@softacus-software/elwis-mcp-core 0.1.0

package/dist/esm/host/serve-http.d.ts

@@ -0,0 +1,42 @@
+import { type IncomingMessage } from 'node:http';
+import type { McpServerLike, ResolvedIdentity, TokenVerifier } from './identity.js';
+import { type LinkTicketClaims } from './link-ticket.js';
+export interface McpEndpoint {
+    path: string;
+    resource: string;
+}
+export type LinkOutcome = {
+    status: 'linked';
+} | {
+    status: 'needs-sign-in';
+    signInUrl: string;
+};
+export interface LinkRequest {
+    headers: IncomingMessage['headers'];
+}
+export interface LinkOptions {
+    path?: string;
+    secret: string;
+    complete: (claims: LinkTicketClaims, request: LinkRequest) => Promise<LinkOutcome>;
+}
+export interface ServeOptions {
+    factory: (identity: ResolvedIdentity) => McpServerLike;
+    verifier: TokenVerifier;
+    resource?: string;
+    endpoints?: McpEndpoint[];
+    authorizationServers: string[];
+    link?: LinkOptions;
+    port?: number;
+    host?: string;
+    path?: string;
+    maxConcurrentVerifications?: number;
+    maxConcurrentSessions?: number;
+}
+export declare const DEFAULT_MAX_CONCURRENT_VERIFICATIONS = 50;
+export declare const DEFAULT_MAX_CONCURRENT_SESSIONS = 200;
+export interface ServeHandle {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function ServeMcpHttp(options: ServeOptions): Promise<ServeHandle>;
+//# sourceMappingURL=serve-http.d.ts.map

package/dist/esm/host/serve-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-http.d.ts","sourceRoot":"","sources":["../../../src/host/serve-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAuB,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,aAAa,CAAC;IACvD,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAqGD,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6K9E"}

package/dist/esm/host/serve-http.js

@@ -0,0 +1,278 @@
+import { createServer } from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { ReadLinkTicket } from './link-ticket.js';
+export const DEFAULT_MAX_CONCURRENT_VERIFICATIONS = 50;
+export const DEFAULT_MAX_CONCURRENT_SESSIONS = 200;
+const METADATA_PATH = '/.well-known/oauth-protected-resource';
+function BearerToken(req) {
+    const header = req.headers.authorization;
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match?.[1] ?? null;
+}
+function MetadataUrl(resource) {
+    const url = new URL(resource);
+    const isHttp = url.protocol === 'http:' || url.protocol === 'https:';
+    if (!isHttp || url.username || url.password || url.search || url.hash) {
+        throw new Error('resource must be an absolute http(s) URL without userinfo, query or fragment');
+    }
+    const suffix = url.pathname === '/' ? '' : url.pathname;
+    return `${url.origin}${METADATA_PATH}${suffix}`;
+}
+function ValidatedCap(name, value, defaultValue) {
+    if (value === undefined)
+        return defaultValue;
+    if (!Number.isInteger(value) || value < 1) {
+        throw new Error(`${name} must be a finite integer of at least 1, got: ${value}`);
+    }
+    return value;
+}
+function HeaderSafeValue(value) {
+    return value.replace(/[^\x20-\x7e]/g, '').replace(/"/g, "'");
+}
+const MAX_LINK_BODY_BYTES = 8192;
+function Html(value) {
+    return value.replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+}
+function LinkPage(res, status, heading, detail, form = '') {
+    res.writeHead(status, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'x-frame-options': 'DENY',
+        'content-security-policy': "frame-ancestors 'none'",
+    });
+    res.end(`<!doctype html><meta charset=utf-8><title>${Html(heading)}</title>`
+        + `<body style="font:16px/1.5 system-ui,sans-serif;max-width:34rem;margin:15vh auto;padding:0 1.5rem">`
+        + `<h1 style="font-size:1.4rem;margin:0 0 .5rem">${Html(heading)}</h1>`
+        + `<p style="color:#555;margin:0">${Html(detail)}</p>${form}`);
+}
+function ConfirmLinkPage(res, path, ticket, claims) {
+    const who = claims.email ?? claims.sub;
+    const form = `<form method="post" action="${Html(path)}" style="margin-top:1.5rem">`
+        + `<input type="hidden" name="ticket" value="${Html(ticket)}">`
+        + `<button type="submit" style="font:inherit;padding:.6rem 1.2rem;border-radius:8px;border:0;background:#1f4fd1;color:#fff;cursor:pointer">Link my ELWIS account</button>`
+        + `</form>`;
+    LinkPage(res, 200, 'Link your ELWIS account', `The assistant signed in as ${who} asks to work in ELWIS with your current ELWIS session. Continue only if ${who} is you.`, form);
+}
+async function ReadFormTicket(req) {
+    let size = 0;
+    const chunks = [];
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_LINK_BODY_BYTES)
+            throw new Error('the link request is too large');
+        chunks.push(chunk);
+    }
+    return new URLSearchParams(Buffer.concat(chunks).toString('utf8')).get('ticket');
+}
+function LinkUrlOf(error) {
+    const candidate = error?.linkUrl;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+function Challenge(res, metadataUrl, description, linkUrl) {
+    const safeDescription = HeaderSafeValue(description);
+    const safeLink = linkUrl ? HeaderSafeValue(linkUrl) : null;
+    res.writeHead(401, {
+        'www-authenticate': `Bearer resource_metadata="${metadataUrl}", error="invalid_token", error_description="${safeDescription}"`
+            + (safeLink ? `, link_url="${safeLink}"` : ''),
+        'content-type': 'application/json',
+    });
+    res.end(JSON.stringify({ error: 'invalid_token', error_description: safeDescription, ...(safeLink ? { link_url: safeLink } : {}) }));
+}
+function ResolveEndpoints(options) {
+    if (options.endpoints?.length) {
+        if (options.resource !== undefined) {
+            throw new Error('pass either resource or endpoints, not both');
+        }
+        return options.endpoints;
+    }
+    if (options.resource === undefined) {
+        throw new Error('one of resource or endpoints is required');
+    }
+    return [{ path: options.path ?? '/mcp', resource: options.resource }];
+}
+export async function ServeMcpHttp(options) {
+    const host = options.host ?? '127.0.0.1';
+    const endpoints = ResolveEndpoints(options).map(e => ({ ...e, metadataUrl: MetadataUrl(e.resource) }));
+    const byPath = new Map(endpoints.map(e => [e.path, e]));
+    const byMetadataPath = new Map(endpoints.map(e => [new URL(e.metadataUrl).pathname, e]));
+    const firstEndpoint = endpoints[0];
+    const maxConcurrentVerifications = ValidatedCap('maxConcurrentVerifications', options.maxConcurrentVerifications, DEFAULT_MAX_CONCURRENT_VERIFICATIONS);
+    const maxConcurrentSessions = ValidatedCap('maxConcurrentSessions', options.maxConcurrentSessions, DEFAULT_MAX_CONCURRENT_SESSIONS);
+    let inFlightVerifications = 0;
+    let liveSessions = 0;
+    const usedTickets = new Map();
+    const server = createServer(async (req, res) => {
+        try {
+            const requestPath = req.url?.split('?')[0] ?? '';
+            const metadataFor = requestPath === METADATA_PATH ? firstEndpoint : byMetadataPath.get(requestPath);
+            if (req.method === 'GET' && metadataFor) {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({
+                    resource: metadataFor.resource,
+                    authorization_servers: options.authorizationServers,
+                    bearer_methods_supported: ['header'],
+                }));
+                return;
+            }
+            const linkPath = options.link?.path ?? '/link';
+            if (options.link && requestPath === linkPath) {
+                if (req.method !== 'GET' && req.method !== 'POST') {
+                    res.writeHead(405, { allow: 'GET, POST' });
+                    res.end();
+                    return;
+                }
+                let ticket;
+                let claims;
+                try {
+                    ticket = req.method === 'POST' ? await ReadFormTicket(req) : new URL(req.url ?? '/', 'http://host').searchParams.get('ticket');
+                    if (!ticket)
+                        throw new Error('a link ticket is required');
+                    claims = ReadLinkTicket(ticket, { secret: options.link.secret });
+                    if (usedTickets.has(ticket))
+                        throw new Error('this link was already used; ask the assistant for a new one');
+                }
+                catch (e) {
+                    LinkPage(res, 400, 'This link cannot be used', e instanceof Error ? e.message : 'the link ticket was rejected');
+                    return;
+                }
+                if (req.method === 'GET') {
+                    ConfirmLinkPage(res, linkPath, ticket, claims);
+                    return;
+                }
+                let outcome;
+                try {
+                    outcome = await options.link.complete(claims, { headers: req.headers });
+                }
+                catch (e) {
+                    LinkPage(res, 502, 'ELWIS could not complete the sign-in', e instanceof Error ? e.message : 'unknown failure');
+                    return;
+                }
+                if (outcome.status === 'needs-sign-in') {
+                    let target;
+                    try {
+                        target = new URL(outcome.signInUrl);
+                    }
+                    catch {
+                        LinkPage(res, 500, 'The sign-in address is not usable', 'the configured sign-in url is not an absolute url');
+                        return;
+                    }
+                    if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+                        LinkPage(res, 500, 'The sign-in address is not usable', 'the configured sign-in url is not http or https');
+                        return;
+                    }
+                    res.writeHead(302, { location: target.toString(), 'cache-control': 'no-store' });
+                    res.end();
+                    return;
+                }
+                const nowSeconds = Math.floor(Date.now() / 1000);
+                for (const [used, exp] of usedTickets)
+                    if (exp <= nowSeconds)
+                        usedTickets.delete(used);
+                usedTickets.set(ticket, claims.exp);
+                LinkPage(res, 200, 'Account linked', 'You can close this tab and go back to your assistant.');
+                return;
+            }
+            const endpoint = byPath.get(requestPath);
+            if (!endpoint) {
+                res.writeHead(404, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'not_found' }));
+                return;
+            }
+            if (req.method === 'GET') {
+                res.writeHead(405, { 'content-type': 'application/json', allow: 'POST' });
+                res.end(JSON.stringify({ error: 'method_not_allowed', error_description: 'GET is not supported; this server does not send server-initiated messages' }));
+                return;
+            }
+            const token = BearerToken(req);
+            if (!token) {
+                Challenge(res, endpoint.metadataUrl, 'a bearer token is required');
+                return;
+            }
+            if (inFlightVerifications >= maxConcurrentVerifications) {
+                res.writeHead(503, { 'content-type': 'application/json', 'retry-after': '1' });
+                res.end(JSON.stringify({ error: 'too_many_requests', error_description: 'too many verifications in flight; try again shortly' }));
+                return;
+            }
+            let identity;
+            inFlightVerifications++;
+            try {
+                identity = await options.verifier.verify(token, endpoint.resource);
+            }
+            catch (e) {
+                const linkUrl = LinkUrlOf(e);
+                Challenge(res, endpoint.metadataUrl, linkUrl ? 'this account is not linked to ELWIS yet' : 'the token was rejected', linkUrl);
+                return;
+            }
+            finally {
+                inFlightVerifications--;
+            }
+            if (liveSessions >= maxConcurrentSessions) {
+                res.writeHead(503, { 'content-type': 'application/json', 'retry-after': '1' });
+                res.end(JSON.stringify({ error: 'too_many_requests', error_description: 'too many sessions in flight; try again shortly' }));
+                return;
+            }
+            liveSessions++;
+            let sessionReleased = false;
+            const releaseSession = () => {
+                if (sessionReleased)
+                    return;
+                sessionReleased = true;
+                liveSessions--;
+            };
+            try {
+                const mcp = options.factory(identity);
+                const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+                res.on('close', () => {
+                    transport.close().catch(() => { });
+                    mcp.close().catch(() => { });
+                    releaseSession();
+                });
+                await mcp.connect(transport);
+                await transport.handleRequest(req, res);
+            }
+            catch (e) {
+                releaseSession();
+                throw e;
+            }
+        }
+        catch {
+            if (!res.headersSent) {
+                res.writeHead(500, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'internal_error' }));
+            }
+            else {
+                res.end();
+            }
+        }
+    });
+    await new Promise((resolve, reject) => {
+        const onListenError = (err) => reject(err);
+        server.once('error', onListenError);
+        server.listen(options.port ?? 0, host, () => {
+            server.removeListener('error', onListenError);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    return {
+        port,
+        close: () => new Promise((resolve, reject) => {
+            server.closeAllConnections();
+            server.close(err => {
+                if (!err) {
+                    resolve();
+                    return;
+                }
+                if (err.code === 'ERR_SERVER_NOT_RUNNING') {
+                    resolve();
+                    return;
+                }
+                reject(err);
+            });
+        }),
+    };
+}
+//# sourceMappingURL=serve-http.js.map

package/dist/esm/host/serve-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-http.js","sourceRoot":"","sources":["../../../src/host/serve-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAmCzE,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAOnD,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACrE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACxD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB,EAAE,YAAoB;IACjF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iDAAiD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAY,CAAA,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc,EAAE,IAAI,GAAG,EAAE;IAC/F,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,MAAM;QACzB,yBAAyB,EAAE,wBAAwB;KACpD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,OAAO,CAAC,UAAU;UACxE,qGAAqG;UACrG,iDAAiD,IAAI,CAAC,OAAO,CAAC,OAAO;UACrE,kCAAkC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,IAAY,EAAE,MAAc,EAAE,MAAwB;IAClG,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,+BAA+B,IAAI,CAAC,IAAI,CAAC,8BAA8B;UAChF,6CAA6C,IAAI,CAAC,MAAM,CAAC,IAAI;UAC7D,wKAAwK;UACxK,SAAS,CAAC;IACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,8BAA8B,GAAG,4EAA4E,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC;AAClL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAoB;IAChD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,SAAS,GAAI,KAA+B,EAAE,OAAO,CAAC;IAC5D,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,WAAmB,EAAE,WAAmB,EAAE,OAAuB;IACvG,MAAM,eAAe,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,kBAAkB,EAAE,6BAA6B,WAAW,gDAAgD,eAAe,GAAG;cAC1H,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvI,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAqB;IAC7C,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IACpC,MAAM,0BAA0B,GAAG,YAAY,CAAC,4BAA4B,EAAE,OAAO,CAAC,0BAA0B,EAAE,oCAAoC,CAAC,CAAC;IACxJ,MAAM,qBAAqB,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;IACpI,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,CAAC;gBACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,qBAAqB,EAAE,OAAO,CAAC,oBAAoB;oBACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;iBACrC,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC3C,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,MAAqB,CAAC;gBAC1B,IAAI,MAA0C,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,aAAa,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/H,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC1D,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjE,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBAC9G,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;oBAChH,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,OAAoB,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBAC/G,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBACvC,IAAI,MAAW,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,EAAE,mDAAmD,CAAC,CAAC;wBAC7G,OAAO;oBACT,CAAC;oBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAChE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,EAAE,iDAAiD,CAAC,CAAC;wBAC3G,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;oBACjF,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,WAAW;oBAAE,IAAI,GAAG,IAAI,UAAU;wBAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvF,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,uDAAuD,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,2EAA2E,EAAE,CAAC,CAAC,CAAC;gBACzJ,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,IAAI,qBAAqB,IAAI,0BAA0B,EAAE,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,qDAAqD,EAAE,CAAC,CAAC,CAAC;gBAClI,OAAO;YACT,CAAC;YACD,IAAI,QAA0B,CAAC;YAC/B,qBAAqB,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC7B,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;gBAC9H,OAAO;YACT,CAAC;oBAAS,CAAC;gBACT,qBAAqB,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,YAAY,IAAI,qBAAqB,EAAE,CAAC;gBAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,YAAY,EAAE,CAAC;YACf,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,MAAM,cAAc,GAAG,GAAS,EAAE;gBAChC,IAAI,eAAe;oBAAE,OAAO;gBAC5B,eAAe,GAAG,IAAI,CAAC;gBACvB,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;gBACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAClC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC5B,cAAc,EAAE,CAAC;gBACnB,CAAC,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC7B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,cAAc,EAAE,CAAC;gBACjB,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,aAAa,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACjB,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAK,GAA6B,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;oBACrE,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/esm/host/session-broker.d.ts

@@ -0,0 +1,45 @@
+import type { ResolvedIdentity } from './identity.js';
+import type { OidcClaims } from './oidc-token.js';
+export type SubjectClaims = Pick<OidcClaims, 'iss' | 'sub' | 'email'>;
+export interface LinkedSession {
+    elwisToken: string;
+    tenantId: string;
+    elwisUserId: string;
+    linkedAt: number;
+}
+export interface LinkStore {
+    get(key: string): Promise<LinkedSession | null>;
+    put(key: string, session: LinkedSession): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export declare class MemoryLinkStore implements LinkStore {
+    private readonly entries;
+    get(key: string): Promise<LinkedSession | null>;
+    put(key: string, session: LinkedSession): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export declare class AccountNotLinkedError extends Error {
+    readonly linkUrl: string;
+    constructor(linkUrl: string, reason: string);
+}
+export declare function LinkKey(claims: SubjectClaims): string;
+export interface CheckedSession {
+    tenantId: string;
+    userId: string;
+    email?: string;
+    rotatedToken?: string;
+}
+export type CheckSession = (token: string) => Promise<CheckedSession>;
+export interface SessionBrokerOptions {
+    store: LinkStore;
+    baseUrl: string;
+    expectedTenant: string;
+    linkUrlFor: (claims: SubjectClaims) => string;
+    checkSession: CheckSession;
+}
+export interface SessionBroker {
+    resolve(claims: SubjectClaims): Promise<ResolvedIdentity>;
+    link(claims: SubjectClaims, elwisToken: string): Promise<LinkedSession>;
+}
+export declare function ElwisSessionBroker(options: SessionBrokerOptions): SessionBroker;
+//# sourceMappingURL=session-broker.d.ts.map

package/dist/esm/host/session-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-broker.d.ts","sourceRoot":"","sources":["../../../src/host/session-broker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,qBAAa,eAAgB,YAAW,SAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAEtD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAI/C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAEtE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC;IAC9C,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAyD/E"}

package/dist/esm/host/session-broker.js

@@ -0,0 +1,77 @@
+export class MemoryLinkStore {
+    entries = new Map();
+    async get(key) {
+        return this.entries.get(key) ?? null;
+    }
+    async put(key, session) {
+        this.entries.set(key, session);
+    }
+    async delete(key) {
+        this.entries.delete(key);
+    }
+}
+export class AccountNotLinkedError extends Error {
+    linkUrl;
+    constructor(linkUrl, reason) {
+        super(`this account is not linked to ELWIS (${reason}); link it at ${linkUrl}`);
+        this.name = 'AccountNotLinkedError';
+        this.linkUrl = linkUrl;
+    }
+}
+export function LinkKey(claims) {
+    return `${encodeURIComponent(claims.iss)}:${encodeURIComponent(claims.sub)}`;
+}
+export function ElwisSessionBroker(options) {
+    async function AssertTenant(token) {
+        const checked = await options.checkSession(token);
+        if (checked.tenantId !== options.expectedTenant) {
+            throw new Error(`the ELWIS session belongs to tenant ${checked.tenantId}, not ${options.expectedTenant}`);
+        }
+        return checked;
+    }
+    function AssertSamePerson(signedInAs, elwisEmail) {
+        if (!signedInAs)
+            throw new Error('the assistant sign-in carries no email, so it cannot be matched to an ELWIS account');
+        if (signedInAs.toLowerCase() !== elwisEmail?.toLowerCase()) {
+            throw new Error(`the assistant is signed in as ${signedInAs}, but this browser is signed in to ELWIS as ${elwisEmail ?? 'an account without an email'}; sign in to ELWIS as ${signedInAs} and open the link again`);
+        }
+    }
+    return {
+        async resolve(claims) {
+            const key = LinkKey(claims);
+            const linked = await options.store.get(key);
+            if (!linked) {
+                throw new AccountNotLinkedError(options.linkUrlFor(claims), 'no linked session');
+            }
+            let checked;
+            try {
+                checked = await options.checkSession(linked.elwisToken);
+            }
+            catch {
+                await options.store.delete(key);
+                throw new AccountNotLinkedError(options.linkUrlFor(claims), 'the linked session is no longer valid');
+            }
+            if (checked.tenantId !== options.expectedTenant) {
+                throw new Error(`the linked ELWIS session belongs to tenant ${checked.tenantId}, not ${options.expectedTenant}`);
+            }
+            const token = checked.rotatedToken ?? linked.elwisToken;
+            if (checked.rotatedToken !== undefined && checked.rotatedToken !== linked.elwisToken) {
+                await options.store.put(key, { ...linked, elwisToken: checked.rotatedToken });
+            }
+            return { token, baseUrl: options.baseUrl, tenantId: linked.tenantId };
+        },
+        async link(claims, elwisToken) {
+            const checked = await AssertTenant(elwisToken);
+            AssertSamePerson(claims.email, checked.email);
+            const session = {
+                elwisToken: checked.rotatedToken ?? elwisToken,
+                tenantId: checked.tenantId,
+                elwisUserId: checked.userId,
+                linkedAt: Date.now(),
+            };
+            await options.store.put(LinkKey(claims), session);
+            return session;
+        },
+    };
+}
+//# sourceMappingURL=session-broker.js.map

package/dist/esm/host/session-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-broker.js","sourceRoot":"","sources":["../../../src/host/session-broker.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE5D,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAS;IAEzB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,wCAAwC,MAAM,iBAAiB,OAAO,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,OAAO,CAAC,MAAqB;IAC3C,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAwBD,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,KAAK,UAAU,YAAY,CAAC,KAAa;QACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,QAAQ,SAAS,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,gBAAgB,CAAC,UAA8B,EAAE,UAA8B;QACtF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACxH,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,WAAW,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,+CAA+C,UAAU,IAAI,6BAA6B,yBAAyB,UAAU,0BAA0B,CAAC,CAAC;QACtN,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAqB;YACjC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACnF,CAAC;YAED,IAAI,OAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,uCAAuC,CAAC,CAAC;YACvG,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,QAAQ,SAAS,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACnH,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC;YACxD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBACrF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAqB,EAAE,UAAkB;YAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAC/C,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAkB;gBAC7B,UAAU,EAAE,OAAO,CAAC,YAAY,IAAI,UAAU;gBAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,18 @@
+export type { ElwisApiPort, ElwisReadPort, ElwisWritePort, ElwisEntity, EntityKind, RecordCollection, RecordPage, Identity, IdentityRole, SystemAttributeIds, } from './ports/elwis-api.port.js';
+export { ResolveIdentityRole } from './ports/elwis-api.port.js';
+export { ElwisApiError, IsElwisApiError, ErrorStatus, AmbiguityError, NotFoundError, AppScopeError, TenantMismatchError, NoTenantError, } from './errors.js';
+export type { EntityMatch } from './resolve.js';
+export { TENANT_LEVEL_KINDS, IsObjectId, ResolveEntity, AssertInApplication, ResolveApplicationId, RequireApplicationId, ResolveOneId, ResolveOneStrict, } from './resolve.js';
+export type { ScopeIdentity } from './app-scope.js';
+export { AppScope, FilterApplicationId } from './app-scope.js';
+export type { ConformanceCase, ConformanceFixtures, ConformanceResult } from './conformance/read-port.conformance.js';
+export { READ_PORT_CONFORMANCE, RunReadPortConformance } from './conformance/read-port.conformance.js';
+export type { PlannableKind, TargetKind, TargetEntity, TargetRelation, TargetState, } from './plan/target-state.js';
+export { PLANNABLE_KINDS, BASE_DATA_TYPES, ResolveBaseDataType, IsDescriptiveName, NormalizeTargetState, } from './plan/target-state.js';
+export type { PlanBinding, PlanStep, PlanAssumption, PlanGap, ExpansionResult, } from './plan/expand.js';
+export { ExpandTargetState } from './plan/expand.js';
+export type { ResolutionAmbiguity, ResolutionResult } from './plan/resolve-existing.js';
+export { ResolveExistingEntities } from './plan/resolve-existing.js';
+export type { PlanChunk, SplitResult } from './plan/split.js';
+export { SplitPlan, MAX_STEPS_PER_PLAN } from './plan/split.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE/D,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEvG,YAAY,EACV,aAAa,EACb,UAAU,EACV,YAAY,EACZ,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,WAAW,EACX,QAAQ,EACR,cAAc,EACd,OAAO,EACP,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,10 @@
+export { ResolveIdentityRole } from './ports/elwis-api.port.js';
+export { ElwisApiError, IsElwisApiError, ErrorStatus, AmbiguityError, NotFoundError, AppScopeError, TenantMismatchError, NoTenantError, } from './errors.js';
+export { TENANT_LEVEL_KINDS, IsObjectId, ResolveEntity, AssertInApplication, ResolveApplicationId, RequireApplicationId, ResolveOneId, ResolveOneStrict, } from './resolve.js';
+export { AppScope, FilterApplicationId } from './app-scope.js';
+export { READ_PORT_CONFORMANCE, RunReadPortConformance } from './conformance/read-port.conformance.js';
+export { PLANNABLE_KINDS, BASE_DATA_TYPES, ResolveBaseDataType, IsDescriptiveName, NormalizeTargetState, } from './plan/target-state.js';
+export { ExpandTargetState } from './plan/expand.js';
+export { ResolveExistingEntities } from './plan/resolve-existing.js';
+export { SplitPlan, MAX_STEPS_PER_PLAN } from './plan/split.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AASvG,OAAO,EACL,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/plan/expand.d.ts

@@ -0,0 +1,37 @@
+import type { PlannableKind, TargetState } from './target-state.js';
+export interface PlanBinding {
+    field: string;
+    fromStep: number;
+    fromField: string;
+}
+export interface PlanStep {
+    index: number;
+    operation: 'create' | 'attach';
+    kind: PlannableKind;
+    name: string | null;
+    toolName: string;
+    args: Record<string, unknown>;
+    dependsOn: number[];
+    bindings: PlanBinding[];
+    description: string;
+}
+export interface PlanAssumption {
+    kind: string;
+    name: string | null;
+    field: string;
+    value: unknown;
+    blocking: boolean;
+    reason: string;
+}
+export interface PlanGap {
+    kind: string;
+    name: string | null;
+    reason: string;
+}
+export interface ExpansionResult {
+    steps: PlanStep[];
+    assumptions: PlanAssumption[];
+    gaps: PlanGap[];
+}
+export declare function ExpandTargetState(input: TargetState): ExpansionResult;
+//# sourceMappingURL=expand.d.ts.map

package/dist/esm/plan/expand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand.d.ts","sourceRoot":"","sources":["../../../src/plan/expand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGlF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AA4BD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAmRrE"}