@hediet/linkrpc 0.0.1

package/dist/hub/client/index.d.ts

@@ -0,0 +1,50 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+import { Ca as JsonValue, Jt as IRequestSender, K as Principal, Pn as SignedCapability, Qt as RawStreamingCall, V as SigningCallCtx, an as IMessageTransport, nn as StreamSendOpts, tn as SendOpts, vt as PublicSigningIdentity } from "../../chunks/linkRpcConnection-CtlQmetO.js";
+import { i as hubFromConnection, n as SlotPrerequest, r as SlotReservation, t as Hub } from "../../chunks/hubFacade-Dkgw2pTi.js";
+import { a as HubAccessResult, i as HubAccessRequest } from "../../chunks/hubAccess-DwTZPiI8.js";
+//#region src/hub/client/hubSigningSender.d.ts
+/**
+ * The single connection handle a hub client consumes: a signing request
+ * sender (every outbound call is wrapped in a `$hubrpc` signed envelope by the
+ * principal) that also surfaces the principal's public identity and its grants.
+ *
+ * It IS the channel — `sendRequest("svc::iface::member", params)` routes a
+ * form-3 hub call. The {@link Principal}'s `capBag` is the live grant list:
+ * {@link listGrants} returns its snapshot and {@link requestAccess} grows it.
+ *
+ * Construct with {@link HubSigningSender.create} from any transport whose peer
+ * is (or routes to) a hub — a socket, a websocket, or an in-memory
+ * {@link import('@hediet/linkrpc-hub/hub/server').Hub} link.
+ */
+declare class HubSigningSender implements IRequestSender<SigningCallCtx> {
+  private readonly _inner;
+  private readonly _principal;
+  /**
+   * Wrap `transport` in a JSON-RPC channel + signing sender bound to
+   * `principal`.
+   */
+  static create(transport: IMessageTransport, principal: Principal): HubSigningSender;
+  private constructor();
+  /** Public identity (nodeId) this connection signs as. Never exposes keys. */
+  get identity(): PublicSigningIdentity;
+  /** Snapshot of the durable capabilities currently held (the cap bag). */
+  listGrants(): readonly SignedCapability[];
+  /**
+   * Request capabilities from the hub through the same signed connection:
+   * a `hubAccess::requestAccess` call served at the connection root (never
+   * forwarded → never gated, so no `hubAccess` bootstrap cap is needed). Any
+   * durable (non-one-shot) caps the hub mints join the principal's cap bag, so
+   * subsequent signed calls present them automatically.
+   */
+  requestAccess(req: HubAccessRequest): Promise<HubAccessResult>;
+  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<JsonValue>;
+  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<void>;
+  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<SigningCallCtx>): RawStreamingCall;
+  close(): void;
+}
+//#endregion
+export { Hub, HubSigningSender, type SlotPrerequest, type SlotReservation, hubFromConnection };
+//# sourceMappingURL=index.d.ts.map

package/dist/hub/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/hub/client/hubSigningSender.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;cAmCa,4BAA4B,eAAe;mBAc/B;mBACA;;;;;SAVP,OACV,WAAW,mBACX,WAAW,YACZ;UAKI;;MAMI,YAAY;;EAKhB,uBAAuB;;;;;;;;EAWjB,cAAc,KAAK,mBAAmB,QAAQ;EAiBpD,YAAY,gBAAgB,QAAQ,uBAAuB,OAAO,SAAS,kBAAkB,QAAQ;EAIrG,iBAAiB,gBAAgB,QAAQ,uBAAuB,OAAO,SAAS,kBAAkB;EAIlG,sBAAsB,gBAAgB,QAAQ,uBAAuB,OAAO,eAAe,kBAAkB;EAI7G"}

package/dist/hub/client/index.js

@@ -0,0 +1,97 @@
+/*---------------------------------------------------------------------------------------------
+*  Copyright (c) Microsoft Corporation. All rights reserved.
+*  Licensed under the MIT License. See License.txt in the project root for license information.
+*--------------------------------------------------------------------------------------------*/
+import { H as JsonRpcChannel, m as SigningSender } from "../../chunks/src-D3NUIwyo.js";
+import { t as hubAccessInterface } from "../../chunks/hub.interfaces-BzWfsVT2.js";
+import { n as hubFromConnection, t as Hub } from "../../chunks/hubFacade-CQflVkVC.js";
+//#region src/hub/client/hubSigningSender.ts
+/**
+* The single connection handle a hub client consumes: a signing request
+* sender (every outbound call is wrapped in a `$hubrpc` signed envelope by the
+* principal) that also surfaces the principal's public identity and its grants.
+*
+* It IS the channel — `sendRequest("svc::iface::member", params)` routes a
+* form-3 hub call. The {@link Principal}'s `capBag` is the live grant list:
+* {@link listGrants} returns its snapshot and {@link requestAccess} grows it.
+*
+* Construct with {@link HubSigningSender.create} from any transport whose peer
+* is (or routes to) a hub — a socket, a websocket, or an in-memory
+* {@link import('@hediet/linkrpc-hub/hub/server').Hub} link.
+*/
+var HubSigningSender = class HubSigningSender {
+	_inner;
+	_principal;
+	/**
+	* Wrap `transport` in a JSON-RPC channel + signing sender bound to
+	* `principal`.
+	*/
+	static create(transport, principal) {
+		const signed = SigningSender.wrapChannel(JsonRpcChannel.create(transport), { principal });
+		return new HubSigningSender(signed.sender, principal);
+	}
+	constructor(_inner, _principal) {
+		this._inner = _inner;
+		this._principal = _principal;
+	}
+	/** Public identity (nodeId) this connection signs as. Never exposes keys. */
+	get identity() {
+		return this._principal.identity.publicSigningIdentity;
+	}
+	/** Snapshot of the durable capabilities currently held (the cap bag). */
+	listGrants() {
+		return this._principal.capBag.capabilities;
+	}
+	/**
+	* Request capabilities from the hub through the same signed connection:
+	* a `hubAccess::requestAccess` call served at the connection root (never
+	* forwarded → never gated, so no `hubAccess` bootstrap cap is needed). Any
+	* durable (non-one-shot) caps the hub mints join the principal's cap bag, so
+	* subsequent signed calls present them automatically.
+	*/
+	async requestAccess(req) {
+		const method = `${hubAccessInterface.info.id}::requestAccess`;
+		const result = await this._inner.sendRequest(method, {
+			consumer: {
+				...req.consumer,
+				principal: this._principal.id
+			},
+			permissions: req.permissions,
+			...req.duration !== void 0 ? { duration: req.duration } : {}
+		});
+		if (result.status === "granted") {
+			const capabilities = result.capabilities ?? [];
+			const durable = capabilities.filter((c) => !_isOneShotCap(c));
+			if (durable.length > 0) await this._principal.capBag.add(...durable);
+			return {
+				status: "granted",
+				capabilities,
+				addedDurable: durable.length
+			};
+		}
+		return {
+			status: result.status,
+			reason: result.reason
+		};
+	}
+	sendRequest(method, params, opts) {
+		return this._inner.sendRequest(method, params, opts);
+	}
+	sendNotification(method, params, opts) {
+		return this._inner.sendNotification(method, params, opts);
+	}
+	sendRequestWithStream(method, params, opts) {
+		return this._inner.sendRequestWithStream(method, params, opts);
+	}
+	close() {
+		this._inner.close();
+	}
+};
+/** A cap is one-shot when any permission is pinned to a single call via `callBind`. */
+function _isOneShotCap(sc) {
+	return sc.permissions.some((p) => p.callBind !== void 0);
+}
+//#endregion
+export { Hub, HubSigningSender, hubFromConnection };
+
+//# sourceMappingURL=index.js.map

package/dist/hub/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/hub/client/hubSigningSender.ts"],"sourcesContent":["/*---------------------------------------------------------------------------------------------\n *  Copyright (c) Microsoft Corporation. All rights reserved.\n *  Licensed under the MIT License. See License.txt in the project root for license information.\n *--------------------------------------------------------------------------------------------*/\n\nimport {\n    type IMessageTransport,\n    type IRequestSender,\n    JsonRpcChannel,\n    type JsonValue,\n    type Principal,\n    type PublicSigningIdentity,\n    type RawStreamingCall,\n    type SendOpts,\n    type SignedCapability,\n    SigningSender,\n    type SigningCallCtx,\n    type StreamSendOpts,\n} from '../../index';\nimport { hubAccessInterface } from '../common/hub.interfaces';\nimport type { HubAccessRequest, HubAccessResult } from '../common/hubAccess';\n\n/**\n * The single connection handle a hub client consumes: a signing request\n * sender (every outbound call is wrapped in a `$hubrpc` signed envelope by the\n * principal) that also surfaces the principal's public identity and its grants.\n *\n * It IS the channel — `sendRequest(\"svc::iface::member\", params)` routes a\n * form-3 hub call. The {@link Principal}'s `capBag` is the live grant list:\n * {@link listGrants} returns its snapshot and {@link requestAccess} grows it.\n *\n * Construct with {@link HubSigningSender.create} from any transport whose peer\n * is (or routes to) a hub — a socket, a websocket, or an in-memory\n * {@link import('@hediet/linkrpc-hub/hub/server').Hub} link.\n */\nexport class HubSigningSender implements IRequestSender<SigningCallCtx> {\n    /**\n     * Wrap `transport` in a JSON-RPC channel + signing sender bound to\n     * `principal`.\n     */\n    public static create(\n        transport: IMessageTransport,\n        principal: Principal,\n    ): HubSigningSender {\n        const signed = SigningSender.wrapChannel(JsonRpcChannel.create(transport), { principal });\n        return new HubSigningSender(signed.sender, principal);\n    }\n\n    private constructor(\n        private readonly _inner: IRequestSender<SigningCallCtx>,\n        private readonly _principal: Principal,\n    ) { }\n\n    /** Public identity (nodeId) this connection signs as. Never exposes keys. */\n    public get identity(): PublicSigningIdentity {\n        return this._principal.identity.publicSigningIdentity;\n    }\n\n    /** Snapshot of the durable capabilities currently held (the cap bag). */\n    public listGrants(): readonly SignedCapability[] {\n        return this._principal.capBag.capabilities;\n    }\n\n    /**\n     * Request capabilities from the hub through the same signed connection:\n     * a `hubAccess::requestAccess` call served at the connection root (never\n     * forwarded → never gated, so no `hubAccess` bootstrap cap is needed). Any\n     * durable (non-one-shot) caps the hub mints join the principal's cap bag, so\n     * subsequent signed calls present them automatically.\n     */\n    public async requestAccess(req: HubAccessRequest): Promise<HubAccessResult> {\n        const method = `${hubAccessInterface.info.id}::requestAccess`;\n        const raw = await this._inner.sendRequest(method, {\n            consumer: { ...req.consumer, principal: this._principal.id },\n            permissions: req.permissions,\n            ...(req.duration !== undefined ? { duration: req.duration } : {}),\n        } as never);\n        const result = raw as unknown as { status: string; capabilities?: SignedCapability[]; reason?: string; };\n        if (result.status === 'granted') {\n            const capabilities = result.capabilities ?? [];\n            const durable = capabilities.filter((c) => !_isOneShotCap(c));\n            if (durable.length > 0) await this._principal.capBag.add(...durable);\n            return { status: 'granted', capabilities, addedDurable: durable.length };\n        }\n        return { status: result.status, reason: result.reason };\n    }\n\n    public sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<JsonValue> {\n        return this._inner.sendRequest(method, params, opts);\n    }\n\n    public sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<void> {\n        return this._inner.sendNotification(method, params, opts);\n    }\n\n    public sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<SigningCallCtx>): RawStreamingCall {\n        return this._inner.sendRequestWithStream(method, params, opts);\n    }\n\n    public close(): void {\n        this._inner.close();\n    }\n}\n\n/** A cap is one-shot when any permission is pinned to a single call via `callBind`. */\nfunction _isOneShotCap(sc: SignedCapability): boolean {\n    return sc.permissions.some((p) => p.callBind !== undefined);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmCA,IAAa,mBAAb,MAAa,iBAA2D;CAc/C;CACA;;;;;CAVrB,OAAc,OACV,WACA,WACgB;EAChB,MAAM,SAAS,cAAc,YAAY,eAAe,OAAO,SAAS,GAAG,EAAE,UAAU,CAAC;EACxF,OAAO,IAAI,iBAAiB,OAAO,QAAQ,SAAS;CACxD;CAEA,YACI,QACA,YACF;EAFmB,KAAA,SAAA;EACA,KAAA,aAAA;CACjB;;CAGJ,IAAW,WAAkC;EACzC,OAAO,KAAK,WAAW,SAAS;CACpC;;CAGA,aAAiD;EAC7C,OAAO,KAAK,WAAW,OAAO;CAClC;;;;;;;;CASA,MAAa,cAAc,KAAiD;EACxE,MAAM,SAAS,GAAG,mBAAmB,KAAK,GAAG;EAM7C,MAAM,SAAS,MALG,KAAK,OAAO,YAAY,QAAQ;GAC9C,UAAU;IAAE,GAAG,IAAI;IAAU,WAAW,KAAK,WAAW;GAAG;GAC3D,aAAa,IAAI;GACjB,GAAI,IAAI,aAAa,KAAA,IAAY,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;EACnE,CAAU;EAEV,IAAI,OAAO,WAAW,WAAW;GAC7B,MAAM,eAAe,OAAO,gBAAgB,CAAC;GAC7C,MAAM,UAAU,aAAa,QAAQ,MAAM,CAAC,cAAc,CAAC,CAAC;GAC5D,IAAI,QAAQ,SAAS,GAAG,MAAM,KAAK,WAAW,OAAO,IAAI,GAAG,OAAO;GACnE,OAAO;IAAE,QAAQ;IAAW;IAAc,cAAc,QAAQ;GAAO;EAC3E;EACA,OAAO;GAAE,QAAQ,OAAO;GAAQ,QAAQ,OAAO;EAAO;CAC1D;CAEA,YAAmB,QAAgB,QAA+B,MAAqD;EACnH,OAAO,KAAK,OAAO,YAAY,QAAQ,QAAQ,IAAI;CACvD;CAEA,iBAAwB,QAAgB,QAA+B,MAAgD;EACnH,OAAO,KAAK,OAAO,iBAAiB,QAAQ,QAAQ,IAAI;CAC5D;CAEA,sBAA6B,QAAgB,QAA+B,MAAyD;EACjI,OAAO,KAAK,OAAO,sBAAsB,QAAQ,QAAQ,IAAI;CACjE;CAEA,QAAqB;EACjB,KAAK,OAAO,MAAM;CACtB;AACJ;;AAGA,SAAS,cAAc,IAA+B;CAClD,OAAO,GAAG,YAAY,MAAM,MAAM,EAAE,aAAa,KAAA,CAAS;AAC9D"}