@opengeni/api-router 0.30.1 → 1.0.0

package/dist/browser-controller-authority.d.ts

@@ -1,61 +1 @@
-import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
-type BrowserControllerAuthorityScope = {
-    rootSecret: string;
-    accountId: string;
-    workspaceId: string;
-    placement: InteractionPlacement;
-    placementInstanceId: string;
-};
-type BrowserSessionAuthorityScope = BrowserControllerAuthorityScope & {
-    browserSessionId: string;
-    controllerGeneration: string;
-    tokenGeneration: number;
-};
-type ComputerSessionAuthorityScope = BrowserControllerAuthorityScope & {
-    computerSessionId: string;
-    controllerGeneration: string;
-    tokenGeneration: number;
-};
-/** Stable placement-admin authority. This token is installed owner-only inside
- * the exact placement and is never persisted or returned by the public API. */
-export declare function deriveBrowserControllerAdminToken(scope: BrowserControllerAuthorityScope): string;
-/** Deterministic controller credentials. The durable generations are the only
- * stored authority; plaintext tokens can be reconstructed only by API replicas
- * holding the deployment HMAC root. */
-export declare function deriveBrowserSessionControllerTokens(scope: BrowserSessionAuthorityScope): {
-    controlToken: string;
-    viewToken: string;
-};
-/** Secret-safe durable identity for one exact route launch. The digest binds
- * the route snapshot and proxy credential without making a password-verifier
- * hash available to database readers. */
-export declare function deriveBrowserNetworkRouteAuthorityDigest(scope: {
-    rootSecret: string;
-    accountId: string;
-    workspaceId: string;
-    browserSessionId: string;
-    routeId: string;
-    routeVersion: number;
-    credentialVersion: number | null;
-    configuration: NetworkRouteConfiguration;
-    consistency: NetworkRouteConsistency;
-    proxyCredential: {
-        username: string;
-        password: string;
-    } | null;
-}): string;
-export declare function deriveBrowserViewGrantToken(scope: BrowserSessionAuthorityScope & {
-    grantId: string;
-    expiresAt: string;
-}): string;
-/** ComputerSession credentials share the placement controller root while using
- * resource-specific domains. Browser and computer authority cannot collide. */
-export declare function deriveComputerSessionControllerTokens(scope: ComputerSessionAuthorityScope): {
-    controlToken: string;
-    viewToken: string;
-};
-export declare function deriveComputerViewGrantToken(scope: ComputerSessionAuthorityScope & {
-    grantId: string;
-    expiresAt: string;
-}): string;
-export {};
+export * from "@opengeni/interaction/browser-controller-authority";

package/dist/browser-ephemeral.d.ts

@@ -0,0 +1,5 @@
+import type { BrowserSession, CreateBrowserSessionRequest } from "@opengeni/contracts";
+export declare function assertEphemeralBrowserCreateEnabled(request: CreateBrowserSessionRequest, enabled: boolean): void;
+/** Only persisted session identity and server-resolved physical placement enter
+ * this private controller partition. Public callers never supply a pool key. */
+export declare function ephemeralBrowserPartition(session: BrowserSession, placementInstanceId: string, rootSecret: string): string;

package/dist/browser-state-authority.d.ts

@@ -1,27 +1 @@
-export type BrowserStateOperationScope = {
-    accountId: string;
-    workspaceId: string;
-    browserSessionId: string;
-    operationId: string;
-    objectKey: string;
-};
-export type BrowserStateArtifactScope = {
-    accountId: string;
-    workspaceId: string;
-    objectKey: string;
-    artifactDigest: string;
-    contentDigest: string;
-};
-/** Deterministic only within one idempotent publication operation. This lets a
- * control-plane retry present browserd with exactly the same secret authority
- * without storing a plaintext key or placing it in an operation row. */
-export declare function deriveBrowserStateDataKey(rootKey: Uint8Array, scopeInput: BrowserStateOperationScope): Buffer;
-/** Associated data for the encrypted profile object. It is reproducible from
- * durable non-secret artifact authority during restore. */
-export declare function browserStateArtifactAad(scopeInput: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">): Buffer;
-/** Wrap a 32-byte artifact data key under the operator-held root key. The
- * ciphertext is bound to workspace, object, and both integrity digests. */
-export declare function wrapBrowserStateDataKey(rootKey: Uint8Array, dataKeyInput: Uint8Array, scopeInput: BrowserStateArtifactScope): string;
-export declare function unwrapBrowserStateDataKey(rootKey: Uint8Array, wrapped: string, scopeInput: BrowserStateArtifactScope): Buffer;
-export declare function browserStateObjectKey(workspaceIdInput: string, operationIdInput: string): string;
-export declare function browserStateManifestDigest(manifest: unknown): string;
+export * from "@opengeni/interaction/browser-state-authority";