@oatscenter/trellis 0.100.0-rc.1

package/auth/mod.js

@@ -0,0 +1,16 @@
+/**
+ * Protocol-owned Trellis session keys and proof helpers.
+ *
+ * @module
+ */
+export { AuthorizationContextBundleSchema, AuthorizationContextCache, AuthorizationContextRefreshError, AuthorizationProviderCache, refreshAuthorizationContext, refreshAuthorizationContextWithMetadata, startAuthorizationContextRefresh, } from "./authorization_context.js";
+export { classifyBrowserAuthError, isRecoverableBrowserAuthError, } from "./browser_recovery.js";
+export { buildDeviceActivationPayload, deriveDeviceConfirmationCode, deriveDeviceIdentity, waitForDeviceActivation, } from "./device_activation.js";
+export { fetchPortalFlowState, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, submitPortalApproval, } from "./browser/portal.js";
+// Context-bound proof helpers for local signing and signature verification.
+export { buildEventProofInput, buildProofInput, createEventProof, createProof, verifyEventProof, verifyProof, } from "./proof.js";
+export { parseSessionProof, SESSION_PROOF_FORMAT_V1, sessionProofRequestDigest, sessionProofSigningDigest, signSessionProof, verifySessionProof, } from "./session_proof.js";
+export { createAuth, } from "./session_auth.js";
+export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
+export { trellisIdFromOriginId } from "./trellis_id.js";
+export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";

package/auth/proof.d.ts

@@ -0,0 +1,31 @@
+export type ProofParams = {
+    contextDigest: string;
+    subject: string;
+    reply: string;
+    payloadHash: Uint8Array;
+    iat: number;
+    requestId: string;
+};
+export type EventProofParams = {
+    contextDigest: string;
+    descriptorIdentity: string;
+    subject: string;
+    payloadHash: Uint8Array;
+    eventId: string;
+    eventTime: string;
+};
+/**
+ * Builds the canonical v1 context-bound request proof input bytes.
+ *
+ * The exact NATS reply inbox must be created before signing and is bound into
+ * the proof input, matching the runtime request verifier.
+ */
+export declare function buildProofInput(contextDigest: string, subject: string, reply: string, payloadHash: Uint8Array, iat: number, requestId: string): Uint8Array;
+/**
+ * Builds the canonical v1 context-bound event proof input bytes.
+ */
+export declare function buildEventProofInput(contextDigest: string, descriptorIdentity: string, subject: string, payloadHash: Uint8Array, eventId: string, eventTime: string): Uint8Array;
+export declare function createProof(privateKey: CryptoKey, params: ProofParams): Promise<string>;
+export declare function createEventProof(privateKey: CryptoKey, params: EventProofParams): Promise<string>;
+export declare function verifyProof(publicSessionKey: string, params: ProofParams, proofBase64url: string): Promise<boolean>;
+export declare function verifyEventProof(publicSessionKey: string, params: EventProofParams, proofBase64url: string): Promise<boolean>;

package/auth/proof.js

@@ -0,0 +1,95 @@
+import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+import { importEd25519PublicKeyFromBase64url } from "./keys.js";
+import { AsyncResult } from "@oatscenter/result";
+const REQUEST_PROOF_DOMAIN = utf8("trellis.authorization-request-proof.v1");
+const EVENT_PROOF_DOMAIN = utf8("trellis.authorization-event-proof.v1");
+function appendLengthPrefixed(buf, view, offset, value) {
+    view.setUint32(offset, value.length);
+    const valueOffset = offset + 4;
+    buf.set(value, valueOffset);
+    return valueOffset + value.length;
+}
+function buildLengthPrefixed(components) {
+    const total = components.reduce((sum, value) => sum + 4 + value.length, 0);
+    const buf = new Uint8Array(total);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    for (const component of components) {
+        offset = appendLengthPrefixed(buf, view, offset, component);
+    }
+    return buf;
+}
+/**
+ * Builds the canonical v1 context-bound request proof input bytes.
+ *
+ * The exact NATS reply inbox must be created before signing and is bound into
+ * the proof input, matching the runtime request verifier.
+ */
+export function buildProofInput(contextDigest, subject, reply, payloadHash, iat, requestId) {
+    const contextDigestBytes = base64urlDecode(contextDigest);
+    if (contextDigestBytes.length !== 32) {
+        throw new Error("authorization context digest must encode 32 bytes");
+    }
+    if (reply.length === 0) {
+        throw new Error("request reply subject must not be empty");
+    }
+    return buildLengthPrefixed([
+        REQUEST_PROOF_DOMAIN,
+        contextDigestBytes,
+        utf8(subject),
+        utf8(reply),
+        payloadHash,
+        utf8(String(iat)),
+        utf8(requestId),
+    ]);
+}
+/**
+ * Builds the canonical v1 context-bound event proof input bytes.
+ */
+export function buildEventProofInput(contextDigest, descriptorIdentity, subject, payloadHash, eventId, eventTime) {
+    const contextDigestBytes = base64urlDecode(contextDigest);
+    if (contextDigestBytes.length !== 32) {
+        throw new Error("authorization context digest must encode 32 bytes");
+    }
+    return buildLengthPrefixed([
+        EVENT_PROOF_DOMAIN,
+        contextDigestBytes,
+        utf8(descriptorIdentity),
+        utf8(subject),
+        payloadHash,
+        utf8(eventId),
+        utf8(eventTime),
+    ]);
+}
+export async function createProof(privateKey, params) {
+    const input = buildProofInput(params.contextDigest, params.subject, params.reply, params.payloadHash, params.iat, params.requestId);
+    const digest = await sha256(input);
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
+    return base64urlEncode(new Uint8Array(sig));
+}
+export async function createEventProof(privateKey, params) {
+    const input = buildEventProofInput(params.contextDigest, params.descriptorIdentity, params.subject, params.payloadHash, params.eventId, params.eventTime);
+    const digest = await sha256(input);
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
+    return base64urlEncode(new Uint8Array(sig));
+}
+export async function verifyProof(publicSessionKey, params, proofBase64url) {
+    const result = await AsyncResult.try(async () => {
+        const input = buildProofInput(params.contextDigest, params.subject, params.reply, params.payloadHash, params.iat, params.requestId);
+        const digest = await sha256(input);
+        const signature = base64urlDecode(proofBase64url);
+        const pub = await importEd25519PublicKeyFromBase64url(publicSessionKey);
+        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(signature), toArrayBuffer(digest));
+    });
+    return result.unwrapOr(false);
+}
+export async function verifyEventProof(publicSessionKey, params, proofBase64url) {
+    const result = await AsyncResult.try(async () => {
+        const input = buildEventProofInput(params.contextDigest, params.descriptorIdentity, params.subject, params.payloadHash, params.eventId, params.eventTime);
+        const digest = await sha256(input);
+        const signature = base64urlDecode(proofBase64url);
+        const pub = await importEd25519PublicKeyFromBase64url(publicSessionKey);
+        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(signature), toArrayBuffer(digest));
+    });
+    return result.unwrapOr(false);
+}

package/auth/protocol_wasm/trellis_protocol_wasm.d.ts

@@ -0,0 +1,138 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * Opaque Rust-owned authorization context retained for repeated proof verification.
+ */
+export class VerifiedAuthorizationContextHandle {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Require the retained context to be eligible at the supplied current time.
+     */
+    assert_current(policy_json: string): void;
+    /**
+     * Return the verified context projection used by the TypeScript cache.
+     */
+    projection(): string;
+}
+
+/**
+ * Verify an online-issued context once and retain it inside WASM.
+ */
+export function create_authorization_context_handle(issuer_json: string, context_json: string, policy_json: string, historical: boolean): VerifiedAuthorizationContextHandle;
+
+/**
+ * Decode and query-bind a shared versioned pagination cursor.
+ */
+export function decode_pagination_cursor(encoded: string, query_digest: string): string;
+
+/**
+ * Encode a JSON value as a shared versioned pagination cursor.
+ */
+export function encode_pagination_cursor(query_digest: string, after_json: string): string;
+
+/**
+ * Derive an API-qualified event base subject.
+ */
+export function event_subject(api_id: string, action: string): string;
+
+/**
+ * Compute the shared query binding for an opaque pagination cursor.
+ */
+export function pagination_query_digest(endpoint: string, query_json: string): string;
+
+/**
+ * Parse and normalize one strict JSON-encoded session-proof envelope.
+ */
+export function parse_session_proof(proof_json: string): string;
+
+/**
+ * Return the canonical request digest for a JSON-encoded proof-bearing request.
+ */
+export function session_proof_request_digest(request_json: string): string;
+
+/**
+ * Return the canonical signing digest for a JSON-encoded purpose-specific input.
+ */
+export function session_proof_signing_digest(input_json: string): string;
+
+/**
+ * Verify a live context with its authenticated online issuer entry.
+ */
+export function verify_authorization_context(issuer_json: string, context_json: string, policy_json: string): string;
+
+/**
+ * Verify one context-bound authorization event proof from a JSON argument.
+ *
+ * The result is always a JSON object. Successful results have `ok: true` and
+ * contain verified publisher/context metadata; rejected inputs have `ok: false`
+ * and a stable authorization error code and path. Event context chains are
+ * checked at their signed historical boundary before the strict event-time
+ * window is evaluated.
+ */
+export function verify_authorization_event(context: VerifiedAuthorizationContextHandle, event_json: string, payload: Uint8Array): string;
+
+/**
+ * Verify one context-bound authorization request proof from a JSON argument.
+ *
+ * The result is always a JSON object. Successful results have `ok: true` and
+ * contain the verified context digest; rejected inputs have `ok: false`
+ * and a stable authorization error code and path.
+ */
+export function verify_authorization_request(context: VerifiedAuthorizationContextHandle, request_json: string, payload: Uint8Array): string;
+
+/**
+ * Verify a JSON-encoded session proof.
+ */
+export function verify_session_proof(input_json: string, proof_json: string, signer_public_key: string, now_ms: number, maximum_age_ms: number, maximum_future_skew_ms: number): void;
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly __wbg_verifiedauthorizationcontexthandle_free: (a: number, b: number) => void;
+    readonly create_authorization_context_handle: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => [number, number, number];
+    readonly decode_pagination_cursor: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly encode_pagination_cursor: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly event_subject: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly pagination_query_digest: (a: number, b: number, c: number, d: number) => [number, number, number, number];
+    readonly parse_session_proof: (a: number, b: number) => [number, number, number, number];
+    readonly session_proof_request_digest: (a: number, b: number) => [number, number, number, number];
+    readonly session_proof_signing_digest: (a: number, b: number) => [number, number, number, number];
+    readonly verifiedauthorizationcontexthandle_assert_current: (a: number, b: number, c: number) => [number, number];
+    readonly verifiedauthorizationcontexthandle_projection: (a: number) => [number, number, number, number];
+    readonly verify_authorization_context: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
+    readonly verify_authorization_event: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+    readonly verify_authorization_request: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+    readonly verify_session_proof: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => [number, number];
+    readonly __wbindgen_externrefs: WebAssembly.Table;
+    readonly __wbindgen_malloc: (a: number, b: number) => number;
+    readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+    readonly __externref_table_dealloc: (a: number) => void;
+    readonly __wbindgen_free: (a: number, b: number, c: number) => void;
+    readonly __wbindgen_start: () => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;