shield360 1.1.0 → 1.2.0

package/dist/agents/index.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * shield360/agents: verify the agents that call your API or MCP server.
+ *
+ *   import { agentVerifier, AGENT_HEADER } from 'shield360/agents';
+ *   const verifier = agentVerifier({ audience: 'api.example.com' });
+ *   const result = await verifier.check(request);
+ *
+ * Kept apart from tracing: importing this subpath loads no OpenTelemetry code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assuranceRank = exports.PASSPORT_TYP = exports.DEFAULT_POLICY = exports.DEFAULT_ISSUERS = exports.ASSURANCE_LEVELS = exports.AGENT_HEADER = exports.MemoryReplayStore = exports.readPassport = exports.agentVerifier = void 0;
+var verifier_1 = require("./verifier");
+Object.defineProperty(exports, "agentVerifier", { enumerable: true, get: function () { return verifier_1.agentVerifier; } });
+Object.defineProperty(exports, "readPassport", { enumerable: true, get: function () { return verifier_1.readPassport; } });
+var replay_1 = require("./replay");
+Object.defineProperty(exports, "MemoryReplayStore", { enumerable: true, get: function () { return replay_1.MemoryReplayStore; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "AGENT_HEADER", { enumerable: true, get: function () { return types_1.AGENT_HEADER; } });
+Object.defineProperty(exports, "ASSURANCE_LEVELS", { enumerable: true, get: function () { return types_1.ASSURANCE_LEVELS; } });
+Object.defineProperty(exports, "DEFAULT_ISSUERS", { enumerable: true, get: function () { return types_1.DEFAULT_ISSUERS; } });
+Object.defineProperty(exports, "DEFAULT_POLICY", { enumerable: true, get: function () { return types_1.DEFAULT_POLICY; } });
+Object.defineProperty(exports, "PASSPORT_TYP", { enumerable: true, get: function () { return types_1.PASSPORT_TYP; } });
+Object.defineProperty(exports, "assuranceRank", { enumerable: true, get: function () { return types_1.assuranceRank; } });
+//# sourceMappingURL=index.js.map

package/dist/agents/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agents/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,uCAAyD;AAAhD,yGAAA,aAAa,OAAA;AAAE,wGAAA,YAAY,OAAA;AAEpC,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,iCAAuH;AAA9G,qGAAA,YAAY,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,wGAAA,eAAe,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,qGAAA,YAAY,OAAA;AAAE,sGAAA,aAAa,OAAA"}

package/dist/agents/passport.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Reading an agent passport: the compact JWS, its claims, the issuer's keys and
+ * the audience. Pure functions plus the key cache; nothing here throws on
+ * hostile input.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_passport.py
+ */
+import { KeyObject } from 'crypto';
+import { AgentIdentity, AgentMandate, Assurance } from './types';
+/** Longer than any real passport; anything bigger is refused unparsed. */
+export declare const MAX_TOKEN_LENGTH = 8192;
+export type PassportClaims = {
+    iss: string;
+    sub: string;
+    aud: string;
+    iat: number;
+    exp: number;
+    jti: string;
+    agent: AgentIdentity;
+    operator: {
+        id: string;
+        name: string;
+        domain: string | null;
+    };
+    act?: {
+        sub: string;
+        domain: string | null;
+        assurance: Assurance;
+        mandate?: AgentMandate;
+    };
+    scope?: string;
+    decision?: {
+        id: string;
+        policyVersion: string;
+    };
+};
+export type ParsedPassport = {
+    kid: string;
+    claims: PassportClaims;
+    signingInput: Buffer;
+    signature: Buffer;
+};
+export type ParseResult = {
+    ok: true;
+    passport: ParsedPassport;
+} | {
+    ok: false;
+    reason: 'malformed' | 'unsupported_alg';
+};
+/** An act's assurance: absent means "named" (older passports); anything unknown counts as the weakest. */
+export declare function assuranceOf(v: unknown): Assurance;
+/** Step 1: three base64url parts, typ and alg, and claims of the right shape. */
+export declare function parsePassport(token: string): ParseResult;
+/** The scopes a passport presents: well-formed ones only, at most 32. */
+export declare function scopesOf(scope: string | undefined): string[];
+export declare function verifySignature(p: ParsedPassport, key: KeyObject): boolean;
+/** An issuer base URL without its trailing slash. */
+export declare function normaliseIssuer(iss: string): string;
+type Audience = {
+    host: string;
+    origin?: string;
+};
+/**
+ * What an audience names: a host name as is (lower case), or an origin and its
+ * host. `strict` refuses origins that are not https (passport audiences).
+ */
+export declare function parseAudience(value: string, strict: boolean): Audience | null;
+/**
+ * Step 5: the passport's aud names one of the receiver's audiences. Hosts
+ * compare case-insensitively; a bare host on either side matches an origin
+ * with that host; two origins must be identical.
+ */
+export declare function audienceMatches(aud: string, audiences: string[]): boolean;
+/** Fetches with a timeout; resolves to undefined on any failure. */
+export declare function fetchJson(fetchImpl: typeof fetch, url: string, init: RequestInit): Promise<{
+    status: number;
+    body: unknown;
+} | undefined>;
+/**
+ * The issuers' public keys: cached for an hour; an unknown kid refetches at
+ * most once a minute per issuer. A stale key is still used when a refetch fails
+ * (published keys stay published after rotation).
+ */
+export declare class KeyCache {
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly issuers;
+    constructor(fetchImpl: () => typeof fetch, now: () => number);
+    get(issuer: string, kid: string): Promise<KeyObject | undefined>;
+    private refresh;
+}
+export {};

package/dist/agents/passport.js

@@ -0,0 +1,301 @@
+"use strict";
+/**
+ * Reading an agent passport: the compact JWS, its claims, the issuer's keys and
+ * the audience. Pure functions plus the key cache; nothing here throws on
+ * hostile input.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_passport.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyCache = exports.MAX_TOKEN_LENGTH = void 0;
+exports.assuranceOf = assuranceOf;
+exports.parsePassport = parsePassport;
+exports.scopesOf = scopesOf;
+exports.verifySignature = verifySignature;
+exports.normaliseIssuer = normaliseIssuer;
+exports.parseAudience = parseAudience;
+exports.audienceMatches = audienceMatches;
+exports.fetchJson = fetchJson;
+const crypto_1 = require("crypto");
+const types_1 = require("./types");
+/** Longer than any real passport; anything bigger is refused unparsed. */
+exports.MAX_TOKEN_LENGTH = 8192;
+const B64URL = /^[A-Za-z0-9_-]+$/;
+const SCOPE = /^[A-Za-z0-9_.:-]{1,64}$/;
+const MAX_SCOPES = 32;
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isText = (v, max = 1024) => typeof v === 'string' && v.length > 0 && v.length <= max;
+const isOptionalText = (v, max = 1024) => v === undefined || v === null || (typeof v === 'string' && v.length <= max);
+const optText = (v, max = 256) => (typeof v === 'string' && v && v.length <= max ? v : null);
+/** An act's assurance: absent means "named" (older passports); anything unknown counts as the weakest. */
+function assuranceOf(v) {
+    if (v === undefined || v === null)
+        return 'named';
+    return types_1.ASSURANCE_LEVELS.includes(v) ? v : 'unverified';
+}
+/** The agent claim: required id and name; the optional profile fields are passed through when well-typed. */
+function agentOf(a) {
+    const out = { id: a.id, name: a.name };
+    if (typeof a.purpose === 'string' && a.purpose)
+        out.purpose = a.purpose;
+    if (a.status === 'enrolled' || a.status === 'not_enrolled')
+        out.status = a.status;
+    for (const k of ['environment', 'risk', 'reviewedAt', 'enrolledAt']) {
+        if (k in a && (a[k] === null || typeof a[k] === 'string'))
+            out[k] = optText(a[k], 128);
+    }
+    if (isObject(a.owner))
+        out.owner = { domain: optText(a.owner.domain) };
+    return out;
+}
+function actOf(act) {
+    const out = {
+        sub: act.sub,
+        domain: optText(act.domain),
+        assurance: assuranceOf(act.assurance),
+    };
+    const m = act.mandate;
+    if (isObject(m) && isText(m.id, 256) && isText(m.expiresAt, 64))
+        out.mandate = { id: m.id, expiresAt: m.expiresAt };
+    return out;
+}
+function decodeJson(part) {
+    try {
+        return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Step 1: three base64url parts, typ and alg, and claims of the right shape. */
+function parsePassport(token) {
+    const malformed = { ok: false, reason: 'malformed' };
+    if (typeof token !== 'string' || token.length > exports.MAX_TOKEN_LENGTH)
+        return malformed;
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts.every((p) => B64URL.test(p)))
+        return malformed;
+    const header = decodeJson(parts[0]);
+    if (!isObject(header))
+        return malformed;
+    if (typeof header.typ !== 'string' || header.typ.toLowerCase() !== types_1.PASSPORT_TYP)
+        return malformed;
+    // Extensions the verifier does not understand must not be ignored (RFC 7515 4.1.11).
+    if (header.crit !== undefined)
+        return malformed;
+    if (header.alg !== 'EdDSA')
+        return { ok: false, reason: 'unsupported_alg' };
+    if (!isText(header.kid, 256))
+        return malformed;
+    const c = decodeJson(parts[1]);
+    if (!isObject(c))
+        return malformed;
+    const agent = c.agent;
+    const operator = c.operator;
+    const act = c.act;
+    const decision = c.decision;
+    if (!isText(c.iss, 512) ||
+        !isText(c.sub, 512) ||
+        !isText(c.aud, 512) ||
+        !isText(c.jti, 256) ||
+        typeof c.iat !== 'number' ||
+        !Number.isFinite(c.iat) ||
+        typeof c.exp !== 'number' ||
+        !Number.isFinite(c.exp) ||
+        !isObject(agent) ||
+        !isText(agent.id, 256) ||
+        !isText(agent.name, 512) ||
+        !isOptionalText(agent.purpose, 2048) ||
+        !isObject(operator) ||
+        !isText(operator.id, 256) ||
+        !isText(operator.name, 512) ||
+        !isOptionalText(operator.domain, 256) ||
+        (act !== undefined && act !== null && (!isObject(act) || !isText(act.sub, 256) || !isOptionalText(act.domain, 256))) ||
+        (c.scope !== undefined && c.scope !== null && typeof c.scope !== 'string') ||
+        (decision !== undefined && decision !== null && !isObject(decision))) {
+        return malformed;
+    }
+    const signature = Buffer.from(parts[2], 'base64url');
+    if (signature.length !== 64)
+        return malformed;
+    const claims = {
+        iss: c.iss,
+        sub: c.sub,
+        aud: c.aud,
+        iat: c.iat,
+        exp: c.exp,
+        jti: c.jti,
+        agent: agentOf(agent),
+        operator: { id: operator.id, name: operator.name, domain: typeof operator.domain === 'string' && operator.domain ? operator.domain : null },
+        ...(isObject(act) ? { act: actOf(act) } : {}),
+        ...(typeof c.scope === 'string' ? { scope: c.scope } : {}),
+        ...(isObject(decision) ? { decision: { id: String(decision.id ?? ''), policyVersion: String(decision.policyVersion ?? '') } } : {}),
+    };
+    return {
+        ok: true,
+        passport: { kid: header.kid, claims, signingInput: Buffer.from(`${parts[0]}.${parts[1]}`, 'ascii'), signature },
+    };
+}
+/** The scopes a passport presents: well-formed ones only, at most 32. */
+function scopesOf(scope) {
+    if (!scope)
+        return [];
+    const out = [];
+    for (const s of scope.split(/\s+/)) {
+        if (SCOPE.test(s) && !out.includes(s))
+            out.push(s);
+        if (out.length >= MAX_SCOPES)
+            break;
+    }
+    return out;
+}
+function verifySignature(p, key) {
+    try {
+        return (0, crypto_1.verify)(null, p.signingInput, key, p.signature);
+    }
+    catch {
+        return false;
+    }
+}
+/** An issuer base URL without its trailing slash. */
+function normaliseIssuer(iss) {
+    return iss.replace(/\/+$/, '');
+}
+/**
+ * What an audience names: a host name as is (lower case), or an origin and its
+ * host. `strict` refuses origins that are not https (passport audiences).
+ */
+function parseAudience(value, strict) {
+    if (typeof value !== 'string')
+        return null;
+    const v = value.trim().toLowerCase();
+    if (!v)
+        return null;
+    if (v.includes('://')) {
+        let url;
+        try {
+            url = new URL(v);
+        }
+        catch {
+            return null;
+        }
+        if (url.protocol !== 'https:' && (strict || url.protocol !== 'http:'))
+            return null;
+        if (url.username || url.password || (url.pathname && url.pathname !== '/') || url.search || url.hash)
+            return null;
+        return url.host ? { host: url.host, origin: url.origin } : null;
+    }
+    return /^[a-z0-9.-]+(:\d{1,5})?$/.test(v) ? { host: v.replace(/\.$/, '') } : null;
+}
+/**
+ * Step 5: the passport's aud names one of the receiver's audiences. Hosts
+ * compare case-insensitively; a bare host on either side matches an origin
+ * with that host; two origins must be identical.
+ */
+function audienceMatches(aud, audiences) {
+    const a = parseAudience(aud, true);
+    if (!a)
+        return false;
+    return audiences.some((value) => {
+        const b = parseAudience(value, false);
+        if (!b)
+            return false;
+        if (a.origin && b.origin)
+            return a.origin === b.origin;
+        return a.host === b.host;
+    });
+}
+const HOUR_MS = 60 * 60 * 1000;
+const MISS_REFETCH_MS = 60 * 1000;
+const FETCH_TIMEOUT_MS = 5000;
+/** Fetches with a timeout; resolves to undefined on any failure. */
+async function fetchJson(fetchImpl, url, init) {
+    const controller = typeof AbortController === 'function' ? new AbortController() : undefined;
+    const timer = controller ? setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS) : undefined;
+    timer?.unref?.();
+    try {
+        const res = await fetchImpl(url, { ...init, signal: controller?.signal });
+        let body;
+        try {
+            body = await res.json();
+        }
+        catch {
+            body = undefined;
+        }
+        return { status: res.status, body };
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function keyFromJwk(jwk) {
+    if (!isObject(jwk) || jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519' || !isText(jwk.x, 128) || !isText(jwk.kid, 256))
+        return undefined;
+    if (jwk.d !== undefined)
+        return undefined; // never accept a private key as a verification key
+    try {
+        const key = (0, crypto_1.createPublicKey)({ key: { kty: 'OKP', crv: 'Ed25519', x: jwk.x }, format: 'jwk' });
+        return { kid: jwk.kid, key };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The issuers' public keys: cached for an hour; an unknown kid refetches at
+ * most once a minute per issuer. A stale key is still used when a refetch fails
+ * (published keys stay published after rotation).
+ */
+class KeyCache {
+    constructor(fetchImpl, now) {
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.issuers = new Map();
+    }
+    async get(issuer, kid) {
+        let entry = this.issuers.get(issuer);
+        if (!entry) {
+            entry = { keys: new Map(), fetchedAt: -Infinity, lastAttempt: -Infinity };
+            this.issuers.set(issuer, entry);
+        }
+        const now = this.now();
+        const known = entry.keys.get(kid);
+        if (known && now - entry.fetchedAt < HOUR_MS)
+            return known;
+        // An unknown kid (or a stale set) refetches at most once a minute per issuer.
+        if (!entry.inflight) {
+            if (now - entry.lastAttempt < MISS_REFETCH_MS)
+                return known;
+            entry.lastAttempt = now;
+        }
+        await this.refresh(issuer, kid, entry);
+        return entry.keys.get(kid) ?? known;
+    }
+    refresh(issuer, kid, entry) {
+        if (entry.inflight)
+            return entry.inflight;
+        entry.inflight = (async () => {
+            const got = await fetchJson(this.fetchImpl(), `${issuer}/api/agent-passports/keys?kid=${encodeURIComponent(kid)}`, {
+                method: 'GET',
+                headers: { Accept: 'application/json' },
+            });
+            if (!got || got.status !== 200 || !isObject(got.body) || !Array.isArray(got.body.keys))
+                return;
+            for (const jwk of got.body.keys.slice(0, 50)) {
+                const k = keyFromJwk(jwk);
+                if (k)
+                    entry.keys.set(k.kid, k.key);
+            }
+            entry.fetchedAt = this.now();
+        })().finally(() => {
+            entry.inflight = undefined;
+        });
+        return entry.inflight;
+    }
+}
+exports.KeyCache = KeyCache;
+//# sourceMappingURL=passport.js.map

package/dist/agents/passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.js","sourceRoot":"","sources":["../../src/agents/passport.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAyCH,kCAGC;AAkCD,sCAgEC;AAGD,4BAQC;AAED,0CAMC;AAGD,0CAEC;AAQD,sCAgBC;AAOD,0CASC;AASD,8BAsBC;AA3OD,mCAA4E;AAC5E,mCAAiG;AAEjG,0EAA0E;AAC7D,QAAA,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAClC,MAAM,KAAK,GAAG,yBAAyB,CAAC;AACxC,MAAM,UAAU,GAAG,EAAE,CAAC;AAyBtB,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,IAAI,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;AACjH,MAAM,cAAc,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,IAAI,EAAW,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;AAExI,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,GAAG,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAErH,0GAA0G;AAC1G,SAAgB,WAAW,CAAC,CAAU;IACpC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAClD,OAAQ,wBAAuC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAe,CAAC,CAAC,CAAC,YAAY,CAAC;AAChG,CAAC;AAED,6GAA6G;AAC7G,SAAS,OAAO,CAAC,CAA0B;IACzC,MAAM,GAAG,GAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IACxE,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAU,EAAE,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B;IACzC,MAAM,GAAG,GAAuC;QAC9C,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3B,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;KACtC,CAAC;IACF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAAE,GAAG,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACpH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAW,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAgB;QAAE,OAAO,SAAS,CAAC;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,oBAAY;QAAE,OAAO,SAAS,CAAC;IAClG,qFAAqF;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IACE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACnB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACnB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QACvB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC;QACtB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;QACxB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;QACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAC3B,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;QACrC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACpH,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC1E,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACpE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,MAAM,GAAmB;QAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAc,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/J,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpI,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE;KAChH,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAgB,QAAQ,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAiB,EAAE,GAAc;IAC/D,IAAI,CAAC;QACH,OAAO,IAAA,eAAY,EAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAgB,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAID;;;GAGG;AACH,SAAgB,aAAa,CAAC,KAAa,EAAE,MAAe;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAClH,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,SAAmB;IAC9D,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAI9B,oEAAoE;AAC7D,KAAK,UAAU,SAAS,CAC7B,SAAuB,EACvB,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GAAG,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,KAA4C,EAAE,KAAK,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnI,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,mDAAmD;IAC9F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAa,QAAQ;IAGnB,YACmB,SAA6B,EAC7B,GAAiB;QADjB,cAAS,GAAT,SAAS,CAAoB;QAC7B,QAAG,GAAH,GAAG,CAAc;QAJnB,YAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAKtD,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,GAAW;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3D,8EAA8E;QAC9E,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC5D,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACtC,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,GAAW,EAAE,KAAiB;QAC5D,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;QAC1C,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,iCAAiC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjH,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC/F,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;CACF;AA5CD,4BA4CC"}

package/dist/agents/policy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The receiver's policy: defaults, the console policy (GET
+ * /api/inbound-agents/policy, cached 60 s) and the local policy, in that order
+ * of precedence from lowest to highest. A failed fetch keeps the last good
+ * console policy, or the defaults when there never was one.
+ */
+import { AgentPolicy, Shield360Connection } from './types';
+/** The well-typed fields of a policy-like value; unknown or ill-typed ones are dropped. */
+export declare function sanitisePolicy(value: unknown): Partial<AgentPolicy>;
+export declare function baseUrlOf(conn: Shield360Connection): string;
+export declare class PolicySource {
+    private readonly from;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly local;
+    private remote;
+    private fetchedAt;
+    private inflight;
+    constructor(local: Partial<AgentPolicy> | undefined, from: Shield360Connection | undefined, fetchImpl: () => typeof fetch, now: () => number);
+    /** The policy in force now. The first call with policyFrom waits for the console policy. */
+    current(): Promise<AgentPolicy>;
+    private merged;
+    private refresh;
+}

package/dist/agents/policy.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * The receiver's policy: defaults, the console policy (GET
+ * /api/inbound-agents/policy, cached 60 s) and the local policy, in that order
+ * of precedence from lowest to highest. A failed fetch keeps the last good
+ * console policy, or the defaults when there never was one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicySource = void 0;
+exports.sanitisePolicy = sanitisePolicy;
+exports.baseUrlOf = baseUrlOf;
+const passport_1 = require("./passport");
+const types_1 = require("./types");
+const CACHE_MS = 60 * 1000;
+const MAX_OPERATORS = 1000;
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/** The well-typed fields of a policy-like value; unknown or ill-typed ones are dropped. */
+function sanitisePolicy(value) {
+    if (!isObject(value))
+        return {};
+    const out = {};
+    if (value.mode === 'observe' || value.mode === 'enforce')
+        out.mode = value.mode;
+    if (typeof value.requireAgent === 'boolean')
+        out.requireAgent = value.requireAgent;
+    if (typeof value.requireOnBehalfOf === 'boolean')
+        out.requireOnBehalfOf = value.requireOnBehalfOf;
+    if (typeof value.online === 'boolean')
+        out.online = value.online;
+    if (value.minAssurance === 'none' || types_1.ASSURANCE_LEVELS.includes(value.minAssurance)) {
+        out.minAssurance = value.minAssurance;
+    }
+    if (Array.isArray(value.operators)) {
+        out.operators = value.operators
+            .filter((o) => typeof o === 'string' && o.trim().length > 0 && o.length <= 256)
+            .map((o) => o.trim())
+            .slice(0, MAX_OPERATORS);
+    }
+    return out;
+}
+function baseUrlOf(conn) {
+    const env = typeof process !== 'undefined' ? process.env?.SHIELD360_URL : undefined;
+    return (conn.baseUrl || env || types_1.DEFAULT_BASE_URL).replace(/\/+$/, '');
+}
+class PolicySource {
+    constructor(local, from, fetchImpl, now) {
+        this.from = from;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.fetchedAt = -Infinity;
+        this.local = sanitisePolicy(local);
+    }
+    /** The policy in force now. The first call with policyFrom waits for the console policy. */
+    async current() {
+        if (this.from?.apiKey && this.now() - this.fetchedAt >= CACHE_MS) {
+            const refresh = this.refresh();
+            // After the first answer, a stale policy is served while it refreshes.
+            if (this.remote === undefined)
+                await refresh;
+        }
+        return this.merged();
+    }
+    merged() {
+        const p = { ...types_1.DEFAULT_POLICY, ...(this.remote ?? {}), ...this.local };
+        return { ...p, operators: [...p.operators] };
+    }
+    refresh() {
+        if (this.inflight)
+            return this.inflight;
+        const from = this.from;
+        this.inflight = (async () => {
+            const got = await (0, passport_1.fetchJson)(this.fetchImpl(), `${baseUrlOf(from)}/api/inbound-agents/policy`, {
+                method: 'GET',
+                headers: { Accept: 'application/json', Authorization: `Bearer ${from.apiKey}` },
+            });
+            // Failures also wait out the cache period, so a down console is not hammered.
+            this.fetchedAt = this.now();
+            if (!got || got.status !== 200 || !isObject(got.body)) {
+                console.warn(`Shield360 agents: could not load the inbound agents policy${got ? ` (HTTP ${got.status})` : ''}; using the last known policy`);
+                return;
+            }
+            const body = got.body;
+            this.remote = sanitisePolicy(isObject(body.policy) ? body.policy : body);
+        })()
+            .catch(() => undefined)
+            .finally(() => {
+            this.inflight = undefined;
+        });
+        return this.inflight;
+    }
+}
+exports.PolicySource = PolicySource;
+//# sourceMappingURL=policy.js.map

package/dist/agents/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/agents/policy.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAWH,wCAiBC;AAED,8BAGC;AA/BD,yCAAuC;AACvC,mCAA+G;AAE/G,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,2FAA2F;AAC3F,SAAgB,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAChF,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACnF,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,IAAK,wBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAA2C,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;aAC3F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,SAAS,CAAC,IAAyB;IACjD,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,IAAI,wBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAa,YAAY;IAMvB,YACE,KAAuC,EACtB,IAAqC,EACrC,SAA6B,EAC7B,GAAiB;QAFjB,SAAI,GAAJ,IAAI,CAAiC;QACrC,cAAS,GAAT,SAAS,CAAoB;QAC7B,QAAG,GAAH,GAAG,CAAc;QAP5B,cAAS,GAAG,CAAC,QAAQ,CAAC;QAS5B,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,uEAAuE;YACvE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,OAAO,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,MAAM;QACZ,MAAM,CAAC,GAAG,EAAE,GAAG,sBAAc,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvE,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/C,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAA2B,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAS,EAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC5F,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;aAChF,CAAC,CAAC;YACH,8EAA8E;YAC9E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,6DAA6D,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;gBAC7I,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,EAAE;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AArDD,oCAqDC"}

package/dist/agents/replay.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The default replay store: passport ids remembered in memory until they
+ * expire, with a size cap. One per process; use a shared ReplayStore (Redis,
+ * a database) when a receiver runs on several instances.
+ */
+import { ReplayStore } from './types';
+export type MemoryReplayStoreOptions = {
+    maxEntries?: number;
+    clock?: () => number;
+};
+export declare class MemoryReplayStore implements ReplayStore {
+    private readonly entries;
+    private readonly maxEntries;
+    private readonly clock;
+    constructor(options?: MemoryReplayStoreOptions);
+    seen(jti: string, expiresAtMs: number): Promise<boolean>;
+    get size(): number;
+    /** Drops expired ids; if still full, the oldest-inserted ones. */
+    private evict;
+}

package/dist/agents/replay.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * The default replay store: passport ids remembered in memory until they
+ * expire, with a size cap. One per process; use a shared ReplayStore (Redis,
+ * a database) when a receiver runs on several instances.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryReplayStore = void 0;
+class MemoryReplayStore {
+    constructor(options = {}) {
+        this.entries = new Map();
+        this.maxEntries = Math.max(1, options.maxEntries ?? 100000);
+        this.clock = options.clock ?? Date.now;
+    }
+    async seen(jti, expiresAtMs) {
+        const now = this.clock();
+        const until = this.entries.get(jti);
+        if (until !== undefined && until > now)
+            return true;
+        if (until !== undefined)
+            this.entries.delete(jti);
+        if (this.entries.size >= this.maxEntries)
+            this.evict(now);
+        this.entries.set(jti, expiresAtMs);
+        return false;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /** Drops expired ids; if still full, the oldest-inserted ones. */
+    evict(now) {
+        for (const [k, until] of this.entries)
+            if (until <= now)
+                this.entries.delete(k);
+        const over = this.entries.size - this.maxEntries + 1;
+        if (over <= 0)
+            return;
+        let n = 0;
+        for (const k of this.entries.keys()) {
+            if (n++ >= over)
+                break;
+            this.entries.delete(k);
+        }
+    }
+}
+exports.MemoryReplayStore = MemoryReplayStore;
+//# sourceMappingURL=replay.js.map

package/dist/agents/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../src/agents/replay.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAMH,MAAa,iBAAiB;IAK5B,YAAY,UAAoC,EAAE;QAJjC,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAKnD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,MAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,WAAmB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACrD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QACtB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,EAAE,IAAI,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;CACF;AAnCD,8CAmCC"}