@undefineds.co/xpod 0.3.70 → 0.3.71-rc.2

package/dist/api/ai-gateway/auth/InvocationTokenCodec.js.map

@@ -1 +1 @@
-{"version":3,"file":"InvocationTokenCodec.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/InvocationTokenCodec.ts"],"names":[],"mappings":";;;AAwLA,wDAmBC;AAyBD,sDAgBC;AApPD,6CAAwF;AAIxF,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AAoCrB,MAAa,uBAAuB;IAIlC,YAAmB,OAAuC;QAFzC,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGhD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,KAA2B;QACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,eAAe,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,MAAM;YACX,KAAK;YACL,MAAM;YACN,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACxD,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,IAAI,CAAC,MAAM,CAAC,GAAG;YACf,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IACE,CAAC,GAAG;eACD,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAClE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IACE,KAAK,CAAC,MAAM,KAAK,WAAW;mBACzB,UAAU,CAAC,MAAM,KAAK,CAAC;mBACvB,UAAU,CAAC,MAAM,GAAG,oBAAoB;mBACxC,GAAG,CAAC,MAAM,KAAK,EAAE,EACpB,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IACE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD;;oBAEtE,MAAM,CAAC,CAAC,KAAK,CAAC;mBACX,MAAM,CAAC,GAAG,KAAK,GAAG;mBAClB,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;mBAChE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;mBAChC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;mBAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAC/C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,GAAG;gBACH,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ;gBACR,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC;gBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAvID,0DAuIC;AAED,SAAgB,sBAAsB,CAAC,KAAa,EAAE,IAAI,GAAG,QAAQ;IACnE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;WACpB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,MAAM,KAAK,KAAK,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,GAAG,WAAW,IAAI,EAAE,MAAM,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;aAC5B,MAAM,EAAE;aACR,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,IAAI,KAAK,KAAK,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;WACf,KAAK,CAAC,MAAM,GAAG,UAAU;WACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACrG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAW,EAAE,IAAY;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,aAAa,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';\nimport type { GatewayDeployment } from './GatewayApiKey';\nimport type { GatewayKeyLocatorSecret } from './GatewayKeyLocatorCodec';\n\nconst PREFIX = 'xpod_inv_v1';\nconst AAD_CONTEXT = 'xpod:gateway:internal-invocation:v1';\nconst NONCE_BYTES = 12;\nconst KEY_BYTES = 32;\nconst MAX_TOKEN_LENGTH = 8_192;\nconst MAX_CIPHERTEXT_BYTES = 4_096;\nconst MAX_TTL_MS = 15 * 60_000;\nconst MAX_SCOPES = 8;\n\nexport interface InvocationTokenClaims {\n  version: 1;\n  kid: string;\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti: string;\n}\n\nexport interface InvocationTokenInput {\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti?: string;\n}\n\nexport interface InvocationTokenCodec {\n  encode(input: InvocationTokenInput): string;\n  decode(token: string): InvocationTokenClaims | undefined;\n}\n\nexport interface AesInvocationTokenCodecOptions {\n  active: GatewayKeyLocatorSecret;\n  previous?: GatewayKeyLocatorSecret[];\n}\n\nexport class AesInvocationTokenCodec implements InvocationTokenCodec {\n  private readonly active: { kid: string; key: Buffer };\n  private readonly ring = new Map<string, Buffer>();\n\n  public constructor(options: AesInvocationTokenCodecOptions) {\n    this.active = normalizeSecret(options.active);\n    this.ring.set(this.active.kid, this.active.key);\n    for (const previous of options.previous ?? []) {\n      const normalized = normalizeSecret(previous);\n      if (this.ring.has(normalized.kid)) {\n        throw new Error(`Duplicate invocation token key id: ${normalized.kid}`);\n      }\n      this.ring.set(normalized.kid, normalized.key);\n    }\n  }\n\n  public encode(input: InvocationTokenInput): string {\n    const webId = requireCanonicalWebId(input.webId);\n    const audience = requireCanonicalOrigin(input.audience, 'audience');\n    const issuer = requireCanonicalOrigin(input.issuer, 'issuer');\n    const scopes = requireScopes(input.scopes);\n    const issuedAt = requireTimestamp(input.issuedAt, 'issuedAt');\n    const expiresAt = requireTimestamp(input.expiresAt, 'expiresAt');\n    if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n      throw new Error(`Invocation token TTL must be between 1 and ${MAX_TTL_MS} milliseconds`);\n    }\n    const payload = {\n      v: 1,\n      kid: this.active.kid,\n      deployment: input.deployment,\n      aud: audience,\n      iss: issuer,\n      webId,\n      scopes,\n      iat: issuedAt,\n      exp: expiresAt,\n      jti: input.jti ?? randomBytes(18).toString('base64url'),\n    };\n    const nonce = randomBytes(NONCE_BYTES);\n    const aad = Buffer.from(`${AAD_CONTEXT}.${this.active.kid}`);\n    const cipher = createCipheriv('aes-256-gcm', this.active.key, nonce);\n    cipher.setAAD(aad);\n    const ciphertext = Buffer.concat([\n      cipher.update(JSON.stringify(payload), 'utf8'),\n      cipher.final(),\n    ]);\n    const tag = cipher.getAuthTag();\n    return [\n      PREFIX,\n      this.active.kid,\n      nonce.toString('base64url'),\n      ciphertext.toString('base64url'),\n      tag.toString('base64url'),\n    ].join('.');\n  }\n\n  public decode(token: string): InvocationTokenClaims | undefined {\n    if (token.length > MAX_TOKEN_LENGTH) {\n      return undefined;\n    }\n    const parts = token.split('.');\n    if (parts.length !== 5 || parts[0] !== PREFIX) {\n      return undefined;\n    }\n    const kid = parts[1];\n    const key = this.ring.get(kid);\n    if (\n      !key\n      || !parts.slice(1).every((part) => /^[A-Za-z0-9_-]+$/u.test(part))\n    ) {\n      return undefined;\n    }\n    try {\n      const nonce = decodeCanonicalBase64Url(parts[2]);\n      const ciphertext = decodeCanonicalBase64Url(parts[3]);\n      const tag = decodeCanonicalBase64Url(parts[4]);\n      if (!nonce || !ciphertext || !tag) {\n        return undefined;\n      }\n      if (\n        nonce.length !== NONCE_BYTES\n        || ciphertext.length === 0\n        || ciphertext.length > MAX_CIPHERTEXT_BYTES\n        || tag.length !== 16\n      ) {\n        return undefined;\n      }\n      const decipher = createDecipheriv('aes-256-gcm', key, nonce);\n      decipher.setAAD(Buffer.from(`${AAD_CONTEXT}.${kid}`));\n      decipher.setAuthTag(tag);\n      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n      const parsed = JSON.parse(plaintext.toString('utf8')) as Record<string, unknown>;\n      const keys = Object.keys(parsed).sort();\n      if (\n        keys.join(',') !== 'aud,deployment,exp,iat,iss,jti,kid,scopes,v,webId'\n        ||\n        parsed.v !== 1\n        || parsed.kid !== kid\n        || (parsed.deployment !== 'local' && parsed.deployment !== 'cloud')\n        || typeof parsed.aud !== 'string'\n        || typeof parsed.iss !== 'string'\n        || typeof parsed.webId !== 'string'\n        || !Array.isArray(parsed.scopes)\n        || typeof parsed.iat !== 'number'\n        || typeof parsed.exp !== 'number'\n        || typeof parsed.jti !== 'string'\n        || !/^[A-Za-z0-9_-]{16,128}$/u.test(parsed.jti)\n      ) {\n        return undefined;\n      }\n      const audience = requireCanonicalOrigin(parsed.aud, 'audience');\n      const issuer = requireCanonicalOrigin(parsed.iss, 'issuer');\n      const webId = requireCanonicalWebId(parsed.webId);\n      const scopes = requireScopes(parsed.scopes);\n      const issuedAt = requireEpoch(parsed.iat);\n      const expiresAt = requireEpoch(parsed.exp);\n      if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n        return undefined;\n      }\n      return {\n        version: 1,\n        kid,\n        deployment: parsed.deployment,\n        audience,\n        issuer,\n        webId,\n        scopes,\n        issuedAt: new Date(issuedAt),\n        expiresAt: new Date(expiresAt),\n        jti: parsed.jti,\n      };\n    } catch {\n      return undefined;\n    }\n  }\n}\n\nexport function requireCanonicalOrigin(value: string, name = 'origin'): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.pathname !== '/'\n    || url.search\n    || url.hash\n    || url.origin !== value\n  ) {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  return url.origin;\n}\n\nfunction decodeCanonicalBase64Url(value: string): Buffer | undefined {\n  const decoded = Buffer.from(value, 'base64url');\n  return decoded.toString('base64url') === value ? decoded : undefined;\n}\n\nfunction normalizeSecret(input: GatewayKeyLocatorSecret): { kid: string; key: Buffer } {\n  const kid = input.kid.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(kid)) {\n    throw new Error('Invocation token key id is invalid');\n  }\n  if (!input.secret.trim()) {\n    throw new Error('Invocation token secret is required');\n  }\n  return {\n    kid,\n    key: createHash('sha256')\n      .update(`${AAD_CONTEXT}\\0`, 'utf8')\n      .update(input.secret, 'utf8')\n      .digest()\n      .subarray(0, KEY_BYTES),\n  };\n}\n\nexport function requireCanonicalWebId(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.href !== value\n  ) {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  return url.href;\n}\n\nfunction requireScopes(value: unknown[]): string[] {\n  if (\n    value.length === 0\n    || value.length > MAX_SCOPES\n    || value.some((scope) => typeof scope !== 'string' || !/^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*$/u.test(scope))\n    || new Set(value).size !== value.length\n  ) {\n    throw new Error('Invocation token scopes are invalid');\n  }\n  return [...value] as string[];\n}\n\nfunction requireTimestamp(value: Date, name: string): number {\n  const timestamp = value.getTime();\n  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {\n    throw new Error(`Invocation token ${name} is invalid`);\n  }\n  return timestamp;\n}\n\nfunction requireEpoch(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error('Invocation token timestamp is invalid');\n  }\n  return value;\n}\n"]}
+{"version":3,"file":"InvocationTokenCodec.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/InvocationTokenCodec.ts"],"names":[],"mappings":";;;AA6LA,wDAmBC;AAyBD,sDAgBC;AAzPD,6CAAwF;AAExF,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AA2CrB,MAAa,uBAAuB;IAIlC,YAAmB,OAAuC;QAFzC,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGhD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,KAA2B;QACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,eAAe,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,MAAM;YACX,KAAK;YACL,MAAM;YACN,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACxD,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,IAAI,CAAC,MAAM,CAAC,GAAG;YACf,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IACE,CAAC,GAAG;eACD,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAClE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IACE,KAAK,CAAC,MAAM,KAAK,WAAW;mBACzB,UAAU,CAAC,MAAM,KAAK,CAAC;mBACvB,UAAU,CAAC,MAAM,GAAG,oBAAoB;mBACxC,GAAG,CAAC,MAAM,KAAK,EAAE,EACpB,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IACE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD;;oBAEtE,MAAM,CAAC,CAAC,KAAK,CAAC;mBACX,MAAM,CAAC,GAAG,KAAK,GAAG;mBAClB,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;mBAChE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;mBAChC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;mBAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAC/C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,GAAG;gBACH,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ;gBACR,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC;gBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAvID,0DAuIC;AAED,SAAgB,sBAAsB,CAAC,KAAa,EAAE,IAAI,GAAG,QAAQ;IACnE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;WACpB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,MAAM,KAAK,KAAK,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,GAAG,WAAW,IAAI,EAAE,MAAM,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;aAC5B,MAAM,EAAE;aACR,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,IAAI,KAAK,KAAK,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;WACf,KAAK,CAAC,MAAM,GAAG,UAAU;WACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACrG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAW,EAAE,IAAY;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,aAAa,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';\n\nconst PREFIX = 'xpod_inv_v1';\nconst AAD_CONTEXT = 'xpod:gateway:internal-invocation:v1';\nconst NONCE_BYTES = 12;\nconst KEY_BYTES = 32;\nconst MAX_TOKEN_LENGTH = 8_192;\nconst MAX_CIPHERTEXT_BYTES = 4_096;\nconst MAX_TTL_MS = 15 * 60_000;\nconst MAX_SCOPES = 8;\n\nexport interface InvocationTokenClaims {\n  version: 1;\n  kid: string;\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti: string;\n}\n\nexport type GatewayDeployment = 'cloud' | 'local';\n\nexport interface InvocationTokenSecret {\n  kid: string;\n  secret: string;\n}\n\nexport interface InvocationTokenInput {\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti?: string;\n}\n\nexport interface InvocationTokenCodec {\n  encode(input: InvocationTokenInput): string;\n  decode(token: string): InvocationTokenClaims | undefined;\n}\n\nexport interface AesInvocationTokenCodecOptions {\n  active: InvocationTokenSecret;\n  previous?: InvocationTokenSecret[];\n}\n\nexport class AesInvocationTokenCodec implements InvocationTokenCodec {\n  private readonly active: { kid: string; key: Buffer };\n  private readonly ring = new Map<string, Buffer>();\n\n  public constructor(options: AesInvocationTokenCodecOptions) {\n    this.active = normalizeSecret(options.active);\n    this.ring.set(this.active.kid, this.active.key);\n    for (const previous of options.previous ?? []) {\n      const normalized = normalizeSecret(previous);\n      if (this.ring.has(normalized.kid)) {\n        throw new Error(`Duplicate invocation token key id: ${normalized.kid}`);\n      }\n      this.ring.set(normalized.kid, normalized.key);\n    }\n  }\n\n  public encode(input: InvocationTokenInput): string {\n    const webId = requireCanonicalWebId(input.webId);\n    const audience = requireCanonicalOrigin(input.audience, 'audience');\n    const issuer = requireCanonicalOrigin(input.issuer, 'issuer');\n    const scopes = requireScopes(input.scopes);\n    const issuedAt = requireTimestamp(input.issuedAt, 'issuedAt');\n    const expiresAt = requireTimestamp(input.expiresAt, 'expiresAt');\n    if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n      throw new Error(`Invocation token TTL must be between 1 and ${MAX_TTL_MS} milliseconds`);\n    }\n    const payload = {\n      v: 1,\n      kid: this.active.kid,\n      deployment: input.deployment,\n      aud: audience,\n      iss: issuer,\n      webId,\n      scopes,\n      iat: issuedAt,\n      exp: expiresAt,\n      jti: input.jti ?? randomBytes(18).toString('base64url'),\n    };\n    const nonce = randomBytes(NONCE_BYTES);\n    const aad = Buffer.from(`${AAD_CONTEXT}.${this.active.kid}`);\n    const cipher = createCipheriv('aes-256-gcm', this.active.key, nonce);\n    cipher.setAAD(aad);\n    const ciphertext = Buffer.concat([\n      cipher.update(JSON.stringify(payload), 'utf8'),\n      cipher.final(),\n    ]);\n    const tag = cipher.getAuthTag();\n    return [\n      PREFIX,\n      this.active.kid,\n      nonce.toString('base64url'),\n      ciphertext.toString('base64url'),\n      tag.toString('base64url'),\n    ].join('.');\n  }\n\n  public decode(token: string): InvocationTokenClaims | undefined {\n    if (token.length > MAX_TOKEN_LENGTH) {\n      return undefined;\n    }\n    const parts = token.split('.');\n    if (parts.length !== 5 || parts[0] !== PREFIX) {\n      return undefined;\n    }\n    const kid = parts[1];\n    const key = this.ring.get(kid);\n    if (\n      !key\n      || !parts.slice(1).every((part) => /^[A-Za-z0-9_-]+$/u.test(part))\n    ) {\n      return undefined;\n    }\n    try {\n      const nonce = decodeCanonicalBase64Url(parts[2]);\n      const ciphertext = decodeCanonicalBase64Url(parts[3]);\n      const tag = decodeCanonicalBase64Url(parts[4]);\n      if (!nonce || !ciphertext || !tag) {\n        return undefined;\n      }\n      if (\n        nonce.length !== NONCE_BYTES\n        || ciphertext.length === 0\n        || ciphertext.length > MAX_CIPHERTEXT_BYTES\n        || tag.length !== 16\n      ) {\n        return undefined;\n      }\n      const decipher = createDecipheriv('aes-256-gcm', key, nonce);\n      decipher.setAAD(Buffer.from(`${AAD_CONTEXT}.${kid}`));\n      decipher.setAuthTag(tag);\n      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n      const parsed = JSON.parse(plaintext.toString('utf8')) as Record<string, unknown>;\n      const keys = Object.keys(parsed).sort();\n      if (\n        keys.join(',') !== 'aud,deployment,exp,iat,iss,jti,kid,scopes,v,webId'\n        ||\n        parsed.v !== 1\n        || parsed.kid !== kid\n        || (parsed.deployment !== 'local' && parsed.deployment !== 'cloud')\n        || typeof parsed.aud !== 'string'\n        || typeof parsed.iss !== 'string'\n        || typeof parsed.webId !== 'string'\n        || !Array.isArray(parsed.scopes)\n        || typeof parsed.iat !== 'number'\n        || typeof parsed.exp !== 'number'\n        || typeof parsed.jti !== 'string'\n        || !/^[A-Za-z0-9_-]{16,128}$/u.test(parsed.jti)\n      ) {\n        return undefined;\n      }\n      const audience = requireCanonicalOrigin(parsed.aud, 'audience');\n      const issuer = requireCanonicalOrigin(parsed.iss, 'issuer');\n      const webId = requireCanonicalWebId(parsed.webId);\n      const scopes = requireScopes(parsed.scopes);\n      const issuedAt = requireEpoch(parsed.iat);\n      const expiresAt = requireEpoch(parsed.exp);\n      if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n        return undefined;\n      }\n      return {\n        version: 1,\n        kid,\n        deployment: parsed.deployment,\n        audience,\n        issuer,\n        webId,\n        scopes,\n        issuedAt: new Date(issuedAt),\n        expiresAt: new Date(expiresAt),\n        jti: parsed.jti,\n      };\n    } catch {\n      return undefined;\n    }\n  }\n}\n\nexport function requireCanonicalOrigin(value: string, name = 'origin'): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.pathname !== '/'\n    || url.search\n    || url.hash\n    || url.origin !== value\n  ) {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  return url.origin;\n}\n\nfunction decodeCanonicalBase64Url(value: string): Buffer | undefined {\n  const decoded = Buffer.from(value, 'base64url');\n  return decoded.toString('base64url') === value ? decoded : undefined;\n}\n\nfunction normalizeSecret(input: InvocationTokenSecret): { kid: string; key: Buffer } {\n  const kid = input.kid.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(kid)) {\n    throw new Error('Invocation token key id is invalid');\n  }\n  if (!input.secret.trim()) {\n    throw new Error('Invocation token secret is required');\n  }\n  return {\n    kid,\n    key: createHash('sha256')\n      .update(`${AAD_CONTEXT}\\0`, 'utf8')\n      .update(input.secret, 'utf8')\n      .digest()\n      .subarray(0, KEY_BYTES),\n  };\n}\n\nexport function requireCanonicalWebId(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.href !== value\n  ) {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  return url.href;\n}\n\nfunction requireScopes(value: unknown[]): string[] {\n  if (\n    value.length === 0\n    || value.length > MAX_SCOPES\n    || value.some((scope) => typeof scope !== 'string' || !/^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*$/u.test(scope))\n    || new Set(value).size !== value.length\n  ) {\n    throw new Error('Invocation token scopes are invalid');\n  }\n  return [...value] as string[];\n}\n\nfunction requireTimestamp(value: Date, name: string): number {\n  const timestamp = value.getTime();\n  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {\n    throw new Error(`Invocation token ${name} is invalid`);\n  }\n  return timestamp;\n}\n\nfunction requireEpoch(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error('Invocation token timestamp is invalid');\n  }\n  return value;\n}\n"]}

package/dist/api/ai-gateway/connect/index.d.ts

@@ -1,10 +1,9 @@
 import { aiProviderResource, credentialResource } from '@undefineds.co/models';
-import type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';
-import type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';
-import type { GatewayDeployment } from '../auth/GatewayApiKey';
+import type { ProviderSecret } from '../credentials/CredentialVault';
+import type { GatewayDeployment } from '../auth/InvocationTokenCodec';
 import type { ProviderRegistry } from '../providers/ProviderRegistry';
 import type { AuthContext } from '../../auth/AuthContext';
-import type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';
+import type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';
 export type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';
 export type ConnectAttemptStatus = 'pending' | 'authorization_pending' | 'slow_down' | 'completed' | 'expired' | 'unsupported';
 export interface ConnectBeginInput {
@@ -74,7 +73,8 @@ export interface ConnectCredentialRecord {
     provider: string;
     deployment: GatewayDeployment;
     authMode: 'apiKey' | 'deviceCodeOAuth';
-    encryptedSecret: EncryptedCredentialSecret;
+    storageMode: 'plaintext-v1';
+    secretPayload: string;
     status: 'active' | 'revoked';
     accountLabel?: string;
     expiresAt?: Date;
@@ -100,14 +100,6 @@ export interface PodCredentialRepository {
     upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
         auth?: AuthContext;
     }): Promise<ConnectCredentialRecord>;
-    rewrapCredential?(input: {
-        webId: string;
-        deployment: GatewayDeployment;
-        credentialId: string;
-        expectedVersion?: number;
-        encryptedSecret: EncryptedCredentialSecret;
-        auth?: AuthContext;
-    }): Promise<boolean>;
     markReauthRequired(input: {
         webId: string;
         provider: string;
@@ -191,7 +183,8 @@ export declare class PodConnectedCredentialRepository implements PodCredentialRe
         quota?: {
             status: 'available' | 'unsupported' | 'exhausted' | 'error';
         };
-        encryptedSecret: EncryptedCredentialSecret;
+        storageMode: 'plaintext-v1';
+        secretPayload: string;
         version?: number;
         runtimeCredential?: Record<string, unknown>;
         metadata?: Record<string, unknown>;
@@ -199,14 +192,6 @@ export declare class PodConnectedCredentialRepository implements PodCredentialRe
     upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
         auth?: AuthContext;
     }): Promise<ConnectCredentialRecord>;
-    rewrapCredential(input: {
-        webId: string;
-        deployment: GatewayDeployment;
-        credentialId: string;
-        expectedVersion?: number;
-        encryptedSecret: EncryptedCredentialSecret;
-        auth?: AuthContext;
-    }): Promise<boolean>;
     markReauthRequired(input: {
         webId: string;
         provider: string;
@@ -272,7 +257,6 @@ export interface BrowserAssistedApiKeyConnectAdapterOptions {
     consoleUrl: string;
     attempts: InMemoryConnectAttemptStore;
     credentialRepository: PodCredentialRepository;
-    vault: CredentialVault;
     deployment: GatewayDeployment;
     now?: () => Date;
     randomBytes?: (bytes: number) => Buffer;
@@ -283,7 +267,6 @@ export declare class BrowserAssistedApiKeyConnectAdapter implements ProviderConn
     private readonly consoleUrl;
     protected readonly attempts: InMemoryConnectAttemptStore;
     protected readonly credentialRepository: PodCredentialRepository;
-    protected readonly vault: CredentialVault;
     protected readonly deployment: GatewayDeployment;
     protected readonly now: () => Date;
     protected readonly randomBytes: (bytes: number) => Buffer;
@@ -327,7 +310,6 @@ export interface ProviderConnectServiceOptions {
     registry: ProviderRegistry;
     adapters: ProviderConnectAdapter[];
     credentialRepository?: PodCredentialRepository;
-    vault?: CredentialVault;
 }
 export interface ProviderConnectionSummary {
     provider: string;
@@ -347,7 +329,6 @@ export interface ProviderConnectionSummary {
 export declare class ProviderConnectService {
     private readonly registry;
     private readonly credentialRepository?;
-    private readonly vault?;
     private readonly adapters;
     constructor(options: ProviderConnectServiceOptions);
     begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;

package/dist/api/ai-gateway/connect/index.js

@@ -4,6 +4,7 @@ exports.ProviderConnectService = exports.DeepSeekConnectAdapter = exports.KimiDe
 const node_crypto_1 = require("node:crypto");
 const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
 const models_1 = require("@undefineds.co/models");
+const PlaintextCredentialPayload_1 = require("../credentials/PlaintextCredentialPayload");
 const ProviderRegistry_1 = require("../providers/ProviderRegistry");
 class PodConnectedCredentialRepository {
     constructor(options = {}) {
@@ -18,7 +19,7 @@ class PodConnectedCredentialRepository {
         const { db, credential } = await this.dbForOwner(input.webId, input.auth);
         const id = models_1.aiRuntimeRepository.credentialId(input);
         const row = await db.findById(credential, id);
-        const record = row ? recordFromCredentialRow(row) : undefined;
+        const record = row ? recordFromCredentialRow(row, input.webId) : undefined;
         if (!record) {
             return undefined;
         }
@@ -42,7 +43,7 @@ class PodConnectedCredentialRepository {
             }
         }))).filter((row) => row !== null);
         return rows
-            .map(recordFromCredentialRow)
+            .map((row) => recordFromCredentialRow(row, input.webId))
             .filter((record) => record.webId === input.webId)
             .filter((record) => record.deployment === input.deployment)
             .filter((record) => record.status === 'active')
@@ -57,7 +58,8 @@ class PodConnectedCredentialRepository {
             priority: priorityFromMetadata(record.metadata),
             health: record.reauthRequired ? 'reauthRequired' : 'healthy',
             quota: { status: 'available' },
-            encryptedSecret: record.encryptedSecret,
+            storageMode: record.storageMode,
+            secretPayload: record.secretPayload,
             version: record.version,
             runtimeCredential: runtimeCredentialFromMetadata(record.metadata),
             metadata: record.metadata,
@@ -77,36 +79,10 @@ class PodConnectedCredentialRepository {
         });
         if (existing) {
             const updated = await db.updateById(credential, record.id, row);
-            return recordFromCredentialRow(updated ?? row);
+            return recordFromCredentialRow(updated ?? row, record.webId);
         }
         await db.insert(credential).values(row).execute();
-        return recordFromCredentialRow(row);
-    }
-    async rewrapCredential(input) {
-        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
-        const existing = await db.findById(credential, input.credentialId);
-        if (!existing) {
-            return false;
-        }
-        const current = recordFromCredentialRow(existing);
-        if (current.webId !== input.webId || current.deployment !== input.deployment) {
-            return false;
-        }
-        const currentVersion = versionFromRow(existing);
-        if (input.expectedVersion === undefined || currentVersion !== input.expectedVersion) {
-            return false;
-        }
-        const updated = await db.update(credential)
-            .set({
-            encryptedSecret: JSON.stringify(input.encryptedSecret),
-            wrappedDataKey: input.encryptedSecret.wrappedDek,
-            encryptionAlgorithm: input.encryptedSecret.algorithm,
-            keyVersion: String(currentVersion + 1),
-        })
-            .where((0, drizzle_solid_1.and)((0, drizzle_solid_1.eq)(credential.id, input.credentialId), (0, drizzle_solid_1.eq)(credential.keyVersion, String(input.expectedVersion))))
-            .returning()
-            .execute();
-        return updated.length === 1;
+        return recordFromCredentialRow(row, record.webId);
     }
     async markReauthRequired(input) {
         const { db, credential } = await this.dbForOwner(input.webId, input.auth);
@@ -124,7 +100,7 @@ class PodConnectedCredentialRepository {
             status: 'active',
             keyVersion: String(existingVersion + 1),
         });
-        return updated ? recordFromCredentialRow(updated) : undefined;
+        return updated ? recordFromCredentialRow(updated, input.webId) : undefined;
     }
     async disconnect(input) {
         const { db, credential } = await this.dbForOwner(input.webId, input.auth);
@@ -137,18 +113,18 @@ class PodConnectedCredentialRepository {
             status: 'revoked',
             keyVersion: String(versionFromRow(existing) + 1),
         });
-        return updated ? recordFromCredentialRow(updated) : undefined;
+        return updated ? recordFromCredentialRow(updated, input.webId) : undefined;
     }
     async dbForOwner(owner, auth) {
-        const trustedFetch = await this.resolveTrustedFetch(owner);
+        const trustedFetch = await this.resolveTrustedFetch(owner, auth);
         const credential = (0, drizzle_solid_1.alias)(this.credentialTemplate, 'credential');
         const aiProvider = (0, drizzle_solid_1.alias)(this.aiProviderTemplate, 'aiProvider');
         const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });
         await db.init?.(credential, aiProvider);
         return { db, credential };
     }
-    async resolveTrustedFetch(owner) {
-        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);
+    async resolveTrustedFetch(owner, auth) {
+        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);
         if (!trustedFetch) {
             throw new Error('AI Connection service identity is not configured');
         }
@@ -261,7 +237,6 @@ class BrowserAssistedApiKeyConnectAdapter {
         this.consoleUrl = options.consoleUrl;
         this.attempts = options.attempts;
         this.credentialRepository = options.credentialRepository;
-        this.vault = options.vault;
         this.deployment = options.deployment;
         this.now = options.now ?? (() => new Date());
         this.randomBytes = options.randomBytes ?? node_crypto_1.randomBytes;
@@ -297,7 +272,7 @@ class BrowserAssistedApiKeyConnectAdapter {
             deployment: input.deployment,
             provider: this.provider,
         });
-        const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, this.provider, { type: 'apiKey', apiKey: input.apiKey });
+        const secretPayload = (0, PlaintextCredentialPayload_1.encodePlaintextCredential)({ type: 'apiKey', apiKey: input.apiKey });
         const record = await this.credentialRepository.upsertConnectedCredential({
             id: models_1.aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),
             credentialIri,
@@ -305,7 +280,8 @@ class BrowserAssistedApiKeyConnectAdapter {
             provider: this.provider,
             deployment: input.deployment,
             authMode: 'apiKey',
-            encryptedSecret,
+            storageMode: PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE,
+            secretPayload,
             status: 'active',
             accountLabel: input.accountLabel,
             expectedVersion: consumed.expectedCredentialVersion,
@@ -601,7 +577,6 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             scope: stringFrom(body.scope),
             idToken: stringFrom(body.id_token),
         };
-        const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, 'kimi', secret);
         return this.credentialRepository.upsertConnectedCredential({
             id: models_1.aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),
             credentialIri,
@@ -609,7 +584,8 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             provider: 'kimi',
             deployment: input.deployment,
             authMode: 'deviceCodeOAuth',
-            encryptedSecret,
+            storageMode: PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE,
+            secretPayload: (0, PlaintextCredentialPayload_1.encodePlaintextCredential)(secret),
             status: 'active',
             expiresAt,
             expectedVersion,
@@ -644,7 +620,6 @@ class ProviderConnectService {
         this.adapters = new Map();
         this.registry = options.registry;
         this.credentialRepository = options.credentialRepository;
-        this.vault = options.vault;
         for (const adapter of options.adapters) {
             this.adapters.set(normalizeProvider(adapter.provider), adapter);
         }
@@ -733,14 +708,14 @@ class ProviderConnectService {
         if (!adapter.refresh) {
             throw new Error('Provider does not support refresh');
         }
-        if (!this.credentialRepository || !this.vault) {
-            throw new Error('CredentialVault and PodCredentialRepository are required for provider refresh');
+        if (!this.credentialRepository) {
+            throw new Error('PodCredentialRepository is required for provider refresh');
         }
         const current = await this.credentialRepository.getActiveCredential(input);
         if (!current) {
             throw new Error('Active provider credential not found');
         }
-        const secret = await this.vault.open({ webId: input.webId }, current.credentialIri, normalizeProvider(input.provider), current.encryptedSecret);
+        const secret = (0, PlaintextCredentialPayload_1.decodePlaintextCredential)(current);
         try {
             return await adapter.refresh(input, current, secret);
         }
@@ -794,9 +769,8 @@ function credentialRowFromRecord(record) {
         service: 'ai',
         authMode: record.authMode,
         status: record.status,
-        encryptedSecret: JSON.stringify(record.encryptedSecret),
-        wrappedDataKey: record.encryptedSecret.wrappedDek,
-        encryptionAlgorithm: record.encryptedSecret.algorithm,
+        storageMode: record.storageMode,
+        secretPayload: record.secretPayload,
         keyVersion: String(record.version ?? 1),
         scopes: record.scopes ?? [],
         expiresAt: record.expiresAt,
@@ -806,21 +780,33 @@ function credentialRowFromRecord(record) {
         lastRefreshAt: new Date(),
     };
 }
-function recordFromCredentialRow(row) {
-    const encrypted = parseEncryptedSecret(row.encryptedSecret);
+function recordFromCredentialRow(row, owner) {
+    const storageMode = stringFrom(row.storageMode) === PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE
+        ? PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE
+        : stringFrom(row.storageMode);
+    const secretPayload = typeof row.secretPayload === 'string' ? row.secretPayload : '';
+    (0, PlaintextCredentialPayload_1.decodePlaintextCredential)({
+        storageMode,
+        secretPayload,
+        encryptedSecret: row.encryptedSecret,
+        wrappedDataKey: row.wrappedDataKey,
+        encryptionAlgorithm: row.encryptionAlgorithm,
+    });
     const id = stringFrom(row.id);
     const provider = providerFromRelation(stringFrom(row.provider))
         || providerFromCredentialId(id);
     const deployment = deploymentFromCredentialId(id);
-    const webId = encrypted.webId;
+    const credentialIri = stringFrom(row.credentialIri)
+        || models_1.aiRuntimeRepository.credentialIri(owner, { deployment, provider });
     return {
         id,
-        credentialIri: encrypted.credentialIri,
-        webId,
+        credentialIri,
+        webId: owner,
         provider,
         deployment,
         authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',
-        encryptedSecret: encrypted,
+        storageMode: PlaintextCredentialPayload_1.PLAINTEXT_CREDENTIAL_STORAGE_MODE,
+        secretPayload,
         status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',
         accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,
         expiresAt: dateFrom(row.expiresAt),
@@ -884,16 +870,6 @@ function runtimeCredentialFromMetadata(metadata) {
         ? value
         : undefined;
 }
-function parseEncryptedSecret(value) {
-    if (typeof value !== 'string' || !value.trim()) {
-        throw new Error('Credential row is missing encrypted secret payload');
-    }
-    const parsed = JSON.parse(value);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('Credential row encrypted secret payload is invalid');
-    }
-    return parsed;
-}
 function versionFromRow(row) {
     const value = row.keyVersion;
     if (typeof value === 'number' && Number.isFinite(value)) {
@@ -943,9 +919,6 @@ function signatureMatches(actual, expected) {
 function codeChallenge(verifier) {
     return (0, node_crypto_1.createHash)('sha256').update(verifier).digest('base64url');
 }
-function principal(webId) {
-    return { webId };
-}
 function cloneAttempt(attempt) {
     return {
         ...attempt,