@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.284

package/components/identity.tokens/operations/issue.js

@@ -8,7 +8,8 @@ export class Effect {
         this.keys = context.remote.identity.keys;
         this.roles = context.remote.identity.roles;
         this.encrypt = context.local.encrypt;
-        this.lifetime = context.configuration.lifetime * 1000;
+        // seconds, as `input.lifetime` and `encrypt` both are
+        this.lifetime = context.configuration.lifetime;
     }
     async execute(input) {
         const lifetime = input.lifetime ?? this.lifetime;
@@ -53,4 +54,4 @@ export class Effect {
         };
     }
 }
-//# sourceMappingURL=issue.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXNzdWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvaXNzdWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBS3ZDLE1BQU0sT0FBTyxNQUFNO0lBQ1QsSUFBSSxDQUF3QztJQUM1QyxLQUFLLENBQXlDO0lBQzlDLE9BQU8sQ0FBOEI7SUFDckMsUUFBUSxDQUFTO0lBRWxCLEtBQUssQ0FBRSxPQUFnQjtRQUM1QixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQTtRQUN4QyxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQTtRQUMxQyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFBO1FBQ3BDLHNEQUFzRDtRQUN0RCxJQUFJLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFBO0lBQ2hELENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFFLEtBQVk7UUFDaEMsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFBO1FBRWhELE1BQU0sT0FBTyxHQUFHLFFBQVEsS0FBSyxDQUFDO1lBQzVCLENBQUMsQ0FBQyxTQUFTO1lBQ1gsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxRQUFRLEdBQUcsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUE7UUFFcEQsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUNqQyxLQUFLLEVBQUU7Z0JBQ0wsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUs7Z0JBQ2xCLE9BQU87YUFDUjtTQUNGLENBQUMsQ0FBQTtRQUVGLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDbEMsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxhQUFhLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUU7Z0JBQzlDLEtBQUssRUFBRSxJQUFJO2FBQ1o7U0FDRixDQUFDLENBQUE7UUFFRixNQUFNLFFBQVEsR0FBYTtZQUN6QixFQUFFLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDbEIsS0FBSztTQUNOLENBQUE7UUFFRCxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFFaEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQy9CLEtBQUssRUFBRTtnQkFDTCxTQUFTO2dCQUNULFFBQVE7Z0JBQ1IsUUFBUTtnQkFDUixNQUFNO2dCQUNOLFdBQVc7Z0JBQ1gsR0FBRzthQUNKO1NBQ0YsQ0FBQyxDQUFBO1FBRUYsSUFBSSxLQUFLLFlBQVksS0FBSztZQUN4QixPQUFPLEtBQUssQ0FBQTtRQUVkLE9BQU87WUFDTCxHQUFHLEVBQUUsR0FBRyxDQUFDLEVBQUU7WUFDWCxpREFBaUQ7WUFDakQsR0FBRyxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDOUMsS0FBSztTQUNOLENBQUE7SUFDSCxDQUFDO0NBQ0YifQ==

package/components/identity.tokens/operations/lib/form.js

@@ -0,0 +1,24 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form(token) {
+    if (token.startsWith(PASETO))
+        return 'paseto';
+    if (segments(token) === JWE_SEGMENTS)
+        return 'jwe';
+    return null;
+}
+function segments(token) {
+    let count = 1;
+    for (let i = 0; i < token.length; i++)
+        if (token.charCodeAt(i) === DOT)
+            count++;
+    return count;
+}
+const PASETO = 'v3.local.';
+const JWE_SEGMENTS = 5;
+const DOT = 46;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9ybS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvZm9ybS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxJQUFJLENBQUUsS0FBYTtJQUNqQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQzFCLE9BQU8sUUFBUSxDQUFBO0lBRWpCLElBQUksUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLFlBQVk7UUFDbEMsT0FBTyxLQUFLLENBQUE7SUFFZCxPQUFPLElBQUksQ0FBQTtBQUNiLENBQUM7QUFFRCxTQUFTLFFBQVEsQ0FBRSxLQUFhO0lBQzlCLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQTtJQUViLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRTtRQUNuQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEtBQUssR0FBRztZQUM3QixLQUFLLEVBQUUsQ0FBQTtJQUVYLE9BQU8sS0FBSyxDQUFBO0FBQ2QsQ0FBQztBQUVELE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQTtBQUMxQixNQUFNLFlBQVksR0FBRyxDQUFDLENBQUE7QUFDdEIsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.tokens/operations/lib/index.js

@@ -1,4 +1,4 @@
+export * from './form.js';
 export * from './pad.js';
-export * from './types.js';
 export { jweKey } from './key.js';
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsV0FBVyxDQUFBO0FBQ3pCLGNBQWMsVUFBVSxDQUFBO0FBRXhCLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxVQUFVLENBQUEifQ==

package/components/identity.tokens/operations/lib/jose.js

@@ -1,2 +1,2 @@
 export const load = async () => await import('jose');
-//# sourceMappingURL=jose.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.tokens/operations/lib/key.js

@@ -4,4 +4,4 @@ export function jweKey(value) {
         throw new TypeError('JWE key must be a base64url-encoded 256-bit secret');
     return new Uint8Array(key);
 }
-//# sourceMappingURL=key.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxVQUFVLE1BQU0sQ0FBRSxLQUFhO0lBQ25DLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFBO0lBRTNDLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxFQUFFLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLO1FBQzFELE1BQU0sSUFBSSxTQUFTLENBQUMsb0RBQW9ELENBQUMsQ0FBQTtJQUUzRSxPQUFPLElBQUksVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQzVCLENBQUMifQ==

package/components/identity.tokens/operations/lib/pad.js

@@ -1,2 +1,2 @@
 export const PAD = 'v3.local.';
-//# sourceMappingURL=pad.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9wYWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHLFdBQVcsQ0FBQSJ9

package/components/identity.tokens/operations/revoke.js

@@ -1,4 +1,4 @@
 export function transition(_, object) {
     object.revokedAt = Date.now();
 }
-//# sourceMappingURL=revoke.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLFVBQVUsVUFBVSxDQUFFLENBQVUsRUFBRSxNQUFjO0lBQ3BELE1BQU0sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFBO0FBQy9CLENBQUMifQ==

package/components/identity.tokens/source/authenticate.test.ts

@@ -4,7 +4,7 @@ import assert from 'node:assert/strict'
 import { generate } from 'randomstring'
 import { Computation as Authenticate } from './authenticate.js'
 import type { Configuration, Context, DecryptOutput, Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let configuration: Configuration
 let context: Context
@@ -14,6 +14,9 @@ let authenticate: Authenticate
 const identity: Identity = { id: generate(), roles: [] }
 const authority = generate()
 
+/** Compact JWE shape: `authenticate` reads it before decrypting, and `decrypt` is mocked. */
+const credentials = 'header.key.iv.ciphertext.tag'
+
 beforeEach(() => {
   configuration = {
     keys: [
@@ -53,7 +56,7 @@ for (const [expected, shift] of [
 
   const result = await authenticate.execute({
     authority,
-    credentials: ''
+    credentials
   })
 
   assert.deepStrictEqual(result, { identity, refresh: expected })
@@ -68,7 +71,7 @@ for (const refresh of [true, false])
 
     const result = await authenticate.execute({
       authority,
-      credentials: ''
+      credentials
     })
 
     assert.deepStrictEqual(result, { identity, refresh })
@@ -80,7 +83,7 @@ it('should not refresh an aged custom token', async () => {
 
   output = { iss: authority, identity, exp, iat, refresh: false, custom: true }
 
-  const result = await authenticate.execute({ authority, credentials: '' })
+  const result = await authenticate.execute({ authority, credentials })
 
   assert.deepStrictEqual(result, { identity, refresh: false })
 })
@@ -93,7 +96,7 @@ it('should check revocation of an aged custom token', async () => {
   context.local.observe = mock.fn(async () => ({ revokedAt: Date.now() })) as unknown as Context['local']['observe']
   authenticate.mount(context)
 
-  const result: any = await authenticate.execute({ authority, credentials: '' })
+  const result: any = await authenticate.execute({ authority, credentials })
 
   assert.deepStrictEqual(result.code, 'TOKEN_REVOKED')
 })

package/components/identity.tokens/source/authenticate.ts

@@ -1,4 +1,6 @@
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
+import { form } from './lib/index.js'
 import type { AuthenticateInput, AuthenticateOutput, Context } from './lib/index.js'
 
 export class Computation implements Operation {
@@ -13,6 +15,11 @@ export class Computation implements Operation {
   }
 
   public async execute (input: AuthenticateInput): Promise<Maybe<AuthenticateOutput>> {
+    // `Bearer` is presented by an OpenID id_token too, and the gateway asks each provider
+    // in turn: a credential this component did not issue is declined, not rejected
+    if (form(input.credentials) === null)
+      return ERR_UNRECOGNIZED
+
     const claims = await this.decrypt({ input: input.credentials })
 
     if (claims instanceof Error)
@@ -43,6 +50,10 @@ export class Computation implements Operation {
   }
 }
 
+const ERR_UNRECOGNIZED = new (class UnrecognizedError extends Error {
+  public readonly code = 'UNRECOGNIZED'
+})()
+
 const ERR_AUTHORITY = new (class AuthorityMismatchError extends Error {
   public readonly code = 'AUTHORITY_MISMATCH'
 })()

package/components/identity.tokens/source/decrypt.test.ts

@@ -6,7 +6,7 @@ import { EncryptFactory, ImportKeyFactory } from 'paseto/v3/local'
 import { Effect as Encrypt } from './encrypt.js'
 import { Computation as Decrypt } from './decrypt.js'
 import { type Configuration, type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let configuration: Configuration
 let context: Context

package/components/identity.tokens/source/decrypt.ts

@@ -1,8 +1,9 @@
 import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local'
 import { LRUCache } from 'lru-cache'
-import { jweKey } from './lib/index.js'
+import { form, jweKey } from './lib/index.js'
 import { load } from './lib/jose.js'
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Claims, DecryptOutput, JWEClaims } from './lib/index.js'
 
 export class Computation implements Operation {
@@ -32,7 +33,7 @@ export class Computation implements Operation {
   }
 
   public async execute (token: string): Promise<Maybe<DecryptOutput>> {
-    const legacy = token.startsWith('v3.local.')
+    const legacy = form(token) === 'paseto'
     const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token)
 
     if (kid instanceof Error)

package/components/identity.tokens/source/encrypt.test.ts

@@ -6,7 +6,7 @@ import { timeout } from '@toa.io/generic'
 import { Effect as Encrypt } from './encrypt.js'
 import { Computation as Decrypt } from './decrypt.js'
 import { type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let encrypt: Encrypt
 let decrypt: Decrypt

package/components/identity.tokens/source/encrypt.ts

@@ -1,6 +1,7 @@
 import { jweKey } from './lib/index.js'
 import { load } from './lib/jose.js'
-import type { Operation, Maybe } from '@toa.io/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Maybe } from '@toa.io/core'
 import type { Identity, Context, EncryptInput, Key } from './lib/index.js'
 
 export class Effect implements Operation {

package/components/identity.tokens/source/issue.test.ts

@@ -0,0 +1,71 @@
+import { it, beforeEach, mock } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { generate } from 'randomstring'
+import { Effect as Issue } from './issue.js'
+import type { Context, EncryptInput } from './lib/index.js'
+
+const LIFETIME = 2592000 // seconds, the configured default
+const identity = generate()
+const authority = generate()
+const label = generate()
+
+let issue: Issue
+let encrypted: EncryptInput
+
+beforeEach(() => {
+  const context = {
+    configuration: { lifetime: LIFETIME },
+    remote: {
+      identity: {
+        keys: { create: mock.fn(async () => ({ id: 'kid0', key: 'secret' })) },
+        roles: { list: mock.fn(async () => []) }
+      }
+    },
+    local: {
+      encrypt: mock.fn(async ({ input }: { input: EncryptInput }) => {
+        encrypted = input
+
+        return 'token'
+      })
+    }
+  } as unknown as Context
+
+  issue = new Issue()
+  issue.mount(context)
+})
+
+/**
+ * The configured lifetime is seconds, as the schema says and as `encrypt` reads it. Storing
+ * it as milliseconds and then multiplying again put the expiration some eighty thousand years
+ * out, and only on this path — every scenario passes a lifetime of its own.
+ */
+it('should expire a token issued without a lifetime as the configuration says', async () => {
+  const now = Date.now()
+  const reply: any = await issue.execute({ authority, identity, label })
+
+  const seconds = (reply.exp - now) / 1000
+
+  assert.ok(Math.abs(seconds - LIFETIME) < 10,
+    `expected to expire in about ${LIFETIME} seconds, got ${seconds}`)
+})
+
+it('should hand the lifetime to `encrypt` in the seconds it reads', async () => {
+  await issue.execute({ authority, identity, label })
+
+  assert.equal(encrypted.lifetime, LIFETIME)
+})
+
+it('should expire a token as its own lifetime says', async () => {
+  const now = Date.now()
+  const reply: any = await issue.execute({ authority, identity, label, lifetime: 600 })
+
+  assert.ok(Math.abs((reply.exp - now) / 1000 - 600) < 10)
+  assert.equal(encrypted.lifetime, 600)
+})
+
+it('should issue a token that does not expire INSECURE', async () => {
+  const reply: any = await issue.execute({ authority, identity, label, lifetime: 0 })
+
+  assert.equal(reply.exp, undefined)
+})

package/components/identity.tokens/source/issue.ts

@@ -1,5 +1,6 @@
 import { quote } from '@toa.io/generic'
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Identity } from './lib/index.js'
 
 export class Effect implements Operation {
@@ -12,7 +13,8 @@ export class Effect implements Operation {
     this.keys = context.remote.identity.keys
     this.roles = context.remote.identity.roles
     this.encrypt = context.local.encrypt
-    this.lifetime = context.configuration.lifetime * 1000
+    // seconds, as `input.lifetime` and `encrypt` both are
+    this.lifetime = context.configuration.lifetime
   }
 
   public async execute (input: Input): Promise<Maybe<Output>> {

package/components/identity.tokens/source/lib/form.test.ts

@@ -0,0 +1,25 @@
+import { it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { form } from './form.js'
+
+it('should recognize a compact JWE by its five segments', () => {
+  assert.equal(form('header.key.iv.ciphertext.tag'), 'jwe')
+})
+
+it('should recognize a legacy PASETO by its prefix', () => {
+  assert.equal(form('v3.local.payload'), 'paseto')
+})
+
+it('should not recognize a JWS, which is what an id_token is', () => {
+  assert.equal(form('header.payload.signature'), null)
+})
+
+it('should not recognize what is not a token at all', () => {
+  for (const value of ['', 'token', 'header.key.iv.ciphertext.tag.extra'])
+    assert.equal(form(value), null)
+})
+
+it('should read the shape and nothing else, leaving the rest to the verifier', () => {
+  assert.equal(form('....'), 'jwe')
+})

package/components/identity.tokens/source/lib/form.ts

@@ -0,0 +1,31 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form (token: string): Form | null {
+  if (token.startsWith(PASETO))
+    return 'paseto'
+
+  if (segments(token) === JWE_SEGMENTS)
+    return 'jwe'
+
+  return null
+}
+
+function segments (token: string): number {
+  let count = 1
+
+  for (let i = 0; i < token.length; i++)
+    if (token.charCodeAt(i) === DOT)
+      count++
+
+  return count
+}
+
+const PASETO = 'v3.local.'
+const JWE_SEGMENTS = 5
+const DOT = 46
+
+export type Form = 'paseto' | 'jwe'

package/components/identity.tokens/source/lib/index.ts

@@ -1,3 +1,4 @@
+export * from './form.js'
 export * from './pad.js'
-export * from './types.js'
+export type * from '../../types/index.js'
 export { jweKey } from './key.js'

package/components/identity.tokens/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../../tsconfig.component.json",
   "compilerOptions": {
     "outDir": "./operations",
     "rootDir": "./source"