beeos-claw 0.6.63-cloud.1 → 0.6.63-cloud.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beeos-claw",
-  "version": "0.6.63-cloud.1",
+  "version": "0.6.63-cloud.10",
   "description": "OpenClaw plugin that bridges the BeeOS platform with the local OpenClaw Gateway, providing file transfer, ACP bridge, and observability.",
   "license": "MIT",
   "author": "BeeOS <dev@beeos.ai>",
@@ -65,9 +65,9 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@beeos-ai/beeos-types": "4.4.2-cloud.1",
+    "@beeos-ai/beeos-types": "4.4.2-cloud.3",
     "@beeos-ai/bridge-client": "^0.1.0",
-    "@beeos-ai/cloud-agent-sdk": "1.0.0",
+    "@beeos-ai/cloud-harness-sdk": "1.0.0-cloud.6",
     "@beeos-ai/message-sdk": "2.0.16",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "adm-zip": "0.6.1",
@@ -88,5 +88,5 @@
     "fast-uri": ">=3.1.4",
     "brace-expansion": ">=5.0.9"
   },
-  "gitHead": "5f9a6c03180e102484e28ed74ecb383a8bcaf137"
+  "gitHead": "c929a8951708b211355eba4a59bcb670e4da3c74"
 }

package/runtime-service-wire-identity.v1.json

@@ -4,18 +4,18 @@
   "hashAlgorithm": "SHA-256",
   "canonicalTypes": {
     "package": "@beeos-ai/beeos-types",
-    "version": "4.4.2-beta.2",
+    "version": "4.4.2-cloud.3",
     "runtimeRpcContractRevision": "2026-07-14.3",
-    "runtimeMethodManifestRawSHA256": "2af68ff555d4a4aa3c7b19a285e48a3df2ef9b43aa618ffddabbebc6e4280162",
-    "runtimeMethodManifestJcsSHA256": "d5db2c5e7c78cee73e5672a3c18a8e56179b28888f6fbb660d98ec021ca9de9b"
+    "runtimeMethodManifestRawSHA256": "f75832c57a18ca614e946a3b1d194828df76d600907f378efe28633df94146fc",
+    "runtimeMethodManifestJcsSHA256": "2e58dbc13b8bef2491b95f89920945cb905085828b2fa7a4d4f621624971b186"
   },
   "artifacts": [
     {
       "name": "runtime-parity-manifest",
       "path": "openapi/runtime-parity-manifest-v1.json",
       "revision": "beeos.runtime-parity.v1.1.0",
-      "rawSHA256": "7028b5a0dd85ee78d7df0690d2ef13ef2118acb08a1c8f718d3e9f08da8f8404",
-      "jcsSHA256": "d464594fe15a1657c805c8829d676a4c93aec5c43e020f3b1fae21f4c9453ca7"
+      "rawSHA256": "f1030e7bf2084f584d558c22b9bffde0f823d6950c696a6f0571adaffcdbcee0",
+      "jcsSHA256": "c98ed2aa822b29530cb02badd51654f2766f1dc0ff2c53b660be6431b1f23747"
     },
     {
       "name": "runtime-message-channel",

package/dist/agent-auth.js

@@ -1 +0,0 @@
-import*as crypto from"node:crypto";import*as fs from"node:fs";import*as path from"node:path";import{agentRequestAuthHeaders,authenticatedAgentFetch,bodyHashHex as sdkBodyHashHex,EMPTY_BODY_SHA256 as SDK_EMPTY_BODY_SHA256}from"@beeos-ai/cloud-agent-sdk";export const EMPTY_BODY_SHA256=SDK_EMPTY_BODY_SHA256;const ED25519_PKCS8_PREFIX=Buffer.from("302e020100300506032b657004220420","hex");function wrapPrivateKey(e){return 32===e.length?Buffer.concat([ED25519_PKCS8_PREFIX,Buffer.from(e)]):Buffer.from(e)}const ED25519_SPKI_PREFIX=Buffer.from("302a300506032b6570032100","hex");function derivePublicKey(e){const r=crypto.createPrivateKey({key:wrapPrivateKey(e),format:"der",type:"pkcs8"}),t=crypto.createPublicKey(r).export({type:"spki",format:"der"});return 44===t.length?new Uint8Array(t.subarray(12)):new Uint8Array(t)}export function loadAgentKeyPair(e){if(!fs.existsSync(e))return generateAgentKeyPair(e);const r=fs.readFileSync(e,"utf-8").trim();try{const e=JSON.parse(r);if(e.publicKey&&e.privateKey)return{publicKey:new Uint8Array(Buffer.from(e.publicKey,"base64")),privateKey:new Uint8Array(Buffer.from(e.privateKey,"base64"))}}catch{}const t=new Uint8Array(Buffer.from(r,"base64"));if(32===t.length)return{publicKey:derivePublicKey(t),privateKey:t};throw new Error(`Invalid key file format at ${e}`)}function generateAgentKeyPair(e){const r=crypto.generateKeyPairSync("ed25519",{publicKeyEncoding:{type:"spki",format:"der"},privateKeyEncoding:{type:"pkcs8",format:"der"}}),t=r.publicKey,n=r.privateKey,a=new Uint8Array(44===t.length?t.subarray(12):t),i=new Uint8Array(48===n.length?n.subarray(16):n),o=path.dirname(e);return fs.existsSync(o)||fs.mkdirSync(o,{recursive:!0}),fs.writeFileSync(e,JSON.stringify({publicKey:Buffer.from(a).toString("base64"),privateKey:Buffer.from(i).toString("base64")},null,2),{mode:384}),{publicKey:a,privateKey:i}}export function signAgentMessage(e,r){const t=crypto.createPrivateKey({key:wrapPrivateKey(r),format:"der",type:"pkcs8"});return new Uint8Array(crypto.sign(null,Buffer.from(e),t))}export function bodyHashHex(e){return sdkBodyHashHex(e)}export function agentAuthHeaders(e,r,t,n){return agentRequestAuthHeaders(e,r,{publicKey:t.publicKey,sign:e=>signAgentMessage(Buffer.from(e).toString("utf8"),t.privateKey)},n)}export function agentBoundAuthHeaders(e,r,t,n){return agentAuthHeaders(e,r,n,t)}export async function agentFetch(e,r,t){return await authenticatedAgentFetch(e,{publicKey:r.publicKey,sign:e=>signAgentMessage(Buffer.from(e).toString("utf8"),r.privateKey)},t)}export async function agentBoundFetch(e,r,t){if(""!==("string"==typeof e?new URL(e):e).search)throw new Error("body-bound agent authority routes forbid query parameters");return agentFetch(e,r,t)}

package/dist/bridge-discovery.js

@@ -1 +0,0 @@
-export async function discoverBridgeFromGW(o,n,r){try{const i=r?`?region=${encodeURIComponent(r)}`:"",e=await n(`${o}/api/v1/bridge/config${i}`,{method:"GET"});if(e.ok){const o=await e.json();if(o.url)return{url:o.url,region:o.region}}}catch{}}

package/dist/runtime/agent-gateway-runtime-attempt-authorization.js

@@ -1 +0,0 @@
-import{canonicalizeJcs}from"@beeos-ai/beeos-types/runtime";const GRANT_ISSUER="beeos-gateway",BOUNDARY_ISSUER="message-service";export class AgentGatewayRuntimeAttemptAuthorizationClient{options;constructor(e){this.options=e}async authorize(e){if(!sameLeaseFence(e.lease,e.fence)||e.request.payload.instanceId!==e.lease.instanceId)return{status:"fenced"};const t="start",n=JSON.stringify({executionGrantRef:e.request.payload.executionGrantRef,operationId:e.request.operationId,requestMessageId:e.request.messageId,method:e.request.payload.request.method,paramsHash:e.request.payload.paramsHash,runtimeLeaseCredential:e.lease.runtimeLeaseCredential,fence:e.fence,journalAttestationHash:e.journal.journalAttestationHash,journalRevisionBeforeAttempt:e.journal.journalRevisionBeforeAttempt,preparedEntryHash:e.journal.preparedEntryHash,executionMode:t}),a=await this.options.boundAgentFetch(new URL(this.options.authorizationUrl),{method:"POST",headers:{"content-type":"application/json"},body:n});if(401===a.status||403===a.status)return{status:"fenced"};if(!a.ok)throw new Error(`Agent Gateway runtime authorization failed (${a.status})`);const o=await a.json();if(isTerminalAuthorization(o))return{status:o.status};if(!isAuthorizedResponse(o))return{status:"invalid"};if(o.operationId!==e.request.operationId||o.requestMessageId!==e.request.messageId||o.method!==e.request.payload.request.method||o.paramsHash!==e.request.payload.paramsHash||canonicalizeJcs(o.command)!==canonicalizeJcs(e.request.payload.command))return{status:"invalid"};await this.options.verifier.refresh();let i=this.options.verifier.verifyAndDecodeGrant(o.runtimeExecutionGrant),r=this.options.verifier.verifyAndDecodeBoundary(o.executionBoundaryAssertion);if(i&&r||(await this.options.verifier.refresh(!0),i=this.options.verifier.verifyAndDecodeGrant(o.runtimeExecutionGrant),r=this.options.verifier.verifyAndDecodeBoundary(o.executionBoundaryAssertion)),!i||!r||o.executionBoundaryId!==r.claims.executionBoundaryId||o.executionBoundaryId!==r.claims.jti)return{status:"invalid"};const s=invocationContext(e.request,e.fence,i.claims,t,this.options.messageServicePublisherIdentityId??BOUNDARY_ISSUER,Math.floor((this.options.now??Date.now)()/1e3));if(!s)return{status:"invalid"};const d={grant:{header:i.header,claims:i.claims,grantJwt:o.runtimeExecutionGrant},boundary:{header:r.header,claims:r.claims,assertionJwt:o.executionBoundaryAssertion}};return{status:"authorized",attempt:{command:o.command,validationContext:s,authorization:d,derivationContext:{invocation:s,boundaryIssuer:BOUNDARY_ISSUER,boundarySubject:e.request.payload.instanceId,nowEpochSeconds:s.nowEpochSeconds,localJournalRevision:e.journal.journalRevisionBeforeAttempt,localPreparedEntryHash:e.journal.preparedEntryHash},executionBoundaryId:o.executionBoundaryId,boundaryAssertionHash:r.compactHash,executionMode:t}}}}function invocationContext(e,t,n,a,o,i){const r=e.payload.command,s={operationId:e.operationId,requestMessageId:e.messageId,dispatchEpoch:r.context.dispatchEpoch,activeRuntimeEpoch:t.runtimeEpoch,requestId:e.payload.request.id,method:e.payload.request.method,gatewayPublisherIdentityId:e.publisherIdentityId,messageServicePublisherIdentityId:o,runtimePublisherIdentityId:t.handlerIdentity,requestHash:e.payload.requestHash,paramsHash:e.payload.paramsHash,commandHash:e.payload.commandHash,idempotencyKeyHash:e.payload.idempotencyKeyHash,idempotencyFingerprint:e.payload.idempotencyFingerprint,callerIntentHash:e.payload.callerIntentHash,callerUserId:e.payload.callerUserId,callerIdentityId:e.payload.callerIdentityId,instanceId:e.payload.instanceId,runtimeInstanceUid:r.context.runtimeInstanceUid,executionGrantRef:e.payload.executionGrantRef,executionGrantHash:e.payload.executionGrantHash,claimDeadlineAt:e.payload.claimDeadlineAt,executionDeadlineAt:e.payload.executionDeadlineAt,grantIssuer:GRANT_ISSUER,grantSubject:t.handlerIdentity,grantJti:`${t.claimId}:${a}`,grantStartDeadline:Math.floor(Date.parse(e.payload.claimDeadlineAt)/1e3),grantExecutionMode:a,nowEpochSeconds:i,activeFence:t};return Number.isSafeInteger(s.grantStartDeadline)?"instance"===n.scope?{...s,scope:"instance",...void 0===n.runtimeAgentUid?{}:{runtimeAgentUid:n.runtimeAgentUid}}:"agent"===n.scope&&"agent"===r.context.scope&&n.platformAgentId&&n.runtimeAgentUid?{...s,scope:"agent",platformAgentId:n.platformAgentId,runtimeAgentUid:n.runtimeAgentUid,runtimeLocalKey:r.context.agent.runtimeLocalKey}:"conversation"===n.scope&&"conversation"===r.context.scope&&n.platformAgentId&&n.runtimeAgentUid&&n.platformConversationId&&n.runtimeConversationUid&&n.runtimeSessionKey?{...s,scope:"conversation",platformAgentId:n.platformAgentId,runtimeAgentUid:n.runtimeAgentUid,platformConversationId:n.platformConversationId,runtimeConversationUid:n.runtimeConversationUid,runtimeSessionKey:n.runtimeSessionKey}:null:null}function sameLeaseFence(e,t){return e.runtimeEpoch===t.runtimeEpoch&&e.handlerIdentity===t.handlerIdentity}function isTerminalAuthorization(e){return isRecord(e)&&1===Object.keys(e).length&&("expired"===e.status||"terminal"===e.status)}function isAuthorizedResponse(e){if(!isRecord(e))return!1;const t=Object.keys(e).sort(),n=["authorizedAt","command","disposition","executionBoundaryAssertion","executionBoundaryId","expiresAt","method","operationId","paramsHash","requestMessageId","runtimeExecutionGrant","status"].sort();return t.length===n.length&&t.every((e,t)=>e===n[t])&&"authorized"===e.status&&("created"===e.disposition||"reused"===e.disposition)&&[e.operationId,e.requestMessageId,e.method,e.paramsHash,e.runtimeExecutionGrant,e.executionBoundaryAssertion,e.executionBoundaryId,e.authorizedAt,e.expiresAt].every(e=>"string"==typeof e&&e.length>0)&&isRecord(e.command)&&Number.isFinite(Date.parse(e.authorizedAt))&&Number.isFinite(Date.parse(e.expiresAt))}function isRecord(e){return null!==e&&"object"==typeof e&&!Array.isArray(e)}

package/dist/runtime/message-service-runtime-invocation-authority.js

@@ -1 +0,0 @@
-import{createHash}from"node:crypto";import{RUNTIME_ERROR_DESCRIPTORS,RUNTIME_HASH_DOMAINS,runtimeHashPreimage}from"@beeos-ai/beeos-types/runtime";import{MessageServiceRuntimeClaimHttpAuthority}from"./message-service-runtime-claim-authority.js";const QUERY_METHODS=new Set(["skills/list","models/list","cron/list","cron/status","cron/runs","mcp/list"]),PROJECTION_METHODS=new Set(["agent/create","agent/update","agent/delete","agent/applyTemplate","session/set_model"]);export class MessageServiceRuntimeInvocationHttpAuthority{deps;constructor(e){this.deps=e}claimNext=e=>this.claimAuthority().claimNext(e);claimExact=e=>this.claimAuthority().claimExact(e);renewClaim=e=>this.claimAuthority().renewClaim(e);releaseClaim=e=>this.claimAuthority().releaseClaim(e);authorize=e=>this.deps.authorization.authorize(e);async appendStarted(e){await this.append(e,"runtime_operation_started",{claimedAt:this.now(),leaseExpiresAt:e.claimLeaseExpiresAt,executionMode:e.attempt.executionMode,executionBoundaryId:e.attempt.executionBoundaryId,boundaryAssertionHash:e.attempt.boundaryAssertionHash,...e.attempt.handoffId?{handoffId:e.attempt.handoffId}:{}})}async appendProgress(e){await this.append(e,"runtime_operation_progress",{executionBoundaryId:e.attempt.executionBoundaryId,phase:e.progress.phase,...void 0===e.progress.current?{}:{current:e.progress.current},...void 0===e.progress.total?{}:{total:e.progress.total}})}async commitResult(e){const t=e.request.payload.request.method;if(PROJECTION_METHODS.has(t))throw new Error(`projection-required runtime method is not enabled by this authority: ${t}`);const o=this.now(),a=e.result,s=hash(RUNTIME_HASH_DOMAINS.serviceResult,{method:t,result:a});let r;if(!QUERY_METHODS.has(t)){const s=hash(RUNTIME_HASH_DOMAINS.coreResult,{method:t,result:a}),n={schemaVersion:1,operationId:e.operationId,method:t,coreResultRef:`sha256:${s}`,coreResultHash:s},i={schemaVersion:1,operationId:e.operationId,requestMessageId:e.requestMessageId,method:t,commandHash:e.request.payload.commandHash,executionBoundaryId:e.attempt.executionBoundaryId,boundaryAssertionHash:e.attempt.boundaryAssertionHash,fence:e.fence,journalRevision:"3",coreResultHash:s,effectRecordHash:hash(RUNTIME_HASH_DOMAINS.effectRecord,n),projection:{state:"not_required"},committedAt:o};r=hash(RUNTIME_HASH_DOMAINS.effectReceipt,i),await this.append(e,"runtime_effect_committed",{executionBoundaryId:e.attempt.executionBoundaryId,committedAt:o,effectReceipt:i,effectReceiptHash:r})}const n={schemaVersion:1,operationId:e.operationId,method:t,outcome:"succeeded",serviceResultRef:`sha256:${s}`,serviceResultHash:s},i={schemaVersion:1,operationId:e.operationId,requestMessageId:e.requestMessageId,method:t,commandHash:e.request.payload.commandHash,executionBoundaryId:e.attempt.executionBoundaryId,boundaryAssertionHash:e.attempt.boundaryAssertionHash,fence:e.fence,journalRevision:"3",terminalRecordHash:hash(RUNTIME_HASH_DOMAINS.terminalRecord,n),completedAt:o,outcome:"succeeded",serviceResultHash:s,...r?{effectReceiptHash:r}:{}};await this.appendTerminal(e,i,{outcome:"succeeded",response:{jsonrpc:"2.0",id:e.request.payload.request.id,result:a},serviceResultHash:s,terminalAuthority:r?{kind:"effect_receipt",effectReceiptHash:r}:{kind:"query_execution",executionBoundaryId:e.attempt.executionBoundaryId,boundaryAssertionHash:e.attempt.boundaryAssertionHash},completedAt:o})}async commitFailure(e){const t=e.request.payload.request.method,o=this.now(),a=normalizeErrorCode(e.outcome,e.code),s=RUNTIME_ERROR_DESCRIPTORS[a],r="outcome_unknown"===e.outcome?"outcome_unknown":"cancelled"===e.outcome?"cancelled":"expired"===e.outcome?"expired":"failed",n={code:s.jsonRpcCode,message:a,data:{code:a,operationId:e.operationId,effectState:r,retryMode:s.retryMode}},i=hash(RUNTIME_HASH_DOMAINS.terminalRecord,{operationId:e.operationId,method:t,outcome:e.outcome,code:a}),c="outcome_unknown"===e.outcome?{schemaVersion:1,operationId:e.operationId,method:t,outcome:e.outcome,uncertaintyRef:`sha256:${i}`,uncertaintyHash:i}:{schemaVersion:1,operationId:e.operationId,method:t,outcome:e.outcome,errorRef:`sha256:${i}`,errorHash:i},d={schemaVersion:1,operationId:e.operationId,requestMessageId:e.requestMessageId,method:t,commandHash:e.request.payload.commandHash,executionBoundaryId:e.attempt.executionBoundaryId,boundaryAssertionHash:e.attempt.boundaryAssertionHash,fence:e.fence,journalRevision:"2",terminalRecordHash:hash(RUNTIME_HASH_DOMAINS.terminalRecord,c),completedAt:o},u="outcome_unknown"===e.outcome?{...d,outcome:"outcome_unknown",uncertaintyHash:i}:{...d,outcome:e.outcome,noEffect:!0,errorHash:i},m={jsonrpc:"2.0",id:e.request.payload.request.id,error:n},p=terminalFailurePayload(e.outcome,o,m,e.attempt.executionBoundaryId,e.attempt.boundaryAssertionHash);await this.appendTerminal(e,u,p)}claimAuthority(){return new MessageServiceRuntimeClaimHttpAuthority({messageServiceUrl:this.deps.messageServiceUrl,fetchAuthorized:(e,t)=>this.deps.fetchMessageService(e,t)})}async append(e,t,o){await this.post(e.operationId,{schemaVersion:1,type:t,operationId:e.operationId,conversationId:e.operationId,requestMessageId:e.requestMessageId,dispatchEpoch:e.request.payload.command.context.dispatchEpoch,fence:e.fence,payload:o})}async appendTerminal(e,t,o){await this.post(e.operationId,{schemaVersion:1,type:"runtime_rpc_response",operationId:e.operationId,conversationId:e.operationId,requestMessageId:e.requestMessageId,dispatchEpoch:e.request.payload.command.context.dispatchEpoch,fence:e.fence,payload:o,replyTo:e.requestMessageId,terminalReceipt:t,terminalReceiptHash:hash(RUNTIME_HASH_DOMAINS.terminalReceipt,t)})}async post(e,t){const o=await this.deps.fetchMessageService(new URL(`/api/v1/runtime/operations/${encodeURIComponent(e)}/events`,this.deps.messageServiceUrl),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});if(201!==o.status)throw new Error(`Message Service runtime event append failed (${o.status})`)}now(){return(this.deps.now??(()=>new Date))().toISOString()}}function hash(e,t){return createHash("sha256").update(runtimeHashPreimage(e,t)).digest("hex")}function normalizeErrorCode(e,t){return"outcome_unknown"===e?"OUTCOME_UNKNOWN":"cancelled"===e?"OPERATION_CANCELLED":"expired"===e?"COMMAND_EXPIRED":t in RUNTIME_ERROR_DESCRIPTORS?t:"RUNTIME_EXECUTION_FAILED"}function terminalFailurePayload(e,t,o,a,s){if("outcome_unknown"===e)return{outcome:e,response:o,terminalAuthority:{kind:"uncertain_effect",executionBoundaryId:a,boundaryAssertionHash:s},completedAt:t};const r={kind:"definitive_no_effect",journalPhase:"prepared",observedAt:t};return"cancelled"===e?{outcome:e,response:o,cancellationEvidence:r,completedAt:t}:"expired"===e?{outcome:e,response:o,expirationEvidence:r,completedAt:t}:{outcome:e,response:o,failureEvidence:r,completedAt:t}}

package/dist/runtime/runtime-jwks-verifier.js

@@ -1 +0,0 @@
-import{createHash,createPublicKey,verify}from"node:crypto";import{validateRuntimeExecutionGrant}from"@beeos-ai/beeos-types/runtime";export class RuntimeJwksVerifier{jwksUrl;fetcher;ttlMs;now;keys=new Map;expiresAt=0;inflight;provenance;keyMaterials=Object.freeze([]);keysetUrl;constructor(e,t=fetch,r=3e5,s=Date.now){this.jwksUrl=e,this.fetcher=t,this.ttlMs=r,this.now=s,this.keysetUrl=new URL(e).toString()}async refresh(e=!1){if(!(!e&&this.keys.size>0&&this.now()<this.expiresAt)){if(this.inflight)return await this.inflight;this.inflight=this.load();try{await this.inflight}finally{this.inflight=void 0}}}hasKid(e){return this.keys.has(e)}trustedKids(){return Object.freeze([...this.keys.keys()].sort())}trustedKeyMaterials(){return this.keyMaterials}documentProvenance(){return this.provenance}verifyAndDecodeGrant(e){const t=this.verifyCompact(e);return t?{header:t.header,claims:t.claims,compactHash:sha256(e)}:null}verifyAndValidateGrant(e,t){const r=this.verifyAndDecodeGrant(e);return r&&0===validateRuntimeExecutionGrant(r.claims,t).length?r:null}verifyAndDecodeBoundary(e){const t=this.verifyCompact(e);return t?{header:t.header,claims:t.claims,compactHash:sha256(e)}:null}async load(){const e=await this.fetcher(this.jwksUrl,{signal:AbortSignal.timeout(1e4),redirect:"error"});if(!e.ok)throw new Error(`JWKS fetch failed: HTTP ${e.status}`);const t=await e.json(),r=new Map,s=[];for(const e of t.keys??[]){if("RSA"!==e.kty||"sig"!==e.use||"RS256"!==e.alg||"string"!=typeof e.kid||!e.kid)continue;if(r.has(e.kid))throw new Error(`JWKS contains duplicate kid: ${e.kid}`);const t=createPublicKey({key:e,format:"jwk"});if((t.asymmetricKeyDetails?.modulusLength??0)<2048)continue;const i=t.export({format:"jwk"});"RSA"===i.kty&&"string"==typeof i.n&&"string"==typeof i.e&&(r.set(e.kid,t),s.push(Object.freeze({jwkThumbprint:sha256(JSON.stringify({e:i.e,kty:"RSA",n:i.n})),spkiSha256:createHash("sha256").update(t.export({format:"der",type:"spki"})).digest("hex")})))}if(0===r.size)throw new Error("JWKS contains no trusted RS256 keys");const i=e.url?new URL(e.url).toString():this.keysetUrl;if(i!==this.keysetUrl)throw new Error("JWKS response provenance URL mismatch");this.keys=r,this.keyMaterials=Object.freeze(s.sort((e,t)=>e.jwkThumbprint.localeCompare(t.jwkThumbprint)||e.spkiSha256.localeCompare(t.spkiSha256))),this.provenance=Object.freeze({sourceUrl:i,etag:e.headers.get("etag")??"",issuer:"string"==typeof t.issuer?t.issuer:"",audience:"string"==typeof t.audience?t.audience:"",purpose:"string"==typeof t.purpose?t.purpose:"",maxClaimTtlSeconds:"number"==typeof t.maxClaimTtlSeconds?t.maxClaimTtlSeconds:Number.NaN}),this.expiresAt=this.now()+this.ttlMs}verifyCompact(e){const t=e.split(".");if(3!==t.length)return null;try{if(!t.every(isCanonicalBase64Url))return null;const e=JSON.parse(decodeBase64Url(t[0]));if("RS256"!==e.alg||"JWT"!==e.typ||"string"!=typeof e.kid)return null;const r=this.keys.get(e.kid);if(!r)return null;const s=Buffer.from(`${t[0]}.${t[1]}`),i=Buffer.from(t[2],"base64url");if(!verify("RSA-SHA256",s,r,i))return null;const n=JSON.parse(decodeBase64Url(t[1]));return null===n||"object"!=typeof n||Array.isArray(n)?null:{header:e,claims:n}}catch{return null}}}function isCanonicalBase64Url(e){if(!e||!/^[A-Za-z0-9_-]+$/.test(e))return!1;return Buffer.from(e,"base64url").toString("base64url")===e}function decodeBase64Url(e){return Buffer.from(e,"base64url").toString("utf8")}function sha256(e){return createHash("sha256").update(e).digest("hex")}

package/dist/runtime/split-runtime-authorization-verifier.js

@@ -1 +0,0 @@
-import{CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN}from"@beeos-ai/beeos-types/runtime";const GATEWAY_GRANT_PROVENANCE=Object.freeze({issuer:"beeos-gateway",audience:"beeos-runtime-command",purpose:"runtime-execution-grant",maxClaimTtlSeconds:60}),CLOUD_GRANT_PROVENANCE=Object.freeze({issuer:CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.issuer,audience:CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.audience,purpose:CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.purpose,maxClaimTtlSeconds:60}),MESSAGE_BOUNDARY_PROVENANCE=Object.freeze({issuer:"message-service",audience:"beeos-runtime-execution-boundary",purpose:"runtime-execution-boundary",maxClaimTtlSeconds:60});export class GatewayGrantJwksVerifier{verifier;purpose="gateway-runtime-grant";keysetProvenance;constructor(e){this.verifier=e,this.keysetProvenance=e.keysetUrl}async refresh(e=!1){await this.verifier.refresh(e),assertResponseProvenance(this.verifier,GATEWAY_GRANT_PROVENANCE)}trustedKeyMaterials(){return this.verifier.trustedKeyMaterials()}responseProvenance(){return this.verifier.documentProvenance()}verifyAndDecodeGrant(e){const r=this.verifier.verifyAndDecodeGrant(e);return"beeos-gateway"===r?.claims.iss&&"beeos-runtime-command"===r.claims.aud&&"runtime-execution-grant"===r.claims.purpose?r:null}}export class CloudGatewayGrantJwksVerifier{verifier;keysetProvenance;constructor(e){this.verifier=e,this.keysetProvenance=e.keysetUrl}async refresh(e=!1){await this.verifier.refresh(e),assertResponseProvenance(this.verifier,CLOUD_GRANT_PROVENANCE)}verifyAndDecodeGrant(e){const r=this.verifier.verifyAndDecodeGrant(e),s=r?.claims;return s?.iss===CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.issuer&&s.aud===CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.audience&&s.purpose===CLOUD_RUNTIME_EXECUTION_GRANT_DOMAIN.purpose?r:null}}export class MessageServiceBoundaryJwksVerifier{verifier;purpose="message-service-execution-boundary";keysetProvenance;constructor(e){this.verifier=e,this.keysetProvenance=e.keysetUrl}async refresh(e=!1){await this.verifier.refresh(e),assertResponseProvenance(this.verifier,MESSAGE_BOUNDARY_PROVENANCE)}trustedKeyMaterials(){return this.verifier.trustedKeyMaterials()}responseProvenance(){return this.verifier.documentProvenance()}verifyAndDecodeBoundary(e){const r=this.verifier.verifyAndDecodeBoundary(e);return"message-service"===r?.claims.iss&&"beeos-runtime-execution-boundary"===r.claims.aud?r:null}}export class SplitIssuerRuntimeAuthorizationVerifier{grant;boundary;constructor(e,r){if(this.grant=e,this.boundary=r,e.keysetProvenance===r.keysetProvenance)throw new Error("grant and boundary JWKS keysets require distinct provenance")}async refresh(e=!1){await Promise.all([this.grant.refresh(e),this.boundary.refresh(e)]);const r=this.grant.responseProvenance(),s=this.boundary.responseProvenance();if(!r||!s||r.sourceUrl===s.sourceUrl||r.etag===s.etag)throw new Error("grant and boundary JWKS responses require distinct provenance");const n=new Set(this.boundary.trustedKeyMaterials().flatMap(e=>[e.jwkThumbprint,e.spkiSha256]));if(this.grant.trustedKeyMaterials().some(e=>n.has(e.jwkThumbprint)||n.has(e.spkiSha256)))throw new Error("grant and boundary JWKS keysets reuse public-key material")}verifyAndDecodeGrant(e){return this.grant.verifyAndDecodeGrant(e)}verifyAndDecodeBoundary(e){return this.boundary.verifyAndDecodeBoundary(e)}}function assertResponseProvenance(e,r){const s=e.documentProvenance();if(!s||!s.etag||s.sourceUrl!==e.keysetUrl||s.issuer!==r.issuer||s.audience!==r.audience||s.purpose!==r.purpose||s.maxClaimTtlSeconds!==r.maxClaimTtlSeconds)throw new Error(`JWKS response provenance mismatch for ${r.purpose}`)}