prokura 0.0.1__tar.gz

prokura-0.0.1/PKG-INFO

@@ -0,0 +1,56 @@
+Metadata-Version: 2.4
+Name: prokura
+Version: 0.0.1
+Summary: One authority for delegated access: identity cards for agents and automations, resolved on every call at the service boundary.
+Author: Elena Viter
+License: MIT
+Project-URL: Homepage, https://github.com/elenaviter/app-ecosystem
+Project-URL: Repository, https://github.com/elenaviter/app-ecosystem
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: aiohttp<4,>=3.9
+Requires-Dist: httpx<1,>=0.27
+Provides-Extra: test
+Requires-Dist: pytest<10,>=8; extra == "test"
+Requires-Dist: pytest-asyncio<2,>=0.23; extra == "test"
+
+# prokura
+
+One authority for delegated access.
+
+Prokura is an old commercial-law institution: delegated signing authority
+that lives in a register. Third parties verify against the register, not
+against any letter the holder carries, and revocation takes effect at the
+register. This package is that idea, built for agents and automations.
+
+The identity provider appeared because many applications needed one
+authority on who the user is. Delegated access needs its own authority the
+same way. Every caller, an agent, a sub-agent, an automation, has its own
+identity card. The authority attached to it lives in one central record:
+acting for which user, on which connected accounts, which operations,
+which claims, until when. A guarded boundary resolves the current
+authority on every call. Calls carry only plain facts, the actor identity
+and the wanted grant. Authorization evidence does not travel with calls,
+and an edit or revocation of the card applies on the very next call.
+
+**Version 0.0.1 is a development release.** The package contains the portable
+authority implementation: authority and authenticator contracts, durable
+identity-card and capability-catalog histories, delegated OAuth and connected-
+account lifecycle, identity-edge resolution, per-call named-service and
+managed-surface admission, structured denial contracts, and explicit ports for
+host storage, dispatch, identity, and live-delivery capabilities. KDCube
+consumes these modules through thin host adapters, and the Connection Hub app
+in this repository is the first frontend over the package.
+
+Home: https://github.com/elenaviter/app-ecosystem
+
+Architecture and contracts:
+
+- [Package boundary and extraction](../../docs/prokura/package/extraction-architecture.md)
+- [Delegated authority and admission](../../docs/prokura/package/delegated-authority-and-admission.md)
+- [Delegated access cards](../../docs/prokura/package/delegated-cards.md)
+- [OAuth delegated credential protocol](../../docs/prokura/package/oauth-delegated-credential-protocol.md)

prokura-0.0.1/README.md

@@ -0,0 +1,36 @@
+# prokura
+
+One authority for delegated access.
+
+Prokura is an old commercial-law institution: delegated signing authority
+that lives in a register. Third parties verify against the register, not
+against any letter the holder carries, and revocation takes effect at the
+register. This package is that idea, built for agents and automations.
+
+The identity provider appeared because many applications needed one
+authority on who the user is. Delegated access needs its own authority the
+same way. Every caller, an agent, a sub-agent, an automation, has its own
+identity card. The authority attached to it lives in one central record:
+acting for which user, on which connected accounts, which operations,
+which claims, until when. A guarded boundary resolves the current
+authority on every call. Calls carry only plain facts, the actor identity
+and the wanted grant. Authorization evidence does not travel with calls,
+and an edit or revocation of the card applies on the very next call.
+
+**Version 0.0.1 is a development release.** The package contains the portable
+authority implementation: authority and authenticator contracts, durable
+identity-card and capability-catalog histories, delegated OAuth and connected-
+account lifecycle, identity-edge resolution, per-call named-service and
+managed-surface admission, structured denial contracts, and explicit ports for
+host storage, dispatch, identity, and live-delivery capabilities. KDCube
+consumes these modules through thin host adapters, and the Connection Hub app
+in this repository is the first frontend over the package.
+
+Home: https://github.com/elenaviter/app-ecosystem
+
+Architecture and contracts:
+
+- [Package boundary and extraction](../../docs/prokura/package/extraction-architecture.md)
+- [Delegated authority and admission](../../docs/prokura/package/delegated-authority-and-admission.md)
+- [Delegated access cards](../../docs/prokura/package/delegated-cards.md)
+- [OAuth delegated credential protocol](../../docs/prokura/package/oauth-delegated-credential-protocol.md)

prokura-0.0.1/pyproject.toml

@@ -0,0 +1,41 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "prokura"
+version = "0.0.1"
+description = "One authority for delegated access: identity cards for agents and automations, resolved on every call at the service boundary."
+readme = "README.md"
+license = { text = "MIT" }
+authors = [{ name = "Elena Viter" }]
+requires-python = ">=3.10"
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+dependencies = [
+    "aiohttp>=3.9,<4",
+    "httpx>=0.27,<1",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest>=8,<10",
+    "pytest-asyncio>=0.23,<2",
+]
+
+[project.urls]
+Homepage = "https://github.com/elenaviter/app-ecosystem"
+Repository = "https://github.com/elenaviter/app-ecosystem"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+prokura = ["py.typed"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"

prokura-0.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

prokura-0.0.1/src/prokura/__init__.py

@@ -0,0 +1,61 @@
+"""Prokura: one authority for delegated access.
+
+Prokura is an old commercial-law institution: delegated signing authority
+that lives in a register, verified against the register rather than any
+carried letter, revocable at the register. This package is that idea,
+built for agents and automations: every caller has its own identity card,
+the authority lives in one central record, and a guarded boundary resolves
+the current authority on every call.
+
+Version 0.0.1 is a development release. The host-neutral authority core is
+present; runtime adapters, per-call admission orchestration, and the
+Connection Hub frontend are moving in subsequent extraction slices. See the
+repository for status: https://github.com/elenaviter/app-ecosystem
+"""
+
+from importlib import import_module
+from typing import Any
+
+__version__ = "0.0.1"
+
+_EXPORTS: dict[str, str] = {}
+for name in (
+    "NAMESPACE",
+    "CONNECTION_CATALOG",
+    "CONNECTION_STATUS",
+    "CONNECTION_GET_TOKEN",
+    "CONNECTION_DISCONNECT",
+    "OAUTH_START",
+    "AGENT_GRANT_GET_TOKEN",
+    "AGENT_GRANT_CHECK",
+    "CONNECTION_OPERATIONS",
+    "ConnectionOperationSpec",
+    "build_connection_operations",
+    "Connection",
+    "ConnectionToken",
+    "CatalogEntry",
+    "ClientApp",
+    "AmbiguousConnectionAccount",
+):
+    _EXPORTS[name] = "prokura.contract"
+for name in ("ConnectionsClient", "ConnectionsError", "ConnectionsTransport"):
+    _EXPORTS[name] = "prokura.client"
+for name in (
+    "AuthorityProviderSpec",
+    "AuthorityRegistry",
+    "AuthorityResolution",
+    "CredentialEnvelope",
+    "authority_provider_spec_from_declaration",
+):
+    _EXPORTS[name] = "prokura.authority_registry"
+
+__all__ = ["__version__", *_EXPORTS]
+
+
+def __getattr__(name: str) -> Any:
+    module_name = _EXPORTS.get(name)
+    if not module_name:
+        raise AttributeError(name)
+    value = getattr(import_module(module_name), name)
+    globals()[name] = value
+    return value

prokura-0.0.1/src/prokura/agent_account_scope.py

@@ -0,0 +1,155 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 Elena Viter
+
+"""Request-scoped per-agent account binding for connected-account resolution.
+
+The broker (`delegated_to_kdcube.broker.ensure_claim`) decides which connected
+account satisfies a provider claim. The calling AGENT may be bound, per
+provider, to specific account(s) AND — per account — to specific claims
+(`account_scope: {provider_id: {account_id: [claims]}}` on its grant card). That
+binding must reach the broker, but the shared resolver
+(`integrations.connected_accounts.resolve_connected_account_claim`) runs
+downstream of the door through a generic transport with no HTTP request.
+
+Whoever HAS the agent's credential sets the binding into this contextvar at the
+boundary — the door bridge from `request.state.delegated_credential`; a native
+agent gate from the same view — and the resolver reads back the per-account
+claim map for the provider it is resolving.
+
+Default-closed for delegated callers: when an agent identity is bound for the
+turn and the provider has NO binding entry, the resolver receives an EMPTY
+mapping — "agent turn, nothing granted on this provider" — and the broker
+denies with the agent-grant reason until the user binds an account. Only
+non-agent turns (no delegated identity — the user's own trusted tools) resolve
+to None, meaning no restriction. An agent never inherits the accounts the user
+connected; the binding is the grant.
+"""
+
+from __future__ import annotations
+
+import contextvars
+from contextlib import contextmanager
+from typing import Any, Mapping
+
+_ACCOUNT_SCOPE: contextvars.ContextVar[dict] = contextvars.ContextVar(
+    "kdcube_agent_account_scope", default={}
+)
+
+# The calling agent's delegated identity (client_id + delegated-resource id) for
+# the current turn. The connected-account resolver reads it to route a
+# per-account claim miss to THIS agent's grant card (Delegated by KDCube) instead
+# of a connect-a-provider banner. Set alongside the account scope by the gate
+# that holds the agent's credential; unset / non-agent turns leave it empty.
+_AGENT_IDENTITY: contextvars.ContextVar[dict] = contextvars.ContextVar(
+    "kdcube_agent_identity", default={}
+)
+
+
+def normalize_account_scope(
+    scope: Mapping[str, Any] | None,
+) -> dict[str, dict[str, tuple[str, ...]]]:
+    """Normalize exact per-provider, per-account claim authority."""
+    normalized: dict[str, dict[str, tuple[str, ...]]] = {}
+    for provider, entry in dict(scope or {}).items():
+        pkey = str(provider or "").strip()
+        if not pkey:
+            continue
+        accounts: dict[str, tuple[str, ...]] = {}
+        if isinstance(entry, Mapping):
+            for account_id, claims in entry.items():
+                akey = str(account_id or "").strip()
+                if not akey:
+                    continue
+                cl = tuple(str(c).strip() for c in (claims or ()) if str(c or "").strip())
+                accounts[akey] = cl or ("*",)
+        else:
+            for account_id in (entry or []):
+                akey = str(account_id or "").strip()
+                if akey:
+                    accounts[akey] = ("*",)
+        if accounts:
+            normalized[pkey] = accounts
+    return normalized
+
+
+def set_agent_account_scope(scope: Mapping[str, Any] | None) -> None:
+    """Bind the current agent's per-account claim scope
+    ({provider_id: {account_id: [claims]}}). Accepts the legacy list form
+    ({provider_id: [account_ids]}) and migrates it (account -> any claim)."""
+    _ACCOUNT_SCOPE.set(normalize_account_scope(scope))
+
+
+def clear_agent_account_scope() -> None:
+    _ACCOUNT_SCOPE.set({})
+    _AGENT_IDENTITY.set({})
+
+
+def set_agent_identity(*, client_id: str = "", resource: str = "") -> None:
+    """Bind the current agent's delegated identity (its
+    ``kdcube-agent:<app>:<agent>`` or ``dcr-…`` client id and the
+    delegated-resource id its grant is keyed under). The client id alone is
+    enough to mark the turn as a delegated (agent) turn — and with it the
+    default-closed account binding; the resource additionally lets a claim
+    miss deep-link the exact grant card. An empty client id clears the field."""
+    cid = str(client_id or "").strip()
+    res = str(resource or "").strip()
+    _AGENT_IDENTITY.set({"client_id": cid, "resource": res} if cid else {})
+
+
+@contextmanager
+def bind_agent_account_scope(
+    scope: Mapping[str, Any] | None,
+    *,
+    client_id: str,
+    resource: str = "",
+):
+    """Bind one delegated provider invocation and restore prior task state."""
+
+    cid = str(client_id or "").strip()
+    res = str(resource or "").strip()
+    scope_token = _ACCOUNT_SCOPE.set(normalize_account_scope(scope))
+    identity_token = _AGENT_IDENTITY.set(
+        {"client_id": cid, "resource": res} if cid else {}
+    )
+    try:
+        yield
+    finally:
+        _AGENT_IDENTITY.reset(identity_token)
+        _ACCOUNT_SCOPE.reset(scope_token)
+
+
+def agent_identity() -> dict:
+    """The current agent's delegated identity ``{client_id, resource}``, or an
+    empty dict on a non-agent turn / when it was not set."""
+    return dict(_AGENT_IDENTITY.get() or {})
+
+
+def account_claim_scope_for(provider_id: str) -> dict[str, tuple[str, ...]] | None:
+    """The current agent's per-account claim binding for ``provider_id`` —
+    ``{account_id: (claims...)}`` (account "*" = any account, claim "*" = any
+    claim).
+
+    Returns None ONLY on a non-agent turn (no delegated identity bound): the
+    user's own trusted tools are unrestricted. On an agent turn with no binding
+    entry for this provider it returns an EMPTY mapping — default-closed: the
+    agent is bound to no account there, and the broker denies with the
+    agent-grant reason until the user grants one."""
+    entry = _ACCOUNT_SCOPE.get().get(str(provider_id or "").strip())
+    if not entry:
+        return {} if _AGENT_IDENTITY.get() else None
+    return {
+        str(account_id).strip(): tuple(claims)
+        for account_id, claims in dict(entry).items()
+        if str(account_id or "").strip()
+    }
+
+
+__all__ = [
+    "set_agent_account_scope",
+    "clear_agent_account_scope",
+    "account_claim_scope_for",
+    "set_agent_identity",
+    "agent_identity",
+    "bind_agent_account_scope",
+    "normalize_account_scope",
+]

prokura-0.0.1/src/prokura/authenticators/__init__.py

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 Elena Viter
+
+"""Host-neutral request-authenticator contracts."""
+
+from prokura.authenticators.authority import (
+    AuthRequestHints,
+    AuthorityIdentity,
+    SurfaceGuardRequirement,
+    select_authenticator_candidates,
+)
+from prokura.authenticators.models import (
+    AuthenticatedRequest,
+    AuthenticatorRegistration,
+    RequestEnvelope,
+)
+from prokura.authenticators.client import (
+    DEFAULT_CONNECTION_HUB_BUNDLE_ID,
+    REQUEST_AUTHENTICATE_OPERATION,
+    ConnectionHubAuthenticatorsClient,
+)
+
+__all__ = [
+    "AuthRequestHints",
+    "AuthenticatedRequest",
+    "AuthenticatorRegistration",
+    "AuthorityIdentity",
+    "ConnectionHubAuthenticatorsClient",
+    "DEFAULT_CONNECTION_HUB_BUNDLE_ID",
+    "REQUEST_AUTHENTICATE_OPERATION",
+    "RequestEnvelope",
+    "SurfaceGuardRequirement",
+    "select_authenticator_candidates",
+]

prokura-0.0.1/src/prokura/authenticators/authority.py

@@ -0,0 +1,265 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 Elena Viter
+
+"""Authority-provider primitives for Connection Hub request auth.
+
+The selector chooses authenticators. Authenticators return identities under an
+authority. Surface guards then resolve grants under the required authority.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Iterable, Mapping, Sequence, TypeVar
+
+from prokura.authenticators.models import (
+    AuthenticatorRegistration,
+    RequestEnvelope,
+)
+
+
+HEADER_AUTHORITY_ID = "x-kdcube-auth-authority-id"
+HEADER_AUTHENTICATOR_ID = "x-kdcube-auth-authenticator-id"
+HEADER_PROVIDER = "x-kdcube-auth-provider"
+
+
+def _str(value: Any) -> str:
+    return str(value or "").strip()
+
+
+def _str_list(value: Any) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        return tuple(part.strip() for part in value.replace(",", " ").split() if part.strip())
+    if isinstance(value, (list, tuple, set)):
+        return tuple(str(part).strip() for part in value if str(part).strip())
+    return ()
+
+
+def _field(value: Any, name: str, default: Any = "") -> Any:
+    if isinstance(value, Mapping):
+        return value.get(name, default)
+    return getattr(value, name, default)
+
+
+@dataclass(frozen=True)
+class AuthRequestHints:
+    """Non-trusted selector hints extracted from a request envelope.
+
+    Hints narrow authenticator candidates. They do not prove authority or
+    identity; only the selected authenticator can do that.
+    """
+
+    authority_id: str = ""
+    authenticator_id: str = ""
+    provider: str = ""
+
+    @classmethod
+    def from_envelope(cls, envelope: RequestEnvelope | Mapping[str, Any]) -> "AuthRequestHints":
+        env = RequestEnvelope.coerce(envelope)
+        headers = env.headers
+        query = env.query
+        body = env.json_body()
+        return cls(
+            authority_id=_str(
+                headers.get(HEADER_AUTHORITY_ID)
+                or headers.get("x-kdcube-auth-authority")
+                or query.get("auth_authority_id")
+                or query.get("kdcube_auth_authority_id")
+                or query.get("authority_id")
+                or query.get("authority")
+                or (body.get("auth_authority_id") if isinstance(body, Mapping) else "")
+                or (body.get("authorityId") if isinstance(body, Mapping) else "")
+            ),
+            authenticator_id=_str(
+                headers.get(HEADER_AUTHENTICATOR_ID)
+                or query.get("auth_authenticator_id")
+                or query.get("kdcube_auth_authenticator_id")
+                or query.get("authenticator_id")
+                or query.get("authenticator")
+                or (body.get("auth_authenticator_id") if isinstance(body, Mapping) else "")
+                or (body.get("authenticatorId") if isinstance(body, Mapping) else "")
+            ),
+            provider=_str(
+                headers.get(HEADER_PROVIDER)
+                or headers.get("x-kdcube-auth-provider-id")
+                or query.get("auth_provider")
+                or query.get("kdcube_auth_provider")
+                or query.get("provider")
+                or (body.get("auth_provider") if isinstance(body, Mapping) else "")
+                or (body.get("authProvider") if isinstance(body, Mapping) else "")
+            ),
+        )
+
+    @classmethod
+    def coerce(cls, value: Any) -> "AuthRequestHints":
+        if isinstance(value, cls):
+            return value
+        if isinstance(value, RequestEnvelope):
+            return cls.from_envelope(value)
+        if isinstance(value, Mapping):
+            if "headers" in value or "query" in value:
+                return cls.from_envelope(value)
+            return cls(
+                authority_id=_str(value.get("authority_id") or value.get("authority")),
+                authenticator_id=_str(value.get("authenticator_id") or value.get("authenticator")),
+                provider=_str(value.get("provider")),
+            )
+        return cls()
+
+    def to_dict(self) -> dict[str, str]:
+        return {
+            "authority_id": self.authority_id,
+            "authenticator_id": self.authenticator_id,
+            "provider": self.provider,
+        }
+
+    @property
+    def has_explicit_selector(self) -> bool:
+        return bool(self.authenticator_id or self.authority_id)
+
+
+@dataclass(frozen=True)
+class AuthorityIdentity:
+    """Identity verified under one authority provider."""
+
+    authority_id: str
+    subject: str
+    ref: str = ""
+    label: str = ""
+    attrs: dict[str, Any] = field(default_factory=dict)
+
+    @property
+    def canonical_ref(self) -> str:
+        if self.ref:
+            return self.ref
+        authority = _str(self.authority_id)
+        subject = _str(self.subject)
+        return f"{authority}:{subject}" if authority and subject else subject
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "authority_id": self.authority_id,
+            "subject": self.subject,
+            "ref": self.canonical_ref,
+            "label": self.label,
+            "attrs": dict(self.attrs),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any] | None) -> "AuthorityIdentity":
+        data = dict(value or {})
+        return cls(
+            authority_id=_str(data.get("authority_id") or data.get("authority")),
+            subject=_str(data.get("subject") or data.get("provider_subject") or data.get("sub")),
+            ref=_str(data.get("ref") or data.get("identity_ref")),
+            label=_str(data.get("label") or data.get("name")),
+            attrs=dict(data.get("attrs") or {}) if isinstance(data.get("attrs"), Mapping) else {},
+        )
+
+    @classmethod
+    def coerce(cls, value: Any) -> "AuthorityIdentity":
+        if isinstance(value, cls):
+            return value
+        return cls.from_dict(value if isinstance(value, Mapping) else {})
+
+
+@dataclass(frozen=True)
+class SurfaceGuardRequirement:
+    """Authority/grant requirement declared by a protected surface."""
+
+    required_authority: str = "kdcube.platform"
+    required_grants: tuple[str, ...] = ()
+    accepted_authorities: tuple[str, ...] = ()
+    accepted_authenticators: tuple[str, ...] = ()
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "required_authority": self.required_authority,
+            "required_grants": list(self.required_grants),
+            "accepted_authorities": list(self.accepted_authorities),
+            "accepted_authenticators": list(self.accepted_authenticators),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any] | None) -> "SurfaceGuardRequirement":
+        data = dict(value or {})
+        return cls(
+            required_authority=_str(data.get("required_authority") or data.get("authority")) or "kdcube.platform",
+            required_grants=_str_list(data.get("required_grants") or data.get("grants")),
+            accepted_authorities=_str_list(data.get("accepted_authorities") or data.get("authority_ids")),
+            accepted_authenticators=_str_list(data.get("accepted_authenticators") or data.get("authenticator_ids")),
+        )
+
+    @classmethod
+    def coerce(cls, value: Any) -> "SurfaceGuardRequirement":
+        if isinstance(value, cls):
+            return value
+        return cls.from_dict(value if isinstance(value, Mapping) else {})
+
+
+T = TypeVar("T")
+
+
+def select_authenticator_candidates(
+    registrations: Iterable[T],
+    hints: AuthRequestHints | RequestEnvelope | Mapping[str, Any] | None = None,
+    *,
+    surface: SurfaceGuardRequirement | Mapping[str, Any] | None = None,
+) -> list[T]:
+    """Select enabled authenticator candidates.
+
+    Selection order is intentionally deterministic. Hints are narrowing inputs,
+    not trusted authorization facts.
+    """
+
+    request_hints = AuthRequestHints.coerce(hints or {})
+    requirement = SurfaceGuardRequirement.coerce(surface or {})
+    enabled: list[T] = [row for row in registrations if bool(_field(row, "enabled", True))]
+
+    if requirement.accepted_authenticators:
+        accepted = set(requirement.accepted_authenticators)
+        enabled = [row for row in enabled if _str(_field(row, "authenticator_id")) in accepted]
+
+    if requirement.accepted_authorities:
+        accepted_authorities = set(requirement.accepted_authorities)
+        enabled = [row for row in enabled if _str(_field(row, "authority_id")) in accepted_authorities]
+
+    if request_hints.authenticator_id:
+        return [
+            row
+            for row in enabled
+            if _str(_field(row, "authenticator_id")) == request_hints.authenticator_id
+        ]
+
+    narrowed = enabled
+    if request_hints.authority_id:
+        narrowed = [
+            row
+            for row in narrowed
+            if _str(_field(row, "authority_id")) == request_hints.authority_id
+        ]
+
+    if request_hints.authority_id:
+        return narrowed
+
+    if request_hints.provider:
+        return [
+            row
+            for row in narrowed
+            if _str(_field(row, "provider")) == request_hints.provider
+        ]
+
+    return narrowed
+
+
+__all__ = [
+    "AuthRequestHints",
+    "AuthorityIdentity",
+    "HEADER_AUTHENTICATOR_ID",
+    "HEADER_AUTHORITY_ID",
+    "HEADER_PROVIDER",
+    "SurfaceGuardRequirement",
+    "select_authenticator_candidates",
+]