@tenuo/core 0.2.4-beta.0

package/dist/generated/tenuo_wasm_bg.wasm.d.ts

@@ -0,0 +1,58 @@
+/* tslint:disable */
+/* eslint-disable */
+export const memory: WebAssembly.Memory;
+export const check_access: (a: number, b: number, c: number, d: number, e: any, f: number, g: number, h: number) => any;
+export const check_access_with_pop: (a: number, b: number, c: number, d: number, e: any, f: number, g: number, h: number, i: number) => any;
+export const check_chain_access: (a: number, b: number, c: number, d: number, e: any, f: number, g: number, h: number) => any;
+export const check_chain_access_with_approvals: (a: number, b: number, c: number, d: number, e: any, f: number, g: number, h: any, i: number, j: number) => any;
+export const check_revocation: (a: number, b: number, c: number, d: number) => any;
+export const compute_request_hash_wasm: (a: number, b: number, c: number, d: number, e: any) => any;
+export const create_issuer_warrant: (a: any) => any;
+export const create_sample_warrant: (a: number, b: number, c: number, d: number, e: number, f: number, g: bigint) => any;
+export const create_warrant_from_config: (a: any) => any;
+export const decode_pem_chain_wasm: (a: number, b: number) => any;
+export const decode_warrant: (a: number, b: number) => any;
+export const evaluate_approval_gates: (a: number, b: number, c: number, d: number, e: any) => any;
+export const generate_keypair: () => any;
+export const parse_connect_token: (a: number, b: number) => any;
+export const sign: (a: number, b: number, c: number, d: number, e: number, f: number, g: any) => any;
+export const sign_receipt: (a: any, b: number, c: number) => any;
+export const verify_approval_set: (a: number, b: number, c: number, d: number, e: any) => any;
+export const verify_signed_approval: (a: number, b: number) => any;
+export const verify_srl: (a: number, b: number, c: number, d: number) => any;
+export const init_panic_hook: () => void;
+export const __wbg_sdkcontext_free: (a: number, b: number) => void;
+export const __wbg_sdksession_free: (a: number, b: number) => void;
+export const sdkInspectParts: (a: number, b: number, c: number, d: number) => [number, number, number];
+export const sdkInspectWarrant: (a: number, b: number) => [number, number, number];
+export const sdkSignApproval: (a: number, b: number, c: number, d: any, e: number, f: number, g: number, h: number, i: number, j: number) => [number, number, number, number];
+export const sdkSignPublishedRevocationList: (a: any, b: number, c: number, d: number) => [number, number, number, number];
+export const sdkSignRevocationList: (a: any, b: number, c: number) => [number, number, number, number];
+export const sdkVerifyReceipt: (a: number, b: number) => [number, number, number];
+export const sdkVerifyReceiptChain: (a: number, b: number, c: any) => [number, number, number];
+export const sdkcontext_authorize: (a: number, b: number, c: number, d: number, e: any, f: any, g: any, h: number, i: number) => any;
+export const sdkcontext_authorizeAsOf: (a: number, b: number, c: number, d: number, e: any, f: number, g: any, h: any) => any;
+export const sdkcontext_authorizePresented: (a: number, b: any, c: number, d: number, e: any, f: number, g: number, h: any, i: any, j: number, k: number) => any;
+export const sdkcontext_fromTrustedRoots: (a: any) => [number, number, number];
+export const sdkcontext_loadRevocationList: (a: number, b: number, c: number) => [number, number];
+export const sdkcontext_mint: (a: number, b: any, c: number, d: any) => [number, number, number];
+export const sdkcontext_narrow: (a: number, b: number, c: any) => [number, number, number];
+export const sdkcontext_new: () => number;
+export const sdkcontext_signPop: (a: number, b: number, c: number, d: number, e: any) => [number, number, number, number];
+export const sdkcontext_signRevocationList: (a: number, b: any) => [number, number, number, number];
+export const sdksession_dedupKey: (a: number, b: number, c: number, d: any) => [number, number, number, number];
+export const sdksession_exportWire: (a: number) => [number, number, number];
+export const sdksession_fromChain: (a: any, b: number, c: number) => [number, number, number];
+export const sdksession_fromParts: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
+export const sdksession_fromWire: (a: number, b: number, c: number, d: number) => [number, number, number];
+export const sdksession_toStackWire: (a: number) => [number, number, number, number];
+export const sdksession_toWire: (a: number) => [number, number, number];
+export const sdksession_warrantIds: (a: number) => [number, number, number];
+export const __wbindgen_malloc: (a: number, b: number) => number;
+export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+export const __wbindgen_exn_store: (a: number) => void;
+export const __externref_table_alloc: () => number;
+export const __wbindgen_externrefs: WebAssembly.Table;
+export const __wbindgen_free: (a: number, b: number, c: number) => void;
+export const __externref_table_dealloc: (a: number) => void;
+export const __wbindgen_start: () => void;

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export type { AllowPolicy, ApprovalRequest, ConstraintExpr, CreateTenuoOptions, Decision, DevRoot, EmailConstraint, ExactConstraint, ExecuteOptions, MaxConstraint, McpAttachOptions, McpCallParams, McpHandlerPolicy, McpJsonRpcError, McpVerifyOptions, NarrowInput, NonceStore, OneOfConstraint, PatternConstraint, ProtectedTool, PublicKeyHandle, RequireApproval, Session, SessionAllow, SessionFromWireInput, SessionInput, Tenuo, TenuoErrorCode, TenuoMcp, TenuoMcpMeta, ToolLike, WarrantPart, ToolPolicy, UnderConstraint, } from "./api.ts";
+export { ApprovalRequiredError, AuthorizationDeniedError, TenuoConfigurationError, TenuoError, } from "./errors.ts";
+export { email, exact, max, oneOf, pattern, under } from "./constraints.ts";
+export { memoryNonceStore } from "./nonce.ts";
+export { Session as SessionHandle, isSession } from "./session.ts";
+export { createTenuo } from "./client.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,eAAe,EACf,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,eAAe,EACf,OAAO,EACP,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,KAAK,EACL,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { ApprovalRequiredError, AuthorizationDeniedError, TenuoConfigurationError, TenuoError, } from "./errors.js";
+export { email, exact, max, oneOf, pattern, under } from "./constraints.js";
+export { memoryNonceStore } from "./nonce.js";
+export { Session as SessionHandle, isSession } from "./session.js";
+export { createTenuo } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqCA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,4 @@
+import type { TenuoMcp } from "./api.ts";
+import type { WasmContext, WasmDecision } from "./wasm.ts";
+export declare function createMcp(context: WasmContext, decide: (decision: WasmDecision, tool: string) => void): TenuoMcp;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAMV,QAAQ,EACT,MAAM,UAAU,CAAC;AAGlB,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE3D,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,QAAQ,CAuFhH"}

package/dist/mcp.js

@@ -0,0 +1,258 @@
+import { ApprovalRequiredError, AuthorizationDeniedError, TenuoConfigurationError, TenuoError } from "./errors.js";
+import { nativeSession } from "./session.js";
+export function createMcp(context, decide) {
+    const mcp = {
+        attach(session, name, args, options) {
+            if (options !== undefined) {
+                assertKnownKeys(options, ATTACH_OPTION_KEYS, "mcp.attach() options");
+            }
+            const native = nativeSession(session);
+            const wireArgs = stripNulls(args);
+            const local = context.authorize(native, name, wireArgs, options?.approvals, undefined, options?.requestId);
+            emitReceipt(options?.onReceipt, local.receipt);
+            decide(local, name);
+            const signature = context.signPop(native, name, wireArgs);
+            const warrant = stackWire(native);
+            const tenuo = { warrant, signature };
+            if (options?.approvals !== undefined && options.approvals.length > 0) {
+                return {
+                    name,
+                    arguments: wireArgs,
+                    _meta: {
+                        tenuo: {
+                            ...tenuo,
+                            approvals: options.approvals.map(approvalWire),
+                        },
+                    },
+                };
+            }
+            return { name, arguments: wireArgs, _meta: { tenuo } };
+        },
+        async verify(name, args, meta, options) {
+            if (options !== undefined) {
+                assertKnownKeys(options, VERIFY_OPTION_KEYS, "mcp.verify() options");
+            }
+            const envelope = tenuoEnvelope(meta);
+            if (envelope === undefined) {
+                throw new TenuoConfigurationError("MCP call is missing _meta.tenuo. The client must call tenuo.mcp.attach().");
+            }
+            const decision = context.authorizePresented(envelope.warrant, name, stripNulls(args), envelope.signature, envelope.approvals, options?.allow, options?.requestId);
+            // Rust already signed this envelope. Emit before the nonce store can
+            // refuse a replay — otherwise an attacker leaves no audit artifact.
+            emitReceipt(options?.onReceipt, decision.receipt);
+            if (decision.outcome === "allow") {
+                await admitPop(options?.nonceStore, envelope.signature, options?.onNonceStoreError);
+            }
+            decide(decision, name);
+            return plainArgs(decision.args);
+        },
+        handler(name, policyOrExecute, maybeExecute) {
+            const policy = isHandlerPolicy(policyOrExecute) ? policyOrExecute : undefined;
+            const execute = isHandlerPolicy(policyOrExecute) ? maybeExecute : policyOrExecute;
+            if (typeof execute !== "function") {
+                throw new TenuoConfigurationError("mcp.handler() requires an execute function");
+            }
+            return async (args, extra) => {
+                const authorized = await mcp.verify(name, args, extra?._meta ?? extra?.meta, {
+                    ...(policy?.allow !== undefined ? { allow: policy.allow } : {}),
+                    ...(policy?.onReceipt !== undefined ? { onReceipt: policy.onReceipt } : {}),
+                    ...(policy?.nonceStore !== undefined ? { nonceStore: policy.nonceStore } : {}),
+                    ...(policy?.onNonceStoreError !== undefined ? { onNonceStoreError: policy.onNonceStoreError } : {}),
+                });
+                return execute(authorized);
+            };
+        },
+        jsonRpcError(error) {
+            return jsonRpcError(error);
+        },
+    };
+    return mcp;
+}
+function stackWire(native) {
+    const session = native;
+    if (typeof session.toStackWire !== "function") {
+        throw new TenuoConfigurationError("session is not bound to the WASM core");
+    }
+    const wire = session.toStackWire();
+    if (typeof wire !== "string" || wire.length === 0) {
+        throw new TenuoConfigurationError("toStackWire() did not return a warrant stack");
+    }
+    return wire;
+}
+function approvalWire(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    return Buffer.from(value).toString("base64");
+}
+function tenuoEnvelope(meta) {
+    if (meta === null || typeof meta !== "object") {
+        return undefined;
+    }
+    const root = meta;
+    const block = root.tenuo ?? root._meta?.tenuo;
+    if (block === null || typeof block !== "object") {
+        return undefined;
+    }
+    const tenuo = block;
+    if (typeof tenuo.warrant !== "string" || tenuo.warrant.length === 0) {
+        return undefined;
+    }
+    if (typeof tenuo.signature !== "string" || tenuo.signature.length === 0) {
+        return undefined;
+    }
+    const approvals = Array.isArray(tenuo.approvals)
+        ? tenuo.approvals.filter((item) => typeof item === "string")
+        : undefined;
+    return {
+        warrant: tenuo.warrant,
+        signature: tenuo.signature,
+        ...(approvals !== undefined && approvals.length > 0 ? { approvals } : {}),
+    };
+}
+const HANDLER_POLICY_KEYS = new Set(["allow", "onReceipt", "nonceStore", "onNonceStoreError"]);
+const VERIFY_OPTION_KEYS = new Set([
+    "allow",
+    "onReceipt",
+    "nonceStore",
+    "onNonceStoreError",
+    "requestId",
+]);
+const REPLAY_STORE_UNAVAILABLE = "Replay store unavailable";
+const ATTACH_OPTION_KEYS = new Set(["approvals", "onReceipt", "requestId"]);
+const MAX_STRIP_DEPTH = 32;
+const MAX_STRIP_LEN = 1024;
+function assertKnownKeys(value, known, label) {
+    const unknown = Object.keys(value).filter((key) => !known.has(key));
+    if (unknown[0] !== undefined) {
+        throw new TenuoConfigurationError(`${label} has unknown key '${unknown[0]}'. Use ${[...known].join(", ")}.`);
+    }
+}
+function isHandlerPolicy(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value) || typeof value === "function") {
+        return false;
+    }
+    const keys = Object.keys(value);
+    assertKnownKeys(value, HANDLER_POLICY_KEYS, "mcp.handler() policy");
+    const record = value;
+    const hasAllow = "allow" in record && record.allow !== null && typeof record.allow === "object" && !Array.isArray(record.allow);
+    const hasReceipt = "onReceipt" in record && typeof record.onReceipt === "function";
+    const hasNonce = "nonceStore" in record && record.nonceStore !== null && typeof record.nonceStore === "object";
+    const hasStoreError = "onNonceStoreError" in record && typeof record.onNonceStoreError === "function";
+    return keys.length === 0 || hasAllow || hasReceipt || hasNonce || hasStoreError;
+}
+async function admitPop(store, signature, onNonceStoreError) {
+    if (store === undefined) {
+        return;
+    }
+    let admitted;
+    try {
+        admitted = store.checkAndRecord(signature);
+    }
+    catch (error) {
+        throw replayStoreUnavailable(error, onNonceStoreError);
+    }
+    if (isThenable(admitted)) {
+        try {
+            admitted = await admitted;
+        }
+        catch (error) {
+            throw replayStoreUnavailable(error, onNonceStoreError);
+        }
+    }
+    if (typeof admitted !== "boolean") {
+        throw replayStoreUnavailable(new TenuoConfigurationError("NonceStore.checkAndRecord() must return boolean or Promise<boolean>"), onNonceStoreError);
+    }
+    if (!admitted) {
+        throw new AuthorizationDeniedError("TENUO_INVALID_POP", "PoP replay detected — this exact authorization token was already consumed.");
+    }
+}
+function replayStoreUnavailable(cause, onNonceStoreError) {
+    emitIsolated(onNonceStoreError, cause);
+    const error = new TenuoConfigurationError(REPLAY_STORE_UNAVAILABLE);
+    if (cause !== undefined) {
+        error.cause = cause;
+    }
+    return error;
+}
+function emitIsolated(hook, error) {
+    if (hook === undefined) {
+        return;
+    }
+    try {
+        const result = hook(error);
+        if (isThenable(result)) {
+            void Promise.resolve(result).catch(() => undefined);
+        }
+    }
+    catch {
+        // Isolated — must not change the public error.
+    }
+}
+function isThenable(value) {
+    return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+function emitReceipt(onReceipt, receipt) {
+    if (onReceipt === undefined || receipt === undefined) {
+        return;
+    }
+    try {
+        const result = onReceipt(receipt);
+        if (isThenable(result)) {
+            void Promise.resolve(result).catch(() => undefined);
+        }
+    }
+    catch {
+        // Receipt hooks must not deny or fail the tool.
+    }
+}
+function plainArgs(value) {
+    if (value instanceof Map) {
+        return Object.fromEntries(value);
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return { ...value };
+    }
+    return {};
+}
+/** Same rule as Python `strip_none_values`: drop null so optional MCP args do not break PoP. */
+function stripNulls(args) {
+    const keys = Object.keys(args);
+    if (keys.length > MAX_STRIP_LEN) {
+        throw new TenuoConfigurationError("arguments exceed the TypeScript input budget");
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (value === null || value === undefined) {
+            continue;
+        }
+        out[key] = Array.isArray(value) ? cleanList(value, 1) : value;
+    }
+    return out;
+}
+function cleanList(value, depth) {
+    if (depth > MAX_STRIP_DEPTH) {
+        throw new TenuoConfigurationError("arguments exceed the TypeScript nesting budget");
+    }
+    if (value.length > MAX_STRIP_LEN) {
+        throw new TenuoConfigurationError("arguments exceed the TypeScript input budget");
+    }
+    const cleaned = [];
+    for (const item of value) {
+        if (item === null || item === undefined) {
+            continue;
+        }
+        cleaned.push(Array.isArray(item) ? cleanList(item, depth + 1) : item);
+    }
+    return cleaned;
+}
+function jsonRpcError(error) {
+    if (error instanceof TenuoError) {
+        const code = error.code;
+        const rpc = code === "TENUO_APPROVAL_REQUIRED" ? -32002 : code === "TENUO_CANONICALIZATION" ? -32602 : -32001;
+        return { code: rpc, message: error.message, data: { tenuo: { code } } };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { code: -32001, message };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAG3D,MAAM,UAAU,SAAS,CAAC,OAAoB,EAAE,MAAsD;IACpG,MAAM,GAAG,GAAa;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAkB,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAC7B,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,EAAE,SAAS,EAClB,SAAS,EACT,OAAO,EAAE,SAAS,CACnB,CAAC;YACF,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,KAAK,GAAoC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACtE,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO;oBACL,IAAI;oBACJ,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE;wBACL,KAAK,EAAE;4BACL,GAAG,KAAK;4BACR,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;yBAC/C;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CACzC,QAAQ,CAAC,OAAO,EAChB,IAAI,EACJ,UAAU,CAAC,IAAI,CAAC,EAChB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,SAAS,EAClB,OAAO,EAAE,KAAK,EACd,OAAO,EAAE,SAAS,CACnB,CAAC;YACF,qEAAqE;YACrE,oEAAoE;YACpE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,YAAa;YAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;YAClF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,IAAI,EAAE;oBAC3E,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpG,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,UAAmB,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,KAAK;YAChB,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,OAAO,GAAG,MAAyC,CAAC;IAC1D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAA0B;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAa;IAEb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAA4C,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,IAAI,CAAC,KAAyC,EAAE,KAAK,CAAC;IACnF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAwE,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,WAAW;IACX,YAAY;IACZ,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,eAAe,CAAC,KAAa,EAAE,KAA0B,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,qBAAqB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACvG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAKd,CAAC;IACF,MAAM,QAAQ,GACZ,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,WAAW,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC;IACnF,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;IAC/G,MAAM,aAAa,GAAG,mBAAmB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU,CAAC;IACtG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,IAAI,aAAa,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAuF,EACvF,SAAiB,EACjB,iBAA4D;IAE5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,QAAoC,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,sBAAsB,CAC1B,IAAI,uBAAuB,CAAC,qEAAqE,CAAC,EAClG,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,iBAA4D;IAE5D,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,IAA4D,EAC5D,KAAc;IAEd,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AAC5G,CAAC;AAED,SAAS,WAAW,CAClB,SAAkE,EAClE,OAA2B;IAE3B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,IAAuC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB,EAAE,KAAa;IACzD,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9G,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC"}

package/dist/nonce.d.ts

@@ -0,0 +1,11 @@
+import type { NonceStore } from "./api.ts";
+/**
+ * In-process PoP replay store. Same shape as Python `NonceStore`.
+ * Not on by default. Does not work across processes — implement
+ * `NonceStore` with an async Redis `checkAndRecord` (return
+ * `Promise<boolean>`). A rejected Promise fails closed.
+ */
+export declare function memoryNonceStore(options?: {
+    readonly ttlSeconds?: number;
+}): NonceStore;
+//# sourceMappingURL=nonce.d.ts.map

package/dist/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../src/nonce.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAmBvF"}

package/dist/nonce.js

@@ -0,0 +1,28 @@
+import { createHash } from "node:crypto";
+/**
+ * In-process PoP replay store. Same shape as Python `NonceStore`.
+ * Not on by default. Does not work across processes — implement
+ * `NonceStore` with an async Redis `checkAndRecord` (return
+ * `Promise<boolean>`). A rejected Promise fails closed.
+ */
+export function memoryNonceStore(options) {
+    const ttlMs = (options?.ttlSeconds ?? 180) * 1000;
+    const seen = new Map();
+    return {
+        checkAndRecord(popSignature) {
+            const now = Date.now();
+            for (const [key, expiry] of seen) {
+                if (expiry <= now) {
+                    seen.delete(key);
+                }
+            }
+            const key = createHash("sha256").update(popSignature).digest("hex");
+            if (seen.has(key)) {
+                return false;
+            }
+            seen.set(key, now + ttlMs);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=nonce.js.map

package/dist/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../src/nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0C;IACzE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,cAAc,CAAC,YAAoB;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACjC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,19 @@
+import type { Session as SessionContract } from "./api.ts";
+import type { WasmSession } from "./wasm.ts";
+declare const inspect: unique symbol;
+/**
+ * Opaque session handle. Structural clones and JSON are not sessions.
+ */
+export declare class Session implements SessionContract {
+    readonly [Symbol.toStringTag]: "TenuoSession";
+    constructor(native: WasmSession);
+    toJSON(): string;
+    toString(): string;
+    [inspect](): string;
+    toWire(): string[];
+    dedupKey(tool: string, args: Readonly<Record<string, unknown>>): string;
+}
+export declare function isSession(value: unknown): value is Session;
+export declare function nativeSession(session: Session): WasmSession;
+export {};
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,QAAA,MAAM,OAAO,eAA2C,CAAC;AAGzD;;GAEG;AACH,qBAAa,OAAQ,YAAW,eAAe;IAC7C,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAG,cAAc,CAAU;gBAE5C,MAAM,EAAE,WAAW;IAI/B,MAAM,IAAI,MAAM;IAIhB,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;IAInB,MAAM,IAAI,MAAM,EAAE;IAYlB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM;CASxE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAE1D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAM3D"}

package/dist/session.js

@@ -0,0 +1,50 @@
+import { TenuoConfigurationError } from "./errors.js";
+const inspect = Symbol.for("nodejs.util.inspect.custom");
+const nativeSessions = new WeakMap();
+/**
+ * Opaque session handle. Structural clones and JSON are not sessions.
+ */
+export class Session {
+    [Symbol.toStringTag] = "TenuoSession";
+    constructor(native) {
+        nativeSessions.set(this, native);
+    }
+    toJSON() {
+        return "[TenuoSession]";
+    }
+    toString() {
+        return "[TenuoSession]";
+    }
+    [inspect]() {
+        return "[TenuoSession]";
+    }
+    toWire() {
+        const native = nativeSessions.get(this);
+        if (native?.toWire === undefined) {
+            throw new TenuoConfigurationError("session is not bound to the WASM core");
+        }
+        const tokens = native.toWire();
+        if (!Array.isArray(tokens) || tokens.some((token) => typeof token !== "string")) {
+            throw new TenuoConfigurationError("toWire() did not return warrant tokens");
+        }
+        return tokens;
+    }
+    dedupKey(tool, args) {
+        const native = nativeSessions.get(this);
+        if (typeof native?.dedupKey !== "function") {
+            throw new TenuoConfigurationError("session is not bound to the WASM core");
+        }
+        return native.dedupKey(tool, args);
+    }
+}
+export function isSession(value) {
+    return value instanceof Session;
+}
+export function nativeSession(session) {
+    const native = nativeSessions.get(session);
+    if (!native) {
+        throw new TenuoConfigurationError("session is not bound to the WASM core");
+    }
+    return native;
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAC;AAE3D;;GAEG;AACH,MAAM,OAAO,OAAO;IACT,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,cAAuB,CAAC;IAExD,YAAY,MAAmB;QAC7B,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,MAAM;QACJ,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,QAAQ;QACN,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAA2C,CAAC;QAClF,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,IAAuC;QAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAEzB,CAAC;QACd,IAAI,OAAO,MAAM,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,OAAO,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/wasm.d.ts

@@ -0,0 +1,107 @@
+import type { TenuoErrorCode } from "./api.ts";
+export type WasmDecision = {
+    outcome: "allow" | "deny" | "approval_required";
+    code?: TenuoErrorCode;
+    field?: string;
+    message?: string;
+    args?: Record<string, unknown>;
+    tool?: string;
+    required?: number;
+    received?: number;
+    receipt?: string;
+};
+export type WasmInspect = {
+    payload_hex: string;
+    signature_hex: string;
+    id: string;
+};
+export type WasmReceipt = {
+    authentic: true;
+    /** Hex key the receipt is signed under — resolve against your authorizer set. */
+    signer_key: string;
+    outcome: "allow" | "deny";
+    action: string;
+    decision_code?: string;
+    request_id: string;
+    /** Version of the revocation list in force, when it carried one. */
+    srl_version?: number;
+    /**
+     * SHA-256 (hex) of the revocation list bytes in force at decision time.
+     * Absent means no revocation data was loaded — a different claim from a
+     * loaded list that revoked nothing.
+     */
+    srl_hash?: string;
+    /**
+     * SHA-256 (hex) commitment to the canonical invocation this decision was
+     * made over. Absent when the arguments could not be canonicalized — never
+     * zero-filled, so absence is a claim rather than a value.
+     */
+    request_hash?: string;
+    /** SHA-256 (hex) of the host ceiling applied to this decision. */
+    policy_definition_hash?: string;
+    /**
+     * SHA-256 (hex) of the previous receipt from this signer. Absent on the
+     * first receipt, or when the deployment does not chain. A broken link means
+     * a receipt was removed from the stream.
+     */
+    prev_receipt_hash?: string;
+    /** SHA-256 (hex) of the trusted root set in force at decision time. */
+    trusted_roots_hash?: string;
+};
+export type WasmReceiptChain = {
+    signer_key: string;
+    outcome: "allow" | "deny";
+    decision_code?: string;
+    timestamp: number;
+    /** The embedded chain verifies to a supplied root at the decision instant. */
+    chain_valid: boolean;
+    /** Canonical error name when it does not. */
+    chain_error?: string;
+    /**
+     * Deny receipts only: the chain failure matches the stated decision_code,
+     * so the embedded authority independently corroborates the refusal.
+     */
+    corroborates_denial?: boolean;
+    root_issuer?: string;
+    leaf_holder?: string;
+};
+export type WasmSession = object;
+export type WasmContext = {
+    mint(allow: unknown, ttlSeconds: number, requireApproval?: unknown): WasmSession;
+    narrow(session: WasmSession, allow: unknown): WasmSession;
+    authorize(session: WasmSession, tool: string, args: unknown, approvals?: unknown, toolAllow?: unknown, requestId?: string): WasmDecision;
+    authorizeAsOf(session: WasmSession, tool: string, args: unknown, asOf: number, approvals?: unknown, toolAllow?: unknown): WasmDecision;
+    loadRevocationList(srl: string): void;
+    signRevocationList(ids: string[]): string;
+    signPop(session: WasmSession, tool: string, args: unknown): string;
+    authorizePresented(warrants: unknown, tool: string, args: unknown, pop: string, approvals?: unknown, toolAllow?: unknown, requestId?: string): WasmDecision;
+};
+type Generated = {
+    SdkContext: {
+        new (): WasmContext;
+        fromTrustedRoots(roots: string[]): WasmContext;
+    };
+    SdkSession: {
+        fromWire(warrant: string, holder: Uint8Array): WasmSession;
+        fromParts(payloadHex: string, signatureHex: string, holder: Uint8Array): WasmSession;
+        fromChain(parts: unknown, holder: Uint8Array): WasmSession;
+    };
+    sdkInspectWarrant(wire: string): WasmInspect;
+    sdkInspectParts(payloadHex: string, signatureHex: string): WasmInspect;
+    sdkSignApproval(session: WasmSession, tool: string, args: unknown, approverSecret: Uint8Array, externalId: string, asOf?: number): string;
+    sdkSignRevocationList(ids: string[], issuerSecret: Uint8Array): string;
+    sdkSignPublishedRevocationList(ids: string[], version: number, issuerSecret: Uint8Array): string;
+    sdkVerifyReceipt(wire: string): WasmReceipt;
+    sdkVerifyReceiptChain(wire: string, roots: string[]): WasmReceiptChain;
+};
+export declare function wasmAvailable(): boolean;
+export declare function loadWasm(): Generated;
+export declare function createDevContext(): WasmContext;
+export declare function createVerifierContext(rootHexes: readonly string[], revocationList?: string): WasmContext;
+export declare function importSessionFromWire(warrant: string, holderKey: Uint8Array): WasmSession;
+export declare function importSessionFromParts(payloadHex: string, signatureHex: string, holderKey: Uint8Array): WasmSession;
+export declare function importSessionFromChain(parts: unknown, holderKey: Uint8Array): WasmSession;
+export declare function inspectWarrant(wire: string): WasmInspect;
+export declare function inspectParts(payloadHex: string, signatureHex: string): WasmInspect;
+export {};
+//# sourceMappingURL=wasm.d.ts.map

package/dist/wasm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../src/wasm.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,mBAAmB,CAAC;IAChD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,EAAE,OAAO,CAAC;IACrB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IACjF,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC;IAC1D,SAAS,CACP,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,YAAY,CAAC;IAChB,aAAa,CACX,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,OAAO,GAClB,YAAY,CAAC;IAChB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACnE,kBAAkB,CAChB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,YAAY,CAAC;CACjB,CAAC;AAEF,KAAK,SAAS,GAAG;IACf,UAAU,EAAE;QACV,QAAQ,WAAW,CAAC;QACpB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;KAChD,CAAC;IACF,UAAU,EAAE;QACV,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,CAAC;QAC3D,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,CAAC;QACrF,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,WAAW,CAAC;KAC5D,CAAC;IACF,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC7C,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,WAAW,CAAC;IACvE,eAAe,CACb,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,cAAc,EAAE,UAAU,EAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC;IACV,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IACvE,8BAA8B,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,MAAM,CAAC;IACjG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5C,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;CACxE,CAAC;AASF,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAKD,wBAAgB,QAAQ,IAAI,SAAS,CAiBpC;AAED,wBAAgB,gBAAgB,IAAI,WAAW,CAG9C;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,cAAc,CAAC,EAAE,MAAM,GACtB,WAAW,CAOb;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,WAAW,CAGzF;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,UAAU,GACpB,WAAW,CAGb;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,GAAG,WAAW,CAGzF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAExD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,WAAW,CAElF"}