@zauso-ai/capstan-auth 1.0.0-beta.6 → 1.0.0-beta.8

package/dist/oauth.js

@@ -0,0 +1,199 @@
+import { randomBytes } from "node:crypto";
+import { signSession } from "./session.js";
+// ── Pre-built providers ───────────────────────────────────────────────
+/** Pre-built Google OAuth provider */
+export function googleProvider(opts) {
+    return {
+        name: "google",
+        authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        userInfoUrl: "https://www.googleapis.com/oauth2/v3/userinfo",
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        scopes: ["openid", "email", "profile"],
+    };
+}
+/** Pre-built GitHub OAuth provider */
+export function githubProvider(opts) {
+    return {
+        name: "github",
+        authorizeUrl: "https://github.com/login/oauth/authorize",
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        userInfoUrl: "https://api.github.com/user",
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        scopes: ["user:email"],
+    };
+}
+// ── State management ──────────────────────────────────────────────────
+/** Generate a cryptographically random state parameter. */
+function generateState() {
+    return randomBytes(32).toString("hex");
+}
+// ── Cookie helpers ────────────────────────────────────────────────────
+function parseCookies(header) {
+    const cookies = new Map();
+    for (const pair of header.split(";")) {
+        const eqIndex = pair.indexOf("=");
+        if (eqIndex === -1)
+            continue;
+        const name = pair.slice(0, eqIndex).trim();
+        const value = pair.slice(eqIndex + 1).trim();
+        cookies.set(name, value);
+    }
+    return cookies;
+}
+function buildCookie(name, value, options) {
+    const parts = [`${name}=${value}`];
+    parts.push(`Path=${options?.path ?? "/"}`);
+    if (options?.domain)
+        parts.push(`Domain=${options.domain}`);
+    if (options?.httpOnly !== false)
+        parts.push("HttpOnly");
+    parts.push(`SameSite=${options?.sameSite ?? "Lax"}`);
+    if (options?.secure)
+        parts.push("Secure");
+    if (options?.maxAge !== undefined)
+        parts.push(`Max-Age=${options.maxAge}`);
+    return parts.join("; ");
+}
+/**
+ * Create OAuth route handlers.
+ * Returns handlers for:
+ * - GET /auth/login/:provider — redirect to OAuth provider
+ * - GET /auth/callback — handle OAuth callback, create session
+ */
+export function createOAuthHandlers(config, fetchFn = globalThis.fetch) {
+    const callbackPath = config.callbackPath ?? "/auth/callback";
+    const stateCookieName = config.stateCookieName ?? "capstan_oauth_state";
+    const sessionCookieName = config.session?.cookieName ?? "capstan_session";
+    const resolvedSessionSecret = config.session?.secret ?? config.sessionSecret;
+    if (!resolvedSessionSecret) {
+        throw new Error("OAuthConfig requires session.secret or sessionSecret");
+    }
+    const sessionSecret = resolvedSessionSecret;
+    const providerMap = new Map();
+    for (const p of config.providers) {
+        providerMap.set(p.name, p);
+    }
+    function login(request, providerName) {
+        const provider = providerMap.get(providerName);
+        if (!provider) {
+            return new Response(JSON.stringify({ error: `Unknown provider: ${providerName}` }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const state = generateState();
+        const url = new URL(request.url);
+        const redirectUri = `${url.origin}${callbackPath}`;
+        const authorizeUrl = new URL(provider.authorizeUrl);
+        authorizeUrl.searchParams.set("client_id", provider.clientId);
+        authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+        authorizeUrl.searchParams.set("response_type", "code");
+        authorizeUrl.searchParams.set("scope", provider.scopes.join(" "));
+        authorizeUrl.searchParams.set("state", `${providerName}:${state}`);
+        return new Response(null, {
+            status: 302,
+            headers: {
+                location: authorizeUrl.toString(),
+                "set-cookie": buildCookie(stateCookieName, `${providerName}:${state}`, {
+                    maxAge: 600,
+                }),
+            },
+        });
+    }
+    async function callback(request) {
+        const url = new URL(request.url);
+        const code = url.searchParams.get("code");
+        const stateParam = url.searchParams.get("state");
+        if (!code || !stateParam) {
+            return new Response(JSON.stringify({ error: "Missing code or state parameter" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        // Validate state against cookie
+        const cookieHeader = request.headers.get("cookie") ?? "";
+        const cookies = parseCookies(cookieHeader);
+        const storedState = cookies.get(stateCookieName);
+        if (!storedState || storedState !== stateParam) {
+            return new Response(JSON.stringify({ error: "Invalid state parameter" }), { status: 403, headers: { "content-type": "application/json" } });
+        }
+        // Extract provider name from state
+        const colonIndex = stateParam.indexOf(":");
+        if (colonIndex === -1) {
+            return new Response(JSON.stringify({ error: "Malformed state parameter" }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        const providerName = stateParam.slice(0, colonIndex);
+        const provider = providerMap.get(providerName);
+        if (!provider) {
+            return new Response(JSON.stringify({ error: `Unknown provider: ${providerName}` }), { status: 400, headers: { "content-type": "application/json" } });
+        }
+        // Exchange code for access token
+        const redirectUri = `${url.origin}${callbackPath}`;
+        let tokenData;
+        try {
+            const tokenResponse = await fetchFn(provider.tokenUrl, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/x-www-form-urlencoded",
+                    accept: "application/json",
+                },
+                body: new URLSearchParams({
+                    grant_type: "authorization_code",
+                    code,
+                    redirect_uri: redirectUri,
+                    client_id: provider.clientId,
+                    client_secret: provider.clientSecret,
+                }).toString(),
+            });
+            if (!tokenResponse.ok) {
+                return new Response(JSON.stringify({ error: "Token exchange failed" }), { status: 502, headers: { "content-type": "application/json" } });
+            }
+            tokenData = (await tokenResponse.json());
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "Token exchange failed" }), { status: 502, headers: { "content-type": "application/json" } });
+        }
+        if (!tokenData.access_token) {
+            return new Response(JSON.stringify({ error: "Token exchange failed" }), { status: 502, headers: { "content-type": "application/json" } });
+        }
+        // Fetch user info
+        let userInfo;
+        try {
+            const userResponse = await fetchFn(provider.userInfoUrl, {
+                headers: {
+                    authorization: `Bearer ${tokenData.access_token}`,
+                    accept: "application/json",
+                },
+            });
+            if (!userResponse.ok) {
+                return new Response(JSON.stringify({ error: "Failed to fetch user info" }), { status: 502, headers: { "content-type": "application/json" } });
+            }
+            userInfo = (await userResponse.json());
+        }
+        catch {
+            return new Response(JSON.stringify({ error: "Failed to fetch user info" }), { status: 502, headers: { "content-type": "application/json" } });
+        }
+        // Build session from user info
+        const userId = userInfo.sub ?? userInfo.id?.toString() ?? userInfo.login ?? "unknown";
+        const sessionData = {
+            userId: `${providerName}:${userId}`,
+            ...(userInfo.name !== undefined ? { displayName: userInfo.name } : {}),
+        };
+        if (userInfo.email !== undefined) {
+            sessionData.email = userInfo.email;
+        }
+        const sessionToken = signSession(sessionData, sessionSecret, config.session?.maxAge !== undefined
+            ? { maxAge: config.session.maxAge }
+            : undefined);
+        // Set session cookie and redirect to /
+        return new Response(null, {
+            status: 302,
+            headers: {
+                location: config.successRedirectPath ?? "/",
+                "set-cookie": buildCookie(sessionCookieName, sessionToken, {
+                    ...(config.session?.cookie ?? {}),
+                    maxAge: 604800,
+                }),
+            },
+        });
+    }
+    return { login, callback };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA2C3C,yEAAyE;AAEzE,sCAAsC;AACtC,MAAM,UAAU,cAAc,CAAC,IAG9B;IACC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,8CAA8C;QAC5D,QAAQ,EAAE,qCAAqC;QAC/C,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,cAAc,CAAC,IAG9B;IACC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,0CAA0C;QACxD,QAAQ,EAAE,6CAA6C;QACvD,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,CAAC,YAAY,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE,2DAA2D;AAC3D,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,yEAAyE;AAEzE,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,KAAa,EACb,OAAgD;IAEhD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,EAAE,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,EAAE,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,OAAO,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAmB,EACnB,UAAmC,UAAU,CAAC,KAAK;IAEnD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,qBAAqB,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,iBAAiB,CAAC;IAC1E,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC;IAC7E,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,SAAS,KAAK,CAAC,OAAgB,EAAE,YAAoB;QACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,YAAY,EAAE,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAEnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,YAAY,CAAC,YAAY,CAAC,GAAG,CAC3B,OAAO,EACP,GAAG,YAAY,IAAI,KAAK,EAAE,CAC3B,CAAC;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;gBACjC,YAAY,EAAE,WAAW,CAAC,eAAe,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE,EAAE;oBACrE,MAAM,EAAE,GAAG;iBACZ,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC/C,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,YAAY,EAAE,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QACnD,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,IAAI;oBACJ,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;oBAC5B,aAAa,EAAE,QAAQ,CAAC,YAAY;iBACrC,CAAC,CAAC,QAAQ,EAAE;aACd,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAuB,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACvD,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;oBACjD,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAkB,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,MAAM,GACV,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,KAAK,IAAI,SAAS,CAAC;QACzE,MAAM,WAAW,GAAsC;YACrD,MAAM,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;YACnC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;QACF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAC9B,WAAW,EACX,aAAa,EACb,MAAM,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;YACnC,CAAC,CAAC,SAAS,CACd,CAAC;QAEF,uCAAuC;QACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,QAAQ,EAAE,MAAM,CAAC,mBAAmB,IAAI,GAAG;gBAC3C,YAAY,EAAE,WAAW,CAAC,iBAAiB,EAAE,YAAY,EAAE;oBACzD,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;oBACjC,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/permissions.d.ts

@@ -1,34 +1,24 @@
+import type { AuthGrant, AuthGrantRequirement } from "./types.js";
+export interface AuthorizationDecision {
+    allowed: boolean;
+    matchedGrant?: AuthGrant;
+    reason?: string;
+}
+export declare function normalizePermissionsToGrants(granted: readonly (string | AuthGrant)[]): AuthGrant[];
+export declare function serializeGrantsToPermissions(grants: readonly AuthGrant[]): string[];
+export declare function authorizeGrant(required: AuthGrantRequirement, granted: readonly (string | AuthGrant)[]): AuthorizationDecision;
+export declare function checkGrant(required: AuthGrantRequirement, granted: readonly (string | AuthGrant)[]): boolean;
 /**
  * Check whether a required permission is satisfied by at least one entry in
- * the `granted` permission set.
- *
- * Permission strings follow the `resource:action` pattern.
- *
- * Wildcards:
- * - `*:read`  — allows `read` on any resource
- * - `ticket:*` — allows any action on `ticket`
- * - `*:*`     — full access (superuser)
- *
- * Examples:
- *   checkPermission({ resource: "ticket", action: "read" }, ["ticket:read"])  // true
- *   checkPermission({ resource: "ticket", action: "write" }, ["*:write"])     // true
- *   checkPermission({ resource: "ticket", action: "delete" }, ["ticket:*"])   // true
- *   checkPermission({ resource: "ticket", action: "delete" }, ["*:*"])        // true
+ * the granted permission / grant set.
  */
 export declare function checkPermission(required: {
     resource: string;
     action: "read" | "write" | "delete";
-}, granted: string[]): boolean;
+}, granted: readonly (string | AuthGrant)[]): boolean;
 /**
  * Derive a `{ resource, action }` pair from an agent capability mode and
  * an optional resource name.
- *
- * Mapping:
- * - `"read"`     → `{ resource, action: "read" }`
- * - `"write"`    → `{ resource, action: "write" }`
- * - `"external"` → `{ resource: "external", action: "write" }`
- *
- * When `resource` is omitted the wildcard `"*"` is used.
  */
 export declare function derivePermission(capability: "read" | "write" | "external", resource?: string): {
     resource: string;

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,EACnE,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAiBT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACzC,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAStC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgDD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,SAAS,EAAE,CAab;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,EAAE,CAEnF;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,qBAAqB,CA0BvB;AAED,wBAAgB,UAAU,CACxB,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,EACnE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,EACzC,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAStC"}

package/dist/permissions.js

@@ -1,44 +1,102 @@
+import { createGrant } from "./runtime-grants.js";
+function isGrantRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "resource" in value &&
+        "action" in value &&
+        typeof value["resource"] === "string" &&
+        typeof value["action"] === "string");
+}
+function parsePermission(permission) {
+    const sepIndex = permission.indexOf(":");
+    if (sepIndex === -1)
+        return null;
+    return createGrant(permission.slice(0, sepIndex), permission.slice(sepIndex + 1));
+}
+function scopeMatches(required, granted) {
+    if (!required || Object.keys(required).length === 0)
+        return true;
+    if (!granted)
+        return false;
+    for (const [key, value] of Object.entries(required)) {
+        const grantedValue = granted[key];
+        if (grantedValue !== "*" && grantedValue !== value) {
+            return false;
+        }
+    }
+    return true;
+}
+function resourceMatches(required, granted) {
+    return granted === "*" || granted === required;
+}
+function actionMatches(required, granted) {
+    return granted === "*" || granted === required;
+}
+function isGrantExpired(grant) {
+    if (grant.expiresAt === undefined)
+        return false;
+    const expiresAt = Date.parse(grant.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt <= Date.now();
+}
+export function normalizePermissionsToGrants(granted) {
+    const grants = [];
+    for (const entry of granted) {
+        if (typeof entry === "string") {
+            const parsed = parsePermission(entry);
+            if (parsed)
+                grants.push(parsed);
+            continue;
+        }
+        if (isGrantRecord(entry)) {
+            grants.push(entry);
+        }
+    }
+    return grants;
+}
+export function serializeGrantsToPermissions(grants) {
+    return grants.map((grant) => `${grant.resource}:${grant.action}`);
+}
+export function authorizeGrant(required, granted) {
+    const grants = normalizePermissionsToGrants(granted);
+    let matchedAllowGrant;
+    for (const grant of grants) {
+        if (isGrantExpired(grant))
+            continue;
+        const matches = resourceMatches(required.resource, grant.resource) &&
+            actionMatches(required.action, grant.action) &&
+            scopeMatches(required.scope, grant.scope);
+        if (!matches)
+            continue;
+        if (grant.effect === "deny") {
+            return {
+                allowed: false,
+                matchedGrant: grant,
+                reason: `Grant explicitly denied ${required.resource}:${required.action}`,
+            };
+        }
+        matchedAllowGrant = grant;
+    }
+    if (matchedAllowGrant) {
+        return { allowed: true, matchedGrant: matchedAllowGrant };
+    }
+    return {
+        allowed: false,
+        reason: `No grant matched ${required.resource}:${required.action}`,
+    };
+}
+export function checkGrant(required, granted) {
+    return authorizeGrant(required, granted).allowed;
+}
 /**
  * Check whether a required permission is satisfied by at least one entry in
- * the `granted` permission set.
- *
- * Permission strings follow the `resource:action` pattern.
- *
- * Wildcards:
- * - `*:read`  — allows `read` on any resource
- * - `ticket:*` — allows any action on `ticket`
- * - `*:*`     — full access (superuser)
- *
- * Examples:
- *   checkPermission({ resource: "ticket", action: "read" }, ["ticket:read"])  // true
- *   checkPermission({ resource: "ticket", action: "write" }, ["*:write"])     // true
- *   checkPermission({ resource: "ticket", action: "delete" }, ["ticket:*"])   // true
- *   checkPermission({ resource: "ticket", action: "delete" }, ["*:*"])        // true
+ * the granted permission / grant set.
  */
 export function checkPermission(required, granted) {
-    for (const perm of granted) {
-        const sepIndex = perm.indexOf(":");
-        if (sepIndex === -1)
-            continue; // malformed entry, skip
-        const grantedResource = perm.slice(0, sepIndex);
-        const grantedAction = perm.slice(sepIndex + 1);
-        const resourceMatch = grantedResource === "*" || grantedResource === required.resource;
-        const actionMatch = grantedAction === "*" || grantedAction === required.action;
-        if (resourceMatch && actionMatch)
-            return true;
-    }
-    return false;
+    return checkGrant(required, granted);
 }
 /**
  * Derive a `{ resource, action }` pair from an agent capability mode and
  * an optional resource name.
- *
- * Mapping:
- * - `"read"`     → `{ resource, action: "read" }`
- * - `"write"`    → `{ resource, action: "write" }`
- * - `"external"` → `{ resource: "external", action: "write" }`
- *
- * When `resource` is omitted the wildcard `"*"` is used.
  */
 export function derivePermission(capability, resource) {
     if (capability === "external") {

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmE,EACnE,OAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,wBAAwB;QAEvD,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE/C,MAAM,aAAa,GACjB,eAAe,KAAK,GAAG,IAAI,eAAe,KAAK,QAAQ,CAAC,QAAQ,CAAC;QACnE,MAAM,WAAW,GACf,aAAa,KAAK,GAAG,IAAI,aAAa,KAAK,QAAQ,CAAC,MAAM,CAAC;QAE7D,IAAI,aAAa,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAyC,EACzC,QAAiB;IAEjB,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,IAAI,GAAG;QACzB,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQlD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,UAAU,IAAI,KAAK;QACnB,QAAQ,IAAI,KAAK;QACjB,OAAQ,KAAiC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAQ,KAAiC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CACnB,QAA4C,EAC5C,OAA2C;IAE3C,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,OAAe;IACxD,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,OAAe;IACtD,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAwC;IAExC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAA4B;IACvE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAA8B,EAC9B,OAAwC;IAExC,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,iBAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,OAAO,GACX,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;YAClD,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAC5C,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,2BAA2B,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,oBAAoB,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,QAA8B,EAC9B,OAAwC;IAExC,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAmE,EACnE,OAAwC;IAExC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAyC,EACzC,QAAiB;IAEjB,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,IAAI,GAAG;QACzB,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}

package/dist/runtime-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { AuthGrant, AuthGrantRequirement } from "./types.js";
+import { type AuthorizationDecision } from "./permissions.js";
+export interface RuntimeGrantScope {
+    runId?: string;
+    approvalId?: string;
+    artifactId?: string;
+    taskId?: string;
+    summaryId?: string;
+    memoryId?: string;
+    tool?: string;
+}
+export interface RuntimeGrantAttributes {
+    memoryKind?: "session" | "persistent";
+    approvalKind?: "tool" | "task";
+}
+export interface RuntimeGrantAuthorizerRequest {
+    action: string;
+    scope?: RuntimeGrantScope;
+    attributes?: RuntimeGrantAttributes;
+}
+export interface RuntimeGrantAuthorizationResult extends AuthorizationDecision {
+    matchedRequirement?: AuthGrantRequirement;
+}
+export type RuntimeGrantSupplier = readonly (string | AuthGrant)[] | (() => readonly (string | AuthGrant)[] | Promise<readonly (string | AuthGrant)[]>);
+export declare function deriveRuntimeGrantRequirements(request: RuntimeGrantAuthorizerRequest): AuthGrantRequirement[];
+export declare function authorizeRuntimeAction(request: RuntimeGrantAuthorizerRequest, granted: readonly (string | AuthGrant)[]): RuntimeGrantAuthorizationResult;
+export declare function createRuntimeGrantAuthorizer(supplier: RuntimeGrantSupplier): (request: RuntimeGrantAuthorizerRequest) => Promise<RuntimeGrantAuthorizationResult>;
+//# sourceMappingURL=runtime-authorizer.d.ts.map

package/dist/runtime-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authorizer.d.ts","sourceRoot":"","sources":["../src/runtime-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED,MAAM,WAAW,+BAAgC,SAAQ,qBAAqB;IAC5E,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAC/B,CAAC,MAAM,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AA6CvF,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,6BAA6B,GACrC,oBAAoB,EAAE,CAiExB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,EACtC,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACvC,+BAA+B,CA+BjC;AAWD,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,oBAAoB,IAC3D,SAAS,6BAA6B,8CAErD"}

package/dist/runtime-authorizer.js

@@ -0,0 +1,136 @@
+import { authorizeGrant } from "./permissions.js";
+function parseRuntimeAction(action) {
+    const separator = action.indexOf(":");
+    if (separator === -1) {
+        return { resource: action, action: "read" };
+    }
+    return {
+        resource: action.slice(0, separator),
+        action: action.slice(separator + 1),
+    };
+}
+function normalizedScope(scope) {
+    if (!scope) {
+        return undefined;
+    }
+    const entries = Object.entries(scope).filter((entry) => typeof entry[1] === "string" && entry[1].trim().length > 0);
+    if (entries.length === 0) {
+        return undefined;
+    }
+    return Object.fromEntries(entries);
+}
+function requirement(resource, action, scope) {
+    const nextScope = normalizedScope(scope);
+    return {
+        resource,
+        action,
+        ...(nextScope ? { scope: nextScope } : {}),
+    };
+}
+function runScope(scope) {
+    return scope?.runId ? { runId: scope.runId } : undefined;
+}
+export function deriveRuntimeGrantRequirements(request) {
+    const parsed = parseRuntimeAction(request.action);
+    const scope = request.scope;
+    const fallbackRunScope = runScope(scope);
+    switch (request.action) {
+        case "checkpoint:read":
+            return [
+                requirement("checkpoint", "read", scope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "artifact:read":
+            return [
+                requirement("artifact", "read", scope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "event:read":
+            return [
+                requirement("event", "read", scope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "task:read":
+            return [
+                requirement("task", "read", scope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "context:read":
+            return [
+                requirement("context", "read", scope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "summary:read":
+            return [
+                requirement("summary", "read", scope),
+                requirement("context", "read", fallbackRunScope),
+                requirement("run", "read", fallbackRunScope),
+            ];
+        case "memory:read":
+            return [
+                requirement("memory", "read", scope),
+                ...(request.attributes?.memoryKind === "session" && fallbackRunScope
+                    ? [
+                        requirement("context", "read", fallbackRunScope),
+                        requirement("run", "read", fallbackRunScope),
+                    ]
+                    : []),
+            ];
+        case "approval:read":
+            return [
+                requirement("approval", "read", scope),
+                requirement("approval", "manage", scope),
+            ];
+        case "approval:approve":
+            return [
+                requirement("approval", "approve", scope),
+                requirement("approval", "manage", scope),
+            ];
+        case "approval:deny":
+            return [
+                requirement("approval", "deny", scope),
+                requirement("approval", "manage", scope),
+            ];
+        default:
+            return [requirement(parsed.resource, parsed.action, scope)];
+    }
+}
+export function authorizeRuntimeAction(request, granted) {
+    const requirements = deriveRuntimeGrantRequirements(request);
+    let denied;
+    for (const current of requirements) {
+        const decision = authorizeGrant(current, granted);
+        if (decision.allowed) {
+            return {
+                ...decision,
+                matchedRequirement: current,
+            };
+        }
+        if (decision.matchedGrant?.effect === "deny") {
+            denied = {
+                ...decision,
+                matchedRequirement: current,
+            };
+            break;
+        }
+    }
+    if (denied) {
+        return denied;
+    }
+    const matchedRequirement = requirements[0];
+    return {
+        allowed: false,
+        reason: `No grant matched ${request.action}`,
+        ...(matchedRequirement ? { matchedRequirement } : {}),
+    };
+}
+async function resolveRuntimeGrants(supplier) {
+    if (typeof supplier === "function") {
+        return supplier();
+    }
+    return supplier;
+}
+export function createRuntimeGrantAuthorizer(supplier) {
+    return async (request) => authorizeRuntimeAction(request, await resolveRuntimeGrants(supplier));
+}
+//# sourceMappingURL=runtime-authorizer.js.map

package/dist/runtime-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-authorizer.js","sourceRoot":"","sources":["../src/runtime-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAA8B,MAAM,kBAAkB,CAAC;AA+B9E,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAoC;IAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1C,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACjG,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,MAAc,EACd,KAAyB;IAEzB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoC;IACpD,OAAO,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAsC;IAEtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEzC,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,iBAAiB;YACpB,OAAO;gBACL,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;gBACxC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;gBACtC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;gBACnC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;gBAClC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;gBACrC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;gBACrC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC;gBAChD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;aAC7C,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO;gBACL,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC;gBACpC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,gBAAgB;oBAClE,CAAC,CAAC;wBACE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC;wBAChD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC;qBAC7C;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;gBACtC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;aACzC,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO;gBACL,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;gBACzC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;aACzC,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;gBACtC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;aACzC,CAAC;QACJ;YACE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAsC,EACtC,OAAwC;IAExC,MAAM,YAAY,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,MAAmD,CAAC;IAExD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,GAAG,QAAQ;gBACX,kBAAkB,EAAE,OAAO;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,MAAM,GAAG;gBACP,GAAG,QAAQ;gBACX,kBAAkB,EAAE,OAAO;aAC5B,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,oBAAoB,OAAO,CAAC,MAAM,EAAE;QAC5C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAA8B;IAE9B,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAA8B;IACzE,OAAO,KAAK,EAAE,OAAsC,EAAE,EAAE,CACtD,sBAAsB,CAAC,OAAO,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/runtime-grants.d.ts

@@ -0,0 +1,31 @@
+import type { AuthGrant } from "./types.js";
+export declare function createGrant(resource: string, action: string, options?: {
+    scope?: Record<string, string>;
+    expiresAt?: string;
+    constraints?: Record<string, unknown>;
+    effect?: "allow" | "deny";
+}): AuthGrant;
+export declare function grantRunActions(runId: string, actions?: readonly string[]): AuthGrant[];
+export declare function grantApprovalActions(actions?: readonly string[], options?: {
+    approvalId?: string;
+    runId?: string;
+    tool?: string;
+}): AuthGrant[];
+export declare function grantApprovalCollectionActions(actions?: readonly string[], options?: {
+    runId?: string;
+}): AuthGrant[];
+export declare function grantArtifactActions(runId: string, actions?: readonly string[], artifactId?: string): AuthGrant[];
+export declare function grantCheckpointActions(runId: string, actions?: readonly string[]): AuthGrant[];
+export declare function grantRunCollectionActions(actions?: readonly string[]): AuthGrant[];
+export declare function grantEventActions(runId: string, actions?: readonly string[]): AuthGrant[];
+export declare function grantEventCollectionActions(actions?: readonly string[]): AuthGrant[];
+export declare function grantTaskActions(runId: string, actions?: readonly string[], taskId?: string): AuthGrant[];
+export declare function grantSummaryActions(runId: string, actions?: readonly string[], summaryId?: string): AuthGrant[];
+export declare function grantSummaryCollectionActions(actions?: readonly string[]): AuthGrant[];
+export declare function grantMemoryActions(actions?: readonly string[], options?: {
+    runId?: string;
+    memoryId?: string;
+}): AuthGrant[];
+export declare function grantContextActions(runId: string, actions?: readonly string[]): AuthGrant[];
+export declare function grantRuntimePathsActions(actions?: readonly string[]): AuthGrant[];
+//# sourceMappingURL=runtime-grants.d.ts.map

package/dist/runtime-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-grants.d.ts","sourceRoot":"","sources":["../src/runtime-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,wBAAgB,WAAW,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC3B,GACA,SAAS,CAOX;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAA0C,GACjE,SAAS,EAAE,CAMb;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,SAAS,MAAM,EAA0C,EAClE,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACA,SAAS,EAAE,CAUb;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,SAAS,MAAM,EAAa,EACrC,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,SAAS,EAAE,CAMb;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,EACrC,UAAU,CAAC,EAAE,MAAM,GAClB,SAAS,EAAE,CAQb;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAMb;AAED,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,SAAS,MAAM,EAAsB,GAC7C,SAAS,EAAE,CAEb;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAMb;AAED,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAEb;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,EACrC,MAAM,CAAC,EAAE,MAAM,GACd,SAAS,EAAE,CAQb;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,EACrC,SAAS,CAAC,EAAE,MAAM,GACjB,SAAS,EAAE,CAQb;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAEb;AAED,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,SAAS,MAAM,EAAa,EACrC,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,SAAS,EAAE,CASb;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAMb;AAED,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,SAAS,MAAM,EAAa,GACpC,SAAS,EAAE,CAEb"}