shield360 1.1.0 → 1.2.1

package/dist/agents/report.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Sends check results to the receiver project's inbound decision log
+ * (POST /api/inbound-agents/decisions, at most 100 per call). Queued and sent
+ * off the request path; a batch that cannot be delivered is retried a few
+ * times and then dropped with a warning. Never the passport, headers or bodies.
+ */
+import { AgentCheck, Shield360Connection } from './types';
+export declare const REPORT_BATCH = 100;
+export type ReportedDecision = AgentCheck & {
+    at: string;
+    route?: string;
+    method?: string;
+    receiver?: string;
+};
+export declare class DecisionReporter {
+    private readonly conn;
+    private readonly fetchImpl;
+    private readonly retryDelayMs;
+    private readonly queue;
+    private readonly endpoint;
+    private timer;
+    private sending;
+    private warnedFull;
+    constructor(conn: Shield360Connection, fetchImpl: () => typeof fetch, retryDelayMs?: number);
+    add(decision: ReportedDecision): void;
+    /** Sends everything queued; resolves when it has been tried. Never rejects. */
+    flush(): Promise<void>;
+    close(): Promise<void>;
+    private post;
+}

package/dist/agents/report.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Sends check results to the receiver project's inbound decision log
+ * (POST /api/inbound-agents/decisions, at most 100 per call). Queued and sent
+ * off the request path; a batch that cannot be delivered is retried a few
+ * times and then dropped with a warning. Never the passport, headers or bodies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DecisionReporter = exports.REPORT_BATCH = void 0;
+const policy_1 = require("./policy");
+exports.REPORT_BATCH = 100;
+const FLUSH_MS = 3000;
+const MAX_QUEUED = 5000;
+const ATTEMPTS = 3;
+const TIMEOUT_MS = 10000;
+class DecisionReporter {
+    constructor(conn, fetchImpl, retryDelayMs = 500) {
+        this.conn = conn;
+        this.fetchImpl = fetchImpl;
+        this.retryDelayMs = retryDelayMs;
+        this.queue = [];
+        this.sending = Promise.resolve();
+        this.warnedFull = false;
+        this.endpoint = `${(0, policy_1.baseUrlOf)(conn)}/api/inbound-agents/decisions`;
+    }
+    add(decision) {
+        if (this.queue.length >= MAX_QUEUED) {
+            if (!this.warnedFull)
+                console.warn('Shield360 agents: the decision report queue is full; reports are being dropped');
+            this.warnedFull = true;
+            return;
+        }
+        this.warnedFull = false;
+        this.queue.push(decision);
+        if (!this.timer) {
+            this.timer = setInterval(() => void this.flush(), FLUSH_MS);
+            // Never keep a process alive just to report.
+            this.timer.unref?.();
+        }
+        if (this.queue.length >= exports.REPORT_BATCH)
+            void this.flush();
+    }
+    /** Sends everything queued; resolves when it has been tried. Never rejects. */
+    flush() {
+        this.sending = this.sending
+            .then(async () => {
+            while (this.queue.length)
+                await this.post(this.queue.splice(0, exports.REPORT_BATCH));
+        })
+            .catch(() => undefined);
+        return this.sending;
+    }
+    close() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+        return this.flush();
+    }
+    async post(batch) {
+        const body = JSON.stringify({ decisions: batch });
+        for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+            const controller = typeof AbortController === 'function' ? new AbortController() : undefined;
+            const t = controller ? setTimeout(() => controller.abort(), TIMEOUT_MS) : undefined;
+            t?.unref?.();
+            try {
+                const res = await this.fetchImpl()(this.endpoint, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${this.conn.apiKey}` },
+                    body,
+                    signal: controller?.signal,
+                });
+                if (res.ok)
+                    return;
+                if ([400, 401, 403, 404, 413].includes(res.status)) {
+                    console.warn(`Shield360 agents: the inbound decision log refused ${batch.length} report(s): HTTP ${res.status}`);
+                    return;
+                }
+            }
+            catch {
+                // retried below
+            }
+            finally {
+                if (t)
+                    clearTimeout(t);
+            }
+            if (attempt < ATTEMPTS - 1)
+                await new Promise((r) => setTimeout(r, this.retryDelayMs * (attempt + 1)));
+        }
+        console.warn(`Shield360 agents: could not deliver ${batch.length} decision report(s); dropped`);
+    }
+}
+exports.DecisionReporter = DecisionReporter;
+//# sourceMappingURL=report.js.map

package/dist/agents/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/agents/report.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,qCAAqC;AAGxB,QAAA,YAAY,GAAG,GAAG,CAAC;AAChC,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,UAAU,GAAG,KAAM,CAAC;AAI1B,MAAa,gBAAgB;IAO3B,YACmB,IAAyB,EACzB,SAA6B,EAC7B,eAAe,GAAG;QAFlB,SAAI,GAAJ,IAAI,CAAqB;QACzB,cAAS,GAAT,SAAS,CAAoB;QAC7B,iBAAY,GAAZ,YAAY,CAAM;QATpB,UAAK,GAAuB,EAAE,CAAC;QAGxC,YAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,eAAU,GAAG,KAAK,CAAC;QAOzB,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,+BAA+B,CAAC;IACpE,CAAC;IAED,GAAG,CAAC,QAA0B;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;YACrH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5D,6CAA6C;YAC5C,IAAI,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,oBAAY;YAAE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED,+EAA+E;IAC/E,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO;aACxB,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,oBAAY,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAyB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,CAAwC,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;oBAC5F,IAAI;oBACJ,MAAM,EAAE,UAAU,EAAE,MAAM;iBAC3B,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,EAAE;oBAAE,OAAO;gBACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnD,OAAO,CAAC,IAAI,CAAC,sDAAsD,KAAK,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjH,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAClG,CAAC;CACF;AA1ED,4CA0EC"}

package/dist/agents/types.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Agent passports: the types shared by the verifier, its policy and its reports.
+ *
+ * The wire formats (passport claims, receiver policy, check result) are a
+ * contract with the Shield360 app (issuer: /api/agent-passports/*, receiver:
+ * /api/inbound-agents/*) and with the Python verifier.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_types.py
+ */
+/** The HTTP header a calling agent sends its passport in. */
+export declare const AGENT_HEADER = "Shield360-Agent";
+/** The JWS `typ` every passport carries. */
+export declare const PASSPORT_TYP = "shield360-agent+jwt";
+/** Issuers trusted when none are configured. */
+export declare const DEFAULT_ISSUERS: string[];
+/** The Shield360 app the policy and reports go to when no base URL is given. */
+export declare const DEFAULT_BASE_URL = "https://app.shield360.ai";
+/** The longest lifetime (exp - iat) a passport may have, in seconds. */
+export declare const MAX_LIFETIME_SECONDS = 300;
+/** How strongly a passport shows the agent acts for a person, strongest first. */
+export type Assurance = 'delegated' | 'named' | 'unverified';
+export declare const ASSURANCE_LEVELS: readonly Assurance[];
+/** The weakest assurance a receiver accepts; "none" has no requirement. */
+export type MinAssurance = 'none' | Assurance;
+/** Rank of an assurance: higher is stronger; "none" (or no act) is 0. */
+export declare function assuranceRank(a: MinAssurance | undefined): number;
+/** The receiver's policy: what to do with the agents that call it. */
+export type AgentPolicy = {
+    /** observe: never block, report what enforce would do. */
+    mode: 'observe' | 'enforce';
+    /** A call without a passport is denied (reason "absent"). */
+    requireAgent: boolean;
+    /** Allowed operator ids or domains; empty means any verified operator. */
+    operators: string[];
+    /** The passport must say the agent acts for a person (the `act` claim). */
+    requireOnBehalfOf: boolean;
+    /** Always ask the issuer whether the passport is still good. */
+    online: boolean;
+    /**
+     * The weakest on-behalf-of assurance accepted. "none" (default): no
+     * requirement; otherwise a passport without act, or with weaker assurance,
+     * is denied with "assurance_too_low".
+     */
+    minAssurance: MinAssurance;
+};
+export declare const DEFAULT_POLICY: Readonly<AgentPolicy>;
+/** Why a check did not verify, or why the policy denied it. */
+export type AgentCheckReason = 'malformed' | 'unsupported_alg' | 'untrusted_issuer' | 'unknown_key' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'lifetime_too_long' | 'wrong_audience' | 'replayed' | 'replay_check_failed' | 'revoked' | 'unknown_passport' | 'issuer_unreachable' | 'absent' | 'operator_not_allowed' | 'on_behalf_of_required' | 'assurance_too_low';
+export type AgentIdentity = {
+    id: string;
+    name: string;
+    purpose?: string;
+    status?: 'enrolled' | 'not_enrolled';
+    environment?: string | null;
+    risk?: string | null;
+    owner?: {
+        domain: string | null;
+    };
+    /** ISO 8601. */
+    reviewedAt?: string | null;
+    /** ISO 8601. */
+    enrolledAt?: string | null;
+};
+export type AgentOperator = {
+    id: string;
+    name: string;
+    domain: string | null;
+};
+export type AgentMandate = {
+    id: string;
+    expiresAt: string;
+};
+export type AgentOnBehalfOf = {
+    id: string;
+    domain: string | null;
+    /** "named" when the passport's act carries none. Lowered when the issuer says so online. */
+    assurance: Assurance;
+    mandate?: AgentMandate;
+};
+/** The result of one check. Never contains the passport itself. */
+export type AgentCheck = {
+    status: 'verified' | 'absent' | 'invalid';
+    /** What the policy says. */
+    decision: 'allow' | 'deny';
+    /** decision === "deny" && mode === "enforce". */
+    blocked: boolean;
+    reason?: AgentCheckReason | string;
+    agent?: AgentIdentity;
+    operator?: AgentOperator;
+    /** id is the pairwise person id (act.sub): stable per receiver, never the person's id or email. */
+    onBehalfOf?: AgentOnBehalfOf;
+    scopes: string[];
+    issuer?: string;
+    /** The passport's jti. */
+    passportId?: string;
+    /** ISO 8601. */
+    expiresAt?: string;
+};
+/** Remembers passport ids so each is accepted once. */
+export interface ReplayStore {
+    /**
+     * Records `jti` until `expiresAtMs` (epoch milliseconds) and returns whether
+     * it had already been seen. Must be atomic for clustered receivers (e.g.
+     * Redis `SET key 1 NX PXAT expiresAtMs`, seen = the SET did not happen).
+     */
+    seen(jti: string, expiresAtMs: number): Promise<boolean>;
+}
+export type Shield360Connection = {
+    apiKey: string;
+    baseUrl?: string;
+};
+export type AgentVerifierOptions = {
+    /** The receiver: a host name (`api.servflo.ai`) or an https origin, or several. */
+    audience: string | string[];
+    /** Trusted issuers' base URLs. Default ["https://app.shield360.ai"]. */
+    issuers?: string[];
+    /** Local policy, merged over the defaults and over the console policy. */
+    policy?: Partial<AgentPolicy>;
+    /** Follow the console policy of the receiver's Shield360 project (cached 60 s). */
+    policyFrom?: Shield360Connection;
+    /** Send results to the project's inbound decision log (batched, never blocks). */
+    report?: Shield360Connection;
+    /** Where passport ids are remembered. Default: in memory, per process. */
+    replay?: ReplayStore;
+    /** Allowed clock difference with the issuer, seconds. Default 60. */
+    clockSkewSeconds?: number;
+    /**
+     * What a failed online check (issuer unreachable) means. Default "allow":
+     * the passport was already verified offline.
+     */
+    onlineFailure?: 'allow' | 'deny';
+    fetch?: typeof fetch;
+    /** Milliseconds since the epoch; for tests. */
+    clock?: () => number;
+};
+export type AgentCheckOptions = {
+    /** Ask the issuer too (also on when the policy says online). */
+    online?: boolean;
+    /** Recorded with the report; never sent anywhere else. */
+    route?: string;
+    method?: string;
+};
+/** Anything a passport can be read from. */
+export type AgentCheckInput = string | Request | Headers | {
+    headers: unknown;
+} | {
+    get(name: string): unknown;
+} | Record<string, string | string[] | undefined> | null | undefined;

package/dist/agents/types.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Agent passports: the types shared by the verifier, its policy and its reports.
+ *
+ * The wire formats (passport claims, receiver policy, check result) are a
+ * contract with the Shield360 app (issuer: /api/agent-passports/*, receiver:
+ * /api/inbound-agents/*) and with the Python verifier.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_types.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLICY = exports.ASSURANCE_LEVELS = exports.MAX_LIFETIME_SECONDS = exports.DEFAULT_BASE_URL = exports.DEFAULT_ISSUERS = exports.PASSPORT_TYP = exports.AGENT_HEADER = void 0;
+exports.assuranceRank = assuranceRank;
+/** The HTTP header a calling agent sends its passport in. */
+exports.AGENT_HEADER = 'Shield360-Agent';
+/** The JWS `typ` every passport carries. */
+exports.PASSPORT_TYP = 'shield360-agent+jwt';
+/** Issuers trusted when none are configured. */
+exports.DEFAULT_ISSUERS = ['https://app.shield360.ai'];
+/** The Shield360 app the policy and reports go to when no base URL is given. */
+exports.DEFAULT_BASE_URL = 'https://app.shield360.ai';
+/** The longest lifetime (exp - iat) a passport may have, in seconds. */
+exports.MAX_LIFETIME_SECONDS = 300;
+exports.ASSURANCE_LEVELS = ['delegated', 'named', 'unverified'];
+/** Rank of an assurance: higher is stronger; "none" (or no act) is 0. */
+function assuranceRank(a) {
+    return a === 'delegated' ? 3 : a === 'named' ? 2 : a === 'unverified' ? 1 : 0;
+}
+exports.DEFAULT_POLICY = Object.freeze({
+    mode: 'observe',
+    requireAgent: false,
+    operators: [],
+    requireOnBehalfOf: false,
+    online: false,
+    minAssurance: 'none',
+});
+//# sourceMappingURL=types.js.map

package/dist/agents/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAwBH,sCAEC;AAxBD,6DAA6D;AAChD,QAAA,YAAY,GAAG,iBAAiB,CAAC;AAE9C,4CAA4C;AAC/B,QAAA,YAAY,GAAG,qBAAqB,CAAC;AAElD,gDAAgD;AACnC,QAAA,eAAe,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAE5D,gFAAgF;AACnE,QAAA,gBAAgB,GAAG,0BAA0B,CAAC;AAE3D,wEAAwE;AAC3D,QAAA,oBAAoB,GAAG,GAAG,CAAC;AAI3B,QAAA,gBAAgB,GAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAI3F,yEAAyE;AACzE,SAAgB,aAAa,CAAC,CAA2B;IACvD,OAAO,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAsBY,QAAA,cAAc,GAA0B,MAAM,CAAC,MAAM,CAAC;IACjE,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,KAAK;IACxB,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC"}

package/dist/agents/verifier.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The agent passport verifier: reads the Shield360-Agent header, verifies the
+ * passport offline (optionally online too), applies the receiver's policy and
+ * reports the result. A passport proves who the agent is, who runs it and for
+ * whom it acts; it never grants access by itself.
+ *
+ * Verification order and reason codes are the contract in the agent passports
+ * spec; every verifier (this one, the Python one, the issuer's verify route)
+ * follows the same order.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_verifier.py
+ */
+import { AgentCheck, AgentCheckInput, AgentCheckOptions, AgentPolicy, AgentVerifierOptions } from './types';
+type Lookup = {
+    token?: string;
+    multiple?: boolean;
+};
+/** Finds the passport in a Request, IncomingMessage, Headers, header record or string. */
+export declare function readPassport(input: AgentCheckInput): Lookup;
+export type AgentVerifier = {
+    /** Checks the passport an input carries. Never throws. */
+    check(input: AgentCheckInput, opts?: AgentCheckOptions): Promise<AgentCheck>;
+    /** Express/Connect middleware: sets req.shield360Agent, answers 403 when blocked. */
+    middleware(): (req: any, res: any, next: (err?: unknown) => void) => void;
+    /** The policy in force now (defaults, console, local). */
+    policy(): Promise<AgentPolicy>;
+    /** Sends queued reports now. */
+    flush(): Promise<void>;
+    /** Stops the report timer and sends what is queued. */
+    close(): Promise<void>;
+};
+export declare function agentVerifier(options: AgentVerifierOptions): AgentVerifier;
+export {};

package/dist/agents/verifier.js

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * The agent passport verifier: reads the Shield360-Agent header, verifies the
+ * passport offline (optionally online too), applies the receiver's policy and
+ * reports the result. A passport proves who the agent is, who runs it and for
+ * whom it acts; it never grants access by itself.
+ *
+ * Verification order and reason codes are the contract in the agent passports
+ * spec; every verifier (this one, the Python one, the issuer's verify route)
+ * follows the same order.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/agents/_verifier.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPassport = readPassport;
+exports.agentVerifier = agentVerifier;
+const passport_1 = require("./passport");
+const policy_1 = require("./policy");
+const replay_1 = require("./replay");
+const report_1 = require("./report");
+const types_1 = require("./types");
+const HEADER_LC = types_1.AGENT_HEADER.toLowerCase();
+const REASON = /^[a-z][a-z0-9_]{0,63}$/;
+function fromValue(v) {
+    if (Array.isArray(v)) {
+        const values = v.filter((x) => typeof x === 'string' && x.trim());
+        if (values.length > 1)
+            return { multiple: true };
+        return { token: values[0]?.trim() };
+    }
+    return typeof v === 'string' && v.trim() ? { token: v.trim() } : {};
+}
+function fromRecord(rec) {
+    for (const k of Object.keys(rec))
+        if (k.toLowerCase() === HEADER_LC)
+            return fromValue(rec[k]);
+    return {};
+}
+/** Finds the passport in a Request, IncomingMessage, Headers, header record or string. */
+function readPassport(input) {
+    try {
+        if (input === null || input === undefined)
+            return {};
+        if (typeof input === 'string')
+            return fromValue(input);
+        if (typeof input !== 'object')
+            return {};
+        const anyInput = input;
+        if (typeof anyInput.get === 'function')
+            return fromValue(anyInput.get.call(input, types_1.AGENT_HEADER));
+        if ('headers' in anyInput && typeof anyInput.headers === 'object' && anyInput.headers !== null) {
+            const h = anyInput.headers;
+            if (typeof h.get === 'function')
+                return fromValue(h.get.call(h, types_1.AGENT_HEADER));
+            return fromRecord(h);
+        }
+        return fromRecord(input);
+    }
+    catch {
+        return {};
+    }
+}
+/** The path of a request URL, without its query (which may carry secrets). */
+function pathOf(url) {
+    if (typeof url !== 'string' || !url)
+        return undefined;
+    const q = url.search(/[?#]/);
+    const path = q === -1 ? url : url.slice(0, q);
+    try {
+        return path.includes('://') ? new URL(path).pathname : path.slice(0, 512);
+    }
+    catch {
+        return undefined;
+    }
+}
+function agentVerifier(options) {
+    const audiences = (Array.isArray(options.audience) ? options.audience : [options.audience]).filter((a) => typeof a === 'string' && a.trim());
+    if (!audiences.length)
+        throw new TypeError('agentVerifier: an audience (the receiver host or origin) is required');
+    const issuers = new Set((options.issuers?.length ? options.issuers : types_1.DEFAULT_ISSUERS).map(passport_1.normaliseIssuer));
+    const skew = Math.max(0, options.clockSkewSeconds ?? 60);
+    const now = options.clock ?? Date.now;
+    const getFetch = () => options.fetch ?? globalThis.fetch;
+    const keys = new passport_1.KeyCache(getFetch, now);
+    const replay = options.replay ?? new replay_1.MemoryReplayStore({ clock: now });
+    const policies = new policy_1.PolicySource(options.policy, options.policyFrom, getFetch, now);
+    const reporter = options.report?.apiKey ? new report_1.DecisionReporter(options.report, getFetch) : undefined;
+    const onlineFailure = options.onlineFailure ?? 'allow';
+    async function online(p, token) {
+        const got = await (0, passport_1.fetchJson)(getFetch(), `${(0, passport_1.normaliseIssuer)(p.claims.iss)}/api/agent-passports/verify`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({ passport: token, audience: p.claims.aud }),
+        });
+        const body = got?.body;
+        if (!got || got.status !== 200 || typeof body !== 'object' || body === null || typeof body.valid !== 'boolean')
+            return { unreachable: true };
+        const reason = typeof body.reason === 'string' && REASON.test(body.reason) ? body.reason : undefined;
+        if (!body.valid)
+            return { invalid: reason ?? 'revoked' };
+        // Still valid, but the issuer may lower the on-behalf-of assurance (e.g. reason "mandate_revoked").
+        return {
+            valid: true,
+            ...(body.assurance !== undefined && body.assurance !== null ? { assurance: (0, passport_1.assuranceOf)(body.assurance) } : {}),
+            ...(reason ? { note: reason } : {}),
+        };
+    }
+    /** Steps 1-7 of the contract. Returns the failure, or the passport and any non-denying note. */
+    async function verify(token, wantOnline) {
+        const parsed = (0, passport_1.parsePassport)(token);
+        if (!parsed.ok)
+            return { reason: parsed.reason };
+        const p = parsed.passport;
+        const c = p.claims;
+        const iss = (0, passport_1.normaliseIssuer)(c.iss);
+        if (!issuers.has(iss))
+            return { reason: 'untrusted_issuer' };
+        const key = await keys.get(iss, p.kid);
+        if (!key)
+            return { reason: 'unknown_key' };
+        if (!(0, passport_1.verifySignature)(p, key))
+            return { reason: 'bad_signature' };
+        const t = now() / 1000;
+        if (!(c.exp > t - skew))
+            return { reason: 'expired', passport: p };
+        if (!(c.iat <= t + skew))
+            return { reason: 'not_yet_valid', passport: p };
+        if (c.exp - c.iat > types_1.MAX_LIFETIME_SECONDS)
+            return { reason: 'lifetime_too_long', passport: p };
+        if (!(0, passport_1.audienceMatches)(c.aud, audiences))
+            return { reason: 'wrong_audience', passport: p };
+        try {
+            if (await replay.seen(c.jti, (c.exp + skew) * 1000))
+                return { reason: 'replayed', passport: p };
+        }
+        catch {
+            return { reason: 'replay_check_failed', passport: p };
+        }
+        if (wantOnline) {
+            const answer = await online(p, token);
+            if ('unreachable' in answer) {
+                if (onlineFailure === 'deny')
+                    return { reason: 'issuer_unreachable', passport: p };
+                return { ok: p, note: 'issuer_unreachable' };
+            }
+            if ('invalid' in answer)
+                return { reason: answer.invalid, passport: p };
+            return { ok: p, note: answer.note, assurance: answer.assurance };
+        }
+        return { ok: p };
+    }
+    function identity(p, lowered) {
+        if (!p)
+            return {};
+        const c = p.claims;
+        let onBehalfOf;
+        if (c.act) {
+            // The issuer can only lower the assurance online, never raise it.
+            const downgraded = lowered && (0, types_1.assuranceRank)(lowered) < (0, types_1.assuranceRank)(c.act.assurance);
+            const assurance = downgraded ? lowered : c.act.assurance;
+            onBehalfOf = {
+                id: c.act.sub,
+                domain: c.act.domain,
+                assurance,
+                ...(c.act.mandate && !downgraded ? { mandate: { ...c.act.mandate } } : {}),
+            };
+        }
+        let expiresAt;
+        try {
+            expiresAt = new Date(c.exp * 1000).toISOString();
+        }
+        catch {
+            expiresAt = undefined;
+        }
+        return {
+            agent: { ...c.agent, ...(c.agent.owner ? { owner: { ...c.agent.owner } } : {}) },
+            operator: { ...c.operator },
+            ...(onBehalfOf ? { onBehalfOf } : {}),
+            scopes: (0, passport_1.scopesOf)(c.scope),
+            issuer: (0, passport_1.normaliseIssuer)(c.iss),
+            passportId: c.jti,
+            ...(expiresAt ? { expiresAt } : {}),
+        };
+    }
+    function operatorAllowed(policy, op) {
+        if (!policy.operators.length)
+            return true;
+        const id = op.id.toLowerCase();
+        const domain = op.domain?.toLowerCase();
+        return policy.operators.some((o) => {
+            const v = o.toLowerCase();
+            return v === id || (!!domain && v === domain);
+        });
+    }
+    async function evaluate(input, opts) {
+        const policy = await policies.current();
+        const finish = (r) => ({ ...r, blocked: r.decision === 'deny' && policy.mode === 'enforce' });
+        const found = readPassport(input);
+        if (found.multiple)
+            return finish({ status: 'invalid', decision: 'deny', reason: 'malformed', scopes: [] });
+        if (!found.token)
+            return finish({ status: 'absent', decision: policy.requireAgent ? 'deny' : 'allow', reason: 'absent', scopes: [] });
+        const v = await verify(found.token, Boolean(opts.online || policy.online));
+        if (!('ok' in v))
+            return finish({ status: 'invalid', decision: 'deny', reason: v.reason, scopes: [], ...identity(v.passport) });
+        const base = { status: 'verified', scopes: [], ...identity(v.ok, v.assurance) };
+        if (!operatorAllowed(policy, v.ok.claims.operator))
+            return finish({ ...base, decision: 'deny', reason: 'operator_not_allowed' });
+        if (policy.requireOnBehalfOf && !v.ok.claims.act)
+            return finish({ ...base, decision: 'deny', reason: 'on_behalf_of_required' });
+        const need = (0, types_1.assuranceRank)(policy.minAssurance);
+        if (need > 0 && (0, types_1.assuranceRank)(base.onBehalfOf?.assurance) < need)
+            return finish({ ...base, decision: 'deny', reason: 'assurance_too_low' });
+        return finish({ ...base, decision: 'allow', ...(v.note ? { reason: v.note } : {}) });
+    }
+    function report(result, opts) {
+        if (!reporter)
+            return;
+        // Calls without a passport are only worth a log line when the policy denied them.
+        if (result.status === 'absent' && result.decision === 'allow')
+            return;
+        try {
+            reporter.add({
+                ...result,
+                at: new Date(now()).toISOString(),
+                ...(opts.route ? { route: String(opts.route).slice(0, 512) } : {}),
+                ...(opts.method ? { method: String(opts.method).slice(0, 16).toUpperCase() } : {}),
+                receiver: audiences[0],
+            });
+        }
+        catch {
+            // reporting never affects the call
+        }
+    }
+    async function check(input, opts = {}) {
+        let result;
+        try {
+            result = await evaluate(input, opts ?? {});
+        }
+        catch {
+            // Unreachable by design; a verifier bug must still deny, never throw.
+            result = { status: 'invalid', decision: 'deny', blocked: false, reason: 'malformed', scopes: [] };
+            try {
+                result.blocked = (await policies.current()).mode === 'enforce';
+            }
+            catch {
+                result.blocked = false;
+            }
+        }
+        report(result, opts ?? {});
+        return result;
+    }
+    function middleware() {
+        return (req, res, next) => {
+            const route = pathOf(req?.originalUrl ?? req?.url);
+            check(req, { route, method: typeof req?.method === 'string' ? req.method : undefined }).then((result) => {
+                if (req && typeof req === 'object')
+                    req.shield360Agent = result;
+                if (!result.blocked)
+                    return next();
+                const body = JSON.stringify({ error: 'agent_not_allowed', reason: result.reason });
+                res.statusCode = 403;
+                res.setHeader?.('Content-Type', 'application/json; charset=utf-8');
+                res.end(body);
+            }, (err) => next(err));
+        };
+    }
+    return {
+        check,
+        middleware,
+        policy: () => policies.current(),
+        flush: () => reporter?.flush() ?? Promise.resolve(),
+        close: () => reporter?.close() ?? Promise.resolve(),
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/agents/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/agents/verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAyCH,oCAgBC;AA6BD,sCA+LC;AAnRD,yCAA0J;AAC1J,qCAAwC;AACxC,qCAA6C;AAC7C,qCAA4C;AAC5C,mCAaiB;AAEjB,MAAM,SAAS,GAAG,oBAAY,CAAC,WAAW,EAAE,CAAC;AAC7C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAIxC,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAgB,YAAY,CAAC,KAAsB;IACjD,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,KAA6C,CAAC;QAC/D,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAE,QAAQ,CAAC,GAA8B,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAY,CAAC,CAAC,CAAC;QAC7H,IAAI,SAAS,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/F,MAAM,CAAC,GAAG,QAAQ,CAAC,OAA4B,CAAC;YAChD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAE,CAAC,CAAC,GAA8B,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAY,CAAC,CAAC,CAAC;YAC3G,OAAO,UAAU,CAAC,CAA4B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,UAAU,CAAC,KAAgC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAiBD,SAAgB,aAAa,CAAC,OAA6B;IACzD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7I,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAe,CAAC,CAAC,GAAG,CAAC,0BAAe,CAAC,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAiB,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,mBAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,IAAI,IAAI,0BAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,qBAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,yBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC;IAIvD,KAAK,UAAU,MAAM,CAAC,CAAiB,EAAE,KAAa;QACpD,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,EAAE,GAAG,IAAA,0BAAe,EAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE;YACrG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,IAA8E,CAAC;QACjG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC7I,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QACzD,oGAAoG;QACpG,OAAO;YACL,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,sBAAW,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,UAAmB;QACtD,MAAM,MAAM,GAAG,IAAA,wBAAa,EAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAEnB,MAAM,GAAG,GAAG,IAAA,0BAAe,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAE7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAA,0BAAe,EAAC,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAEjE,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,4BAAoB;YAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAE9F,IAAI,CAAC,IAAA,0BAAe,EAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAEzF,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;gBAC5B,IAAI,aAAa,KAAK,MAAM;oBAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACnF,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,SAAS,IAAI,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,SAAS,QAAQ,CAAC,CAA6B,EAAE,OAAmB;QAClE,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,UAAoC,CAAC;QACzC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,kEAAkE;YAClE,MAAM,UAAU,GAAG,OAAO,IAAI,IAAA,qBAAa,EAAC,OAAO,CAAC,GAAG,IAAA,qBAAa,EAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxE,UAAU,GAAG;gBACX,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBACb,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,SAAS;gBACT,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAChF,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,IAAA,mBAAQ,EAAC,CAAC,CAAC,KAAK,CAAC;YACzB,MAAM,EAAE,IAAA,0BAAe,EAAC,CAAC,CAAC,GAAG,CAAC;YAC9B,UAAU,EAAE,CAAC,CAAC,GAAG;YACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC;IAED,SAAS,eAAe,CAAC,MAAmB,EAAE,EAAyC;QACrF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAsB,EAAE,IAAuB;QACrE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAA8B,EAAc,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;QACvI,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtI,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEhI,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,UAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjI,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAChI,MAAM,IAAI,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAA,qBAAa,EAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,IAAI;YAAE,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5I,OAAO,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,SAAS,MAAM,CAAC,MAAkB,EAAE,IAAuB;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,kFAAkF;QAClF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC;gBACX,GAAG,MAAM;gBACT,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,KAAsB,EAAE,OAA0B,EAAE;QACvE,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,MAAM,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAClG,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACzB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,UAAU;QACjB,OAAO,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAA6B,EAAQ,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAC1F,CAAC,MAAM,EAAE,EAAE;gBACT,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAAE,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACnB,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,UAAU;QACV,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE;QACnD,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/ai-security/__tests__/bench.test.d.ts

@@ -0,0 +1 @@
+export {};