@oatscenter/trellis 0.100.0-rc.1

package/auth/protocol_wasm.d.ts

@@ -0,0 +1,179 @@
+import { type VerifiedAuthorizationContextHandle as WasmAuthorizationContextHandle } from "./protocol_wasm/trellis_protocol_wasm.js";
+/** Verification policy accepted by the Rust authorization protocol. */
+export type AuthorizationVerificationPolicy = {
+    nowUnixSeconds: number;
+    allowedClockSkewSeconds: number;
+    maximumContextLifetimeSeconds: number;
+    maximumContextBytes: number;
+    maximumPermissions: number;
+};
+/** Context verification policy fields used to schedule refresh. */
+export type AuthorizationContextVerificationPolicy = AuthorizationVerificationPolicy & {
+    refreshLeadSeconds: number;
+    refreshJitterSeconds: number;
+};
+/** Online issuer entry and signed context supplied to a local verifier. */
+export type AuthorizationContextVerificationInput = {
+    issuer: AuthorizationIssuerKey;
+    context: unknown;
+};
+/** Public issuer entry authenticated by the configured Trellis origin. */
+export type AuthorizationIssuerKey = {
+    keyId: string;
+    publicKey: string;
+    state: "active" | "retired" | "revoked";
+};
+/** Meta-authority not represented by ordinary permission atoms. */
+export type PlatformPrivilege = "trellis.auth::admin";
+/** One exact API or participant-resource permission target. */
+export type PermissionTarget = {
+    kind: "apiSurface";
+    api: string;
+    surface: "rpc" | "operation" | "event" | "feed" | "state";
+    name: string;
+} | {
+    kind: "participantResource";
+    participant: string;
+    resource: "kv" | "store" | "jobQueue" | "eventConsumer" | "state";
+    name: string;
+} | {
+    kind: "operationSignal";
+    api: string;
+    operation: string;
+    signal: string;
+};
+/** One exact machine-enforceable permission atom. */
+export type PermissionAtom = {
+    target: PermissionTarget;
+    action: "call" | "invoke" | "observe" | "cancel" | "control" | "publish" | "subscribe" | "read" | "write" | "delete" | "submit" | "process" | "consume";
+};
+/** Grant set projection returned by local authorization verification. */
+export type GrantSet = {
+    format: "trellis.grant-set.v1";
+    permissions: PermissionAtom[];
+};
+/** Verified request caller projection. */
+export type VerifiedAuthorizationRequestProjection = {
+    contextDigest: string;
+};
+/** Verified event publisher projection. */
+export type VerifiedAuthorizationEventPublisher = {
+    kind: "user" | "service" | "device";
+    deploymentId: string | null;
+    instanceId: string | null;
+    participantId: string;
+    connectionId: string;
+    loginSessionId: string | null;
+};
+/** Verified event publisher projection. */
+export type VerifiedAuthorizationEventProjection = VerifiedAuthorizationRequestProjection & {
+    publisher: VerifiedAuthorizationEventPublisher;
+};
+/** Stable error categories returned by local authorization verification. */
+export type AuthorizationVerificationErrorCode = "InvalidInput" | "SerializationError" | "InvalidFormat" | "UnsafeJsonInteger" | "InvalidEncoding" | "InvalidPublicKey" | "InvalidKeyId" | "InvalidSignature" | "UnknownCriticalExtension" | "NonCanonicalSet" | "InvalidValidityWindow" | "IssuerRevoked" | "IssuerRetired" | "HistoricalContext" | "ContextNotYetValid" | "ContextExpired" | "ContextLifetimeExceeded" | "InvalidSessionKey" | "PermissionDenied" | "ContextTooLarge" | "ProofIatOutOfRange" | "InvalidRequestProof" | "ReplySubjectMismatch" | "InvalidEventTime" | "InvalidEventProof" | "EventRevoked";
+/** Stable structured local authorization failure. */
+export type AuthorizationVerificationError = {
+    code: AuthorizationVerificationErrorCode;
+    path: string;
+};
+/** Result envelope returned by a local request authorization verifier. */
+export type VerifyAuthorizationRequestResult = ({
+    ok: true;
+} & VerifiedAuthorizationRequestProjection) | {
+    ok: false;
+    error: AuthorizationVerificationError;
+};
+/** Result envelope returned by a local event authorization verifier. */
+export type VerifyAuthorizationEventResult = ({
+    ok: true;
+} & VerifiedAuthorizationEventProjection) | {
+    ok: false;
+    error: AuthorizationVerificationError;
+};
+/** Arguments for local context-bound request authorization. */
+export type VerifyAuthorizationRequestArgs = {
+    contextHandle: AuthorizationContextHandle;
+    subject: string;
+    reply: string | null;
+    payload: Uint8Array;
+    iat: number;
+    requestId: string;
+    proof: string;
+    requiredPermissions: PermissionAtom[];
+    policy: AuthorizationVerificationPolicy;
+};
+/** Arguments for local context-bound event authorization. */
+export type VerifyAuthorizationEventArgs = {
+    contextHandle: AuthorizationContextHandle;
+    descriptorIdentity: string;
+    subject: string;
+    payload: Uint8Array;
+    eventId: string;
+    eventTime: string;
+    proof: string;
+    policy: AuthorizationVerificationPolicy;
+    revokedAt?: number | null;
+};
+/** Projection returned after verifying an online-issued context. */
+export type VerifiedAuthorizationContextTokenProjection = {
+    issuer: AuthorizationIssuerKey;
+    contextDigest: string;
+    refreshAt: number;
+    context: Record<string, unknown> & {
+        ownerKind: "deployment" | "user";
+        ownerId: string;
+        grantRevision: number;
+        principalId: string;
+        principalKind: "user" | "service" | "device";
+        participantId: string;
+        identityKeyId: string | null;
+        loginSessionId: string | null;
+        deploymentId: string | null;
+        instanceId: string | null;
+        issuerKeyId: string;
+        connectionId: string;
+        sessionKey: string;
+        inboxPrefix: string;
+        issuedAt: number;
+        notBefore: number;
+        expiresAt: number;
+        grants: GrantSet;
+        platformPrivileges: PlatformPrivilege[];
+    };
+};
+/** Opaque Rust/WASM verification state for one authorization context. */
+export type AuthorizationContextHandle = WasmAuthorizationContextHandle;
+/** Initialize the shared Rust protocol implementation before asynchronous use. */
+export declare function initializeProtocolWasm(): Promise<void>;
+/** Initialize the shared Rust protocol implementation before synchronous use. */
+export declare function initializeProtocolWasmSync(): void;
+/** Derive an API-qualified event subject through the shared Rust protocol. */
+export declare function eventSubjectWasm(apiId: string, action: string): Promise<string>;
+/** Compute the shared query binding for an opaque pagination cursor. */
+export declare function paginationQueryDigest(endpoint: string, query: unknown): Promise<string>;
+/** Encode a value with the shared versioned pagination cursor codec. */
+export declare function encodePaginationCursor(queryDigest: string, after: unknown): Promise<string>;
+/** Decode and query-bind a value with the shared pagination cursor codec. */
+export declare function decodePaginationCursor<T>(cursor: string, queryDigest: string): Promise<T>;
+/** Verify a complete signed authorization context through Rust/WASM. */
+export declare function verifyAuthorizationContextWasm(args: {
+    issuer: AuthorizationIssuerKey;
+    context: unknown;
+    policy: AuthorizationContextVerificationPolicy;
+}): Promise<VerifiedAuthorizationContextTokenProjection>;
+/** Verify and retain one authorization context for repeated proof checks. */
+export declare function createAuthorizationContextHandleWasm(args: {
+    issuer: AuthorizationIssuerKey;
+    context: unknown;
+    policy: AuthorizationContextVerificationPolicy;
+    historical?: boolean;
+}): Promise<{
+    handle: AuthorizationContextHandle;
+    verified: VerifiedAuthorizationContextTokenProjection;
+}>;
+/** Require an opaque verified context to be currently eligible. */
+export declare function assertAuthorizationContextHandleCurrentWasm(handle: AuthorizationContextHandle, policy: AuthorizationContextVerificationPolicy): void;
+/** Verify one context-bound request proof using actual received request bytes. */
+export declare function verifyAuthorizationRequestWasm(args: VerifyAuthorizationRequestArgs): Promise<VerifyAuthorizationRequestResult>;
+/** Verify one context-bound event proof, including historical time/revocation checks. */
+export declare function verifyAuthorizationEventWasm(args: VerifyAuthorizationEventArgs): Promise<VerifyAuthorizationEventResult>;

package/auth/protocol_wasm.js

@@ -0,0 +1,133 @@
+import init, { initSync, } from "./protocol_wasm/trellis_protocol_wasm.js";
+import * as protocolWasmModule from "./protocol_wasm/trellis_protocol_wasm.js";
+import { PROTOCOL_WASM_BASE64 } from "./protocol_wasm/trellis_protocol_wasm_bytes.js";
+import { base64urlDecode } from "./utils.js";
+const protocolWasm = protocolWasmModule;
+let initialized;
+let initializedSync = false;
+async function wasmBytes() {
+    const url = new URL("./protocol_wasm/trellis_protocol_wasm_bg.wasm", import.meta.url);
+    if (url.protocol === "file:") {
+        const { readFile } = await import("node:fs/promises");
+        return new Uint8Array(await readFile(url));
+    }
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`authorization protocol WASM returned HTTP ${response.status}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+}
+/** Initialize the shared Rust protocol implementation before asynchronous use. */
+export async function initializeProtocolWasm() {
+    initialized ??= (async () => {
+        await init({ module_or_path: await wasmBytes() });
+    })();
+    await initialized;
+}
+/** Initialize the shared Rust protocol implementation before synchronous use. */
+export function initializeProtocolWasmSync() {
+    if (initializedSync)
+        return;
+    const url = new URL("./protocol_wasm/trellis_protocol_wasm_bg.wasm", import.meta.url);
+    const runtime = globalThis;
+    const process = runtime["pro" + "cess"];
+    if (process?.versions?.node && process.getBuiltinModule) {
+        initSync({
+            module: process.getBuiltinModule("node:fs").readFileSync(url),
+        });
+        initializedSync = true;
+        return;
+    }
+    const binary = atob(PROTOCOL_WASM_BASE64);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    initSync({ module: bytes });
+    initializedSync = true;
+}
+/** Derive an API-qualified event subject through the shared Rust protocol. */
+export async function eventSubjectWasm(apiId, action) {
+    await initializeProtocolWasm();
+    return protocolWasm.event_subject(apiId, action);
+}
+/** Compute the shared query binding for an opaque pagination cursor. */
+export async function paginationQueryDigest(endpoint, query) {
+    await initializeProtocolWasm();
+    return protocolWasm.pagination_query_digest(endpoint, JSON.stringify(query));
+}
+/** Encode a value with the shared versioned pagination cursor codec. */
+export async function encodePaginationCursor(queryDigest, after) {
+    await initializeProtocolWasm();
+    return protocolWasm.encode_pagination_cursor(queryDigest, JSON.stringify(after));
+}
+/** Decode and query-bind a value with the shared pagination cursor codec. */
+export async function decodePaginationCursor(cursor, queryDigest) {
+    await initializeProtocolWasm();
+    return JSON.parse(protocolWasm.decode_pagination_cursor(cursor, queryDigest));
+}
+/** Verify a complete signed authorization context through Rust/WASM. */
+export async function verifyAuthorizationContextWasm(args) {
+    const { handle, verified } = await createAuthorizationContextHandleWasm(args);
+    handle.free();
+    return verified;
+}
+/** Verify and retain one authorization context for repeated proof checks. */
+export async function createAuthorizationContextHandleWasm(args) {
+    await initializeProtocolWasm();
+    const handle = protocolWasm.create_authorization_context_handle(JSON.stringify(args.issuer), JSON.stringify(args.context), JSON.stringify(wasmVerificationPolicy(args.policy)), args.historical ?? false);
+    try {
+        const result = JSON.parse(handle.projection());
+        const jitter = contextJitter(result.contextDigest, args.policy.refreshJitterSeconds);
+        return {
+            handle,
+            verified: {
+                ...result,
+                refreshAt: result.context.expiresAt - args.policy.refreshLeadSeconds -
+                    jitter,
+            },
+        };
+    }
+    catch (error) {
+        handle.free();
+        throw error;
+    }
+}
+/** Require an opaque verified context to be currently eligible. */
+export function assertAuthorizationContextHandleCurrentWasm(handle, policy) {
+    handle.assert_current(JSON.stringify(wasmVerificationPolicy(policy)));
+}
+/** Verify one context-bound request proof using actual received request bytes. */
+export async function verifyAuthorizationRequestWasm(args) {
+    await initializeProtocolWasm();
+    const { contextHandle, payload, ...input } = args;
+    return JSON.parse(protocolWasm.verify_authorization_request(contextHandle, JSON.stringify({
+        ...input,
+        policy: wasmVerificationPolicy(args.policy),
+    }), payload));
+}
+/** Verify one context-bound event proof, including historical time/revocation checks. */
+export async function verifyAuthorizationEventWasm(args) {
+    await initializeProtocolWasm();
+    const { contextHandle, payload, ...input } = args;
+    return JSON.parse(protocolWasm.verify_authorization_event(contextHandle, JSON.stringify({
+        ...input,
+        policy: wasmVerificationPolicy(args.policy),
+    }), payload));
+}
+function wasmVerificationPolicy(policy) {
+    return {
+        nowUnixSeconds: policy.nowUnixSeconds,
+        allowedClockSkewSeconds: policy.allowedClockSkewSeconds,
+        maximumContextLifetimeSeconds: policy.maximumContextLifetimeSeconds,
+        maximumContextBytes: policy.maximumContextBytes,
+        maximumPermissions: policy.maximumPermissions,
+    };
+}
+function contextJitter(contextDigest, maximum) {
+    const bytes = base64urlDecode(contextDigest);
+    let value = 0n;
+    for (const byte of bytes.slice(0, 8))
+        value = (value << 8n) | BigInt(byte);
+    return Number(value % BigInt(maximum + 1));
+}

package/auth/session_auth.d.ts

@@ -0,0 +1,30 @@
+import { type Authenticator } from "@nats-io/nats-core";
+import type { AuthorizationProviderCache } from "./authorization_context.ts";
+import { type SessionProof, type SessionProofInput } from "./session_proof.ts";
+export type NatsConnectOptions = {
+    authenticator: Authenticator | Authenticator[];
+    inboxPrefix: string;
+};
+export type TrellisAuth = {
+    sessionKey: string;
+    sessionNkey: string;
+    sign: (data: Uint8Array) => Promise<Uint8Array>;
+    currentIat: () => number;
+    setServerClockOffsetMs: (clockOffsetMs: number) => void;
+    /** Current authorization-context digest bound into v1 request and event proofs. */
+    contextDigest: () => string;
+    /** Local verifier for received requests and events. */
+    authorizationProviderCache?: AuthorizationProviderCache;
+    createProof: (subject: string, payloadHash: Uint8Array, reply: string, requestId?: string, iat?: number) => Promise<string>;
+    signSessionProof: (input: SessionProofInput) => Promise<SessionProof>;
+    natsConnectOptions: (opts: {
+        sessionId: string;
+        contextDigest: string | (() => string);
+        jwt: string | (() => string);
+        authorizationUsable?: () => boolean;
+    }) => Promise<NatsConnectOptions>;
+};
+export declare function createAuth(opts: {
+    sessionKeySeed: string;
+    contextDigest?: string | (() => string);
+}): Promise<TrellisAuth>;

package/auth/session_auth.js

@@ -0,0 +1,77 @@
+import { jwtAuthenticator } from "@nats-io/nats-core";
+import { fromSeed, Prefix } from "@nats-io/nkeys";
+import { Codec } from "@nats-io/nkeys/lib/codec.js";
+import { ulid } from "ulid";
+import { importEd25519PrivateKeyFromSeedBase64url, publicKeyBase64urlFromSeed, } from "./keys.js";
+import { createProof } from "./proof.js";
+import { signSessionProof, } from "./session_proof.js";
+import { correctedIatSeconds } from "./time.js";
+import { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";
+export async function createAuth(opts) {
+    const seed = base64urlDecode(opts.sessionKeySeed);
+    const privateKey = await importEd25519PrivateKeyFromSeedBase64url(opts.sessionKeySeed);
+    const sessionKey = publicKeyBase64urlFromSeed(seed);
+    const encodedSeed = Codec.encodeSeed(Prefix.User, seed);
+    const sessionNkey = fromSeed(encodedSeed).getPublicKey();
+    let serverClockOffsetMs = 0;
+    const resolveContextDigest = () => {
+        const digest = typeof opts.contextDigest === "function"
+            ? opts.contextDigest()
+            : opts.contextDigest;
+        if (digest === undefined) {
+            throw new Error("contextDigest is required to sign v1 request proofs");
+        }
+        return digest;
+    };
+    const sign = async (data) => {
+        const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(data));
+        return new Uint8Array(sig);
+    };
+    const currentIat = () => correctedIatSeconds(Date.now(), serverClockOffsetMs);
+    return {
+        sessionKey,
+        sessionNkey,
+        sign,
+        currentIat,
+        setServerClockOffsetMs: (clockOffsetMs) => {
+            serverClockOffsetMs = clockOffsetMs;
+        },
+        contextDigest: resolveContextDigest,
+        createProof: (subject, payloadHash, reply, requestId, iat) => createProof(privateKey, {
+            contextDigest: resolveContextDigest(),
+            subject,
+            reply,
+            payloadHash,
+            iat: iat ?? currentIat(),
+            requestId: requestId ?? ulid(),
+        }),
+        signSessionProof: (input) => signSessionProof(input, privateKey, sessionKey),
+        natsConnectOptions: (options) => {
+            return Promise.resolve({
+                authenticator: [
+                    jwtAuthenticator(options.jwt, encodedSeed),
+                    (nonce) => {
+                        if (options.authorizationUsable?.() === false) {
+                            throw new Error("authorization context is suspended");
+                        }
+                        if (!nonce)
+                            throw new Error("NATS server nonce is required");
+                        const contextDigest = typeof options.contextDigest === "function"
+                            ? options.contextDigest()
+                            : options.contextDigest;
+                        if (!contextDigest) {
+                            throw new Error("contextDigest is required for NATS connect");
+                        }
+                        return {
+                            auth_token: JSON.stringify({
+                                format: "trellis.nats-connect-token.v1",
+                                contextDigest,
+                            }),
+                        };
+                    },
+                ],
+                inboxPrefix: `_INBOX.${options.sessionId}`,
+            });
+        },
+    };
+}

package/auth/session_proof.d.ts

@@ -0,0 +1,53 @@
+/** Strict signature envelope shared by auth, bootstrap, and context refresh. */
+export declare const SESSION_PROOF_FORMAT_V1: "trellis.session-proof.v1";
+/** One protocol-owned signature purpose. */
+export type SessionProofPurpose = "userAuthRequest" | "userAuthBind" | "serviceBootstrap" | "deviceBootstrap" | "deviceEnrollment" | "authorizationContextRefresh";
+/** Inputs validated and encoded by the Rust session-proof protocol. */
+export type SessionProofInput = {
+    purpose: "userAuthBind";
+    origin: string;
+    flowId: string;
+    sessionPublicKey: string;
+    unsignedRequest: Record<string, unknown> & {
+        issuedAt: number;
+    };
+} | {
+    purpose: "userAuthRequest";
+    origin: string;
+    unsignedRequest: Record<string, unknown> & {
+        issuedAt: number;
+    };
+} | {
+    purpose: "serviceBootstrap" | "deviceBootstrap" | "deviceEnrollment";
+    origin: string;
+    unsignedRequest: Record<string, unknown> & {
+        iat: number;
+    };
+} | {
+    purpose: "authorizationContextRefresh";
+    origin: string;
+    sessionPublicKey: string;
+    unsignedRequest: Record<string, unknown> & {
+        issuedAt: number;
+    };
+};
+/** One strict session-proof signature envelope. */
+export type SessionProof = {
+    format: typeof SESSION_PROOF_FORMAT_V1;
+    signature: string;
+};
+/** Freshness limits enforced by the Rust verifier. */
+export type SessionProofPolicy = {
+    maximumAgeMs: number;
+    maximumFutureSkewMs: number;
+};
+/** Parse and validate one signature envelope through Rust. */
+export declare function parseSessionProof(value: unknown): SessionProof;
+/** Hash a browser proof-bearing request using its protocol-owned payload rules. */
+export declare function sessionProofRequestDigest(request: Record<string, unknown>): Promise<string>;
+/** Return the protocol-owned signing digest without implementing its framing in JS. */
+export declare function sessionProofSigningDigest(input: SessionProofInput): Promise<string>;
+/** Sign the Rust-produced digest, then verify the declared key and signature in Rust. */
+export declare function signSessionProof(input: SessionProofInput, privateKey: CryptoKey, signerPublicKey: string): Promise<SessionProof>;
+/** Verify signature, signer binding, input shape, and freshness through Rust. */
+export declare function verifySessionProof(input: SessionProofInput, proof: SessionProof, signerPublicKey: string, nowMs: number, policy?: SessionProofPolicy): Promise<void>;

package/auth/session_proof.js

@@ -0,0 +1,43 @@
+import { initializeProtocolWasm, initializeProtocolWasmSync, } from "./protocol_wasm.js";
+import * as protocol from "./protocol_wasm/trellis_protocol_wasm.js";
+import { base64urlDecode, base64urlEncode, toArrayBuffer } from "./utils.js";
+/** Strict signature envelope shared by auth, bootstrap, and context refresh. */
+export const SESSION_PROOF_FORMAT_V1 = "trellis.session-proof.v1";
+/** Parse and validate one signature envelope through Rust. */
+export function parseSessionProof(value) {
+    initializeProtocolWasmSync();
+    return JSON.parse(protocol.parse_session_proof(JSON.stringify(value)));
+}
+/** Hash a browser proof-bearing request using its protocol-owned payload rules. */
+export async function sessionProofRequestDigest(request) {
+    await initializeProtocolWasm();
+    return protocol.session_proof_request_digest(JSON.stringify(request));
+}
+/** Return the protocol-owned signing digest without implementing its framing in JS. */
+export async function sessionProofSigningDigest(input) {
+    await initializeProtocolWasm();
+    return protocol.session_proof_signing_digest(JSON.stringify(input));
+}
+/** Sign the Rust-produced digest, then verify the declared key and signature in Rust. */
+export async function signSessionProof(input, privateKey, signerPublicKey) {
+    const digest = base64urlDecode(await sessionProofSigningDigest(input));
+    const signature = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
+    const proof = {
+        format: SESSION_PROOF_FORMAT_V1,
+        signature: base64urlEncode(new Uint8Array(signature)),
+    };
+    await verifySessionProof(input, proof, signerPublicKey, Number(input.purpose === "serviceBootstrap" ||
+        input.purpose === "deviceBootstrap" ||
+        input.purpose === "deviceEnrollment"
+        ? input.unsignedRequest.iat
+        : input.unsignedRequest.issuedAt), { maximumAgeMs: 0, maximumFutureSkewMs: 0 });
+    return proof;
+}
+/** Verify signature, signer binding, input shape, and freshness through Rust. */
+export async function verifySessionProof(input, proof, signerPublicKey, nowMs, policy = {
+    maximumAgeMs: 30_000,
+    maximumFutureSkewMs: 30_000,
+}) {
+    await initializeProtocolWasm();
+    protocol.verify_session_proof(JSON.stringify(input), JSON.stringify(proof), signerPublicKey, nowMs, policy.maximumAgeMs, policy.maximumFutureSkewMs);
+}

package/auth/time.d.ts

@@ -0,0 +1,6 @@
+export declare function estimateMidpointClockOffsetMs(args: {
+    requestStartedAtMs: number;
+    responseReceivedAtMs: number;
+    serverNowSeconds: number;
+}): number;
+export declare function correctedIatSeconds(nowMs?: number, clockOffsetMs?: number): number;

package/auth/time.js

@@ -0,0 +1,7 @@
+export function estimateMidpointClockOffsetMs(args) {
+    const midpointMs = (args.requestStartedAtMs + args.responseReceivedAtMs) / 2;
+    return args.serverNowSeconds * 1_000 - midpointMs;
+}
+export function correctedIatSeconds(nowMs = Date.now(), clockOffsetMs = 0) {
+    return Math.floor((nowMs + clockOffsetMs) / 1_000);
+}

package/auth/trellis_id.d.ts

@@ -0,0 +1 @@
+export declare function trellisIdFromOriginId(origin: string, id: string): Promise<string>;

package/auth/trellis_id.js

@@ -0,0 +1,5 @@
+import { base64urlEncode, sha256, utf8 } from "./utils.js";
+export async function trellisIdFromOriginId(origin, id) {
+    const digest = await sha256(utf8(`${origin}:${id}`));
+    return base64urlEncode(digest).slice(0, 22);
+}

package/auth/utils.d.ts

@@ -0,0 +1,10 @@
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare function utf8(s: string): Uint8Array;
+export declare function canonicalizeJson(value: JsonValue): string;
+export declare function toArrayBuffer(data: Uint8Array): ArrayBuffer;
+export declare function base64urlEncode(data: Uint8Array): string;
+export declare function base64urlDecode(s: string): Uint8Array;
+export declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+export declare function canonicalizeJsonValue(value: unknown): string;

package/auth/utils.js

@@ -0,0 +1,69 @@
+export function utf8(s) {
+    return new TextEncoder().encode(s);
+}
+export function canonicalizeJson(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number")
+        return JSON.stringify(value);
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalizeJson).join(",")}]`;
+    }
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalizeJson(value[key])}`).join(",")}}`;
+}
+export function toArrayBuffer(data) {
+    const buf = data.buffer;
+    if (buf instanceof ArrayBuffer) {
+        return buf.slice(data.byteOffset, data.byteOffset + data.byteLength);
+    }
+    const copy = new Uint8Array(data.byteLength);
+    copy.set(data);
+    return copy.buffer;
+}
+export function base64urlEncode(data) {
+    const b64 = btoa(String.fromCharCode(...data));
+    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export function base64urlDecode(s) {
+    const normalized = s.replace(/-/g, "+").replace(/_/g, "/");
+    const padLen = (4 - (normalized.length % 4)) % 4;
+    const padded = normalized + "=".repeat(padLen);
+    const bin = atob(padded);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+export async function sha256(data) {
+    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(data));
+    return new Uint8Array(digest);
+}
+function canonicalizeUnknownJsonValue(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("JSON numbers must be finite");
+        return JSON.stringify(value);
+    }
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalizeUnknownJsonValue).join(",")}]`;
+    }
+    if (typeof value === "object") {
+        const keys = Object.keys(value).sort();
+        return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalizeUnknownJsonValue(value[key])}`).join(",")}}`;
+    }
+    throw new Error("Value is not JSON-serializable");
+}
+export function canonicalizeJsonValue(value) {
+    return canonicalizeUnknownJsonValue(value);
+}

package/auth.d.ts

@@ -0,0 +1 @@
+export * from "./auth/mod.ts";

package/auth.js

@@ -0,0 +1 @@
+export * from "./auth/mod.js";