@originator-profile/ca-client 0.0.0 → 0.7.0-beta.4

package/dist/index.js

@@ -0,0 +1,723 @@
+import { UnsignedContentAttestation, ContentAttestationSet } from '@originator-profile/model';
+import { fetchAndSetDigestSri, fetchAndSetTargetIntegrity, createIntegrity } from '@originator-profile/sign';
+import { JSDOM } from 'jsdom';
+import { mkdir, writeFile, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+
+const CaClientErrorCode = {
+  Config: "CA_CONFIG",
+  Validation: "CA_VALIDATION",
+  Http: "CA_HTTP",
+  Response: "CA_RESPONSE",
+  File: "CA_FILE"
+};
+class CaClientError extends Error {
+  code;
+  status;
+  constructor(message, options) {
+    super(message, { cause: options.cause });
+    this.name = "CaClientError";
+    this.code = options.code;
+    this.status = options.status;
+  }
+}
+const isUnauthorized = (error) => error instanceof CaClientError && error.code === CaClientErrorCode.Http && error.status === 401;
+
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+
+const requireConfigString = (value, field, hint = "") => {
+  if (typeof value !== "string" || value === "") {
+    throw new CaClientError(`CCSP auth failed: ${field} is required${hint}`, {
+      code: CaClientErrorCode.Config
+    });
+  }
+  return value;
+};
+const parseConfigRecord = (decoded) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(decoded);
+  } catch (error) {
+    throw new CaClientError("CCSP auth failed: failed to parse config", {
+      code: CaClientErrorCode.Config,
+      cause: error
+    });
+  }
+  if (!isRecord(parsed)) {
+    throw new CaClientError("CCSP auth failed: failed to parse config", {
+      code: CaClientErrorCode.Config
+    });
+  }
+  return parsed;
+};
+const parseCcspConfig = (base64Config) => {
+  const parsed = parseConfigRecord(
+    Buffer.from(base64Config.replace(/^CCSP:/, ""), "base64").toString("utf-8")
+  );
+  const authType = requireConfigString(parsed.authType, "authType");
+  if (authType !== "client_secret_post") {
+    throw new CaClientError(
+      `CCSP auth failed: unsupported auth type "${authType}" (only "client_secret_post" is supported)`,
+      { code: CaClientErrorCode.Config }
+    );
+  }
+  const config = {
+    authType,
+    clientId: requireConfigString(parsed.clientId, "clientId"),
+    clientSec: requireConfigString(
+      parsed.clientSec,
+      "clientSec",
+      " (OAuth client_secret)"
+    ),
+    tokenUrl: requireConfigString(parsed.tokenUrl, "tokenUrl")
+  };
+  if (!URL.canParse(config.tokenUrl)) {
+    throw new CaClientError("CCSP auth failed: tokenUrl is not a valid URL", {
+      code: CaClientErrorCode.Config
+    });
+  }
+  return config;
+};
+const parseTokenResponse = (data) => {
+  if (!isRecord(data) || typeof data.access_token !== "string" || data.access_token === "") {
+    throw new CaClientError(
+      "CCSP auth failed: response is missing access_token",
+      { code: CaClientErrorCode.Response }
+    );
+  }
+  const token = { access_token: data.access_token };
+  if (typeof data.token_type === "string") {
+    token.token_type = data.token_type;
+  }
+  if (typeof data.expires_in === "number") {
+    token.expires_in = data.expires_in;
+  }
+  if (typeof data.scope === "string") {
+    token.scope = data.scope;
+  }
+  return token;
+};
+const getCcspAccessToken = async (config, fetchOps = { fetch }) => {
+  const formData = new URLSearchParams();
+  formData.append("grant_type", "client_credentials");
+  formData.append("client_id", config.clientId);
+  formData.append("client_secret", config.clientSec);
+  let response;
+  try {
+    response = await fetchOps.fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: formData.toString()
+    });
+  } catch (error) {
+    throw new CaClientError(
+      `CCSP auth failed: ${error instanceof Error ? error.message : String(error)}`,
+      { code: CaClientErrorCode.Http, cause: error }
+    );
+  }
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new CaClientError(
+      `CCSP auth failed: ${response.status} ${response.statusText}: ${errorText}`,
+      { code: CaClientErrorCode.Http, status: response.status }
+    );
+  }
+  return parseTokenResponse(await response.json());
+};
+
+const decodeJwtPayload = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new CaClientError(
+      `Invalid JWT: expected 3 parts, got ${parts.length}`,
+      { code: CaClientErrorCode.Validation }
+    );
+  }
+  const [, payload] = parts;
+  if (!payload) {
+    throw new CaClientError("Invalid JWT: empty payload", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  let parsed;
+  try {
+    const decoded = Buffer.from(payload, "base64url").toString("utf-8");
+    parsed = JSON.parse(decoded);
+  } catch (error) {
+    throw new CaClientError("Failed to decode JWT payload", {
+      code: CaClientErrorCode.Validation,
+      cause: error
+    });
+  }
+  if (!isRecord(parsed)) {
+    throw new CaClientError("Failed to decode JWT payload", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  return parsed;
+};
+const getJwtExpiration = (token) => {
+  try {
+    const payload = decodeJwtPayload(token);
+    const exp = payload.exp;
+    if (typeof exp === "number") {
+      return exp;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+};
+
+const DEFAULT_TTL_SECONDS = 3600;
+const resolveExpiresAt = (response, now) => {
+  if (typeof response.expires_in === "number" && response.expires_in > 0) {
+    return now + response.expires_in;
+  }
+  const jwtExp = getJwtExpiration(response.access_token);
+  if (jwtExp && jwtExp > 0) {
+    return jwtExp;
+  }
+  return now + DEFAULT_TTL_SECONDS;
+};
+const resolveBufferSeconds = (ttlSeconds, configuredBufferSeconds) => Math.min(configuredBufferSeconds, Math.max(0, Math.floor(ttlSeconds / 2)));
+const defaultTokenOperations = {
+  getCcspAccessToken,
+  now: () => Math.floor(Date.now() / 1e3)
+};
+class TokenManager {
+  cachedToken = null;
+  refreshPromise = null;
+  config;
+  bufferSeconds;
+  tokenOps;
+  constructor(config, bufferSeconds = 300, tokenOps = defaultTokenOperations) {
+    this.config = config;
+    this.bufferSeconds = bufferSeconds;
+    this.tokenOps = tokenOps;
+  }
+  async getAccessToken() {
+    if (this.refreshPromise) {
+      return await this.refreshPromise;
+    }
+    if (this.cachedToken && this.isTokenValid()) {
+      return this.cachedToken.accessToken;
+    }
+    return await this.refreshToken();
+  }
+  async refreshToken() {
+    if (this.refreshPromise) {
+      return await this.refreshPromise;
+    }
+    this.refreshPromise = (async () => {
+      try {
+        const response = await this.tokenOps.getCcspAccessToken(this.config);
+        const now = this.tokenOps.now();
+        const expiresAt = resolveExpiresAt(response, now);
+        this.cachedToken = {
+          accessToken: response.access_token,
+          expiresAt,
+          bufferSeconds: resolveBufferSeconds(
+            expiresAt - now,
+            this.bufferSeconds
+          )
+        };
+        return response.access_token;
+      } finally {
+        this.refreshPromise = null;
+      }
+    })();
+    return await this.refreshPromise;
+  }
+  clearCache() {
+    this.cachedToken = null;
+    this.refreshPromise = null;
+  }
+  isTokenValid() {
+    if (!this.cachedToken) {
+      return false;
+    }
+    return this.cachedToken.expiresAt > this.tokenOps.now() + this.cachedToken.bufferSeconds;
+  }
+}
+const createTokenManager = (ccspConfig, bufferSeconds) => new TokenManager(parseCcspConfig(ccspConfig), bufferSeconds);
+
+const JWT_PAYLOAD_CONTENT_ATTESTATION_KEYS = [
+  "@context",
+  "type",
+  "issuer",
+  "credentialSubject",
+  "allowedUrl",
+  "target"
+];
+const assertJwtPayloadHasContentAttestationKeys = (payload, source) => {
+  const missingKeys = JWT_PAYLOAD_CONTENT_ATTESTATION_KEYS.filter(
+    (key) => payload[key] === void 0 || payload[key] === null
+  );
+  if (missingKeys.length > 0) {
+    throw new CaClientError(
+      `Invalid Content Attestation: missing required keys in ${source}: ${missingKeys.join(", ")}`,
+      { code: CaClientErrorCode.Validation }
+    );
+  }
+};
+const jwtPayloadToUnsignedCa = (payload, source, options) => {
+  assertJwtPayloadHasContentAttestationKeys(payload, source);
+  const issuer = options?.issuer !== void 0 ? options.issuer : payload.issuer;
+  const parsed = UnsignedContentAttestation.safeParse({
+    "@context": payload["@context"],
+    type: payload.type,
+    issuer,
+    credentialSubject: payload.credentialSubject,
+    allowedUrl: payload.allowedUrl,
+    target: payload.target
+  });
+  if (!parsed.success) {
+    throw new CaClientError(
+      `Invalid Content Attestation: invalid payload in ${source}: ${parsed.error.message}`,
+      { code: CaClientErrorCode.Validation, cause: parsed.error }
+    );
+  }
+  return parsed.data;
+};
+
+function parseDates({
+  issuedAt: issuedAtDateOrString = /* @__PURE__ */ new Date(),
+  expiredAt: expiredAtDateOrString
+} = {}) {
+  const issuedAt = new Date(issuedAtDateOrString);
+  const expiredAt = expiredAtDateOrString ? new Date(expiredAtDateOrString) : (() => {
+    const next = new Date(issuedAt);
+    next.setUTCFullYear(next.getUTCFullYear() + 1);
+    return next;
+  })();
+  if (Number.isNaN(issuedAt.getTime())) {
+    throw new CaClientError("issuedAt must be a valid date", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  if (Number.isNaN(expiredAt.getTime())) {
+    throw new CaClientError("expiredAt must be a valid date", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  if (expiredAt.getTime() <= issuedAt.getTime()) {
+    throw new CaClientError("expiredAt must be after issuedAt", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  return { issuedAt, expiredAt };
+}
+const toUnixTime = (date) => Math.floor(date.getTime() / 1e3);
+
+async function fetchDocument(url, fetchOps) {
+  let res;
+  try {
+    res = await fetchOps.fetch(url);
+  } catch (error) {
+    throw new CaClientError(
+      `Failed to fetch document: ${error instanceof Error ? error.message : String(error)}`,
+      { code: CaClientErrorCode.Http, cause: error }
+    );
+  }
+  if (!res.ok) {
+    throw new CaClientError(
+      `Failed to fetch document: ${res.status} ${res.statusText}`,
+      { code: CaClientErrorCode.Http, status: res.status }
+    );
+  }
+  return await res.text();
+}
+async function documentProvider({ type, content = "" }, fetchOps = { fetch }) {
+  if (type === "ExternalResourceTargetIntegrity") {
+    throw new CaClientError(
+      "Invalid Content Attestation: ExternalResourceTargetIntegrity is not supported",
+      { code: CaClientErrorCode.Validation }
+    );
+  }
+  if (Array.isArray(content) && content.length > 1) {
+    throw new CaClientError(
+      "Invalid Content Attestation: multiple contents are not supported",
+      { code: CaClientErrorCode.Validation }
+    );
+  }
+  const flatContent = Array.isArray(content) ? content[0] ?? "" : content;
+  let url;
+  let html;
+  if (URL.canParse(flatContent)) {
+    url = flatContent;
+    html = await fetchDocument(url, fetchOps);
+  } else {
+    url = void 0;
+    html = flatContent;
+  }
+  const dom = new JSDOM(html, {
+    url
+  });
+  return dom.window.document;
+}
+
+function jwtFromCaResponse(body) {
+  const responseBody = body.trim();
+  if (responseBody === "") {
+    throw new CaClientError("CA signing failed: empty response", {
+      code: CaClientErrorCode.Response
+    });
+  }
+  let result;
+  try {
+    result = JSON.parse(responseBody);
+  } catch {
+    return responseBody;
+  }
+  if (typeof result === "string") {
+    return result;
+  }
+  if (Array.isArray(result) && typeof result[0] === "string") {
+    return result[0];
+  }
+  throw new CaClientError("CA signing failed: response did not contain a JWT", {
+    code: CaClientErrorCode.Response
+  });
+}
+async function signByCaServer(uca, {
+  endpoint,
+  accessToken,
+  documentProvider: documentProvider$1,
+  fetchOps = { fetch },
+  ...timingOptions
+}) {
+  const { issuedAt, expiredAt } = parseDates(timingOptions);
+  const resolveDocument = documentProvider$1 ?? ((raw) => documentProvider(raw, fetchOps));
+  let payload;
+  try {
+    payload = UnsignedContentAttestation.parse(structuredClone(uca));
+    await Promise.all([
+      fetchAndSetDigestSri("sha256", payload.credentialSubject.image),
+      fetchAndSetTargetIntegrity("sha256", payload, resolveDocument)
+    ]);
+  } catch (error) {
+    if (error instanceof CaClientError) {
+      throw error;
+    }
+    throw new CaClientError(
+      `Invalid Content Attestation: ${error instanceof Error ? error.message : String(error)}`,
+      { code: CaClientErrorCode.Validation, cause: error }
+    );
+  }
+  const subjectId = payload.credentialSubject.id;
+  let response;
+  try {
+    response = await fetchOps.fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`
+      },
+      body: JSON.stringify({
+        ...payload,
+        iss: payload.issuer,
+        ...subjectId !== void 0 ? { sub: subjectId } : {},
+        iat: toUnixTime(issuedAt),
+        exp: toUnixTime(expiredAt),
+        issuedAt: issuedAt.toISOString(),
+        expiredAt: expiredAt.toISOString()
+      })
+    });
+  } catch (error) {
+    throw new CaClientError(
+      `CA signing failed: ${error instanceof Error ? error.message : String(error)}`,
+      { code: CaClientErrorCode.Http, cause: error }
+    );
+  }
+  if (!response.ok) {
+    const responseBody = await response.text();
+    throw new CaClientError(
+      `CA signing failed: ${response.status} ${response.statusText}: ${responseBody}`,
+      { code: CaClientErrorCode.Http, status: response.status }
+    );
+  }
+  return jwtFromCaResponse(await response.text());
+}
+
+const serverSignOptions = (endpoint, tokens) => ({
+  endpoint,
+  getAccessToken: () => tokens.getAccessToken(),
+  refreshAccessToken: () => tokens.refreshToken()
+});
+const signByServer = async (uca, options) => {
+  const {
+    getAccessToken,
+    refreshAccessToken,
+    sign = signByCaServer,
+    ...signOptions
+  } = options;
+  const accessToken = await getAccessToken();
+  try {
+    return await sign(uca, {
+      ...signOptions,
+      accessToken
+    });
+  } catch (error) {
+    if (refreshAccessToken && isUnauthorized(error)) {
+      return await sign(uca, {
+        ...signOptions,
+        accessToken: await refreshAccessToken()
+      });
+    }
+    throw error;
+  }
+};
+
+const reSign = async (jwtPayload, options) => {
+  const { source, issuer, ...signOptions } = options;
+  const uca = jwtPayloadToUnsignedCa(jwtPayload, source, { issuer });
+  return signByServer(uca, signOptions);
+};
+
+const createCaClient = (config, options) => {
+  const tokenManager = createTokenManager(
+    config.ccspConfig,
+    config.tokenBufferSeconds
+  );
+  const signOptions = {
+    ...serverSignOptions(config.endpoint, tokenManager),
+    ...options?.sign ? { sign: options.sign } : {}
+  };
+  return {
+    config,
+    sign: (uca) => signByServer(uca, signOptions),
+    reSign: (jwtPayload, source) => reSign(jwtPayload, {
+      source,
+      issuer: config.issuer,
+      ...signOptions
+    })
+  };
+};
+
+const isEnoent = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+const toFileError = (message, error) => {
+  if (error instanceof CaClientError) {
+    return error;
+  }
+  return new CaClientError(
+    `${message}: ${error instanceof Error ? error.message : String(error)}`,
+    { code: CaClientErrorCode.File, cause: error }
+  );
+};
+
+const isEmpty = (value) => value.trim() === "";
+const resolveCasFilePath = (filePath) => {
+  if (isEmpty(filePath)) {
+    throw new CaClientError("filePath must be a non-empty string", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  return resolve(filePath);
+};
+const writeCasFile = async ({
+  filePath,
+  jwt
+}) => {
+  if (isEmpty(jwt)) {
+    throw new CaClientError("jwt must be a non-empty string", {
+      code: CaClientErrorCode.Validation
+    });
+  }
+  const dest = resolveCasFilePath(filePath);
+  const casContent = `${JSON.stringify([jwt], null, 2)}
+`;
+  try {
+    await mkdir(dirname(dest), { recursive: true });
+    await writeFile(dest, casContent, "utf8");
+  } catch (error) {
+    throw toFileError(`Failed to write CAS file ${dest}`, error);
+  }
+};
+
+const DEFAULT_EXTERNAL_SELECTOR = ".target-integrity";
+const uniqueSelectors = (selectors) => [
+  ...new Set((selectors ?? []).filter((selector) => selector.length > 0))
+];
+const toExtractedTarget = (type, integrity, cssSelector) => cssSelector === void 0 ? { type, integrity } : { type, integrity, cssSelector };
+const extractExternalTargetIntegrities = (document, cssSelector = DEFAULT_EXTERNAL_SELECTOR) => {
+  const targets = [];
+  for (const element of document.querySelectorAll(cssSelector)) {
+    const integrity = element.getAttribute("integrity");
+    if (integrity && /^sha(256|384|512)-/.test(integrity)) {
+      targets.push({
+        type: "ExternalResourceTargetIntegrity",
+        integrity
+      });
+    }
+  }
+  return targets;
+};
+const extractDomTargets = async (document, type, selectors) => {
+  const extracted = await Promise.all(
+    uniqueSelectors(selectors).map(async (cssSelector) => {
+      const target = await createIntegrity(
+        "sha256",
+        { type, cssSelector },
+        document
+      );
+      if (!target?.integrity) {
+        return void 0;
+      }
+      return toExtractedTarget(target.type, target.integrity, cssSelector);
+    })
+  );
+  return extracted.filter((target) => target !== void 0);
+};
+const extractTargetsFromHtml = async (htmlContent, options = {}) => {
+  const document = new JSDOM(htmlContent).window.document;
+  const [textTargets, htmlTargets, visibleTextTargets] = await Promise.all([
+    extractDomTargets(document, "TextTargetIntegrity", options.textSelectors),
+    extractDomTargets(document, "HtmlTargetIntegrity", options.htmlSelectors),
+    extractDomTargets(
+      document,
+      "VisibleTextTargetIntegrity",
+      options.visibleTextSelectors
+    )
+  ]);
+  return [
+    ...textTargets,
+    ...htmlTargets,
+    ...visibleTextTargets,
+    ...extractExternalTargetIntegrities(document, options.externalSelector)
+  ];
+};
+
+const INVALID_CAS_FORMAT = "Invalid CAS file format (expected JSON array with JWT string)";
+const jwtFromCasItem = (item) => {
+  if (typeof item === "string") {
+    return item;
+  }
+  if (isRecord(item) && typeof item.attestation === "string") {
+    return item.attestation;
+  }
+  return void 0;
+};
+const isCasTarget = (value) => isRecord(value) && typeof value.type === "string" && typeof value.integrity === "string";
+const normalizeTargets = (targets) => {
+  if (!Array.isArray(targets)) {
+    return [];
+  }
+  return targets.filter(isCasTarget).map(
+    (target) => typeof target.cssSelector === "string" ? {
+      type: target.type,
+      integrity: target.integrity,
+      cssSelector: target.cssSelector
+    } : { type: target.type, integrity: target.integrity }
+  ).sort((a, b) => {
+    const left = `${a.type}\0${a.cssSelector ?? ""}\0${a.integrity}`;
+    const right = `${b.type}\0${b.cssSelector ?? ""}\0${b.integrity}`;
+    return left.localeCompare(right);
+  });
+};
+const areTargetsEqual = (currentTargets, casTargets) => {
+  if (currentTargets.length !== casTargets.length) {
+    return false;
+  }
+  return currentTargets.every((target, index) => {
+    const casTarget = casTargets[index];
+    const cssSelectorEqual = casTarget?.cssSelector === void 0 || target.cssSelector === casTarget.cssSelector;
+    return target.type === casTarget?.type && target.integrity === casTarget?.integrity && cssSelectorEqual;
+  });
+};
+const parseCasTargets = (casFileContent) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(casFileContent);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, reason: detail };
+  }
+  const cas = ContentAttestationSet.safeParse(parsed);
+  if (!cas.success) {
+    return { ok: false, reason: INVALID_CAS_FORMAT };
+  }
+  const jwt = jwtFromCasItem(cas.data[0]);
+  if (!jwt) {
+    return { ok: false, reason: INVALID_CAS_FORMAT };
+  }
+  try {
+    const payload = decodeJwtPayload(jwt);
+    return { ok: true, targets: normalizeTargets(payload.target) };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, reason: detail };
+  }
+};
+const selectorsForType = (casTargets, type, fallback) => {
+  const fromCas = [
+    ...new Set(
+      casTargets.flatMap(
+        (target) => target.type === type && typeof target.cssSelector === "string" ? [target.cssSelector] : []
+      )
+    )
+  ];
+  if (fromCas.length > 0) {
+    return fromCas;
+  }
+  return fallback && fallback.length > 0 ? [fallback] : [];
+};
+const extractOptionsFromCas = (casTargets, options) => ({
+  textSelectors: selectorsForType(
+    casTargets,
+    "TextTargetIntegrity",
+    options.textSelector
+  ),
+  htmlSelectors: selectorsForType(
+    casTargets,
+    "HtmlTargetIntegrity",
+    options.htmlSelector
+  ),
+  visibleTextSelectors: selectorsForType(
+    casTargets,
+    "VisibleTextTargetIntegrity",
+    options.visibleTextSelector
+  ),
+  externalSelector: options.externalSelector ?? casTargets.find(
+    (target) => target.type === "ExternalResourceTargetIntegrity"
+  )?.cssSelector ?? DEFAULT_EXTERNAL_SELECTOR
+});
+const detectDrift = async (options) => {
+  const dest = resolveCasFilePath(options.filePath);
+  let casFileContent;
+  try {
+    casFileContent = await readFile(dest, "utf8");
+  } catch (error) {
+    if (isEnoent(error)) {
+      return { status: "cas_missing", casFilePath: dest };
+    }
+    throw toFileError(`Failed to read CAS file ${dest}`, error);
+  }
+  const casRead = parseCasTargets(casFileContent);
+  if (!casRead.ok) {
+    return { status: "cas_invalid", casFilePath: dest, reason: casRead.reason };
+  }
+  const casTargets = casRead.targets;
+  const currentTargets = normalizeTargets(
+    await extractTargetsFromHtml(
+      options.html,
+      extractOptionsFromCas(casTargets, options)
+    )
+  );
+  if (currentTargets.length === 0) {
+    return { status: "html_no_targets", casFilePath: dest };
+  }
+  if (!areTargetsEqual(currentTargets, casTargets)) {
+    return {
+      status: "drifted",
+      casFilePath: dest,
+      current: currentTargets,
+      expected: casTargets
+    };
+  }
+  return { status: "ok", casFilePath: dest };
+};
+
+export { CaClientError, CaClientErrorCode, createCaClient, detectDrift, isUnauthorized, writeCasFile };