@pellux/goodvibes-sdk 0.18.3 → 0.18.12

package/dist/_internal/platform/security/http-auth.js

@@ -0,0 +1,112 @@
+import { timingSafeEqual } from 'node:crypto';
+export const OPERATOR_SESSION_COOKIE_NAME = 'goodvibes_session';
+function parseCookies(header) {
+    const cookies = new Map();
+    if (!header)
+        return cookies;
+    for (const segment of header.split(';')) {
+        const [rawName, ...rawValueParts] = segment.split('=');
+        const name = rawName?.trim();
+        if (!name)
+            continue;
+        const rawValue = rawValueParts.join('=').trim();
+        if (!rawValue)
+            continue;
+        try {
+            cookies.set(name, decodeURIComponent(rawValue));
+        }
+        catch {
+            cookies.set(name, rawValue);
+        }
+    }
+    return cookies;
+}
+function isSecureRequest(req, trustProxy = false) {
+    try {
+        const url = new URL(req.url);
+        if (url.protocol === 'https:')
+            return true;
+    }
+    catch {
+        // Ignore malformed URLs; Bun always provides a valid request URL.
+    }
+    if (!trustProxy)
+        return false;
+    const forwardedProto = req.headers.get('x-forwarded-proto') ?? '';
+    return forwardedProto
+        .split(',')
+        .map((value) => value.trim().toLowerCase())
+        .some((value) => value === 'https');
+}
+export function extractOperatorAuthToken(req) {
+    const bearer = req.headers.get('authorization')?.replace(/^Bearer\s+/i, '').trim();
+    if (bearer)
+        return bearer;
+    const sessionCookie = parseCookies(req.headers.get('cookie')).get(OPERATOR_SESSION_COOKIE_NAME)?.trim();
+    if (sessionCookie)
+        return sessionCookie;
+    return '';
+}
+function matchesSharedToken(token, sharedToken) {
+    if (token.length !== sharedToken.length)
+        return false;
+    return timingSafeEqual(Buffer.from(token), Buffer.from(sharedToken));
+}
+export function authenticateOperatorToken(token, context) {
+    const normalized = token.trim();
+    if (!normalized)
+        return null;
+    if (context.sharedToken) {
+        return matchesSharedToken(normalized, context.sharedToken)
+            ? { kind: 'shared-token', token: normalized }
+            : null;
+    }
+    const session = context.userAuth.validateSession(normalized);
+    if (!session)
+        return null;
+    const user = context.userAuth.getUser(session.username);
+    if (!user)
+        return null;
+    return {
+        kind: 'session',
+        token: normalized,
+        username: user.username,
+        roles: user.roles,
+    };
+}
+export function authenticateOperatorRequest(req, context) {
+    return authenticateOperatorToken(extractOperatorAuthToken(req), context);
+}
+export function isOperatorAdmin(authenticated) {
+    if (!authenticated)
+        return false;
+    return authenticated.kind === 'shared-token' || authenticated.roles.includes('admin');
+}
+export function buildOperatorSessionCookie(token, options) {
+    const maxAgeSeconds = Math.max(0, Math.floor((options.expiresAt - Date.now()) / 1_000));
+    const secure = isSecureRequest(options.req, options.trustProxy);
+    const parts = [
+        `${OPERATOR_SESSION_COOKIE_NAME}=${encodeURIComponent(token)}`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+        `Expires=${new Date(options.expiresAt).toUTCString()}`,
+        `Max-Age=${maxAgeSeconds}`,
+    ];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function buildExpiredOperatorSessionCookie(req, trustProxy = false) {
+    const parts = [
+        `${OPERATOR_SESSION_COOKIE_NAME}=`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+        'Expires=Thu, 01 Jan 1970 00:00:00 GMT',
+        'Max-Age=0',
+    ];
+    if (isSecureRequest(req, trustProxy))
+        parts.push('Secure');
+    return parts.join('; ');
+}

package/dist/_internal/platform/security/index.d.ts

@@ -0,0 +1,8 @@
+export { SpawnTokenManager } from './spawn-tokens.js';
+export type { SpawnToken, OrchestrationPolicyConfig } from './spawn-tokens.js';
+export { UserAuthManager } from './user-auth.js';
+export type { AuthUser, AuthSession } from './user-auth.js';
+export { ApiTokenAuditor } from './token-audit.js';
+export type { ApiTokenMetadata, TokenScopePolicy, TokenScopeAuditResult, TokenRotationAuditResult, TokenAuditResult, TokenAuditReport, TokenAuditorConfig, ScopeAuditOutcome, RotationAuditOutcome, } from './token-audit.js';
+export { DEFAULT_ROTATION_CADENCE_MS, DEFAULT_ROTATION_WARNING_THRESHOLD_MS } from './token-audit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/platform/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,2BAA2B,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/_internal/platform/security/index.js

@@ -0,0 +1,4 @@
+export { SpawnTokenManager } from './spawn-tokens.js';
+export { UserAuthManager } from './user-auth.js';
+export { ApiTokenAuditor } from './token-audit.js';
+export { DEFAULT_ROTATION_CADENCE_MS, DEFAULT_ROTATION_WARNING_THRESHOLD_MS } from './token-audit.js';

package/dist/_internal/platform/security/spawn-tokens.d.ts

@@ -0,0 +1,65 @@
+export interface SpawnToken {
+    type: 'orchestrator' | 'agent';
+    sessionId: string;
+    issuedTo: string;
+    issuedBy: string;
+    depth: number;
+    maxDepth: number;
+    canGenerate: boolean;
+    expiresAt: number;
+    signature: string;
+}
+export interface OrchestrationPolicyConfig {
+    recursionEnabled: boolean;
+    maxDepth: number;
+    maxActiveAgents: number;
+}
+interface ValidateResult {
+    valid: boolean;
+    reason?: string;
+}
+interface CanSpawnResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Manages spawn tokens for the bounded recursive orchestration security model.
+ *
+ * Security model (3 layers):
+ *   1. Policy gate   — recursionEnabled must be true
+ *   2. Capacity gate — currentAgentCount < maxActiveAgents && depth <= maxDepth
+ *   3. Token gate    — token must be valid, authentic, not expired, and canGenerate
+ */
+export declare class SpawnTokenManager {
+    private secret;
+    private tokens;
+    constructor(sessionId: string);
+    private sign;
+    private verifySignature;
+    /**
+     * Create the orchestrator token. Called once at session start.
+     * The orchestrator token can generate agent tokens.
+     */
+    createOrchestratorToken(ttlMs?: number): SpawnToken;
+    /**
+     * Generate an agent token from an orchestrator token.
+     * Returns null if the orchestrator token is invalid or cannot generate.
+     */
+    generateAgentToken(orchestratorToken: SpawnToken, agentId: string, ttlMs?: number): SpawnToken | null;
+    /**
+     * Validate a token is authentic (correct HMAC), registered, and not expired.
+     */
+    validate(token: SpawnToken): ValidateResult;
+    /**
+     * Check if spawning is allowed given config constraints and token.
+     * 3-layer check: config gate → capacity gate → token gate.
+     */
+    canSpawn(token: SpawnToken, config: OrchestrationPolicyConfig, currentAgentCount: number): CanSpawnResult;
+    /**
+     * Revoke a token by its signature.
+     * Returns true if the token was found and revoked.
+     */
+    revoke(tokenSignature: string): boolean;
+}
+export {};
+//# sourceMappingURL=spawn-tokens.d.ts.map

package/dist/_internal/platform/security/spawn-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-tokens.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/spawn-tokens.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAiC;gBAEnC,SAAS,EAAE,MAAM;IAS7B,OAAO,CAAC,IAAI;IAcZ,OAAO,CAAC,eAAe;IAYvB;;;OAGG;IACH,uBAAuB,CAAC,KAAK,GAAE,MAA6B,GAAG,UAAU;IAgBzE;;;OAGG;IACH,kBAAkB,CAChB,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,MAA6B,GACnC,UAAU,GAAG,IAAI;IA8BpB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc;IAmB3C;;;OAGG;IACH,QAAQ,CACN,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,yBAAyB,EACjC,iBAAiB,EAAE,MAAM,GACxB,cAAc;IA6BjB;;;OAGG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;CAGxC"}

package/dist/_internal/platform/security/spawn-tokens.js

@@ -0,0 +1,161 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
+import { logger } from '../utils/logger.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Default TTL for spawn tokens: 1 hour in milliseconds. */
+const DEFAULT_TOKEN_TTL_MS = 3_600_000;
+// ---------------------------------------------------------------------------
+// SpawnTokenManager
+// ---------------------------------------------------------------------------
+/**
+ * Manages spawn tokens for the bounded recursive orchestration security model.
+ *
+ * Security model (3 layers):
+ *   1. Policy gate   — recursionEnabled must be true
+ *   2. Capacity gate — currentAgentCount < maxActiveAgents && depth <= maxDepth
+ *   3. Token gate    — token must be valid, authentic, not expired, and canGenerate
+ */
+export class SpawnTokenManager {
+    secret;
+    tokens = new Map();
+    constructor(sessionId) {
+        // Per-session random secret — never shared outside this instance
+        this.secret = `${sessionId}:${randomBytes(32).toString('hex')}`;
+    }
+    // -------------------------------------------------------------------------
+    // Signing
+    // -------------------------------------------------------------------------
+    sign(token) {
+        const payload = JSON.stringify({
+            type: token.type,
+            sessionId: token.sessionId,
+            issuedTo: token.issuedTo,
+            issuedBy: token.issuedBy,
+            depth: token.depth,
+            maxDepth: token.maxDepth,
+            canGenerate: token.canGenerate,
+            expiresAt: token.expiresAt,
+        });
+        return createHmac('sha256', this.secret).update(payload).digest('hex');
+    }
+    verifySignature(token) {
+        const expected = this.sign(token);
+        const expectedBuf = Buffer.from(expected);
+        const actualBuf = Buffer.from(token.signature);
+        if (expectedBuf.length !== actualBuf.length)
+            return false;
+        return timingSafeEqual(expectedBuf, actualBuf);
+    }
+    // -------------------------------------------------------------------------
+    // Public API
+    // -------------------------------------------------------------------------
+    /**
+     * Create the orchestrator token. Called once at session start.
+     * The orchestrator token can generate agent tokens.
+     */
+    createOrchestratorToken(ttlMs = DEFAULT_TOKEN_TTL_MS) {
+        const partial = {
+            type: 'orchestrator',
+            sessionId: this.secret.split(':')[0],
+            issuedTo: 'main',
+            issuedBy: 'system',
+            depth: 0,
+            maxDepth: 1,
+            canGenerate: true,
+            expiresAt: Date.now() + ttlMs,
+        };
+        const token = { ...partial, signature: this.sign(partial) };
+        this.tokens.set(token.signature, token);
+        return token;
+    }
+    /**
+     * Generate an agent token from an orchestrator token.
+     * Returns null if the orchestrator token is invalid or cannot generate.
+     */
+    generateAgentToken(orchestratorToken, agentId, ttlMs = DEFAULT_TOKEN_TTL_MS) {
+        const validation = this.validate(orchestratorToken);
+        if (!validation.valid) {
+            logger.info('generateAgentToken: orchestrator token invalid', { reason: validation.reason });
+            return null;
+        }
+        if (!orchestratorToken.canGenerate) {
+            logger.info('generateAgentToken: token does not have canGenerate=true', { issuedTo: orchestratorToken.issuedTo });
+            return null;
+        }
+        if (orchestratorToken.type !== 'orchestrator') {
+            logger.info('generateAgentToken: only orchestrator tokens can generate agent tokens');
+            return null;
+        }
+        const partial = {
+            type: 'agent',
+            sessionId: orchestratorToken.sessionId,
+            issuedTo: agentId,
+            issuedBy: 'main',
+            depth: 1,
+            maxDepth: orchestratorToken.maxDepth,
+            canGenerate: false, // agents cannot generate further tokens
+            expiresAt: Date.now() + ttlMs,
+        };
+        const token = { ...partial, signature: this.sign(partial) };
+        this.tokens.set(token.signature, token);
+        return token;
+    }
+    /**
+     * Validate a token is authentic (correct HMAC), registered, and not expired.
+     */
+    validate(token) {
+        if (!token || typeof token !== 'object') {
+            return { valid: false, reason: 'token is not an object' };
+        }
+        if (!token.signature) {
+            return { valid: false, reason: 'token has no signature' };
+        }
+        if (!this.tokens.has(token.signature)) {
+            return { valid: false, reason: 'token not registered (revoked or foreign)' };
+        }
+        if (!this.verifySignature(token)) {
+            return { valid: false, reason: 'signature mismatch — token tampered' };
+        }
+        if (Date.now() > token.expiresAt) {
+            return { valid: false, reason: 'token expired' };
+        }
+        return { valid: true };
+    }
+    /**
+     * Check if spawning is allowed given config constraints and token.
+     * 3-layer check: config gate → capacity gate → token gate.
+     */
+    canSpawn(token, config, currentAgentCount) {
+        // Layer 1: policy gate
+        if (!config.recursionEnabled) {
+            return { allowed: false, reason: 'recursive orchestration is disabled in policy' };
+        }
+        // Layer 2: capacity checks
+        if (currentAgentCount >= config.maxActiveAgents) {
+            return {
+                allowed: false,
+                reason: `maxActiveAgents limit reached (${currentAgentCount}/${config.maxActiveAgents})`,
+            };
+        }
+        if (token.depth > config.maxDepth) {
+            return {
+                allowed: false,
+                reason: `depth ${token.depth} exceeds maxDepth ${config.maxDepth}`,
+            };
+        }
+        // Layer 3: token gate
+        const validation = this.validate(token);
+        if (!validation.valid) {
+            return { allowed: false, reason: `invalid token: ${validation.reason}` };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Revoke a token by its signature.
+     * Returns true if the token was found and revoked.
+     */
+    revoke(tokenSignature) {
+        return this.tokens.delete(tokenSignature);
+    }
+}

package/dist/_internal/platform/security/token-audit.d.ts

@@ -0,0 +1,207 @@
+/**
+ * ApiTokenAuditor — minimum scope and rotation cadence enforcement.
+ *
+ * Security model (two audit dimensions):
+ *   1. Scope audit  — verifies each registered token only holds the scopes
+ *                     its declared policy permits (minimum scope principle)
+ *   2. Rotation audit — checks token age against the rotation cadence policy
+ *                       and emits warnings at the warning threshold, errors
+ *                       when rotation is overdue
+ *
+ * In managed mode, out-of-policy tokens are blocked from use.
+ * In advisory mode, violations are reported but not blocked.
+ */
+import type { SecurityEvent } from '../runtime/events/security.js';
+/** Default rotation cadence: 90 days in ms. */
+export declare const DEFAULT_ROTATION_CADENCE_MS: number;
+/** Default warning threshold: 14 days before rotation deadline. */
+export declare const DEFAULT_ROTATION_WARNING_THRESHOLD_MS: number;
+/**
+ * Metadata for a registered API token.
+ * Callers supply this when registering a token with the auditor.
+ */
+export interface ApiTokenMetadata {
+    /** Stable identifier for this token (never the secret value). */
+    id: string;
+    /** Human-readable label (e.g. 'OPENAI_API_KEY', 'SLACK_BOT_TOKEN'). */
+    label: string;
+    /** Epoch ms when this token was issued / last rotated. */
+    issuedAt: number;
+    /** Scopes granted to this token (provider-specific strings). */
+    grantedScopes: readonly string[];
+    /** Policy ID this token is evaluated against (maps to TokenScopePolicy.id). */
+    policyId: string;
+}
+/**
+ * Scope policy for a category of tokens.
+ * Defines the maximum set of scopes permitted under the minimum scope principle.
+ */
+export interface TokenScopePolicy {
+    /** Stable policy identifier. */
+    id: string;
+    /** Human-readable name. */
+    name: string;
+    /**
+     * The complete list of scopes permitted for tokens governed by this policy.
+     * Tokens holding scopes outside this set violate the minimum scope principle.
+     */
+    allowedScopes: readonly string[];
+    /**
+     * Rotation cadence in ms. Tokens older than this value are overdue.
+     * Defaults to DEFAULT_ROTATION_CADENCE_MS when not specified.
+     */
+    rotationCadenceMs?: number;
+    /**
+     * Warning threshold in ms before the rotation deadline.
+     * Defaults to DEFAULT_ROTATION_WARNING_THRESHOLD_MS when not specified.
+     */
+    rotationWarningThresholdMs?: number;
+}
+/** Outcome of a single scope audit check. */
+export type ScopeAuditOutcome = 'ok' | 'violation';
+/** Outcome of a single rotation audit check. */
+export type RotationAuditOutcome = 'ok' | 'warning' | 'overdue';
+/** Result of a scope audit for one token. */
+export interface TokenScopeAuditResult {
+    tokenId: string;
+    outcome: ScopeAuditOutcome;
+    /** Scopes present on the token that are not in the policy's allowedScopes. */
+    excessScopes: string[];
+    /** The policy evaluated against. */
+    policyId: string;
+}
+/** Result of a rotation audit for one token. */
+export interface TokenRotationAuditResult {
+    tokenId: string;
+    outcome: RotationAuditOutcome;
+    /** How old the token is in ms. */
+    ageMs: number;
+    /** The configured rotation cadence in ms. */
+    cadenceMs: number;
+    /** Ms remaining until rotation is due (negative = overdue). */
+    msUntilDue: number;
+    /** Epoch ms when rotation was / is due. */
+    dueAt: number;
+}
+/** Combined audit result for a single token. */
+export interface TokenAuditResult {
+    tokenId: string;
+    label: string;
+    scope: TokenScopeAuditResult;
+    rotation: TokenRotationAuditResult;
+    /**
+     * Whether this token is blocked from use in managed mode.
+     * A token is blocked when it has a scope violation or an overdue rotation.
+     */
+    blocked: boolean;
+}
+/** Full audit report across all registered tokens. */
+export interface TokenAuditReport {
+    results: TokenAuditResult[];
+    /** Tokens blocked in managed mode. */
+    blocked: string[];
+    /** Tokens with scope violations. */
+    scopeViolations: string[];
+    /** Tokens with rotation warnings (approaching deadline). */
+    rotationWarnings: string[];
+    /** Tokens with overdue rotation. */
+    rotationOverdue: string[];
+    /** Epoch ms when this report was produced. */
+    capturedAt: number;
+}
+/** Configuration for the ApiTokenAuditor. */
+export interface TokenAuditorConfig {
+    /**
+     * When true, out-of-policy tokens are blocked from use.
+     * When false, violations are reported but tokens remain usable.
+     */
+    managed: boolean;
+}
+/**
+ * Callback invoked after each token is audited in `auditAll()`.
+ * Receives one SecurityEvent per relevant audit outcome.
+ * No-op by default — pass via `ApiTokenAuditor` constructor options.
+ */
+export type SecurityEventEmitter = (event: SecurityEvent) => void;
+/**
+ * Audits registered API tokens for scope minimization and rotation cadence.
+ *
+ * Usage:
+ * ```ts
+ * const auditor = new ApiTokenAuditor({ managed: true });
+ * auditor.registerPolicy({
+ *   id: 'openai',
+ *   name: 'OpenAI API',
+ *   allowedScopes: ['completions:write', 'models:read'],
+ *   rotationCadenceMs: 90 * 24 * 60 * 60 * 1000,
+ * });
+ * auditor.registerToken({
+ *   id: 'tok_openai_main',
+ *   label: 'OPENAI_API_KEY',
+ *   issuedAt: Date.now() - 30 * 24 * 60 * 60 * 1000,
+ *   grantedScopes: ['completions:write', 'models:read'],
+ *   policyId: 'openai',
+ * });
+ * const report = auditor.auditAll();
+ * ```
+ */
+export declare class ApiTokenAuditor {
+    private readonly _policies;
+    private readonly _tokens;
+    private readonly _config;
+    private readonly _emitter;
+    constructor(config?: TokenAuditorConfig, options?: {
+        emitter?: SecurityEventEmitter;
+    });
+    /**
+     * Register a scope policy. Policies must be registered before tokens that
+     * reference them.
+     */
+    registerPolicy(policy: TokenScopePolicy): void;
+    /**
+     * Register an API token for auditing.
+     * Throws if the referenced policyId is not registered.
+     */
+    registerToken(metadata: ApiTokenMetadata): void;
+    /**
+     * Deregister a token (e.g. on rotation — remove the old registration,
+     * then registerToken with the new metadata).
+     */
+    deregisterToken(tokenId: string): boolean;
+    /**
+     * Audit the scope of a single token against its policy.
+     * Returns a TokenScopeAuditResult or null if the token is not registered.
+     */
+    auditScope(tokenId: string): TokenScopeAuditResult | null;
+    /**
+     * Audit the rotation cadence of a single token.
+     * Returns a TokenRotationAuditResult or null if the token is not registered.
+     */
+    auditRotation(tokenId: string, now?: number): TokenRotationAuditResult | null;
+    private _auditScopeFor;
+    private _auditRotationFor;
+    /**
+     * Run scope and rotation audits for all registered tokens.
+     *
+     * In managed mode, tokens with scope violations or overdue rotation are
+     * flagged as blocked. Callers must check `result.blocked` or
+     * `report.blocked` before using a token.
+     */
+    auditAll(now?: number): TokenAuditReport;
+    /**
+     * Check whether a specific token is currently blocked.
+     * Returns false when not in managed mode or when the token is not registered.
+     */
+    isBlocked(tokenId: string, now?: number): boolean;
+    /** Whether managed mode is active. */
+    get isManaged(): boolean;
+    /** Number of registered tokens. */
+    get tokenCount(): number;
+    /** Number of registered policies. */
+    get policyCount(): number;
+    /** Get a registered policy by id, or undefined if not found. */
+    getPolicy(id: string): TokenScopePolicy | undefined;
+    /** Get registered token metadata by id (without the secret value). */
+    getTokenMetadata(id: string): ApiTokenMetadata | undefined;
+}
+//# sourceMappingURL=token-audit.d.ts.map

package/dist/_internal/platform/security/token-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-audit.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/security/token-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAMnE,+CAA+C;AAC/C,eAAO,MAAM,2BAA2B,QAA2B,CAAC;AAEpE,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,QAA2B,CAAC;AAM9E;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,6CAA6C;AAC7C,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,CAAC;AAEnD,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,wBAAwB,CAAC;IACnC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,sCAAsC;IACtC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oCAAoC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oCAAoC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAMlE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;gBAG9C,MAAM,GAAE,kBAAuC,EAC/C,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,oBAAoB,CAAA;KAAE;IAU9C;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAK9C;;;OAGG;IACH,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAU/C;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAQzC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI;IAQzD;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,wBAAwB,GAAG,IAAI;IAYzF,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,iBAAiB;IA0CzB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,GAAE,MAAmB,GAAG,gBAAgB;IA2FpD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAa7D,sCAAsC;IACtC,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,mCAAmC;IACnC,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,qCAAqC;IACrC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,gEAAgE;IAChE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAInD,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;CAG3D"}