agentlock-shared 0.2.0 → 0.3.0

package/dist/schemas.d.ts

@@ -53,43 +53,92 @@ export declare const PolicyRulesSchema: z.ZodObject<{
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }, {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }>, {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }, {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }>, "many">;
     http: z.ZodOptional<z.ZodObject<{
         allowedDomains: z.ZodArray<z.ZodString, "many">;
         allowedMethods: z.ZodArray<z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]>, "many">;
         blockList: z.ZodArray<z.ZodString, "many">;
+        allowAllDomains: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         allowedDomains: string[];
-        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
+        allowedMethods: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "DELETE" | "PATCH")[];
         blockList: string[];
+        allowAllDomains?: boolean | undefined;
     }, {
         allowedDomains: string[];
-        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
+        allowedMethods: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "DELETE" | "PATCH")[];
         blockList: string[];
+        allowAllDomains?: boolean | undefined;
+    }>>;
+    ssh: z.ZodOptional<z.ZodObject<{
+        allowedHosts: z.ZodArray<z.ZodString, "many">;
+        allowedUsers: z.ZodArray<z.ZodString, "many">;
+        commandRules: z.ZodArray<z.ZodObject<{
+            pattern: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+            decision: z.ZodEnum<["ALLOW", "REQUIRE_APPROVAL", "BLOCK"]>;
+            require_two_approvals: z.ZodOptional<z.ZodBoolean>;
+            allowed_approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }, {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }>, "many">;
+        defaultDecision: z.ZodDefault<z.ZodEnum<["ALLOW", "REQUIRE_APPROVAL", "BLOCK"]>>;
+    }, "strip", z.ZodTypeAny, {
+        defaultDecision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+        allowedHosts: string[];
+        allowedUsers: string[];
+        commandRules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+    }, {
+        allowedHosts: string[];
+        allowedUsers: string[];
+        commandRules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
     }>>;
     limits: z.ZodOptional<z.ZodObject<{
         maxCostPerAction: z.ZodOptional<z.ZodNumber>;
@@ -101,44 +150,166 @@ export declare const PolicyRulesSchema: z.ZodObject<{
         maxActionsPerHour?: number | undefined;
         maxCostPerAction?: number | undefined;
     }>>;
+    allowHighRiskAutoApproval: z.ZodOptional<z.ZodObject<{
+        financial: z.ZodOptional<z.ZodBoolean>;
+        admin: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        admin?: boolean | undefined;
+        financial?: boolean | undefined;
+    }, {
+        admin?: boolean | undefined;
+        financial?: boolean | undefined;
+    }>>;
+    vpnRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        domainPattern: z.ZodString;
+        vpnCredentialId: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        domainPattern: string;
+        vpnCredentialId: string;
+    }, {
+        domainPattern: string;
+        vpnCredentialId: string;
+    }>, "many">>;
+    claudeBash: z.ZodOptional<z.ZodObject<{
+        rules: z.ZodArray<z.ZodObject<{
+            pattern: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+            decision: z.ZodEnum<["ALLOW", "REQUIRE_APPROVAL", "BLOCK"]>;
+            description: z.ZodOptional<z.ZodString>;
+            require_two_approvals: z.ZodOptional<z.ZodBoolean>;
+            allowed_approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }, {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }>, "many">;
+        defaultDecision: z.ZodOptional<z.ZodEnum<["ALLOW", "REQUIRE_APPROVAL", "BLOCK"]>>;
+    }, "strip", z.ZodTypeAny, {
+        rules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
+    }, {
+        rules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     defaultMode: "allow" | "require_approval" | "block";
     rules: {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }[];
     http?: {
         allowedDomains: string[];
-        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
+        allowedMethods: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "DELETE" | "PATCH")[];
         blockList: string[];
+        allowAllDomains?: boolean | undefined;
+    } | undefined;
+    claudeBash?: {
+        rules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
+    } | undefined;
+    ssh?: {
+        defaultDecision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+        allowedHosts: string[];
+        allowedUsers: string[];
+        commandRules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
     } | undefined;
+    vpnRoutes?: {
+        domainPattern: string;
+        vpnCredentialId: string;
+    }[] | undefined;
     limits?: {
         maxActionsPerHour?: number | undefined;
         maxCostPerAction?: number | undefined;
     } | undefined;
+    allowHighRiskAutoApproval?: {
+        admin?: boolean | undefined;
+        financial?: boolean | undefined;
+    } | undefined;
 }, {
     defaultMode: "allow" | "require_approval" | "block";
     rules: {
         decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
         tool?: string | undefined;
         action_type?: "admin" | "read" | "write" | "financial" | undefined;
-        domain?: string | undefined;
         require_two_approvals?: boolean | undefined;
         allowed_approvers?: string[] | undefined;
+        domain?: string | undefined;
     }[];
     http?: {
         allowedDomains: string[];
-        allowedMethods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS")[];
+        allowedMethods: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "DELETE" | "PATCH")[];
         blockList: string[];
+        allowAllDomains?: boolean | undefined;
+    } | undefined;
+    claudeBash?: {
+        rules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
+    } | undefined;
+    ssh?: {
+        allowedHosts: string[];
+        allowedUsers: string[];
+        commandRules: {
+            pattern: string;
+            decision: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+            require_two_approvals?: boolean | undefined;
+            allowed_approvers?: string[] | undefined;
+            description?: string | undefined;
+        }[];
+        defaultDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK" | undefined;
     } | undefined;
+    vpnRoutes?: {
+        domainPattern: string;
+        vpnCredentialId: string;
+    }[] | undefined;
     limits?: {
         maxActionsPerHour?: number | undefined;
         maxCostPerAction?: number | undefined;
     } | undefined;
+    allowHighRiskAutoApproval?: {
+        admin?: boolean | undefined;
+        financial?: boolean | undefined;
+    } | undefined;
 }>;
 export declare const ApproveRequestSchema: z.ZodObject<{
     action: z.ZodEnum<["approve", "deny"]>;
@@ -186,4 +357,25 @@ export declare const AgentSendMessageSchema: z.ZodObject<{
     thread_id: string;
     metadata?: Record<string, unknown> | undefined;
 }>;
+/**
+ * Schema for an agent creating a brand-new thread (Flow A of the gateway
+ * messages endpoint). Unlike AgentSendMessageSchema this has an optional
+ * `subject` for the thread title and no thread_id.
+ */
+export declare const AgentCreateThreadSchema: z.ZodObject<{
+    create_thread: z.ZodLiteral<true>;
+    content: z.ZodString;
+    subject: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnknown>, Record<string, unknown>, Record<string, unknown>>>;
+}, "strip", z.ZodTypeAny, {
+    content: string;
+    create_thread: true;
+    metadata?: Record<string, unknown> | undefined;
+    subject?: string | undefined;
+}, {
+    content: string;
+    create_thread: true;
+    metadata?: Record<string, unknown> | undefined;
+    subject?: string | undefined;
+}>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,yEA8B1B,CAAC;AAEJ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EASnC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAIH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;IAI/B,kEAAkE;;;;;;;;;;;;EAElE,CAAC;AAKH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;EAOjC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,yEA8B1B,CAAC;AAEJ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EASnC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAIH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkH5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;IAI/B,kEAAkE;;;;;;;;;;;;EAElE,CAAC;AAKH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;EAOjC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAQlC,CAAC"}

package/dist/schemas.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentSendMessageSchema = exports.SendMessageSchema = exports.ApproveRequestSchema = exports.PolicyRulesSchema = exports.RegisterAgentSchema = exports.AgentActionRequestSchema = exports.WebhookUrlSchema = void 0;
+exports.AgentCreateThreadSchema = exports.AgentSendMessageSchema = exports.SendMessageSchema = exports.ApproveRequestSchema = exports.PolicyRulesSchema = exports.RegisterAgentSchema = exports.AgentActionRequestSchema = exports.WebhookUrlSchema = void 0;
 const zod_1 = require("zod");
+const regex_safety_js_1 = require("./regex-safety.js");
+const policy_js_1 = require("./policy.js");
 /** Max payload size: 64KB when serialized */
 const MAX_PAYLOAD_SIZE = 65_536;
 /** Maximum length for webhook URLs (standard URL length limit) */
@@ -67,6 +69,29 @@ exports.PolicyRulesSchema = zod_1.z.object({
         allowedDomains: zod_1.z.array(zod_1.z.string().min(1).max(253).regex(DOMAIN_RE, 'Invalid domain format')),
         allowedMethods: zod_1.z.array(zod_1.z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'])),
         blockList: zod_1.z.array(zod_1.z.string().min(1).max(253).regex(DOMAIN_RE, 'Invalid domain format')),
+        allowAllDomains: zod_1.z.boolean().optional(),
+    })
+        .optional(),
+    ssh: zod_1.z
+        .object({
+        allowedHosts: zod_1.z.array(zod_1.z.string().min(1).max(253)).max(100),
+        allowedUsers: zod_1.z.array(zod_1.z.string().min(1).max(64).regex(/^[a-zA-Z0-9_\-.]+$/, 'Invalid SSH username')).max(50),
+        commandRules: zod_1.z
+            .array(zod_1.z.object({
+            pattern: zod_1.z.string().min(1).max(500).refine((p) => !(0, regex_safety_js_1.isLikelyRedos)(p), { message: 'Pattern rejected: looks like it could cause catastrophic regex backtracking (ReDoS). Simplify nested quantifiers or alternations.' }).refine((p) => { try {
+                (0, policy_js_1.compileSshPattern)(p);
+                return true;
+            }
+            catch {
+                return false;
+            } }, { message: 'Invalid pattern (must be a glob like "systemctl restart *" or a valid regex)' }),
+            decision: zod_1.z.enum(['ALLOW', 'REQUIRE_APPROVAL', 'BLOCK']),
+            require_two_approvals: zod_1.z.boolean().optional(),
+            allowed_approvers: zod_1.z.array(zod_1.z.string().uuid()).optional(),
+            description: zod_1.z.string().max(200).optional(),
+        }))
+            .max(200),
+        defaultDecision: zod_1.z.enum(['ALLOW', 'REQUIRE_APPROVAL', 'BLOCK']).default('REQUIRE_APPROVAL'),
     })
         .optional(),
     limits: zod_1.z
@@ -75,6 +100,60 @@ exports.PolicyRulesSchema = zod_1.z.object({
         maxActionsPerHour: zod_1.z.number().nonnegative().optional(),
     })
         .optional(),
+    allowHighRiskAutoApproval: zod_1.z
+        .object({
+        financial: zod_1.z.boolean().optional(),
+        admin: zod_1.z.boolean().optional(),
+    })
+        .optional(),
+    // Domain→VPN routing table. Each entry pins traffic to a specific VPN
+    // credential when the tool's target hostname matches `domainPattern`.
+    // Patterns may be a literal hostname or `*.<suffix>` for wildcard sub-
+    // domain matches. Capped at 50 entries to keep evaluation cheap and to
+    // force users toward broad patterns rather than a row per endpoint.
+    vpnRoutes: zod_1.z
+        .array(zod_1.z.object({
+        domainPattern: zod_1.z
+            .string()
+            .min(1)
+            .max(253)
+            .regex(/^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)*[a-zA-Z]{2,}$/, 'Invalid domain pattern — use a hostname like "corp.example" or "*.corp.example"'),
+        vpnCredentialId: zod_1.z.string().uuid(),
+    }))
+        .max(50)
+        .optional(),
+    claudeBash: zod_1.z
+        .object({
+        rules: zod_1.z
+            .array(zod_1.z.object({
+            pattern: zod_1.z
+                .string()
+                .min(1)
+                .max(500)
+                .refine((p) => !(0, regex_safety_js_1.isLikelyRedos)(p), {
+                message: 'Pattern rejected: looks like it could cause catastrophic regex backtracking. Simplify nested quantifiers or alternations.',
+            })
+                .refine((p) => {
+                try {
+                    (0, policy_js_1.compileClaudeBashPattern)(p);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            }, { message: 'Invalid pattern (use a literal prefix like "grep /home/" or wrap a regex in /.../)' }),
+            decision: zod_1.z.enum(['ALLOW', 'REQUIRE_APPROVAL', 'BLOCK']),
+            description: zod_1.z.string().max(200).optional(),
+            // Per-rule overrides for the surrounding permission.claude_code
+            // rule's two-person and approver-allowlist settings. Match the
+            // shape on ssh.commandRules so admins learn one set of fields.
+            require_two_approvals: zod_1.z.boolean().optional(),
+            allowed_approvers: zod_1.z.array(zod_1.z.string().uuid()).optional(),
+        }))
+            .max(200),
+        defaultDecision: zod_1.z.enum(['ALLOW', 'REQUIRE_APPROVAL', 'BLOCK']).optional(),
+    })
+        .optional(),
 });
 exports.ApproveRequestSchema = zod_1.z.object({
     action: zod_1.z.enum(['approve', 'deny']),
@@ -96,4 +175,15 @@ exports.AgentSendMessageSchema = zod_1.z.object({
     thread_id: zod_1.z.string().uuid(),
     metadata: zod_1.z.record(zod_1.z.unknown()).refine((val) => JSON.stringify(val).length <= MAX_METADATA_SIZE, { message: `Metadata exceeds maximum size of ${MAX_METADATA_SIZE} bytes` }).optional(),
 });
+/**
+ * Schema for an agent creating a brand-new thread (Flow A of the gateway
+ * messages endpoint). Unlike AgentSendMessageSchema this has an optional
+ * `subject` for the thread title and no thread_id.
+ */
+exports.AgentCreateThreadSchema = zod_1.z.object({
+    create_thread: zod_1.z.literal(true),
+    content: zod_1.z.string().min(1).max(4096),
+    subject: zod_1.z.string().max(200).optional(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).refine((val) => JSON.stringify(val).length <= MAX_METADATA_SIZE, { message: `Metadata exceeds maximum size of ${MAX_METADATA_SIZE} bytes` }).optional(),
+});
 //# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,sBAAsB,EAAE,uCAAuC,sBAAsB,cAAc,CAAC;KACxG,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,uCAAuC,EAAE,CACrD;KACA,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,eAAe,GAAG;YACtB,QAAQ,EAAE,OAAO,EAAE,4BAA4B;YAC/C,aAAa,EAAE,aAAa,EAAE,MAAM;YACpC,cAAc,EAAE,WAAW,EAAE,cAAc;SAC5C,CAAC;QACF,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,yDAAyD,EAAE,CACvE,CAAC;AAES,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC;IACzI,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,gBAAgB,EACvD,EAAE,OAAO,EAAE,mCAAmC,gBAAgB,QAAQ,EAAE,CACzE;IACD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnF,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAExE,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CACZ,OAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC,CAAC,QAAQ,EAAE;QAC7I,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;QACvE,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7C,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC9F,CAAC,GAAG,CAAC,GAAG,CAAC;IACV,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC7F,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;KACzF,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACrD,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9C,kEAAkE;IAClE,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEnB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,uDAAkD;AAClD,2CAA0E;AAE1E,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,sBAAsB,EAAE,uCAAuC,sBAAsB,cAAc,CAAC;KACxG,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,uCAAuC,EAAE,CACrD;KACA,MAAM,CACL,CAAC,GAAG,EAAE,EAAE;IACN,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,eAAe,GAAG;YACtB,QAAQ,EAAE,OAAO,EAAE,4BAA4B;YAC/C,aAAa,EAAE,aAAa,EAAE,MAAM;YACpC,cAAc,EAAE,WAAW,EAAE,cAAc;SAC5C,CAAC;QACF,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,yDAAyD,EAAE,CACvE,CAAC;AAES,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC;IACzI,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,gBAAgB,EACvD,EAAE,OAAO,EAAE,mCAAmC,gBAAgB,QAAQ,EAAE,CACzE;IACD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnF,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAExE,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,KAAK,EAAE,OAAC,CAAC,KAAK,CACZ,OAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,0EAA0E,CAAC,CAAC,QAAQ,EAAE;QAC7I,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;QACvE,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7C,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAC9F,CAAC,GAAG,CAAC,GAAG,CAAC;IACV,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC7F,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QACxF,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC;SACD,QAAQ,EAAE;IACb,GAAG,EAAE,OAAC;SACH,MAAM,CAAC;QACN,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1D,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,YAAY,EAAE,OAAC;aACZ,KAAK,CACJ,OAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,+BAAa,EAAC,CAAC,CAAC,EACxB,EAAE,OAAO,EAAE,mIAAmI,EAAE,CACjJ,CAAC,MAAM,CACN,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;gBAAC,IAAA,6BAAiB,EAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC,CAAC,CAAC,EAC7E,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAC5F;YACD,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACxD,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC7C,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;SAC5C,CAAC,CACH;aACA,GAAG,CAAC,GAAG,CAAC;QACX,eAAe,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAC5F,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACrD,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,yBAAyB,EAAE,OAAC;SACzB,MAAM,CAAC;QACN,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,QAAQ,EAAE;IACb,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,SAAS,EAAE,OAAC;SACT,KAAK,CACJ,OAAC,CAAC,MAAM,CAAC;QACP,aAAa,EAAE,OAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,KAAK,CACJ,kEAAkE,EAClE,iFAAiF,CAClF;QACH,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KACnC,CAAC,CACH;SACA,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,KAAK,EAAE,OAAC;aACL,KAAK,CACJ,OAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAC;iBACP,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,GAAG,CAAC;iBACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,+BAAa,EAAC,CAAC,CAAC,EAAE;gBAChC,OAAO,EACL,2HAA2H;aAC9H,CAAC;iBACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE;gBACJ,IAAI,CAAC;oBACH,IAAA,oCAAwB,EAAC,CAAC,CAAC,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,EACD,EAAE,OAAO,EAAE,oFAAoF,EAAE,CAClG;YACH,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3C,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC7C,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;SACzD,CAAC,CACH;aACA,GAAG,CAAC,GAAG,CAAC;QACX,eAAe,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC9C,kEAAkE;IAClE,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEnB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEU,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EACxD,EAAE,OAAO,EAAE,oCAAoC,iBAAiB,QAAQ,EAAE,CAC3E,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC"}

package/dist/signing.d.ts

@@ -1,8 +1,21 @@
+/**
+ * Supported signature-scheme version. v1 is the original Ed25519 over
+ * `${canonicalStringify(body)}:${timestamp}:${nonce}`. Future versions
+ * (e.g. v2 switching to a hash-chained nonce or a different canonicalisation)
+ * bump this number; `verifyRequest` must then dispatch on the header value.
+ *
+ * The header is OPTIONAL for backward-compat with agents that don't send it;
+ * an absent header is treated as v1. New clients should set it explicitly so
+ * a future v2 rollout can leave v1 traffic alone during the transition.
+ */
+export declare const SIGNATURE_VERSION_CURRENT: "1";
+export type SignatureVersion = '1';
 export interface SignedHeaders {
     'x-agent-id': string;
     'x-timestamp': string;
     'x-signature': string;
     'x-nonce'?: string;
+    'x-signature-version'?: SignatureVersion;
 }
 export interface KeyPair {
     publicKey: string;
@@ -16,8 +29,10 @@ export declare function verifyRequest(body: Record<string, unknown>, headers: {
     'x-timestamp'?: string;
     'x-signature'?: string;
     'x-nonce'?: string;
+    'x-signature-version'?: string;
 }, publicKeyBase64: string, maxSkewMs?: number): {
     agentId: string;
     nonce: string;
+    version: SignatureVersion;
 };
 //# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAoCD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEvE;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GACvB,aAAa,CAef;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,eAAe,EAAE,MAAM,EACvB,SAAS,SAAgB,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2BpC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,EAAG,GAAY,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAoCD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEvE;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GACvB,aAAa,CAqBf;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,EACD,eAAe,EAAE,MAAM,EACvB,SAAS,SAAgB,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CA4D/D"}

package/dist/signing.js

@@ -3,12 +3,24 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_VERSION_CURRENT = void 0;
 exports.generateKeypair = generateKeypair;
 exports.canonicalStringify = canonicalStringify;
 exports.signRequest = signRequest;
 exports.verifyRequest = verifyRequest;
 const tweetnacl_1 = __importDefault(require("tweetnacl"));
 const tweetnacl_util_1 = require("tweetnacl-util");
+/**
+ * Supported signature-scheme version. v1 is the original Ed25519 over
+ * `${canonicalStringify(body)}:${timestamp}:${nonce}`. Future versions
+ * (e.g. v2 switching to a hash-chained nonce or a different canonicalisation)
+ * bump this number; `verifyRequest` must then dispatch on the header value.
+ *
+ * The header is OPTIONAL for backward-compat with agents that don't send it;
+ * an absent header is treated as v1. New clients should set it explicitly so
+ * a future v2 rollout can leave v1 traffic alone during the transition.
+ */
+exports.SIGNATURE_VERSION_CURRENT = '1';
 function generateKeypair() {
     const pair = tweetnacl_1.default.sign.keyPair();
     return {
@@ -60,7 +72,12 @@ function signRequest(body, agentId, privateKeyBase64) {
     const timestamp = Date.now().toString();
     const nonce = (0, tweetnacl_util_1.encodeBase64)(tweetnacl_1.default.randomBytes(16));
     const canonical = canonicalStringify(body);
-    const message = (0, tweetnacl_util_1.decodeUTF8)(`${canonical}:${timestamp}:${nonce}`);
+    // Bind the signature-scheme version into the signed material so an on-path
+    // attacker cannot strip `x-signature-version` to force a future v2-signed
+    // request to verify under v1 rules (cross-version downgrade). Without this,
+    // adding a v2 scheme later becomes a breaking change for every deployed
+    // agent — fixing it at the moment the version header is introduced is free.
+    const message = (0, tweetnacl_util_1.decodeUTF8)(`${canonical}:${timestamp}:${nonce}:${exports.SIGNATURE_VERSION_CURRENT}`);
     const privateKey = (0, tweetnacl_util_1.decodeBase64)(privateKeyBase64);
     const signature = tweetnacl_1.default.sign.detached(message, privateKey);
     return {
@@ -68,29 +85,61 @@ function signRequest(body, agentId, privateKeyBase64) {
         'x-timestamp': timestamp,
         'x-signature': (0, tweetnacl_util_1.encodeBase64)(signature),
         'x-nonce': nonce,
+        'x-signature-version': exports.SIGNATURE_VERSION_CURRENT,
     };
 }
+const SUPPORTED_SIGNATURE_VERSIONS = new Set(['1']);
 function verifyRequest(body, headers, publicKeyBase64, maxSkewMs = 5 * 60 * 1000) {
     const agentId = headers['x-agent-id'];
     const timestamp = headers['x-timestamp'];
     const signatureB64 = headers['x-signature'];
     const nonce = headers['x-nonce'];
+    // Optional for backward compat. Absent = treat as v1 so existing agents
+    // keep working. A future breaking change bumps SIGNATURE_VERSION_CURRENT
+    // and adds a new branch below; v1 traffic continues to verify until we
+    // decide to hard-retire it.
+    const version = headers['x-signature-version'] ?? '1';
     if (!agentId || !timestamp || !signatureB64 || !nonce) {
         throw new Error('Missing required signature headers');
     }
+    if (!SUPPORTED_SIGNATURE_VERSIONS.has(version)) {
+        throw new Error(`Unsupported signature version: ${version}`);
+    }
     const ts = parseInt(timestamp, 10);
+    // A non-numeric timestamp parses to NaN, and `Math.abs(now - NaN) > skew`
+    // is false — which would silently skip the freshness check. Reject it.
+    if (!Number.isFinite(ts)) {
+        throw new Error('Invalid timestamp');
+    }
     const now = Date.now();
     if (Math.abs(now - ts) > maxSkewMs) {
         throw new Error(`Timestamp skew too large: ${Math.abs(now - ts)}ms`);
     }
     const canonical = canonicalStringify(body);
-    const message = (0, tweetnacl_util_1.decodeUTF8)(`${canonical}:${timestamp}:${nonce}`);
+    // Mirror the version binding in signRequest. A stripped `x-signature-version`
+    // header defaults to `'1'` here, so the pre-image bytes match only when the
+    // signer also used v1. Any future v2 scheme binds `'2'` into its message,
+    // making version-downgrade attempts flip the verify result to false.
+    const messageBound = (0, tweetnacl_util_1.decodeUTF8)(`${canonical}:${timestamp}:${nonce}:${version}`);
     const signature = (0, tweetnacl_util_1.decodeBase64)(signatureB64);
     const publicKey = (0, tweetnacl_util_1.decodeBase64)(publicKeyBase64);
-    const valid = tweetnacl_1.default.sign.detached.verify(message, signature, publicKey);
+    let valid = tweetnacl_1.default.sign.detached.verify(messageBound, signature, publicKey);
+    // Transitional legacy fallback: pre-version-binding agents sign the
+    // unbound pre-image (`canonical:timestamp:nonce`) and send no version
+    // header. Accept those signatures so the binding rollout doesn't force
+    // every deployed agent to redeploy simultaneously. The fallback only
+    // engages when the caller did NOT send `x-signature-version`, so it
+    // closes only the "client upgrades are lagging" gap, not a
+    // header-strip downgrade. Remove this branch before introducing v2 —
+    // by then every client must send the header for the binding to be
+    // meaningful.
+    if (!valid && headers['x-signature-version'] === undefined) {
+        const messageLegacy = (0, tweetnacl_util_1.decodeUTF8)(`${canonical}:${timestamp}:${nonce}`);
+        valid = tweetnacl_1.default.sign.detached.verify(messageLegacy, signature, publicKey);
+    }
     if (!valid) {
         throw new Error('Invalid signature');
     }
-    return { agentId, nonce };
+    return { agentId, nonce, version: version };
 }
 //# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":";;;;;AAeA,0CAMC;AAoCD,gDAEC;AAED,kCAmBC;AAED,sCAqCC;AAvHD,0DAA6B;AAC7B,mDAAwE;AAcxE,SAAgB,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,SAAS,EAAE,IAAA,6BAAY,EAAC,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU,EAAE,IAAA,6BAAY,EAAC,IAAI,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,2DAA2D;QAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,eAAe,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAA4B;IAC7D,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,SAAgB,WAAW,CACzB,IAA6B,EAC7B,OAAe,EACf,gBAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAA,6BAAY,EAAC,mBAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,2BAAU,EAAC,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAA,6BAAY,EAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,YAAY,EAAE,OAAO;QACrB,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,IAAA,6BAAY,EAAC,SAAS,CAAC;QACtC,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAC3B,IAA6B,EAC7B,OAKC,EACD,eAAuB,EACvB,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,2BAAU,EAAC,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,eAAe,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":";;;;;;AA6BA,0CAMC;AAoCD,gDAEC;AAED,kCAyBC;AAID,sCAuEC;AA/KD,0DAA6B;AAC7B,mDAAwE;AAExE;;;;;;;;;GASG;AACU,QAAA,yBAAyB,GAAG,GAAY,CAAC;AAgBtD,SAAgB,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,SAAS,EAAE,IAAA,6BAAY,EAAC,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU,EAAE,IAAA,6BAAY,EAAC,IAAI,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,2DAA2D;QAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,eAAe,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAA4B;IAC7D,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,SAAgB,WAAW,CACzB,IAA6B,EAC7B,OAAe,EACf,gBAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAA,6BAAY,EAAC,mBAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAA,2BAAU,EAAC,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,iCAAyB,EAAE,CAAC,CAAC;IAE9F,MAAM,UAAU,GAAG,IAAA,6BAAY,EAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,YAAY,EAAE,OAAO;QACrB,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,IAAA,6BAAY,EAAC,SAAS,CAAC;QACtC,SAAS,EAAE,KAAK;QAChB,qBAAqB,EAAE,iCAAyB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAE5D,SAAgB,aAAa,CAC3B,IAA6B,EAC7B,OAMC,EACD,eAAuB,EACvB,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC;IAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,YAAY,GAAG,IAAA,2BAAU,EAAC,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,eAAe,CAAC,CAAC;IAEhD,IAAI,KAAK,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAE1E,oEAAoE;IACpE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,oEAAoE;IACpE,2DAA2D;IAC3D,qEAAqE;IACrE,kEAAkE;IAClE,cAAc;IACd,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAA,2BAAU,EAAC,GAAG,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;QACvE,KAAK,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAA2B,EAAE,CAAC;AAClE,CAAC"}

package/dist/ssh-fingerprint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Normalize an SSH host-key fingerprint to canonical lowercase SHA-256 hex.
+ *
+ * Accepted input forms:
+ * - 64-char hex digest
+ * - OpenSSH-style `SHA256:<base64>`
+ * - bare base64 / url-safe base64 (43/44 chars, optional padding)
+ */
+export declare function normalizeSshHostKeyFingerprint(fp: string): string;
+//# sourceMappingURL=ssh-fingerprint.d.ts.map

package/dist/ssh-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-fingerprint.d.ts","sourceRoot":"","sources":["../src/ssh-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAyBjE"}