@tier0/sdk-v2 0.9.10 → 0.10.0

package/dist/cjs/client.d.ts

@@ -8,7 +8,7 @@ import type { CloudTransportConfig } from './cloud-transport.js';
 export interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {
 }
 export type Tier0Client = ReturnType<typeof createClient>;
-/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */
+/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */
 export declare function createClient(config?: Tier0ClientConfig): Readonly<{
     streams: {
         requests: StreamRequestsClient;
@@ -59,6 +59,8 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
         send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
             createdAt: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
         }>;
         get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -68,9 +70,17 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
             errorCode?: string;
             message?: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
             type: string;
         }>;
+        list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+            list: import("./index.js").components["schemas"]["NotificationListItem"][];
+            page: number | bigint;
+            size: number | bigint;
+            total: number | bigint;
+        }>;
     };
     mqttAuth: {
         create: (body: import("./index.js").components["schemas"]["SdkmqttAuthCreateRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -210,7 +220,6 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
     files: FilesClient;
     capabilities: CapabilitiesClient;
     source: Readonly<{
-        delete: (request: import("./index.js").CloudSourceDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDeleteResponse>;
         validate: (request: import("./index.js").UnsV2SourceValidateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceValidateResponse>;
         probe: (request: import("./index.js").UnsV2SourceProbeReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceProbeResponse>;
         discover: (request: import("./index.js").CloudSourceDiscoverReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDiscoverResponse>;
@@ -225,11 +234,30 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
         observations: Readonly<{
             get: (request: import("./index.js").CloudSourceObservationsGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceObservationsGetResponse>;
         }>;
+        resources: Readonly<{
+            catalog: (request: import("./index.js").CloudSourceResourceCatalogReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceCatalogResponse>;
+            preview: (request: import("./index.js").CloudSourceResourceReadReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceReadResponse>;
+            scan: (request: import("./index.js").CloudSourceResourceScanReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceScanResponse>;
+        }>;
+        devices: Readonly<{
+            list: (request: import("./index.js").CloudSourceDevicesListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDevicesListResponse>;
+        }>;
         documents: Readonly<{
             list: (request: import("./index.js").CloudSourceDocumentListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentListResponse>;
             get: (request: import("./index.js").CloudSourceDocumentGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentGetResponse>;
             create: (request: import("./index.js").CloudSourceDocumentCreateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentCreateResponse>;
             update: (request: import("./index.js").CloudSourceDocumentUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentUpdateResponse>;
+            delete: (request: import("./index.js").UnsV2SourceDocumentDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceDocumentDeleteResponse>;
+            credentials: Readonly<{
+                update: (request: import("./index.js").UnsV2SourceNativeCredentialsUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeCredentialsUpdateResponse>;
+            }>;
+            state: Readonly<{
+                update: (request: import("./index.js").CloudEdgeSourceStateUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudEdgeSourceStateUpdateResponse>;
+            }>;
+            oauth: Readonly<{
+                start: (request: import("./index.js").UnsV2SourceNativeOAuthStartReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthStartResponse>;
+                complete: (request: import("./index.js").UnsV2SourceNativeOAuthCompleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthCompleteResponse>;
+            }>;
         }>;
     }>;
     stream: Readonly<{
@@ -335,6 +363,8 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
             send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
                 createdAt: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
             }>;
             get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -344,9 +374,17 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
                 errorCode?: string;
                 message?: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
                 type: string;
             }>;
+            list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+                list: import("./index.js").components["schemas"]["NotificationListItem"][];
+                page: number | bigint;
+                size: number | bigint;
+                total: number | bigint;
+            }>;
         };
         members: {
             listWorkspace: (body?: import("./index.js").components["schemas"]["SdkmembersListWorkspaceRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -570,6 +608,8 @@ export declare const client: Readonly<{
         send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
             createdAt: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
         }>;
         get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -579,9 +619,17 @@ export declare const client: Readonly<{
             errorCode?: string;
             message?: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
             type: string;
         }>;
+        list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+            list: import("./index.js").components["schemas"]["NotificationListItem"][];
+            page: number | bigint;
+            size: number | bigint;
+            total: number | bigint;
+        }>;
     };
     mqttAuth: {
         create: (body: import("./index.js").components["schemas"]["SdkmqttAuthCreateRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -721,7 +769,6 @@ export declare const client: Readonly<{
     files: FilesClient;
     capabilities: CapabilitiesClient;
     source: Readonly<{
-        delete: (request: import("./index.js").CloudSourceDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDeleteResponse>;
         validate: (request: import("./index.js").UnsV2SourceValidateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceValidateResponse>;
         probe: (request: import("./index.js").UnsV2SourceProbeReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceProbeResponse>;
         discover: (request: import("./index.js").CloudSourceDiscoverReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDiscoverResponse>;
@@ -736,11 +783,30 @@ export declare const client: Readonly<{
         observations: Readonly<{
             get: (request: import("./index.js").CloudSourceObservationsGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceObservationsGetResponse>;
         }>;
+        resources: Readonly<{
+            catalog: (request: import("./index.js").CloudSourceResourceCatalogReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceCatalogResponse>;
+            preview: (request: import("./index.js").CloudSourceResourceReadReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceReadResponse>;
+            scan: (request: import("./index.js").CloudSourceResourceScanReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceScanResponse>;
+        }>;
+        devices: Readonly<{
+            list: (request: import("./index.js").CloudSourceDevicesListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDevicesListResponse>;
+        }>;
         documents: Readonly<{
             list: (request: import("./index.js").CloudSourceDocumentListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentListResponse>;
             get: (request: import("./index.js").CloudSourceDocumentGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentGetResponse>;
             create: (request: import("./index.js").CloudSourceDocumentCreateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentCreateResponse>;
             update: (request: import("./index.js").CloudSourceDocumentUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentUpdateResponse>;
+            delete: (request: import("./index.js").UnsV2SourceDocumentDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceDocumentDeleteResponse>;
+            credentials: Readonly<{
+                update: (request: import("./index.js").UnsV2SourceNativeCredentialsUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeCredentialsUpdateResponse>;
+            }>;
+            state: Readonly<{
+                update: (request: import("./index.js").CloudEdgeSourceStateUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudEdgeSourceStateUpdateResponse>;
+            }>;
+            oauth: Readonly<{
+                start: (request: import("./index.js").UnsV2SourceNativeOAuthStartReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthStartResponse>;
+                complete: (request: import("./index.js").UnsV2SourceNativeOAuthCompleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthCompleteResponse>;
+            }>;
         }>;
     }>;
     stream: Readonly<{
@@ -846,6 +912,8 @@ export declare const client: Readonly<{
             send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
                 createdAt: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
             }>;
             get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -855,9 +923,17 @@ export declare const client: Readonly<{
                 errorCode?: string;
                 message?: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
                 type: string;
             }>;
+            list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+                list: import("./index.js").components["schemas"]["NotificationListItem"][];
+                page: number | bigint;
+                size: number | bigint;
+                total: number | bigint;
+            }>;
         };
         members: {
             listWorkspace: (body?: import("./index.js").components["schemas"]["SdkmembersListWorkspaceRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{

package/dist/cjs/client.js

@@ -14,9 +14,7 @@ const source_js_1 = require("./source.js");
 const stream_js_1 = require("./stream.js");
 const capabilities_js_2 = require("./capabilities.js");
 const files_js_1 = require("./files.js");
-/** Use a fresh instance per incoming request when supplying employee data delegation. */
-function assemble(resolve, snapshot) {
-    const http = resolve();
+function assemble(resolve, snapshot, http = resolve()) {
     const api = (0, api_generated_js_1.createOpenAPI)(http);
     const transport = new transport_js_1.StreamTransport(resolve, snapshot);
     const messages = new messages_js_1.StreamMessagesClient(transport);
@@ -37,9 +35,9 @@ function assemble(resolve, snapshot) {
         api,
     });
 }
-/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */
+/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */
 function createClient(config = {}) {
-    const snapshot = Object.freeze({ ...config });
+    const snapshot = Object.freeze((0, client_js_1.snapshotClientConfig)(config));
     const http = new client_js_1.HttpClient(snapshot);
     return assemble(() => http, snapshot);
 }
@@ -52,5 +50,5 @@ const defaultHttp = new Proxy(new client_js_1.HttpClient(), {
     },
 });
 /** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */
-exports.client = assemble(() => defaultHttp, {});
+exports.client = assemble(client_js_1.getClient, {}, defaultHttp);
 //# sourceMappingURL=client.js.map

package/dist/cjs/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAyCA,oCAIC;AA7CD,uDAA6D;AAC7D,uDAA6D;AAC7D,yDAAyD;AACzD,+DAAqE;AACrE,mDAA+E;AAC/E,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,yFAAyF;AACzF,SAAS,QAAQ,CAAC,OAAyB,EAAE,QAA2B;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,8BAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,kCAAoB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,kCAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,0CAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACnI,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAGD,sCAAsC;AACtC,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,6CAA6C;AAC7C,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,IAAI,sBAAU,EAAE,EAAE;IAC9C,GAAG,CAAC,OAAO,EAAE,GAAG;QACd,MAAM,OAAO,GAAG,IAAA,qBAAS,GAAE,CAAC;QAC5B,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACF,CAAC,CAAC;AACH,sCAAsC;AACzB,QAAA,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC","sourcesContent":["import { StreamRequestsClient } from './streams/requests.js';\nimport { StreamMessagesClient } from './streams/messages.js';\nimport { StreamTransport } from './streams/transport.js';\nimport { StreamCapabilitiesClient } from './streams/capabilities.js';\nimport { getClient, HttpClient, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\n/** Use a fresh instance per incoming request when supplying employee data delegation. */\nfunction assemble(resolve: () => HttpClient, snapshot: Tier0ClientConfig) {\n  const http = resolve();\n  const api = createOpenAPI(http);\n  const transport = new StreamTransport(resolve, snapshot);\n  const messages = new StreamMessagesClient(transport);\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    streams: { requests: new StreamRequestsClient(transport), messages, capabilities: new StreamCapabilitiesClient(resolve, snapshot) },\n    dispose: () => messages.dispose(),\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n\n/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze({ ...config });\n  const http = new HttpClient(snapshot);\n  return assemble(() => http, snapshot);\n}\n\n// 全局兼容入口也在调用时读取 configureClient，不固化模块导入时的配置。\nconst defaultHttp = new Proxy(new HttpClient(), {\n  get(_target, key) {\n    const current = getClient();\n    const value: unknown = Reflect.get(current, key);\n    return typeof value === 'function' ? value.bind(current) : value;\n  },\n});\n/** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */\nexport const client = assemble(() => defaultHttp, {});\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAuCA,oCAIC;AA3CD,uDAA6D;AAC7D,uDAA6D;AAC7D,yDAAyD;AACzD,+DAAqE;AACrE,mDAAqG;AACrG,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,SAAS,QAAQ,CAAC,OAAyB,EAAE,QAA2B,EAAE,IAAI,GAAG,OAAO,EAAE;IACxF,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,8BAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,kCAAoB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,kCAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,0CAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACnI,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAGD,oCAAoC;AACpC,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,gCAAoB,EAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,6CAA6C;AAC7C,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,IAAI,sBAAU,EAAE,EAAE;IAC9C,GAAG,CAAC,OAAO,EAAE,GAAG;QACd,MAAM,OAAO,GAAG,IAAA,qBAAS,GAAE,CAAC;QAC5B,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACF,CAAC,CAAC;AACH,sCAAsC;AACzB,QAAA,MAAM,GAAG,QAAQ,CAAC,qBAAS,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC","sourcesContent":["import { StreamRequestsClient } from './streams/requests.js';\nimport { StreamMessagesClient } from './streams/messages.js';\nimport { StreamTransport } from './streams/transport.js';\nimport { StreamCapabilitiesClient } from './streams/capabilities.js';\nimport { getClient, HttpClient, snapshotClientConfig, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\nfunction assemble(resolve: () => HttpClient, snapshot: Tier0ClientConfig, http = resolve()) {\n  const api = createOpenAPI(http);\n  const transport = new StreamTransport(resolve, snapshot);\n  const messages = new StreamMessagesClient(transport);\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    streams: { requests: new StreamRequestsClient(transport), messages, capabilities: new StreamCapabilitiesClient(resolve, snapshot) },\n    dispose: () => messages.dispose(),\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n\n/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze(snapshotClientConfig(config));\n  const http = new HttpClient(snapshot);\n  return assemble(() => http, snapshot);\n}\n\n// 全局兼容入口也在调用时读取 configureClient，不固化模块导入时的配置。\nconst defaultHttp = new Proxy(new HttpClient(), {\n  get(_target, key) {\n    const current = getClient();\n    const value: unknown = Reflect.get(current, key);\n    return typeof value === 'function' ? value.bind(current) : value;\n  },\n});\n/** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */\nexport const client = assemble(getClient, {}, defaultHttp);\n"]}

package/dist/cjs/cloud-server.d.ts

@@ -1,31 +1,38 @@
-export declare const APP_REQUEST_IDENTITY_HEADER: "X-Tier0-App-Identity";
-export declare class AppRequestIdentityError extends Error {
-    readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID';
-    constructor(code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID');
+/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */
+export declare const VISITOR_HEADER = "X-Tier0-Visitor";
+export type VisitorErrorCode = 'VISITOR_HEADER_INVALID' | 'VISITOR_CONFIGURATION_INVALID';
+export declare class VisitorError extends Error {
+    readonly code: VisitorErrorCode;
+    constructor(code: VisitorErrorCode);
 }
-export interface VerifiedCloudAppUser {
-    readonly kind: 'gateway-user';
-    readonly userID: string;
+/** The visitor of a request, from `X-Tier0-Visitor`. */
+export interface Visitor {
+    readonly subType: 'employee' | 'machine';
+    /** Employee user ID, or the call token ID of a machine visitor. */
+    readonly subject: string;
+    /** Grant of an employee's access; empty for a machine visitor. */
+    readonly grant: string;
     readonly workspaceID: string;
     readonly appID: string;
-    readonly roleKeys: readonly string[];
-    readonly requestID: string;
-    readonly issuedAt: number;
-    readonly expiresAt: number;
-    readonly verificationKeyID: string;
+    readonly runtime: 'deployed' | 'preview';
+    /** Roles of this visitor in the App; in Preview, the roles selected in "view as". */
+    readonly appRoles: readonly string[];
+    /** Only in Preview's "view as". */
+    readonly activeRole?: string;
 }
-export interface CloudAppIdentityAuthority {
-    appID: string;
-    workspaceID: string;
-    /** Pinned server configuration, never a key or URL taken from the request. */
-    publicKeys: unknown;
+export interface ParseVisitorOptions {
+    /** The App the header must name. Defaults to `TIER0_APP_ID`. */
+    appID?: string;
 }
-export interface CloudAppIdentityRequest {
-    assertion: string | undefined;
-    method: string;
-    requestURI: string;
-    /** Exact bytes received from the gateway, before JSON parsing or normalization. */
-    body: Uint8Array;
-}
-/** Verifies request provenance, not business authorization or delegated UNS permissions. */
-export declare function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority): (request: CloudAppIdentityRequest) => VerifiedCloudAppUser;
+/**
+ * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8
+ * JSON object of at most 8192 bytes. The header is not signed; the front door
+ * is the only way into the App and replaces whatever the client sent. Parsing
+ * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate
+ * (e.g. `"\ud800"`), an unknown or missing field, a wrong type or length, a `ws` that
+ * is not a positive decimal ID without sign or leading zero, an employee
+ * without a grant or a machine visitor with one, or an `app` other than this
+ * App's throws `VISITOR_HEADER_INVALID`. Without an App ID
+ * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.
+ */
+export declare function parseVisitorHeader(value: string | null | undefined, options?: ParseVisitorOptions): Visitor;

package/dist/cjs/cloud-server.js

@@ -1,114 +1,116 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AppRequestIdentityError = exports.APP_REQUEST_IDENTITY_HEADER = void 0;
-exports.createCloudAppRequestVerifier = createCloudAppRequestVerifier;
-// Server-only entry point. Browser HTTP clients remain independent of node:crypto.
-const node_crypto_1 = require("node:crypto");
-const app_identity_contract_generated_js_1 = require("./app-identity-contract.generated.js");
-exports.APP_REQUEST_IDENTITY_HEADER = app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.header;
-class AppRequestIdentityError extends Error {
+exports.VisitorError = exports.VISITOR_HEADER = void 0;
+exports.parseVisitorHeader = parseVisitorHeader;
+// Server-only entry point: the App's view of the request it is serving.
+const runtime_env_js_1 = require("./runtime-env.js");
+const maxID = BigInt('9223372036854775807');
+/** A positive decimal int64 without sign or leading zero. */
+const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */
+exports.VISITOR_HEADER = 'X-Tier0-Visitor';
+/** Limit of the JSON before encoding. */
+const VISITOR_MAX_JSON_BYTES = 8192;
+/** Unpadded base64url of `VISITOR_MAX_JSON_BYTES`. */
+const VISITOR_MAX_HEADER_LENGTH = Math.ceil((VISITOR_MAX_JSON_BYTES * 4) / 3);
+const VISITOR_MAX_STRING_BYTES = 128;
+const VISITOR_FIELDS = new Set(['ws', 'app', 'runtime', 'sub_type', 'sub', 'grant', 'app_roles', 'active_role']);
+class VisitorError extends Error {
     code;
     constructor(code) {
         super(code);
         this.code = code;
-        this.name = 'AppRequestIdentityError';
+        this.name = 'VisitorError';
     }
 }
-exports.AppRequestIdentityError = AppRequestIdentityError;
-const invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');
-const invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');
-const appPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.appIDPattern);
-const kidPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.keyIDPattern);
-const methodPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.methodPattern);
-const maxID = BigInt('9223372036854775807');
-const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
-const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
-const exactKeys = (value, keys) => Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));
-const validString = (value, maxBytes) => typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&
-    Buffer.from(value).toString('utf8') === value && !/[\u0000-\u001f\u007f-\u009f]/.test(value);
-const decode = (value) => {
-    if (!/^[A-Za-z0-9_-]+$/.test(value))
-        throw invalid();
-    const bytes = Buffer.from(value, 'base64url');
-    if (bytes.toString('base64url') !== value)
-        throw invalid();
-    return bytes;
-};
-/** Verifies request provenance, not business authorization or delegated UNS permissions. */
-function createCloudAppRequestVerifier(authority) {
-    if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID))
-        throw invalidConfig();
-    const appID = authority.appID;
-    const workspaceID = authority.workspaceID;
-    const keys = new Map();
-    try {
-        let raw = authority.publicKeys;
-        if (typeof raw === 'string') {
-            if (Buffer.byteLength(raw) > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTokenBytes * app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxKeys)
-                throw invalidConfig();
-            raw = JSON.parse(raw);
-        }
-        if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||
-            raw.keys.length === 0 || raw.keys.length > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxKeys)
-            throw invalidConfig();
-        for (const key of raw.keys) {
-            if (!isObject(key) || !exactKeys(key, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.publicKeyFields) || key.kty !== 'OKP' ||
-                key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||
-                keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32)
-                throw invalidConfig();
-            keys.set(key.kid, (0, node_crypto_1.createPublicKey)({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));
+exports.VisitorError = VisitorError;
+/** A UTF-16 surrogate without its pair, as JSON escapes like "\ud800" can produce. */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/**
+ * Raw key tokens of the top-level object, for spotting duplicates
+ * (`JSON.parse` keeps the last silently). Values of the visitor are strings
+ * and arrays of strings, so only depth 1 holds keys.
+ */
+function topLevelKeys(json) {
+    const keys = [];
+    let depth = 0;
+    for (let i = 0; i < json.length; i += 1) {
+        const char = json[i];
+        if (char === '{' || char === '[')
+            depth += 1;
+        else if (char === '}' || char === ']')
+            depth -= 1;
+        else if (char === '"') {
+            const start = i;
+            for (i += 1; i < json.length && json[i] !== '"'; i += 1)
+                if (json[i] === '\\')
+                    i += 1;
+            let next = i + 1;
+            while (next < json.length && /\s/.test(json[next]))
+                next += 1;
+            if (depth === 1 && json[next] === ':')
+                keys.push(json.slice(start, i + 1));
         }
     }
+    return keys;
+}
+const bytes = (value) => Buffer.byteLength(value, 'utf8');
+const sized = (value, min, max) => typeof value === 'string' && !LONE_SURROGATE.test(value) && bytes(value) >= min && bytes(value) <= max;
+/**
+ * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8
+ * JSON object of at most 8192 bytes. The header is not signed; the front door
+ * is the only way into the App and replaces whatever the client sent. Parsing
+ * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate
+ * (e.g. `"\ud800"`), an unknown or missing field, a wrong type or length, a `ws` that
+ * is not a positive decimal ID without sign or leading zero, an employee
+ * without a grant or a machine visitor with one, or an `app` other than this
+ * App's throws `VISITOR_HEADER_INVALID`. Without an App ID
+ * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.
+ */
+function parseVisitorHeader(value, options = {}) {
+    const appID = options.appID ?? (0, runtime_env_js_1.getEnvVar)('TIER0_APP_ID')?.trim();
+    if (!appID)
+        throw new VisitorError('VISITOR_CONFIGURATION_INVALID');
+    const fail = () => new VisitorError('VISITOR_HEADER_INVALID');
+    if (typeof value !== 'string' || value.length === 0 || value.length > VISITOR_MAX_HEADER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw fail();
+    const raw = Buffer.from(value, 'base64url');
+    // Only the canonical encoding: no padding, no stray trailing bits.
+    if (raw.length > VISITOR_MAX_JSON_BYTES || raw.toString('base64url') !== value)
+        throw fail();
+    // A UTF-8 byte order mark is not part of the contract (TextDecoder would drop it silently).
+    if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf)
+        throw fail();
+    let claims;
+    let json;
+    try {
+        json = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+        claims = JSON.parse(json);
+    }
     catch {
-        throw invalidConfig();
+        throw fail();
     }
-    return (request) => {
-        try {
-            if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTokenBytes ||
-                !(request.body instanceof Uint8Array) || request.body.byteLength > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxBodyBytes ||
-                !methodPattern.test(request.method) || !validString(request.requestURI, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxURIBytes) ||
-                !request.requestURI.startsWith('/') || request.requestURI.startsWith('//'))
-                throw invalid();
-            const parts = request.assertion.split('.');
-            if (parts.length !== 3)
-                throw invalid();
-            const header = JSON.parse(decode(parts[0]).toString('utf8'));
-            if (!isObject(header) || !exactKeys(header, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.requiredHeaderFields) ||
-                header.alg !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.algorithm || header.typ !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.type ||
-                typeof header.kid !== 'string' || !kidPattern.test(header.kid))
-                throw invalid();
-            const key = keys.get(header.kid);
-            const signature = decode(parts[2]);
-            if (!key || signature.length !== 64 ||
-                !(0, node_crypto_1.verify)(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature))
-                throw invalid();
-            const claims = JSON.parse(decode(parts[1]).toString('utf8'));
-            if (!isObject(claims) || !exactKeys(claims, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.requiredClaims) ||
-                claims.ver !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.version || claims.iss !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.issuer || claims.aud !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.audience ||
-                !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||
-                claims.method !== request.method || claims.requestURI !== request.requestURI ||
-                typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||
-                claims.bodySHA256 !== (0, node_crypto_1.createHash)('sha256').update(request.body).digest('hex') ||
-                typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||
-                typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||
-                claims.exp - claims.iat > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTTLSeconds ||
-                typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||
-                !Array.isArray(claims.roles) || claims.roles.length > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxRoles ||
-                claims.roles.some((role) => !validString(role, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxRoleBytes) || role.trim() !== role) ||
-                new Set(claims.roles).size !== claims.roles.length)
-                throw invalid();
-            const now = Math.floor(Date.now() / 1000);
-            if (claims.iat > now + app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.clockSkewSeconds || now >= claims.exp + app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.clockSkewSeconds)
-                throw invalid();
-            return Object.freeze({
-                kind: 'gateway-user', userID: claims.sub, workspaceID, appID,
-                roleKeys: Object.freeze([...claims.roles]), requestID: claims.jti,
-                issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,
-            });
-        }
-        catch {
-            throw invalid();
-        }
-    };
+    if (!isObject(claims) || Object.keys(claims).some((key) => !VISITOR_FIELDS.has(key)))
+        throw fail();
+    // Every key at most once, each spelling decoded ("\u0077s" is "ws").
+    const keys = topLevelKeys(json).map((token) => JSON.parse(token));
+    if (new Set(keys).size !== keys.length)
+        throw fail();
+    const { ws, app, runtime, sub_type: subType, sub, grant, app_roles: appRoles, active_role: activeRole } = claims;
+    if (!validID(ws) || app !== appID ||
+        (runtime !== 'deployed' && runtime !== 'preview') ||
+        (subType !== 'employee' && subType !== 'machine') ||
+        !sized(sub, 1, VISITOR_MAX_STRING_BYTES) ||
+        // An employee's access always has a grant; a machine visitor has none.
+        typeof grant !== 'string' || (subType === 'employee' ? !sized(grant, 1, VISITOR_MAX_STRING_BYTES) : grant !== '') ||
+        !Array.isArray(appRoles) || appRoles.some((role) => !sized(role, 1, VISITOR_MAX_STRING_BYTES)) ||
+        (activeRole !== undefined && !sized(activeRole, 1, VISITOR_MAX_STRING_BYTES)))
+        throw fail();
+    return Object.freeze({
+        subType, subject: sub, grant, workspaceID: ws, appID, runtime,
+        appRoles: Object.freeze([...new Set(appRoles)]),
+        ...(activeRole === undefined ? {} : { activeRole }),
+    });
 }
 //# sourceMappingURL=cloud-server.js.map

package/dist/cjs/cloud-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":";;;AA+DA,sEA4DC;AA3HD,mFAAmF;AACnF,6CAAkF;AAClF,6FAAiG;AAEpF,QAAA,2BAA2B,GAAG,kEAAQ,CAAC,MAAM,CAAC;AAE3D,MAAa,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,IAAmE;QAC7F,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAA+D;QAE7F,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AA6BD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,kEAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,kEAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,kEAAQ,CAAC,aAAa,CAAC,CAAC;AACzD,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,IAAuB,EAAE,EAAE,CAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAmB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ;IACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;IAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4FAA4F;AAC5F,SAAgB,6BAA6B,CAAC,SAAoC;IAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC/J,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,kEAAQ,CAAC,aAAa,GAAG,kEAAQ,CAAC,OAAO;gBAAE,MAAM,aAAa,EAAE,CAAC;YAC9F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,kEAAQ,CAAC,OAAO;YAAE,MAAM,aAAa,EAAE,CAAC;QACvF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,kEAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;gBAChF,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,aAAa,EAAE,CAAC;YACzG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,aAAa,EAAE,CAAC;IAAC,CAAC;IAElC,OAAO,CAAC,OAAgC,EAAwB,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,kEAAQ,CAAC,aAAa;gBACtG,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,kEAAQ,CAAC,YAAY;gBACxF,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,kEAAQ,CAAC,WAAW,CAAC;gBAC7F,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YAChG,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,kEAAQ,CAAC,oBAAoB,CAAC;gBACtE,MAAM,CAAC,GAAG,KAAK,kEAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,kEAAQ,CAAC,IAAI;gBACjE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAC/B,CAAC,IAAA,oBAAM,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpG,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,kEAAQ,CAAC,cAAc,CAAC;gBAChE,MAAM,CAAC,GAAG,KAAK,kEAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,kEAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,kEAAQ,CAAC,QAAQ;gBACrG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBACpF,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAC5E,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAClF,MAAM,CAAC,UAAU,KAAK,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC;gBACtF,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;gBAC/F,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,kEAAQ,CAAC,aAAa;gBAChD,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,kEAAQ,CAAC,QAAQ;gBACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,kEAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;gBAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,kEAAQ,CAAC,gBAAgB,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,kEAAQ,CAAC,gBAAgB;gBAAE,MAAM,OAAO,EAAE,CAAC;YACnH,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,cAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK;gBACrE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG;gBAC7E,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Server-only entry point. Browser HTTP clients remain independent of node:crypto.\nimport { createHash, createPublicKey, verify, type KeyObject } from 'node:crypto';\nimport { APP_REQUEST_IDENTITY_CONTRACT as contract } from './app-identity-contract.generated.js';\n\nexport const APP_REQUEST_IDENTITY_HEADER = contract.header;\n\nexport class AppRequestIdentityError extends Error {\n  constructor(public readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID') {\n    super(code);\n    this.name = 'AppRequestIdentityError';\n  }\n}\n\nexport interface VerifiedCloudAppUser {\n  readonly kind: 'gateway-user';\n  readonly userID: string;\n  readonly workspaceID: string;\n  readonly appID: string;\n  readonly roleKeys: readonly string[];\n  readonly requestID: string;\n  readonly issuedAt: number;\n  readonly expiresAt: number;\n  readonly verificationKeyID: string;\n}\n\nexport interface CloudAppIdentityAuthority {\n  appID: string;\n  workspaceID: string;\n  /** Pinned server configuration, never a key or URL taken from the request. */\n  publicKeys: unknown;\n}\n\nexport interface CloudAppIdentityRequest {\n  assertion: string | undefined;\n  method: string;\n  requestURI: string;\n  /** Exact bytes received from the gateway, before JSON parsing or normalization. */\n  body: Uint8Array;\n}\n\nconst invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');\nconst invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');\nconst appPattern = new RegExp(contract.appIDPattern);\nconst kidPattern = new RegExp(contract.keyIDPattern);\nconst methodPattern = new RegExp(contract.methodPattern);\nconst maxID = BigInt('9223372036854775807');\nconst validID = (value: unknown): value is string =>\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value);\nconst exactKeys = (value: Record<string, unknown>, keys: readonly string[]) =>\n  Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));\nconst validString = (value: unknown, maxBytes: number): value is string =>\n  typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&\n  Buffer.from(value).toString('utf8') === value && !/[\\u0000-\\u001f\\u007f-\\u009f]/.test(value);\nconst decode = (value: string) => {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw invalid();\n  const bytes = Buffer.from(value, 'base64url');\n  if (bytes.toString('base64url') !== value) throw invalid();\n  return bytes;\n};\n\n/** Verifies request provenance, not business authorization or delegated UNS permissions. */\nexport function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority) {\n  if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID)) throw invalidConfig();\n  const appID = authority.appID;\n  const workspaceID = authority.workspaceID;\n  const keys = new Map<string, KeyObject>();\n  try {\n    let raw = authority.publicKeys;\n    if (typeof raw === 'string') {\n      if (Buffer.byteLength(raw) > contract.maxTokenBytes * contract.maxKeys) throw invalidConfig();\n      raw = JSON.parse(raw);\n    }\n    if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||\n        raw.keys.length === 0 || raw.keys.length > contract.maxKeys) throw invalidConfig();\n    for (const key of raw.keys) {\n      if (!isObject(key) || !exactKeys(key, contract.publicKeyFields) || key.kty !== 'OKP' ||\n          key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||\n          keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32) throw invalidConfig();\n      keys.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));\n    }\n  } catch { throw invalidConfig(); }\n\n  return (request: CloudAppIdentityRequest): VerifiedCloudAppUser => {\n    try {\n      if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > contract.maxTokenBytes ||\n          !(request.body instanceof Uint8Array) || request.body.byteLength > contract.maxBodyBytes ||\n          !methodPattern.test(request.method) || !validString(request.requestURI, contract.maxURIBytes) ||\n          !request.requestURI.startsWith('/') || request.requestURI.startsWith('//')) throw invalid();\n      const parts = request.assertion.split('.');\n      if (parts.length !== 3) throw invalid();\n      const header: unknown = JSON.parse(decode(parts[0]).toString('utf8'));\n      if (!isObject(header) || !exactKeys(header, contract.requiredHeaderFields) ||\n          header.alg !== contract.algorithm || header.typ !== contract.type ||\n          typeof header.kid !== 'string' || !kidPattern.test(header.kid)) throw invalid();\n      const key = keys.get(header.kid);\n      const signature = decode(parts[2]);\n      if (!key || signature.length !== 64 ||\n          !verify(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature)) throw invalid();\n      const claims: unknown = JSON.parse(decode(parts[1]).toString('utf8'));\n      if (!isObject(claims) || !exactKeys(claims, contract.requiredClaims) ||\n          claims.ver !== contract.version || claims.iss !== contract.issuer || claims.aud !== contract.audience ||\n          !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||\n          claims.method !== request.method || claims.requestURI !== request.requestURI ||\n          typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||\n          claims.bodySHA256 !== createHash('sha256').update(request.body).digest('hex') ||\n          typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||\n          typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||\n          claims.exp - claims.iat > contract.maxTTLSeconds ||\n          typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||\n          !Array.isArray(claims.roles) || claims.roles.length > contract.maxRoles ||\n          claims.roles.some((role) => !validString(role, contract.maxRoleBytes) || role.trim() !== role) ||\n          new Set(claims.roles).size !== claims.roles.length) throw invalid();\n      const now = Math.floor(Date.now() / 1000);\n      if (claims.iat > now + contract.clockSkewSeconds || now >= claims.exp + contract.clockSkewSeconds) throw invalid();\n      return Object.freeze({\n        kind: 'gateway-user' as const, userID: claims.sub, workspaceID, appID,\n        roleKeys: Object.freeze([...claims.roles] as string[]), requestID: claims.jti,\n        issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,\n      });\n    } catch { throw invalid(); }\n  };\n}\n"]}
+{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":";;;AA2FA,gDAoCC;AA/HD,wEAAwE;AACxE,qDAA6C;AAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,6DAA6D;AAC7D,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEhE,sHAAsH;AACzG,QAAA,cAAc,GAAG,iBAAiB,CAAC;AAEhD,yCAAyC;AACzC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9E,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAItI,MAAa,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,IAAsB;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAAkB;QAEhD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AALD,oCAKC;AAuBD,sFAAsF;AACtF,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAEhG;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACxC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAClE,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CAC1E,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;AAEzG;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,KAAgC,EAAE,UAA+B,EAAE;IACpG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAA,0BAAS,EAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IACjJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5C,mEAAmE;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,EAAE,CAAC;IAC7F,4FAA4F;IAC5F,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,EAAE,CAAC;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IACnG,qEAAqE;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC,CAAC;IAC5E,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,KAAK;QAC7B,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,CAAC;QACjD,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,CAAC;QACjD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,wBAAwB,CAAC;QACxC,uEAAuE;QACvE,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACjH,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC9F,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IAChG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO;QAC7D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAoB,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC","sourcesContent":["// Server-only entry point: the App's view of the request it is serving.\nimport { getEnvVar } from './runtime-env.js';\n\nconst maxID = BigInt('9223372036854775807');\n/** A positive decimal int64 without sign or leading zero. */\nconst validID = (value: unknown): value is string =>\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value);\n\n/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */\nexport const VISITOR_HEADER = 'X-Tier0-Visitor';\n\n/** Limit of the JSON before encoding. */\nconst VISITOR_MAX_JSON_BYTES = 8192;\n/** Unpadded base64url of `VISITOR_MAX_JSON_BYTES`. */\nconst VISITOR_MAX_HEADER_LENGTH = Math.ceil((VISITOR_MAX_JSON_BYTES * 4) / 3);\nconst VISITOR_MAX_STRING_BYTES = 128;\nconst VISITOR_FIELDS: ReadonlySet<string> = new Set(['ws', 'app', 'runtime', 'sub_type', 'sub', 'grant', 'app_roles', 'active_role']);\n\nexport type VisitorErrorCode = 'VISITOR_HEADER_INVALID' | 'VISITOR_CONFIGURATION_INVALID';\n\nexport class VisitorError extends Error {\n  constructor(public readonly code: VisitorErrorCode) {\n    super(code);\n    this.name = 'VisitorError';\n  }\n}\n\n/** The visitor of a request, from `X-Tier0-Visitor`. */\nexport interface Visitor {\n  readonly subType: 'employee' | 'machine';\n  /** Employee user ID, or the call token ID of a machine visitor. */\n  readonly subject: string;\n  /** Grant of an employee's access; empty for a machine visitor. */\n  readonly grant: string;\n  readonly workspaceID: string;\n  readonly appID: string;\n  readonly runtime: 'deployed' | 'preview';\n  /** Roles of this visitor in the App; in Preview, the roles selected in \"view as\". */\n  readonly appRoles: readonly string[];\n  /** Only in Preview's \"view as\". */\n  readonly activeRole?: string;\n}\n\nexport interface ParseVisitorOptions {\n  /** The App the header must name. Defaults to `TIER0_APP_ID`. */\n  appID?: string;\n}\n\n/** A UTF-16 surrogate without its pair, as JSON escapes like \"\\ud800\" can produce. */\nconst LONE_SURROGATE = /[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]/;\n\n/**\n * Raw key tokens of the top-level object, for spotting duplicates\n * (`JSON.parse` keeps the last silently). Values of the visitor are strings\n * and arrays of strings, so only depth 1 holds keys.\n */\nfunction topLevelKeys(json: string): string[] {\n  const keys: string[] = [];\n  let depth = 0;\n  for (let i = 0; i < json.length; i += 1) {\n    const char = json[i];\n    if (char === '{' || char === '[') depth += 1;\n    else if (char === '}' || char === ']') depth -= 1;\n    else if (char === '\"') {\n      const start = i;\n      for (i += 1; i < json.length && json[i] !== '\"'; i += 1) if (json[i] === '\\\\') i += 1;\n      let next = i + 1;\n      while (next < json.length && /\\s/.test(json[next])) next += 1;\n      if (depth === 1 && json[next] === ':') keys.push(json.slice(start, i + 1));\n    }\n  }\n  return keys;\n}\n\nconst bytes = (value: string) => Buffer.byteLength(value, 'utf8');\nconst sized = (value: unknown, min: number, max: number): value is string =>\n  typeof value === 'string' && !LONE_SURROGATE.test(value) && bytes(value) >= min && bytes(value) <= max;\n\n/**\n * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8\n * JSON object of at most 8192 bytes. The header is not signed; the front door\n * is the only way into the App and replaces whatever the client sent. Parsing\n * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate\n * (e.g. `\"\\ud800\"`), an unknown or missing field, a wrong type or length, a `ws` that\n * is not a positive decimal ID without sign or leading zero, an employee\n * without a grant or a machine visitor with one, or an `app` other than this\n * App's throws `VISITOR_HEADER_INVALID`. Without an App ID\n * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.\n */\nexport function parseVisitorHeader(value: string | null | undefined, options: ParseVisitorOptions = {}): Visitor {\n  const appID = options.appID ?? getEnvVar('TIER0_APP_ID')?.trim();\n  if (!appID) throw new VisitorError('VISITOR_CONFIGURATION_INVALID');\n  const fail = () => new VisitorError('VISITOR_HEADER_INVALID');\n  if (typeof value !== 'string' || value.length === 0 || value.length > VISITOR_MAX_HEADER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(value)) throw fail();\n  const raw = Buffer.from(value, 'base64url');\n  // Only the canonical encoding: no padding, no stray trailing bits.\n  if (raw.length > VISITOR_MAX_JSON_BYTES || raw.toString('base64url') !== value) throw fail();\n  // A UTF-8 byte order mark is not part of the contract (TextDecoder would drop it silently).\n  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) throw fail();\n  let claims: unknown;\n  let json: string;\n  try {\n    json = new TextDecoder('utf-8', { fatal: true }).decode(raw);\n    claims = JSON.parse(json);\n  } catch {\n    throw fail();\n  }\n  if (!isObject(claims) || Object.keys(claims).some((key) => !VISITOR_FIELDS.has(key))) throw fail();\n  // Every key at most once, each spelling decoded (\"\\u0077s\" is \"ws\").\n  const keys = topLevelKeys(json).map((token) => JSON.parse(token) as string);\n  if (new Set(keys).size !== keys.length) throw fail();\n  const { ws, app, runtime, sub_type: subType, sub, grant, app_roles: appRoles, active_role: activeRole } = claims;\n  if (!validID(ws) || app !== appID ||\n      (runtime !== 'deployed' && runtime !== 'preview') ||\n      (subType !== 'employee' && subType !== 'machine') ||\n      !sized(sub, 1, VISITOR_MAX_STRING_BYTES) ||\n      // An employee's access always has a grant; a machine visitor has none.\n      typeof grant !== 'string' || (subType === 'employee' ? !sized(grant, 1, VISITOR_MAX_STRING_BYTES) : grant !== '') ||\n      !Array.isArray(appRoles) || appRoles.some((role) => !sized(role, 1, VISITOR_MAX_STRING_BYTES)) ||\n      (activeRole !== undefined && !sized(activeRole, 1, VISITOR_MAX_STRING_BYTES))) throw fail();\n  return Object.freeze({\n    subType, subject: sub, grant, workspaceID: ws, appID, runtime,\n    appRoles: Object.freeze([...new Set(appRoles as string[])]),\n    ...(activeRole === undefined ? {} : { activeRole }),\n  });\n}\n"]}