@ixo/editor 3.0.0-beta.28 → 3.0.0-beta.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{chunk-SZSEZY6Z.mjs → chunk-5PHI3WWK.mjs} +2 -2
- package/dist/{chunk-NOMJJJDB.mjs → chunk-77R3T42S.mjs} +43 -672
- package/dist/chunk-77R3T42S.mjs.map +1 -0
- package/dist/{chunk-LQP2DPYM.mjs → chunk-EDCITCO5.mjs} +424 -645
- package/dist/chunk-EDCITCO5.mjs.map +1 -0
- package/dist/core/index.d.ts +4 -4
- package/dist/core/index.mjs +6 -20
- package/dist/{graphql-client-CSiffz9I.d.ts → graphql-client-D1Zgezg6.d.ts} +1 -8
- package/dist/{index-BmOZ-1iJ.d.ts → index-7ptWHYA8.d.ts} +212 -124
- package/dist/index.d.ts +3 -3
- package/dist/index.mjs +17 -15
- package/dist/index.mjs.map +1 -1
- package/dist/mantine/index.d.ts +5 -4
- package/dist/mantine/index.mjs +2 -2
- package/dist/setup-CahGoKeh.d.ts +452 -0
- package/package.json +1 -1
- package/dist/chunk-LQP2DPYM.mjs.map +0 -1
- package/dist/chunk-NOMJJJDB.mjs.map +0 -1
- package/dist/setup-C5MpJdyr.d.ts +0 -780
- /package/dist/{chunk-SZSEZY6Z.mjs.map → chunk-5PHI3WWK.mjs.map} +0 -0
package/dist/setup-C5MpJdyr.d.ts
DELETED
|
@@ -1,780 +0,0 @@
|
|
|
1
|
-
import { r as FlowNode, F as FlowNodeAuthzExtension, p as FlowNodeRuntimeState, J as IxoEditorType, S as SignedCapability, B as CreateRootDelegationParams, t as StoredDelegation, G as CreateDelegationParams, H as CreateInvocationParams, w as InvocationResult, x as ExecutionWithInvocationResult, s as UcanCapability, y as DelegationChainValidationResult, z as FindProofsResult, M as MigrationReport, U as UcanDelegationStore, l as InvocationStore, E as EvaluationStatus, C as Capability, a as CapabilityValidationResult } from './index-BmOZ-1iJ.mjs';
|
|
2
|
-
import { Delegation } from '@ixo/ucan';
|
|
3
|
-
import { Doc, Map } from 'yjs';
|
|
4
|
-
import { MatrixClient } from 'matrix-js-sdk';
|
|
5
|
-
|
|
6
|
-
/** Condition that gates when a capability activates. */
|
|
7
|
-
interface ConditionRef {
|
|
8
|
-
/** ID of the upstream capability whose output is checked. */
|
|
9
|
-
sourceId: string;
|
|
10
|
-
/** Output field path to inspect, e.g., "decision". */
|
|
11
|
-
field: string;
|
|
12
|
-
/** Comparison operator. */
|
|
13
|
-
operator: 'eq' | 'neq' | 'gt' | 'lt' | 'in' | 'exists';
|
|
14
|
-
/** Value to compare against (omit for 'exists'). */
|
|
15
|
-
value?: unknown;
|
|
16
|
-
/** What happens when the condition is (not) met. */
|
|
17
|
-
effect?: {
|
|
18
|
-
action: 'enable' | 'disable' | 'hide' | 'show';
|
|
19
|
-
message?: string;
|
|
20
|
-
};
|
|
21
|
-
}
|
|
22
|
-
/** Authorization constraint for a capability. */
|
|
23
|
-
interface ActorConstraint {
|
|
24
|
-
/** Whitelisted actor DIDs. */
|
|
25
|
-
authorisedActors?: string[];
|
|
26
|
-
/** Parent capability URI for delegation chain. */
|
|
27
|
-
parentCapability?: string;
|
|
28
|
-
}
|
|
29
|
-
/** Time-to-live constraint for a capability. */
|
|
30
|
-
interface TTLConstraint {
|
|
31
|
-
/** Hard deadline (ISO 8601 date string). */
|
|
32
|
-
absoluteDueDate?: string;
|
|
33
|
-
/** Duration from when the block becomes enabled (ISO 8601 duration, e.g., "P7D"). */
|
|
34
|
-
fromEnablement?: string;
|
|
35
|
-
/** Duration from when an actor commits (ISO 8601 duration, e.g., "PT2H"). */
|
|
36
|
-
fromCommitment?: string;
|
|
37
|
-
}
|
|
38
|
-
/**
|
|
39
|
-
* A single capability in a Base UCAN flow plan.
|
|
40
|
-
*
|
|
41
|
-
* UCAN semantics:
|
|
42
|
-
* can = the action
|
|
43
|
-
* with = the resource or scope
|
|
44
|
-
* nb = typed caveats, inputs, parameters
|
|
45
|
-
*
|
|
46
|
-
* Workflow semantics (kept separate from nb):
|
|
47
|
-
* dependsOn, condition, parallelGroup, phase
|
|
48
|
-
*/
|
|
49
|
-
interface FlowCapability {
|
|
50
|
-
/** Stable node identifier for this step. */
|
|
51
|
-
id: string;
|
|
52
|
-
/** UCAN-style ability string, e.g., "bid/submit", "email/send". */
|
|
53
|
-
can: string;
|
|
54
|
-
/** Resource URI, e.g., "ixo:flow:{flowId}" or "ixo:flow:{flowId}:{nodeId}". */
|
|
55
|
-
with: string;
|
|
56
|
-
/** Typed caveats / input parameters. Shape is dictated by the action registry. */
|
|
57
|
-
nb?: Record<string, unknown>;
|
|
58
|
-
/** IDs of upstream capabilities this depends on. */
|
|
59
|
-
dependsOn?: string[];
|
|
60
|
-
/** Condition that must be met for this capability to activate. */
|
|
61
|
-
condition?: ConditionRef;
|
|
62
|
-
/** Capabilities sharing a parallelGroup run concurrently. */
|
|
63
|
-
parallelGroup?: string;
|
|
64
|
-
/** Semantic grouping for layout lanes. */
|
|
65
|
-
phase?: string;
|
|
66
|
-
/** Who can execute this step. */
|
|
67
|
-
actor?: ActorConstraint;
|
|
68
|
-
/** Time-to-live constraints. */
|
|
69
|
-
ttl?: TTLConstraint;
|
|
70
|
-
/** Display title (falls back to can statement). */
|
|
71
|
-
title?: string;
|
|
72
|
-
/** Description of what this step does. */
|
|
73
|
-
description?: string;
|
|
74
|
-
/** Icon identifier. */
|
|
75
|
-
icon?: string;
|
|
76
|
-
}
|
|
77
|
-
/**
|
|
78
|
-
* The Base UCAN flow plan — the intermediate representation between
|
|
79
|
-
* user intent and the compiled flow graph.
|
|
80
|
-
*
|
|
81
|
-
* capabilities is an ordered list. Each capability carries its own stable `id`.
|
|
82
|
-
*/
|
|
83
|
-
interface BaseUcanFlow {
|
|
84
|
-
kind: 'qi.flow.base-ucan';
|
|
85
|
-
version: '1.0';
|
|
86
|
-
flowId: string;
|
|
87
|
-
title: string;
|
|
88
|
-
goal?: string;
|
|
89
|
-
meta?: {
|
|
90
|
-
entityDid?: string;
|
|
91
|
-
flowUri?: string;
|
|
92
|
-
rootIssuer?: string;
|
|
93
|
-
};
|
|
94
|
-
/** Ordered capabilities, each with its own stable node ID. */
|
|
95
|
-
capabilities: FlowCapability[];
|
|
96
|
-
}
|
|
97
|
-
/** A reference to an upstream node's output field. Format: "nodeId.output.fieldPath" */
|
|
98
|
-
interface RuntimeRef {
|
|
99
|
-
$ref: string;
|
|
100
|
-
}
|
|
101
|
-
declare function isRuntimeRef(value: unknown): value is RuntimeRef;
|
|
102
|
-
/** A single block ready for insertion into BlockNote. */
|
|
103
|
-
interface CompiledBlock {
|
|
104
|
-
/** Pre-generated stable block ID. */
|
|
105
|
-
id: string;
|
|
106
|
-
/** BlockNote block type (e.g., "action"). */
|
|
107
|
-
type: string;
|
|
108
|
-
/** Block props — all values are strings per BlockNote convention. */
|
|
109
|
-
props: Record<string, string>;
|
|
110
|
-
}
|
|
111
|
-
/** A dependency edge in the flow graph. */
|
|
112
|
-
interface CompiledEdge {
|
|
113
|
-
id: string;
|
|
114
|
-
source: string;
|
|
115
|
-
target: string;
|
|
116
|
-
kind: 'dependency';
|
|
117
|
-
condition?: ConditionRef;
|
|
118
|
-
}
|
|
119
|
-
/** A compiled flow node stored in qi.flow.nodes. */
|
|
120
|
-
interface CompiledFlowNode {
|
|
121
|
-
id: string;
|
|
122
|
-
blockId: string;
|
|
123
|
-
can: string;
|
|
124
|
-
with: string;
|
|
125
|
-
registryType: string;
|
|
126
|
-
title: string;
|
|
127
|
-
description: string;
|
|
128
|
-
props: Record<string, string>;
|
|
129
|
-
dependsOn: string[];
|
|
130
|
-
phase?: string;
|
|
131
|
-
parallelGroup?: string;
|
|
132
|
-
actor?: ActorConstraint;
|
|
133
|
-
}
|
|
134
|
-
/** The complete compiled output from the Base UCAN compiler. */
|
|
135
|
-
interface CompiledFlow {
|
|
136
|
-
/** Flow metadata for qi.flow.meta and Y.Map('root'). */
|
|
137
|
-
meta: {
|
|
138
|
-
flowId: string;
|
|
139
|
-
title: string;
|
|
140
|
-
goal?: string;
|
|
141
|
-
version: string;
|
|
142
|
-
flowOwnerDid: string;
|
|
143
|
-
flowUri?: string;
|
|
144
|
-
compiledAt: string;
|
|
145
|
-
compiledFrom: 'BaseUcanFlow';
|
|
146
|
-
};
|
|
147
|
-
/** Blocks to insert into BlockNote, in topological order. */
|
|
148
|
-
blocks: CompiledBlock[];
|
|
149
|
-
/** Flow graph nodes, keyed by node ID. */
|
|
150
|
-
nodes: Record<string, CompiledFlowNode>;
|
|
151
|
-
/** Dependency edges. */
|
|
152
|
-
edges: CompiledEdge[];
|
|
153
|
-
/** Topological order of node IDs. */
|
|
154
|
-
order: string[];
|
|
155
|
-
/** nodeId → blockId mapping. */
|
|
156
|
-
blockIndex: Record<string, string>;
|
|
157
|
-
}
|
|
158
|
-
|
|
159
|
-
declare const buildAuthzFromProps: (props: Record<string, any>) => FlowNodeAuthzExtension;
|
|
160
|
-
declare const buildFlowNodeFromBlock: (block: any) => FlowNode;
|
|
161
|
-
|
|
162
|
-
interface FlowRuntimeStateManager {
|
|
163
|
-
get: (nodeId: string) => FlowNodeRuntimeState;
|
|
164
|
-
update: (nodeId: string, updates: Partial<FlowNodeRuntimeState>) => void;
|
|
165
|
-
}
|
|
166
|
-
declare const createRuntimeStateManager: (editor?: IxoEditorType | null) => FlowRuntimeStateManager;
|
|
167
|
-
/**
|
|
168
|
-
* Clears runtime and invocations from a Y.Doc.
|
|
169
|
-
* Used when cloning a flow as a template — the new document should
|
|
170
|
-
* carry only configuration (intent), not execution history.
|
|
171
|
-
*/
|
|
172
|
-
declare function clearRuntimeForTemplateClone(yDoc: Doc): void;
|
|
173
|
-
|
|
174
|
-
interface DelegationStore {
|
|
175
|
-
get: (capabilityId: string) => SignedCapability | null;
|
|
176
|
-
set: (capability: SignedCapability) => void;
|
|
177
|
-
remove: (capabilityId: string) => void;
|
|
178
|
-
getRoot: () => SignedCapability | null;
|
|
179
|
-
setRootId: (capabilityId: string) => void;
|
|
180
|
-
getAll: () => SignedCapability[];
|
|
181
|
-
has: (capabilityId: string) => boolean;
|
|
182
|
-
}
|
|
183
|
-
/**
|
|
184
|
-
* Create a delegation store backed by Y.Map
|
|
185
|
-
*/
|
|
186
|
-
declare const createDelegationStore: (yMap: Map<any>) => DelegationStore;
|
|
187
|
-
/**
|
|
188
|
-
* Create an in-memory delegation store (for testing or when Y.Map unavailable)
|
|
189
|
-
*/
|
|
190
|
-
declare const createMemoryDelegationStore: () => DelegationStore;
|
|
191
|
-
|
|
192
|
-
interface CapabilityGrant {
|
|
193
|
-
raw: string;
|
|
194
|
-
with?: string;
|
|
195
|
-
audience?: string;
|
|
196
|
-
expiresAt?: number;
|
|
197
|
-
action?: string;
|
|
198
|
-
}
|
|
199
|
-
type DerivedCapability = CapabilityGrant;
|
|
200
|
-
interface UCANManager {
|
|
201
|
-
loadParentCapability: (capability: string) => Promise<CapabilityGrant>;
|
|
202
|
-
deriveNodeCapability: (parent: CapabilityGrant, nodeId: string, actorDid: string) => Promise<DerivedCapability>;
|
|
203
|
-
validateDerivedCapability: (derived: DerivedCapability, nodeId: string, actorDid: string) => Promise<void>;
|
|
204
|
-
}
|
|
205
|
-
declare class SimpleUCANManager implements UCANManager {
|
|
206
|
-
loadParentCapability(capability: string): Promise<CapabilityGrant>;
|
|
207
|
-
deriveNodeCapability(parent: CapabilityGrant, nodeId: string, actorDid: string): Promise<DerivedCapability>;
|
|
208
|
-
validateDerivedCapability(derived: DerivedCapability): Promise<void>;
|
|
209
|
-
}
|
|
210
|
-
|
|
211
|
-
/**
|
|
212
|
-
* UCAN Service using @ixo/ucan directly
|
|
213
|
-
*
|
|
214
|
-
* This service provides a high-level API for:
|
|
215
|
-
* - Creating and managing delegations (CAR format)
|
|
216
|
-
* - Creating and validating invocations
|
|
217
|
-
* - Executing actions with invocation-based authorization
|
|
218
|
-
* - Migrating legacy delegations
|
|
219
|
-
*
|
|
220
|
-
* The host app only needs to provide the signer (private key) after PIN decryption.
|
|
221
|
-
* All UCAN operations are performed using @ixo/ucan directly.
|
|
222
|
-
*/
|
|
223
|
-
|
|
224
|
-
/**
|
|
225
|
-
* Signer session scope type
|
|
226
|
-
*/
|
|
227
|
-
type SignerSessionScope = 'session' | 'operation';
|
|
228
|
-
/**
|
|
229
|
-
* Signer session returned by createSignerSession
|
|
230
|
-
*/
|
|
231
|
-
interface SignerSessionInfo {
|
|
232
|
-
sessionId: string;
|
|
233
|
-
did: string;
|
|
234
|
-
publicKey: string;
|
|
235
|
-
keyId: string;
|
|
236
|
-
expiresAt: number;
|
|
237
|
-
scope: SignerSessionScope;
|
|
238
|
-
}
|
|
239
|
-
/**
|
|
240
|
-
* Handler functions for getting signers from the host application
|
|
241
|
-
* The host app handles PIN decryption and key management
|
|
242
|
-
*/
|
|
243
|
-
interface UcanServiceHandlers {
|
|
244
|
-
/**
|
|
245
|
-
* Get a signer for the given DID after PIN verification
|
|
246
|
-
* The host app decrypts the private key using the PIN
|
|
247
|
-
*
|
|
248
|
-
* @returns The private key in multibase format (for parseSigner)
|
|
249
|
-
* @deprecated Prefer createSignerSession for better security
|
|
250
|
-
*/
|
|
251
|
-
getPrivateKey?: (params: {
|
|
252
|
-
did: string;
|
|
253
|
-
didType: 'entity' | 'user';
|
|
254
|
-
entityRoomId?: string;
|
|
255
|
-
pin: string;
|
|
256
|
-
}) => Promise<string>;
|
|
257
|
-
/**
|
|
258
|
-
* Get a signer from mnemonic (alternative to getPrivateKey)
|
|
259
|
-
* The host app retrieves and decrypts the mnemonic using the PIN
|
|
260
|
-
*
|
|
261
|
-
* @returns The mnemonic phrase
|
|
262
|
-
* @deprecated Prefer createSignerSession for better security
|
|
263
|
-
*/
|
|
264
|
-
getMnemonic?: (params: {
|
|
265
|
-
did: string;
|
|
266
|
-
didType: 'entity' | 'user';
|
|
267
|
-
entityRoomId?: string;
|
|
268
|
-
pin: string;
|
|
269
|
-
}) => Promise<string>;
|
|
270
|
-
/**
|
|
271
|
-
* Create a signer session that can be used for multiple sign operations.
|
|
272
|
-
* The host app keeps the key material secure; the editor only receives an opaque handle.
|
|
273
|
-
*
|
|
274
|
-
* @param params.scope - 'session' for multiple operations, 'operation' for one-time use
|
|
275
|
-
* @param params.ttlSeconds - Time-to-live for session scope (default: 300, max: 3600)
|
|
276
|
-
*/
|
|
277
|
-
createSignerSession?: (params: {
|
|
278
|
-
did: string;
|
|
279
|
-
didType: 'entity' | 'user';
|
|
280
|
-
entityRoomId?: string;
|
|
281
|
-
pin: string;
|
|
282
|
-
scope: SignerSessionScope;
|
|
283
|
-
ttlSeconds?: number;
|
|
284
|
-
}) => Promise<SignerSessionInfo>;
|
|
285
|
-
/**
|
|
286
|
-
* Sign data using an existing session.
|
|
287
|
-
* For 'operation' scope, the session is automatically invalidated after this call.
|
|
288
|
-
*/
|
|
289
|
-
signWithSession?: (params: {
|
|
290
|
-
sessionId: string;
|
|
291
|
-
data: string;
|
|
292
|
-
algorithm?: 'Ed25519';
|
|
293
|
-
}) => Promise<{
|
|
294
|
-
signature: string;
|
|
295
|
-
algorithm: 'Ed25519';
|
|
296
|
-
keyId: string;
|
|
297
|
-
}>;
|
|
298
|
-
/**
|
|
299
|
-
* Release a session before it expires.
|
|
300
|
-
* Safe to call on already-released or expired sessions.
|
|
301
|
-
*/
|
|
302
|
-
releaseSignerSession?: (params: {
|
|
303
|
-
sessionId: string;
|
|
304
|
-
}) => Promise<{
|
|
305
|
-
released: boolean;
|
|
306
|
-
reason?: string;
|
|
307
|
-
}>;
|
|
308
|
-
/**
|
|
309
|
-
* Create a delegation directly in the host app.
|
|
310
|
-
* The host handles all signing internally using session-based signing.
|
|
311
|
-
* This is the preferred approach for security.
|
|
312
|
-
*/
|
|
313
|
-
createDelegationWithSession?: (params: {
|
|
314
|
-
sessionId: string;
|
|
315
|
-
audience: string;
|
|
316
|
-
capabilities: Array<{
|
|
317
|
-
can: string;
|
|
318
|
-
with: string;
|
|
319
|
-
nb?: Record<string, unknown>;
|
|
320
|
-
}>;
|
|
321
|
-
proofs?: string[];
|
|
322
|
-
expiration?: number;
|
|
323
|
-
}) => Promise<{
|
|
324
|
-
cid: string;
|
|
325
|
-
delegation: string;
|
|
326
|
-
}>;
|
|
327
|
-
/**
|
|
328
|
-
* Create an invocation directly in the host app.
|
|
329
|
-
* The host handles all signing internally using session-based signing.
|
|
330
|
-
* This is the preferred approach for security.
|
|
331
|
-
*/
|
|
332
|
-
createInvocationWithSession?: (params: {
|
|
333
|
-
sessionId: string;
|
|
334
|
-
audience: string;
|
|
335
|
-
capability: {
|
|
336
|
-
can: string;
|
|
337
|
-
with: string;
|
|
338
|
-
nb?: Record<string, unknown>;
|
|
339
|
-
};
|
|
340
|
-
proofs: string[];
|
|
341
|
-
}) => Promise<{
|
|
342
|
-
cid: string;
|
|
343
|
-
invocation: string;
|
|
344
|
-
}>;
|
|
345
|
-
}
|
|
346
|
-
/**
|
|
347
|
-
* Configuration for UcanService
|
|
348
|
-
*/
|
|
349
|
-
interface UcanServiceConfig {
|
|
350
|
-
delegationStore: UcanDelegationStore;
|
|
351
|
-
invocationStore: InvocationStore;
|
|
352
|
-
handlers: UcanServiceHandlers;
|
|
353
|
-
flowOwnerDid: string;
|
|
354
|
-
flowUri: string;
|
|
355
|
-
}
|
|
356
|
-
/**
|
|
357
|
-
* UCAN Service interface
|
|
358
|
-
*/
|
|
359
|
-
interface UcanService {
|
|
360
|
-
createRootDelegation: (params: CreateRootDelegationParams) => Promise<StoredDelegation>;
|
|
361
|
-
createDelegation: (params: CreateDelegationParams) => Promise<StoredDelegation>;
|
|
362
|
-
revokeDelegation: (cid: string) => void;
|
|
363
|
-
getDelegation: (cid: string) => StoredDelegation | null;
|
|
364
|
-
getAllDelegations: () => StoredDelegation[];
|
|
365
|
-
getRootDelegation: () => StoredDelegation | null;
|
|
366
|
-
createAndValidateInvocation: (params: CreateInvocationParams, flowId: string, blockId?: string) => Promise<InvocationResult>;
|
|
367
|
-
executeWithInvocation: <T>(params: CreateInvocationParams, action: () => Promise<T>, flowId: string, blockId?: string) => Promise<ExecutionWithInvocationResult & {
|
|
368
|
-
actionResult?: T;
|
|
369
|
-
}>;
|
|
370
|
-
validateDelegationChain: (audienceDid: string, capability: UcanCapability) => Promise<DelegationChainValidationResult>;
|
|
371
|
-
findValidProofs: (audienceDid: string, capability: UcanCapability) => Promise<FindProofsResult>;
|
|
372
|
-
parseDelegationFromStore: (cid: string) => Promise<Delegation | null>;
|
|
373
|
-
migrateLegacyDelegation: (legacyId: string, pin: string) => Promise<StoredDelegation | null>;
|
|
374
|
-
migrateAllLegacy: (pin: string) => Promise<MigrationReport>;
|
|
375
|
-
getLegacyCount: () => number;
|
|
376
|
-
isConfigured: () => boolean;
|
|
377
|
-
}
|
|
378
|
-
/**
|
|
379
|
-
* Create a UCAN service instance
|
|
380
|
-
*/
|
|
381
|
-
declare const createUcanService: (config: UcanServiceConfig) => UcanService;
|
|
382
|
-
|
|
383
|
-
interface NodeActionResult {
|
|
384
|
-
claimId?: string;
|
|
385
|
-
evaluationStatus?: EvaluationStatus;
|
|
386
|
-
submittedByDid?: string;
|
|
387
|
-
payload?: any;
|
|
388
|
-
}
|
|
389
|
-
interface ExecutionContext {
|
|
390
|
-
runtime: FlowRuntimeStateManager;
|
|
391
|
-
/** @deprecated Use delegationStore instead */
|
|
392
|
-
ucanManager?: UCANManager;
|
|
393
|
-
delegationStore?: DelegationStore;
|
|
394
|
-
verifySignature?: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
395
|
-
valid: boolean;
|
|
396
|
-
error?: string;
|
|
397
|
-
}>;
|
|
398
|
-
rootIssuer?: string;
|
|
399
|
-
flowUri?: string;
|
|
400
|
-
now?: () => number;
|
|
401
|
-
}
|
|
402
|
-
interface ExecutionOutcome {
|
|
403
|
-
success: boolean;
|
|
404
|
-
stage: 'activation' | 'authorization' | 'claim' | 'action' | 'complete';
|
|
405
|
-
error?: string;
|
|
406
|
-
result?: NodeActionResult;
|
|
407
|
-
capabilityId?: string;
|
|
408
|
-
/** Invocation CID (new @ixo/ucan) */
|
|
409
|
-
invocationCid?: string;
|
|
410
|
-
}
|
|
411
|
-
/**
|
|
412
|
-
* V2 Execution context for @ixo/ucan integration
|
|
413
|
-
*/
|
|
414
|
-
interface ExecutionContextV2 {
|
|
415
|
-
runtime: FlowRuntimeStateManager;
|
|
416
|
-
/** UCAN service for invocation-based execution */
|
|
417
|
-
ucanService?: UcanService;
|
|
418
|
-
/** Invocation store for audit trail */
|
|
419
|
-
invocationStore?: InvocationStore;
|
|
420
|
-
/** Flow URI */
|
|
421
|
-
flowUri: string;
|
|
422
|
-
/** Flow ID for invocation storage */
|
|
423
|
-
flowId: string;
|
|
424
|
-
/** Flow owner DID */
|
|
425
|
-
flowOwnerDid: string;
|
|
426
|
-
/** Current time function */
|
|
427
|
-
now?: () => number;
|
|
428
|
-
/** @deprecated Use ucanService instead */
|
|
429
|
-
ucanManager?: UCANManager;
|
|
430
|
-
/** @deprecated Use ucanService instead */
|
|
431
|
-
delegationStore?: DelegationStore;
|
|
432
|
-
/** @deprecated Use ucanService instead */
|
|
433
|
-
verifySignature?: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
434
|
-
valid: boolean;
|
|
435
|
-
error?: string;
|
|
436
|
-
}>;
|
|
437
|
-
/** @deprecated Use flowOwnerDid instead */
|
|
438
|
-
rootIssuer?: string;
|
|
439
|
-
}
|
|
440
|
-
/**
|
|
441
|
-
* V2 Execute node params with PIN for invocation signing
|
|
442
|
-
*/
|
|
443
|
-
interface ExecuteNodeParamsV2 {
|
|
444
|
-
node: FlowNode;
|
|
445
|
-
actorDid: string;
|
|
446
|
-
actorType: 'entity' | 'user';
|
|
447
|
-
entityRoomId?: string;
|
|
448
|
-
context: ExecutionContextV2;
|
|
449
|
-
action: () => Promise<NodeActionResult>;
|
|
450
|
-
/** PIN for signing invocation (required for @ixo/ucan) */
|
|
451
|
-
pin: string;
|
|
452
|
-
}
|
|
453
|
-
interface ExecuteNodeParams {
|
|
454
|
-
node: FlowNode;
|
|
455
|
-
actorDid: string;
|
|
456
|
-
context: ExecutionContext;
|
|
457
|
-
action: () => Promise<NodeActionResult>;
|
|
458
|
-
}
|
|
459
|
-
declare const executeNode: ({ node, actorDid, context, action }: ExecuteNodeParams) => Promise<ExecutionOutcome>;
|
|
460
|
-
/**
|
|
461
|
-
* V2 Execute node with invocation-based authorization
|
|
462
|
-
* Creates an invocation before execution and stores it for audit trail
|
|
463
|
-
*/
|
|
464
|
-
declare const executeNodeWithInvocation: ({ node, actorDid, actorType, entityRoomId, context, action, pin }: ExecuteNodeParamsV2) => Promise<ExecutionOutcome>;
|
|
465
|
-
|
|
466
|
-
interface AuthorizationResult {
|
|
467
|
-
authorized: boolean;
|
|
468
|
-
reason?: string;
|
|
469
|
-
capabilityId?: string;
|
|
470
|
-
/** Proof chain CIDs for creating invocations (new @ixo/ucan) */
|
|
471
|
-
proofCids?: string[];
|
|
472
|
-
/** @deprecated */
|
|
473
|
-
derived?: DerivedCapability;
|
|
474
|
-
}
|
|
475
|
-
interface AuthorizationContext {
|
|
476
|
-
/** @deprecated Use delegationStore instead */
|
|
477
|
-
ucanManager?: UCANManager;
|
|
478
|
-
delegationStore?: DelegationStore;
|
|
479
|
-
verifySignature?: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
480
|
-
valid: boolean;
|
|
481
|
-
error?: string;
|
|
482
|
-
}>;
|
|
483
|
-
rootIssuer?: string;
|
|
484
|
-
flowUri?: string;
|
|
485
|
-
}
|
|
486
|
-
/**
|
|
487
|
-
* Authorization context V2 for @ixo/ucan integration
|
|
488
|
-
*/
|
|
489
|
-
interface AuthorizationContextV2 {
|
|
490
|
-
/** UCAN service for validation (new @ixo/ucan) */
|
|
491
|
-
ucanService?: UcanService;
|
|
492
|
-
/** Flow URI for resource matching */
|
|
493
|
-
flowUri?: string;
|
|
494
|
-
/** Flow owner DID (root issuer) */
|
|
495
|
-
flowOwnerDid?: string;
|
|
496
|
-
/** @deprecated Use ucanService instead */
|
|
497
|
-
ucanManager?: UCANManager;
|
|
498
|
-
/** @deprecated Use ucanService instead */
|
|
499
|
-
delegationStore?: DelegationStore;
|
|
500
|
-
/** @deprecated Use ucanService instead */
|
|
501
|
-
verifySignature?: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
502
|
-
valid: boolean;
|
|
503
|
-
error?: string;
|
|
504
|
-
}>;
|
|
505
|
-
/** @deprecated Use flowOwnerDid instead */
|
|
506
|
-
rootIssuer?: string;
|
|
507
|
-
}
|
|
508
|
-
declare const isActorAuthorized: (node: FlowNode, actorDid: string, context?: AuthorizationContext) => Promise<AuthorizationResult>;
|
|
509
|
-
/**
|
|
510
|
-
* V2 Authorization check using @ixo/ucan service
|
|
511
|
-
* Returns proof chain for invocation creation
|
|
512
|
-
*/
|
|
513
|
-
declare const isActorAuthorizedV2: (node: FlowNode, actorDid: string, context?: AuthorizationContextV2) => Promise<AuthorizationResult>;
|
|
514
|
-
|
|
515
|
-
interface ActivationResult {
|
|
516
|
-
active: boolean;
|
|
517
|
-
reason?: string;
|
|
518
|
-
}
|
|
519
|
-
declare const isNodeActive: (node: FlowNode, runtime: FlowRuntimeStateManager) => ActivationResult;
|
|
520
|
-
|
|
521
|
-
interface ValidateChainParams {
|
|
522
|
-
/** The capability to validate */
|
|
523
|
-
capability: SignedCapability;
|
|
524
|
-
/** The actor DID trying to use the capability */
|
|
525
|
-
actorDid: string;
|
|
526
|
-
/** Required capability (what the actor wants to do) */
|
|
527
|
-
requiredCapability: Capability;
|
|
528
|
-
/** The delegation store */
|
|
529
|
-
delegationStore: DelegationStore;
|
|
530
|
-
/** Handler to verify signatures */
|
|
531
|
-
verifySignature: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
532
|
-
valid: boolean;
|
|
533
|
-
error?: string;
|
|
534
|
-
}>;
|
|
535
|
-
/** Expected root issuer (entity DID) */
|
|
536
|
-
rootIssuer: string;
|
|
537
|
-
}
|
|
538
|
-
/**
|
|
539
|
-
* Validate a capability chain back to the root
|
|
540
|
-
*/
|
|
541
|
-
declare const validateCapabilityChain: (params: ValidateChainParams) => Promise<CapabilityValidationResult>;
|
|
542
|
-
/**
|
|
543
|
-
* Find a valid capability for an actor to perform an action
|
|
544
|
-
*/
|
|
545
|
-
declare const findValidCapability: (params: {
|
|
546
|
-
actorDid: string;
|
|
547
|
-
requiredCapability: Capability;
|
|
548
|
-
delegationStore: DelegationStore;
|
|
549
|
-
verifySignature: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
550
|
-
valid: boolean;
|
|
551
|
-
error?: string;
|
|
552
|
-
}>;
|
|
553
|
-
rootIssuer: string;
|
|
554
|
-
}) => Promise<{
|
|
555
|
-
found: boolean;
|
|
556
|
-
capabilityId?: string;
|
|
557
|
-
error?: string;
|
|
558
|
-
}>;
|
|
559
|
-
|
|
560
|
-
interface ActionContext {
|
|
561
|
-
actorDid: string;
|
|
562
|
-
flowId: string;
|
|
563
|
-
nodeId: string;
|
|
564
|
-
services: ActionServices;
|
|
565
|
-
flowNode?: any;
|
|
566
|
-
runtime?: any;
|
|
567
|
-
delegationStore?: any;
|
|
568
|
-
verifySignature?: (capabilityRaw: string, issuerDid: string) => Promise<{
|
|
569
|
-
valid: boolean;
|
|
570
|
-
error?: string;
|
|
571
|
-
}>;
|
|
572
|
-
rootIssuer?: string;
|
|
573
|
-
flowUri?: string;
|
|
574
|
-
handlers?: any;
|
|
575
|
-
editor?: any;
|
|
576
|
-
}
|
|
577
|
-
interface ActionServices {
|
|
578
|
-
http?: {
|
|
579
|
-
request: (params: {
|
|
580
|
-
url: string;
|
|
581
|
-
method: string;
|
|
582
|
-
headers?: Record<string, string>;
|
|
583
|
-
body?: any;
|
|
584
|
-
}) => Promise<{
|
|
585
|
-
status: number;
|
|
586
|
-
headers: Record<string, string>;
|
|
587
|
-
data: any;
|
|
588
|
-
}>;
|
|
589
|
-
};
|
|
590
|
-
email?: {
|
|
591
|
-
send: (params: {
|
|
592
|
-
to: string;
|
|
593
|
-
subject: string;
|
|
594
|
-
template: string;
|
|
595
|
-
templateVersion?: string;
|
|
596
|
-
variables?: Record<string, any>;
|
|
597
|
-
cc?: string;
|
|
598
|
-
bcc?: string;
|
|
599
|
-
replyTo?: string;
|
|
600
|
-
}) => Promise<{
|
|
601
|
-
messageId: string;
|
|
602
|
-
sentAt: string;
|
|
603
|
-
}>;
|
|
604
|
-
};
|
|
605
|
-
notify?: {
|
|
606
|
-
send: (params: {
|
|
607
|
-
channel: string;
|
|
608
|
-
to: string[];
|
|
609
|
-
cc?: string[];
|
|
610
|
-
bcc?: string[];
|
|
611
|
-
subject?: string;
|
|
612
|
-
body?: string;
|
|
613
|
-
bodyType?: 'text' | 'html';
|
|
614
|
-
from?: string;
|
|
615
|
-
replyTo?: string;
|
|
616
|
-
}) => Promise<{
|
|
617
|
-
messageId: string;
|
|
618
|
-
sentAt: string;
|
|
619
|
-
}>;
|
|
620
|
-
};
|
|
621
|
-
bid?: {
|
|
622
|
-
submitBid: (params: {
|
|
623
|
-
collectionId: string;
|
|
624
|
-
role: string;
|
|
625
|
-
surveyAnswers: Record<string, any>;
|
|
626
|
-
}) => Promise<any>;
|
|
627
|
-
approveBid: (params: {
|
|
628
|
-
bidId: string;
|
|
629
|
-
collectionId: string;
|
|
630
|
-
did: string;
|
|
631
|
-
}) => Promise<any>;
|
|
632
|
-
rejectBid: (params: {
|
|
633
|
-
bidId: string;
|
|
634
|
-
collectionId: string;
|
|
635
|
-
did: string;
|
|
636
|
-
reason: string;
|
|
637
|
-
}) => Promise<any>;
|
|
638
|
-
approveServiceAgentApplication: (params: {
|
|
639
|
-
adminAddress: string;
|
|
640
|
-
collectionId: string;
|
|
641
|
-
agentQuota: number;
|
|
642
|
-
deedDid: string;
|
|
643
|
-
currentUserAddress: string;
|
|
644
|
-
}) => Promise<void>;
|
|
645
|
-
approveEvaluatorApplication: (params: {
|
|
646
|
-
adminAddress: string;
|
|
647
|
-
collectionId: string;
|
|
648
|
-
deedDid: string;
|
|
649
|
-
evaluatorAddress: string;
|
|
650
|
-
agentQuota?: number;
|
|
651
|
-
claimIds?: string[];
|
|
652
|
-
maxAmounts?: Array<{
|
|
653
|
-
denom: string;
|
|
654
|
-
amount: string;
|
|
655
|
-
}>;
|
|
656
|
-
}) => Promise<void>;
|
|
657
|
-
};
|
|
658
|
-
claim?: {
|
|
659
|
-
requestPin: (config?: {
|
|
660
|
-
title?: string;
|
|
661
|
-
description?: string;
|
|
662
|
-
submitText?: string;
|
|
663
|
-
}) => Promise<string>;
|
|
664
|
-
submitClaim: (params: {
|
|
665
|
-
surveyData: any;
|
|
666
|
-
deedDid: string;
|
|
667
|
-
collectionId: string;
|
|
668
|
-
adminAddress: string;
|
|
669
|
-
pin: string;
|
|
670
|
-
}) => Promise<{
|
|
671
|
-
transactionHash: string;
|
|
672
|
-
claimId: string;
|
|
673
|
-
}>;
|
|
674
|
-
evaluateClaim: (granteeAddress: string, did: string, payload: {
|
|
675
|
-
claimId: string;
|
|
676
|
-
collectionId: string;
|
|
677
|
-
adminAddress: string;
|
|
678
|
-
status?: number;
|
|
679
|
-
verificationProof: string;
|
|
680
|
-
amount?: {
|
|
681
|
-
denom: string;
|
|
682
|
-
amount: string;
|
|
683
|
-
} | Array<{
|
|
684
|
-
denom: string;
|
|
685
|
-
amount: string;
|
|
686
|
-
}>;
|
|
687
|
-
}) => Promise<void>;
|
|
688
|
-
getCurrentUser: () => {
|
|
689
|
-
address: string;
|
|
690
|
-
};
|
|
691
|
-
createUdid?: (params: any) => Promise<any>;
|
|
692
|
-
};
|
|
693
|
-
matrix?: {
|
|
694
|
-
storeCredential: (params: {
|
|
695
|
-
roomId: string;
|
|
696
|
-
credentialKey: string;
|
|
697
|
-
credential: Record<string, any>;
|
|
698
|
-
cid: string;
|
|
699
|
-
}) => Promise<{
|
|
700
|
-
storedAt: string;
|
|
701
|
-
duplicate: boolean;
|
|
702
|
-
}>;
|
|
703
|
-
};
|
|
704
|
-
}
|
|
705
|
-
interface OutputSchemaField {
|
|
706
|
-
path: string;
|
|
707
|
-
displayName: string;
|
|
708
|
-
type: 'string' | 'number' | 'boolean' | 'object' | 'array';
|
|
709
|
-
description?: string;
|
|
710
|
-
}
|
|
711
|
-
interface ActionDefinition {
|
|
712
|
-
type: string;
|
|
713
|
-
/** UCAN-style ability string used by the flow compiler, e.g., "bid/submit". */
|
|
714
|
-
can?: string;
|
|
715
|
-
sideEffect: boolean;
|
|
716
|
-
defaultRequiresConfirmation: boolean;
|
|
717
|
-
requiredCapability?: string;
|
|
718
|
-
inputSchema?: object;
|
|
719
|
-
/** Static output schema for action types with predictable output (e.g. email.send).
|
|
720
|
-
* For action types with dynamic output (e.g. http.request), the schema is user-defined in inputs. */
|
|
721
|
-
outputSchema?: OutputSchemaField[];
|
|
722
|
-
run: (inputs: Record<string, any>, ctx: ActionContext) => Promise<ActionResult>;
|
|
723
|
-
}
|
|
724
|
-
interface ActionResult {
|
|
725
|
-
output: Record<string, any>;
|
|
726
|
-
}
|
|
727
|
-
|
|
728
|
-
/** Registry interface expected by the compiler (keeps it pure / testable). */
|
|
729
|
-
interface CompilerRegistry {
|
|
730
|
-
getActionByCan(can: string): ActionDefinition | undefined;
|
|
731
|
-
}
|
|
732
|
-
/**
|
|
733
|
-
* Compile a Base UCAN flow plan into blocks, graph state, and metadata.
|
|
734
|
-
*
|
|
735
|
-
* This is a **pure function** — no React, no Yjs, no side effects.
|
|
736
|
-
* The output is consumed by `hydrateFlowFromPlan()`.
|
|
737
|
-
*/
|
|
738
|
-
declare function compileBaseUcanFlow(plan: BaseUcanFlow, registry: CompilerRegistry): CompiledFlow;
|
|
739
|
-
|
|
740
|
-
interface SetupFlowOptions {
|
|
741
|
-
/** The Base UCAN flow plan to compile. */
|
|
742
|
-
plan: BaseUcanFlow;
|
|
743
|
-
/** Matrix room ID to hydrate the flow into. */
|
|
744
|
-
roomId: string;
|
|
745
|
-
/** Authenticated Matrix client. */
|
|
746
|
-
matrixClient: MatrixClient;
|
|
747
|
-
/** DID of the user setting up the flow. */
|
|
748
|
-
creatorDid: string;
|
|
749
|
-
/** Optional doc ID override (defaults to plan.flowId). */
|
|
750
|
-
docId?: string;
|
|
751
|
-
}
|
|
752
|
-
interface SetupFlowResult {
|
|
753
|
-
/** The compiled flow artifacts. */
|
|
754
|
-
compiled: CompiledFlow;
|
|
755
|
-
/** The room ID (same as input, for convenience). */
|
|
756
|
-
roomId: string;
|
|
757
|
-
/** The flow ID from the plan. */
|
|
758
|
-
flowId: string;
|
|
759
|
-
}
|
|
760
|
-
/**
|
|
761
|
-
* One-shot function that compiles a Base UCAN flow plan and writes it
|
|
762
|
-
* into a Matrix room's Y.Doc. After this completes, the room is a
|
|
763
|
-
* normal flow that anyone can open via `useCreateCollaborativeIxoEditor`.
|
|
764
|
-
*
|
|
765
|
-
* Usage:
|
|
766
|
-
* ```ts
|
|
767
|
-
* const result = await setupFlowFromBaseUcan({
|
|
768
|
-
* plan: myBaseUcanFlow,
|
|
769
|
-
* roomId: '!abc:matrix.org',
|
|
770
|
-
* matrixClient,
|
|
771
|
-
* creatorDid: 'did:ixo:abc123',
|
|
772
|
-
* });
|
|
773
|
-
*
|
|
774
|
-
* // Now open the flow through normal channels:
|
|
775
|
-
* // useCreateCollaborativeIxoEditor({ roomId: result.roomId, ... })
|
|
776
|
-
* ```
|
|
777
|
-
*/
|
|
778
|
-
declare function setupFlowFromBaseUcan(options: SetupFlowOptions): Promise<SetupFlowResult>;
|
|
779
|
-
|
|
780
|
-
export { isRuntimeRef as $, type AuthorizationResult as A, type BaseUcanFlow as B, type CompilerRegistry as C, type DelegationStore as D, type ExecuteNodeParams as E, type FlowRuntimeStateManager as F, type AuthorizationContextV2 as G, createUcanService as H, type UcanServiceConfig as I, type UcanServiceHandlers as J, SimpleUCANManager as K, type UCANManager as L, type CapabilityGrant as M, type NodeActionResult as N, type DerivedCapability as O, type ActionContext as P, type ActionResult as Q, type OutputSchemaField as R, type SetupFlowOptions as S, type ConditionRef as T, type UcanService as U, type ActorConstraint as V, type TTLConstraint as W, type RuntimeRef as X, type CompiledBlock as Y, type CompiledEdge as Z, type CompiledFlowNode as _, isNodeActive as a, createMemoryDelegationStore as b, createDelegationStore as c, createRuntimeStateManager as d, executeNode as e, findValidCapability as f, buildFlowNodeFromBlock as g, buildAuthzFromProps as h, isActorAuthorized as i, type ExecutionOutcome as j, type ExecutionContext as k, type AuthorizationContext as l, type ActivationResult as m, compileBaseUcanFlow as n, type SetupFlowResult as o, type FlowCapability as p, type CompiledFlow as q, type ActionDefinition as r, setupFlowFromBaseUcan as s, type ActionServices as t, clearRuntimeForTemplateClone as u, validateCapabilityChain as v, executeNodeWithInvocation as w, type ExecuteNodeParamsV2 as x, type ExecutionContextV2 as y, isActorAuthorizedV2 as z };
|