@kubun/id 0.12.0 → 0.13.0

package/lib/base.d.ts

@@ -14,12 +14,15 @@ export type ModelType = typeof MODEL_SCALAR | typeof MODEL_SHAPE | typeof MODEL_
  */
 export declare const DOCUMENT_MERGE = 30;
 export type DocumentType = typeof DOCUMENT_MERGE;
+export declare const CREDENTIAL_KEY = 31;
+export declare const CREDENTIAL_ENTRY = 32;
+export type CredentialType = typeof CREDENTIAL_KEY | typeof CREDENTIAL_ENTRY;
 /**
  * External references
  */
 export declare const EXTERNAL_PLUGIN_NODE = 40;
 export type ExternalType = typeof EXTERNAL_PLUGIN_NODE;
-export type KubunType = AttachmentType | ModelType | DocumentType | ExternalType;
+export type KubunType = AttachmentType | ModelType | DocumentType | CredentialType | ExternalType;
 export declare class KubunID<T extends KubunType = KubunType> {
     #private;
     constructor(type: T, dataBytes: Uint8Array);

package/lib/base.js

@@ -15,6 +15,8 @@ export const MODEL_CLUSTER = 21;
 /**
  * Mutable references
  */ export const DOCUMENT_MERGE = 30;
+export const CREDENTIAL_KEY = 31;
+export const CREDENTIAL_ENTRY = 32;
 /**
  * External references
  */ export const EXTERNAL_PLUGIN_NODE = 40;

package/lib/credential.d.ts

@@ -0,0 +1,34 @@
+import { CREDENTIAL_ENTRY, CREDENTIAL_KEY, KubunID } from './base.js';
+/**
+ * A credential key: the unit a wrapping addresses, a grant shares and a rotation
+ * bumps.
+ *
+ * Not content-addressed. Rotation preserves the id and moves `version`, so a
+ * document referencing a key keeps referencing it across rotations — which is
+ * the whole reason rotation does not mint a new id.
+ */
+export declare class CredentialKeyID extends KubunID<typeof CREDENTIAL_KEY> {
+    #private;
+    static create(owner: string | Uint8Array, unique: Uint8Array): CredentialKeyID;
+    static fromBytes(input: Uint8Array): CredentialKeyID;
+    static fromString(input: string): CredentialKeyID;
+    static from(input: CredentialKeyID | Uint8Array | string): CredentialKeyID;
+    constructor(digest: Uint8Array);
+    get digest(): Uint8Array;
+}
+/**
+ * A credential entry: one encrypted value under a key.
+ *
+ * Does not embed its key's id. An entry can be re-keyed without every document
+ * that references it changing, and its value changes — a refreshed OAuth token —
+ * without the reference changing either.
+ */
+export declare class CredentialEntryID extends KubunID<typeof CREDENTIAL_ENTRY> {
+    #private;
+    static create(owner: string | Uint8Array, unique: Uint8Array): CredentialEntryID;
+    static fromBytes(input: Uint8Array): CredentialEntryID;
+    static fromString(input: string): CredentialEntryID;
+    static from(input: CredentialEntryID | Uint8Array | string): CredentialEntryID;
+    constructor(digest: Uint8Array);
+    get digest(): Uint8Array;
+}

package/lib/credential.js

@@ -0,0 +1,110 @@
+import { fromUTF } from '@sozai/codec';
+import { base36 } from 'multiformats/bases/base36';
+import { CREDENTIAL_ENTRY, CREDENTIAL_KEY, KubunID, NAMESPACE_CODE } from './base.js';
+import { concat } from './bytes.js';
+import { decodeVarint, digestBytes, encodeVarint } from './utils.js';
+function encodeData(digest) {
+    return concat([
+        encodeVarint(digest.byteLength),
+        digest
+    ]);
+}
+function decodeDigest(input, expected) {
+    let offset = 0;
+    // Check namespace = is it a KubunID?
+    const [namespace, namespaceLength] = decodeVarint(input);
+    if (namespace !== NAMESPACE_CODE) {
+        throw new Error('Invalid KubunID: namespace mismatch');
+    }
+    offset += namespaceLength;
+    // Check type matches
+    const [type, typeLength] = decodeVarint(input, offset);
+    if (type !== expected) {
+        throw new Error('Invalid KubunID: type mismatch');
+    }
+    offset += typeLength;
+    const [digestLength, digestVarintLength] = decodeVarint(input, offset);
+    offset += digestVarintLength;
+    return input.slice(offset, offset + digestLength);
+}
+function createDigest(owner, unique) {
+    return digestBytes(concat([
+        typeof owner === 'string' ? fromUTF(owner) : owner,
+        unique
+    ]));
+}
+/**
+ * A credential key: the unit a wrapping addresses, a grant shares and a rotation
+ * bumps.
+ *
+ * Not content-addressed. Rotation preserves the id and moves `version`, so a
+ * document referencing a key keeps referencing it across rotations — which is
+ * the whole reason rotation does not mint a new id.
+ */ export class CredentialKeyID extends KubunID {
+    static create(owner, unique) {
+        return new CredentialKeyID(createDigest(owner, unique));
+    }
+    static fromBytes(input) {
+        return new CredentialKeyID(decodeDigest(input, CREDENTIAL_KEY));
+    }
+    static fromString(input) {
+        return CredentialKeyID.fromBytes(base36.decode(input));
+    }
+    static from(input) {
+        if (input instanceof CredentialKeyID) {
+            return input;
+        }
+        if (input instanceof Uint8Array) {
+            return CredentialKeyID.fromBytes(input);
+        }
+        if (typeof input === 'string') {
+            return CredentialKeyID.fromString(input);
+        }
+        throw new Error('Unsupported input type');
+    }
+    #digest;
+    constructor(digest){
+        super(CREDENTIAL_KEY, encodeData(digest));
+        this.#digest = digest;
+    }
+    get digest() {
+        return this.#digest;
+    }
+}
+/**
+ * A credential entry: one encrypted value under a key.
+ *
+ * Does not embed its key's id. An entry can be re-keyed without every document
+ * that references it changing, and its value changes — a refreshed OAuth token —
+ * without the reference changing either.
+ */ export class CredentialEntryID extends KubunID {
+    static create(owner, unique) {
+        return new CredentialEntryID(createDigest(owner, unique));
+    }
+    static fromBytes(input) {
+        return new CredentialEntryID(decodeDigest(input, CREDENTIAL_ENTRY));
+    }
+    static fromString(input) {
+        return CredentialEntryID.fromBytes(base36.decode(input));
+    }
+    static from(input) {
+        if (input instanceof CredentialEntryID) {
+            return input;
+        }
+        if (input instanceof Uint8Array) {
+            return CredentialEntryID.fromBytes(input);
+        }
+        if (typeof input === 'string') {
+            return CredentialEntryID.fromString(input);
+        }
+        throw new Error('Unsupported input type');
+    }
+    #digest;
+    constructor(digest){
+        super(CREDENTIAL_ENTRY, encodeData(digest));
+        this.#digest = digest;
+    }
+    get digest() {
+        return this.#digest;
+    }
+}

package/lib/decode.js

@@ -1,7 +1,8 @@
 import { base36 } from 'multiformats/bases/base36';
 import { AttachmentID } from './attachment.js';
-import { ATTACHMENT_BINARY, DOCUMENT_MERGE, EXTERNAL_PLUGIN_NODE, MODEL_CLUSTER, MODEL_DOCUMENT, MODEL_SCALAR, MODEL_SHAPE, NAMESPACE_CODE } from './base.js';
+import { ATTACHMENT_BINARY, CREDENTIAL_ENTRY, CREDENTIAL_KEY, DOCUMENT_MERGE, EXTERNAL_PLUGIN_NODE, MODEL_CLUSTER, MODEL_DOCUMENT, MODEL_SCALAR, MODEL_SHAPE, NAMESPACE_CODE } from './base.js';
 import { ClusterModelID } from './cluster-model.js';
+import { CredentialEntryID, CredentialKeyID } from './credential.js';
 import { DocumentID } from './document.js';
 import { DocumentModelID, ScalarModelID, ShapeModelID } from './model.js';
 import { PluginNodeID } from './plugin-node.js';
@@ -26,6 +27,10 @@ export function decodeID(input) {
             return ClusterModelID.fromBytes(bytes);
         case DOCUMENT_MERGE:
             return DocumentID.fromBytes(bytes);
+        case CREDENTIAL_KEY:
+            return CredentialKeyID.fromBytes(bytes);
+        case CREDENTIAL_ENTRY:
+            return CredentialEntryID.fromBytes(bytes);
         case EXTERNAL_PLUGIN_NODE:
             return PluginNodeID.fromBytes(bytes);
         default:

package/lib/index.d.ts

@@ -1,6 +1,7 @@
 export { AttachmentID } from './attachment.js';
 export { KubunID } from './base.js';
 export { ClusterModelID } from './cluster-model.js';
+export { CredentialEntryID, CredentialKeyID } from './credential.js';
 export { decodeID } from './decode.js';
 export { DocumentID } from './document.js';
 export { DocumentModelID, ScalarModelID, ShapeModelID } from './model.js';

package/lib/index.js

@@ -1,6 +1,7 @@
 export { AttachmentID } from './attachment.js';
 export { KubunID } from './base.js';
 export { ClusterModelID } from './cluster-model.js';
+export { CredentialEntryID, CredentialKeyID } from './credential.js';
 export { decodeID } from './decode.js';
 export { DocumentID } from './document.js';
 export { DocumentModelID, ScalarModelID, ShapeModelID } from './model.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/id",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,7 +15,7 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "@noble/hashes": "^2.2.0",
+    "@noble/hashes": "^2.3.0",
     "@sozai/codec": "^0.4.0",
     "multiformats": "^14.0.5",
     "varint": "^6.0.0"
@@ -23,6 +23,9 @@
   "devDependencies": {
     "@types/varint": "^6.0.3"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",