@cruba/crubal-host 0.0.0-stage → 0.3.0

package/dist/src/schema.sql

@@ -0,0 +1,128 @@
+-- The host's own schema (docs/design/host.md): owners and their keys, identities and API keys. Nothing of
+-- an owner's data lives here; that is the store's. Private keys are here only in the reference host's
+-- simplest form; a platform keeps them in a key store or a KMS and leaves `private` empty.
+
+create table if not exists host_owners (
+  owner text primary key,
+  public text not null,
+  private text,
+  created text not null
+);
+
+create table if not exists host_api_keys (
+  key_hash text primary key,
+  owner text not null,
+  caller text not null,
+  label text,
+  created text not null
+);
+
+-- The reference index (docs/design/index-and-forms.md): the current rows per view and audience, applied from
+-- the projection stream, and where it is in each stream. Searchable over the row's text slots.
+create table if not exists index_rows (
+  owner text not null,
+  view text not null,
+  version text not null,
+  audience text not null,
+  record text not null,
+  row jsonb not null,
+  buckets jsonb not null default '{}',
+  marks jsonb,
+  ancestors text[] not null default '{}',
+  sort jsonb not null default '[]',
+  pin integer,
+  seq bigint not null,
+  search tsvector,
+  primary key (owner, view, version, audience, record)
+);
+create index if not exists index_rows_search on index_rows using gin (search);
+-- Picks are containments on the buckets document; the first pages of a view in its stored order come off this index.
+create index if not exists index_rows_buckets on index_rows using gin (buckets);
+create index if not exists index_rows_order on index_rows (owner, view, version, audience, pin, (sort ->> 0), (sort ->> 1), (sort ->> 2), record);
+-- The platform index (14.8, 14.10): rows reached by an edge on an ancestor, across owners.
+create index if not exists index_rows_ancestors on index_rows using gin (ancestors);
+create index if not exists index_rows_record on index_rows (record);
+
+create table if not exists index_cursors (
+  owner text not null,
+  view text not null,
+  version text not null,
+  audience text not null,
+  seq bigint not null default 0,
+  primary key (owner, view, version, audience)
+);
+
+-- Credentials behind a contract's name (docs/design/host.md, "Outbound"). The reference host keeps the
+-- material here; a platform keeps it in a vault behind the same interface and leaves `material` empty.
+create table if not exists host_credentials (
+  owner text not null,
+  name text not null,
+  scheme text not null,
+  material jsonb not null,
+  scopes text[] not null default '{}',
+  expires text,
+  connected text not null,
+  primary key (owner, name)
+);
+
+create table if not exists host_identities (
+  provider text not null,
+  subject text not null,
+  owner text not null,
+  caller text not null,
+  primary key (provider, subject)
+);
+
+-- Link offers (7.8 `to: link`): one unguessable token per offer; unpublishing revokes, republishing keeps it.
+create table if not exists host_offer_links (
+  owner text not null,
+  contract text not null,
+  token text not null,
+  revoked boolean not null default false,
+  primary key (owner, contract)
+);
+
+-- Retired signing keys (11.7): each with the span it signed in, so a rotated key still verifies.
+create table if not exists host_keys (
+  owner text not null,
+  public text not null,
+  "from" text,
+  until text not null,
+  primary key (owner, public)
+);
+
+-- A system acting for a hosted person (14.9): what the person allowed, narrowed to items, until when, gated
+-- until they lift it. Revoking keeps the row with when. Identity-adjacent, so the host's, like API keys.
+create table if not exists host_acting_for (
+  id bigint generated always as identity primary key,
+  system_owner text not null,
+  system text not null,
+  person text not null,
+  items text[] not null default '{}',
+  until text,
+  gated boolean not null default true,
+  created text not null,
+  revoked text
+);
+create index if not exists host_acting_for_person on host_acting_for (person);
+
+-- Packages an owner publishes from this host (11.5, 11.7): each version's signed bundle and its text, listed in
+-- the well-known file and served at /packages/<owner>/<name>/<version>/. A published version never changes.
+create table if not exists host_published (
+  owner text not null,
+  package text not null,
+  version text not null,
+  hash text not null,
+  json jsonb not null,
+  text text not null,
+  published text not null,
+  primary key (owner, package, version)
+);
+
+-- When each view with a delay (12.6 fresh: 5m) was last published by the loop.
+create table if not exists host_publish (
+  owner text not null,
+  view text not null,
+  at text not null,
+  primary key (owner, view)
+);

package/dist/src/secrets.d.ts

@@ -0,0 +1,21 @@
+export type SecretStore = {
+    get(owner: string, name: string): Promise<string | undefined>;
+    /** Optional: a store that can be written to (the table can; the environment can't). */
+    set?(owner: string, name: string, value: string): Promise<void>;
+};
+/** Secrets from the environment: `CRUBAL_SECRET_<OWNER>_<NAME>`. */
+export declare class EnvSecrets implements SecretStore {
+    get(owner: string, name: string): Promise<string | undefined>;
+}
+/** Secrets from a function the host was configured with (a vault client, a file). */
+export declare class FunctionSecrets implements SecretStore {
+    private readonly fn;
+    constructor(fn: (owner: string, name: string) => string | undefined | Promise<string | undefined>);
+    get(owner: string, name: string): Promise<string | undefined>;
+}
+/** Several stores asked in order; the first answer wins. */
+export declare class ChainedSecrets implements SecretStore {
+    private readonly stores;
+    constructor(stores: SecretStore[]);
+    get(owner: string, name: string): Promise<string | undefined>;
+}

package/dist/src/secrets.js

@@ -0,0 +1,36 @@
+// secrets.ts: where credentials' secrets live (docs/design/host.md "What is kept where"). The host asks a
+// SecretStore by (owner, name); the environment serves one owner, the credentials table serves many, and a
+// vault is another implementation of the same two calls. Adapters never see names, only the material.
+const envName = (s) => s.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
+/** Secrets from the environment: `CRUBAL_SECRET_<OWNER>_<NAME>`. */
+export class EnvSecrets {
+    async get(owner, name) {
+        return process.env[`CRUBAL_SECRET_${envName(owner)}_${envName(name)}`];
+    }
+}
+/** Secrets from a function the host was configured with (a vault client, a file). */
+export class FunctionSecrets {
+    fn;
+    constructor(fn) {
+        this.fn = fn;
+    }
+    async get(owner, name) {
+        return this.fn(owner, name);
+    }
+}
+/** Several stores asked in order; the first answer wins. */
+export class ChainedSecrets {
+    stores;
+    constructor(stores) {
+        this.stores = stores;
+    }
+    async get(owner, name) {
+        for (const s of this.stores) {
+            const v = await s.get(owner, name);
+            if (v !== undefined)
+                return v;
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/src/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,2GAA2G;AAC3G,sGAAsG;AAQtG,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAE7E,oEAAoE;AACpE,MAAM,OAAO,UAAU;IACrB,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAY;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,eAAe;IACT,EAAE,CAAoF;IACvG,YAAY,EAAqF;QAC/F,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAY;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,cAAc;IACR,MAAM,CAAgB;IACvC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAY;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/src/server.d.ts

@@ -0,0 +1,41 @@
+import { type Server } from "node:http";
+import type { Host } from "./host.ts";
+/**
+ * A request as the host sees it, whatever carried it: the node server below, or a route in an app that runs
+ * the host in process. `url` is the path and query as node gives it; the origin a signature covers comes
+ * from the `host` and `x-forwarded-proto` headers; the body is already read, once, so a digest can cover it.
+ */
+export type HostRequest = {
+    method: string;
+    url: string;
+    headers: {
+        [h: string]: string | string[] | undefined;
+    };
+    body: string;
+};
+/** What a request's log line and CORS need, set as the request is understood. */
+export type Seen = {
+    owner?: string;
+    caller?: string;
+    route?: string;
+};
+export type HostReply = {
+    status: number;
+    headers: {
+        [h: string]: string;
+    };
+    body: string;
+    seen: Seen;
+};
+/**
+ * Answer one request. Every route is here, owner-scoped, the same for every owner; errors become a JSON
+ * body with their status. Transports call this: `serve` for node, an app's route for in-process hosting.
+ */
+export declare function handle(host: Host, req: HostRequest): Promise<HostReply>;
+/** One structured line per request, when it has been answered. */
+export declare function logLine(host: Host, req: {
+    method: string;
+    url: string;
+}, reply: HostReply, started: number): void;
+/** The node server: reads each request, hands it to `handle`, writes the reply, logs the line. */
+export declare function serve(host: Host): Server;