@softacus-software/elwis-mcp-core 0.1.0

package/dist/esm/errors.d.ts

@@ -0,0 +1,40 @@
+export declare class ElwisApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    readonly body: unknown;
+    constructor(status: number, path: string, body: unknown);
+}
+export declare function IsElwisApiError(error: unknown): error is ElwisApiError;
+export declare function ErrorStatus(error: unknown): number | undefined;
+export declare class AmbiguityError extends Error {
+    readonly candidates: Array<{
+        id: string;
+        name: string;
+    }>;
+    constructor(message: string, candidates: Array<{
+        id: string;
+        name: string;
+    }>);
+}
+export declare class NotFoundError extends Error {
+    readonly kind: string;
+    readonly nameOrAlias: string;
+    readonly candidates: Array<{
+        id: string;
+        name: string;
+    }>;
+    constructor(kind: string, nameOrAlias: string, candidates?: Array<{
+        id: string;
+        name: string;
+    }>);
+}
+export declare class AppScopeError extends Error {
+    constructor(ref: string);
+}
+export declare class TenantMismatchError extends Error {
+    constructor(expected: string, actual: string | null);
+}
+export declare class NoTenantError extends Error {
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAOxD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAStE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAE7C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAK7E;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAE7C,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAM;CAOpG;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,GAAG,EAAE,MAAM;CAIxB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAMpD;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAKvC"}

package/dist/esm/errors.js

@@ -0,0 +1,63 @@
+export class ElwisApiError extends Error {
+    status;
+    path;
+    body;
+    constructor(status, path, body) {
+        super(`ELWIS API ${status} for ${path}`);
+        this.name = 'ElwisApiError';
+        this.status = status;
+        this.path = path;
+        this.body = body;
+    }
+}
+export function IsElwisApiError(error) {
+    if (error instanceof ElwisApiError)
+        return true;
+    return (typeof error === 'object' &&
+        error !== null &&
+        typeof error.status === 'number' &&
+        typeof error.name === 'string' &&
+        /^Elwis(Api|Http)Error$/.test(error.name));
+}
+export function ErrorStatus(error) {
+    return IsElwisApiError(error) ? error.status : undefined;
+}
+export class AmbiguityError extends Error {
+    candidates;
+    constructor(message, candidates) {
+        super(message);
+        this.name = 'AmbiguityError';
+        this.candidates = candidates;
+    }
+}
+export class NotFoundError extends Error {
+    kind;
+    nameOrAlias;
+    candidates;
+    constructor(kind, nameOrAlias, candidates = []) {
+        super(`No active ${kind} named "${nameOrAlias}" in this application`);
+        this.name = 'NotFoundError';
+        this.kind = kind;
+        this.nameOrAlias = nameOrAlias;
+        this.candidates = candidates;
+    }
+}
+export class AppScopeError extends Error {
+    constructor(ref) {
+        super(`Application "${ref}" is outside the configured application allowlist`);
+        this.name = 'AppScopeError';
+    }
+}
+export class TenantMismatchError extends Error {
+    constructor(expected, actual) {
+        super(`No data was read or written. This connection is locked to tenant ${expected}, but the access token belongs to a different tenant (${actual ?? 'unknown'}).`);
+        this.name = 'TenantMismatchError';
+    }
+}
+export class NoTenantError extends Error {
+    constructor() {
+        super('No tenant is set, so there is no way to know which ELWIS environment to work in.');
+        this.name = 'NoTenantError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,IAAI,CAAU;IAEvB,YAAY,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,KAAK,CAAC,aAAa,MAAM,QAAQ,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,aAAa;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QAC1D,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACtD,wBAAwB,CAAC,IAAI,CAAE,KAA0B,CAAC,IAAI,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,UAAU,CAAsC;IAEzD,YAAY,OAAe,EAAE,UAA+C;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,UAAU,CAAsC;IAEzD,YAAY,IAAY,EAAE,WAAmB,EAAE,aAAkD,EAAE;QACjG,KAAK,CAAC,aAAa,IAAI,WAAW,WAAW,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,GAAW;QACrB,KAAK,CAAC,gBAAgB,GAAG,mDAAmD,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,QAAgB,EAAE,MAAqB;QACjD,KAAK,CACH,oEAAoE,QAAQ,yDAAyD,MAAM,IAAI,SAAS,IAAI,CAC7J,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC;QACE,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/esm/host/elwis-jwt-verifier.d.ts

@@ -0,0 +1,9 @@
+import type { TokenVerifier } from './identity.js';
+export type ResolveTokenIdentity = (token: string) => Promise<{
+    tenantId: string | null;
+}>;
+export declare function ElwisJwtVerifier(options: {
+    baseUrl: string;
+    resolveIdentity: ResolveTokenIdentity;
+}): TokenVerifier;
+//# sourceMappingURL=elwis-jwt-verifier.d.ts.map

package/dist/esm/host/elwis-jwt-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elwis-jwt-verifier.d.ts","sourceRoot":"","sources":["../../../src/host/elwis-jwt-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,eAAe,CAAC;AAiBrE,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAE3F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,oBAAoB,CAAC;CACvC,GAAG,aAAa,CAuBhB"}

package/dist/esm/host/elwis-jwt-verifier.js

@@ -0,0 +1,37 @@
+const TENANT_ID_PATTERN = /^[a-f0-9]{24}$/i;
+function AssertLooksLikeAToken(token) {
+    const parts = token.split('.');
+    const payload = parts[1];
+    if (parts.length !== 3 || payload === undefined) {
+        throw new Error('the bearer value is not a valid token');
+    }
+    try {
+        JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('the bearer value is not a valid token');
+    }
+}
+export function ElwisJwtVerifier(options) {
+    return {
+        async verify(token) {
+            AssertLooksLikeAToken(token);
+            let resolved;
+            try {
+                resolved = await options.resolveIdentity(token);
+            }
+            catch (e) {
+                throw new Error(`could not resolve the bearer token against ELWIS: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            if (resolved.tenantId === null || !TENANT_ID_PATTERN.test(resolved.tenantId)) {
+                throw new Error(`the resolved identity has no valid tenant id (got: ${resolved.tenantId ?? 'null'})`);
+            }
+            return {
+                token,
+                baseUrl: options.baseUrl,
+                tenantId: resolved.tenantId,
+            };
+        },
+    };
+}
+//# sourceMappingURL=elwis-jwt-verifier.js.map

package/dist/esm/host/elwis-jwt-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elwis-jwt-verifier.js","sourceRoot":"","sources":["../../../src/host/elwis-jwt-verifier.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAID,MAAM,UAAU,gBAAgB,CAAC,OAGhC;IACC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAE7B,IAAI,QAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;YACxG,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/host/file-link-store.d.ts

@@ -0,0 +1,13 @@
+import type { LinkedSession, LinkStore } from './session-broker.js';
+export declare class FileLinkStore implements LinkStore {
+    private readonly path;
+    private entries;
+    private writing;
+    constructor(path: string);
+    private Load;
+    private Flush;
+    get(key: string): Promise<LinkedSession | null>;
+    put(key: string, session: LinkedSession): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+//# sourceMappingURL=file-link-store.d.ts.map

package/dist/esm/host/file-link-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-link-store.d.ts","sourceRoot":"","sources":["../../../src/host/file-link-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKpE,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,OAAO,CAAoC;gBAEvC,IAAI,EAAE,MAAM;IAKxB,OAAO,CAAC,IAAI;IAgBZ,OAAO,CAAC,KAAK;IAWP,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAI/C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMzC"}

package/dist/esm/host/file-link-store.js

@@ -0,0 +1,56 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+const FILE_MODE = 0o600;
+const DIRECTORY_MODE = 0o700;
+export class FileLinkStore {
+    path;
+    entries;
+    writing = Promise.resolve();
+    constructor(path) {
+        this.path = path;
+        this.entries = this.Load();
+    }
+    Load() {
+        let raw;
+        try {
+            raw = readFileSync(this.path, 'utf8');
+        }
+        catch {
+            return {};
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                return {};
+            return parsed;
+        }
+        catch {
+            return {};
+        }
+    }
+    Flush() {
+        const snapshot = JSON.stringify(this.entries);
+        this.writing = this.writing.then(() => {
+            mkdirSync(dirname(this.path), { recursive: true, mode: DIRECTORY_MODE });
+            const temporary = `${this.path}.${process.pid}.tmp`;
+            writeFileSync(temporary, snapshot, { mode: FILE_MODE });
+            renameSync(temporary, this.path);
+        }, () => { });
+        return this.writing;
+    }
+    async get(key) {
+        return this.entries[key] ?? null;
+    }
+    async put(key, session) {
+        this.entries = { ...this.entries, [key]: session };
+        await this.Flush();
+    }
+    async delete(key) {
+        const { [key]: removed, ...rest } = this.entries;
+        if (removed === undefined)
+            return;
+        this.entries = rest;
+        await this.Flush();
+    }
+}
+//# sourceMappingURL=file-link-store.js.map

package/dist/esm/host/file-link-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-link-store.js","sourceRoot":"","sources":["../../../src/host/file-link-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,MAAM,OAAO,aAAa;IACP,IAAI,CAAS;IACtB,OAAO,CAAgC;IACvC,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAEO,IAAI;QACV,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtF,OAAO,MAAuC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACpD,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAAsB;QAC3C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/esm/host/identity.d.ts

@@ -0,0 +1,13 @@
+export interface ResolvedIdentity {
+    token: string;
+    baseUrl: string;
+    tenantId?: string;
+}
+export interface TokenVerifier {
+    verify(token: string, resource: string): Promise<ResolvedIdentity>;
+}
+export interface McpServerLike {
+    connect(transport: unknown): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/esm/host/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/host/identity.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/esm/host/identity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.js.map

package/dist/esm/host/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/host/identity.ts"],"names":[],"mappings":""}

package/dist/esm/host/index.d.ts

@@ -0,0 +1,15 @@
+export type { McpServerLike, ResolvedIdentity, TokenVerifier } from './identity.js';
+export type { ServeOptions, ServeHandle, McpEndpoint, LinkOptions, LinkOutcome, LinkRequest } from './serve-http.js';
+export { CreateLinkTicket, ReadLinkTicket } from './link-ticket.js';
+export type { LinkTicketClaims } from './link-ticket.js';
+export { ServeMcpHttp } from './serve-http.js';
+export { ElwisJwtVerifier } from './elwis-jwt-verifier.js';
+export { VerifyOidcToken } from './oidc-token.js';
+export type { OidcClaims, JsonWebKeySet } from './oidc-token.js';
+export { OidcVerifier } from './oidc-verifier.js';
+export { ElwisSessionBroker, MemoryLinkStore, AccountNotLinkedError, LinkKey } from './session-broker.js';
+export { FileLinkStore } from './file-link-store.js';
+export type { LinkStore, LinkedSession, SessionBroker, SubjectClaims } from './session-broker.js';
+export type { ResolveTokenIdentity } from './elwis-jwt-verifier.js';
+export { RunHostConformance } from '../conformance/host.conformance.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/host/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/host/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpF,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACrH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElG,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/esm/host/index.js

@@ -0,0 +1,9 @@
+export { CreateLinkTicket, ReadLinkTicket } from './link-ticket.js';
+export { ServeMcpHttp } from './serve-http.js';
+export { ElwisJwtVerifier } from './elwis-jwt-verifier.js';
+export { VerifyOidcToken } from './oidc-token.js';
+export { OidcVerifier } from './oidc-verifier.js';
+export { ElwisSessionBroker, MemoryLinkStore, AccountNotLinkedError, LinkKey } from './session-broker.js';
+export { FileLinkStore } from './file-link-store.js';
+export { RunHostConformance } from '../conformance/host.conformance.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/host/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/esm/host/link-ticket.d.ts

@@ -0,0 +1,17 @@
+export interface LinkTicketClaims {
+    iss: string;
+    sub: string;
+    email?: string;
+    resource?: string;
+}
+export interface LinkTicketOptions {
+    secret: string;
+    now?: number;
+    ttlSeconds?: number;
+}
+export declare const DEFAULT_LINK_TICKET_TTL_SECONDS = 600;
+export declare function CreateLinkTicket(claims: LinkTicketClaims, options: LinkTicketOptions): string;
+export declare function ReadLinkTicket(ticket: string, options: LinkTicketOptions): LinkTicketClaims & {
+    exp: number;
+};
+//# sourceMappingURL=link-ticket.d.ts.map

package/dist/esm/host/link-ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-ticket.d.ts","sourceRoot":"","sources":["../../../src/host/link-ticket.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAgBnD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAW7F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CA8B7G"}

package/dist/esm/host/link-ticket.js

@@ -0,0 +1,54 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export const DEFAULT_LINK_TICKET_TTL_SECONDS = 600;
+function Sign(body, secret) {
+    return createHmac('sha256', secret).update(body).digest('base64url');
+}
+function Matches(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export function CreateLinkTicket(claims, options) {
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const body = {
+        iss: claims.iss,
+        sub: claims.sub,
+        ...(claims.email ? { email: claims.email } : {}),
+        ...(claims.resource ? { resource: claims.resource } : {}),
+        exp: now + (options.ttlSeconds ?? DEFAULT_LINK_TICKET_TTL_SECONDS),
+    };
+    const encoded = Buffer.from(JSON.stringify(body)).toString('base64url');
+    return `${encoded}.${Sign(encoded, options.secret)}`;
+}
+export function ReadLinkTicket(ticket, options) {
+    const parts = ticket.split('.');
+    const [encoded, signature] = parts;
+    if (parts.length !== 2 || !encoded || !signature) {
+        throw new Error('the link ticket is malformed');
+    }
+    if (!Matches(signature, Sign(encoded, options.secret))) {
+        throw new Error('the link ticket signature does not verify');
+    }
+    let body;
+    try {
+        body = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('the link ticket payload is not valid JSON');
+    }
+    const parsed = body;
+    if (typeof parsed.iss !== 'string' || typeof parsed.sub !== 'string' || typeof parsed.exp !== 'number') {
+        throw new Error('the link ticket payload is incomplete');
+    }
+    if (parsed.exp <= (options.now ?? Math.floor(Date.now() / 1000))) {
+        throw new Error('the link ticket has expired');
+    }
+    return {
+        iss: parsed.iss,
+        sub: parsed.sub,
+        ...(typeof parsed.email === 'string' ? { email: parsed.email } : {}),
+        ...(typeof parsed.resource === 'string' ? { resource: parsed.resource } : {}),
+        exp: parsed.exp,
+    };
+}
+//# sourceMappingURL=link-ticket.js.map

package/dist/esm/host/link-ticket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-ticket.js","sourceRoot":"","sources":["../../../src/host/link-ticket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAMnD,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAwB,EAAE,OAA0B;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAe;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC;KACnE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAA0B;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,IAA2B,CAAC;IAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;AACJ,CAAC"}

package/dist/esm/host/oidc-token.d.ts

@@ -0,0 +1,20 @@
+export interface JsonWebKeySet {
+    keys: Array<Record<string, unknown>>;
+}
+export interface OidcClaims {
+    sub: string;
+    iss: string;
+    aud: string[];
+    exp: number;
+    email?: string;
+    [claim: string]: unknown;
+}
+export interface VerifyOidcTokenOptions {
+    issuer: string;
+    resource: string;
+    jwks: JsonWebKeySet;
+    now?: number;
+    clockSkewSeconds?: number;
+}
+export declare function VerifyOidcToken(token: string, options: VerifyOidcTokenOptions): Promise<OidcClaims>;
+//# sourceMappingURL=oidc-token.d.ts.map

package/dist/esm/host/oidc-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-token.d.ts","sourceRoot":"","sources":["../../../src/host/oidc-token.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAoCD,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiEzG"}

package/dist/esm/host/oidc-token.js

@@ -0,0 +1,93 @@
+import { webcrypto } from 'node:crypto';
+const DEFAULT_CLOCK_SKEW_SECONDS = 60;
+const ALGORITHMS = {
+    RS256: { importParams: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, verifyParams: { name: 'RSASSA-PKCS1-v1_5' } },
+    RS384: { importParams: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-384' }, verifyParams: { name: 'RSASSA-PKCS1-v1_5' } },
+    RS512: { importParams: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-512' }, verifyParams: { name: 'RSASSA-PKCS1-v1_5' } },
+    ES256: { importParams: { name: 'ECDSA', namedCurve: 'P-256' }, verifyParams: { name: 'ECDSA', hash: 'SHA-256' } },
+    ES384: { importParams: { name: 'ECDSA', namedCurve: 'P-384' }, verifyParams: { name: 'ECDSA', hash: 'SHA-384' } },
+    ES512: { importParams: { name: 'ECDSA', namedCurve: 'P-521' }, verifyParams: { name: 'ECDSA', hash: 'SHA-512' } },
+};
+function DecodeSegment(segment, what) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error(`the token ${what} is not valid JSON`);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`the token ${what} is not an object`);
+    }
+    return parsed;
+}
+function Audiences(claim) {
+    if (typeof claim === 'string')
+        return [claim];
+    if (Array.isArray(claim))
+        return claim.filter((entry) => typeof entry === 'string');
+    return [];
+}
+function SameResource(a, b) {
+    return a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+}
+export async function VerifyOidcToken(token, options) {
+    const parts = token.split('.');
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    if (parts.length !== 3 || !encodedHeader || !encodedPayload || encodedSignature === undefined) {
+        throw new Error('the bearer value is not a JWS compact serialization');
+    }
+    const header = DecodeSegment(encodedHeader, 'header');
+    const algorithm = typeof header.alg === 'string' ? ALGORITHMS[header.alg] : undefined;
+    if (!algorithm) {
+        throw new Error(`unsupported token signing algorithm: ${String(header.alg)}`);
+    }
+    const kid = typeof header.kid === 'string' ? header.kid : null;
+    const candidates = options.jwks.keys.filter(key => kid === null || key.kid === kid);
+    if (candidates.length === 0) {
+        throw new Error(`no key in the issuer key set matches kid ${kid ?? '(absent)'}`);
+    }
+    const signed = Buffer.from(`${encodedHeader}.${encodedPayload}`, 'utf8');
+    const signature = Buffer.from(encodedSignature, 'base64url');
+    let verified = false;
+    for (const jwk of candidates) {
+        let key;
+        try {
+            key = await webcrypto.subtle.importKey('jwk', jwk, algorithm.importParams, false, ['verify']);
+        }
+        catch {
+            continue;
+        }
+        if (await webcrypto.subtle.verify(algorithm.verifyParams, key, signature, signed)) {
+            verified = true;
+            break;
+        }
+    }
+    if (!verified) {
+        throw new Error('the token signature does not verify against the issuer key set');
+    }
+    const payload = DecodeSegment(encodedPayload, 'payload');
+    if (payload.iss !== options.issuer) {
+        throw new Error(`the token issuer ${String(payload.iss)} is not the configured issuer`);
+    }
+    const audiences = Audiences(payload.aud);
+    if (!audiences.some(entry => SameResource(entry, options.resource))) {
+        throw new Error(`the token audience does not include this resource (${options.resource})`);
+    }
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const skew = options.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
+    if (typeof payload.exp !== 'number') {
+        throw new Error('the token has no exp claim');
+    }
+    if (payload.exp <= now) {
+        throw new Error('the token has expired');
+    }
+    if (typeof payload.nbf === 'number' && payload.nbf - skew > now) {
+        throw new Error('the token is not valid yet');
+    }
+    if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+        throw new Error('the token has no sub claim');
+    }
+    return { ...payload, sub: payload.sub, iss: options.issuer, aud: audiences, exp: payload.exp };
+}
+//# sourceMappingURL=oidc-token.js.map

package/dist/esm/host/oidc-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-token.js","sourceRoot":"","sources":["../../../src/host/oidc-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAuBxC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,MAAM,UAAU,GAAmE;IACjF,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACpH,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACpH,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACpH,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACjH,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACjH,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;CAClH,CAAC;AAEF,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACrG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,OAA+B;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAA2B,EAAE,SAAS,CAAC,YAA6C,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,YAA6C,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACnH,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEzD,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IACpE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAgB,CAAC;AAC/G,CAAC"}

package/dist/esm/host/oidc-verifier.d.ts

@@ -0,0 +1,14 @@
+import type { TokenVerifier } from './identity.js';
+import type { SessionBroker } from './session-broker.js';
+export type FetchJson = (url: string) => Promise<unknown>;
+export interface OidcVerifierOptions {
+    issuer: string;
+    broker: SessionBroker;
+    fetchJson?: FetchJson;
+    clockSkewSeconds?: number;
+    keyCacheSeconds?: number;
+    now?: () => number;
+}
+export declare const DEFAULT_KEY_CACHE_SECONDS = 600;
+export declare function OidcVerifier(options: OidcVerifierOptions): TokenVerifier;
+//# sourceMappingURL=oidc-verifier.d.ts.map

package/dist/esm/host/oidc-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../../src/host/oidc-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAyB7C,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CAsCxE"}

package/dist/esm/host/oidc-verifier.js

@@ -0,0 +1,63 @@
+import { VerifyOidcToken } from './oidc-token.js';
+export const DEFAULT_KEY_CACHE_SECONDS = 600;
+const DISCOVERY_SUFFIX = '/.well-known/openid-configuration';
+async function DefaultFetchJson(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`${url} answered ${res.status}`);
+    return res.json();
+}
+function KeyIds(jwks) {
+    return new Set(jwks.keys.map(key => (typeof key.kid === 'string' ? key.kid : '')));
+}
+function TokenKeyId(token) {
+    const header = token.split('.')[0];
+    if (!header)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(header, 'base64url').toString('utf8'));
+        return typeof parsed.kid === 'string' ? parsed.kid : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function OidcVerifier(options) {
+    const fetchJson = options.fetchJson ?? DefaultFetchJson;
+    const now = options.now ?? Date.now;
+    const cacheMs = (options.keyCacheSeconds ?? DEFAULT_KEY_CACHE_SECONDS) * 1000;
+    let jwksUri = null;
+    let cached = null;
+    let cachedAt = 0;
+    async function KeySet(refresh) {
+        if (cached && !refresh && now() - cachedAt < cacheMs)
+            return cached;
+        if (jwksUri === null) {
+            const discovery = await fetchJson(`${options.issuer.replace(/\/+$/, '')}${DISCOVERY_SUFFIX}`);
+            if (typeof discovery.jwks_uri !== 'string') {
+                throw new Error(`the issuer ${options.issuer} published no jwks_uri`);
+            }
+            jwksUri = discovery.jwks_uri;
+        }
+        cached = await fetchJson(jwksUri);
+        cachedAt = now();
+        return cached;
+    }
+    return {
+        async verify(token, resource) {
+            let jwks = await KeySet(false);
+            const kid = TokenKeyId(token);
+            if (kid !== null && !KeyIds(jwks).has(kid)) {
+                jwks = await KeySet(true);
+            }
+            const claims = await VerifyOidcToken(token, {
+                issuer: options.issuer,
+                resource,
+                jwks,
+                clockSkewSeconds: options.clockSkewSeconds,
+            });
+            return options.broker.resolve(claims);
+        },
+    };
+}
+//# sourceMappingURL=oidc-verifier.js.map

package/dist/esm/host/oidc-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../../src/host/oidc-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAC;AAatE,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAE7D,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,IAAmB;IACjC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAClG,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC,GAAG,IAAI,CAAC;IAC9E,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,GAAG,QAAQ,GAAG,OAAO;YAAE,OAAO,MAAM,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAA2B,CAAC;YACxH,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,MAAM,wBAAwB,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAkB,CAAC;QACnD,QAAQ,GAAG,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;YAC1C,IAAI,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ;gBACR,IAAI;gBACJ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}