@hediet/linkrpc-hub 0.0.1

package/dist/chunks/connectionTokenBinder.interfaces-B-beCg06.js

@@ -0,0 +1,40 @@
+import { defineInterface, requestType } from "@hediet/linkrpc";
+import { number, object, optional, string } from "zod/mini";
+//#region src/hub/server/connectionTokenBinder.interfaces.ts
+/**
+* Privileged **connection-token binder**, served by a trusted, hub-spawned
+* endpoint that carries a `connectionTokenBinder` grant. It mints a single-use
+* `hubrpc::initialize` token that binds up to two independent things for a
+* **future** peer connection:
+*
+* - an `identitySlot` — the managed identity the peer inherits (`identity::*`),
+*   authorized against the binder's `identitySlotPrefix`; and
+* - a `serviceIdNamespace` — the serviceId namespace the peer may claim freely
+*   (`hubGrantedServiceId::get`), authorized against the binder's
+*   `serviceIdPrefix`.
+*
+* Both request fields are optional and authorized independently: omit a field
+* to leave that axis unbound. The peer later presents the returned token in its
+* `hubrpc::initialize` handshake on a `managedIdentity: { mode: "fromToken" }`
+* and/or `grantedServiceId: { mode: "fromToken" }` listener, which redeems it.
+*
+* This is the broker side of the token model: the caller asks the hub to issue a
+* credential for **another** (future) connection — distinct from `identity::*`
+* (which is about the caller's *own* identity). Minting is authorized purely by
+* the binder's configured prefixes: each requested field must fall under its
+* corresponding prefix.
+*/
+const connectionTokenBinderInterface = defineInterface({
+	id: "connectionTokenBinder",
+	description: "Privileged connection-token binder: mints single-use hubrpc::initialize tokens binding an identity slot and/or a serviceId namespace, for redemption by a peer on a `managedIdentity` / `grantedServiceId` { mode: \"fromToken\" } listener. Each field is authorized against the binder's identitySlotPrefix / serviceIdPrefix."
+}, { bindConnectionToken: requestType(object({
+	identitySlot: optional(string()),
+	serviceIdNamespace: optional(string())
+}), object({
+	token: string(),
+	expiresAt: number()
+})) });
+//#endregion
+export { connectionTokenBinderInterface as t };
+
+//# sourceMappingURL=connectionTokenBinder.interfaces-B-beCg06.js.map

package/dist/chunks/connectionTokenBinder.interfaces-B-beCg06.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionTokenBinder.interfaces-B-beCg06.js","names":[],"sources":["../../src/hub/server/connectionTokenBinder.interfaces.ts"],"sourcesContent":["import { number, object, optional, string } from 'zod/mini';\nimport { defineInterface, requestType } from '@hediet/linkrpc';\n\n/**\n * Privileged **connection-token binder**, served by a trusted, hub-spawned\n * endpoint that carries a `connectionTokenBinder` grant. It mints a single-use\n * `hubrpc::initialize` token that binds up to two independent things for a\n * **future** peer connection:\n *\n * - an `identitySlot` — the managed identity the peer inherits (`identity::*`),\n *   authorized against the binder's `identitySlotPrefix`; and\n * - a `serviceIdNamespace` — the serviceId namespace the peer may claim freely\n *   (`hubGrantedServiceId::get`), authorized against the binder's\n *   `serviceIdPrefix`.\n *\n * Both request fields are optional and authorized independently: omit a field\n * to leave that axis unbound. The peer later presents the returned token in its\n * `hubrpc::initialize` handshake on a `managedIdentity: { mode: \"fromToken\" }`\n * and/or `grantedServiceId: { mode: \"fromToken\" }` listener, which redeems it.\n *\n * This is the broker side of the token model: the caller asks the hub to issue a\n * credential for **another** (future) connection — distinct from `identity::*`\n * (which is about the caller's *own* identity). Minting is authorized purely by\n * the binder's configured prefixes: each requested field must fall under its\n * corresponding prefix.\n */\nexport const connectionTokenBinderInterface = defineInterface(\n    {\n        id: 'connectionTokenBinder',\n        description:\n            'Privileged connection-token binder: mints single-use ' +\n            'hubrpc::initialize tokens binding an identity slot and/or a ' +\n            'serviceId namespace, for redemption by a peer on a `managedIdentity` ' +\n            '/ `grantedServiceId` { mode: \"fromToken\" } listener. Each field is ' +\n            \"authorized against the binder's identitySlotPrefix / serviceIdPrefix.\",\n    },\n    {\n        bindConnectionToken: requestType(\n            object({\n                identitySlot: optional(string()),\n                serviceIdNamespace: optional(string()),\n            }),\n            object({ token: string(), expiresAt: number() }),\n        ),\n    },\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,iCAAiC,gBAC1C;CACI,IAAI;CACJ,aACI;AAKR,GACA,EACI,qBAAqB,YACjB,OAAO;CACH,cAAc,SAAS,OAAO,CAAC;CAC/B,oBAAoB,SAAS,OAAO,CAAC;AACzC,CAAC,GACD,OAAO;CAAE,OAAO,OAAO;CAAG,WAAW,OAAO;AAAE,CAAC,CACnD,EACJ,CACJ"}

package/dist/chunks/connectionTokenBinder.interfaces-BhzQ1DTS.d.ts

@@ -0,0 +1,36 @@
+//#region src/hub/server/connectionTokenBinder.interfaces.d.ts
+/**
+ * Privileged **connection-token binder**, served by a trusted, hub-spawned
+ * endpoint that carries a `connectionTokenBinder` grant. It mints a single-use
+ * `hubrpc::initialize` token that binds up to two independent things for a
+ * **future** peer connection:
+ *
+ * - an `identitySlot` — the managed identity the peer inherits (`identity::*`),
+ *   authorized against the binder's `identitySlotPrefix`; and
+ * - a `serviceIdNamespace` — the serviceId namespace the peer may claim freely
+ *   (`hubGrantedServiceId::get`), authorized against the binder's
+ *   `serviceIdPrefix`.
+ *
+ * Both request fields are optional and authorized independently: omit a field
+ * to leave that axis unbound. The peer later presents the returned token in its
+ * `hubrpc::initialize` handshake on a `managedIdentity: { mode: "fromToken" }`
+ * and/or `grantedServiceId: { mode: "fromToken" }` listener, which redeems it.
+ *
+ * This is the broker side of the token model: the caller asks the hub to issue a
+ * credential for **another** (future) connection — distinct from `identity::*`
+ * (which is about the caller's *own* identity). Minting is authorized purely by
+ * the binder's configured prefixes: each requested field must fall under its
+ * corresponding prefix.
+ */
+declare const connectionTokenBinderInterface: import("@hediet/linkrpc").InterfaceDefinition<{
+  bindConnectionToken: import("@hediet/linkrpc").RequestType<{
+    identitySlot?: string | undefined;
+    serviceIdNamespace?: string | undefined;
+  }, {
+    token: string;
+    expiresAt: number;
+  }, any, never, never>;
+}>;
+//#endregion
+export { connectionTokenBinderInterface as t };
+//# sourceMappingURL=connectionTokenBinder.interfaces-BhzQ1DTS.d.ts.map