@feltdb/core 0.5.6 → 0.6.0

package/dist/cli/commands.js

@@ -8,6 +8,7 @@ import net from 'net';
 import { createRequire } from 'module';
 import { spawn, spawnSync } from 'child_process';
 import { createFeltDB, diffFlowSpec, formatFlowSpec, parseFlowSpec, planFlowSpecMigration, validateFlowSpec } from '@feltdb/core';
+import { discoverWorkspace, generatePairingToken, persistPairingToken, displayWorkspaceStatus } from './workspace-integration.js';
 function loadProjectEnvironment(file = path.resolve('.env.local')) {
     if (!fs.existsSync(file))
         return;
@@ -49,6 +50,8 @@ export async function handleCommand(command, args) {
             return handleConnect(args);
         case 'status':
             return handleStatus();
+        case 'workspace':
+            return handleWorkspace(args);
         case 'dev':
             return handleDev(args);
         case 'build':
@@ -365,6 +368,51 @@ async function handleStatus() {
     console.log('Workflows:    5');
     console.log('Health:       ✓\n');
 }
+async function handleWorkspace(args) {
+    const subcommand = args[0] || 'status';
+    switch (subcommand) {
+        case 'status':
+            return handleWorkspaceStatus();
+        case 'info':
+            return handleWorkspaceInfo();
+        case 'connect':
+            return handleWorkspaceConnect(args.slice(1));
+        default:
+            console.error(`Unknown workspace subcommand: ${subcommand}`);
+            process.exit(1);
+    }
+}
+async function handleWorkspaceStatus() {
+    displayWorkspaceStatus(process.cwd());
+}
+async function handleWorkspaceInfo() {
+    const workspace = discoverWorkspace(process.cwd());
+    if (!workspace) {
+        console.log('❌ No Development Workspace found');
+        console.log('   Run "feltdb dev" to initialize the workspace');
+        return;
+    }
+    console.log('\n📋 Workspace Information\n');
+    console.log(`   Workspace ID: ${workspace.workspaceId}`);
+    console.log(`   Project:      ${workspace.projectId}`);
+    console.log(`   Version:      ${workspace.version}`);
+    console.log(`   Location:     .feltdb/workspace.json\n`);
+    console.log('   This workspace enables:');
+    console.log('   • Browser extensions to discover and connect');
+    console.log('   • IDE integrations to share state');
+    console.log('   • Agents to coordinate through the same interface');
+    console.log('   • CLI to manage workspace discovery\n');
+}
+async function handleWorkspaceConnect(args) {
+    const workspaceId = args[0];
+    if (!workspaceId) {
+        console.error('Usage: feltdb workspace connect <workspace-id>');
+        process.exit(1);
+    }
+    console.log(`🔗 Connecting to workspace: ${workspaceId}`);
+    console.log('   This feature will be implemented in the next phase');
+    console.log('   (when @feltdb/client workspace APIs are available)\n');
+}
 function runLocalVite(args, waitForExit) {
     const executable = process.platform === 'win32' ? 'npm.cmd' : 'npm';
     const child = spawn(executable, ['exec', '--', 'vite', ...args], {
@@ -432,11 +480,30 @@ async function handleDev(args) {
         selfHostedStarted = true;
         (_c = process.env).VITE_FELTDB_URL || (_c.VITE_FELTDB_URL = 'http://127.0.0.1:7700');
     }
+    // Initialize Development Workspace
+    // This enables all FeltDB-aware tools to discover and connect to the same workspace
+    const workspace = discoverWorkspace(process.cwd());
+    let pairingToken = null;
+    if (workspace) {
+        const token = generatePairingToken();
+        token.workspaceId = workspace.workspaceId;
+        persistPairingToken(process.cwd(), token);
+        pairingToken = token.token;
+    }
     console.log('FeltDB Dev Server');
     console.log(`  Namespace: ${config.namespace}`);
     console.log(`  Runtime: ${config.runtime}`);
     console.log(`  Storage: ${config.storage}`);
-    console.log(`  Distributed: ${config.distributed}\n`);
+    console.log(`  Distributed: ${config.distributed}`);
+    if (workspace) {
+        console.log(`  Workspace: ${workspace.workspaceId}\n`);
+        console.log(`🔗 Development Workspace`);
+        if (pairingToken) {
+            console.log(`  Pairing Code: ${pairingToken}`);
+            console.log(`  Clients can use this code to auto-discover the workspace`);
+        }
+    }
+    console.log();
     const open = !args.includes('--no-open');
     console.log(`Application: http://127.0.0.1:${appPort}`);
     console.log(`Studio:      http://127.0.0.1:${studioPort}\n`);

package/dist/cli/workspace-integration.js

@@ -0,0 +1,96 @@
+/**
+ * FeltDB Development Workspace Integration
+ *
+ * Integrates Development Workspace support into the CLI:
+ * - Discovers workspace identity from .feltdb/workspace.json
+ * - Launches Development Workspace authority via getDevelopmentNode()
+ * - Manages pairing tokens for browser/IDE discovery
+ * - Provides workspace status and connection information
+ */
+import fs from 'fs';
+import path from 'path';
+import { randomBytes } from 'crypto';
+/**
+ * Discover workspace identity from .feltdb/workspace.json
+ * Returns null if workspace is not initialized
+ */
+export function discoverWorkspace(projectDir) {
+    const workspacePath = path.join(projectDir, '.feltdb', 'workspace.json');
+    if (!fs.existsSync(workspacePath)) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(workspacePath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch (error) {
+        console.error('Failed to read workspace.json:', error);
+        return null;
+    }
+}
+/**
+ * Generate a short-lived pairing token for browser/IDE discovery
+ * Format: FELT-XXXX (6 random alphanumeric characters)
+ * Expires in 15 minutes
+ */
+export function generatePairingToken() {
+    const randomPart = randomBytes(4).toString('hex').toUpperCase().slice(0, 6);
+    const token = `FELT-${randomPart}`;
+    const expiresAt = Date.now() + 15 * 60 * 1000; // 15 minutes
+    return { token, workspaceId: '', expiresAt };
+}
+/**
+ * Persist pairing token to .feltdb/pairing.json
+ * This file should be gitignored but is readable by clients
+ */
+export function persistPairingToken(projectDir, token) {
+    const feltdbDir = path.join(projectDir, '.feltdb');
+    if (!fs.existsSync(feltdbDir)) {
+        fs.mkdirSync(feltdbDir, { recursive: true });
+    }
+    const pairingPath = path.join(feltdbDir, 'pairing.json');
+    fs.writeFileSync(pairingPath, JSON.stringify(token, null, 2) + '\n');
+}
+/**
+ * Read pairing token from .feltdb/pairing.json
+ * Returns null if token doesn't exist or has expired
+ */
+export function readPairingToken(projectDir) {
+    const pairingPath = path.join(projectDir, '.feltdb', 'pairing.json');
+    if (!fs.existsSync(pairingPath)) {
+        return null;
+    }
+    try {
+        const content = fs.readFileSync(pairingPath, 'utf-8');
+        const token = JSON.parse(content);
+        // Check if token has expired
+        if (token.expiresAt && Date.now() > token.expiresAt) {
+            return null;
+        }
+        return token;
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * Display workspace status information
+ */
+export function displayWorkspaceStatus(projectDir) {
+    const workspace = discoverWorkspace(projectDir);
+    if (!workspace) {
+        console.log('❌ No Development Workspace found');
+        console.log('   Run "feltdb dev" to initialize the workspace');
+        return;
+    }
+    const pairingToken = readPairingToken(projectDir);
+    console.log('\n🔗 FeltDB Development Workspace\n');
+    console.log(`   Project:     ${workspace.projectId}`);
+    console.log(`   Workspace:   ${workspace.workspaceId}`);
+    if (pairingToken) {
+        console.log(`   Pairing:     ${pairingToken.token}`);
+        const minutesRemaining = Math.ceil((pairingToken.expiresAt - Date.now()) / 60000);
+        console.log(`   Expires in:  ${minutesRemaining} minutes`);
+    }
+    console.log('\n   Location:    .feltdb/workspace.json\n');
+}

package/dist/create/cli.js

@@ -307,7 +307,7 @@ Learn more: https://github.com/rkendel1/feltdb`);
         await createProject({
             projectName,
             autoYes: shouldAutoYes,
-            templatesDir: path.join(__dirname, '../templates'),
+            templatesDir: path.join(__dirname, '../template'),
             runtime: options.runtime,
             framework: options.framework,
             distributed: options.distributed,

package/dist/create/create.js

@@ -6,6 +6,7 @@ import path from 'path';
 import { randomBytes } from 'crypto';
 import { feltdbPackageRange } from './package-versions.js';
 import { generateDockerCompose, generateDockerfile, generateDockerIgnore, generateDotEnvLocal, generateFeltDBDockerfile, generateStudioDockerfile, } from './docker-compose-generator.js';
+import { initializeWorkspace, appendWorkspaceGitignore, } from './workspace-initialization.js';
 export async function createProject(options) {
     const { projectName, templatesDir } = options;
     const projectDir = path.resolve(process.cwd(), projectName);
@@ -1759,4 +1760,24 @@ If port 5173 is in use:
 MIT
 `;
     fs.writeFileSync(path.join(projectDir, 'README.md'), readme);
+    // Initialize Development Workspace
+    // This creates .feltdb/workspace.json which enables all FeltDB-aware tools
+    // (CLI, IDE, agents, browser extensions) to discover and connect to the
+    // same workspace without manual configuration.
+    const workspaceDiscovery = initializeWorkspace(projectDir, applicationName);
+    appendWorkspaceGitignore(projectDir);
+    // Copy .feltdb README from template
+    const templateReadmePath = path.join(templatesDir, 'dot-feltdb-README.md');
+    const targetReadmePath = path.join(projectDir, '.feltdb', 'README.md');
+    if (fs.existsSync(templateReadmePath)) {
+        fs.copyFileSync(templateReadmePath, targetReadmePath);
+    }
+    console.log(`\n✓ Development Workspace initialized`);
+    console.log(`  Workspace ID: ${workspaceDiscovery.workspaceId}`);
+    console.log(`  Location: ${path.join(projectName, '.feltdb/workspace.json')}`);
+    console.log(`\nNext steps:`);
+    console.log(`  cd ${projectName}`);
+    console.log(`  npm install`);
+    console.log(`  npm run dev`);
+    console.log(`\nYour Development Workspace is ready for use!`);
 }

package/dist/create/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.6';
+export const FELTDB_PACKAGE_VERSION = '0.6.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/create/server-source/Cargo.lock

@@ -513,6 +513,7 @@ dependencies = [
  "base64",
  "feltdb",
  "futures-core",
+ "hmac",
  "password-hash",
  "rand 0.8.7",
  "reqwest",
@@ -668,6 +669,15 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"

package/dist/create/server-source/crates/feltdb-server/Cargo.toml

@@ -9,6 +9,7 @@ async-stream = "0.3"
 argon2 = "0.5"
 password-hash = "0.5"
 base64 = "0.22"
+hmac = "0.12"
 feltdb = { path = "../feltdb" }
 futures-core = "0.3"
 rand = "0.8"

package/dist/create/server-source/crates/feltdb-server/src/app_state.rs

@@ -1,5 +1,8 @@
-use std::sync::{atomic::AtomicU64, Arc};
 use std::path::PathBuf;
+use std::{
+    sync::{atomic::AtomicU64, Arc},
+    time::Instant,
+};
 
 use feltdb::{
     FeltDb,
@@ -33,6 +36,7 @@ use crate::{
 
 #[derive(Clone)]
 pub struct AppState {
+    pub started_at: Instant,
     pub db: FeltDb,
     pub namespace: Arc<str>,
     pub ids: Arc<AtomicU64>,

package/dist/create/server-source/crates/feltdb-server/src/authenticated_principal.rs

@@ -0,0 +1,273 @@
+use serde::{Deserialize, Serialize};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Authenticated principal derived exclusively from verified credentials.
+/// Never derived from request body or untrusted sources.
+/// Available to authorization evaluation and included in request context.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticatedPrincipal {
+    /// ID of the service key used for authentication.
+    /// Preserved separately from actorId for auditing.
+    pub service_key_id: String,
+
+    /// ID of the actor (user, service, workload, etc.) performing the operation.
+    pub actor_id: String,
+
+    /// Tenant ID from authenticated credentials.
+    pub tenant_id: String,
+
+    /// Roles granted to this principal.
+    pub roles: Vec<String>,
+
+    /// Authentication method used.
+    pub auth_method: AuthMethod,
+
+    /// When this principal was authenticated.
+    pub authenticated_at: u64,
+
+    /// Provenance tracking for audit.
+    pub provenance: AuthenticationProvenance,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum AuthMethod {
+    ApiKey,
+    Session,
+    Delegation,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticationProvenance {
+    /// Source of the credential (e.g., "bearer_token", "session_cookie", "delegation_token").
+    pub credential_source: String,
+
+    /// Hash of the credential for audit purposes (never the credential itself).
+    pub credential_hash: Option<String>,
+
+    /// Additional context about the authentication.
+    pub context: String,
+}
+
+impl AuthenticatedPrincipal {
+    /// Creates a new AuthenticatedPrincipal from API key authentication.
+    pub fn from_api_key(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::ApiKey,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "bearer_token".into(),
+                credential_hash: None,
+                context: "API key authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from session authentication.
+    pub fn from_session(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Session,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "session_cookie".into(),
+                credential_hash: None,
+                context: "Session authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from delegation token.
+    pub fn from_delegation(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+        delegation_context: String,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Delegation,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "delegation_token".into(),
+                credential_hash: None,
+                context: delegation_context,
+            },
+        }
+    }
+
+    /// Checks if this principal has a specific role.
+    pub fn has_role(&self, role: &str) -> bool {
+        self.roles.iter().any(|r| r == role || r == "*")
+    }
+
+    /// Checks if actor_id matches expected value, rejecting mismatches.
+    pub fn verify_actor_id(&self, expected: &str) -> Result<(), String> {
+        if self.actor_id != expected {
+            Err(format!(
+                "actor_id mismatch: authenticated as {} but operation requested {}",
+                self.actor_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Checks if tenant_id matches expected value, rejecting mismatches.
+    pub fn verify_tenant_id(&self, expected: &str) -> Result<(), String> {
+        if self.tenant_id != expected {
+            Err(format!(
+                "tenant_id mismatch: authenticated for {} but operation requested {}",
+                self.tenant_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn authenticated_principal_preserves_separation() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["read".into(), "write".into()],
+        );
+
+        assert_eq!(principal.service_key_id, "key_abc123");
+        assert_eq!(principal.actor_id, "user_xyz");
+        assert_eq!(principal.tenant_id, "tenant_prod");
+        assert_eq!(principal.auth_method, AuthMethod::ApiKey);
+    }
+
+    #[test]
+    fn verify_actor_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_other").is_err());
+    }
+
+    #[test]
+    fn verify_tenant_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_other").is_err());
+    }
+
+    #[test]
+    fn has_role_works_correctly() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["admin".into(), "viewer".into()],
+        );
+
+        assert!(principal.has_role("admin"));
+        assert!(principal.has_role("viewer"));
+        assert!(!principal.has_role("editor"));
+    }
+
+    #[test]
+    fn wildcard_role_matches_all() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["*".into()],
+        );
+
+        assert!(principal.has_role("any_role"));
+        assert!(principal.has_role("admin"));
+    }
+
+    #[test]
+    fn from_session_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_session(
+            "key_session".into(),
+            "user_abc".into(),
+            "tenant_staging".into(),
+            vec!["viewer".into()],
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Session);
+        assert_eq!(principal.provenance.credential_source, "session_cookie");
+    }
+
+    #[test]
+    fn from_delegation_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_delegation(
+            "key_delegated".into(),
+            "service_xyz".into(),
+            "tenant_prod".into(),
+            vec!["execute".into()],
+            "delegated from sherpa".into(),
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Delegation);
+        assert_eq!(principal.provenance.credential_source, "delegation_token");
+        assert_eq!(principal.provenance.context, "delegated from sherpa");
+    }
+
+    #[test]
+    fn multiple_calls_to_verify_preserve_state() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        // Verify multiple times to ensure no state mutation
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+    }
+}