@sema-agent/connectors 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,181 @@
+# Changelog: @sema-agent/connectors
+
+All notable changes to this package are documented here. Released sections are
+frozen: once a version is published its section is never edited again; new text
+goes into the next version's section.
+
+## 0.1.0 (2026-10-14)
+
+### Added
+
+- Package entry point and the `sema-connector` bin. The entry exports
+  `resolveConfigDir`, `openFileSecrets`, `verifyAssertion`, `standaloneResolver`,
+  `hostedResolver`, `ASSERTION_HEADER`, `mount` and their types; it exports
+  nothing that turns a secret handle into a value.
+- The launcher behind the `sema-connector` bin (CN-003):
+  `sema-connector run <name> --mode standalone|hosted --transport stdio|http [--listen <ip>:<port>] [--config-dir <absolute path>]`.
+  Structural guards exit with code 2: a missing `run`, an unknown or repeated
+  argument, a missing or unknown `--mode` or `--transport`, standalone with
+  anything but stdio, hosted without http, without a `--listen <IPv4 or [IPv6]>:<port>`,
+  without `CONNECTOR_ASSERTION_ISSUER` or `CONNECTOR_ASSERTION_AUDIENCE` (CN-008),
+  with both key-set overrides, or with a key set URL that is neither `https://`
+  nor `http://` on `127.0.0.1` or `localhost`, or that carries credentials,
+  standalone without `--config-dir` or with one that is not an absolute path,
+  and hosted with `--config-dir` (CN-028). Standalone reads its configuration
+  directory from `--config-dir` only, never from an environment variable, so a
+  launcher started from a catalog entry with the engine's minimal environment
+  finds it (CN-028). A
+  connector `<name>` must be lowercase letters and digits in hyphen-separated
+  words, so that it can only name `@sema-agent/connector-<name>`. Error messages
+  never repeat argument or environment values.
+- Hosted http face (CN-008): hosted mode that passes the guards obtains its key
+  set once (inline `CONNECTOR_ASSERTION_JWKS`, `CONNECTOR_ASSERTION_JWKS_URL`, or
+  `<issuer>/.well-known/jwks.json`; one GET, no redirect, never refreshed; exit
+  2 when it cannot), resolves its connector (exit 4) and serves the subset of MCP
+  Streamable HTTP the MCP SDK client needs on `--listen`: every request needs a
+  verifiable assertion in `connector-assertion` (HTTP 401 with
+  `connector.bad_assertion` otherwise, a bare name header included); `POST /mcp`
+  carries one message answered as one JSON body (notifications and replies 202);
+  one session at a time, each with its own connector process, named by
+  `mcp-session-id` (400 without it, 404 for another, 409 for a second
+  `initialize`); `mcp-protocol-version` must match the version the connector
+  chose; `GET /mcp` answers 405 (no stream); `DELETE /mcp` ends the session's
+  connector down the teardown ladder and answers 204 once it is gone; requests
+  still waiting when a connector ends are answered with `connector.internal`;
+  `GET /status` serves the status value under the request's own principal. An
+  id stays taken until the connector answers it (409 meanwhile), a message or a
+  status read for a connector that has not read its earlier input answers 503,
+  and connector
+  stderr a stalled log has not taken one step after the connector exited is
+  dropped; only a JSON-RPC answer (result or error) ends a request's wait. A stop
+  signal ends the open session and exits 0, abandoning output a stalled log has
+  not taken one step later. Exit code 3 is gone.
+- An upstream message with a line break inside (a CR other than CRLF framing,
+  or an LF in an http body) is refused like an unreadable one: the connector
+  could read its parts as other messages than the one judged.
+- The message session judges every upstream message under the principal of the
+  request that carried it (the stdio path passes the anonymous principal), and
+  a `tools/list` reply or a status read under the principal of the request it
+  answers.
+- Resolution of `@sema-agent/connector-<name>` from the launcher's own
+  `package.json`; a package that cannot be resolved, or whose `bin` is not a
+  single name, exits with code 4 and `connector.not_installed`.
+- MCP stdio path of newline-delimited messages in both directions, with no
+  runtime dependencies. The connector's stdout and stderr and the upstream
+  input all go through one pump with flow control, so a slow reader holds the
+  writer back instead of growing the launcher's memory, whether or not the
+  output contains newlines. The connector's stderr passes as it arrives; the
+  two message streams are read whole line by line, up to 4 MiB per line,
+  through the stages below, and nothing is forwarded unread; messages no stage
+  concerns are forwarded byte for byte. From upstream, a line that is not a
+  single JSON-RPC message within 4 MiB, that repeats a key in any object, or
+  whose id is neither a string nor a number gets one error with `id` null and
+  `data.code` `connector.forbidden_scope` (CN-004). From the connector, a
+  reply is forwarded only for a request the launcher forwarded and has not seen
+  answered; a longer line, a batch or a message with a repeated key is dropped,
+  and every pending request gets a `connector.internal` error instead (CN-005),
+  so a tool result over 4 MiB arrives as that error; their ids stay taken until
+  the connector answers them (a request with one is refused meanwhile), so a
+  late reply never answers another request (CN-008). An id is also taken while
+  its request is pending, so a request reusing it is refused, not forwarded
+  (CN-031). Upstream input is also held
+  back while upstream does not read the launcher's own replies. Once a reader has gone
+  away, what can no longer be delivered to it is dropped instead of waited for;
+  after a stop signal has run the teardown below to its end, undelivered output
+  is abandoned. When the connector process ends, every request it left
+  unanswered gets a JSON-RPC error with `data.code` `connector.internal` naming
+  how it ended. The connector exiting with code 0 on its own exits the launcher
+  with code 0. A non-zero exit, a signal or stalled input (below) exits with
+  code 5 (with one error with `id` null when no request was pending).
+- The connector never outlives the launcher. It runs as its own process group,
+  so helper processes it starts (for example an upstream binary sharing its
+  stdio) go down with it. One teardown ladder, one second per step: end the
+  connector's input, then `SIGTERM` to the group, then `SIGKILL` to the group.
+  The end of upstream input enters the ladder at its first step; `SIGTERM`,
+  `SIGINT` or `SIGHUP` sent to the launcher enters it at the second, passing that
+  signal on; the connector's own exit enters it at the second for whatever is
+  left of its group. The ladder finishes inside an MCP stdio client's own
+  shutdown (2 seconds after closing input before `SIGTERM`, 2 seconds after
+  `SIGTERM` before `SIGKILL`). The exit code follows the connector process.
+- Stalled input (CN-025): input reaches the connector one piece of at most
+  1 KiB at a time; a connector that takes none of its waiting input for ten
+  teardown steps (10 seconds) has stopped reading and enters the ladder at its
+  second step, on both transports. Its unanswered requests get
+  `connector.internal` naming the stalled input, and the run is abnormal
+  (stdio: exit 5). A client that only closes its pipe while input waits behind a
+  connector that stopped reading no longer leaves the launcher and the connector
+  running.
+- Receipts (CN-031): one `connector-receipt-v1` receipt per `tools/call` that
+  names its tool, on both transports, minted by the launcher's session once the
+  call is settled and written as the stderr line `sema-connector: receipt <JSON>`:
+  `refused` when the launcher refused it, `ok` for a result, `failed` for a
+  result with `isError`, a connector error (with its `data.code` only when that
+  is a code of the closed set) or a `connector.internal` answer of the launcher.
+  It holds the connector and tool names, the start time, the duration, the
+  outcome and the error code, nothing of the call's arguments; a tool name that
+  carries a secret value is written as `[redacted]`. A connector
+  stderr line that would start a line of the launcher's stderr with
+  `sema-connector:` gets `connector: ` in front, so such lines are always the
+  launcher's own.
+- The connector process gets a fixed environment instead of the launcher's:
+  `HOME`, `LOGNAME`, `USER`, `PATH`, `SHELL`, `TERM`, `LANG`, `LC_ALL` and `TZ`
+  when present, and `<NAME>_FILE` with the path of each of its secret files
+  (CN-005).
+- `resolveConfigDir(env)`, for connector CLI subcommands: the configuration
+  directory is `CONFIG_LOCAL_DIR`, which must be an absolute path; not set or
+  empty is refused, and no other variable or default is read (CN-028).
+- Secrets (CN-004): `openFileSecrets({ configDir, connector })` lists handles
+  (name, connector, source, optional expiry; never the value) and stores values
+  atomically. Layout: `<configuration directory>/connectors/<name>/` with mode
+  0700, one 0600 file per handle, optional `<handle>.meta.json` with
+  `expiresAt`. Listing refuses wider modes, symbolic links and unreadable
+  expiry data; the launcher then exits with code 2 and `connector.internal`
+  before the connector starts. The launcher reads each value once, through a
+  function the entry does not export, into a per-launch 0600 copy that the
+  connector receives and that is removed when the launcher ends, and keeps
+  exactly those values out of what it forwards, looking for them also behind
+  JSON escapes: a connector stdout line carrying one is withheld, a reply
+  becoming a `connector.internal` error, and the connector's stderr is
+  scrubbed, also across writes. A line that fails to be judged is not
+  forwarded.
+- Principal (CN-004): `verifyAssertion(compactJws, { issuer, audience, keys, now })`
+  checks a JWS compact assertion with Node's crypto in the contract's order
+  (algorithm allow-list `EdDSA` / `ES256`, key by `kid` with matching key type
+  and no other `alg`, signature, presence of every required claim with `iat` a
+  non-negative integer and `jti` a non-empty string (CN-029), `iss`, `aud`,
+  `exp` with 30 seconds of tolerance, non-empty `sub` and `space`, `scope`
+  pattern); every refusal is
+  `connector.bad_assertion` with the name of the failed step and nothing of the
+  token. `hostedResolver` takes a principal only from a verifiable assertion in
+  the `connector-assertion` request header (`ASSERTION_HEADER`: the header
+  name is the engine's standard to define; this value is the proposal the
+  launcher reads until the engine exports its constant, CN-034; a hosted
+  catalog entry names it with the settings schema's `assertionHeader` key,
+  CN-020), so a bare name header is
+  refused; `standaloneResolver` is anonymous with scope
+  `tool:*`.
+- Scope (CN-004): one judge for `tools/list` and `tools/call`: a tool is
+  granted by `tool:*` or `tool:<name>` in the principal's scope. Tools outside
+  the grant are not listed, and calls to them are answered with JSON-RPC error
+  `-32602` and `connector.forbidden_scope` without reaching the connector.
+- Normalize (CN-005): listed tool annotations keep `title` and the hints at
+  their MCP default (`destructiveHint: true`, `idempotentHint: false`,
+  `openWorldHint: true`); `readOnlyHint`, other hint values and unknown keys
+  are removed.
+- Status (CN-005): the launcher serves `sema-connector://<name>/status`, a
+  `connector-status-v1` value with state `unauthorized`, `authorized` or
+  `expired` from the handles read at start and their expiry, and the tools
+  the reading request's principal sees; hosted, also at `GET /status`
+  (CN-008). Reads never reach the connector; `resources/list` gains the
+  status entry (merged with the connector's own resources, never repeated), and
+  `initialize` gains the resources capability when the connector has none.
+- `mount({ name, configDir })` (CN-005, CN-028): writes the standalone entry
+  into `<configDir>/config.d/mcp.json`, and the entry's arguments end with
+  `--config-dir <configDir>`, the same directory. `configDir` must be an
+  absolute path (used normalized); mount reads no environment variable and has
+  no default. The same entry again changes nothing, another entry under the
+  same name (also one naming another configuration directory, or none) is
+  refused as a conflict, every other byte of the file is kept, and the file is
+  replaced atomically with its mode kept, under a lock file that excludes
+  concurrent mount writers and that only its holder removes. Refusals are
+  returned as reasons.

package/bin/sema-connector.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// sema-connector: the launcher executable (CN-003). Command line, exit codes and resolution rule:
+// docs/ARCHITECTURE.md. Implementation: src/launcher.ts, built to dist/launcher.js.
+import { main } from '../dist/launcher.js'
+
+process.exit(await main(process.argv.slice(2), process.env))

package/dist/config-dir.d.ts

@@ -0,0 +1,11 @@
+export type Env = Readonly<Record<string, string | undefined>>;
+export declare const given: (v: string | undefined) => v is string;
+export declare function absoluteDir(value: unknown): string | null;
+export type ConfigDirResolution = {
+    readonly ok: true;
+    readonly dir: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare function resolveConfigDir(env: Env): ConfigDirResolution;

package/dist/config-dir.js

@@ -0,0 +1,12 @@
+import { isAbsolute, resolve } from 'node:path';
+export const given = (v) => v !== undefined && v !== '';
+export function absoluteDir(value) {
+    return typeof value === 'string' && isAbsolute(value) ? resolve(value) : null;
+}
+export function resolveConfigDir(env) {
+    const value = env.CONFIG_LOCAL_DIR;
+    if (value === undefined || value === '')
+        return { ok: false, reason: 'CONFIG_LOCAL_DIR is not set: it names the configuration directory as an absolute path, and there is no default' };
+    const dir = absoluteDir(value);
+    return dir === null ? { ok: false, reason: 'CONFIG_LOCAL_DIR must be an absolute path' } : { ok: true, dir };
+}

package/dist/connector-name.d.ts

@@ -0,0 +1 @@
+export declare const CONNECTOR_NAME: RegExp;

package/dist/connector-name.js

@@ -0,0 +1 @@
+export const CONNECTOR_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;

package/dist/http.d.ts

@@ -0,0 +1,26 @@
+import type { Principal, PrincipalResolver } from './principal.js';
+import { type JsonRpcId } from './session.js';
+export declare const MCP_PATH = "/mcp";
+export declare const STATUS_PATH = "/status";
+export interface ConnectorLink {
+    send(raw: Buffer, principal: Principal): void;
+    readStatus(id: JsonRpcId, principal: Principal): void;
+    busy(): boolean;
+    end(signal?: NodeJS.Signals): void;
+    readonly gone: Promise<void>;
+}
+export type StartConnector = (deliver: (line: string) => void) => ConnectorLink;
+export interface HttpFaceOptions {
+    readonly host: string;
+    readonly port: number;
+    readonly resolver: PrincipalResolver;
+    readonly start: StartConnector;
+}
+export type HttpFace = {
+    readonly ok: true;
+    close(signal: NodeJS.Signals): Promise<void>;
+} | {
+    readonly ok: false;
+    readonly code: string;
+};
+export declare function serveHttp(options: HttpFaceOptions): Promise<HttpFace>;

package/dist/http.js

@@ -0,0 +1,264 @@
+import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { INSPECT_LIMIT_BYTES, INTERNAL_ERROR, INVALID_REQUEST, STATUS_BEFORE_INITIALIZE, errorLine, idKey, isId, read } from './session.js';
+export const MCP_PATH = '/mcp';
+export const STATUS_PATH = '/status';
+const SESSION_HEADER = 'mcp-session-id';
+const VERSION_HEADER = 'mcp-protocol-version';
+const BAD_ASSERTION = 'connector.bad_assertion';
+const NOT_TAKEN = 'connector.forbidden_scope';
+const INTERNAL = 'connector.internal';
+class Live {
+    id = randomBytes(16).toString('hex');
+    waiting = new Map();
+    current = null;
+    initialized = false;
+    version = null;
+    ending = false;
+    link;
+    gone;
+    constructor(start, released) {
+        this.link = start((line) => this.deliver(line));
+        this.gone = this.link.gone.then(() => released(this));
+    }
+    deliver(line) {
+        let m;
+        try {
+            m = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (m === null || typeof m !== 'object' || Array.isArray(m) || 'method' in m || !('result' in m || 'error' in m))
+            return;
+        const id = m.id;
+        if (isId(id))
+            this.waiting.get(idKey(id))?.answer(line);
+        else if (id === null)
+            this.current?.answer(line);
+    }
+    end(signal) {
+        this.ending = true;
+        this.link.end(signal);
+        return this.gone;
+    }
+}
+const refusal = (status, message, dataCode = NOT_TAKEN) => [status, errorLine(null, INVALID_REQUEST, message, dataCode)];
+function reply(res, status, body, headers = {}) {
+    if (res.headersSent || res.writableEnded)
+        return;
+    const text = body === undefined ? undefined : body.endsWith('\n') ? body.slice(0, -1) : body;
+    res.writeHead(status, { ...(text !== undefined ? { 'content-type': 'application/json' } : {}), ...headers });
+    res.end(text);
+}
+function single(req, name) {
+    const values = req.headersDistinct[name];
+    if (values === undefined)
+        return undefined;
+    return values.length === 1 ? values[0] : null;
+}
+const sameId = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+function readBody(req) {
+    return new Promise((resolve) => {
+        const parts = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size <= INSPECT_LIMIT_BYTES)
+                parts.push(chunk);
+            else
+                parts.length = 0;
+        });
+        req.on('end', () => resolve(size > INSPECT_LIMIT_BYTES ? 'oversized' : Buffer.concat(parts)));
+        req.on('error', () => resolve(null));
+        req.on('close', () => resolve(null));
+    });
+}
+const isJsonMediaType = (value) => (value ?? '').split(';')[0]?.trim().toLowerCase() === 'application/json';
+export function serveHttp(options) {
+    let live = null;
+    let closing = false;
+    const open = new Set();
+    const released = (l) => {
+        if (live === l)
+            live = null;
+    };
+    const named = (req) => {
+        const sid = single(req, SESSION_HEADER);
+        if (sid === undefined)
+            return refusal(400, 'the request names no session: open one with initialize, then send its mcp-session-id with every request');
+        if (sid === null)
+            return refusal(400, 'mcp-session-id is given more than once');
+        if (live === null || !live.initialized || live.ending || !sameId(sid, live.id))
+            return refusal(404, 'no open session has this mcp-session-id');
+        return live;
+    };
+    const judge = (l, body, principal, res, opening) => {
+        const r = read(body);
+        const id = r.kind === 'message' && typeof r.m.method === 'string' && isId(r.m.id) ? r.m.id : null;
+        const key = id === null ? null : idKey(id);
+        if (key !== null && l.waiting.has(key)) {
+            reply(res, ...refusal(409, 'a request with this id is already waiting for its answer'));
+            return;
+        }
+        if (l.link.busy()) {
+            reply(res, ...refusal(503, 'the connector has not read its earlier input yet; send the request again later', INTERNAL));
+            return;
+        }
+        let answered = false;
+        const waiter = {
+            id: id ?? '',
+            answer: (line) => {
+                if (key !== null)
+                    l.waiting.delete(key);
+                if (answered)
+                    return;
+                answered = true;
+                const m = JSON.parse(line);
+                const headers = {};
+                if (opening) {
+                    if (m.result !== undefined && m.result !== null && !l.ending) {
+                        l.initialized = true;
+                        l.version = typeof m.result.protocolVersion === 'string' ? m.result.protocolVersion : null;
+                        headers[SESSION_HEADER] = l.id;
+                    }
+                    else
+                        void l.end();
+                }
+                reply(res, m.id === null ? 400 : 200, line, headers);
+            },
+        };
+        if (key !== null)
+            l.waiting.set(key, waiter);
+        res.on('close', () => {
+            if (answered)
+                return;
+            answered = true;
+            if (opening)
+                void l.end();
+        });
+        l.current = waiter;
+        try {
+            l.link.send(body, principal);
+        }
+        finally {
+            l.current = null;
+        }
+        if (!answered && key === null) {
+            answered = true;
+            if (opening)
+                void l.end();
+            reply(res, 202);
+        }
+    };
+    const post = async (req, res, principal) => {
+        if (!isJsonMediaType(req.headers['content-type']))
+            return reply(res, ...refusal(415, 'the body must be one JSON-RPC message with Content-Type application/json'));
+        const body = await readBody(req);
+        if (body === null)
+            return;
+        if (body === 'oversized')
+            return reply(res, ...refusal(413, `the body is over ${INSPECT_LIMIT_BYTES / (1024 * 1024)} MiB, more than the launcher reads to check a message against the granted scope`));
+        if (closing)
+            return reply(res, ...refusal(503, 'the launcher is stopping', INTERNAL));
+        const r = read(body);
+        if (r.kind === 'message' && r.m.method === 'initialize') {
+            if (live !== null)
+                return reply(res, ...refusal(409, 'a session is already open: the launcher serves one session at a time'));
+            live = new Live(options.start, released);
+            return judge(live, body, principal, res, true);
+        }
+        const l = named(req);
+        if (Array.isArray(l))
+            return reply(res, ...l);
+        const version = single(req, VERSION_HEADER);
+        if (version === null || (version !== undefined && version !== l.version))
+            return reply(res, ...refusal(400, 'mcp-protocol-version is not the version the connector answered initialize with'));
+        judge(l, body, principal, res, false);
+    };
+    const remove = async (req, res) => {
+        const l = named(req);
+        if (Array.isArray(l))
+            return reply(res, ...l);
+        await l.end();
+        reply(res, 204);
+    };
+    const status = (res, principal) => {
+        const l = live;
+        if (l === null || !l.initialized || l.ending)
+            return reply(res, 503, errorLine(null, INTERNAL_ERROR, STATUS_BEFORE_INITIALIZE, INTERNAL));
+        if (l.link.busy())
+            return reply(res, ...refusal(503, 'the connector has not read its earlier input yet; read the status again later', INTERNAL));
+        const id = `status/${randomUUID()}`;
+        const key = idKey(id);
+        const waiter = {
+            id,
+            answer: (line) => {
+                l.waiting.delete(key);
+                const m = JSON.parse(line);
+                const text = m.result?.contents?.[0]?.text;
+                if (typeof text === 'string')
+                    reply(res, 200, text);
+                else
+                    reply(res, 503, line);
+            },
+        };
+        l.waiting.set(key, waiter);
+        try {
+            l.link.readStatus(id, principal);
+        }
+        catch {
+            l.waiting.delete(key);
+            reply(res, 503, errorLine(id, INTERNAL_ERROR, 'the status could not be read', INTERNAL));
+        }
+    };
+    const failed = (res) => () => reply(res, 500, errorLine(null, INTERNAL_ERROR, 'the launcher could not handle this request', INTERNAL));
+    const handle = (req, res) => {
+        open.add(res);
+        res.on('close', () => open.delete(res));
+        if (closing)
+            return reply(res, ...refusal(503, 'the launcher is stopping', INTERNAL), { connection: 'close' });
+        const verdict = options.resolver.resolve({ headers: req.headersDistinct });
+        if (!verdict.ok)
+            return reply(res, ...refusal(401, verdict.reason, BAD_ASSERTION));
+        const path = new URL(req.url ?? '/', 'http://launcher.invalid').pathname;
+        if (path === STATUS_PATH) {
+            if (req.method === 'GET')
+                return status(res, verdict.principal);
+            return reply(res, ...refusal(405, '/status takes GET only'), { allow: 'GET' });
+        }
+        if (path !== MCP_PATH)
+            return reply(res, ...refusal(404, 'the launcher serves /mcp and /status only'));
+        if (req.method === 'POST')
+            return void post(req, res, verdict.principal).catch(failed(res));
+        if (req.method === 'DELETE')
+            return void remove(req, res).catch(failed(res));
+        return reply(res, ...refusal(405, '/mcp takes POST and DELETE: the evaluation form opens no stream (GET)'), { allow: 'POST, DELETE' });
+    };
+    return new Promise((resolve) => {
+        const server = createServer((req, res) => {
+            try {
+                handle(req, res);
+            }
+            catch {
+                failed(res)();
+            }
+        });
+        server.once('error', (e) => resolve({ ok: false, code: e.code ?? 'unknown' }));
+        server.listen(options.port, options.host, () => {
+            resolve({
+                ok: true,
+                close: async (signal) => {
+                    closing = true;
+                    server.close();
+                    const l = live;
+                    if (l !== null)
+                        await l.end(signal);
+                    const finished = [...open].map((res) => new Promise((done) => (res.writableFinished ? done() : res.once('close', () => done()))));
+                    await Promise.race([Promise.all(finished), new Promise((done) => setTimeout(done, 1_000).unref())]);
+                    server.closeAllConnections();
+                },
+            });
+        });
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { resolveConfigDir } from './config-dir.js';
+export type { ConfigDirResolution, Env } from './config-dir.js';
+export { openFileSecrets } from './secrets.js';
+export type { FileSecrets, PutOptions, SecretHandle, SecretListing } from './secrets.js';
+export { ASSERTION_HEADER, hostedResolver, standaloneResolver, verifyAssertion } from './principal.js';
+export type { AnonymousPrincipal, AssertionPrincipal, AssertionStep, Principal, PrincipalResolver, PrincipalResult, RequestContext, VerifyOptions, VerifyResult, } from './principal.js';
+export { mount } from './mount.js';
+export type { MountOptions, MountRefusal, MountResult } from './mount.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export { resolveConfigDir } from './config-dir.js';
+export { openFileSecrets } from './secrets.js';
+export { ASSERTION_HEADER, hostedResolver, standaloneResolver, verifyAssertion } from './principal.js';
+export { mount } from './mount.js';

package/dist/json-text.d.ts

@@ -0,0 +1,11 @@
+export declare function skipWhitespace(t: string, i: number): number;
+export declare function endOfString(t: string, i: number): number;
+export declare function endOfValue(t: string, i: number): number;
+export interface Span {
+    readonly key: string;
+    readonly start: number;
+    readonly valueStart: number;
+    readonly valueEnd: number;
+}
+export declare function spansOf(t: string, open: number, keyed: boolean): Span[];
+export declare function hasRepeatedKey(t: string): boolean;

package/dist/json-text.js

@@ -0,0 +1,93 @@
+const WHITESPACE = ' \t\n\r';
+export function skipWhitespace(t, i) {
+    while (i < t.length && WHITESPACE.includes(t.charAt(i)))
+        i++;
+    return i;
+}
+export function endOfString(t, i) {
+    for (i++; i < t.length; i++) {
+        if (t[i] === '\\')
+            i++;
+        else if (t[i] === '"')
+            return i + 1;
+    }
+    return t.length;
+}
+export function endOfValue(t, i) {
+    if (t[i] === '"')
+        return endOfString(t, i);
+    if (t[i] === '{' || t[i] === '[') {
+        let depth = 0;
+        while (i < t.length) {
+            const c = t[i];
+            if (c === '"') {
+                i = endOfString(t, i);
+                continue;
+            }
+            if (c === '{' || c === '[')
+                depth++;
+            else if ((c === '}' || c === ']') && --depth === 0)
+                return i + 1;
+            i++;
+        }
+        return t.length;
+    }
+    while (i < t.length && !',}]'.includes(t.charAt(i)) && !WHITESPACE.includes(t.charAt(i)))
+        i++;
+    return i;
+}
+export function spansOf(t, open, keyed) {
+    const close = keyed ? '}' : ']';
+    const spans = [];
+    let i = skipWhitespace(t, open + 1);
+    while (i < t.length && t[i] !== close) {
+        const start = i;
+        let key = '';
+        if (keyed) {
+            const keyEnd = endOfString(t, i);
+            key = JSON.parse(t.slice(i, keyEnd));
+            i = skipWhitespace(t, skipWhitespace(t, keyEnd) + 1);
+        }
+        const valueStart = i;
+        const valueEnd = endOfValue(t, i);
+        spans.push({ key, start, valueStart, valueEnd });
+        i = skipWhitespace(t, valueEnd);
+        if (t[i] === ',')
+            i = skipWhitespace(t, i + 1);
+    }
+    return spans;
+}
+export function hasRepeatedKey(t) {
+    const objects = [];
+    let expectKey = false;
+    for (let i = 0; i < t.length; i++) {
+        const c = t[i];
+        if (c === '"') {
+            const end = endOfString(t, i);
+            const top = objects[objects.length - 1];
+            if (expectKey && top instanceof Set) {
+                const key = JSON.parse(t.slice(i, end));
+                if (top.has(key))
+                    return true;
+                top.add(key);
+                expectKey = false;
+            }
+            i = end - 1;
+        }
+        else if (c === '{') {
+            objects.push(new Set());
+            expectKey = true;
+        }
+        else if (c === '[') {
+            objects.push(null);
+            expectKey = false;
+        }
+        else if (c === '}' || c === ']') {
+            objects.pop();
+            expectKey = false;
+        }
+        else if (c === ',')
+            expectKey = objects[objects.length - 1] instanceof Set;
+    }
+    return false;
+}

package/dist/jwks.d.ts

@@ -0,0 +1,18 @@
+import { type Env } from './config-dir.js';
+export type KeySetSource = {
+    readonly kind: 'inline';
+    readonly text: string;
+} | {
+    readonly kind: 'url';
+    readonly from: string;
+    readonly url: URL;
+};
+export type KeySet = {
+    readonly ok: true;
+    readonly keys: unknown;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
+export declare function keySetSource(env: Env, issuer: string): KeySetSource | string;
+export declare function obtainKeySet(source: KeySetSource): Promise<KeySet>;