@ariestools/aries-datalake-core 0.1.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -0
- package/dist/browser/api/errors.d.ts +24 -0
- package/dist/browser/api/errors.d.ts.map +1 -0
- package/dist/browser/api/health.d.ts +12 -0
- package/dist/browser/api/health.d.ts.map +1 -0
- package/dist/browser/api/paths.d.ts +13 -0
- package/dist/browser/api/paths.d.ts.map +1 -0
- package/dist/browser/api/planePaths.d.ts +31 -0
- package/dist/browser/api/planePaths.d.ts.map +1 -0
- package/dist/browser/api/requests.d.ts +18 -0
- package/dist/browser/api/requests.d.ts.map +1 -0
- package/dist/browser/browser.d.ts +21 -0
- package/dist/browser/browser.d.ts.map +1 -0
- package/dist/browser/browser.mjs +144 -0
- package/dist/browser/browser.mjs.map +7 -0
- package/dist/browser/types/AclEntry.d.ts +14 -0
- package/dist/browser/types/AclEntry.d.ts.map +1 -0
- package/dist/browser/types/BrowserPayload.d.ts +48 -0
- package/dist/browser/types/BrowserPayload.d.ts.map +1 -0
- package/dist/browser/types/DatalakeConfig.d.ts +48 -0
- package/dist/browser/types/DatalakeConfig.d.ts.map +1 -0
- package/dist/browser/types/DatalakeDescriptor.d.ts +38 -0
- package/dist/browser/types/DatalakeDescriptor.d.ts.map +1 -0
- package/dist/browser/types/Principal.d.ts +17 -0
- package/dist/browser/types/Principal.d.ts.map +1 -0
- package/dist/browser/types/Region.d.ts +8 -0
- package/dist/browser/types/Region.d.ts.map +1 -0
- package/dist/browser/types/Scope.d.ts +17 -0
- package/dist/browser/types/Scope.d.ts.map +1 -0
- package/dist/browser/types/Status.d.ts +7 -0
- package/dist/browser/types/Status.d.ts.map +1 -0
- package/dist/browser/types/Tier.d.ts +8 -0
- package/dist/browser/types/Tier.d.ts.map +1 -0
- package/dist/browser/types/Token.d.ts +18 -0
- package/dist/browser/types/Token.d.ts.map +1 -0
- package/dist/node/api/errors.d.ts +24 -0
- package/dist/node/api/errors.d.ts.map +1 -0
- package/dist/node/api/health.d.ts +12 -0
- package/dist/node/api/health.d.ts.map +1 -0
- package/dist/node/api/paths.d.ts +13 -0
- package/dist/node/api/paths.d.ts.map +1 -0
- package/dist/node/api/planePaths.d.ts +31 -0
- package/dist/node/api/planePaths.d.ts.map +1 -0
- package/dist/node/api/requests.d.ts +18 -0
- package/dist/node/api/requests.d.ts.map +1 -0
- package/dist/node/auth/sessionTokenCodec.d.ts +69 -0
- package/dist/node/auth/sessionTokenCodec.d.ts.map +1 -0
- package/dist/node/auth/strictHs256.d.ts +13 -0
- package/dist/node/auth/strictHs256.d.ts.map +1 -0
- package/dist/node/auth/tokenCodec.d.ts +49 -0
- package/dist/node/auth/tokenCodec.d.ts.map +1 -0
- package/dist/node/browser.d.ts +21 -0
- package/dist/node/browser.d.ts.map +1 -0
- package/dist/node/index.d.ts +27 -0
- package/dist/node/index.d.ts.map +1 -0
- package/dist/node/index.mjs +423 -0
- package/dist/node/index.mjs.map +7 -0
- package/dist/node/store/DatalakeStore.d.ts +36 -0
- package/dist/node/store/DatalakeStore.d.ts.map +1 -0
- package/dist/node/types/AclEntry.d.ts +14 -0
- package/dist/node/types/AclEntry.d.ts.map +1 -0
- package/dist/node/types/BrowserPayload.d.ts +48 -0
- package/dist/node/types/BrowserPayload.d.ts.map +1 -0
- package/dist/node/types/DatalakeConfig.d.ts +48 -0
- package/dist/node/types/DatalakeConfig.d.ts.map +1 -0
- package/dist/node/types/DatalakeDescriptor.d.ts +38 -0
- package/dist/node/types/DatalakeDescriptor.d.ts.map +1 -0
- package/dist/node/types/Payload.d.ts +75 -0
- package/dist/node/types/Payload.d.ts.map +1 -0
- package/dist/node/types/Principal.d.ts +17 -0
- package/dist/node/types/Principal.d.ts.map +1 -0
- package/dist/node/types/Region.d.ts +8 -0
- package/dist/node/types/Region.d.ts.map +1 -0
- package/dist/node/types/Scope.d.ts +17 -0
- package/dist/node/types/Scope.d.ts.map +1 -0
- package/dist/node/types/Status.d.ts +7 -0
- package/dist/node/types/Status.d.ts.map +1 -0
- package/dist/node/types/Tier.d.ts +8 -0
- package/dist/node/types/Tier.d.ts.map +1 -0
- package/dist/node/types/Token.d.ts +18 -0
- package/dist/node/types/Token.d.ts.map +1 -0
- package/package.json +66 -0
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Standard error body returned by the control plane for any non-2xx response.
|
|
3
|
+
* The `code` is a stable machine-readable identifier; `message` is the
|
|
4
|
+
* human-readable description.
|
|
5
|
+
*/
|
|
6
|
+
export interface ApiErrorBody {
|
|
7
|
+
code: ApiErrorCode;
|
|
8
|
+
message: string;
|
|
9
|
+
/** Optional request-correlation id for server logs. */
|
|
10
|
+
requestId?: string;
|
|
11
|
+
}
|
|
12
|
+
export type ApiErrorCode = 'bad_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'unprocessable' | 'rate_limited' | 'internal';
|
|
13
|
+
export declare const API_ERROR_STATUS: Record<ApiErrorCode, number>;
|
|
14
|
+
/**
|
|
15
|
+
* Thrown by `RestDatalakeClient` when the server returns a non-2xx response.
|
|
16
|
+
* Carries the structured error body so callers can branch on `.code`.
|
|
17
|
+
*/
|
|
18
|
+
export declare class DatalakeApiError extends Error {
|
|
19
|
+
readonly code: ApiErrorCode;
|
|
20
|
+
readonly requestId?: string;
|
|
21
|
+
readonly status: number;
|
|
22
|
+
constructor(status: number, body: ApiErrorBody);
|
|
23
|
+
}
|
|
24
|
+
//# sourceMappingURL=errors.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Response body for `GET /v1/health`. Used by the CLI to validate that a
|
|
3
|
+
* configured base URL is reachable and speaks our protocol before issuing
|
|
4
|
+
* real requests.
|
|
5
|
+
*/
|
|
6
|
+
export interface HealthResponse {
|
|
7
|
+
status: 'ok';
|
|
8
|
+
/** Server wall-clock time at the moment of response (ISO-8601). */
|
|
9
|
+
time: string;
|
|
10
|
+
version: string;
|
|
11
|
+
}
|
|
12
|
+
//# sourceMappingURL=health.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Canonical path builders for the datalake control-plane HTTP API.
|
|
3
|
+
* Both the REST client and the control-plane service import from here so
|
|
4
|
+
* the wire contract has a single source of truth.
|
|
5
|
+
*/
|
|
6
|
+
export declare const DATALAKE_API_VERSION = "v1";
|
|
7
|
+
export declare function datalakeCollectionPath(): string;
|
|
8
|
+
export declare function datalakeResourcePath(idOrName: string): string;
|
|
9
|
+
export declare function datalakeGrantsPath(idOrName: string): string;
|
|
10
|
+
export declare function datalakeGrantPath(idOrName: string, principal: string): string;
|
|
11
|
+
export declare function datalakeTokensPath(idOrName: string): string;
|
|
12
|
+
export declare function datalakeHealthPath(): string;
|
|
13
|
+
//# sourceMappingURL=paths.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/api/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAExC,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Data-plane path builders. The data plane is addressed by datalake id
|
|
3
|
+
* (globally unique), not by name (which is scoped to owner). Route names
|
|
4
|
+
* mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)
|
|
5
|
+
* so a generic archivist client can talk to a datalake-plane after picking
|
|
6
|
+
* the per-datalake prefix.
|
|
7
|
+
*/
|
|
8
|
+
/**
|
|
9
|
+
* Header that conveys how many payloads in the insert request were skipped
|
|
10
|
+
* because their hash already existed in the datalake.
|
|
11
|
+
*/
|
|
12
|
+
export declare const DATALAKE_HEADER_DUPLICATES = "x-datalake-duplicates";
|
|
13
|
+
/**
|
|
14
|
+
* Header that conveys the comma-separated list of archivist-computed
|
|
15
|
+
* `_hash` values rejected by the datalake's schema policy.
|
|
16
|
+
*/
|
|
17
|
+
export declare const DATALAKE_HEADER_REJECTED = "x-datalake-rejected";
|
|
18
|
+
/**
|
|
19
|
+
* Header that conveys the cursor (`_sequence`) of the last payload in a
|
|
20
|
+
* `next` response page, when more pages may exist.
|
|
21
|
+
*/
|
|
22
|
+
export declare const DATALAKE_HEADER_NEXT_CURSOR = "x-datalake-next-cursor";
|
|
23
|
+
export declare function datalakePlaneResourcePath(id: string): string;
|
|
24
|
+
export declare function datalakePlaneInsertPath(id: string): string;
|
|
25
|
+
export declare function datalakePlaneGetPath(id: string, hash: string): string;
|
|
26
|
+
export declare function datalakePlaneGetManyPath(id: string): string;
|
|
27
|
+
export declare function datalakePlaneNextPath(id: string): string;
|
|
28
|
+
export declare function datalakePlaneDeletePath(id: string, hash: string): string;
|
|
29
|
+
export declare function datalakePlaneClearPath(id: string): string;
|
|
30
|
+
export declare function datalakePlaneUsagePath(id: string): string;
|
|
31
|
+
//# sourceMappingURL=planePaths.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"planePaths.d.ts","sourceRoot":"","sources":["../../../src/api/planePaths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;GAGG;AACH,eAAO,MAAM,0BAA0B,0BAA0B,CAAA;AAEjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAE7D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAA;AAEnE,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import type { DatalakeConfig } from '../types/DatalakeConfig.ts';
|
|
2
|
+
import type { DatalakePrincipal, DatalakeRole } from '../types/Principal.ts';
|
|
3
|
+
/**
|
|
4
|
+
* Request payloads for the control-plane HTTP API. Exchanged as JSON bodies.
|
|
5
|
+
*/
|
|
6
|
+
export interface CreateDatalakeBody {
|
|
7
|
+
config: DatalakeConfig;
|
|
8
|
+
name: string;
|
|
9
|
+
}
|
|
10
|
+
export interface GrantBody {
|
|
11
|
+
principal: DatalakePrincipal;
|
|
12
|
+
role: DatalakeRole;
|
|
13
|
+
}
|
|
14
|
+
export interface MintTokenBody {
|
|
15
|
+
role: DatalakeRole;
|
|
16
|
+
ttlSeconds?: number;
|
|
17
|
+
}
|
|
18
|
+
//# sourceMappingURL=requests.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"requests.d.ts","sourceRoot":"","sources":["../../../src/api/requests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE5E;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB"}
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Session tokens issued after a successful XYO Wallet sign-in. The wire
|
|
3
|
+
* format mirrors `tokenCodec.ts` (HS256 JWT) but the payload carries no
|
|
4
|
+
* `dl` claim — sessions are scoped to a user (wallet address), not a
|
|
5
|
+
* single datalake. The control plane mints these; both planes verify
|
|
6
|
+
* them via `verifySessionToken`.
|
|
7
|
+
*/
|
|
8
|
+
export interface SessionTokenPayload {
|
|
9
|
+
/** Expiration (seconds since epoch). */
|
|
10
|
+
exp: number;
|
|
11
|
+
/** Issued-at (seconds since epoch). */
|
|
12
|
+
iat: number;
|
|
13
|
+
/** Unique token id. */
|
|
14
|
+
jti: string;
|
|
15
|
+
/** Wallet address that authenticated; used as the `ownerId`. */
|
|
16
|
+
sub: string;
|
|
17
|
+
/** Token kind. Always `'session'` for this codec. */
|
|
18
|
+
typ: 'session';
|
|
19
|
+
}
|
|
20
|
+
export interface SignSessionTokenInput {
|
|
21
|
+
address: string;
|
|
22
|
+
signingSecret: string;
|
|
23
|
+
ttlSeconds: number;
|
|
24
|
+
}
|
|
25
|
+
export interface SignedSessionToken {
|
|
26
|
+
expiresAt: string;
|
|
27
|
+
token: string;
|
|
28
|
+
}
|
|
29
|
+
export declare function signSessionToken(input: SignSessionTokenInput): SignedSessionToken;
|
|
30
|
+
export type SessionTokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'wrong_type';
|
|
31
|
+
export declare class SessionTokenVerificationError extends Error {
|
|
32
|
+
readonly code: SessionTokenVerificationErrorCode;
|
|
33
|
+
constructor(code: SessionTokenVerificationErrorCode, message: string);
|
|
34
|
+
}
|
|
35
|
+
export interface VerifySessionTokenInput {
|
|
36
|
+
now?: number;
|
|
37
|
+
signingSecret: string;
|
|
38
|
+
token: string;
|
|
39
|
+
}
|
|
40
|
+
export declare function verifySessionToken(input: VerifySessionTokenInput): SessionTokenPayload;
|
|
41
|
+
/**
|
|
42
|
+
* Single-use challenge token. The wallet signs the entire `token` string
|
|
43
|
+
* (the wallet doesn't need to parse it). The server stores no state — it
|
|
44
|
+
* just verifies its own signature on the challenge then verifies the
|
|
45
|
+
* wallet's signature over the challenge string.
|
|
46
|
+
*/
|
|
47
|
+
export interface ChallengeTokenPayload {
|
|
48
|
+
address: string;
|
|
49
|
+
exp: number;
|
|
50
|
+
iat: number;
|
|
51
|
+
jti: string;
|
|
52
|
+
typ: 'challenge';
|
|
53
|
+
}
|
|
54
|
+
export interface SignChallengeInput {
|
|
55
|
+
address: string;
|
|
56
|
+
signingSecret: string;
|
|
57
|
+
ttlSeconds: number;
|
|
58
|
+
}
|
|
59
|
+
export interface SignedChallenge {
|
|
60
|
+
challenge: string;
|
|
61
|
+
expiresAt: string;
|
|
62
|
+
}
|
|
63
|
+
export declare function signChallenge(input: SignChallengeInput): SignedChallenge;
|
|
64
|
+
export declare function verifyChallenge(input: {
|
|
65
|
+
challenge: string;
|
|
66
|
+
now?: number;
|
|
67
|
+
signingSecret: string;
|
|
68
|
+
}): ChallengeTokenPayload;
|
|
69
|
+
//# sourceMappingURL=sessionTokenCodec.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sessionTokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/sessionTokenCodec.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AAEH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAA;IACX,qDAAqD;IACrD,GAAG,EAAE,SAAS,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB,CAkBjF;AAED,MAAM,MAAM,iCAAiC,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,CAAA;AAE1H,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAA;gBAEpC,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM;CAKrE;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAkCtF;AAED;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,WAAW,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CAkBxE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,CAmCxH"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
export type StrictHs256ErrorCode = 'bad_signature' | 'malformed';
|
|
2
|
+
export declare class StrictHs256Error extends Error {
|
|
3
|
+
readonly code: StrictHs256ErrorCode;
|
|
4
|
+
constructor(code: StrictHs256ErrorCode, message: string);
|
|
5
|
+
}
|
|
6
|
+
export interface StrictHs256Parts {
|
|
7
|
+
payload: Record<string, unknown>;
|
|
8
|
+
}
|
|
9
|
+
export declare function verifyStrictHs256(token: string, signingSecret: string): StrictHs256Parts;
|
|
10
|
+
export declare function assertExactKeys(value: Record<string, unknown>, expected: readonly string[], label: string): void;
|
|
11
|
+
export declare function isFiniteInteger(value: unknown): value is number;
|
|
12
|
+
export declare function isNonEmptyString(value: unknown): value is string;
|
|
13
|
+
//# sourceMappingURL=strictHs256.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"strictHs256.d.ts","sourceRoot":"","sources":["../../../src/auth/strictHs256.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,WAAW,CAAA;AAEhE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;gBAEvB,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAKxD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAoBxF;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,EAAE,MAAM,GACZ,IAAI,CAMN;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEhE"}
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
import type { DatalakeRole } from '../types/Principal.ts';
|
|
2
|
+
import type { DatalakeToken } from '../types/Token.ts';
|
|
3
|
+
/**
|
|
4
|
+
* HS256 token layout used for data-plane access. The signature is a small
|
|
5
|
+
* subset of RFC 7519 — enough to interoperate with any JWT verifier but tiny
|
|
6
|
+
* enough to implement without pulling a full JWT library. Replace with a
|
|
7
|
+
* proper OIDC-signed JWT in P3.
|
|
8
|
+
*/
|
|
9
|
+
export interface TokenPayload {
|
|
10
|
+
/** Datalake id the token grants access to. */
|
|
11
|
+
dl: string;
|
|
12
|
+
/** Expiration (seconds since epoch). */
|
|
13
|
+
exp: number;
|
|
14
|
+
/** Issued-at (seconds since epoch). */
|
|
15
|
+
iat: number;
|
|
16
|
+
/** Unique token id — helpful for future revocation lists. */
|
|
17
|
+
jti: string;
|
|
18
|
+
/** Role granted. */
|
|
19
|
+
role: DatalakeRole;
|
|
20
|
+
/** Owner (user id) that minted the token. */
|
|
21
|
+
sub: string;
|
|
22
|
+
}
|
|
23
|
+
export interface SignTokenInput {
|
|
24
|
+
datalakeId: string;
|
|
25
|
+
ownerId: string;
|
|
26
|
+
role: DatalakeRole;
|
|
27
|
+
signingSecret: string;
|
|
28
|
+
ttlSeconds: number;
|
|
29
|
+
url: string;
|
|
30
|
+
}
|
|
31
|
+
export declare function signToken(input: SignTokenInput): DatalakeToken;
|
|
32
|
+
export type TokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid';
|
|
33
|
+
export declare class TokenVerificationError extends Error {
|
|
34
|
+
readonly code: TokenVerificationErrorCode;
|
|
35
|
+
constructor(code: TokenVerificationErrorCode, message: string);
|
|
36
|
+
}
|
|
37
|
+
export interface VerifyTokenInput {
|
|
38
|
+
/** Current wall-clock time (seconds since epoch). Injectable for tests. */
|
|
39
|
+
now?: number;
|
|
40
|
+
signingSecret: string;
|
|
41
|
+
token: string;
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* Verifies an HS256 token issued by `signToken` and returns its payload.
|
|
45
|
+
* Throws `TokenVerificationError` if the token is malformed, bears a bad
|
|
46
|
+
* signature, or has expired.
|
|
47
|
+
*/
|
|
48
|
+
export declare function verifyToken(input: VerifyTokenInput): TokenPayload;
|
|
49
|
+
//# sourceMappingURL=tokenCodec.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/tokenCodec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAKtD;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAA;IACV,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,YAAY,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAOD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAsB9D;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,CAAA;AAEpG,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAA;gBAE7B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAwCjE"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
export type { ApiErrorBody, ApiErrorCode } from './api/errors.ts';
|
|
2
|
+
export { API_ERROR_STATUS, DatalakeApiError } from './api/errors.ts';
|
|
3
|
+
export type { HealthResponse } from './api/health.ts';
|
|
4
|
+
export { DATALAKE_API_VERSION, datalakeCollectionPath, datalakeGrantPath, datalakeGrantsPath, datalakeHealthPath, datalakeResourcePath, datalakeTokensPath, } from './api/paths.ts';
|
|
5
|
+
export { DATALAKE_HEADER_DUPLICATES, DATALAKE_HEADER_NEXT_CURSOR, DATALAKE_HEADER_REJECTED, datalakePlaneClearPath, datalakePlaneDeletePath, datalakePlaneGetManyPath, datalakePlaneGetPath, datalakePlaneInsertPath, datalakePlaneNextPath, datalakePlaneResourcePath, datalakePlaneUsagePath, } from './api/planePaths.ts';
|
|
6
|
+
export type { CreateDatalakeBody, GrantBody, MintTokenBody, } from './api/requests.ts';
|
|
7
|
+
export type { AclEntry } from './types/AclEntry.ts';
|
|
8
|
+
export type { DatalakeInsertSummary, InsertPayloadsBody, InsertPayloadsResponse, InsertPayloadsResult, JsonObject, JsonPrimitive, JsonValue, NextPayloadsOptions, NextPayloadsResponse, NextPayloadsResult, Payload, StorageMeta, StoredPayload, WithStorageMeta, } from './types/BrowserPayload.ts';
|
|
9
|
+
export type { DatalakeConfig, RateLimitOverrides } from './types/DatalakeConfig.ts';
|
|
10
|
+
export type { DatalakeDescriptor, DatalakeUsage } from './types/DatalakeDescriptor.ts';
|
|
11
|
+
export type { DatalakePrincipal, DatalakeRole } from './types/Principal.ts';
|
|
12
|
+
export { isPublicPrincipal, PUBLIC_PRINCIPAL } from './types/Principal.ts';
|
|
13
|
+
export type { DatalakeRegion } from './types/Region.ts';
|
|
14
|
+
export { DATALAKE_REGIONS, DEFAULT_REGION } from './types/Region.ts';
|
|
15
|
+
export type { DatalakeControlOperation, DatalakeDataOperation, DatalakeOperation, } from './types/Scope.ts';
|
|
16
|
+
export { DATALAKE_CONTROL_AUDIENCE, DATALAKE_CONTROL_OPERATIONS, DATALAKE_CONTROL_SCOPE, DATALAKE_DATA_OPERATIONS, DATALAKE_DATA_SCOPE, DATALAKE_WALLET_JWT_SCHEMA, isDatalakeControlOperation, isDatalakeDataOperation, } from './types/Scope.ts';
|
|
17
|
+
export type { DatalakeStatus } from './types/Status.ts';
|
|
18
|
+
export type { DatalakeTier } from './types/Tier.ts';
|
|
19
|
+
export { DATALAKE_TIERS } from './types/Tier.ts';
|
|
20
|
+
export type { DatalakeToken } from './types/Token.ts';
|
|
21
|
+
//# sourceMappingURL=browser.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAAE,SAAS,EAAE,aAAa,GAC7C,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,SAAS,EACT,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,OAAO,EACP,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AACtF,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACpE,YAAY,EACV,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,GACnE,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
export type { ApiErrorBody, ApiErrorCode } from './api/errors.ts';
|
|
2
|
+
export { API_ERROR_STATUS, DatalakeApiError } from './api/errors.ts';
|
|
3
|
+
export type { HealthResponse } from './api/health.ts';
|
|
4
|
+
export { DATALAKE_API_VERSION, datalakeCollectionPath, datalakeGrantPath, datalakeGrantsPath, datalakeHealthPath, datalakeResourcePath, datalakeTokensPath, } from './api/paths.ts';
|
|
5
|
+
export { DATALAKE_HEADER_DUPLICATES, DATALAKE_HEADER_NEXT_CURSOR, DATALAKE_HEADER_REJECTED, datalakePlaneClearPath, datalakePlaneDeletePath, datalakePlaneGetManyPath, datalakePlaneGetPath, datalakePlaneInsertPath, datalakePlaneNextPath, datalakePlaneResourcePath, datalakePlaneUsagePath, } from './api/planePaths.ts';
|
|
6
|
+
export type { CreateDatalakeBody, GrantBody, MintTokenBody, } from './api/requests.ts';
|
|
7
|
+
export type { ChallengeTokenPayload, SessionTokenPayload, SessionTokenVerificationErrorCode, SignChallengeInput, SignedChallenge, SignedSessionToken, SignSessionTokenInput, VerifySessionTokenInput, } from './auth/sessionTokenCodec.ts';
|
|
8
|
+
export { SessionTokenVerificationError, signChallenge, signSessionToken, verifyChallenge, verifySessionToken, } from './auth/sessionTokenCodec.ts';
|
|
9
|
+
export type { SignTokenInput, TokenPayload, TokenVerificationErrorCode, VerifyTokenInput, } from './auth/tokenCodec.ts';
|
|
10
|
+
export { signToken, TokenVerificationError, verifyToken, } from './auth/tokenCodec.ts';
|
|
11
|
+
export type { DatalakeStore } from './store/DatalakeStore.ts';
|
|
12
|
+
export { ROLE_RANK } from './store/DatalakeStore.ts';
|
|
13
|
+
export type { AclEntry } from './types/AclEntry.ts';
|
|
14
|
+
export type { DatalakeConfig, RateLimitOverrides } from './types/DatalakeConfig.ts';
|
|
15
|
+
export type { DatalakeDescriptor, DatalakeUsage } from './types/DatalakeDescriptor.ts';
|
|
16
|
+
export type { DatalakeInsertSummary, InsertPayloadsBody, InsertPayloadsResponse, InsertPayloadsResult, NextPayloadsOptions, NextPayloadsResponse, NextPayloadsResult, Payload, StoredPayload, WithStorageMeta, } from './types/Payload.ts';
|
|
17
|
+
export type { DatalakePrincipal, DatalakeRole } from './types/Principal.ts';
|
|
18
|
+
export { isPublicPrincipal, PUBLIC_PRINCIPAL } from './types/Principal.ts';
|
|
19
|
+
export type { DatalakeRegion } from './types/Region.ts';
|
|
20
|
+
export { DATALAKE_REGIONS, DEFAULT_REGION } from './types/Region.ts';
|
|
21
|
+
export type { DatalakeControlOperation, DatalakeDataOperation, DatalakeOperation, } from './types/Scope.ts';
|
|
22
|
+
export { DATALAKE_CONTROL_AUDIENCE, DATALAKE_CONTROL_OPERATIONS, DATALAKE_CONTROL_SCOPE, DATALAKE_DATA_OPERATIONS, DATALAKE_DATA_SCOPE, DATALAKE_WALLET_JWT_SCHEMA, isDatalakeControlOperation, isDatalakeDataOperation, } from './types/Scope.ts';
|
|
23
|
+
export type { DatalakeStatus } from './types/Status.ts';
|
|
24
|
+
export type { DatalakeTier } from './types/Tier.ts';
|
|
25
|
+
export { DATALAKE_TIERS } from './types/Tier.ts';
|
|
26
|
+
export type { DatalakeToken } from './types/Token.ts';
|
|
27
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAAE,SAAS,EAAE,aAAa,GAC7C,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,iCAAiC,EACjC,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,6BAA6B,EAC7B,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,SAAS,EAAE,sBAAsB,EAAE,WAAW,GAC/C,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACpD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AACtF,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACpE,YAAY,EACV,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,GACnE,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}
|