@nimbus-sh/worker 0.1.0

package/dist/auth/types.js

@@ -0,0 +1,114 @@
+/**
+ * auth/types.ts — Public-facing types for the Nimbus auth surface.
+ *
+ * Two consumers:
+ *   1. The Worker (`@nimbus-sh/worker`) — reads `verifyNimbusToken` results
+ *      to gate `/s/<id>/` routes and pin DO instance names per-tenant.
+ *   2. The SDK (`@nimbus-sh/sdk`) — re-exports `issueNimbusToken` so an
+ *      embedder's Worker (or CLI) can mint tokens from a JWT secret.
+ *
+ * The on-the-wire shape is a JWS with HS256 signature, base64url-encoded:
+ *
+ *   <header>.<payload>.<signature>
+ *
+ * where the payload is a `NimbusTokenClaims` JSON object below. The header
+ * is the constant `{"alg":"HS256","typ":"JWT"}` — we don't permit alg
+ * variation (no `alg: "none"` confusion attack; we never read the header's
+ * `alg`).
+ */
+/** Default token TTL when `issueNimbusToken` is called without `ttlMs`. 1 hour. */
+export const DEFAULT_TOKEN_TTL_MS = 60 * 60 * 1000;
+/** Maximum permitted token TTL. 30 days. Prevents accidental long-lived secrets. */
+export const MAX_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Base error class for every auth-layer failure. Subclasses encode the
+ * specific failure mode in `code`.
+ *
+ * Why a class hierarchy instead of an `{ ok: false, code }` union? Two
+ * reasons: (1) embedders' error handlers naturally use `try/catch`, and
+ * an exception flow propagates without ceremony; (2) consumers in
+ * non-TypeScript environments (a Node SSR layer minting tokens) still
+ * get `error.code` introspection.
+ *
+ * Every subclass below is INSTANCEOF-compatible with this base, so a
+ * blanket `catch (e instanceof NimbusAuthError)` works.
+ */
+export class NimbusAuthError extends Error {
+    /** Machine-readable code for catch sites. Subclass-stable. */
+    code;
+    /** HTTP status the embedder's auth gate should map to (typically 401). */
+    httpStatus;
+    constructor(message, code, httpStatus = 401) {
+        super(message);
+        this.name = 'NimbusAuthError';
+        this.code = code;
+        this.httpStatus = httpStatus;
+    }
+}
+/** Thrown when JWT_SECRET env var is missing at issue/verify time. */
+export class NimbusAuthConfigError extends NimbusAuthError {
+    constructor(message = 'JWT_SECRET is not configured') {
+        super(message, 'E_AUTH_CONFIG_MISSING', 500);
+        this.name = 'NimbusAuthConfigError';
+    }
+}
+/** Thrown when the token shape is structurally invalid (not 3 parts, bad b64). */
+export class NimbusTokenMalformedError extends NimbusAuthError {
+    constructor(reason) {
+        super(`Malformed token: ${reason}`, 'E_TOKEN_MALFORMED');
+        this.name = 'NimbusTokenMalformedError';
+    }
+}
+/** Thrown when the HMAC signature does not verify against JWT_SECRET. */
+export class NimbusTokenSignatureError extends NimbusAuthError {
+    constructor() {
+        super('Token signature invalid', 'E_TOKEN_SIGNATURE');
+        this.name = 'NimbusTokenSignatureError';
+    }
+}
+/** Thrown when claims fail validation (missing scope, bad tn shape, etc.). */
+export class NimbusTokenClaimsError extends NimbusAuthError {
+    constructor(reason) {
+        super(`Invalid claims: ${reason}`, 'E_TOKEN_CLAIMS');
+        this.name = 'NimbusTokenClaimsError';
+    }
+}
+/** Thrown when `exp` is in the past (with no clock skew tolerance — strict). */
+export class NimbusTokenExpiredError extends NimbusAuthError {
+    /** Seconds the token expired ago (always ≥ 0). */
+    expiredAgoSec;
+    constructor(expiredAgoSec) {
+        super(`Token expired ${expiredAgoSec}s ago`, 'E_TOKEN_EXPIRED');
+        this.name = 'NimbusTokenExpiredError';
+        this.expiredAgoSec = expiredAgoSec;
+    }
+}
+/** Thrown when issue-time ttl exceeds {@link MAX_TOKEN_TTL_MS}. */
+export class NimbusTokenTtlError extends NimbusAuthError {
+    constructor(ttlMs, maxMs) {
+        super(`Token TTL ${ttlMs}ms exceeds maximum ${maxMs}ms`, 'E_TOKEN_TTL_TOO_LARGE', 400);
+        this.name = 'NimbusTokenTtlError';
+    }
+}
+/** Thrown when a route requires a scope the token doesn't carry. */
+export class NimbusScopeError extends NimbusAuthError {
+    requiredScope;
+    constructor(requiredScope) {
+        super(`Missing required scope: ${requiredScope}`, 'E_SCOPE_MISSING', 403);
+        this.name = 'NimbusScopeError';
+        this.requiredScope = requiredScope;
+    }
+}
+/** Thrown when sid-pin doesn't match the actual session being attached. */
+export class NimbusSessionPinError extends NimbusAuthError {
+    pinnedTo;
+    attempted;
+    constructor(pinnedTo, attempted) {
+        super(`Token pinned to session "${pinnedTo}" but request targets "${attempted}"`, 'E_SESSION_PIN_MISMATCH', 403);
+        this.name = 'NimbusSessionPinError';
+        this.pinnedTo = pinnedTo;
+        this.attempted = attempted;
+    }
+}
+/** Regex used to validate the `tn` and `sub` shape (per Mossaic §7.1). */
+export const ID_COMPONENT_RE = /^[A-Za-z0-9._-]{1,128}$/;

package/dist/bindings/d1.d.ts

@@ -0,0 +1,102 @@
+/**
+ * binding-d1.ts — D1 database emulator for nimbus-wrangler.
+ *
+ * Implements the Workers D1 runtime API
+ * (https://developers.cloudflare.com/d1/worker-api/) backed by the
+ * supervisor's own SqlStorage. Tables are namespaced per-binding via a
+ * lightweight identifier-rewriter so two D1 bindings on the same
+ * SqlStorage don't collide.
+ *
+ * Plan §14.1 (post-review amendment) recommends a child-DO-facet-per-
+ * binding architecture for full isolation in production. Implementation
+ * cost: a new DO class registered in src/index.ts + a wrangler.jsonc
+ * migration entry. Deferred to W10.5 — for W10 we ship the simpler
+ * single-storage variant with prefix-rewriting. Test seam preserves
+ * the contract so the upgrade is a drop-in replacement.
+ *
+ * Rewriter scope (deliberately narrow):
+ *   - CREATE [TABLE|INDEX|TRIGGER|VIEW] <name>      → prefixed
+ *   - DROP TABLE <name>                              → prefixed
+ *   - INSERT [OR ...] INTO <name>                    → prefixed
+ *   - SELECT ... FROM <name> [, <name>] ... [JOIN <name>] ...  → prefixed
+ *   - UPDATE <name>                                  → prefixed
+ *   - DELETE FROM <name>                             → prefixed
+ *   - WITH <cte> AS (SELECT ...)                     → CTE alias is NOT
+ *     prefixed (it's a query-local alias, not a real table); the inner
+ *     FROM <table> IS prefixed if it matches a known table
+ *
+ * SQL keywords are matched case-insensitively. We DO NOT rewrite inside
+ * string literals (single-quoted) or quoted identifiers in
+ * CREATE/INSERT/etc — the rewriter walks tokens, not bytes.
+ *
+ * Bind parameter forms: '?' positional only. Named parameters (':name')
+ * are NOT supported (D1 itself doesn't support them).
+ */
+import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
+export interface D1Result<T = Record<string, any>> {
+    success: boolean;
+    results?: T[];
+    meta: D1Meta;
+    error?: string;
+}
+export interface D1Meta {
+    duration: number;
+    changes: number;
+    last_row_id: number;
+    rows_read: number;
+    rows_written: number;
+    size_after?: number;
+    served_by: string;
+    changed_db: boolean;
+}
+export interface D1ExecResult {
+    count: number;
+    duration: number;
+}
+export interface D1EmulatorOptions {
+    /** workerd SqlStorage instance, e.g. ctx.storage.sql. */
+    sqlStorage: any;
+    binding: string;
+    vfs?: SqliteVFS | any;
+    root?: string;
+    migrationsDir?: string;
+    onLog?: (msg: string) => void;
+}
+export declare class D1PreparedStatementEmu {
+    /** @internal */
+    _sql: string;
+    /** @internal */
+    _params: any[];
+    private _emu;
+    constructor(emu: D1Emulator, sql: string, params: any[]);
+    bind(...values: any[]): D1PreparedStatementEmu;
+    first<T = any>(colName?: string): Promise<T | null>;
+    run<T = any>(): Promise<D1Result<T>>;
+    all<T = any>(): Promise<D1Result<T>>;
+    raw<T = any>(): Promise<T[]>;
+}
+export declare class D1Emulator {
+    private sql;
+    private prefix;
+    private prefixer;
+    private migrationsRun;
+    private migrationsDir?;
+    private vfs?;
+    private root?;
+    private onLog;
+    constructor(opts: D1EmulatorOptions);
+    prepare(query: string): D1PreparedStatementEmu;
+    batch<T = any>(stmts: D1PreparedStatementEmu[]): Promise<D1Result<T>[]>;
+    exec(query: string): Promise<D1ExecResult>;
+    /** @internal */
+    _runOne(sql: string, params: any[]): D1Result<any>;
+    /** Synchronous core (workerd SqlStorage.exec is sync). */
+    /** @internal */
+    _runOneSync(sql: string, params: any[]): D1Result<any>;
+    private _meta;
+    /** Apply migrations from migrations_dir if present. Idempotent. */
+    applyMigrations(): Promise<{
+        applied: number;
+    }>;
+}
+//# sourceMappingURL=d1.d.ts.map

package/dist/bindings/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../src/bindings/d1.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AACD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAkRD,qBAAa,sBAAsB;IACjC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB;IAChB,OAAO,EAAE,GAAG,EAAE,CAAC;IACf,OAAO,CAAC,IAAI,CAAa;gBAEb,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;IAMvD,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,sBAAsB;IAIxC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAQnD,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAIpC,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAIpC,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC;CAInC;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,GAAG,CAAC,CAAM;IAClB,OAAO,CAAC,IAAI,CAAC,CAAS;IACtB,OAAO,CAAC,KAAK,CAAsB;gBAEvB,IAAI,EAAE,iBAAiB;IAUnC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB;IAIxC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAyBvE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAahD,gBAAgB;IAChB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC;IAIlD,0DAA0D;IAC1D,gBAAgB;IAChB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC;IAkCtD,OAAO,CAAC,KAAK;IAYb,mEAAmE;IAC7D,eAAe,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAiCtD"}