@wenathlan/devthink 2.0.15 → 2.0.20

package/dist/auth.d.ts

@@ -1,224 +0,0 @@
-/** The auth module of the 1.1.88 consolidation: every correlated variation of the auth logic interned in this one file, so the module family carries one surface without duplicate variations. */
-import type { allowlistentry, authchallenge, authmethod, clientidentity, pairingcode, sessiontoken, tlsconfig, tokenhash, toolnamespace, formpayload, multipartpayload, oauthflow, revocationrule, bridgepairingrecord, relaytokenrecord } from "./types.js";
-/**
- * Client auth of the 1.1.55 agent protocol part two.
- * Every pairing, token, allowlist and handshake concern for remote clients lives in this file: the one time pairing codes with their single use state, the session tokens issued in exchange and stored only as sha-256 tokenhash values, the token verification on every frame with its scope limits and expiry, the client allowlist that refuses unknown fingerprints, the grant history of every scope change, the auth challenges with their single use nonces, the handshake completion that marks a client paired, the revocation that stays available to the user at any time, the token expiry that enforces the user configured lifetime and the auth failures that answer with one fixed json rpc message so the pairing state never leaks.
- * The module stays pure: every value is a user choice with no code ceiling, and no endpoint, provider, certificate or key is ever hardcoded.
- */
-/** The prefix every stored tokenhash carries so raw token values never persist. */
-export declare const tokenhashprefix = "sha256:";
-/** The documented default session token lifetime of one hour; any user configured window wins. */
-export declare const defaulttokenlifetimems = 3600000;
-/** The documented default pairing code window of five minutes; any user configured window wins. */
-export declare const defaultpairinglifetimems = 300000;
-/** The documented default auth challenge window of two minutes; any user configured window wins. */
-export declare const defaultchallengelifetimems = 120000;
-/** The fixed message every auth failure answers with; it names no client, token or pairing state so nothing leaks. */
-export declare const authrefusedmessage = "The remote frame failed its authentication handshake.";
-/** Digests one raw token into its stored tokenhash form: the sha-256 hex digest under the documented prefix, computed through the platform crypto seam so the raw value never persists. */
-export declare function tokenhashof(raw: string): Promise<tokenhash>;
-/** Issues one pairing code for a one time client pairing: the human copied code, the granted namespaces, the issue time and the user configured expiry window. */
-export declare function issuepairingcode(input: {
-    now: number;
-    scopes: toolnamespace[];
-    lifetime?: number;
-    code?: string;
-}): pairingcode;
-/** Exchanges one pairing code for its granted scopes: the code must match, stay pending and sit inside its window while a used or expired code never pairs a second client. */
-export declare function redeempairingcode(input: {
-    codes: pairingcode[];
-    code: string;
-    now: number;
-}): {
-    code?: pairingcode;
-    reason?: string;
-};
-/** Issues one session token for a paired client: the raw token leaves exactly once in the answer while the record persists only its tokenhash form, the scopes, the issue time and the user configured expiry. */
-export declare function issuetoken(input: {
-    clientid: string;
-    scopes: toolnamespace[];
-    now: number;
-    lifetime?: number;
-    id?: string;
-    raw?: string;
-}): Promise<{
-    token: sessiontoken;
-    raw: string;
-}>;
-/** Validates one session token on every frame: the digest of the presented raw token must match a stored, unrevoked, unexpired record; every failure answers with the fixed message so the pairing state never leaks. */
-export declare function verifytoken(input: {
-    tokens: sessiontoken[];
-    raw: string;
-    now: number;
-}): Promise<{
-    token?: sessiontoken;
-    reason?: string;
-}>;
-/** Revokes every session token of one client on demand; the revocation stays available to the user at any time and the records stay for the audit trail. */
-export declare function revokeclient(tokens: sessiontoken[], clientid: string, now: number): sessiontoken[];
-/** Enforces the configured token lifetime: tokens past their expiry leave the live set while their records stay for the audit trail. */
-export declare function expiretokens(input: {
-    tokens: sessiontoken[];
-    now: number;
-}): {
-    live: sessiontoken[];
-    expired: sessiontoken[];
-};
-/** Checks the client allowlist: a fingerprint must carry an entry and, when a namespace is asked, the entry must grant it. */
-export declare function checkallowlist(input: {
-    entries: allowlistentry[];
-    fingerprint: string;
-    namespace?: toolnamespace;
-}): {
-    allowed: boolean;
-    reason?: string;
-};
-/** Grants or updates one allowlist entry with its grant history: every scope change lands in the history with its actor and plain language change. */
-export declare function grantallowlistentry(input: {
-    entries: allowlistentry[];
-    identity: clientidentity;
-    namespaces: toolnamespace[];
-    actor: string;
-    now: number;
-}): allowlistentry[];
-/** Issues one auth challenge to a new client: the single use nonce, the method it authenticates and the user configured expiry window. */
-export declare function issuechallenge(input: {
-    method: authmethod;
-    now: number;
-    lifetime?: number;
-    nonce?: string;
-}): authchallenge;
-/** Completes the auth handshake: the echoed nonce must match the live challenge and the presented token must verify; success marks the client paired while every failure answers with the fixed message. */
-export declare function verifyauth(input: {
-    challenge: authchallenge;
-    nonce: string;
-    tokens: sessiontoken[];
-    rawtoken: string;
-    now: number;
-}): Promise<{
-    verified: boolean;
-    clientid?: string;
-    reason?: string;
-}>;
-/** Limits one tool call to the namespaces the token scopes grant: an unknown namespace fails fast while a known but ungranted namespace stays a consent refusal. */
-export declare function scopecheck(token: sessiontoken | undefined, namespace: toolnamespace | undefined): {
-    allowed: boolean;
-    fast?: boolean;
-    reason?: string;
-};
-/** Reports the tls termination state of one transport config for the remote status view: the mode, the certificate requirement and whether the peer was verified. */
-export declare function tlsstateof(tls: tlsconfig): {
-    mode: string;
-    certificaterequired: boolean;
-    verified: boolean;
-};
-/** Correlated auth and upload logics of the 1.1.44 family: reviewed oauth flows with code capture, token exchange and refresh, token revocation, api key entries, urlencoded form payloads and streamed multipart uploads. */
-/** Parses one reviewed oauth flow from step options: provider, authorize url, token url, scopes and the redirect origin the code capture watches. */
-export declare function oauthflowof(value: unknown): oauthflow | undefined;
-/** Builds the provider consent page url of one reviewed oauth flow with the response type code, the redirect origin, the scopes and the run scoped state token. */
-export declare function authorizeurl(flow: oauthflow, state: string): string;
-/** Captures the oauth code from one redirect url: the url must land on the granted redirect origin with the matching state token and carry the code parameter; error redirects are refused with their reason. */
-export declare function capturecode(url: string, redirectorigin: string, state: string): {
-    code: string;
-    error?: undefined;
-} | {
-    error: string;
-};
-/** Parses one token endpoint response body: access token, refresh token, expiry seconds and granted scopes; a body without a token string parses to nothing. */
-export declare function parsetokens(body: string): {
-    accesstoken?: string;
-    refreshtoken?: string;
-    expiresin?: number;
-    scopes?: string[];
-} | undefined;
-/** Builds the token endpoint request of one reviewed flow: the authorization code exchange with the redirect origin or the refresh token grant that stays scoped to the provider token origin. */
-export declare function tokenrequest(flow: oauthflow, input: {
-    code?: string;
-    refreshtoken?: string;
-}): {
-    url: string;
-    body: string;
-};
-/** Parses one reviewed token revocation rule from step options: the token ids, the reason and the revoke time. */
-export declare function revocationruleof(value: unknown): revocationrule | undefined;
-/** Parses one reviewed urlencoded form payload from step options: the target url, the field list and the optional encoding name of the 1.1.76 family; an absent encoding keeps the urlencoded grammar. */
-export declare function formpayloadof(value: unknown): formpayload | undefined;
-/** Encodes one reviewed field list with the application/x-www-form-urlencoded grammar: names and values percent encode with the form encoding set and pairs join with ampersands. */
-export declare function urlencodeform(fields: Array<{
-    name: string;
-    value: string;
-}>): string;
-/** Parses one reviewed multipart upload payload from step options: the target url, the field list and the reviewed files. */
-export declare function multipartpayloadof(value: unknown): multipartpayload | undefined;
-/** Streams one reviewed multipart payload as ordered chunks: one chunk per field part, per file part and the closing boundary, so large uploads move chunk by chunk without buffering the whole payload. */
-export declare function multipartchunks(payload: multipartpayload): {
-    chunks: string[];
-    boundary: string;
-    bytes: number;
-};
-/**
- * Shared auth of the 1.1.82 site integration family.
- * Every pairing and token concern of the site bridge lives in this one pure module, and it extends the reviewed clientauth family instead of duplicating it: the pairing code mint inside the extension options reuses the one time pairing code record of the clientauth family bound to the relay origin the user typed; the expiry countdown reads the code window for the options page display; the code exchange redeems the clientauth record once and answers the session token exactly once while the record persists only its sha-256 hash through the clientauth digest; the rotation on every reconnect issues a fresh token that keeps the id of the token it replaced and revokes the old one; the token storage stays scoped to the relay origin so one relay never reads the sessions of another; and the one click revocation stamps every record with its revocation time. The pairing scopes stay the browser namespace because the site never gains an executor: the token authenticates frames only.
- * Example: `const pairing = mintbridgepairing({ origin, now }); const exchange = await exchangebridgepairing({ records: [pairing], origin, code: pairing.code.code, sessionid, now }); const rotated = await rotatebridgetoken({ tokens: [exchange.record], sessionid, origin, now });`
- */
-/** The pairing scopes the bridge grants: the browser namespace only, because a paired site reads and answers frames while the extension stays the only executor. */
-export declare const bridgepairingscopes: toolnamespace[];
-/** Mints one bridge pairing code inside the extension options: the clientauth pairing code record bound to the relay origin the user typed, with the lifetime staying the user's choice over the documented five minute window. */
-export declare function mintbridgepairing(input: {
-    origin: string;
-    now: number;
-    lifetime?: number;
-    code?: string;
-}): bridgepairingrecord;
-/** Reads the expiry countdown of one bridge pairing code for the options page: the seconds left inside the window, the expired flag once the window passed and the human label the options page renders. */
-export declare function pairingcountdown(record: bridgepairingrecord, now: number): {
-    secondsleft: number;
-    expired: boolean;
-    label: string;
-};
-/** Exchanges one bridge pairing code for its relay session token: the code must match a record of the same relay origin, stay pending and sit inside its window (the clientauth redemption enforces the single use state), and the answer carries the raw token exactly once while the record persists only its sha-256 hash scoped to the origin and session. */
-export declare function exchangebridgepairing(input: {
-    records: bridgepairingrecord[];
-    origin: string;
-    code: string;
-    sessionid: string;
-    now: number;
-    lifetime?: number;
-}): Promise<{
-    record?: relaytokenrecord;
-    raw?: string;
-    used?: pairingcode;
-    reason?: string;
-}>;
-/** Rotates the relay session token on one reconnect: the fresh raw token answers exactly once, the new record keeps the id of the token it replaced through the rotation chain, and the replaced record stamps its revocation time while its hash history stays for the audit trail. */
-export declare function rotatebridgetoken(input: {
-    tokens: relaytokenrecord[];
-    sessionid: string;
-    origin: string;
-    now: number;
-    lifetime?: number;
-    raw?: string;
-}): Promise<{
-    tokens: relaytokenrecord[];
-    raw: string;
-    record: relaytokenrecord;
-}>;
-/** Verifies one relay session token on an incoming frame: the sha-256 digest of the raw token must match a record of the same relay origin and session that stays unrevoked and inside its expiry, so a frame of another origin, another session, a revoked or an expired token never passes. */
-export declare function verifybridgetoken(input: {
-    tokens: relaytokenrecord[];
-    origin: string;
-    sessionid: string;
-    raw: string;
-    now: number;
-}): Promise<{
-    ok: boolean;
-    reason?: string;
-    token?: relaytokenrecord;
-}>;
-/** Reads the origin scoped storage key of the relay token records: every origin keeps its own token family so one relay never reads the sessions of another. */
-export declare function tokenscopedkey(origin: string): string;
-/** Revokes every relay session token with one click: every live record stamps its revocation time while the records themselves stay for the audit trail, so the socket and the pairing die instantly and no frame passes afterwards. */
-export declare function revokeallsessions(tokens: relaytokenrecord[], now: number): relaytokenrecord[];
-/** Reads the live token count of one origin: the unrevoked records the options page lists beside the revoke all button. */
-export declare function livetokensof(tokens: relaytokenrecord[], origin: string, now: number): relaytokenrecord[];
-//# sourceMappingURL=auth.d.ts.map