@abloatai/transaction 0.59.2 → 0.61.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/apiKey.d.ts +10 -11
- package/dist/auth/apiKey.d.ts.map +1 -1
- package/dist/auth/apiKey.js +15 -29
- package/dist/auth/apiKey.js.map +1 -1
- package/dist/auth/browserCredentialSafety.js +1 -1
- package/dist/auth/browserCredentialSafety.js.map +1 -1
- package/dist/auth/capability.d.ts +15 -15
- package/dist/auth/capabilityLifecycle.d.ts +3 -3
- package/dist/auth/capabilityLifecycle.d.ts.map +1 -1
- package/dist/auth/capabilityLifecycle.js +2 -1
- package/dist/auth/capabilityLifecycle.js.map +1 -1
- package/dist/auth/credentialEndpoint.js +1 -1
- package/dist/auth/credentialEndpoint.js.map +1 -1
- package/dist/auth/credentialResult.d.ts +2 -1
- package/dist/auth/credentialResult.d.ts.map +1 -1
- package/dist/auth/credentialResult.js.map +1 -1
- package/dist/auth/credentialSource.js.map +1 -1
- package/dist/auth/identity.js.map +1 -1
- package/dist/auth/schemas.d.ts +5 -5
- package/dist/auth/sessionIssuanceProtocol.d.ts +8 -8
- package/dist/auth/sessionIssuanceProtocol.d.ts.map +1 -1
- package/dist/branches.d.ts +38 -38
- package/dist/claims/admission.d.ts +4 -0
- package/dist/claims/admission.d.ts.map +1 -0
- package/dist/claims/admission.js +32 -0
- package/dist/claims/admission.js.map +1 -0
- package/dist/claims/awaitGrant.d.ts.map +1 -1
- package/dist/claims/awaitGrant.js +4 -38
- package/dist/claims/awaitGrant.js.map +1 -1
- package/dist/claims/conflict.d.ts +55 -0
- package/dist/claims/conflict.d.ts.map +1 -0
- package/dist/claims/conflict.js +71 -0
- package/dist/claims/conflict.js.map +1 -0
- package/dist/claims/contract.d.ts +39 -27
- package/dist/claims/contract.d.ts.map +1 -1
- package/dist/claims/contract.js +2 -0
- package/dist/claims/contract.js.map +1 -1
- package/dist/claims/eventContract.d.ts +18 -18
- package/dist/claims/events.d.ts +1 -1
- package/dist/claims/events.d.ts.map +1 -1
- package/dist/claims/index.d.ts +2 -0
- package/dist/claims/index.d.ts.map +1 -1
- package/dist/claims/index.js +1 -0
- package/dist/claims/index.js.map +1 -1
- package/dist/claims/routes.d.ts +9 -9
- package/dist/claims/routes.d.ts.map +1 -1
- package/dist/claims/trace.d.ts.map +1 -1
- package/dist/claims/trace.js.map +1 -1
- package/dist/client/ablo.d.ts +11 -8
- package/dist/client/ablo.d.ts.map +1 -1
- package/dist/client/ablo.js +5 -6
- package/dist/client/ablo.js.map +1 -1
- package/dist/client/resources/httpResources.d.ts +1 -169
- package/dist/client/resources/httpResources.d.ts.map +1 -1
- package/dist/client/resources/httpResources.js +1 -1
- package/dist/client/resources/httpResources.js.map +1 -1
- package/dist/client/resources/modelOperations.d.ts +6 -15
- package/dist/client/resources/modelOperations.d.ts.map +1 -1
- package/dist/client/resources/where.d.ts +12 -12
- package/dist/client/surface.d.ts +1 -1
- package/dist/client/surface.d.ts.map +1 -1
- package/dist/client/surface.js +2 -4
- package/dist/client/surface.js.map +1 -1
- package/dist/commit/confirmation/commitEnvelope.d.ts +7 -7
- package/dist/commit/confirmation/httpCommitEnvelope.d.ts +1 -1
- package/dist/commit/confirmation/pendingWrite.d.ts +5 -5
- package/dist/commit/contract.d.ts +249 -249
- package/dist/commit/contract.d.ts.map +1 -1
- package/dist/coordination/index.d.ts +2 -2
- package/dist/coordination/index.d.ts.map +1 -1
- package/dist/coordination/index.js +4 -5
- package/dist/coordination/index.js.map +1 -1
- package/dist/coordination/schema.d.ts +64 -101
- package/dist/coordination/schema.d.ts.map +1 -1
- package/dist/coordination/schema.js +14 -69
- package/dist/coordination/schema.js.map +1 -1
- package/dist/environment.d.ts +3 -3
- package/dist/environment.d.ts.map +1 -1
- package/dist/environment.js.map +1 -1
- package/dist/errorCodes.d.ts +4 -5
- package/dist/errorCodes.d.ts.map +1 -1
- package/dist/errorCodes.js +15 -9
- package/dist/errorCodes.js.map +1 -1
- package/dist/errorObservation.d.ts +14 -14
- package/dist/errors.d.ts +17 -11
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +101 -5
- package/dist/errors.js.map +1 -1
- package/dist/keys/index.d.ts +1 -1
- package/dist/keys/index.d.ts.map +1 -1
- package/dist/keys/index.js.map +1 -1
- package/dist/observation/contract.d.ts +34 -34
- package/dist/observation/feedContract.d.ts +86 -86
- package/dist/observation/persistence/syncDeltaRow.d.ts +23 -23
- package/dist/observation/persistence/syncDeltaRow.d.ts.map +1 -1
- package/dist/pricing.d.ts +12 -12
- package/dist/schema/audit.js.map +1 -1
- package/dist/schema/ddl.js.map +1 -1
- package/dist/schema/ddlLock.js.map +1 -1
- package/dist/schema/deployment/contracts.d.ts +64 -64
- package/dist/schema/deployment/index.js.map +1 -1
- package/dist/schema/deployment/reconcile.js.map +1 -1
- package/dist/schema/diff.js.map +1 -1
- package/dist/schema/field.d.ts +1 -1
- package/dist/schema/field.d.ts.map +1 -1
- package/dist/schema/loadStrategy.d.ts +2 -2
- package/dist/schema/loadStrategy.d.ts.map +1 -1
- package/dist/schema/openapi.js.map +1 -1
- package/dist/schema/relation.d.ts +3 -3
- package/dist/schema/relation.d.ts.map +1 -1
- package/dist/schema/residency.d.ts +1 -1
- package/dist/schema/roles.d.ts +1 -1
- package/dist/schema/roles.d.ts.map +1 -1
- package/dist/schema/roles.js.map +1 -1
- package/dist/schema/schema.d.ts +1 -1
- package/dist/schema/schema.d.ts.map +1 -1
- package/dist/schema/serialize.js.map +1 -1
- package/dist/schema/sugar.d.ts.map +1 -1
- package/dist/schema/tenancy.d.ts +2 -2
- package/dist/server/storageMode.d.ts +1 -1
- package/dist/sessions/client.d.ts +29 -0
- package/dist/sessions/client.d.ts.map +1 -0
- package/dist/sessions/client.js +69 -0
- package/dist/sessions/client.js.map +1 -0
- package/dist/sessions/contract.d.ts +97 -0
- package/dist/sessions/contract.d.ts.map +1 -0
- package/dist/sessions/contract.js +5 -0
- package/dist/sessions/contract.js.map +1 -0
- package/dist/{auth/sessionMint.d.ts → sessions/create.d.ts} +4 -4
- package/dist/sessions/create.d.ts.map +1 -0
- package/dist/{auth/sessionMint.js → sessions/create.js} +11 -10
- package/dist/sessions/create.js.map +1 -0
- package/dist/sessions/handler.d.ts +23 -0
- package/dist/sessions/handler.d.ts.map +1 -0
- package/dist/sessions/handler.js +55 -0
- package/dist/sessions/handler.js.map +1 -0
- package/dist/sessions/index.d.ts +14 -0
- package/dist/sessions/index.d.ts.map +1 -0
- package/dist/sessions/index.js +14 -0
- package/dist/sessions/index.js.map +1 -0
- package/dist/{transport/connection/credentialLifecycle.d.ts → sessions/lifecycle.d.ts} +6 -6
- package/dist/sessions/lifecycle.d.ts.map +1 -0
- package/dist/{transport/connection/credentialLifecycle.js → sessions/lifecycle.js} +5 -5
- package/dist/sessions/lifecycle.js.map +1 -0
- package/dist/sessions/source.d.ts +24 -0
- package/dist/sessions/source.d.ts.map +1 -0
- package/dist/sessions/source.js +56 -0
- package/dist/sessions/source.js.map +1 -0
- package/dist/source/adapters/adapterProfile.d.ts +6 -6
- package/dist/source/adapters/conformance.js.map +1 -1
- package/dist/source/adapters/contract.d.ts +14 -14
- package/dist/source/adapters/kysely.js.map +1 -1
- package/dist/source/adapters/memory.js.map +1 -1
- package/dist/source/adapters/prisma.js.map +1 -1
- package/dist/source/connector/client.d.ts.map +1 -1
- package/dist/source/connector/client.js.map +1 -1
- package/dist/source/connector/protocol.d.ts.map +1 -1
- package/dist/source/delivery/pushQueue.d.ts.map +1 -1
- package/dist/source/delivery/pushQueue.js.map +1 -1
- package/dist/source/endpoint/signing.d.ts +4 -4
- package/dist/source/endpoint/signing.d.ts.map +1 -1
- package/dist/source/outbox/contract.d.ts +4 -4
- package/dist/testing/fixtures/httpResponses.d.ts +2 -2
- package/dist/testing/fixtures/httpResponses.d.ts.map +1 -1
- package/dist/testing/fixtures/httpResponses.js.map +1 -1
- package/dist/transport/connection/index.d.ts +0 -1
- package/dist/transport/connection/index.d.ts.map +1 -1
- package/dist/transport/connection/index.js +0 -1
- package/dist/transport/connection/index.js.map +1 -1
- package/dist/transport/connection/manager.d.ts +1 -1
- package/dist/transport/connection/manager.d.ts.map +1 -1
- package/dist/transport/connection/manager.js.map +1 -1
- package/dist/transport/connection/networkProbe.d.ts +5 -18
- package/dist/transport/connection/networkProbe.d.ts.map +1 -1
- package/dist/transport/connection/networkProbe.js.map +1 -1
- package/dist/transport/http/claimWait.d.ts +9 -0
- package/dist/transport/http/claimWait.d.ts.map +1 -0
- package/dist/transport/http/claimWait.js +74 -0
- package/dist/transport/http/claimWait.js.map +1 -0
- package/dist/transport/http/client.d.ts +11 -19
- package/dist/transport/http/client.d.ts.map +1 -1
- package/dist/transport/http/client.js +15 -18
- package/dist/transport/http/client.js.map +1 -1
- package/dist/transport/http/contract.d.ts +57 -0
- package/dist/transport/http/contract.d.ts.map +1 -0
- package/dist/transport/http/contract.js +3 -0
- package/dist/transport/http/contract.js.map +1 -0
- package/dist/transport/http/index.d.ts +1 -0
- package/dist/transport/http/index.d.ts.map +1 -1
- package/dist/transport/http/index.js +1 -0
- package/dist/transport/http/index.js.map +1 -1
- package/dist/transport/http/options.d.ts +4 -1
- package/dist/transport/http/options.d.ts.map +1 -1
- package/dist/transport/http/transport.d.ts +1 -84
- package/dist/transport/http/transport.d.ts.map +1 -1
- package/dist/transport/http/transport.js +16 -134
- package/dist/transport/http/transport.js.map +1 -1
- package/dist/transport/websocket/commitFrames.d.ts +1 -2
- package/dist/transport/websocket/commitFrames.d.ts.map +1 -1
- package/dist/transport/websocket/commitFrames.js.map +1 -1
- package/dist/transport/websocket/frameHandlers.d.ts +0 -14
- package/dist/transport/websocket/frameHandlers.d.ts.map +1 -1
- package/dist/transport/websocket/frameHandlers.js +4 -71
- package/dist/transport/websocket/frameHandlers.js.map +1 -1
- package/dist/transport/websocket/heartbeat.d.ts.map +1 -1
- package/dist/transport/websocket/heartbeat.js.map +1 -1
- package/dist/transport/websocket/session.d.ts.map +1 -1
- package/dist/transport/websocket/session.js +137 -64
- package/dist/transport/websocket/session.js.map +1 -1
- package/dist/transport/websocket/sessionContract.d.ts +4 -15
- package/dist/transport/websocket/sessionContract.d.ts.map +1 -1
- package/dist/transport/websocket/transport.d.ts +6 -42
- package/dist/transport/websocket/transport.d.ts.map +1 -1
- package/dist/transport/websocket/transport.js +14 -101
- package/dist/transport/websocket/transport.js.map +1 -1
- package/dist/wire/accountResponses.d.ts +31 -31
- package/dist/wire/auth.d.ts +3 -3
- package/dist/wire/bootstrapReason.d.ts +2 -2
- package/dist/wire/dataSourceResponses.d.ts +2 -2
- package/dist/wire/dataSourceResponses.d.ts.map +1 -1
- package/dist/wire/frames.d.ts +8 -8
- package/dist/wire/inboundFrames.d.ts +60 -63
- package/dist/wire/inboundFrames.d.ts.map +1 -1
- package/dist/wire/inboundFrames.js +5 -6
- package/dist/wire/inboundFrames.js.map +1 -1
- package/dist/wire/listEnvelope.js.map +1 -1
- package/dist/wire/modelResponses.d.ts +2 -2
- package/dist/wire/modelShape.d.ts +4 -4
- package/dist/wire/pricing.d.ts +3 -3
- package/dist/wire/protocolVersion.d.ts.map +1 -1
- package/package.json +6 -1
- package/src/auth/apiKey.ts +25 -44
- package/src/auth/browserCredentialSafety.ts +1 -1
- package/src/auth/capabilityLifecycle.ts +3 -2
- package/src/auth/credentialEndpoint.ts +1 -1
- package/src/auth/credentialResult.ts +2 -0
- package/src/claims/admission.ts +49 -0
- package/src/claims/awaitGrant.ts +3 -52
- package/src/claims/conflict.ts +103 -0
- package/src/claims/contract.ts +2 -0
- package/src/claims/events.ts +1 -2
- package/src/claims/index.ts +11 -0
- package/src/client/ablo.ts +15 -10
- package/src/client/resources/httpResources.ts +2 -174
- package/src/client/resources/modelOperations.ts +0 -10
- package/src/client/surface.ts +2 -4
- package/src/coordination/index.ts +4 -9
- package/src/coordination/schema.ts +18 -81
- package/src/errorCodes.ts +21 -13
- package/src/errors.ts +116 -4
- package/src/sessions/client.ts +121 -0
- package/src/sessions/contract.ts +116 -0
- package/src/{auth/sessionMint.ts → sessions/create.ts} +13 -12
- package/src/sessions/handler.ts +96 -0
- package/src/sessions/index.ts +13 -0
- package/src/{transport/connection/credentialLifecycle.ts → sessions/lifecycle.ts} +5 -5
- package/src/sessions/source.ts +94 -0
- package/src/transport/connection/index.ts +0 -1
- package/src/transport/connection/manager.ts +1 -1
- package/src/transport/http/claimWait.ts +108 -0
- package/src/transport/http/client.ts +27 -36
- package/src/transport/http/contract.ts +71 -0
- package/src/transport/http/index.ts +1 -0
- package/src/transport/http/options.ts +4 -1
- package/src/transport/http/transport.ts +22 -275
- package/src/transport/websocket/commitFrames.ts +0 -2
- package/src/transport/websocket/frameHandlers.ts +7 -102
- package/src/transport/websocket/session.ts +162 -73
- package/src/transport/websocket/sessionContract.ts +4 -13
- package/src/transport/websocket/transport.ts +15 -137
- package/src/wire/inboundFrames.ts +5 -6
- package/dist/auth/sessionMint.d.ts.map +0 -1
- package/dist/auth/sessionMint.js.map +0 -1
- package/dist/transport/connection/credentialLifecycle.d.ts.map +0 -1
- package/dist/transport/connection/credentialLifecycle.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inboundFrames.d.ts","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;kCAKZ,CAAC;AACzB,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0CAA0C;AAC1C,MAAM,MAAM,oBAAoB;AAC9B,wDAAwD;AACtD;IAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CAAE;AAChE;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAChC,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,iBAAiB
|
|
1
|
+
{"version":3,"file":"inboundFrames.d.ts","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;kCAKZ,CAAC;AACzB,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0CAA0C;AAC1C,MAAM,MAAM,oBAAoB;AAC9B,wDAAwD;AACtD;IAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CAAE;AAChE;;;;;;GAMG;GACD;IACE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAChC,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D2B,CAAC;AAE1D,8CAA8C;AAC9C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;KAC7C,GACG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GACV,KAAK;CACV,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,wBAAwB,GAAG;KACpC,CAAC,IAAI,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC/B,GACG,CAAC,GACD,KAAK;CACV,CAAC,gBAAgB,CAAC,CAAC;AAEpB,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,GACrB,IAAI,IAAI,wBAAwB,CAElC"}
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
import { z } from 'zod';
|
|
26
26
|
import { commitReceiptSchema } from '../commit/contract.js';
|
|
27
27
|
import { clientSyncDeltaSchema } from '../observation/contract.js';
|
|
28
|
-
import { claimAcquiredSchema,
|
|
28
|
+
import { claimAcquiredSchema, claimAbandonAckPayloadSchema, claimGrantedSchema, claimHeartbeatAckPayloadSchema, claimLostSchema, claimQueuedSchema, claimQueueSchema, claimRejectionSchema, presenceUpdateSchema, subscriptionAckPayloadSchema, } from '../coordination/schema.js';
|
|
29
29
|
/**
|
|
30
30
|
* The envelope itself: a type and a payload. `catchall` keeps the extra keys,
|
|
31
31
|
* because the oldest delta form puts a delta's own fields at the top level
|
|
@@ -76,10 +76,6 @@ export const WS_INBOUND_FRAMES = {
|
|
|
76
76
|
checkedBy: commitReceiptSchema,
|
|
77
77
|
},
|
|
78
78
|
// ── Requests we made ───────────────────────────────────────────────────
|
|
79
|
-
claim_ack: {
|
|
80
|
-
validation: 'handler',
|
|
81
|
-
where: 'handleClaimAck narrows field by field, because a rejection carries a typed capability error it has to re-raise as CapabilityError',
|
|
82
|
-
},
|
|
83
79
|
subscription_ack: {
|
|
84
80
|
validation: 'handler',
|
|
85
81
|
// Not parsed at dispatch because the handler must first claim the oldest
|
|
@@ -90,9 +86,12 @@ export const WS_INBOUND_FRAMES = {
|
|
|
90
86
|
},
|
|
91
87
|
// ── Coordination ───────────────────────────────────────────────────────
|
|
92
88
|
presence_update: { validation: 'schema', payload: presenceUpdateSchema },
|
|
93
|
-
claim_expired: { validation: 'schema', payload: claimExpiredSchema },
|
|
94
89
|
claim_rejected: { validation: 'schema', payload: claimRejectionSchema },
|
|
95
90
|
claim_acquired: { validation: 'schema', payload: claimAcquiredSchema },
|
|
91
|
+
claim_abandon_ack: {
|
|
92
|
+
validation: 'schema',
|
|
93
|
+
payload: claimAbandonAckPayloadSchema,
|
|
94
|
+
},
|
|
96
95
|
claim_queued: { validation: 'schema', payload: claimQueuedSchema },
|
|
97
96
|
claim_granted: { validation: 'schema', payload: claimGrantedSchema },
|
|
98
97
|
claim_lost: { validation: 'schema', payload: claimLostSchema },
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inboundFrames.js","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,
|
|
1
|
+
{"version":3,"file":"inboundFrames.js","sourceRoot":"","sources":["../../src/wire/inboundFrames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,8BAA8B,EAC9B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAoBzB;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0EAA0E;IAC1E,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,uCAAuC,EAAE;IAC/E,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,uCAAuC,EAAE;IAE/E,0EAA0E;IAC1E,KAAK,EAAE;QACL,UAAU,EAAE,SAAS;QACrB,2EAA2E;QAC3E,wEAAwE;QACxE,+BAA+B;QAC/B,KAAK,EAAE,qDAAqD;QAC5D,SAAS,EAAE,qBAAqB;KACjC;IACD,aAAa,EAAE;QACb,UAAU,EAAE,SAAS;QACrB,0DAA0D;QAC1D,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,KAAK,EAAE,oEAAoE;KAC5E;IACD,kBAAkB,EAAE;QAClB,UAAU,EAAE,SAAS;QACrB,gEAAgE;QAChE,KAAK,EAAE,sEAAsE;KAC9E;IAED,0EAA0E;IAC1E,eAAe,EAAE;QACf,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,4FAA4F;QACnG,SAAS,EAAE,mBAAmB;KAC/B;IAED,0EAA0E;IAC1E,gBAAgB,EAAE;QAChB,UAAU,EAAE,SAAS;QACrB,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,EAAE,uBAAuB;QAC9B,SAAS,EAAE,4BAA4B;KACxC;IAED,0EAA0E;IAC1E,eAAe,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE;IACxE,cAAc,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE;IACvE,cAAc,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACtE,iBAAiB,EAAE;QACjB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,4BAA4B;KACtC;IACD,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAClE,aAAa,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE;IAC9D,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE;IAChE,mBAAmB,EAAE;QACnB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,8BAA8B;KACxC;CACsD,CAAC;AA4B1D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB;IAEtB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;AACzD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"listEnvelope.js","sourceRoot":"","sources":["../../src/wire/listEnvelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAI,UAAwB;IAC5D,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;QACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAMD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAkB,EAClB,
|
|
1
|
+
{"version":3,"file":"listEnvelope.js","sourceRoot":"","sources":["../../src/wire/listEnvelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAI,UAAwB;IAC5D,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;QACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAMD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAkB,EAClB,OAA0D,EAAE;IAE5D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK;QAC/B,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC"}
|
|
@@ -34,15 +34,15 @@ export declare const modelReadResponseSchema: z.ZodObject<{
|
|
|
34
34
|
id: z.ZodString;
|
|
35
35
|
actor: z.ZodString;
|
|
36
36
|
participantKind: z.ZodPreprocess<z.ZodEnum<{
|
|
37
|
+
user: "user";
|
|
37
38
|
agent: "agent";
|
|
38
39
|
system: "system";
|
|
39
|
-
user: "user";
|
|
40
40
|
}>>;
|
|
41
41
|
onBehalfOfId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
42
42
|
onBehalfOfKind: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodEnum<{
|
|
43
|
+
user: "user";
|
|
43
44
|
agent: "agent";
|
|
44
45
|
system: "system";
|
|
45
|
-
user: "user";
|
|
46
46
|
}>>>>;
|
|
47
47
|
capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
48
48
|
description: z.ZodOptional<z.ZodString>;
|
|
@@ -25,23 +25,23 @@ import { z } from 'zod';
|
|
|
25
25
|
* narrow one of these; they do not add a member.
|
|
26
26
|
*/
|
|
27
27
|
export declare const fieldTypeSchema: z.ZodEnum<{
|
|
28
|
+
string: "string";
|
|
29
|
+
number: "number";
|
|
28
30
|
boolean: "boolean";
|
|
29
31
|
date: "date";
|
|
30
32
|
enum: "enum";
|
|
31
33
|
json: "json";
|
|
32
|
-
number: "number";
|
|
33
|
-
string: "string";
|
|
34
34
|
}>;
|
|
35
35
|
export type FieldType = z.infer<typeof fieldTypeSchema>;
|
|
36
36
|
/** One field of a model, as the schema artifact records it. */
|
|
37
37
|
export declare const fieldMetaSchema: z.ZodObject<{
|
|
38
38
|
type: z.ZodEnum<{
|
|
39
|
+
string: "string";
|
|
40
|
+
number: "number";
|
|
39
41
|
boolean: "boolean";
|
|
40
42
|
date: "date";
|
|
41
43
|
enum: "enum";
|
|
42
44
|
json: "json";
|
|
43
|
-
number: "number";
|
|
44
|
-
string: "string";
|
|
45
45
|
}>;
|
|
46
46
|
isOptional: z.ZodBoolean;
|
|
47
47
|
isIndexed: z.ZodBoolean;
|
package/dist/wire/pricing.d.ts
CHANGED
|
@@ -7,9 +7,9 @@
|
|
|
7
7
|
*/
|
|
8
8
|
import { z } from 'zod';
|
|
9
9
|
export declare const planTierSchema: z.ZodEnum<{
|
|
10
|
-
enterprise: "enterprise";
|
|
11
10
|
free: "free";
|
|
12
11
|
scale: "scale";
|
|
12
|
+
enterprise: "enterprise";
|
|
13
13
|
}>;
|
|
14
14
|
export type PlanTier = z.infer<typeof planTierSchema>;
|
|
15
15
|
/**
|
|
@@ -24,10 +24,10 @@ export type PlanTier = z.infer<typeof planTierSchema>;
|
|
|
24
24
|
* the act of connecting.
|
|
25
25
|
*/
|
|
26
26
|
export declare const meterEventSchema: z.ZodEnum<{
|
|
27
|
-
"api.bootstraps": "api.bootstraps";
|
|
28
|
-
"api.claim_creates": "api.claim_creates";
|
|
29
27
|
"api.commit_ops": "api.commit_ops";
|
|
30
28
|
"api.model_reads": "api.model_reads";
|
|
29
|
+
"api.claim_creates": "api.claim_creates";
|
|
30
|
+
"api.bootstraps": "api.bootstraps";
|
|
31
31
|
}>;
|
|
32
32
|
export type MeterEvent = z.infer<typeof meterEventSchema>;
|
|
33
33
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocolVersion.d.ts","sourceRoot":"","sources":["../../src/wire/protocolVersion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,
|
|
1
|
+
{"version":3,"file":"protocolVersion.d.ts","sourceRoot":"","sources":["../../src/wire/protocolVersion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,cAAe,CAAC;AAExD,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,sBAAsB,GAAG,IAAI,CAO/B;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,wBAAwB,GAAG,IAAI,CAGjC;AAED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,0BAA0B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@abloatai/transaction",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.61.0",
|
|
4
4
|
"description": "The headless Ablo transaction client and canonical contracts for reads, commits, confirmation, claims, and durable observation.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -97,6 +97,11 @@
|
|
|
97
97
|
"import": "./dist/auth/*.js",
|
|
98
98
|
"default": "./dist/auth/*.js"
|
|
99
99
|
},
|
|
100
|
+
"./sessions": {
|
|
101
|
+
"types": "./dist/sessions/index.d.ts",
|
|
102
|
+
"import": "./dist/sessions/index.js",
|
|
103
|
+
"default": "./dist/sessions/index.js"
|
|
104
|
+
},
|
|
100
105
|
"./keys": {
|
|
101
106
|
"types": "./dist/keys/index.d.ts",
|
|
102
107
|
"import": "./dist/keys/index.js",
|
package/src/auth/apiKey.ts
CHANGED
|
@@ -17,15 +17,18 @@ import { classifyCredentialKind } from './credentialKind.js';
|
|
|
17
17
|
import { ABLO_DEFAULT_BASE_URL } from './hostedEndpoints.js';
|
|
18
18
|
import { normalizeAbloBaseUrl } from './baseUrl.js';
|
|
19
19
|
import type { KeyEnvironment } from '../environment.js';
|
|
20
|
-
import { isCredentialEndpoint
|
|
20
|
+
import { isCredentialEndpoint } from './credentialEndpoint.js';
|
|
21
21
|
import {
|
|
22
22
|
credentialToken,
|
|
23
23
|
type CredentialProvider,
|
|
24
|
+
type CredentialProviderResult,
|
|
24
25
|
} from './credentialResult.js';
|
|
26
|
+
import type { SessionSource } from '../sessions/contract.js';
|
|
25
27
|
import {
|
|
26
28
|
assertBrowserSafety,
|
|
27
29
|
protectBrowserCredentialProvider,
|
|
28
30
|
} from './browserCredentialSafety.js';
|
|
31
|
+
import { resolveSessionCredential } from '../sessions/source.js';
|
|
29
32
|
export { assertBrowserSafety };
|
|
30
33
|
|
|
31
34
|
/**
|
|
@@ -40,22 +43,18 @@ export type { CredentialProvider } from './credentialResult.js';
|
|
|
40
43
|
* The client options that decide a credential.
|
|
41
44
|
*
|
|
42
45
|
* This is the ONE declaration of that set. The resolvers below read it, and the
|
|
43
|
-
* transport configs that accept these options derive from it rather than
|
|
44
|
-
* the fields again
|
|
45
|
-
* runtime, named in an error message, and absent from the type a caller writes
|
|
46
|
-
* against.
|
|
46
|
+
* transport configs that accept these options derive from it rather than
|
|
47
|
+
* listing the fields again.
|
|
47
48
|
*/
|
|
48
49
|
export interface AuthClientOptions {
|
|
49
50
|
readonly apiKey?: string | CredentialProvider | null;
|
|
50
|
-
/** A
|
|
51
|
-
readonly
|
|
51
|
+
/** A scoped session, its renewal provider, or a browser session endpoint. */
|
|
52
|
+
readonly session?: SessionSource | null;
|
|
52
53
|
/** A token the caller already has, used as-is. */
|
|
53
54
|
readonly authToken?: string | null;
|
|
54
55
|
readonly baseURL?: string | null;
|
|
55
56
|
readonly dangerouslyAllowBrowser?: boolean;
|
|
56
57
|
readonly fetch?: typeof globalThis.fetch;
|
|
57
|
-
readonly authTimeoutMs?: number;
|
|
58
|
-
readonly allowCrossOriginAuthEndpoint?: boolean;
|
|
59
58
|
}
|
|
60
59
|
|
|
61
60
|
export interface AuthResolveInput {
|
|
@@ -83,45 +82,20 @@ export function readProcessEnv(): Record<string, string | undefined> {
|
|
|
83
82
|
export function resolveApiKey(
|
|
84
83
|
input: AuthResolveInput,
|
|
85
84
|
): string | CredentialProvider | null {
|
|
86
|
-
// `authEndpoint` is the option that names a session-mint route: a URL the
|
|
87
|
-
// client exchanges for a short-lived token, or an async resolver for custom
|
|
88
|
-
// exchanges. It is resolved into a `CredentialProvider` here — the single point
|
|
89
|
-
// shared by every client variant (WebSocket, HTTP, and protocol clients) — so
|
|
90
|
-
// every downstream consumer sees the same resolver and the credential
|
|
91
|
-
// lifecycle drives renewal off it.
|
|
92
|
-
const endpoint = input.options.authEndpoint;
|
|
93
85
|
const configured = input.options.apiKey;
|
|
94
|
-
|
|
95
|
-
|
|
86
|
+
const session = input.options.session;
|
|
87
|
+
if (session != null) {
|
|
88
|
+
if (configured != null || input.options.authToken != null) {
|
|
96
89
|
throw new AbloValidationError(
|
|
97
|
-
'Ablo: pass
|
|
98
|
-
|
|
99
|
-
'which credential to use.',
|
|
100
|
-
{ code: 'invalid_options', param: 'authEndpoint' },
|
|
90
|
+
'Ablo: pass `session`, `apiKey`, or `authToken` — not more than one.',
|
|
91
|
+
{ code: 'invalid_options', param: 'session' },
|
|
101
92
|
);
|
|
102
93
|
}
|
|
103
|
-
|
|
104
|
-
return protectBrowserCredentialProvider(
|
|
105
|
-
endpoint,
|
|
106
|
-
input.options.dangerouslyAllowBrowser,
|
|
107
|
-
);
|
|
108
|
-
}
|
|
109
|
-
if (!isCredentialEndpoint(endpoint)) {
|
|
110
|
-
throw new AbloValidationError(
|
|
111
|
-
'`authEndpoint` expects a URL or path (e.g. \'/api/ablo-session\') or an ' +
|
|
112
|
-
'async resolver — a key string belongs in `apiKey`.',
|
|
113
|
-
{ code: 'invalid_options', param: 'authEndpoint' },
|
|
114
|
-
);
|
|
115
|
-
}
|
|
116
|
-
return protectBrowserCredentialProvider(createEndpointCredentialResolver(endpoint, {
|
|
117
|
-
fetch: input.options.fetch,
|
|
118
|
-
timeoutMs: input.options.authTimeoutMs,
|
|
119
|
-
allowCrossOrigin: input.options.allowCrossOriginAuthEndpoint,
|
|
120
|
-
}), input.options.dangerouslyAllowBrowser);
|
|
94
|
+
return resolveSessionCredential(session, input.options);
|
|
121
95
|
}
|
|
122
96
|
if (typeof configured === 'string' && isCredentialEndpoint(configured)) {
|
|
123
97
|
throw new AbloValidationError(
|
|
124
|
-
'`apiKey`
|
|
98
|
+
'`apiKey` does not accept an endpoint. Use `session: { endpoint }`.',
|
|
125
99
|
{ code: 'invalid_options', param: 'apiKey' },
|
|
126
100
|
);
|
|
127
101
|
}
|
|
@@ -139,8 +113,8 @@ export function resolveApiKey(
|
|
|
139
113
|
* needs: an async `() => token | null`, or `null` when auth is static — a plain
|
|
140
114
|
* long-lived key string with no refresh, which is the common case.
|
|
141
115
|
*
|
|
142
|
-
*
|
|
143
|
-
* SDK then drives the whole credential lifecycle
|
|
116
|
+
* A renewable session or browser session endpoint resolves to a credential
|
|
117
|
+
* provider, and the SDK then drives the whole credential lifecycle
|
|
144
118
|
* from it: mint-before-connect, the proactive refresh timer with its
|
|
145
119
|
* wake/online/focus re-mint, and the reactive `credential_stale` re-mint. The
|
|
146
120
|
* resolver follows the provider contract end to end: resolve a token,
|
|
@@ -434,8 +408,15 @@ export function rejectRemovedDatabaseUrlOption(options: object): void {
|
|
|
434
408
|
export async function resolveApiKeyValue(
|
|
435
409
|
apiKey: string | CredentialProvider | null,
|
|
436
410
|
): Promise<string | null> {
|
|
411
|
+
return credentialToken(await resolveCredentialValue(apiKey));
|
|
412
|
+
}
|
|
413
|
+
|
|
414
|
+
/** Resolve without discarding session expiry metadata needed by live clients. */
|
|
415
|
+
export async function resolveCredentialValue(
|
|
416
|
+
apiKey: string | CredentialProvider | null,
|
|
417
|
+
): Promise<CredentialProviderResult> {
|
|
437
418
|
if (apiKey == null) return null;
|
|
438
|
-
if (typeof apiKey === 'function') return
|
|
419
|
+
if (typeof apiKey === 'function') return apiKey();
|
|
439
420
|
return apiKey;
|
|
440
421
|
}
|
|
441
422
|
|
|
@@ -42,7 +42,7 @@ export function protectBrowserCredentialProvider(
|
|
|
42
42
|
function throwBrowserSecretError(): never {
|
|
43
43
|
throw new AbloAuthenticationError(
|
|
44
44
|
'A secret `sk_` credential reached the browser. Keep it server-side and ' +
|
|
45
|
-
'configure the browser with `
|
|
45
|
+
'configure the browser with `session: { endpoint }` instead.',
|
|
46
46
|
{ code: 'browser_apikey_blocked' },
|
|
47
47
|
);
|
|
48
48
|
}
|
|
@@ -9,7 +9,8 @@ import type {
|
|
|
9
9
|
RotateSessionParams,
|
|
10
10
|
SessionRevocation,
|
|
11
11
|
SessionRotation,
|
|
12
|
-
} from '../
|
|
12
|
+
} from '../sessions/contract.js';
|
|
13
|
+
import { sessionScope } from '../sessions/contract.js';
|
|
13
14
|
|
|
14
15
|
export const sessionRevocationResponseSchema = z.object({
|
|
15
16
|
id: z.string().min(1),
|
|
@@ -166,7 +167,7 @@ export async function rotateCapability(
|
|
|
166
167
|
token: parsed.data.token,
|
|
167
168
|
expiresAt: parsed.data.expiresAt,
|
|
168
169
|
organizationId: parsed.data.organizationId,
|
|
169
|
-
scope: parsed.data.scope,
|
|
170
|
+
scope: sessionScope(parsed.data.scope),
|
|
170
171
|
rotatedFrom: {
|
|
171
172
|
id: parsed.data.rotatedFrom.capabilityId,
|
|
172
173
|
expiresAt: parsed.data.rotatedFrom.expiresAt,
|
|
@@ -23,7 +23,7 @@ function assertEndpointOrigin(endpoint: string, allowCrossOrigin: boolean): void
|
|
|
23
23
|
if (endpointOrigin !== window.location.origin) {
|
|
24
24
|
throw new Error(
|
|
25
25
|
'credential endpoint must be same-origin; set ' +
|
|
26
|
-
'`
|
|
26
|
+
'`session.allowCrossOrigin: true` only after configuring CORS and CSRF protection',
|
|
27
27
|
);
|
|
28
28
|
}
|
|
29
29
|
}
|
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
import type { CredentialEndpointSuccess } from './credentialEndpointProtocol.js';
|
|
2
|
+
import type { SessionCredential } from '../sessions/contract.js';
|
|
2
3
|
|
|
3
4
|
export type CredentialProviderResult =
|
|
4
5
|
| string
|
|
5
6
|
| CredentialEndpointSuccess
|
|
7
|
+
| SessionCredential
|
|
6
8
|
| null;
|
|
7
9
|
|
|
8
10
|
/** Rotating secret provider or short-lived browser credential provider. */
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
/** One interpretation of a rejected claim admission, shared by live callers. */
|
|
2
|
+
import {
|
|
3
|
+
AbloClaimedError,
|
|
4
|
+
AbloValidationError,
|
|
5
|
+
CapabilityError,
|
|
6
|
+
formatClaimedErrorMessage,
|
|
7
|
+
claimTargetLabel,
|
|
8
|
+
} from '../errors.js';
|
|
9
|
+
import type { AbloError } from '../errors.js';
|
|
10
|
+
import type { ClaimRejection } from '../coordination/schema.js';
|
|
11
|
+
import { modelTarget } from './locator.js';
|
|
12
|
+
import { conflictFromClaimRejection } from './conflict.js';
|
|
13
|
+
|
|
14
|
+
export function claimAdmissionError(rejection: ClaimRejection): AbloError {
|
|
15
|
+
const target = rejection.target
|
|
16
|
+
? claimTargetLabel({
|
|
17
|
+
...modelTarget(rejection.target),
|
|
18
|
+
field: rejection.target.field,
|
|
19
|
+
})
|
|
20
|
+
: rejection.claimId;
|
|
21
|
+
if (rejection.reason === 'capability_denied') {
|
|
22
|
+
return new CapabilityError(
|
|
23
|
+
'capability_scope_denied',
|
|
24
|
+
rejection.message ?? `This credential may not claim ${target}.`,
|
|
25
|
+
);
|
|
26
|
+
}
|
|
27
|
+
if (rejection.reason === 'invalid_target') {
|
|
28
|
+
return new AbloValidationError(
|
|
29
|
+
rejection.message ?? `Invalid claim target ${target}.`,
|
|
30
|
+
{ code: 'invalid_body' },
|
|
31
|
+
);
|
|
32
|
+
}
|
|
33
|
+
return new AbloClaimedError(
|
|
34
|
+
formatClaimedErrorMessage({
|
|
35
|
+
targetLabel: target,
|
|
36
|
+
heldBy: rejection.heldBy,
|
|
37
|
+
claim: rejection.heldByClaim,
|
|
38
|
+
detail: rejection.message,
|
|
39
|
+
fallback: `Claim rejected for ${target}.`,
|
|
40
|
+
}),
|
|
41
|
+
{
|
|
42
|
+
code: rejection.reason === 'conflict'
|
|
43
|
+
? 'claim_conflict'
|
|
44
|
+
: 'claim_lease_unavailable',
|
|
45
|
+
claims: rejection.heldByClaim ? [rejection.heldByClaim] : undefined,
|
|
46
|
+
conflict: conflictFromClaimRejection(rejection),
|
|
47
|
+
},
|
|
48
|
+
);
|
|
49
|
+
}
|
package/src/claims/awaitGrant.ts
CHANGED
|
@@ -16,14 +16,10 @@
|
|
|
16
16
|
import {
|
|
17
17
|
AbloClaimedError,
|
|
18
18
|
AbloError,
|
|
19
|
-
AbloValidationError,
|
|
20
|
-
CapabilityError,
|
|
21
|
-
formatClaimedErrorMessage,
|
|
22
|
-
claimTargetLabel,
|
|
23
19
|
} from '../errors.js';
|
|
24
20
|
import type { ClaimRejection } from '../coordination/schema.js';
|
|
25
|
-
import { modelTarget } from './locator.js';
|
|
26
21
|
import { noopLogger, type Logger } from '../logger.js';
|
|
22
|
+
import { claimAdmissionError } from './admission.js';
|
|
27
23
|
|
|
28
24
|
export interface GrantTransport {
|
|
29
25
|
subscribe(
|
|
@@ -179,52 +175,7 @@ export function awaitClaimGrant(
|
|
|
179
175
|
transport.subscribe('claim_rejected', (p) => {
|
|
180
176
|
const rejection = p as ClaimRejection;
|
|
181
177
|
if (rejection.claimId !== claimId) return;
|
|
182
|
-
|
|
183
|
-
? claimTargetLabel({
|
|
184
|
-
...modelTarget(rejection.target),
|
|
185
|
-
field: rejection.target.field,
|
|
186
|
-
})
|
|
187
|
-
: claimId;
|
|
188
|
-
if (rejection.reason === 'capability_denied') {
|
|
189
|
-
settle(() => {
|
|
190
|
-
const error = new CapabilityError(
|
|
191
|
-
'capability_scope_denied',
|
|
192
|
-
rejection.message ??
|
|
193
|
-
`This credential may not claim ${target}.`,
|
|
194
|
-
);
|
|
195
|
-
observe(() => options?.onFailed?.(error));
|
|
196
|
-
reject(error);
|
|
197
|
-
});
|
|
198
|
-
return;
|
|
199
|
-
}
|
|
200
|
-
if (rejection.reason === 'invalid_target') {
|
|
201
|
-
settle(() => {
|
|
202
|
-
const error = new AbloValidationError(
|
|
203
|
-
rejection.message ?? `Invalid claim target ${target}.`,
|
|
204
|
-
{ code: 'invalid_body' },
|
|
205
|
-
);
|
|
206
|
-
observe(() => options?.onFailed?.(error));
|
|
207
|
-
reject(error);
|
|
208
|
-
});
|
|
209
|
-
return;
|
|
210
|
-
}
|
|
211
|
-
fail(
|
|
212
|
-
new AbloClaimedError(
|
|
213
|
-
formatClaimedErrorMessage({
|
|
214
|
-
targetLabel: target,
|
|
215
|
-
heldBy: rejection.heldBy,
|
|
216
|
-
claim: rejection.heldByClaim,
|
|
217
|
-
detail: rejection.message,
|
|
218
|
-
fallback: `Claim rejected for ${target}.`,
|
|
219
|
-
}),
|
|
220
|
-
{
|
|
221
|
-
code: rejection.reason === 'conflict'
|
|
222
|
-
? 'claim_conflict'
|
|
223
|
-
: 'claim_lease_unavailable',
|
|
224
|
-
claims: rejection.heldByClaim ? [rejection.heldByClaim] : undefined,
|
|
225
|
-
},
|
|
226
|
-
),
|
|
227
|
-
);
|
|
178
|
+
fail(claimAdmissionError(rejection));
|
|
228
179
|
}),
|
|
229
180
|
);
|
|
230
181
|
unsubs.push(
|
|
@@ -257,7 +208,7 @@ export function awaitClaimGrant(
|
|
|
257
208
|
unsubs.push(() => { signal.removeEventListener('abort', abort); });
|
|
258
209
|
}
|
|
259
210
|
|
|
260
|
-
if (options?.timeoutMs
|
|
211
|
+
if (options?.timeoutMs !== undefined) {
|
|
261
212
|
timer = setTimeout(() => {
|
|
262
213
|
fail(
|
|
263
214
|
new AbloClaimedError(
|
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The public, transport-independent facts about a claim conflict.
|
|
3
|
+
*
|
|
4
|
+
* A counterparty's display-safe context is deliberately separate from its raw
|
|
5
|
+
* participant id. Applications can show the kind, description, and expiry
|
|
6
|
+
* without treating an opaque authorization identity as a label.
|
|
7
|
+
*/
|
|
8
|
+
import { z } from 'zod';
|
|
9
|
+
import {
|
|
10
|
+
modelTargetSchema,
|
|
11
|
+
participantKindSchema,
|
|
12
|
+
type ClaimRejection,
|
|
13
|
+
type ModelTarget,
|
|
14
|
+
type ParticipantKind,
|
|
15
|
+
type WireClaimSummary,
|
|
16
|
+
} from '../coordination/schema.js';
|
|
17
|
+
import { modelTarget } from './locator.js';
|
|
18
|
+
|
|
19
|
+
export const claimConflictCounterpartySchema = z.object({
|
|
20
|
+
kind: participantKindSchema.optional(),
|
|
21
|
+
description: z.string().optional(),
|
|
22
|
+
expiresAt: z.number().optional(),
|
|
23
|
+
}).readonly();
|
|
24
|
+
|
|
25
|
+
export type ClaimConflictCounterparty = z.infer<
|
|
26
|
+
typeof claimConflictCounterpartySchema
|
|
27
|
+
>;
|
|
28
|
+
|
|
29
|
+
export const claimConflictContextSchema = z.object({
|
|
30
|
+
counterparty: claimConflictCounterpartySchema.optional(),
|
|
31
|
+
target: modelTargetSchema.unwrap().partial().readonly().optional(),
|
|
32
|
+
claimId: z.string().optional(),
|
|
33
|
+
/**
|
|
34
|
+
* Opaque authorization identity of the holder. Keep it separate from the
|
|
35
|
+
* display-safe counterparty block: exposing it to an end user is an
|
|
36
|
+
* application privacy decision, not a formatting default.
|
|
37
|
+
*/
|
|
38
|
+
participantId: z.string().optional(),
|
|
39
|
+
}).readonly();
|
|
40
|
+
|
|
41
|
+
export type ClaimConflictContext = z.infer<typeof claimConflictContextSchema>;
|
|
42
|
+
|
|
43
|
+
export interface ClaimConflictSource {
|
|
44
|
+
readonly heldBy?: string;
|
|
45
|
+
readonly heldByKind?: ParticipantKind;
|
|
46
|
+
readonly heldByClaimId?: string;
|
|
47
|
+
readonly heldByExpiresAt?: number;
|
|
48
|
+
readonly heldByClaim?: WireClaimSummary;
|
|
49
|
+
readonly target?: Partial<ModelTarget>;
|
|
50
|
+
readonly description?: string;
|
|
51
|
+
readonly expiresAt?: number;
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
/** Normalize every wire spelling into the one public conflict shape. */
|
|
55
|
+
export function normalizeClaimConflict(
|
|
56
|
+
source: ClaimConflictSource,
|
|
57
|
+
): ClaimConflictContext | undefined {
|
|
58
|
+
const summary = source.heldByClaim;
|
|
59
|
+
const description = source.description ?? summary?.description;
|
|
60
|
+
const expiresAt =
|
|
61
|
+
source.expiresAt ?? source.heldByExpiresAt ?? summary?.expiresAt;
|
|
62
|
+
const counterparty: ClaimConflictCounterparty = {
|
|
63
|
+
...(source.heldByKind !== undefined ? { kind: source.heldByKind } : {}),
|
|
64
|
+
...(description !== undefined ? { description } : {}),
|
|
65
|
+
...(expiresAt !== undefined ? { expiresAt } : {}),
|
|
66
|
+
};
|
|
67
|
+
const target = source.target ?? (summary ? modelTarget(summary) : undefined);
|
|
68
|
+
const conflict: ClaimConflictContext = {
|
|
69
|
+
...(Object.keys(counterparty).length > 0 ? { counterparty } : {}),
|
|
70
|
+
...(target !== undefined ? { target } : {}),
|
|
71
|
+
...(source.heldByClaimId !== undefined
|
|
72
|
+
? { claimId: source.heldByClaimId }
|
|
73
|
+
: summary?.claimId !== undefined
|
|
74
|
+
? { claimId: summary.claimId }
|
|
75
|
+
: {}),
|
|
76
|
+
...(source.heldBy !== undefined ? { participantId: source.heldBy } : {}),
|
|
77
|
+
};
|
|
78
|
+
return Object.keys(conflict).length > 0 ? conflict : undefined;
|
|
79
|
+
}
|
|
80
|
+
|
|
81
|
+
/** Normalize the canonical WebSocket claim-rejection frame. */
|
|
82
|
+
export function conflictFromClaimRejection(
|
|
83
|
+
rejection: ClaimRejection,
|
|
84
|
+
): ClaimConflictContext | undefined {
|
|
85
|
+
return normalizeClaimConflict({
|
|
86
|
+
...(rejection.heldBy !== undefined ? { heldBy: rejection.heldBy } : {}),
|
|
87
|
+
...(rejection.heldByKind !== undefined
|
|
88
|
+
? { heldByKind: rejection.heldByKind }
|
|
89
|
+
: {}),
|
|
90
|
+
...(rejection.heldByClaimId !== undefined
|
|
91
|
+
? { heldByClaimId: rejection.heldByClaimId }
|
|
92
|
+
: {}),
|
|
93
|
+
...(rejection.heldByExpiresAt !== undefined
|
|
94
|
+
? { heldByExpiresAt: rejection.heldByExpiresAt }
|
|
95
|
+
: {}),
|
|
96
|
+
...(rejection.heldByClaim !== undefined
|
|
97
|
+
? { heldByClaim: rejection.heldByClaim }
|
|
98
|
+
: {}),
|
|
99
|
+
...(rejection.target !== undefined
|
|
100
|
+
? { target: modelTarget(rejection.target) }
|
|
101
|
+
: {}),
|
|
102
|
+
});
|
|
103
|
+
}
|
package/src/claims/contract.ts
CHANGED
|
@@ -232,6 +232,8 @@ export const claimQueuedResponseSchema = z.object({
|
|
|
232
232
|
status: z.literal('queued'),
|
|
233
233
|
position: z.number().int().nonnegative(),
|
|
234
234
|
heldBy: z.string().optional(),
|
|
235
|
+
heldByKind: wireParticipantKindSchema.optional(),
|
|
236
|
+
heldByClaimId: z.string().optional(),
|
|
235
237
|
expiresAt: z.number().int().optional(),
|
|
236
238
|
heldByClaim: wireClaimSummarySchema.optional(),
|
|
237
239
|
});
|
package/src/claims/events.ts
CHANGED
package/src/claims/index.ts
CHANGED
|
@@ -17,5 +17,16 @@ export type {
|
|
|
17
17
|
ConflictEvent,
|
|
18
18
|
CoordinationObserver,
|
|
19
19
|
} from './events.js';
|
|
20
|
+
export {
|
|
21
|
+
claimConflictCounterpartySchema,
|
|
22
|
+
claimConflictContextSchema,
|
|
23
|
+
normalizeClaimConflict,
|
|
24
|
+
conflictFromClaimRejection,
|
|
25
|
+
} from './conflict.js';
|
|
26
|
+
export type {
|
|
27
|
+
ClaimConflictCounterparty,
|
|
28
|
+
ClaimConflictContext,
|
|
29
|
+
ClaimConflictSource,
|
|
30
|
+
} from './conflict.js';
|
|
20
31
|
export * from './targetConflict.js';
|
|
21
32
|
export * from './trace.js';
|