createMemoryRelayStore, createRelayHandler, fetchAuthorizationRequest, isCodeChallengeS256, openArtifact, redactForLog, redactUrl, resumeAuthorization, sealArtifact, submitAuthorizationDecision, verifyPkceS256 };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/relay/errors.ts","../src/artifact/claim.ts","../src/artifact/encrypt.ts","../src/authorization/challenge.ts","../src/authorization/code.ts","../src/authorization/request.ts","../src/authorization/resume.ts","../src/security/rate-limit.ts","../src/session-signer/kms-provider.ts","../src/relay/handler.ts","../src/security/redact.ts","../src/store/memory.ts"],"mappings":";;;;;;;;;;;;KASY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6DC,oBAAoB,SAAS,OAAO;cAyBpC,wBAAwB;WAC1B,MAAM;EAEf,YAAY,MAAM,gBAAgB;;;;UC1EnB;WACN,OAAO;WACP,OAAO;WACP,KAAK;;WAEL,QAAQ;;WAER;;UAGM;WACN;WACA;;iBAGW,uBACpB,OAAO,8BACN,QAAQ;;;;;;;iBCzBW,aAAa,KAAK,UAAU,oBAAoB;;iBAoBhD,aAAa,KAAK,UAAU,wBAAwB;;;;;;;iBCgBpD,eACpB,sBACA,8BACC;;iBAMa,oBAAoB;;;UChCnB;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;WACA;WACA;;UAGM;WACN;;WAEA;;iBAOW,yBACpB,OAAO,gCACN,QAAQ;;;UC9BM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;WACA;WACA;WACA;;UAGM;WACN;WACA;;UAGM;WACN;WACA;WACA;WACA;WACA;WACA;WACA,UAAU;IACjB,SAAS;IACT;;;iBAIkB,2BACpB,OAAO,kCACN,QAAQ;UA8DM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;;iBAIK,0BACd,OAAO,iCACN,QAAQ;;;UC7GM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;iBAGK,oBAAoB,OAAO,2BAA2B,QAAQ;;;;;;;;;;;;UCZ7D;;WAEN;WACA;;UAGM;;EAEf,MAAM,OAAO,sBAAsB;;;;UCWpB;WACN;WACA;WACA;;UAGM,iCAAiC;;WAEvC;;UAGM;;;;;;WAMN,aAAa,SAAS,SAAS,2BAA2B;;WAE1D,OAAO,SAAS,SAAS,8BAA8B;;iBAkBlD,+BAA+B;WACpC,KAAK;IACZ;;;;;;;;;UC6Ba;WACN;WACA,QAAQ,qBAAqB;WAC7B,cAAc,qBAAqB;WACnC,UAAU,qBAAqB;WAC/B,QAAQ,qBAAqB;;WAE7B,aAAa,qBAAqB;;WAElC,SAAS,qBAAqB;WAC9B,UAAU;IAAW;IAAwB;;;WAE7C;;;UAIM;WACN;WACA;WACA;WACA;;;;;;;;;;UAWM;WACN;WACA;WACA,UAAU,SAAS;;;UAIb;WACN,QAAQ;IAAW;IAAkB;;WACrC;WACA,QAAQ;;;;;;UAOF;WACN,uBACP,SAAS,SAAS,kCACf;WACI,mBAAmB,SAAS,SAAS,kCAAkC;;UAGjE;WACN;WACA;;WAEA;WACA,UAAU,SAAS;;UAGb;WACN,OAAO;WACP,gBAAgB;WAChB,KAAK;WACL,OAAO;;WAEP,YAAY;WACZ;WACA;WACA;;WAEA,YAAY,SAAS;;WAErB,kBAAkB,SAAS;;WAE3B,gBAAgB,SAAS;;;;;WAKzB,6BAA6B,SAAS;;KAGrC,gBAAgB,SAAS,YAAY,QAAQ;iBAoazC,mBAAmB,SAAS,sBAAsB;;;;;;;;;;;;cCnlBrD;;iBAiDG,UAAU;;iBA+DV,aAAa;;;iBCnDb,0BAA0B"}