@privos_ai/app-server 0.1.0 → 0.3.1

package/dist/workload/dispatch-assertion.js

@@ -0,0 +1,653 @@
+import crypto from 'node:crypto';
+const replay = new Map();
+const RUNTIME_DISPATCH_V3_HEADER_KEYS = ['alg', 'kid', 'privos_protocol', 'typ'];
+const RUNTIME_DISPATCH_V3_COMMON_KEYS = [
+    'aud',
+    'authorizationContext',
+    'bodyDigest',
+    'deploymentId',
+    'executionMode',
+    'exp',
+    'generationId',
+    'generationNumber',
+    'htm',
+    'htu',
+    'iat',
+    'iss',
+    'jti',
+    'manifestDigest',
+    'mcpAppId',
+    'nonce',
+    'protocolVersion',
+    'resourceManifestHash',
+    'runtimeApprovalReceiptHash',
+    'runtimeAuthorizationEpoch',
+    'runtimeInstallationId',
+    'runtimeResourceInventoryHash',
+    'type',
+    'workspaceId',
+];
+const RUNTIME_DISPATCH_V3_ROOM_KEYS = [
+    'authorizationBindingId',
+    'bindingEpoch',
+    'bindingGrantHash',
+    'bindingReceiptHash',
+    'bindingTokenVersion',
+    'roomId',
+];
+const RUNTIME_DISPATCH_V3_AFFINITY_REQUIRED_KEYS = [
+    'workspaceId',
+    'deploymentId',
+    'mcpAppId',
+    'executionMode',
+    'generationId',
+    'generationNumber',
+    'runtimeInstallationId',
+    'manifestDigest',
+    'resourceManifestHash',
+];
+const RUNTIME_DISPATCH_V3_AFFINITY_OPTIONAL_KEYS = [
+    'runtimeResourceInventoryHash',
+    'runtimeApprovalReceiptHash',
+    'runtimeAuthorizationEpoch',
+];
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+const RUNTIME_HASH_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const RUNTIME_MANIFEST_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const RUNTIME_NONCE_PATTERN = /^[A-Za-z0-9_-]{32,128}$/;
+const DEFAULT_RUNTIME_REPLAY_CAPACITY = 10_000;
+const MAX_RUNTIME_COMPACT_BYTES = 32_768;
+const UNSIGNED_RUNTIME_INITIALIZE_PARAMS_V3 = Object.freeze({
+    protocolVersion: '2025-03-26',
+    capabilities: Object.freeze({
+        extensions: Object.freeze({
+            'io.modelcontextprotocol/ui': Object.freeze({
+                mimeTypes: Object.freeze(['text/html;profile=mcp-app']),
+            }),
+        }),
+    }),
+    clientInfo: Object.freeze({ name: 'privos-hub', version: '1.0.0' }),
+});
+/** Process-local bounded replay protection. Publishers with multiple replicas must inject a shared atomic consumer. */
+export class BoundedRuntimeDispatchReplayConsumerV3 {
+    capacity;
+    jtis = new Map();
+    nonces = new Map();
+    constructor(capacity = DEFAULT_RUNTIME_REPLAY_CAPACITY) {
+        this.capacity = capacity;
+        if (!Number.isSafeInteger(capacity) || capacity < 1)
+            throw new RangeError('Runtime dispatch replay capacity must be positive.');
+    }
+    consume(input) {
+        for (const [key, expiresAt] of this.jtis) {
+            if (expiresAt <= input.now)
+                this.jtis.delete(key);
+        }
+        for (const [key, expiresAt] of this.nonces) {
+            if (expiresAt <= input.now)
+                this.nonces.delete(key);
+        }
+        const jtiKey = JSON.stringify([input.issuer, input.jti]);
+        const nonceKey = JSON.stringify([input.issuer, input.nonce]);
+        if (this.jtis.has(jtiKey) || this.nonces.has(nonceKey))
+            return false;
+        if (this.jtis.size >= this.capacity)
+            throw new Error('dispatch_assertion_replay_store_full');
+        this.jtis.set(jtiKey, input.expiresAt);
+        this.nonces.set(nonceKey, input.expiresAt);
+        return true;
+    }
+}
+const defaultRuntimeReplayConsumer = new BoundedRuntimeDispatchReplayConsumerV3();
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, child]) => [key, canonicalize(child)]));
+    }
+    return value;
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const sortedExpected = [...expected].sort();
+    return actual.length === sortedExpected.length && actual.every((key, index) => key === sortedExpected[index]);
+}
+function runtimeId(value) {
+    return typeof value === 'string' && value.length >= 1 && value.length <= 256;
+}
+function positiveSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 1;
+}
+function runtimeHash(value) {
+    return typeof value === 'string' && RUNTIME_HASH_PATTERN.test(value);
+}
+function strictBase64urlDecode(value) {
+    if (!value || !BASE64URL_PATTERN.test(value))
+        throw new Error('dispatch_assertion_invalid');
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value)
+        throw new Error('dispatch_assertion_invalid');
+    return decoded;
+}
+function parseRuntimeDispatchCompactV3(compact) {
+    if (typeof compact !== 'string' || Buffer.byteLength(compact, 'utf8') > MAX_RUNTIME_COMPACT_BYTES) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    const parts = compact.split('.');
+    if (parts.length !== 3 || parts.some((part) => !part))
+        throw new Error('dispatch_assertion_invalid');
+    let header;
+    let payload;
+    const headerBytes = strictBase64urlDecode(parts[0]);
+    const payloadBytes = strictBase64urlDecode(parts[1]);
+    const signature = strictBase64urlDecode(parts[2]);
+    try {
+        header = JSON.parse(headerBytes.toString('utf8'));
+        payload = JSON.parse(payloadBytes.toString('utf8'));
+    }
+    catch {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (!isRecord(header) || !isRecord(payload))
+        throw new Error('dispatch_assertion_invalid');
+    if (parts[0] !== Buffer.from(canonical(header), 'utf8').toString('base64url') ||
+        parts[1] !== Buffer.from(canonical(payload), 'utf8').toString('base64url')) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    return { encodedHeader: parts[0], encodedPayload: parts[1], signature, header, payload };
+}
+function assertRuntimeDispatchHeaderV3(header) {
+    if (!exactKeys(header, RUNTIME_DISPATCH_V3_HEADER_KEYS) ||
+        header.alg !== 'ES256' ||
+        header.typ !== 'privos-hub-runtime-dispatch+jws' ||
+        header.privos_protocol !== 3 ||
+        !runtimeId(header.kid)) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+}
+function assertRuntimeDispatchPayloadV3(payload) {
+    const context = payload.authorizationContext;
+    const expectedKeys = context === 'room'
+        ? [...RUNTIME_DISPATCH_V3_COMMON_KEYS, ...RUNTIME_DISPATCH_V3_ROOM_KEYS]
+        : RUNTIME_DISPATCH_V3_COMMON_KEYS;
+    if (!exactKeys(payload, expectedKeys))
+        throw new Error('dispatch_assertion_invalid');
+    if (payload.protocolVersion !== 3 ||
+        payload.type !== 'hub-runtime-dispatch-assertion' ||
+        !runtimeId(payload.iss) ||
+        !runtimeId(payload.aud) ||
+        !runtimeId(payload.jti) ||
+        typeof payload.nonce !== 'string' ||
+        !RUNTIME_NONCE_PATTERN.test(payload.nonce) ||
+        !positiveSafeInteger(payload.iat) ||
+        !positiveSafeInteger(payload.exp) ||
+        !runtimeId(payload.workspaceId) ||
+        !runtimeId(payload.deploymentId) ||
+        !runtimeId(payload.mcpAppId) ||
+        !['SELF_HOSTED_LOCAL', 'PUBLISHER_HOSTED'].includes(String(payload.executionMode)) ||
+        !runtimeId(payload.generationId) ||
+        !positiveSafeInteger(payload.generationNumber) ||
+        !runtimeId(payload.runtimeInstallationId) ||
+        typeof payload.manifestDigest !== 'string' ||
+        !RUNTIME_MANIFEST_DIGEST_PATTERN.test(payload.manifestDigest) ||
+        !runtimeHash(payload.resourceManifestHash) ||
+        !runtimeHash(payload.runtimeResourceInventoryHash) ||
+        !runtimeHash(payload.runtimeApprovalReceiptHash) ||
+        !positiveSafeInteger(payload.runtimeAuthorizationEpoch) ||
+        (context !== 'workspace' && context !== 'room') ||
+        payload.htm !== 'POST' ||
+        payload.htu !== '/mcp' ||
+        !runtimeHash(payload.bodyDigest)) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (context === 'room') {
+        if (!runtimeId(payload.roomId) ||
+            !runtimeId(payload.authorizationBindingId) ||
+            !runtimeHash(payload.bindingReceiptHash) ||
+            !runtimeHash(payload.bindingGrantHash) ||
+            !positiveSafeInteger(payload.bindingEpoch) ||
+            !positiveSafeInteger(payload.bindingTokenVersion)) {
+            throw new Error('dispatch_assertion_invalid');
+        }
+    }
+}
+function runtimeDispatchTrustHintV3(header, payload, body) {
+    return Object.freeze({
+        kid: header.kid,
+        workspaceId: payload.workspaceId,
+        deploymentId: payload.deploymentId,
+        mcpAppId: payload.mcpAppId,
+        executionMode: payload.executionMode,
+        generationId: payload.generationId,
+        generationNumber: payload.generationNumber,
+        runtimeInstallationId: payload.runtimeInstallationId,
+        authorizationContext: payload.authorizationContext,
+        ...(isExactRuntimeReadinessRpcV3(body) ? { preactivationReadiness: true } : {}),
+        ...(payload.authorizationContext === 'room'
+            ? { roomId: String(payload.roomId), authorizationBindingId: String(payload.authorizationBindingId) }
+            : {}),
+    });
+}
+export function assertRuntimeDispatchTrustConfigurationV3(value) {
+    if (!isRecord(value) || !exactKeys(value, ['affinity', 'hubKid', 'hubPublicJwk'])) {
+        throw new Error('runtime_dispatch_trust_invalid');
+    }
+    const jwk = value.hubPublicJwk;
+    const affinity = value.affinity;
+    if (typeof value.hubKid !== 'string' ||
+        !RUNTIME_HASH_PATTERN.test(value.hubKid) ||
+        !isRecord(jwk) ||
+        !exactKeys(jwk, ['crv', 'kty', 'x', 'y']) ||
+        jwk.kty !== 'EC' ||
+        jwk.crv !== 'P-256' ||
+        typeof jwk.x !== 'string' ||
+        typeof jwk.y !== 'string' ||
+        !RUNTIME_HASH_PATTERN.test(jwk.x) ||
+        !RUNTIME_HASH_PATTERN.test(jwk.y) ||
+        !isRecord(affinity)) {
+        throw new Error('runtime_dispatch_trust_invalid');
+    }
+    const optionalKeys = RUNTIME_DISPATCH_V3_AFFINITY_OPTIONAL_KEYS.filter((key) => affinity[key] !== undefined);
+    let canonicalPublicKey = false;
+    try {
+        const x = Buffer.from(String(jwk.x), 'base64url');
+        const y = Buffer.from(String(jwk.y), 'base64url');
+        const key = crypto.createPublicKey({ key: jwk, format: 'jwk' });
+        const exported = key.export({ format: 'jwk' });
+        canonicalPublicKey =
+            x.byteLength === 32 &&
+                y.byteLength === 32 &&
+                x.toString('base64url') === jwk.x &&
+                y.toString('base64url') === jwk.y &&
+                exported.kty === 'EC' &&
+                exported.crv === 'P-256' &&
+                exported.x === jwk.x &&
+                exported.y === jwk.y &&
+                !exported.d;
+    }
+    catch {
+        canonicalPublicKey = false;
+    }
+    if (!exactKeys(affinity, [...RUNTIME_DISPATCH_V3_AFFINITY_REQUIRED_KEYS, ...optionalKeys]) ||
+        !runtimeId(affinity.workspaceId) ||
+        !runtimeId(affinity.deploymentId) ||
+        !runtimeId(affinity.mcpAppId) ||
+        !['SELF_HOSTED_LOCAL', 'PUBLISHER_HOSTED'].includes(String(affinity.executionMode)) ||
+        !runtimeId(affinity.generationId) ||
+        !positiveSafeInteger(affinity.generationNumber) ||
+        !runtimeId(affinity.runtimeInstallationId) ||
+        typeof affinity.manifestDigest !== 'string' ||
+        !RUNTIME_MANIFEST_DIGEST_PATTERN.test(affinity.manifestDigest) ||
+        !runtimeHash(affinity.resourceManifestHash) ||
+        (affinity.runtimeResourceInventoryHash !== undefined && !runtimeHash(affinity.runtimeResourceInventoryHash)) ||
+        (affinity.runtimeApprovalReceiptHash !== undefined && !runtimeHash(affinity.runtimeApprovalReceiptHash)) ||
+        (affinity.runtimeAuthorizationEpoch !== undefined && !positiveSafeInteger(affinity.runtimeAuthorizationEpoch)) ||
+        !canonicalPublicKey ||
+        crypto.createHash('sha256').update(canonical({
+            crv: jwk.crv,
+            kty: jwk.kty,
+            x: jwk.x,
+            y: jwk.y,
+        })).digest('base64url') !== value.hubKid) {
+        throw new Error('runtime_dispatch_trust_invalid');
+    }
+}
+export function parseRuntimeDispatchTrustV3Json(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('runtime_dispatch_trust_invalid');
+    }
+    assertRuntimeDispatchTrustConfigurationV3(parsed);
+    return Object.freeze({
+        hubKid: parsed.hubKid,
+        hubPublicJwk: Object.freeze({ ...parsed.hubPublicJwk }),
+        affinity: Object.freeze({ ...parsed.affinity }),
+    });
+}
+function assertRuntimeDispatchTrustMatchesV3(trust, header, payload) {
+    try {
+        assertRuntimeDispatchTrustConfigurationV3(trust);
+    }
+    catch {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (trust.hubKid !== header.kid)
+        throw new Error('dispatch_assertion_invalid');
+    if (RUNTIME_DISPATCH_V3_AFFINITY_REQUIRED_KEYS.some((key) => trust.affinity[key] !== payload[key]) ||
+        RUNTIME_DISPATCH_V3_AFFINITY_OPTIONAL_KEYS.some((key) => trust.affinity[key] !== undefined && trust.affinity[key] !== payload[key])) {
+        throw new Error('dispatch_assertion_binding_mismatch');
+    }
+}
+export function sha256RuntimeDispatchBodyV3(body) {
+    return crypto.createHash('sha256').update(canonical(body), 'utf8').digest('base64url');
+}
+export function isUnsignedRuntimeReadinessRpcV3(body, security) {
+    if (security.mode !== 'required' ||
+        security.unsignedReadiness !== 'initialize-and-tools-list' ||
+        !isExactRuntimeReadinessRpcV3(body))
+        return false;
+    return true;
+}
+/** Exact readiness classification; it grants no authority without a verified signed assertion. */
+export function isExactRuntimeReadinessRpcV3(body) {
+    if (!isRecord(body))
+        return false;
+    if (body.method === 'initialize') {
+        return exactKeys(body, ['id', 'jsonrpc', 'method', 'params']) &&
+            body.jsonrpc === '2.0' &&
+            body.id === 1 &&
+            canonical(body.params) === canonical(UNSIGNED_RUNTIME_INITIALIZE_PARAMS_V3);
+    }
+    if (body.method === 'notifications/initialized') {
+        return exactKeys(body, ['jsonrpc', 'method']) && body.jsonrpc === '2.0';
+    }
+    if (body.method === 'tools/list') {
+        return exactKeys(body, ['id', 'jsonrpc', 'method', 'params']) &&
+            body.jsonrpc === '2.0' &&
+            body.id === 2 &&
+            isRecord(body.params) &&
+            exactKeys(body.params, []);
+    }
+    return false;
+}
+export async function verifyRuntimeDispatchAssertionV3(input) {
+    if (!input.security || input.security.mode !== 'required')
+        throw new Error('dispatch_assertion_invalid');
+    const parsed = parseRuntimeDispatchCompactV3(input.compact);
+    assertRuntimeDispatchHeaderV3(parsed.header);
+    assertRuntimeDispatchPayloadV3(parsed.payload);
+    const trust = typeof input.security.trust === 'function'
+        ? await input.security.trust(runtimeDispatchTrustHintV3(parsed.header, parsed.payload, input.body))
+        : input.security.trust;
+    assertRuntimeDispatchTrustMatchesV3(trust, parsed.header, parsed.payload);
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: trust.hubPublicJwk, format: 'jwk' });
+    }
+    catch {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (parsed.signature.byteLength !== 64 ||
+        !crypto.verify('sha256', Buffer.from(`${parsed.encodedHeader}.${parsed.encodedPayload}`, 'ascii'), { key, dsaEncoding: 'ieee-p1363' }, parsed.signature)) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (parsed.payload.iss !== `hub:${parsed.payload.deploymentId}` ||
+        parsed.payload.aud !== `mcp-runtime:${parsed.payload.mcpAppId}`) {
+        throw new Error('dispatch_assertion_binding_mismatch');
+    }
+    const now = input.now ?? input.security.now?.() ?? Math.floor(Date.now() / 1_000);
+    const skew = input.security.clockSkewSeconds ?? 5;
+    if (!Number.isSafeInteger(now) || now < 1 || !Number.isSafeInteger(skew) || skew < 0 || skew > 30) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (parsed.payload.iat > now + skew ||
+        parsed.payload.exp <= now ||
+        parsed.payload.exp <= parsed.payload.iat ||
+        parsed.payload.exp - parsed.payload.iat > 30) {
+        throw new Error('dispatch_assertion_time_invalid');
+    }
+    if (parsed.payload.bodyDigest !== sha256RuntimeDispatchBodyV3(input.body)) {
+        throw new Error('dispatch_assertion_body_mismatch');
+    }
+    if (input.relayAuthorization) {
+        assertRuntimeDispatchRelayAffinityV3(input.relayAuthorization, parsed.payload);
+    }
+    const consumed = await (input.security.replayConsumer ?? defaultRuntimeReplayConsumer).consume({
+        issuer: parsed.payload.iss,
+        jti: parsed.payload.jti,
+        nonce: parsed.payload.nonce,
+        expiresAt: parsed.payload.exp,
+        now,
+    });
+    if (!consumed)
+        throw new Error('dispatch_assertion_replayed');
+    return Object.freeze({ ...parsed.payload });
+}
+export function extractRuntimeDispatchRelayEnvelopeV3(value) {
+    if (!isRecord(value) || !isRecord(value.params) || !isRecord(value.params._meta)) {
+        throw new Error('dispatch_assertion_missing');
+    }
+    const meta = value.params._meta;
+    const authorization = meta.privosAuthorization;
+    if (!isRecord(authorization))
+        throw new Error('dispatch_assertion_missing');
+    const allowedAuthorizationKeys = authorization.authorizationBindingId === undefined
+        ? ['assertion', 'runtimeInstallationId']
+        : ['assertion', 'authorizationBindingId', 'runtimeInstallationId'];
+    if (!exactKeys(authorization, allowedAuthorizationKeys) ||
+        typeof authorization.assertion !== 'string' ||
+        !authorization.assertion ||
+        !runtimeId(authorization.runtimeInstallationId) ||
+        (authorization.authorizationBindingId !== undefined && !runtimeId(authorization.authorizationBindingId))) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    const logicalMeta = { ...meta };
+    delete logicalMeta.privosAuthorization;
+    delete logicalMeta.privosUser;
+    const logicalParams = { ...value.params };
+    if (Object.keys(logicalMeta).length === 0)
+        delete logicalParams._meta;
+    else
+        logicalParams._meta = logicalMeta;
+    const logicalRpc = { ...value, params: logicalParams };
+    return Object.freeze({
+        logicalRpc,
+        authorization: Object.freeze({
+            assertion: authorization.assertion,
+            runtimeInstallationId: authorization.runtimeInstallationId,
+            ...(authorization.authorizationBindingId !== undefined
+                ? { authorizationBindingId: authorization.authorizationBindingId }
+                : {}),
+        }),
+        ...(Object.prototype.hasOwnProperty.call(meta, 'privosUser') ? { userMetadata: meta.privosUser } : {}),
+    });
+}
+export function assertRuntimeDispatchRelayAffinityV3(authorization, verified) {
+    if (authorization.runtimeInstallationId !== verified.runtimeInstallationId ||
+        (verified.authorizationContext === 'workspace' && authorization.authorizationBindingId !== undefined) ||
+        (verified.authorizationContext === 'room' && authorization.authorizationBindingId !== verified.authorizationBindingId)) {
+        throw new Error('dispatch_assertion_binding_mismatch');
+    }
+}
+function canonical(value) {
+    return JSON.stringify(canonicalize(value));
+}
+const CLUSTER_DISPATCH_V3_COMMON_KEYS = [
+    'aud',
+    'authorizationContext',
+    'bodyDigest',
+    'clusterAppId',
+    'clusterId',
+    'deploymentId',
+    'exp',
+    'generationId',
+    'generationNumber',
+    'htm',
+    'htu',
+    'iat',
+    'iss',
+    'jti',
+    'manifestDigest',
+    'mcpAppId',
+    'nonce',
+    'protocolVersion',
+    'resourceManifestHash',
+    'runtimeApprovalReceiptHash',
+    'runtimeGrantEpoch',
+    'runtimeInstallationId',
+    'runtimeResourceInventoryHash',
+    'type',
+    'workspaceId',
+];
+const CLUSTER_DISPATCH_V3_ROOM_KEYS = [
+    ...CLUSTER_DISPATCH_V3_COMMON_KEYS,
+    'authorizationBindingId',
+    'bindingEpoch',
+    'bindingReceiptHash',
+    'roomId',
+];
+/**
+ * Verify the dispatch a Hub routes to an App Library runtime through its
+ * cluster. The assertion reuses the replica `typ` but carries generation
+ * affinity instead of replica affinity, so every field is checked against the
+ * generation the node attested — the runtime trusts no claim the broker did
+ * not already bind it to.
+ */
+export function verifyClusterDispatchAssertionV3(input) {
+    const generation = input.context.binding.generation;
+    if (!generation)
+        throw new Error('dispatch_assertion_invalid');
+    const parts = input.compact.split('.');
+    if (parts.length !== 3)
+        throw new Error('dispatch_assertion_invalid');
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (!isRecord(header) ||
+        !isRecord(payload) ||
+        !exactKeys(header, RUNTIME_DISPATCH_V3_HEADER_KEYS) ||
+        header.alg !== 'ES256' ||
+        header.typ !== 'privos-hub-dispatch+jws' ||
+        header.privos_protocol !== 3 ||
+        header.kid !== input.context.hubKid) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    const key = crypto.createPublicKey({ key: input.context.hubPublicJwk, format: 'jwk' });
+    if (!crypto.verify('sha256', Buffer.from(`${parts[0]}.${parts[1]}`, 'utf8'), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(parts[2], 'base64url')))
+        throw new Error('dispatch_assertion_invalid');
+    const now = input.now ?? Math.floor(Date.now() / 1000);
+    const room = payload.authorizationContext === 'room';
+    if (!exactKeys(payload, room ? CLUSTER_DISPATCH_V3_ROOM_KEYS : CLUSTER_DISPATCH_V3_COMMON_KEYS) ||
+        payload.protocolVersion !== 3 ||
+        payload.type !== 'hub-dispatch-assertion' ||
+        payload.aud !== 'privos-mcp-app' ||
+        payload.htm !== 'POST' ||
+        payload.htu !== '/mcp' ||
+        typeof payload.jti !== 'string' ||
+        typeof payload.iss !== 'string' ||
+        typeof payload.nonce !== 'string' ||
+        !Number.isInteger(payload.iat) ||
+        !Number.isInteger(payload.exp) ||
+        Number(payload.iat) > now + 5 ||
+        Number(payload.exp) < now ||
+        Number(payload.exp) - Number(payload.iat) > 30) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    if (payload.workspaceId !== input.context.binding.workspaceId ||
+        payload.runtimeInstallationId !== input.context.binding.installationId ||
+        payload.mcpAppId !== input.context.binding.mcpAppId ||
+        payload.runtimeApprovalReceiptHash !== input.context.binding.receiptHash ||
+        payload.runtimeGrantEpoch !== input.context.binding.grantEpoch ||
+        payload.clusterId !== generation.clusterId ||
+        payload.deploymentId !== generation.deploymentId ||
+        payload.generationId !== generation.generationId ||
+        payload.generationNumber !== generation.generationNumber ||
+        payload.manifestDigest !== generation.manifestDigest ||
+        payload.resourceManifestHash !== generation.resourceManifestHash ||
+        payload.runtimeResourceInventoryHash !== generation.runtimeResourceInventoryHash ||
+        typeof payload.clusterAppId !== 'string' ||
+        payload.clusterAppId.length === 0 ||
+        payload.bodyDigest !== sha256RuntimeDispatchBodyV3(input.body)) {
+        throw new Error('dispatch_assertion_binding_mismatch');
+    }
+    if (room && (typeof payload.roomId !== 'string' ||
+        payload.roomId.length === 0 ||
+        typeof payload.authorizationBindingId !== 'string' ||
+        payload.authorizationBindingId.length === 0 ||
+        typeof payload.bindingReceiptHash !== 'string' ||
+        !Number.isInteger(payload.bindingEpoch) ||
+        Number(payload.bindingEpoch) < 1)) {
+        throw new Error('dispatch_assertion_binding_mismatch');
+    }
+    if (!room && payload.authorizationContext !== 'workspace')
+        throw new Error('dispatch_assertion_invalid');
+    for (const [jti, exp] of replay)
+        if (exp < now)
+            replay.delete(jti);
+    if (replay.has(payload.jti))
+        throw new Error('dispatch_assertion_replayed');
+    replay.set(payload.jti, Number(payload.exp));
+    return Object.freeze({
+        jti: payload.jti,
+        issuedAt: Number(payload.iat),
+        expiresAt: Number(payload.exp),
+        authorizationContext: room ? 'room' : 'workspace',
+        ...(room ? { roomId: String(payload.roomId), authorizationBindingId: String(payload.authorizationBindingId) } : {}),
+    });
+}
+export function verifyDispatchAssertion(input) {
+    const parts = input.compact.split('.');
+    if (parts.length !== 3)
+        throw new Error('dispatch_assertion_invalid');
+    const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    if (header.alg !== 'ES256' || header.typ !== 'privos-hub-dispatch+jws' || header.kid !== input.context.hubKid) {
+        throw new Error('dispatch_assertion_invalid');
+    }
+    const key = crypto.createPublicKey({ key: input.context.hubPublicJwk, format: 'jwk' });
+    if (!crypto.verify('sha256', Buffer.from(`${parts[0]}.${parts[1]}`, 'utf8'), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(parts[2], 'base64url')))
+        throw new Error('dispatch_assertion_invalid');
+    const now = input.now ?? Math.floor(Date.now() / 1000);
+    if (payload.type !== 'hub-dispatch-assertion' ||
+        payload.aud !== 'privos-mcp-app' ||
+        payload.htm !== 'POST' ||
+        payload.htu !== '/mcp' ||
+        !Number.isInteger(payload.iat) ||
+        !Number.isInteger(payload.exp) ||
+        Number(payload.iat) > now + 5 ||
+        Number(payload.exp) < now ||
+        Number(payload.exp) - Number(payload.iat) > 30 ||
+        payload.workspaceId !== input.context.binding.workspaceId ||
+        payload.installationId !== input.context.binding.installationId ||
+        payload.mcpAppId !== input.context.binding.mcpAppId ||
+        payload.replicaId !== input.context.binding.replicaId ||
+        payload.receiptHash !== input.context.binding.receiptHash ||
+        payload.grantEpoch !== input.context.binding.grantEpoch ||
+        payload.bodyDigest !== `sha256:${crypto.createHash('sha256').update(canonical(input.body)).digest('hex')}` ||
+        typeof payload.jti !== 'string')
+        throw new Error('dispatch_assertion_binding_mismatch');
+    let actor;
+    if (payload.actor !== undefined) {
+        const candidate = payload.actor;
+        if (!candidate ||
+            typeof candidate !== 'object' ||
+            typeof candidate.subject !== 'string' ||
+            candidate.subject.length === 0 ||
+            (candidate.username !== undefined && typeof candidate.username !== 'string') ||
+            (candidate.roomId !== undefined && typeof candidate.roomId !== 'string'))
+            throw new Error('dispatch_assertion_actor_invalid');
+        actor = Object.freeze({
+            subject: candidate.subject,
+            ...(candidate.username ? { username: candidate.username } : {}),
+            ...(candidate.roomId ? { roomId: candidate.roomId } : {}),
+        });
+    }
+    for (const [jti, exp] of replay)
+        if (exp < now)
+            replay.delete(jti);
+    if (replay.has(payload.jti))
+        throw new Error('dispatch_assertion_replayed');
+    replay.set(payload.jti, Number(payload.exp));
+    return Object.freeze({
+        jti: payload.jti,
+        issuedAt: Number(payload.iat),
+        expiresAt: Number(payload.exp),
+        ...(actor ? { actor } : {}),
+    });
+}
+//# sourceMappingURL=dispatch-assertion.js.map