@plurnk/plurnk-contracts 3.2.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.env.defaults +17 -0
- package/README.md +3 -1
- package/SPEC.md +71 -51
- package/dist/conformance/agui-v1.json +308 -183
- package/dist/schema/A2aAgentDefinition.json +42 -10
- package/dist/schema/AguiDiscovery.json +1 -1
- package/dist/schema/FunctionalityMutationResult.json +9 -2
- package/dist/schema/ProposalProjection.json +90 -14
- package/dist/schema/RollbackReport.json +53 -0
- package/dist/src/Application.d.ts +253 -0
- package/dist/src/Application.d.ts.map +1 -0
- package/dist/src/Application.js +2 -0
- package/dist/src/Application.js.map +1 -0
- package/dist/src/ApplicationPort.d.ts +73 -147
- package/dist/src/ApplicationPort.d.ts.map +1 -1
- package/dist/src/Functionality.d.ts +3 -2
- package/dist/src/Functionality.d.ts.map +1 -1
- package/dist/src/HttpOrigin.d.ts +16 -0
- package/dist/src/HttpOrigin.d.ts.map +1 -0
- package/dist/src/HttpOrigin.js +15 -0
- package/dist/src/HttpOrigin.js.map +1 -0
- package/dist/src/Validator.d.ts +5 -2
- package/dist/src/Validator.d.ts.map +1 -1
- package/dist/src/Validator.js +14 -14
- package/dist/src/Validator.js.map +1 -1
- package/dist/src/index.d.ts +4 -2
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +2 -1
- package/dist/src/index.js.map +1 -1
- package/dist/src/types.d.ts +11 -7
- package/dist/src/types.d.ts.map +1 -1
- package/dist/src/types.generated.d.ts +88 -25
- package/dist/src/types.generated.d.ts.map +1 -1
- package/dist/src/types.js.map +1 -1
- package/package.json +7 -3
- package/plurnk.md +21 -26
- package/dist/schema/ClientStatement.json +0 -104
|
@@ -28,17 +28,49 @@
|
|
|
28
28
|
"additionalProperties": { "type": "string" }
|
|
29
29
|
},
|
|
30
30
|
"authorization": {
|
|
31
|
-
"
|
|
32
|
-
"
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
"
|
|
38
|
-
|
|
39
|
-
|
|
31
|
+
"description": "How the daemon authenticates to the agent: a fixed bearer, or OAuth 2.0 client credentials obtained from the agent's declared token endpoint.",
|
|
32
|
+
"oneOf": [
|
|
33
|
+
{
|
|
34
|
+
"type": "object",
|
|
35
|
+
"additionalProperties": false,
|
|
36
|
+
"required": ["type", "token"],
|
|
37
|
+
"properties": {
|
|
38
|
+
"type": { "const": "bearer" },
|
|
39
|
+
"token": {
|
|
40
|
+
"description": "A symbolic `${NAME}` environment reference; the secret is never persisted.",
|
|
41
|
+
"type": "string",
|
|
42
|
+
"pattern": "^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$"
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"type": "object",
|
|
48
|
+
"additionalProperties": false,
|
|
49
|
+
"required": ["type", "clientId", "clientSecret"],
|
|
50
|
+
"properties": {
|
|
51
|
+
"type": { "const": "oauth2" },
|
|
52
|
+
"clientId": {
|
|
53
|
+
"description": "The client id the agent's authorization server knows this daemon by.",
|
|
54
|
+
"type": "string",
|
|
55
|
+
"minLength": 1
|
|
56
|
+
},
|
|
57
|
+
"clientSecret": {
|
|
58
|
+
"description": "A symbolic `${NAME}` environment reference to the client secret; the secret is never persisted.",
|
|
59
|
+
"type": "string",
|
|
60
|
+
"pattern": "^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$"
|
|
61
|
+
},
|
|
62
|
+
"tokenUrl": {
|
|
63
|
+
"description": "The token endpoint; omitted, the Agent Card's clientCredentials flow names it.",
|
|
64
|
+
"type": "string",
|
|
65
|
+
"pattern": "^https?://"
|
|
66
|
+
},
|
|
67
|
+
"scope": {
|
|
68
|
+
"description": "The scope to request, space-separated; omitted, every scope the card's flow offers.",
|
|
69
|
+
"type": "string"
|
|
70
|
+
}
|
|
71
|
+
}
|
|
40
72
|
}
|
|
41
|
-
|
|
73
|
+
]
|
|
42
74
|
}
|
|
43
75
|
}
|
|
44
76
|
}
|
|
@@ -1,16 +1,23 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
3
|
"$id": "https://schemas.plurnk.xyz/v0/FunctionalityMutationResult.json",
|
|
4
|
-
"description": "The committed resource outcome of add, replace, enable, disable, or remove ({§functionality-mutation-status}): 202 when the resulting definition requires authorization; otherwise 201 when add or replace creates a local definition (including an inherited override), or 200 for assignment to an existing local definition and settled enable/disable/remove. Only replace may change a different local definition.",
|
|
4
|
+
"description": "The committed resource outcome of add, replace, enable, disable, or remove ({§functionality-mutation-status}): 202 when the resulting definition requires authorization; otherwise 201 when add or replace creates a local definition (including an inherited override), or 200 for assignment to an existing local definition and settled enable/disable/remove. Only replace may change a different local definition. A mutation names the one alias it concerned, or, for an add that names its definitions by their content ({§functionality-addressing}), lists every definition it admitted.",
|
|
5
5
|
"title": "FunctionalityMutationResult",
|
|
6
6
|
"type": "object",
|
|
7
7
|
"additionalProperties": false,
|
|
8
|
-
"required": ["status", "family"
|
|
8
|
+
"required": ["status", "family"],
|
|
9
|
+
"oneOf": [{ "required": ["alias"] }, { "required": ["definitions"] }],
|
|
9
10
|
"properties": {
|
|
10
11
|
"status": { "type": "integer", "enum": [200, 201, 202] },
|
|
11
12
|
"family": { "type": "string", "minLength": 1 },
|
|
12
13
|
"alias": { "type": "string", "minLength": 1 },
|
|
13
14
|
"definition": { "$ref": "https://schemas.plurnk.xyz/v0/FunctionalityDefinitionState.json" },
|
|
15
|
+
"definitions": {
|
|
16
|
+
"description": "Every definition an addressing family's add admitted, in the order the body named them.",
|
|
17
|
+
"type": "array",
|
|
18
|
+
"minItems": 1,
|
|
19
|
+
"items": { "$ref": "https://schemas.plurnk.xyz/v0/FunctionalityDefinitionState.json" }
|
|
20
|
+
},
|
|
14
21
|
"removed": { "const": true }
|
|
15
22
|
}
|
|
16
23
|
}
|
|
@@ -7,8 +7,10 @@
|
|
|
7
7
|
"required": [
|
|
8
8
|
"logEntryId",
|
|
9
9
|
"workerId",
|
|
10
|
+
"worker",
|
|
10
11
|
"loopId",
|
|
11
12
|
"turnId",
|
|
13
|
+
"coordinate",
|
|
12
14
|
"op",
|
|
13
15
|
"target",
|
|
14
16
|
"body",
|
|
@@ -18,31 +20,105 @@
|
|
|
18
20
|
],
|
|
19
21
|
"additionalProperties": false,
|
|
20
22
|
"properties": {
|
|
21
|
-
"logEntryId": {
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
"logEntryId": {
|
|
24
|
+
"type": "integer",
|
|
25
|
+
"minimum": 1
|
|
26
|
+
},
|
|
27
|
+
"workerId": {
|
|
28
|
+
"type": "integer",
|
|
29
|
+
"minimum": 1
|
|
30
|
+
},
|
|
31
|
+
"worker": {
|
|
32
|
+
"description": "The requesting worker's name.",
|
|
33
|
+
"type": "string",
|
|
34
|
+
"minLength": 1
|
|
35
|
+
},
|
|
36
|
+
"loopId": {
|
|
37
|
+
"type": "integer",
|
|
38
|
+
"minimum": 1
|
|
39
|
+
},
|
|
40
|
+
"turnId": {
|
|
41
|
+
"type": "integer",
|
|
42
|
+
"minimum": 1
|
|
43
|
+
},
|
|
44
|
+
"coordinate": {
|
|
45
|
+
"description": "The gated operation's log coordinate, loop/turn/sequence: the id of the call it is.",
|
|
46
|
+
"type": "string",
|
|
47
|
+
"pattern": "^[0-9]+/[0-9]+/[0-9]+$"
|
|
48
|
+
},
|
|
25
49
|
"op": {
|
|
26
50
|
"description": "An operation keyword, or a runtime tag: an execution's operation is its runtime.",
|
|
27
51
|
"anyOf": [
|
|
28
|
-
{
|
|
29
|
-
|
|
52
|
+
{
|
|
53
|
+
"enum": [
|
|
54
|
+
"FIND",
|
|
55
|
+
"READ",
|
|
56
|
+
"EDIT",
|
|
57
|
+
"COPY",
|
|
58
|
+
"MOVE",
|
|
59
|
+
"SEND",
|
|
60
|
+
"BARE",
|
|
61
|
+
"WORK",
|
|
62
|
+
"FORK",
|
|
63
|
+
"KILL",
|
|
64
|
+
"NOTE",
|
|
65
|
+
"WAIT"
|
|
66
|
+
]
|
|
67
|
+
},
|
|
68
|
+
{
|
|
69
|
+
"type": "string",
|
|
70
|
+
"pattern": "^[a-z][a-z0-9+.-]*$"
|
|
71
|
+
}
|
|
30
72
|
],
|
|
31
73
|
"tsType": "\"FIND\" | \"READ\" | \"EDIT\" | \"COPY\" | \"MOVE\" | \"SEND\" | \"BARE\" | \"WORK\" | \"FORK\" | \"KILL\" | \"NOTE\" | \"WAIT\" | Lowercase<string>"
|
|
32
74
|
},
|
|
33
75
|
"target": {
|
|
34
76
|
"type": "object",
|
|
35
|
-
"required": [
|
|
77
|
+
"required": [
|
|
78
|
+
"scheme",
|
|
79
|
+
"authority",
|
|
80
|
+
"pathname"
|
|
81
|
+
],
|
|
36
82
|
"additionalProperties": false,
|
|
37
83
|
"properties": {
|
|
38
|
-
"scheme": {
|
|
39
|
-
|
|
40
|
-
|
|
84
|
+
"scheme": {
|
|
85
|
+
"type": [
|
|
86
|
+
"string",
|
|
87
|
+
"null"
|
|
88
|
+
]
|
|
89
|
+
},
|
|
90
|
+
"authority": {
|
|
91
|
+
"type": [
|
|
92
|
+
"string",
|
|
93
|
+
"null"
|
|
94
|
+
]
|
|
95
|
+
},
|
|
96
|
+
"pathname": {
|
|
97
|
+
"type": [
|
|
98
|
+
"string",
|
|
99
|
+
"null"
|
|
100
|
+
]
|
|
101
|
+
}
|
|
41
102
|
}
|
|
42
103
|
},
|
|
43
|
-
"body": {
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
"
|
|
104
|
+
"body": {
|
|
105
|
+
"type": "string"
|
|
106
|
+
},
|
|
107
|
+
"attrs": {
|
|
108
|
+
"type": "object",
|
|
109
|
+
"additionalProperties": true
|
|
110
|
+
},
|
|
111
|
+
"owner": {
|
|
112
|
+
"type": "string",
|
|
113
|
+
"minLength": 1
|
|
114
|
+
},
|
|
115
|
+
"disposition": {
|
|
116
|
+
"$ref": "https://schemas.plurnk.xyz/v0/ProposalDisposition.json"
|
|
117
|
+
},
|
|
118
|
+
"expiresAt": {
|
|
119
|
+
"description": "When the gate stops waiting and core cancels it (ISO 8601); absent while it waits indefinitely.",
|
|
120
|
+
"type": "string",
|
|
121
|
+
"format": "date-time"
|
|
122
|
+
}
|
|
47
123
|
}
|
|
48
124
|
}
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://schemas.plurnk.xyz/v0/RollbackReport.json",
|
|
4
|
+
"title": "RollbackReport",
|
|
5
|
+
"description": "What a rollback to a log coordinate did ({§rollback}): the file mutations it reversed, latest first, each as an ordinary operation of the acting client; the rows it could not reverse because they kept no patch; and, when it stopped, the row and path where the file no longer matched what that mutation wrote.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["to", "restored", "skipped", "stopped"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"to": { "type": "string", "minLength": 1, "description": "The coordinate rolled back to, `<loop>/<turn>/<item>`; the state after that item is what remains." },
|
|
11
|
+
"restored": {
|
|
12
|
+
"type": "array",
|
|
13
|
+
"items": {
|
|
14
|
+
"type": "object",
|
|
15
|
+
"additionalProperties": false,
|
|
16
|
+
"required": ["coordinate", "path", "action"],
|
|
17
|
+
"properties": {
|
|
18
|
+
"coordinate": { "type": "string", "minLength": 1 },
|
|
19
|
+
"path": { "type": "string", "minLength": 1 },
|
|
20
|
+
"action": { "enum": ["update", "create", "delete"], "description": "What the reversal did to the file: rewrote it, recreated a removed file, or removed a created one." }
|
|
21
|
+
}
|
|
22
|
+
}
|
|
23
|
+
},
|
|
24
|
+
"skipped": {
|
|
25
|
+
"type": "array",
|
|
26
|
+
"items": {
|
|
27
|
+
"type": "object",
|
|
28
|
+
"additionalProperties": false,
|
|
29
|
+
"required": ["coordinate", "reason"],
|
|
30
|
+
"properties": {
|
|
31
|
+
"coordinate": { "type": "string", "minLength": 1 },
|
|
32
|
+
"reason": { "enum": ["no-patch", "already-reversed"], "description": "no-patch: the row kept no patch (a byte write, a member past the materialization bound, or a row settled before patches were kept). already-reversed: the file is in the state before that mutation, so an earlier rollback reversed it; nothing is done again." }
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
},
|
|
36
|
+
"stopped": {
|
|
37
|
+
"oneOf": [
|
|
38
|
+
{ "type": "null" },
|
|
39
|
+
{
|
|
40
|
+
"type": "object",
|
|
41
|
+
"additionalProperties": false,
|
|
42
|
+
"required": ["coordinate", "path", "reason", "detail"],
|
|
43
|
+
"properties": {
|
|
44
|
+
"coordinate": { "type": "string", "minLength": 1 },
|
|
45
|
+
"path": { "type": "string", "minLength": 1 },
|
|
46
|
+
"reason": { "enum": ["drift", "refused"], "description": "drift: the file no longer holds what that mutation wrote, so nothing was restored for it or for anything earlier; refused: the reversing operation was refused, and its Problem is the detail." },
|
|
47
|
+
"detail": { "type": "string" }
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
]
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
}
|
|
@@ -0,0 +1,253 @@
|
|
|
1
|
+
import type { LoopLifecycle } from "./LoopLifecycle.ts";
|
|
2
|
+
import type { JsonSchema, ModelRoute, OperationResult } from "./types.ts";
|
|
3
|
+
import type { RequestHeaders } from "./HttpOrigin.ts";
|
|
4
|
+
export type ProposalDecision = "accept" | "reject" | "cancel";
|
|
5
|
+
export interface ApplicationOwnerIdentity {
|
|
6
|
+
readonly workspaceId: number;
|
|
7
|
+
readonly address: string;
|
|
8
|
+
}
|
|
9
|
+
export interface ProposalResolution {
|
|
10
|
+
readonly decision: ProposalDecision;
|
|
11
|
+
readonly body?: string;
|
|
12
|
+
readonly outcome?: string;
|
|
13
|
+
}
|
|
14
|
+
export type ApplicationActionContext = {
|
|
15
|
+
readonly scope: "daemon";
|
|
16
|
+
} | {
|
|
17
|
+
readonly scope: "workspace";
|
|
18
|
+
readonly workspaceId: number;
|
|
19
|
+
} | {
|
|
20
|
+
readonly scope: "worker";
|
|
21
|
+
readonly workspaceId: number;
|
|
22
|
+
readonly workerId: number;
|
|
23
|
+
};
|
|
24
|
+
export interface ApplicationActionDescriptor {
|
|
25
|
+
readonly name: string;
|
|
26
|
+
readonly scope: ApplicationActionContext["scope"];
|
|
27
|
+
readonly inputSchema: JsonSchema;
|
|
28
|
+
readonly outputSchema: JsonSchema;
|
|
29
|
+
}
|
|
30
|
+
export interface ClientEnvelope {
|
|
31
|
+
readonly workspaceId: number;
|
|
32
|
+
readonly workspaceName: string;
|
|
33
|
+
readonly projectRoot: string | null;
|
|
34
|
+
/** {§workspace-label} The folder as the daemon spells it for display; null without a folder. */
|
|
35
|
+
readonly projectLabel: string | null;
|
|
36
|
+
}
|
|
37
|
+
export type ApplicationWorkerOrigin = "model" | "_plurnk";
|
|
38
|
+
export type ApplicationWorkerKind = "root" | "fork" | "work";
|
|
39
|
+
export interface ApplicationWorkerProjection {
|
|
40
|
+
readonly id: number;
|
|
41
|
+
readonly name: string;
|
|
42
|
+
readonly created_at: string;
|
|
43
|
+
readonly origin: ApplicationWorkerOrigin;
|
|
44
|
+
readonly owner: string;
|
|
45
|
+
readonly parentWorkerId: number | null;
|
|
46
|
+
readonly kind: ApplicationWorkerKind;
|
|
47
|
+
readonly lifecycle: LoopLifecycle;
|
|
48
|
+
}
|
|
49
|
+
export interface ApplicationWorkerQuery {
|
|
50
|
+
readonly origin?: ApplicationWorkerOrigin;
|
|
51
|
+
/** Omitted means every lineage position; null means roots only. */
|
|
52
|
+
readonly parentWorkerId?: number | null;
|
|
53
|
+
}
|
|
54
|
+
export type ApplicationWorkerIdentity = {
|
|
55
|
+
readonly id: number;
|
|
56
|
+
readonly name?: never;
|
|
57
|
+
} | {
|
|
58
|
+
readonly id?: never;
|
|
59
|
+
readonly name: string;
|
|
60
|
+
};
|
|
61
|
+
export type ApplicationWorkerCreation = {
|
|
62
|
+
readonly workspaceId: number;
|
|
63
|
+
readonly name?: string;
|
|
64
|
+
} & ({
|
|
65
|
+
readonly parentWorkerId: number;
|
|
66
|
+
readonly owner?: never;
|
|
67
|
+
} | {
|
|
68
|
+
readonly parentWorkerId?: never;
|
|
69
|
+
readonly owner?: string;
|
|
70
|
+
});
|
|
71
|
+
export interface ApplicationLoopProjection {
|
|
72
|
+
readonly id: number;
|
|
73
|
+
readonly workerId: number;
|
|
74
|
+
readonly sequence: number;
|
|
75
|
+
readonly status: number;
|
|
76
|
+
readonly prompt: string;
|
|
77
|
+
readonly promptSource: string | null;
|
|
78
|
+
/** When the loop first ran ({§loop-claim-latency}), ISO 8601 UTC; null until it has. */
|
|
79
|
+
readonly claimedAt: string | null;
|
|
80
|
+
/** When the loop concluded, ISO 8601 UTC; null while it is unfinished. */
|
|
81
|
+
readonly terminatedAt: string | null;
|
|
82
|
+
readonly terminalResult: OperationResult | null;
|
|
83
|
+
/** Exact count of durable packet-bearing turns; retries and administrative turns do not contribute. */
|
|
84
|
+
readonly packetCount: number;
|
|
85
|
+
/** Durable observation deadline, Unix milliseconds; null outside bounded parks. */
|
|
86
|
+
readonly waitUntil: number | null;
|
|
87
|
+
/**
|
|
88
|
+
* {§worker-obligations} The operation that opened the loop, by sending its first message: its worker and its log
|
|
89
|
+
* address in that worker's log. Null when no worker's operation did, or none was recorded.
|
|
90
|
+
*/
|
|
91
|
+
readonly invocation: {
|
|
92
|
+
readonly workerId: number;
|
|
93
|
+
readonly address: string;
|
|
94
|
+
} | null;
|
|
95
|
+
}
|
|
96
|
+
export interface ApplicationLoopPacket {
|
|
97
|
+
readonly workerId: number;
|
|
98
|
+
readonly loopId: number;
|
|
99
|
+
readonly packetCount: number;
|
|
100
|
+
}
|
|
101
|
+
export type LogEntryWire = {
|
|
102
|
+
id: number;
|
|
103
|
+
worker_id: number;
|
|
104
|
+
loop_id: number;
|
|
105
|
+
loop_seq: number;
|
|
106
|
+
turn_id: number;
|
|
107
|
+
turn_seq: number;
|
|
108
|
+
sequence: number;
|
|
109
|
+
at: string;
|
|
110
|
+
origin: string;
|
|
111
|
+
source: string | null;
|
|
112
|
+
op: string | null;
|
|
113
|
+
signal: unknown;
|
|
114
|
+
scheme: string | null;
|
|
115
|
+
username: string | null;
|
|
116
|
+
password: string | null;
|
|
117
|
+
hostname: string | null;
|
|
118
|
+
port: number | null;
|
|
119
|
+
pathname: string | null;
|
|
120
|
+
query: string | null;
|
|
121
|
+
fragment: string | null;
|
|
122
|
+
lineMarker: unknown;
|
|
123
|
+
tx: unknown;
|
|
124
|
+
mimetype_tx: string;
|
|
125
|
+
rx: unknown;
|
|
126
|
+
mimetype_rx: string;
|
|
127
|
+
status_rx: number;
|
|
128
|
+
weight: number;
|
|
129
|
+
attrs: unknown;
|
|
130
|
+
state: "proposed" | "resolved" | "failed" | "cancelled";
|
|
131
|
+
reasoning?: string;
|
|
132
|
+
reasoning_model_call_id?: number;
|
|
133
|
+
reasoning_request_sequence?: number;
|
|
134
|
+
invocation?: string;
|
|
135
|
+
answering?: string;
|
|
136
|
+
};
|
|
137
|
+
/** {§methods-loop-run} A prompt's admission: its acknowledgement, the loop it landed on and how it landed. */
|
|
138
|
+
export type ApplicationLoopAdmission = OperationResult & {
|
|
139
|
+
readonly action: "injected_next_turn" | "enqueued_new_loop";
|
|
140
|
+
readonly loopId: number;
|
|
141
|
+
readonly turnSeq?: number;
|
|
142
|
+
};
|
|
143
|
+
/** {§agui-provider-routes} A declared alias as the route a worker seeded from it gets, its configured effort included. */
|
|
144
|
+
export type ApplicationProviderAlias = ModelRoute & {
|
|
145
|
+
readonly alias: string;
|
|
146
|
+
readonly active: boolean;
|
|
147
|
+
readonly inputCapacity: number | null;
|
|
148
|
+
};
|
|
149
|
+
export type ApplicationEventHandler = (workspaceId: number | null, method: string, params: unknown) => void;
|
|
150
|
+
/**
|
|
151
|
+
* {§credential-authority} The kind of a credential: an access token is presented as a bearer; a
|
|
152
|
+
* refresh token is exchanged for new credentials of its family and is never presented; a session
|
|
153
|
+
* is a browser's standing at the authorization server ({§agui-oauth-session}), never a bearer.
|
|
154
|
+
*/
|
|
155
|
+
export type CredentialKind = "access" | "refresh" | "session";
|
|
156
|
+
/**
|
|
157
|
+
* {§credential-authority} What an issued credential stands for. `family` names the grant it descends
|
|
158
|
+
* from: revocation is by family, so an access token and the refresh token that renews it fall together.
|
|
159
|
+
*/
|
|
160
|
+
export interface CredentialClaims {
|
|
161
|
+
readonly kind: CredentialKind;
|
|
162
|
+
readonly subject: string;
|
|
163
|
+
readonly clientId: string;
|
|
164
|
+
readonly scopes: readonly string[];
|
|
165
|
+
readonly family: string;
|
|
166
|
+
readonly expiresAt: number;
|
|
167
|
+
}
|
|
168
|
+
export interface IssuedCredential {
|
|
169
|
+
readonly token: string;
|
|
170
|
+
readonly expiresAt: number;
|
|
171
|
+
}
|
|
172
|
+
/**
|
|
173
|
+
* {§credential-authority} The issuing face of the authority, published by the module that issues:
|
|
174
|
+
* the issuer origin where a request's caller obtains credentials, or, asked with no request in hand,
|
|
175
|
+
* the configured issuer or the listener's own origin; answered from the moment it is published
|
|
176
|
+
* ({§http-request-origin}). Published, the daemon authenticates; absent, every mounted resource
|
|
177
|
+
* admits anonymously.
|
|
178
|
+
*/
|
|
179
|
+
export interface CredentialFace {
|
|
180
|
+
readonly issuer: (req?: RequestHeaders) => string;
|
|
181
|
+
}
|
|
182
|
+
/**
|
|
183
|
+
* {§credential-sessions} A live browser sign-in: the family every credential of that sign-in shares,
|
|
184
|
+
* which is its handle and never a credential; whose it is; when it was established; when the last
|
|
185
|
+
* of its session credentials expires; and the clients holding credentials in it. Never a token.
|
|
186
|
+
*/
|
|
187
|
+
export interface CredentialSession {
|
|
188
|
+
readonly family: string;
|
|
189
|
+
readonly subject: string;
|
|
190
|
+
readonly createdAt: number;
|
|
191
|
+
readonly expiresAt: number;
|
|
192
|
+
readonly clients: readonly string[];
|
|
193
|
+
}
|
|
194
|
+
/**
|
|
195
|
+
* {§credential-module-client} The confidential client a module of this daemon registers for itself at
|
|
196
|
+
* setup: its id, the absolute pathnames under its own mounts it may be answered at, the scopes it may
|
|
197
|
+
* ask for and, optionally, the pathname of a stylesheet it serves for the authority's documents shown
|
|
198
|
+
* to its requests ({§agui-oauth-documents}). The issuer supplies the origin of each. What others may
|
|
199
|
+
* know of it; never its secret.
|
|
200
|
+
*/
|
|
201
|
+
export interface ModuleClient {
|
|
202
|
+
readonly id: string;
|
|
203
|
+
readonly redirectPaths: readonly string[];
|
|
204
|
+
readonly scopes: readonly string[];
|
|
205
|
+
readonly stylesheetPath?: string;
|
|
206
|
+
}
|
|
207
|
+
/**
|
|
208
|
+
* {§credential-authority} The daemon's one authority over the credentials presented to its listener:
|
|
209
|
+
* opaque tokens it issued, live until they expire, are consumed or their family is revoked. Every
|
|
210
|
+
* exterior adapter verifies through it; the client protocol is its issuing face.
|
|
211
|
+
*/
|
|
212
|
+
export interface CredentialAuthority {
|
|
213
|
+
/**
|
|
214
|
+
* The operator's client secret, `PLURNK_SECRET` when set, else one minted for this boot; null
|
|
215
|
+
* when the daemon authenticates nothing (`PLURNK_AUTH=0`) and no credential exists.
|
|
216
|
+
*/
|
|
217
|
+
readonly operatorSecret: string | null;
|
|
218
|
+
issue(credential: Omit<CredentialClaims, "expiresAt"> & {
|
|
219
|
+
readonly ttlMs: number;
|
|
220
|
+
}): IssuedCredential;
|
|
221
|
+
/** The claims of a live credential; null for one unknown, expired, consumed or revoked. */
|
|
222
|
+
verify(token: string): CredentialClaims | null;
|
|
223
|
+
/**
|
|
224
|
+
* Retires a live refresh token in exchange for new credentials of its family. A token already
|
|
225
|
+
* retired is a reuse: its whole family is revoked and named; anything else answers null.
|
|
226
|
+
*/
|
|
227
|
+
consume(token: string): {
|
|
228
|
+
readonly claims: CredentialClaims;
|
|
229
|
+
} | {
|
|
230
|
+
readonly reusedFamily: string | null;
|
|
231
|
+
};
|
|
232
|
+
revokeFamily(family: string): void;
|
|
233
|
+
onRevoked(listener: (family: string) => void): () => void;
|
|
234
|
+
/** {§credential-sessions} The live browser sign-ins of `subject`, oldest first; never a token. */
|
|
235
|
+
sessions(subject: string): readonly CredentialSession[];
|
|
236
|
+
/**
|
|
237
|
+
* Registers the calling module's own confidential client and answers its secret, minted for
|
|
238
|
+
* this boot, held in memory and told to nobody else. A second registration of one id is a fault.
|
|
239
|
+
*/
|
|
240
|
+
registerClient(client: ModuleClient): {
|
|
241
|
+
readonly clientId: string;
|
|
242
|
+
readonly clientSecret: string;
|
|
243
|
+
};
|
|
244
|
+
/** A module's registered client, without its secret; null for an id no module registered. */
|
|
245
|
+
client(id: string): ModuleClient | null;
|
|
246
|
+
/** Whether `secret` is the one minted for the module client `id`, compared in constant time. */
|
|
247
|
+
authenticateClient(id: string, secret: string): boolean;
|
|
248
|
+
/** Publishes the one issuing face; a second publication is a configuration fault. */
|
|
249
|
+
publish(face: CredentialFace): void;
|
|
250
|
+
/** The published face, or null while nothing issues: the daemon authenticates nothing. */
|
|
251
|
+
face(): CredentialFace | null;
|
|
252
|
+
}
|
|
253
|
+
//# sourceMappingURL=Application.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Application.d.ts","sourceRoot":"","sources":["../../src/Application.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,wBAAwB,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F,MAAM,WAAW,2BAA2B;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;CACrC;AAKD,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,CAAC;AAM1D,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAC7D,MAAM,WAAW,2BAA2B;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IAC1C,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,yBAAyB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,yBAAyB,GAAG;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,CACE;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CACjE,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,eAAe,GAAG,IAAI,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvF;AAED,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAChC;AAMD,MAAM,MAAM,YAAY,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAEf,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAEpC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AACF,8GAA8G;AAC9G,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG;IACrD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,0HAA0H;AAC1H,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAClC,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,KACd,IAAI,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,cAAc,KAAK,MAAM,CAAC;CACrD;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,CAAC;IACtG,2FAA2F;IAC3F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC1D,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,iBAAiB,EAAE,CAAC;IACxD;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACnG,6FAA6F;IAC7F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IACxC,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,qFAAqF;IACrF,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,0FAA0F;IAC1F,IAAI,IAAI,cAAc,GAAG,IAAI,CAAC;CACjC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Application.js","sourceRoot":"","sources":["../../src/Application.ts"],"names":[],"mappings":""}
|