@predicatesystems/authority 0.3.3 → 0.4.1

package/dist/verify/verifier.js

@@ -0,0 +1,347 @@
+/**
+ * Post-execution verification module.
+ *
+ * The Verifier class compares actual operations against what was
+ * authorized via a mandate, detecting unauthorized deviations.
+ */
+import { AuthorityClientError } from "../errors.js";
+import { actionsMatch, resourcesMatch } from "./comparators.js";
+import { isBrowserEvidence, isCliEvidence, isDbEvidence, isFileEvidence, isHttpEvidence, isMandateDetails, isRecordVerificationResponse, } from "./types.js";
+/**
+ * Verifier for post-execution authorization checks.
+ *
+ * Compares actual operations against mandates to detect unauthorized
+ * deviations from what was authorized.
+ *
+ * @example
+ * ```typescript
+ * const verifier = new Verifier({ baseUrl: 'http://127.0.0.1:8787' });
+ *
+ * const result = await verifier.verify({
+ *   mandateId: decision.mandate_id,
+ *   actual: {
+ *     action: 'fs.read',
+ *     resource: '/src/index.ts',
+ *   },
+ * });
+ *
+ * if (!result.verified) {
+ *   console.error('Operation mismatch:', result.reason);
+ * }
+ * ```
+ */
+export class Verifier {
+    baseUrl;
+    timeoutMs;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.timeoutMs = options.timeoutMs ?? 2000;
+    }
+    /**
+     * Verify that an actual operation matches its mandate.
+     *
+     * @param request - Verification request with mandate ID and actual operation
+     * @returns Verification result
+     */
+    async verify(request) {
+        // 1. Retrieve mandate details
+        const mandate = await this.getMandate(request.mandateId);
+        if (!mandate) {
+            return {
+                verified: false,
+                reason: "mandate_not_found",
+            };
+        }
+        // 2. Check mandate expiration
+        const expiresAt = new Date(mandate.expires_at).getTime();
+        if (expiresAt < Date.now()) {
+            return {
+                verified: false,
+                reason: "mandate_expired",
+            };
+        }
+        // 3. Compare action
+        if (!actionsMatch(mandate.action, request.actual.action)) {
+            const result = {
+                verified: false,
+                reason: "action_mismatch",
+                details: {
+                    authorized: { action: mandate.action, resource: mandate.resource },
+                    actual: {
+                        action: request.actual.action,
+                        resource: request.actual.resource,
+                    },
+                },
+            };
+            // Record failed verification
+            await this.recordVerification({
+                mandateId: request.mandateId,
+                verified: false,
+                actual: request.actual,
+                reason: "action_mismatch",
+            });
+            return result;
+        }
+        // 4. Compare resource (with normalization)
+        if (!resourcesMatch(mandate.resource, request.actual.resource)) {
+            const result = {
+                verified: false,
+                reason: "resource_mismatch",
+                details: {
+                    authorized: { action: mandate.action, resource: mandate.resource },
+                    actual: {
+                        action: request.actual.action,
+                        resource: request.actual.resource,
+                    },
+                },
+            };
+            // Record failed verification
+            await this.recordVerification({
+                mandateId: request.mandateId,
+                verified: false,
+                actual: request.actual,
+                reason: "resource_mismatch",
+            });
+            return result;
+        }
+        // 5. Record successful verification
+        const auditId = await this.recordVerification({
+            mandateId: request.mandateId,
+            verified: true,
+            actual: request.actual,
+        });
+        return {
+            verified: true,
+            auditId,
+        };
+    }
+    /**
+     * Verify an operation locally without sidecar communication.
+     *
+     * Use this when the sidecar endpoints are not available yet (Phase 2).
+     * This performs the same matching logic but skips mandate retrieval
+     * and audit logging.
+     *
+     * @param mandate - Known mandate details
+     * @param request - Verification request
+     * @returns Verification result (without auditId)
+     */
+    verifyLocal(mandate, request) {
+        // Check mandate expiration
+        const expiresAt = new Date(mandate.expires_at).getTime();
+        if (expiresAt < Date.now()) {
+            return {
+                verified: false,
+                reason: "mandate_expired",
+            };
+        }
+        // Compare action
+        if (!actionsMatch(mandate.action, request.actual.action)) {
+            return {
+                verified: false,
+                reason: "action_mismatch",
+                details: {
+                    authorized: { action: mandate.action, resource: mandate.resource },
+                    actual: {
+                        action: request.actual.action,
+                        resource: request.actual.resource,
+                    },
+                },
+            };
+        }
+        // Compare resource
+        if (!resourcesMatch(mandate.resource, request.actual.resource)) {
+            return {
+                verified: false,
+                reason: "resource_mismatch",
+                details: {
+                    authorized: { action: mandate.action, resource: mandate.resource },
+                    actual: {
+                        action: request.actual.action,
+                        resource: request.actual.resource,
+                    },
+                },
+            };
+        }
+        return { verified: true };
+    }
+    /**
+     * Retrieve mandate details from the sidecar.
+     *
+     * @param mandateId - Mandate ID to look up
+     * @returns Mandate details or null if not found
+     */
+    async getMandate(mandateId) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await fetch(`${this.baseUrl}/v1/mandates/${encodeURIComponent(mandateId)}`, {
+                method: "GET",
+                headers: {
+                    accept: "application/json",
+                },
+                signal: controller.signal,
+            });
+            if (response.status === 404) {
+                return null;
+            }
+            if (!response.ok) {
+                throw new AuthorityClientError(`mandate lookup failed: ${response.status}`, {
+                    code: "server_error",
+                    status: response.status,
+                });
+            }
+            const payload = await response.json();
+            if (!isMandateDetails(payload)) {
+                throw new AuthorityClientError("invalid mandate response payload", {
+                    code: "protocol_error",
+                    status: response.status,
+                    details: payload,
+                });
+            }
+            return payload;
+        }
+        catch (error) {
+            if (error instanceof AuthorityClientError) {
+                throw error;
+            }
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new AuthorityClientError("mandate lookup timed out", {
+                    code: "timeout",
+                    cause: error,
+                });
+            }
+            throw new AuthorityClientError("mandate lookup failed", {
+                code: "network_error",
+                cause: error,
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Record a verification result in the sidecar's audit log.
+     *
+     * @param request - Verification details to record
+     * @returns Audit trail ID
+     */
+    async recordVerification(request) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const actualPayload = this.buildActualPayload(request.actual);
+            const response = await fetch(`${this.baseUrl}/v1/verify`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    mandate_id: request.mandateId,
+                    verified: request.verified,
+                    actual: actualPayload,
+                    reason: request.reason,
+                    verified_at: new Date().toISOString(),
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw new AuthorityClientError(`record verification failed: ${response.status}`, {
+                    code: "server_error",
+                    status: response.status,
+                });
+            }
+            const payload = await response.json();
+            if (!isRecordVerificationResponse(payload)) {
+                // Graceful fallback: generate a local audit ID if sidecar doesn't return one
+                return `local_audit_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+            }
+            return payload.audit_id;
+        }
+        catch (error) {
+            if (error instanceof AuthorityClientError) {
+                throw error;
+            }
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new AuthorityClientError("record verification timed out", {
+                    code: "timeout",
+                    cause: error,
+                });
+            }
+            throw new AuthorityClientError("record verification failed", {
+                code: "network_error",
+                cause: error,
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Build the actual operation payload for the verification request.
+     * Handles the discriminated union by extracting type-specific fields.
+     */
+    buildActualPayload(actual) {
+        // Common fields present on all evidence types
+        const payload = {
+            action: actual.action,
+            resource: actual.resource,
+            executed_at: actual.executedAt,
+        };
+        // Check if it has a type discriminator (new ExecutionEvidence types)
+        if ("type" in actual) {
+            payload.type = actual.type;
+            if (isFileEvidence(actual)) {
+                payload.content_hash = actual.contentHash;
+                payload.file_size = actual.fileSize;
+                payload.permissions = actual.permissions;
+                payload.modified_at = actual.modifiedAt;
+            }
+            else if (isCliEvidence(actual)) {
+                payload.command = actual.command;
+                payload.exit_code = actual.exitCode;
+                payload.stdout_hash = actual.stdoutHash;
+                payload.stderr_hash = actual.stderrHash;
+                payload.transcript_hash = actual.transcriptHash;
+                payload.cwd = actual.cwd;
+                payload.duration_ms = actual.durationMs;
+            }
+            else if (isBrowserEvidence(actual)) {
+                payload.final_url = actual.finalUrl;
+                payload.selector = actual.selector;
+                payload.a11y_tree_hash = actual.a11yTreeHash;
+                payload.dom_state_hash = actual.domStateHash;
+                payload.screenshot_hash = actual.screenshotHash;
+                payload.page_title = actual.pageTitle;
+            }
+            else if (isHttpEvidence(actual)) {
+                payload.method = actual.method;
+                payload.status_code = actual.statusCode;
+                payload.response_body_hash = actual.responseBodyHash;
+                payload.content_type = actual.contentType;
+                payload.response_size = actual.responseSize;
+                payload.duration_ms = actual.durationMs;
+            }
+            else if (isDbEvidence(actual)) {
+                payload.query_hash = actual.queryHash;
+                payload.rows_affected = actual.rowsAffected;
+                payload.result_hash = actual.resultHash;
+                payload.duration_ms = actual.durationMs;
+            }
+            else {
+                // GenericEvidence
+                const generic = actual;
+                payload.evidence_hash = generic.evidenceHash;
+                payload.metadata = generic.metadata;
+            }
+        }
+        else {
+            // Legacy ActualOperation - extract known fields
+            const legacy = actual;
+            payload.content_hash = legacy.contentHash;
+            payload.transcript_hash = legacy.transcriptHash;
+        }
+        return payload;
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/verify/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/verify/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAQL,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAkCpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,QAAQ;IACF,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,YAAY,OAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,8BAA8B;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,iBAAiB;aAC1B,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAiB;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE;oBACP,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBAClE,MAAM,EAAE;wBACN,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;wBAC7B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;qBAClC;iBACF;aACF,CAAC;YAEF,6BAA6B;YAC7B,MAAM,IAAI,CAAC,kBAAkB,CAAC;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2CAA2C;QAC3C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAiB;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE;oBACP,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBAClE,MAAM,EAAE;wBACN,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;wBAC7B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;qBAClC;iBACF;aACF,CAAC;YAEF,6BAA6B;YAC7B,MAAM,IAAI,CAAC,kBAAkB,CAAC;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,mBAAmB;aAC5B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,WAAW,CAAC,OAAuB,EAAE,OAAsB;QACzD,2BAA2B;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACzD,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,iBAAiB;aAC1B,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE;oBACP,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBAClE,MAAM,EAAE;wBACN,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;wBAC7B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;qBAClC;iBACF;aACF,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE;oBACP,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBAClE,MAAM,EAAE;wBACN,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;wBAC7B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;qBAClC;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;gBAC3F,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAC1E,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEtC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAoB,CAAC,kCAAkC,EAAE;oBACjE,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE;oBACzD,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE;gBACtD,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAkC;QACzD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAE9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,YAAY,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,OAAO,CAAC,SAAS;oBAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACtC,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAC/E,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEtC,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,6EAA6E;gBAC7E,OAAO,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,CAAC;YAED,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,EAAE;oBAC9D,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,EAAE;gBAC3D,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,kBAAkB,CACxB,MAA2C;QAE3C,8CAA8C;QAC9C,MAAM,OAAO,GAA4B;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC;QAEF,qEAAqE;QACrE,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YAE3B,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC1C,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACpC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACzC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,CAAC;iBAAM,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBACjC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACpC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxC,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;gBAChD,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;gBACzB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,CAAC;iBAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACpC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC7C,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC7C,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;gBAChD,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;YACxC,CAAC;iBAAM,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBACrD,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC1C,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC5C,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;gBACtC,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC5C,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,kBAAkB;gBAClB,MAAM,OAAO,GAAG,MAAyB,CAAC;gBAC1C,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;gBAC7C,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gDAAgD;YAChD,MAAM,MAAM,GAAG,MAAyB,CAAC;YACzC,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;YAC1C,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@predicatesystems/authority",
-  "version": "0.3.3",
+  "version": "0.4.1",
   "description": "TypeScript authority SDK for Predicate Systems sidecar integration.",
   "license": "(MIT OR Apache-2.0)",
   "type": "module",