@tier0/sdk-v2 0.9.10 → 0.10.1

package/dist/esm/cloud-server.js

@@ -1,109 +1,111 @@
-// Server-only entry point. Browser HTTP clients remain independent of node:crypto.
-import { createHash, createPublicKey, verify } from 'node:crypto';
-import { APP_REQUEST_IDENTITY_CONTRACT as contract } from './app-identity-contract.generated.js';
-export const APP_REQUEST_IDENTITY_HEADER = contract.header;
-export class AppRequestIdentityError extends Error {
+// Server-only entry point: the App's view of the request it is serving.
+import { getEnvVar } from './runtime-env.js';
+const maxID = BigInt('9223372036854775807');
+/** A positive decimal int64 without sign or leading zero. */
+const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */
+export const VISITOR_HEADER = 'X-Tier0-Visitor';
+/** Limit of the JSON before encoding. */
+const VISITOR_MAX_JSON_BYTES = 8192;
+/** Unpadded base64url of `VISITOR_MAX_JSON_BYTES`. */
+const VISITOR_MAX_HEADER_LENGTH = Math.ceil((VISITOR_MAX_JSON_BYTES * 4) / 3);
+const VISITOR_MAX_STRING_BYTES = 128;
+const VISITOR_FIELDS = new Set(['ws', 'app', 'runtime', 'sub_type', 'sub', 'grant', 'app_roles', 'active_role']);
+export class VisitorError extends Error {
     code;
     constructor(code) {
         super(code);
         this.code = code;
-        this.name = 'AppRequestIdentityError';
+        this.name = 'VisitorError';
     }
 }
-const invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');
-const invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');
-const appPattern = new RegExp(contract.appIDPattern);
-const kidPattern = new RegExp(contract.keyIDPattern);
-const methodPattern = new RegExp(contract.methodPattern);
-const maxID = BigInt('9223372036854775807');
-const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
-const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
-const exactKeys = (value, keys) => Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));
-const validString = (value, maxBytes) => typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&
-    Buffer.from(value).toString('utf8') === value && !/[\u0000-\u001f\u007f-\u009f]/.test(value);
-const decode = (value) => {
-    if (!/^[A-Za-z0-9_-]+$/.test(value))
-        throw invalid();
-    const bytes = Buffer.from(value, 'base64url');
-    if (bytes.toString('base64url') !== value)
-        throw invalid();
-    return bytes;
-};
-/** Verifies request provenance, not business authorization or delegated UNS permissions. */
-export function createCloudAppRequestVerifier(authority) {
-    if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID))
-        throw invalidConfig();
-    const appID = authority.appID;
-    const workspaceID = authority.workspaceID;
-    const keys = new Map();
-    try {
-        let raw = authority.publicKeys;
-        if (typeof raw === 'string') {
-            if (Buffer.byteLength(raw) > contract.maxTokenBytes * contract.maxKeys)
-                throw invalidConfig();
-            raw = JSON.parse(raw);
-        }
-        if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||
-            raw.keys.length === 0 || raw.keys.length > contract.maxKeys)
-            throw invalidConfig();
-        for (const key of raw.keys) {
-            if (!isObject(key) || !exactKeys(key, contract.publicKeyFields) || key.kty !== 'OKP' ||
-                key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||
-                keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32)
-                throw invalidConfig();
-            keys.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));
+/** A UTF-16 surrogate without its pair, as JSON escapes like "\ud800" can produce. */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/**
+ * Raw key tokens of the top-level object, for spotting duplicates
+ * (`JSON.parse` keeps the last silently). Values of the visitor are strings
+ * and arrays of strings, so only depth 1 holds keys.
+ */
+function topLevelKeys(json) {
+    const keys = [];
+    let depth = 0;
+    for (let i = 0; i < json.length; i += 1) {
+        const char = json[i];
+        if (char === '{' || char === '[')
+            depth += 1;
+        else if (char === '}' || char === ']')
+            depth -= 1;
+        else if (char === '"') {
+            const start = i;
+            for (i += 1; i < json.length && json[i] !== '"'; i += 1)
+                if (json[i] === '\\')
+                    i += 1;
+            let next = i + 1;
+            while (next < json.length && /\s/.test(json[next]))
+                next += 1;
+            if (depth === 1 && json[next] === ':')
+                keys.push(json.slice(start, i + 1));
         }
     }
+    return keys;
+}
+const bytes = (value) => Buffer.byteLength(value, 'utf8');
+const sized = (value, min, max) => typeof value === 'string' && !LONE_SURROGATE.test(value) && bytes(value) >= min && bytes(value) <= max;
+/**
+ * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8
+ * JSON object of at most 8192 bytes. The header is not signed; the front door
+ * is the only way into the App and replaces whatever the client sent. Parsing
+ * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate
+ * (e.g. `"\ud800"`), an unknown or missing field, a wrong type or length, a `ws` that
+ * is not a positive decimal ID without sign or leading zero, an employee
+ * without a grant or a machine visitor with one, or an `app` other than this
+ * App's throws `VISITOR_HEADER_INVALID`. Without an App ID
+ * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.
+ */
+export function parseVisitorHeader(value, options = {}) {
+    const appID = options.appID ?? getEnvVar('TIER0_APP_ID')?.trim();
+    if (!appID)
+        throw new VisitorError('VISITOR_CONFIGURATION_INVALID');
+    const fail = () => new VisitorError('VISITOR_HEADER_INVALID');
+    if (typeof value !== 'string' || value.length === 0 || value.length > VISITOR_MAX_HEADER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw fail();
+    const raw = Buffer.from(value, 'base64url');
+    // Only the canonical encoding: no padding, no stray trailing bits.
+    if (raw.length > VISITOR_MAX_JSON_BYTES || raw.toString('base64url') !== value)
+        throw fail();
+    // A UTF-8 byte order mark is not part of the contract (TextDecoder would drop it silently).
+    if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf)
+        throw fail();
+    let claims;
+    let json;
+    try {
+        json = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+        claims = JSON.parse(json);
+    }
     catch {
-        throw invalidConfig();
+        throw fail();
     }
-    return (request) => {
-        try {
-            if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > contract.maxTokenBytes ||
-                !(request.body instanceof Uint8Array) || request.body.byteLength > contract.maxBodyBytes ||
-                !methodPattern.test(request.method) || !validString(request.requestURI, contract.maxURIBytes) ||
-                !request.requestURI.startsWith('/') || request.requestURI.startsWith('//'))
-                throw invalid();
-            const parts = request.assertion.split('.');
-            if (parts.length !== 3)
-                throw invalid();
-            const header = JSON.parse(decode(parts[0]).toString('utf8'));
-            if (!isObject(header) || !exactKeys(header, contract.requiredHeaderFields) ||
-                header.alg !== contract.algorithm || header.typ !== contract.type ||
-                typeof header.kid !== 'string' || !kidPattern.test(header.kid))
-                throw invalid();
-            const key = keys.get(header.kid);
-            const signature = decode(parts[2]);
-            if (!key || signature.length !== 64 ||
-                !verify(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature))
-                throw invalid();
-            const claims = JSON.parse(decode(parts[1]).toString('utf8'));
-            if (!isObject(claims) || !exactKeys(claims, contract.requiredClaims) ||
-                claims.ver !== contract.version || claims.iss !== contract.issuer || claims.aud !== contract.audience ||
-                !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||
-                claims.method !== request.method || claims.requestURI !== request.requestURI ||
-                typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||
-                claims.bodySHA256 !== createHash('sha256').update(request.body).digest('hex') ||
-                typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||
-                typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||
-                claims.exp - claims.iat > contract.maxTTLSeconds ||
-                typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||
-                !Array.isArray(claims.roles) || claims.roles.length > contract.maxRoles ||
-                claims.roles.some((role) => !validString(role, contract.maxRoleBytes) || role.trim() !== role) ||
-                new Set(claims.roles).size !== claims.roles.length)
-                throw invalid();
-            const now = Math.floor(Date.now() / 1000);
-            if (claims.iat > now + contract.clockSkewSeconds || now >= claims.exp + contract.clockSkewSeconds)
-                throw invalid();
-            return Object.freeze({
-                kind: 'gateway-user', userID: claims.sub, workspaceID, appID,
-                roleKeys: Object.freeze([...claims.roles]), requestID: claims.jti,
-                issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,
-            });
-        }
-        catch {
-            throw invalid();
-        }
-    };
+    if (!isObject(claims) || Object.keys(claims).some((key) => !VISITOR_FIELDS.has(key)))
+        throw fail();
+    // Every key at most once, each spelling decoded ("\u0077s" is "ws").
+    const keys = topLevelKeys(json).map((token) => JSON.parse(token));
+    if (new Set(keys).size !== keys.length)
+        throw fail();
+    const { ws, app, runtime, sub_type: subType, sub, grant, app_roles: appRoles, active_role: activeRole } = claims;
+    if (!validID(ws) || app !== appID ||
+        (runtime !== 'deployed' && runtime !== 'preview') ||
+        (subType !== 'employee' && subType !== 'machine') ||
+        !sized(sub, 1, VISITOR_MAX_STRING_BYTES) ||
+        // An employee's access always has a grant; a machine visitor has none.
+        typeof grant !== 'string' || (subType === 'employee' ? !sized(grant, 1, VISITOR_MAX_STRING_BYTES) : grant !== '') ||
+        !Array.isArray(appRoles) || appRoles.some((role) => !sized(role, 1, VISITOR_MAX_STRING_BYTES)) ||
+        (activeRole !== undefined && !sized(activeRole, 1, VISITOR_MAX_STRING_BYTES)))
+        throw fail();
+    return Object.freeze({
+        subType, subject: sub, grant, workspaceID: ws, appID, runtime,
+        appRoles: Object.freeze([...new Set(appRoles)]),
+        ...(activeRole === undefined ? {} : { activeRole }),
+    });
 }
 //# sourceMappingURL=cloud-server.js.map

package/dist/esm/cloud-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,6BAA6B,IAAI,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAEjG,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,MAAM,CAAC;AAE3D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,IAAmE;QAC7F,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAA+D;QAE7F,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AA6BD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzD,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,IAAuB,EAAE,EAAE,CAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAmB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ;IACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;IAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAAC,SAAoC;IAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC/J,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO;gBAAE,MAAM,aAAa,EAAE,CAAC;YAC9F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO;YAAE,MAAM,aAAa,EAAE,CAAC;QACvF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;gBAChF,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,aAAa,EAAE,CAAC;YACzG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,aAAa,EAAE,CAAC;IAAC,CAAC;IAElC,OAAO,CAAC,OAAgC,EAAwB,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,aAAa;gBACtG,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,YAAY;gBACxF,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAC7F,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YAChG,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;gBACtE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI;gBACjE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAC/B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpG,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC;gBAChE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;gBACrG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBACpF,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAC5E,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAClF,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC;gBACtF,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;gBAC/F,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,aAAa;gBAChD,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ;gBACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;gBAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,gBAAgB,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,gBAAgB;gBAAE,MAAM,OAAO,EAAE,CAAC;YACnH,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,cAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK;gBACrE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG;gBAC7E,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Server-only entry point. Browser HTTP clients remain independent of node:crypto.\nimport { createHash, createPublicKey, verify, type KeyObject } from 'node:crypto';\nimport { APP_REQUEST_IDENTITY_CONTRACT as contract } from './app-identity-contract.generated.js';\n\nexport const APP_REQUEST_IDENTITY_HEADER = contract.header;\n\nexport class AppRequestIdentityError extends Error {\n  constructor(public readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID') {\n    super(code);\n    this.name = 'AppRequestIdentityError';\n  }\n}\n\nexport interface VerifiedCloudAppUser {\n  readonly kind: 'gateway-user';\n  readonly userID: string;\n  readonly workspaceID: string;\n  readonly appID: string;\n  readonly roleKeys: readonly string[];\n  readonly requestID: string;\n  readonly issuedAt: number;\n  readonly expiresAt: number;\n  readonly verificationKeyID: string;\n}\n\nexport interface CloudAppIdentityAuthority {\n  appID: string;\n  workspaceID: string;\n  /** Pinned server configuration, never a key or URL taken from the request. */\n  publicKeys: unknown;\n}\n\nexport interface CloudAppIdentityRequest {\n  assertion: string | undefined;\n  method: string;\n  requestURI: string;\n  /** Exact bytes received from the gateway, before JSON parsing or normalization. */\n  body: Uint8Array;\n}\n\nconst invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');\nconst invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');\nconst appPattern = new RegExp(contract.appIDPattern);\nconst kidPattern = new RegExp(contract.keyIDPattern);\nconst methodPattern = new RegExp(contract.methodPattern);\nconst maxID = BigInt('9223372036854775807');\nconst validID = (value: unknown): value is string =>\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value);\nconst exactKeys = (value: Record<string, unknown>, keys: readonly string[]) =>\n  Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));\nconst validString = (value: unknown, maxBytes: number): value is string =>\n  typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&\n  Buffer.from(value).toString('utf8') === value && !/[\\u0000-\\u001f\\u007f-\\u009f]/.test(value);\nconst decode = (value: string) => {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw invalid();\n  const bytes = Buffer.from(value, 'base64url');\n  if (bytes.toString('base64url') !== value) throw invalid();\n  return bytes;\n};\n\n/** Verifies request provenance, not business authorization or delegated UNS permissions. */\nexport function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority) {\n  if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID)) throw invalidConfig();\n  const appID = authority.appID;\n  const workspaceID = authority.workspaceID;\n  const keys = new Map<string, KeyObject>();\n  try {\n    let raw = authority.publicKeys;\n    if (typeof raw === 'string') {\n      if (Buffer.byteLength(raw) > contract.maxTokenBytes * contract.maxKeys) throw invalidConfig();\n      raw = JSON.parse(raw);\n    }\n    if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||\n        raw.keys.length === 0 || raw.keys.length > contract.maxKeys) throw invalidConfig();\n    for (const key of raw.keys) {\n      if (!isObject(key) || !exactKeys(key, contract.publicKeyFields) || key.kty !== 'OKP' ||\n          key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||\n          keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32) throw invalidConfig();\n      keys.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));\n    }\n  } catch { throw invalidConfig(); }\n\n  return (request: CloudAppIdentityRequest): VerifiedCloudAppUser => {\n    try {\n      if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > contract.maxTokenBytes ||\n          !(request.body instanceof Uint8Array) || request.body.byteLength > contract.maxBodyBytes ||\n          !methodPattern.test(request.method) || !validString(request.requestURI, contract.maxURIBytes) ||\n          !request.requestURI.startsWith('/') || request.requestURI.startsWith('//')) throw invalid();\n      const parts = request.assertion.split('.');\n      if (parts.length !== 3) throw invalid();\n      const header: unknown = JSON.parse(decode(parts[0]).toString('utf8'));\n      if (!isObject(header) || !exactKeys(header, contract.requiredHeaderFields) ||\n          header.alg !== contract.algorithm || header.typ !== contract.type ||\n          typeof header.kid !== 'string' || !kidPattern.test(header.kid)) throw invalid();\n      const key = keys.get(header.kid);\n      const signature = decode(parts[2]);\n      if (!key || signature.length !== 64 ||\n          !verify(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature)) throw invalid();\n      const claims: unknown = JSON.parse(decode(parts[1]).toString('utf8'));\n      if (!isObject(claims) || !exactKeys(claims, contract.requiredClaims) ||\n          claims.ver !== contract.version || claims.iss !== contract.issuer || claims.aud !== contract.audience ||\n          !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||\n          claims.method !== request.method || claims.requestURI !== request.requestURI ||\n          typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||\n          claims.bodySHA256 !== createHash('sha256').update(request.body).digest('hex') ||\n          typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||\n          typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||\n          claims.exp - claims.iat > contract.maxTTLSeconds ||\n          typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||\n          !Array.isArray(claims.roles) || claims.roles.length > contract.maxRoles ||\n          claims.roles.some((role) => !validString(role, contract.maxRoleBytes) || role.trim() !== role) ||\n          new Set(claims.roles).size !== claims.roles.length) throw invalid();\n      const now = Math.floor(Date.now() / 1000);\n      if (claims.iat > now + contract.clockSkewSeconds || now >= claims.exp + contract.clockSkewSeconds) throw invalid();\n      return Object.freeze({\n        kind: 'gateway-user' as const, userID: claims.sub, workspaceID, appID,\n        roleKeys: Object.freeze([...claims.roles] as string[]), requestID: claims.jti,\n        issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,\n      });\n    } catch { throw invalid(); }\n  };\n}\n"]}
+{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,6DAA6D;AAC7D,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEhE,sHAAsH;AACtH,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,yCAAyC;AACzC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,sBAAsB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9E,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAItI,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,IAAsB;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAAkB;QAEhD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAuBD,sFAAsF;AACtF,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAEhG;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACxC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAClE,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CAC1E,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;AAEzG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgC,EAAE,UAA+B,EAAE;IACpG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IACjJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5C,mEAAmE;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,EAAE,CAAC;IAC7F,4FAA4F;IAC5F,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,EAAE,CAAC;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IACnG,qEAAqE;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC,CAAC;IAC5E,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,EAAE,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,KAAK;QAC7B,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,CAAC;QACjD,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,CAAC;QACjD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,wBAAwB,CAAC;QACxC,uEAAuE;QACvE,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACjH,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC9F,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IAChG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO;QAC7D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAoB,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC","sourcesContent":["// Server-only entry point: the App's view of the request it is serving.\nimport { getEnvVar } from './runtime-env.js';\n\nconst maxID = BigInt('9223372036854775807');\n/** A positive decimal int64 without sign or leading zero. */\nconst validID = (value: unknown): value is string =>\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value);\n\n/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */\nexport const VISITOR_HEADER = 'X-Tier0-Visitor';\n\n/** Limit of the JSON before encoding. */\nconst VISITOR_MAX_JSON_BYTES = 8192;\n/** Unpadded base64url of `VISITOR_MAX_JSON_BYTES`. */\nconst VISITOR_MAX_HEADER_LENGTH = Math.ceil((VISITOR_MAX_JSON_BYTES * 4) / 3);\nconst VISITOR_MAX_STRING_BYTES = 128;\nconst VISITOR_FIELDS: ReadonlySet<string> = new Set(['ws', 'app', 'runtime', 'sub_type', 'sub', 'grant', 'app_roles', 'active_role']);\n\nexport type VisitorErrorCode = 'VISITOR_HEADER_INVALID' | 'VISITOR_CONFIGURATION_INVALID';\n\nexport class VisitorError extends Error {\n  constructor(public readonly code: VisitorErrorCode) {\n    super(code);\n    this.name = 'VisitorError';\n  }\n}\n\n/** The visitor of a request, from `X-Tier0-Visitor`. */\nexport interface Visitor {\n  readonly subType: 'employee' | 'machine';\n  /** Employee user ID, or the call token ID of a machine visitor. */\n  readonly subject: string;\n  /** Grant of an employee's access; empty for a machine visitor. */\n  readonly grant: string;\n  readonly workspaceID: string;\n  readonly appID: string;\n  readonly runtime: 'deployed' | 'preview';\n  /** Roles of this visitor in the App; in Preview, the roles selected in \"view as\". */\n  readonly appRoles: readonly string[];\n  /** Only in Preview's \"view as\". */\n  readonly activeRole?: string;\n}\n\nexport interface ParseVisitorOptions {\n  /** The App the header must name. Defaults to `TIER0_APP_ID`. */\n  appID?: string;\n}\n\n/** A UTF-16 surrogate without its pair, as JSON escapes like \"\\ud800\" can produce. */\nconst LONE_SURROGATE = /[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]/;\n\n/**\n * Raw key tokens of the top-level object, for spotting duplicates\n * (`JSON.parse` keeps the last silently). Values of the visitor are strings\n * and arrays of strings, so only depth 1 holds keys.\n */\nfunction topLevelKeys(json: string): string[] {\n  const keys: string[] = [];\n  let depth = 0;\n  for (let i = 0; i < json.length; i += 1) {\n    const char = json[i];\n    if (char === '{' || char === '[') depth += 1;\n    else if (char === '}' || char === ']') depth -= 1;\n    else if (char === '\"') {\n      const start = i;\n      for (i += 1; i < json.length && json[i] !== '\"'; i += 1) if (json[i] === '\\\\') i += 1;\n      let next = i + 1;\n      while (next < json.length && /\\s/.test(json[next])) next += 1;\n      if (depth === 1 && json[next] === ':') keys.push(json.slice(start, i + 1));\n    }\n  }\n  return keys;\n}\n\nconst bytes = (value: string) => Buffer.byteLength(value, 'utf8');\nconst sized = (value: unknown, min: number, max: number): value is string =>\n  typeof value === 'string' && !LONE_SURROGATE.test(value) && bytes(value) >= min && bytes(value) <= max;\n\n/**\n * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8\n * JSON object of at most 8192 bytes. The header is not signed; the front door\n * is the only way into the App and replaces whatever the client sent. Parsing\n * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate\n * (e.g. `\"\\ud800\"`), an unknown or missing field, a wrong type or length, a `ws` that\n * is not a positive decimal ID without sign or leading zero, an employee\n * without a grant or a machine visitor with one, or an `app` other than this\n * App's throws `VISITOR_HEADER_INVALID`. Without an App ID\n * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.\n */\nexport function parseVisitorHeader(value: string | null | undefined, options: ParseVisitorOptions = {}): Visitor {\n  const appID = options.appID ?? getEnvVar('TIER0_APP_ID')?.trim();\n  if (!appID) throw new VisitorError('VISITOR_CONFIGURATION_INVALID');\n  const fail = () => new VisitorError('VISITOR_HEADER_INVALID');\n  if (typeof value !== 'string' || value.length === 0 || value.length > VISITOR_MAX_HEADER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(value)) throw fail();\n  const raw = Buffer.from(value, 'base64url');\n  // Only the canonical encoding: no padding, no stray trailing bits.\n  if (raw.length > VISITOR_MAX_JSON_BYTES || raw.toString('base64url') !== value) throw fail();\n  // A UTF-8 byte order mark is not part of the contract (TextDecoder would drop it silently).\n  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) throw fail();\n  let claims: unknown;\n  let json: string;\n  try {\n    json = new TextDecoder('utf-8', { fatal: true }).decode(raw);\n    claims = JSON.parse(json);\n  } catch {\n    throw fail();\n  }\n  if (!isObject(claims) || Object.keys(claims).some((key) => !VISITOR_FIELDS.has(key))) throw fail();\n  // Every key at most once, each spelling decoded (\"\\u0077s\" is \"ws\").\n  const keys = topLevelKeys(json).map((token) => JSON.parse(token) as string);\n  if (new Set(keys).size !== keys.length) throw fail();\n  const { ws, app, runtime, sub_type: subType, sub, grant, app_roles: appRoles, active_role: activeRole } = claims;\n  if (!validID(ws) || app !== appID ||\n      (runtime !== 'deployed' && runtime !== 'preview') ||\n      (subType !== 'employee' && subType !== 'machine') ||\n      !sized(sub, 1, VISITOR_MAX_STRING_BYTES) ||\n      // An employee's access always has a grant; a machine visitor has none.\n      typeof grant !== 'string' || (subType === 'employee' ? !sized(grant, 1, VISITOR_MAX_STRING_BYTES) : grant !== '') ||\n      !Array.isArray(appRoles) || appRoles.some((role) => !sized(role, 1, VISITOR_MAX_STRING_BYTES)) ||\n      (activeRole !== undefined && !sized(activeRole, 1, VISITOR_MAX_STRING_BYTES))) throw fail();\n  return Object.freeze({\n    subType, subject: sub, grant, workspaceID: ws, appID, runtime,\n    appRoles: Object.freeze([...new Set(appRoles as string[])]),\n    ...(activeRole === undefined ? {} : { activeRole }),\n  });\n}\n"]}

package/dist/esm/cloud-transport.d.ts

@@ -1,23 +1,11 @@
-import type { AppRuntime } from './runtime.js';
 import { type HttpClient, type RequestOptions } from './openapi/client.js';
-import { type UnsV2OperationName, type UnsV2StreamOperationName } from './uns-v2/generated.js';
 export interface CloudTransportConfig {
     /** Whole HTTP exchange including the response body, in milliseconds; default 60,000. */
     transportTimeoutMs?: number;
     /** UNS v2 response body limit; may only tighten the 20 MiB contract/RPC ceiling. */
     unsV2MaxResponseBytes?: number;
-    /**
-     * Opaque proof from the trusted App Gateway only: tier0.app-data-subject/v1,
-     * X-Tier0-App-Data-Subject, aud tier0-uns-data. Proof alone is not authentication;
-     * the SDK checks only compact syntax, never parses or trusts claims.
-     * Create a new client per incoming request; never reuse a token across users.
-     * Do not automatically forward the runtime App request assertion: its audience differs.
-     */
-    unsV2AppDataSubject?: string;
 }
 export declare const DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS = 60000;
-/** Header carrying `unsV2AppDataSubject`; the trusted App Gateway sets it on each business request. */
-export declare const UNS_V2_APP_DATA_SUBJECT_HEADER = "X-Tier0-App-Data-Subject";
 export declare const UNS_V2_MAX_REQUEST_BYTES: number;
 export declare const UNS_V2_MAX_RESPONSE_BYTES: number;
 type Failure = 'TRANSPORT_ERROR' | 'PROTOCOL_ERROR' | 'TRANSPORT_TIMEOUT' | 'TRANSPORT_ABORTED';
@@ -25,22 +13,28 @@ type Failure = 'TRANSPORT_ERROR' | 'PROTOCOL_ERROR' | 'TRANSPORT_TIMEOUT' | 'TRA
 export declare class CloudTransportError extends Error {
     readonly kind: Failure;
     readonly status?: number | undefined;
-    constructor(kind: Failure, status?: number | undefined);
+    readonly notStarted: boolean;
+    constructor(kind: Failure, status?: number | undefined, notStarted?: boolean);
 }
-/** Single fetch, no redirects/retries; one deadline covers both headers and body. */
+/**
+ * No redirects; one deadline covers both headers and body. The only retries are
+ * the HTTP client's, of answers the node proxy produced itself.
+ */
 export declare class CloudTransport {
-    #private;
     private readonly resolveClient;
     private readonly configuredTimeoutMs;
-    private get timeoutMs();
     private readonly unsV2MaxResponseBytes;
     constructor(resolveClient?: () => HttpClient, config?: CloudTransportConfig);
-    /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */
-    postText(path: string, body: string, options?: RequestOptions, operation?: UnsV2OperationName): Promise<{
+    /**
+     * `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body.
+     * `notForwarded`: the node proxy answered itself (`X-Tier0-Proxy: not-forwarded`), the platform never saw the request.
+     */
+    postText(path: string, body: string, options?: RequestOptions): Promise<{
         text: string;
         status: number;
         ok: boolean;
         retryAfter?: string;
+        notForwarded?: true;
     }>;
     /**
      * Opens a server-sent event stream (GET, `Accept: text/event-stream`
@@ -53,15 +47,16 @@ export declare class CloudTransport {
     getEventStream(path: string, options?: {
         lastEventId?: string;
         signal?: AbortSignal;
-    }, operation?: UnsV2StreamOperationName): Promise<{
+    }): Promise<{
         status: number;
         stream: ReadableStream<Uint8Array>;
         close(): void;
     } | {
         status: number;
         text: string;
+        notForwarded?: true;
     }>;
-    post(path: string, body: unknown, signal?: AbortSignal, runtime?: AppRuntime): Promise<{
+    post(path: string, body: unknown, signal?: AbortSignal): Promise<{
         value: unknown;
         status: number;
         ok: boolean;