@drakkar.software/starfish-client 3.0.0-alpha.0 → 3.0.0-alpha.2

package/dist/sync.js

@@ -0,0 +1,127 @@
+import { deepMerge, stableStringify } from "@drakkar.software/starfish-protocol";
+import { ConflictError } from "./types.js";
+import { createEncryptor } from "./crypto.js";
+import { ValidationError } from "./validate.js";
+export class SyncManager {
+    client;
+    pullPath;
+    pushPath;
+    onConflict;
+    maxRetries;
+    encryptor;
+    signData;
+    logger;
+    loggerName;
+    validate;
+    lastHash = null;
+    lastCheckpoint = 0;
+    localData = {};
+    constructor(options) {
+        this.client = options.client;
+        this.pullPath = options.pullPath;
+        this.pushPath = options.pushPath;
+        this.onConflict = options.onConflict ?? deepMerge;
+        this.maxRetries = options.maxRetries ?? 3;
+        this.signData = options.signData;
+        this.logger = options.logger;
+        this.loggerName = options.loggerName ?? options.pullPath.split("/").filter(Boolean).pop() ?? options.pullPath;
+        this.validate = options.validate;
+        this.encryptor =
+            options.encryptor ??
+                (options.encryptionSecret && options.encryptionSalt
+                    ? createEncryptor(options.encryptionSecret, options.encryptionSalt, options.encryptionInfo)
+                    : null);
+    }
+    getData() {
+        return { ...this.localData };
+    }
+    getHash() {
+        return this.lastHash;
+    }
+    getCheckpoint() {
+        return this.lastCheckpoint;
+    }
+    async pull() {
+        this.logger?.pullStart(this.loggerName);
+        const start = performance.now();
+        try {
+            const result = await this.client.pull(this.pullPath, this.lastCheckpoint);
+            if (this.encryptor) {
+                const decrypted = await this.encryptor.decrypt(result.data);
+                this.localData = decrypted;
+                result.data = decrypted;
+            }
+            else if (this.lastCheckpoint > 0) {
+                this.localData = deepMerge(this.localData, result.data);
+                result.data = this.localData;
+            }
+            else {
+                this.localData = result.data;
+            }
+            this.lastHash = result.hash;
+            this.lastCheckpoint = result.timestamp;
+            this.logger?.pullSuccess(this.loggerName, Math.round(performance.now() - start));
+            return result;
+        }
+        catch (err) {
+            this.logger?.pullError(this.loggerName, err instanceof Error ? err.message : String(err));
+            throw err;
+        }
+    }
+    async push(data) {
+        if (this.validate) {
+            const result = this.validate(data);
+            if (result !== true)
+                throw new ValidationError(result);
+        }
+        this.logger?.pushStart(this.loggerName);
+        const start = performance.now();
+        let attempt = 0;
+        let pendingData = data;
+        while (attempt <= this.maxRetries) {
+            try {
+                const payload = this.encryptor
+                    ? await this.encryptor.encrypt(pendingData)
+                    : pendingData;
+                const sig = this.signData
+                    ? await this.signData(stableStringify(payload))
+                    : undefined;
+                const result = await this.client.push(this.pushPath, payload, this.lastHash, sig);
+                this.lastHash = result.hash;
+                this.lastCheckpoint = result.timestamp;
+                this.localData = pendingData;
+                this.logger?.pushSuccess(this.loggerName, Math.round(performance.now() - start));
+                return result;
+            }
+            catch (err) {
+                if (!(err instanceof ConflictError) || attempt >= this.maxRetries) {
+                    this.logger?.pushError(this.loggerName, err instanceof Error ? err.message : String(err));
+                    throw err;
+                }
+                this.logger?.conflict(this.loggerName, attempt + 1);
+                try {
+                    const remote = await this.client.pull(this.pullPath);
+                    const remoteData = this.encryptor
+                        ? await this.encryptor.decrypt(remote.data)
+                        : remote.data;
+                    this.lastHash = remote.hash;
+                    this.lastCheckpoint = remote.timestamp;
+                    pendingData = this.onConflict(pendingData, remoteData);
+                }
+                catch (resolveErr) {
+                    const msg = resolveErr instanceof Error ? resolveErr.message : String(resolveErr);
+                    this.logger?.pushError(this.loggerName, `Conflict resolution failed (attempt ${attempt + 1}): ${msg}`);
+                    throw resolveErr;
+                }
+                await new Promise(resolve => setTimeout(resolve, Math.min(100 * Math.pow(2, attempt), 2000) + Math.random() * 100));
+                attempt++;
+            }
+        }
+        throw new ConflictError();
+    }
+    async update(modifier) {
+        await this.pull();
+        const updated = modifier(this.localData);
+        return this.push(updated);
+    }
+}

package/dist/types.d.ts

@@ -23,10 +23,17 @@ export interface StarfishCapProvider {
      * Returns the device's cap-cert and its Ed25519 private key (hex).
      * Implementations are expected to cache; the client may call this once per
      * authenticated request.
+     *
+     * For an `audience` (public-link) cap, which binds no single subject, also
+     * return `pubHex` — the redeemer's own Ed25519 pubkey matching `devEdPrivHex`.
+     * The client then sends it as `X-Starfish-Pub` so the server can verify the
+     * request signature against it and check the cap's `aud` allow-list. Omit
+     * `pubHex` for device/member caps (the server uses `cap.sub`).
      */
     getCap(): Promise<{
         cap: CapCert;
         devEdPrivHex: string;
+        pubHex?: string;
     }>;
 }
 /** Options for creating a StarfishClient. */

package/dist/types.js

@@ -0,0 +1,18 @@
+/** Push conflict error (HTTP 409). */
+export class ConflictError extends Error {
+    constructor() {
+        super("hash_mismatch");
+        this.name = "ConflictError";
+    }
+}
+/** HTTP error from the Starfish server. */
+export class StarfishHttpError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`HTTP ${status}: ${body}`);
+        this.status = status;
+        this.body = body;
+        this.name = "StarfishHttpError";
+    }
+}

package/dist/validate.js

@@ -0,0 +1,28 @@
+/** Error thrown when pre-push validation fails. */
+export class ValidationError extends Error {
+    errors;
+    constructor(errors) {
+        super(`Validation failed: ${errors.join("; ")}`);
+        this.errors = errors;
+        this.name = "ValidationError";
+    }
+}
+/**
+ * Creates a validator from a JSON Schema object.
+ * Requires an Ajv-compatible validate function.
+ *
+ * @example
+ * ```ts
+ * import Ajv from "ajv"
+ * const ajv = new Ajv()
+ * const validator = createSchemaValidator(ajv, mySchema)
+ * ```
+ */
+export function createSchemaValidator(ajv, schema) {
+    const validate = ajv.compile(schema);
+    return (data) => {
+        if (validate(data))
+            return true;
+        return [ajv.errorsText(validate.errors)];
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakkar.software/starfish-client",
-  "version": "3.0.0-alpha.0",
+  "version": "3.0.0-alpha.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/Drakkar-Software/starfish.git",
@@ -60,7 +60,7 @@
     }
   },
   "dependencies": {
-    "@drakkar.software/starfish-protocol": "3.0.0-alpha.0"
+    "@drakkar.software/starfish-protocol": "3.0.0-alpha.2"
   },
   "devDependencies": {
     "@legendapp/state": "^2.0.0",

package/dist/_crypto_helpers.d.ts

@@ -1,4 +0,0 @@
-export declare function hkdfBytes(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array, lengthBytes?: number): Promise<Uint8Array>;
-export declare function bytesToHex(bytes: Uint8Array): string;
-export declare function hexToBytes(hex: string): Uint8Array;
-export declare function concat(...parts: Uint8Array[]): Uint8Array;

package/dist/cap-mint.d.ts

@@ -1,20 +0,0 @@
-/**
- * Phase-2 transitional shim. `mintDeviceCap` + `scopes.rootAll` now live in
- * `@drakkar.software/starfish-identities`; `mintMemberCap` +
- * `scopes.readOnly`/`scopes.writer`/`scopes.admin` now live in
- * `@drakkar.software/starfish-sharing`. The `scopes` re-export here merges
- * both so existing imports of `import { scopes } from
- * "../src/cap-mint.js"` keep working. Removed in Phase 3.
- */
-import { type ScopePreset as IdentityScopePreset, type MintOpts as IdentityMintOpts } from "@drakkar.software/starfish-identities";
-export { mintDeviceCap } from "@drakkar.software/starfish-identities";
-export { mintMemberCap } from "@drakkar.software/starfish-sharing";
-/** @deprecated Phase-2 transitional facade. Use the per-package `scopes` directly. */
-export declare const scopes: {
-    readOnly: (c: string) => import("@drakkar.software/starfish-sharing").ScopePreset;
-    writer: (c: string) => import("@drakkar.software/starfish-sharing").ScopePreset;
-    admin: (c: string) => import("@drakkar.software/starfish-sharing").ScopePreset;
-    rootAll: () => IdentityScopePreset;
-};
-export type ScopePreset = IdentityScopePreset;
-export type MintOpts = IdentityMintOpts;

package/dist/cap-mint.js

@@ -1,12 +0,0 @@
-// src/cap-mint.ts
-import { scopes as identityScopes } from "@drakkar.software/starfish-identities";
-import { scopes as sharingScopes } from "@drakkar.software/starfish-sharing";
-import { mintDeviceCap } from "@drakkar.software/starfish-identities";
-import { mintMemberCap } from "@drakkar.software/starfish-sharing";
-var scopes = { ...identityScopes, ...sharingScopes };
-export {
-  mintDeviceCap,
-  mintMemberCap,
-  scopes
-};
-//# sourceMappingURL=cap-mint.js.map

package/dist/cap-mint.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/cap-mint.ts"],
-  "sourcesContent": ["/**\n * Phase-2 transitional shim. `mintDeviceCap` + `scopes.rootAll` now live in\n * `@drakkar.software/starfish-identities`; `mintMemberCap` +\n * `scopes.readOnly`/`scopes.writer`/`scopes.admin` now live in\n * `@drakkar.software/starfish-sharing`. The `scopes` re-export here merges\n * both so existing imports of `import { scopes } from\n * \"../src/cap-mint.js\"` keep working. Removed in Phase 3.\n */\nimport { scopes as identityScopes, type ScopePreset as IdentityScopePreset, type MintOpts as IdentityMintOpts } from \"@drakkar.software/starfish-identities\"\nimport { scopes as sharingScopes } from \"@drakkar.software/starfish-sharing\"\n\nexport { mintDeviceCap } from \"@drakkar.software/starfish-identities\"\nexport { mintMemberCap } from \"@drakkar.software/starfish-sharing\"\n\n/** @deprecated Phase-2 transitional facade. Use the per-package `scopes` directly. */\nexport const scopes = { ...identityScopes, ...sharingScopes }\n\nexport type ScopePreset = IdentityScopePreset\nexport type MintOpts = IdentityMintOpts\n"],
-  "mappings": ";AAQA,SAAS,UAAU,sBAAkG;AACrH,SAAS,UAAU,qBAAqB;AAExC,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAGvB,IAAM,SAAS,EAAE,GAAG,gBAAgB,GAAG,cAAc;",
-  "names": []
-}

package/dist/directory.d.ts

@@ -1,9 +0,0 @@
-/**
- * Phase-2 transitional shim. Device-directory helpers now live in
- * `@drakkar.software/starfish-identities`; member-directory helpers now live
- * in `@drakkar.software/starfish-sharing`. Removed in Phase 3.
- */
-export { addDeviceEntry, listDevices, removeDeviceEntry, devicesPathFor, } from "@drakkar.software/starfish-identities";
-export type { DirectoryEntry, Directory, DeviceEntry, ListDirectoryOpts, } from "@drakkar.software/starfish-identities";
-export { addMemberEntry, listMembers, removeMemberEntry, membersPathFor, } from "@drakkar.software/starfish-sharing";
-export type { MemberEntry } from "@drakkar.software/starfish-sharing";

package/dist/directory.js

@@ -1,24 +0,0 @@
-// src/directory.ts
-import {
-  addDeviceEntry,
-  listDevices,
-  removeDeviceEntry,
-  devicesPathFor
-} from "@drakkar.software/starfish-identities";
-import {
-  addMemberEntry,
-  listMembers,
-  removeMemberEntry,
-  membersPathFor
-} from "@drakkar.software/starfish-sharing";
-export {
-  addDeviceEntry,
-  addMemberEntry,
-  devicesPathFor,
-  listDevices,
-  listMembers,
-  membersPathFor,
-  removeDeviceEntry,
-  removeMemberEntry
-};
-//# sourceMappingURL=directory.js.map

package/dist/directory.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/directory.ts"],
-  "sourcesContent": ["/**\n * Phase-2 transitional shim. Device-directory helpers now live in\n * `@drakkar.software/starfish-identities`; member-directory helpers now live\n * in `@drakkar.software/starfish-sharing`. Removed in Phase 3.\n */\nexport {\n  addDeviceEntry,\n  listDevices,\n  removeDeviceEntry,\n  devicesPathFor,\n} from \"@drakkar.software/starfish-identities\"\nexport type {\n  DirectoryEntry,\n  Directory,\n  DeviceEntry,\n  ListDirectoryOpts,\n} from \"@drakkar.software/starfish-identities\"\n\nexport {\n  addMemberEntry,\n  listMembers,\n  removeMemberEntry,\n  membersPathFor,\n} from \"@drakkar.software/starfish-sharing\"\nexport type { MemberEntry } from \"@drakkar.software/starfish-sharing\"\n"],
-  "mappings": ";AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
-  "names": []
-}

package/dist/keyring.d.ts

@@ -1,6 +0,0 @@
-/**
- * Phase-2 transitional shim. The implementation lives in
- * `@drakkar.software/starfish-keyring`. This file is removed in Phase 3.
- */
-export { KEYRING_WRAP_SALT, KEYRING_WRAP_INFO, KEYRING_IV_BYTES, wrapForRecipient, unwrapFromEntry, verifyEntrySignature, createKeyring, addRecipient, rotateEpoch, createKeyringEncryptor, } from "@drakkar.software/starfish-keyring";
-export type { WrappedKeyEntry, KeyringEpoch, Keyring, KeyringEncryptor, } from "@drakkar.software/starfish-keyring";

package/dist/keyring.js

@@ -1,26 +0,0 @@
-// src/keyring.ts
-import {
-  KEYRING_WRAP_SALT,
-  KEYRING_WRAP_INFO,
-  KEYRING_IV_BYTES,
-  wrapForRecipient,
-  unwrapFromEntry,
-  verifyEntrySignature,
-  createKeyring,
-  addRecipient,
-  rotateEpoch,
-  createKeyringEncryptor
-} from "@drakkar.software/starfish-keyring";
-export {
-  KEYRING_IV_BYTES,
-  KEYRING_WRAP_INFO,
-  KEYRING_WRAP_SALT,
-  addRecipient,
-  createKeyring,
-  createKeyringEncryptor,
-  rotateEpoch,
-  unwrapFromEntry,
-  verifyEntrySignature,
-  wrapForRecipient
-};
-//# sourceMappingURL=keyring.js.map

package/dist/keyring.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/keyring.ts"],
-  "sourcesContent": ["/**\n * Phase-2 transitional shim. The implementation lives in\n * `@drakkar.software/starfish-keyring`. This file is removed in Phase 3.\n */\nexport {\n  KEYRING_WRAP_SALT,\n  KEYRING_WRAP_INFO,\n  KEYRING_IV_BYTES,\n  wrapForRecipient,\n  unwrapFromEntry,\n  verifyEntrySignature,\n  createKeyring,\n  addRecipient,\n  rotateEpoch,\n  createKeyringEncryptor,\n} from \"@drakkar.software/starfish-keyring\"\nexport type {\n  WrappedKeyEntry,\n  KeyringEpoch,\n  Keyring,\n  KeyringEncryptor,\n} from \"@drakkar.software/starfish-keyring\"\n"],
-  "mappings": ";AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
-  "names": []
-}

package/dist/pairing.d.ts

@@ -1,6 +0,0 @@
-/**
- * Phase-2 transitional shim. The implementation lives in
- * `@drakkar.software/starfish-identities`. Removed in Phase 3.
- */
-export { bootstrapRootIdentity, buildPairingQr, parsePairingQr, assemblePairingBundle, installPairingBundle, deriveCodeKey, buildPairingRequest, readPairingRequest, buildPairingResponse, readPairingResponse, } from "@drakkar.software/starfish-identities";
-export type { DeviceCredentials, PairingQrPayload, PairingBundle, WrappedCekEntry, InstalledPairingResult, AssemblePairingBundleOpts, PairingRequestEncrypted, PairingResponseEncrypted, } from "@drakkar.software/starfish-identities";

package/dist/pairing.js

@@ -1,26 +0,0 @@
-// src/pairing.ts
-import {
-  bootstrapRootIdentity,
-  buildPairingQr,
-  parsePairingQr,
-  assemblePairingBundle,
-  installPairingBundle,
-  deriveCodeKey,
-  buildPairingRequest,
-  readPairingRequest,
-  buildPairingResponse,
-  readPairingResponse
-} from "@drakkar.software/starfish-identities";
-export {
-  assemblePairingBundle,
-  bootstrapRootIdentity,
-  buildPairingQr,
-  buildPairingRequest,
-  buildPairingResponse,
-  deriveCodeKey,
-  installPairingBundle,
-  parsePairingQr,
-  readPairingRequest,
-  readPairingResponse
-};
-//# sourceMappingURL=pairing.js.map

package/dist/pairing.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/pairing.ts"],
-  "sourcesContent": ["/**\n * Phase-2 transitional shim. The implementation lives in\n * `@drakkar.software/starfish-identities`. Removed in Phase 3.\n */\nexport {\n  bootstrapRootIdentity,\n  buildPairingQr,\n  parsePairingQr,\n  assemblePairingBundle,\n  installPairingBundle,\n  deriveCodeKey,\n  buildPairingRequest,\n  readPairingRequest,\n  buildPairingResponse,\n  readPairingResponse,\n} from \"@drakkar.software/starfish-identities\"\nexport type {\n  DeviceCredentials,\n  PairingQrPayload,\n  PairingBundle,\n  WrappedCekEntry,\n  InstalledPairingResult,\n  AssemblePairingBundleOpts,\n  PairingRequestEncrypted,\n  PairingResponseEncrypted,\n} from \"@drakkar.software/starfish-identities\"\n"],
-  "mappings": ";AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
-  "names": []
-}

package/dist/recipients.d.ts

@@ -1,6 +0,0 @@
-/**
- * Phase-2 transitional shim. The implementation lives in
- * `@drakkar.software/starfish-keyring`. This file is removed in Phase 3.
- */
-export { keyringPathFor, addCollectionRecipient, removeRecipient, listRecipients, currentEpoch, } from "@drakkar.software/starfish-keyring";
-export type { RecipientRef, AdderKeys, ListedRecipient, } from "@drakkar.software/starfish-keyring";

package/dist/recipients.js

@@ -1,16 +0,0 @@
-// src/recipients.ts
-import {
-  keyringPathFor,
-  addCollectionRecipient,
-  removeRecipient,
-  listRecipients,
-  currentEpoch
-} from "@drakkar.software/starfish-keyring";
-export {
-  addCollectionRecipient,
-  currentEpoch,
-  keyringPathFor,
-  listRecipients,
-  removeRecipient
-};
-//# sourceMappingURL=recipients.js.map

package/dist/recipients.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/recipients.ts"],
-  "sourcesContent": ["/**\n * Phase-2 transitional shim. The implementation lives in\n * `@drakkar.software/starfish-keyring`. This file is removed in Phase 3.\n */\nexport {\n  keyringPathFor,\n  addCollectionRecipient,\n  removeRecipient,\n  listRecipients,\n  currentEpoch,\n} from \"@drakkar.software/starfish-keyring\"\nexport type {\n  RecipientRef,\n  AdderKeys,\n  ListedRecipient,\n} from \"@drakkar.software/starfish-keyring\"\n"],
-  "mappings": ";AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
-  "names": []
-}