@oatscenter/trellis 0.100.0-rc.1

package/auth/authorization/refresh.d.ts

@@ -0,0 +1,46 @@
+import { TrellisHttpError } from "../http_error.ts";
+import type { TrellisAuth } from "../session_auth.ts";
+import type { AuthorizationContextCache } from "./client_context.ts";
+import type { AuthorizationContextRefreshResponse, AuthorizationContextRefreshResult, VerifiedAuthorizationContext } from "./types.ts";
+/** HTTP refresh failure with terminal-state classification. */
+export declare class AuthorizationContextRefreshError extends TrellisHttpError {
+    readonly terminal: boolean;
+    readonly loginInvalid: boolean;
+    constructor(status: number, code: string);
+}
+/** Refresh a context after proving possession of its bound session key. */
+export declare function refreshAuthorizationContextWithMetadata(args: {
+    trellisUrl: string;
+    sessionId: string;
+    auth: TrellisAuth;
+    sessionKey?: string;
+    cache: AuthorizationContextCache;
+    fetch?: typeof globalThis.fetch;
+    shouldInstall?: () => boolean;
+    requiredTransport?: "native" | "websocket";
+    prepareInstall?: (response: AuthorizationContextRefreshResponse) => Promise<(verified: VerifiedAuthorizationContext) => void>;
+    prepareOnly?: boolean;
+}): Promise<AuthorizationContextRefreshResult>;
+/** Refresh a context and return only its verified projection. */
+export declare function refreshAuthorizationContext(args: {
+    trellisUrl: string;
+    sessionId: string;
+    auth: TrellisAuth;
+    sessionKey?: string;
+    cache: AuthorizationContextCache;
+    fetch?: typeof globalThis.fetch;
+    shouldInstall?: () => boolean;
+}): Promise<VerifiedAuthorizationContext>;
+/** Start proactive refresh using the context's distributed refresh time. */
+export declare function startAuthorizationContextRefresh(args: {
+    trellisUrl: string;
+    sessionId: string;
+    auth: TrellisAuth;
+    sessionKey?: string;
+    cache: AuthorizationContextCache;
+    fetch?: typeof globalThis.fetch;
+    refresh?: (shouldInstall: () => boolean) => Promise<VerifiedAuthorizationContext>;
+    onTerminalFailure?: (error: unknown) => void | Promise<void>;
+    onTransientFailure?: (error: unknown) => void | Promise<void>;
+    onRefresh?: (context: VerifiedAuthorizationContext) => void | Promise<void>;
+}): () => void;

package/auth/authorization/refresh.js

@@ -0,0 +1,246 @@
+import { Value } from "typebox/value";
+import { ulid } from "ulid";
+import { decodeTrellisHttpError, TrellisHttpError } from "../http_error.js";
+import { AuthorizationContextRefreshResponseSchema as ResponseSchema } from "./types.js";
+/** HTTP refresh failure with terminal-state classification. */
+export class AuthorizationContextRefreshError extends TrellisHttpError {
+    terminal;
+    loginInvalid;
+    constructor(status, code) {
+        super(status, code);
+        this.name = "AuthorizationContextRefreshError";
+        this.terminal = [
+            "session_not_found",
+            "session_expired",
+            "session_revoked",
+            "identity_not_found",
+            "identity_inactive",
+            "user_not_found",
+            "user_inactive",
+            "login_not_found",
+            "participant_not_found",
+            "participant_changed",
+            "contract_changed",
+            "authority_not_found",
+            "authority_rejected",
+            "authority_revoked",
+            "authority_expired",
+            "context_owner_mismatch",
+            "deployment_inactive",
+            "instance_inactive",
+            "device_inactive",
+            "activation_required",
+            "delegation_expired",
+            "context_refresh_mismatch",
+            "invalid_proof",
+        ].includes(code);
+        this.loginInvalid = [
+            "session_not_found",
+            "session_expired",
+            "session_revoked",
+            "identity_not_found",
+            "identity_inactive",
+            "user_not_found",
+            "user_inactive",
+            "login_not_found",
+        ].includes(code);
+    }
+}
+/** Refresh a context after proving possession of its bound session key. */
+export async function refreshAuthorizationContextWithMetadata(args) {
+    const fetch = args.fetch ?? globalThis.fetch;
+    const currentDigest = args.cache.storedContextDigest();
+    let runtime;
+    try {
+        runtime = args.cache.runtimeBinding();
+    }
+    catch {
+        runtime = undefined;
+    }
+    if (runtime?.loginSessionId && runtime.loginSessionId !== args.sessionId) {
+        throw new Error("authorization recovery session mismatch");
+    }
+    const requestStartedAt = args.cache.nowMilliseconds();
+    const unsignedRequest = {
+        requestId: ulid(),
+        issuedAt: Math.trunc(args.auth.currentIat() * 1_000),
+        loginSessionId: args.sessionId,
+        connectionId: runtime?.connectionId ?? ulid(),
+        sessionKey: args.sessionKey ?? args.auth.sessionKey,
+        currentContextDigest: currentDigest ?? null,
+    };
+    const proof = await args.auth.signSessionProof({
+        purpose: "authorizationContextRefresh",
+        origin: new URL(args.trellisUrl).origin,
+        sessionPublicKey: args.auth.sessionKey,
+        unsignedRequest,
+    });
+    const response = await fetch(new URL("/auth/context/refresh", args.trellisUrl), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ ...unsignedRequest, proof }),
+    });
+    if (!response.ok) {
+        const error = await decodeTrellisHttpError(response);
+        throw new AuthorizationContextRefreshError(error.status, error.code);
+    }
+    const next = Value.Parse(ResponseSchema, await response.json());
+    if (args.requiredTransport &&
+        !next.transports[args.requiredTransport]?.natsServers.length) {
+        throw new Error(`authorization refresh has no ${args.requiredTransport} NATS endpoints`);
+    }
+    const serverClockOffsetMs = next.serverNow - Math.trunc((requestStartedAt + args.cache.nowMilliseconds()) / 2);
+    args.cache.setServerClockOffsetMs(serverClockOffsetMs);
+    args.auth.setServerClockOffsetMs(serverClockOffsetMs);
+    if (args.shouldInstall?.() === false) {
+        throw new Error("authorization context refresh stopped");
+    }
+    const nextRuntime = runtimeBindingFromResponse(next);
+    const context = await args.cache[args.prepareOnly ? "prepare" : "install"](next.authorizationContext, {
+        bootstrapJwt: next.routing.bootstrapJwt,
+        bootstrapJwtExpiresAt: next.routing.bootstrapJwtExpiresAt,
+    }, Math.floor(next.serverNow / 1_000), args.shouldInstall, nextRuntime, async (verified) => {
+        const installAdditional = await args.prepareInstall?.(next);
+        return installAdditional ? () => installAdditional(verified) : undefined;
+    });
+    return { context, response: next };
+}
+/** Refresh a context and return only its verified projection. */
+export async function refreshAuthorizationContext(args) {
+    const result = await refreshAuthorizationContextWithMetadata(args);
+    return result.context;
+}
+/** Start proactive refresh using the context's distributed refresh time. */
+export function startAuthorizationContextRefresh(args) {
+    let stopped = false;
+    let timer;
+    let failures = 0;
+    let running = false;
+    let wakePending = false;
+    const schedule = (delayMs) => {
+        if (!stopped)
+            timer = setTimeout(run, delayMs);
+    };
+    const run = async () => {
+        if (running) {
+            wakePending = true;
+            return;
+        }
+        running = true;
+        const clearGuard = args.cache.clearGuard();
+        try {
+            let before;
+            try {
+                before = args.cache.storedContextDigest();
+            }
+            catch {
+                before = undefined;
+            }
+            const context = args.refresh
+                ? await args.refresh(() => !stopped)
+                : (await refreshAuthorizationContextWithMetadata({
+                    ...args,
+                    shouldInstall: () => !stopped,
+                    prepareOnly: true,
+                })).context;
+            if (stopped)
+                return;
+            failures = 0;
+            await args.onRefresh?.(context);
+            schedule(refreshDelay(args.cache, before === context.contextDigest ? 5_000 : 1_000));
+        }
+        catch (error) {
+            if (stopped)
+                return;
+            if (error instanceof AuthorizationContextRefreshError && error.terminal) {
+                if (!(await args.cache.clearIfCurrent(clearGuard))) {
+                    failures = 0;
+                    schedule(refreshDelay(args.cache, 1_000));
+                    return;
+                }
+                await args.onTerminalFailure?.(error);
+                return;
+            }
+            failures += 1;
+            let current;
+            try {
+                current = args.cache.current();
+            }
+            catch {
+                current = undefined;
+            }
+            await args.onTransientFailure?.(error);
+            const beforeExpiry = current
+                ? Math.max(1_000, (current.context.expiresAt - args.cache.correctedNowSeconds()) *
+                    1_000)
+                : Number.POSITIVE_INFINITY;
+            schedule(Math.min(beforeExpiry, 5_000 * 2 ** Math.min(failures - 1, 3)));
+        }
+        finally {
+            running = false;
+            if (wakePending && !stopped) {
+                wakePending = false;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                schedule(0);
+            }
+        }
+    };
+    schedule(refreshDelay(args.cache));
+    let unregisterRefreshRequest;
+    try {
+        unregisterRefreshRequest = args.cache.registerRefreshRequest(() => {
+            if (running) {
+                wakePending = true;
+                return;
+            }
+            if (timer !== undefined)
+                clearTimeout(timer);
+            schedule(0);
+        });
+    }
+    catch (error) {
+        stopped = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+        throw error;
+    }
+    return () => {
+        stopped = true;
+        unregisterRefreshRequest();
+        if (timer !== undefined)
+            clearTimeout(timer);
+    };
+}
+function refreshDelay(cache, minimumMs = 1_000) {
+    try {
+        return Math.max(minimumMs, (cache.routingRefreshAt() - cache.correctedNowSeconds()) * 1_000);
+    }
+    catch {
+        return minimumMs;
+    }
+}
+function runtimeBindingFromResponse(response) {
+    if (!response.transports.native &&
+        !response.transports.websocket) {
+        throw new Error("authorization refresh returned no NATS transport");
+    }
+    return {
+        connectionId: response.runtime.connectionId,
+        loginSessionId: response.runtime.loginSessionId,
+        participantId: response.runtime.participantId,
+        inboxPrefix: response.runtime.inboxPrefix,
+        transports: {
+            ...(response.transports.native === undefined ? {} : {
+                native: {
+                    natsServers: [...response.transports.native.natsServers],
+                },
+            }),
+            ...(response.transports.websocket === undefined ? {} : {
+                websocket: {
+                    natsServers: [...response.transports.websocket.natsServers],
+                },
+            }),
+        },
+    };
+}

package/auth/authorization/types.d.ts

@@ -0,0 +1,207 @@
+import { type Static, Type } from "typebox";
+import type { AuthorizationContextVerificationPolicy, PermissionAtom, VerifiedAuthorizationContextTokenProjection } from "../protocol_wasm.ts";
+/** Pinned root and connected NATS KV registry binding. */
+export declare const AuthorizationRegistryBindingSchema: Type.TObject<{
+    contextBucket: Type.TString;
+}>;
+/** Wire binding for Trellis' internal authorization registry. */
+export type AuthorizationRegistryBinding = Static<typeof AuthorizationRegistryBindingSchema>;
+/** Wire schema for one published authorization context bundle. */
+export declare const AuthorizationContextBundleSchema: Type.TObject<{
+    context: Type.TUnknown;
+    issuer: Type.TObject<{
+        keyId: Type.TString;
+        publicKey: Type.TString;
+        state: Type.TUnion<[Type.TLiteral<"active">, Type.TLiteral<"retired">, Type.TLiteral<"revoked">]>;
+    }>;
+    authorizationRegistry: Type.TObject<{
+        contextBucket: Type.TString;
+    }>;
+    policy: Type.TObject<{
+        allowedClockSkewSeconds: Type.TInteger;
+        maximumContextLifetimeSeconds: Type.TInteger;
+        maximumContextBytes: Type.TInteger;
+        maximumPermissions: Type.TInteger;
+        refreshLeadSeconds: Type.TInteger;
+        refreshJitterSeconds: Type.TInteger;
+    }>;
+}>;
+/** Published signed context and the trust information needed to verify it. */
+export type AuthorizationContextBundle = Static<typeof AuthorizationContextBundleSchema>;
+/** Route-selection JWT installed atomically with a context. */
+export type AuthorizationRoutingMaterial = {
+    bootstrapJwt: string;
+    bootstrapJwtExpiresAt: number;
+};
+/** Transport endpoints retained for reconnect recovery. */
+export type AuthorizationRuntimeTransports = {
+    native?: {
+        natsServers: string[];
+    };
+    websocket?: {
+        natsServers: string[];
+    };
+};
+/** Transport metadata retained for reconnect recovery. */
+export type AuthorizationRuntimeBinding = {
+    connectionId: string;
+    loginSessionId: string | null;
+    participantId: string;
+    inboxPrefix: string;
+    transports: AuthorizationRuntimeTransports;
+};
+/** Trusted context projection returned by the Rust/WASM verifier. */
+export type VerifiedAuthorizationContext = VerifiedAuthorizationContextTokenProjection;
+/** Installed trust material that a provider-side verifier may reuse. */
+export type AuthorizationContextVerificationMaterial = {
+    issuer: AuthorizationContextBundle["issuer"];
+    context: unknown;
+    contextDigest: string;
+    policy: AuthorizationContextVerificationPolicy;
+    verified: VerifiedAuthorizationContext;
+};
+/** Presented request proof data supplied by a provider transport adapter. */
+export type AuthorizationProviderRequest = {
+    contextDigest: string;
+    sessionKey: string;
+    subject: string;
+    reply: string | null;
+    payload: Uint8Array;
+    iat: number;
+    requestId: string;
+    proof: string;
+    requiredPermissions: PermissionAtom[];
+    requiredCapabilities: string[];
+};
+/** Presented event proof data supplied by a provider event adapter. */
+export type AuthorizationProviderEvent = {
+    contextDigest: string;
+    sessionKey: string;
+    descriptorIdentity: string;
+    subject: string;
+    payload: Uint8Array;
+    eventId: string;
+    eventTime: string;
+    proof: string;
+    requiredCapabilities: string[];
+};
+/** Proactive refresh response returned by the Rust auth service. */
+export declare const AuthorizationContextRefreshResponseSchema: Type.TObject<{
+    serverNow: Type.TInteger;
+    authorizationContext: Type.TObject<{
+        context: Type.TUnknown;
+        issuer: Type.TObject<{
+            keyId: Type.TString;
+            publicKey: Type.TString;
+            state: Type.TUnion<[Type.TLiteral<"active">, Type.TLiteral<"retired">, Type.TLiteral<"revoked">]>;
+        }>;
+        authorizationRegistry: Type.TObject<{
+            contextBucket: Type.TString;
+        }>;
+        policy: Type.TObject<{
+            allowedClockSkewSeconds: Type.TInteger;
+            maximumContextLifetimeSeconds: Type.TInteger;
+            maximumContextBytes: Type.TInteger;
+            maximumPermissions: Type.TInteger;
+            refreshLeadSeconds: Type.TInteger;
+            refreshJitterSeconds: Type.TInteger;
+        }>;
+    }>;
+    routing: Type.TObject<{
+        bootstrapJwt: Type.TString;
+        bootstrapJwtExpiresAt: Type.TInteger;
+    }>;
+    runtime: Type.TObject<{
+        connectionId: Type.TString;
+        loginSessionId: Type.TUnion<[Type.TString, Type.TNull]>;
+        participantId: Type.TString;
+        inboxPrefix: Type.TString;
+    }>;
+    apiBindings: Type.TRecord<"^.*$", Type.TObject<{
+        providerDeploymentId: Type.TString;
+    }>>;
+    transports: Type.TObject<{
+        native: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+        websocket: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+    }>;
+    authorization: Type.TObject<{
+        participantId: Type.TString;
+        participantDigest: Type.TString;
+        resourceRuntime: Type.TObject<{
+            kv: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+                bucket: Type.TString;
+                history: Type.TInteger;
+                ttlMs: Type.TInteger;
+                maxValueBytes: Type.TOptional<Type.TInteger>;
+            }>>>;
+            store: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+                name: Type.TString;
+                ttlMs: Type.TInteger;
+                maxObjectBytes: Type.TOptional<Type.TInteger>;
+                maxTotalBytes: Type.TOptional<Type.TInteger>;
+            }>>>;
+            jobs: Type.TOptional<Type.TObject<{
+                serviceName: Type.TString;
+                namespace: Type.TString;
+                workStream: Type.TOptional<Type.TString>;
+                queues: Type.TRecord<"^.*$", Type.TObject<{
+                    queueType: Type.TString;
+                    publishPrefix: Type.TString;
+                    workSubject: Type.TString;
+                    consumerName: Type.TString;
+                    payload: Type.TObject<{
+                        schema: Type.TString;
+                    }>;
+                    update: Type.TOptional<Type.TObject<{
+                        schema: Type.TString;
+                    }>>;
+                    updatesPrefix: Type.TOptional<Type.TString>;
+                    result: Type.TOptional<Type.TObject<{
+                        schema: Type.TString;
+                    }>>;
+                    maxDeliver: Type.TInteger;
+                    backoffMs: Type.TArray<Type.TInteger>;
+                    ackWaitMs: Type.TInteger;
+                    defaultDeadlineMs: Type.TOptional<Type.TInteger>;
+                    keyConcurrency: Type.TOptional<Type.TObject<{
+                        key: Type.TArray<Type.TString>;
+                        maxActive: Type.TInteger;
+                        heartbeatIntervalMs: Type.TInteger;
+                        heartbeatTtlMs: Type.TInteger;
+                        stalePolicy: Type.TUnion<[Type.TLiteral<"fail-stale">, Type.TLiteral<"block">]>;
+                    }>>;
+                    queue: Type.TOptional<Type.TObject<{
+                        maxQueuedPerKey: Type.TInteger;
+                        whenFull: Type.TUnion<[Type.TLiteral<"reject">, Type.TLiteral<"coalesce">, Type.TLiteral<"replace-oldest">]>;
+                    }>>;
+                }>>;
+            }>>;
+            eventConsumers: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+                resourceId: Type.TString;
+                stream: Type.TString;
+                consumerName: Type.TString;
+                filterSubjects: Type.TArray<Type.TString>;
+                replay: Type.TUnion<[Type.TLiteral<"new">, Type.TLiteral<"all">]>;
+                concurrency: Type.TInteger;
+                ackWaitMs: Type.TInteger;
+                maxDeliver: Type.TInteger;
+                backoffMs: Type.TArray<Type.TInteger>;
+                replayBinding: Type.TObject<{
+                    stream: Type.TString;
+                    consumerName: Type.TString;
+                }>;
+            }>>>;
+        }>;
+    }>;
+}>;
+/** Proactive refresh response with its verified installed context. */
+export type AuthorizationContextRefreshResponse = Static<typeof AuthorizationContextRefreshResponseSchema>;
+/** Result returned by the metadata-preserving refresh helper. */
+export type AuthorizationContextRefreshResult = {
+    context: VerifiedAuthorizationContext;
+    response: AuthorizationContextRefreshResponse;
+};

package/auth/authorization/types.js

@@ -0,0 +1,60 @@
+import { Type } from "typebox";
+import { ContractResourceBindingsSchema } from "../../participant.js";
+/** Pinned root and connected NATS KV registry binding. */
+export const AuthorizationRegistryBindingSchema = Type.Object({
+    contextBucket: Type.String({ minLength: 1 }),
+});
+/** Wire schema for one published authorization context bundle. */
+export const AuthorizationContextBundleSchema = Type.Object({
+    context: Type.Unknown(),
+    issuer: Type.Object({
+        keyId: Type.String({ minLength: 1 }),
+        publicKey: Type.String({ minLength: 1 }),
+        state: Type.Union([
+            Type.Literal("active"),
+            Type.Literal("retired"),
+            Type.Literal("revoked"),
+        ]),
+    }),
+    authorizationRegistry: AuthorizationRegistryBindingSchema,
+    policy: Type.Object({
+        allowedClockSkewSeconds: Type.Integer({ minimum: 0 }),
+        maximumContextLifetimeSeconds: Type.Integer({ minimum: 1 }),
+        // Canonical signed-context JSON size in UTF-8 bytes.
+        maximumContextBytes: Type.Integer({ minimum: 1 }),
+        maximumPermissions: Type.Integer({ minimum: 1 }),
+        refreshLeadSeconds: Type.Integer({ minimum: 1 }),
+        refreshJitterSeconds: Type.Integer({ minimum: 0 }),
+    }),
+});
+/** Proactive refresh response returned by the Rust auth service. */
+export const AuthorizationContextRefreshResponseSchema = Type.Object({
+    serverNow: Type.Integer({ minimum: 0 }),
+    authorizationContext: AuthorizationContextBundleSchema,
+    routing: Type.Object({
+        bootstrapJwt: Type.String({ minLength: 1 }),
+        bootstrapJwtExpiresAt: Type.Integer({ minimum: 1 }),
+    }),
+    runtime: Type.Object({
+        connectionId: Type.String({ minLength: 1 }),
+        loginSessionId: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+        participantId: Type.String({ minLength: 1 }),
+        inboxPrefix: Type.String({ minLength: 1 }),
+    }),
+    apiBindings: Type.Record(Type.String({ minLength: 1 }), Type.Object({
+        providerDeploymentId: Type.String({ minLength: 1 }),
+    })),
+    transports: Type.Object({
+        native: Type.Optional(Type.Object({
+            natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+        })),
+        websocket: Type.Optional(Type.Object({
+            natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+        })),
+    }),
+    authorization: Type.Object({
+        participantId: Type.String({ minLength: 1 }),
+        participantDigest: Type.String({ minLength: 1 }),
+        resourceRuntime: ContractResourceBindingsSchema,
+    }),
+});

package/auth/authorization_context.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Authorization context facade.
+ *
+ * The implementation is split by responsibility under `auth/authorization/`;
+ * this module preserves the existing import surface for Trellis clients.
+ */
+export { AuthorizationContextCache, authorizationContextVerificationPolicy, verifyAuthorizationContext, } from "./authorization/client_context.ts";
+export { AuthorizationProviderCache, type AuthorizationProviderCacheHealth, type AuthorizationProviderCacheOptions, type AuthorizationProviderIoCounters, } from "./authorization/provider_cache.ts";
+export { AuthorizationContextRefreshError, refreshAuthorizationContext, refreshAuthorizationContextWithMetadata, startAuthorizationContextRefresh, } from "./authorization/refresh.ts";
+export type { AuthorizationContextBundle, AuthorizationContextRefreshResponse, AuthorizationContextRefreshResult, AuthorizationContextVerificationMaterial, AuthorizationProviderEvent, AuthorizationProviderRequest, AuthorizationRoutingMaterial, AuthorizationRuntimeBinding, AuthorizationRuntimeTransports, VerifiedAuthorizationContext, } from "./authorization/types.ts";
+export { AuthorizationContextBundleSchema, AuthorizationContextRefreshResponseSchema, } from "./authorization/types.ts";

package/auth/authorization_context.js

@@ -0,0 +1,10 @@
+/**
+ * Authorization context facade.
+ *
+ * The implementation is split by responsibility under `auth/authorization/`;
+ * this module preserves the existing import surface for Trellis clients.
+ */
+export { AuthorizationContextCache, authorizationContextVerificationPolicy, verifyAuthorizationContext, } from "./authorization/client_context.js";
+export { AuthorizationProviderCache, } from "./authorization/provider_cache.js";
+export { AuthorizationContextRefreshError, refreshAuthorizationContext, refreshAuthorizationContextWithMetadata, startAuthorizationContextRefresh, } from "./authorization/refresh.js";
+export { AuthorizationContextBundleSchema, AuthorizationContextRefreshResponseSchema, } from "./authorization/types.js";

package/auth/browser/flow_types.d.ts

@@ -0,0 +1,84 @@
+import type { StaticDecode } from "typebox";
+import { Type } from "typebox";
+export declare const PortalFlowStateSchema: Type.TUnion<[Type.TObject<{
+    status: Type.TLiteral<"choose_provider">;
+    flowId: Type.TString;
+    providers: Type.TArray<Type.TObject<{
+        id: Type.TString;
+        displayName: Type.TString;
+    }>>;
+    app: Type.TObject<{
+        displayName: Type.TString;
+    }>;
+    portal: Type.TOptional<Type.TObject<{}>>;
+    registration: Type.TOptional<Type.TObject<{}>>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"processing">;
+    flowId: Type.TString;
+}>, Type.TObject<{
+    status: Type.TLiteral<"approval_required">;
+    flowId: Type.TString;
+    consentViewDigest: Type.TString;
+    optionalBundles: Type.TArray<Type.TObject<{}>>;
+    user: Type.TObject<{
+        origin: Type.TString;
+        id: Type.TString;
+        name: Type.TOptional<Type.TString>;
+        email: Type.TOptional<Type.TString>;
+        image: Type.TOptional<Type.TString>;
+    }>;
+    approval: Type.TObject<{
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+        }>>;
+    }>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"approval_denied">;
+    flowId: Type.TString;
+    approval: Type.TObject<{
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+        }>>;
+    }>;
+    returnLocation: Type.TOptional<Type.TString>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"insufficient_capabilities">;
+    flowId: Type.TString;
+    user: Type.TOptional<Type.TObject<{
+        origin: Type.TString;
+        id: Type.TString;
+        name: Type.TOptional<Type.TString>;
+        email: Type.TOptional<Type.TString>;
+        image: Type.TOptional<Type.TString>;
+    }>>;
+    approval: Type.TObject<{
+        contractId: Type.TString;
+        contractDigest: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        capabilities: Type.TRecord<"^.*$", Type.TObject<{
+            displayName: Type.TString;
+            description: Type.TString;
+        }>>;
+    }>;
+    missingCapabilities: Type.TArray<Type.TString>;
+    userCapabilities: Type.TArray<Type.TString>;
+    returnLocation: Type.TOptional<Type.TString>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"redirect">;
+    location: Type.TString;
+}>, Type.TObject<{
+    status: Type.TLiteral<"expired">;
+    returnLocation: Type.TOptional<Type.TString>;
+}>]>;
+export type PortalFlowState = StaticDecode<typeof PortalFlowStateSchema>;