@qlever-llc/trellis 0.5.1 → 0.6.0

package/script/auth/browser.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.ApprovalDecisionSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForBindingToken = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindSession = exports.bindFlow = void 0;
+var login_ts_1 = require("./browser/login.ts");
+Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return login_ts_1.bindFlow; } });
+Object.defineProperty(exports, "bindSession", { enumerable: true, get: function () { return login_ts_1.bindSession; } });
+Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_ts_1.buildLoginUrl; } });
+Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_ts_1.isBindSuccessResponse; } });
+var portal_ts_1 = require("./browser/portal.ts");
+Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_ts_1.fetchPortalFlowState; } });
+Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_ts_1.portalFlowIdFromUrl; } });
+Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return portal_ts_1.portalProviderLoginUrl; } });
+Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return portal_ts_1.portalRedirectLocation; } });
+Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return portal_ts_1.submitPortalApproval; } });
+var session_ts_1 = require("./browser/session.ts");
+Object.defineProperty(exports, "bindFlowSig", { enumerable: true, get: function () { return session_ts_1.bindFlowSig; } });
+Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return session_ts_1.clearSessionKey; } });
+Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return session_ts_1.createRpcProof; } });
+Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return session_ts_1.generateSessionKey; } });
+Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return session_ts_1.getOrCreateSessionKey; } });
+Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_ts_1.getPublicSessionKey; } });
+Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_ts_1.hasSessionKey; } });
+Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_ts_1.loadSessionKey; } });
+Object.defineProperty(exports, "natsConnectSigForBindingToken", { enumerable: true, get: function () { return session_ts_1.natsConnectSigForBindingToken; } });
+Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_ts_1.signBytes; } });
+var storage_ts_1 = require("./browser/storage.ts");
+Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_ts_1.deleteKeyPair; } });
+Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_ts_1.hasKeyPair; } });
+var schemas_ts_1 = require("./schemas.ts");
+Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindResponseSchema; } });
+Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_ts_1.ContractApprovalSchema; } });
+Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_ts_1.NatsAuthTokenV1Schema; } });
+Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_ts_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_ts_1.SentinelCredsSchema; } });
+var utils_ts_1 = require("./utils.ts");
+Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_ts_1.base64urlDecode; } });
+Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_ts_1.base64urlEncode; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_ts_1.sha256; } });
+Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_ts_1.toArrayBuffer; } });
+Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_ts_1.utf8; } });

package/script/auth/keys.d.ts

@@ -0,0 +1,5 @@
+export declare function pkcs8FromEd25519Seed(seed32: Uint8Array): Uint8Array;
+export declare function importEd25519PrivateKeyFromSeedBase64url(seedBase64url: string): Promise<CryptoKey>;
+export declare function publicKeyBase64urlFromPrivateKey(privateKey: CryptoKey): Promise<string>;
+export declare function importEd25519PublicKeyFromBase64url(publicKeyBase64url: string): Promise<CryptoKey>;
+//# sourceMappingURL=keys.d.ts.map

package/script/auth/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../auth/keys.ts"],"names":[],"mappings":"AAqBA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAQnE;AAED,wBAAsB,wCAAwC,CAC5D,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAapB;AAED,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,mCAAmC,CACvD,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,SAAS,CAAC,CAYpB"}

package/script/auth/keys.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pkcs8FromEd25519Seed = pkcs8FromEd25519Seed;
+exports.importEd25519PrivateKeyFromSeedBase64url = importEd25519PrivateKeyFromSeedBase64url;
+exports.publicKeyBase64urlFromPrivateKey = publicKeyBase64urlFromPrivateKey;
+exports.importEd25519PublicKeyFromBase64url = importEd25519PublicKeyFromBase64url;
+const utils_ts_1 = require("./utils.ts");
+const ED25519_PKCS8_PREFIX = Uint8Array.from([
+    0x30,
+    0x2e,
+    0x02,
+    0x01,
+    0x00,
+    0x30,
+    0x05,
+    0x06,
+    0x03,
+    0x2b,
+    0x65,
+    0x70,
+    0x04,
+    0x22,
+    0x04,
+    0x20,
+]);
+function pkcs8FromEd25519Seed(seed32) {
+    if (seed32.length !== 32) {
+        throw new Error(`Invalid Ed25519 seed length: ${seed32.length} (expected 32)`);
+    }
+    const pkcs8 = new Uint8Array(ED25519_PKCS8_PREFIX.length + seed32.length);
+    pkcs8.set(ED25519_PKCS8_PREFIX, 0);
+    pkcs8.set(seed32, ED25519_PKCS8_PREFIX.length);
+    return pkcs8;
+}
+async function importEd25519PrivateKeyFromSeedBase64url(seedBase64url) {
+    const seed = (0, utils_ts_1.base64urlDecode)(seedBase64url);
+    if (seed.length !== 32) {
+        throw new Error(`Invalid Ed25519 seed length: ${seed.length} (expected 32)`);
+    }
+    const pkcs8 = pkcs8FromEd25519Seed(seed);
+    return await crypto.subtle.importKey("pkcs8", (0, utils_ts_1.toArrayBuffer)(pkcs8), { name: "Ed25519" }, true, ["sign"]);
+}
+async function publicKeyBase64urlFromPrivateKey(privateKey) {
+    const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+    if (typeof jwk.x !== "string" || jwk.x.length === 0) {
+        throw new Error("Failed to derive Ed25519 public key (missing JWK.x)");
+    }
+    return jwk.x;
+}
+async function importEd25519PublicKeyFromBase64url(publicKeyBase64url) {
+    const raw = (0, utils_ts_1.base64urlDecode)(publicKeyBase64url);
+    if (raw.length !== 32) {
+        throw new Error(`Invalid Ed25519 public key length: ${raw.length} (expected 32)`);
+    }
+    return await crypto.subtle.importKey("raw", (0, utils_ts_1.toArrayBuffer)(raw), { name: "Ed25519" }, true, ["verify"]);
+}

package/script/auth/mod.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @module
+ *
+ * Trellis server-side authentication library for session-key based authentication.
+ *
+ * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
+ * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
+ * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
+ */
+export { buildWorkloadActivationPayload, buildWorkloadActivationUrl, buildWorkloadWaitProofInput, createWorkloadNatsAuthToken, createWorkloadActivationClient, deriveWorkloadConfirmationCode, deriveWorkloadIdentity, deriveWorkloadQrMac, encodeWorkloadActivationPayload, getWorkloadConnectInfo, parseWorkloadActivationPayload, signWorkloadWaitRequest, verifyWorkloadConfirmationCode, verifyWorkloadWaitSignature, waitForWorkloadActivation, type AuthActivateWorkloadInput, type AuthActivateWorkloadOutput, type AuthListWorkloadActivationsInput, type AuthListWorkloadActivationsOutput, type AuthRevokeWorkloadActivationInput, type AuthRevokeWorkloadActivationResponse, type GetWorkloadConnectInfoInput, type GetWorkloadConnectInfoOutput, type WaitForWorkloadActivationResponse, type WorkloadActivationPayload, type WorkloadActivationTransport, type WorkloadActivationWaitRequest, type WorkloadIdentity, } from "./workload_activation.ts";
+export { type AuthConfig, bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, signBytes, submitPortalApproval, } from "./browser.ts";
+export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.ts";
+export { ApprovalRecordViewSchema, AuthActivateWorkloadResponseSchema, AuthActivateWorkloadSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthClearWorkloadPortalSelectionResponseSchema, AuthClearWorkloadPortalSelectionSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateWorkloadProfileResponseSchema, AuthCreateWorkloadProfileSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, type PortalFlowUser, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthDisableWorkloadInstanceResponseSchema, AuthDisableWorkloadInstanceSchema, AuthDisableWorkloadProfileResponseSchema, AuthDisableWorkloadProfileSchema, AuthGetWorkloadConnectInfoResponseSchema, AuthGetWorkloadConnectInfoSchema, AuthGetWorkloadPortalDefaultResponseSchema, AuthGetWorkloadPortalDefaultSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListWorkloadPortalSelectionsResponseSchema, AuthListWorkloadPortalSelectionsSchema, AuthListWorkloadActivationReviewsResponseSchema, AuthListWorkloadActivationReviewsSchema, AuthListWorkloadActivationsResponseSchema, AuthListWorkloadActivationsSchema, AuthGetWorkloadActivationStatusResponseSchema, AuthGetWorkloadActivationStatusSchema, AuthListWorkloadInstancesResponseSchema, AuthListWorkloadInstancesSchema, AuthListWorkloadProfilesResponseSchema, AuthListWorkloadProfilesSchema, AuthProvisionWorkloadInstanceResponseSchema, AuthProvisionWorkloadInstanceSchema, AuthDecideWorkloadActivationReviewResponseSchema, AuthDecideWorkloadActivationReviewSchema, AuthWorkloadActivationReviewRequestedEventSchema, AuthRevokeWorkloadActivationResponseSchema, AuthRevokeWorkloadActivationSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetWorkloadPortalDefaultResponseSchema, AuthSetWorkloadPortalDefaultSchema, AuthSetWorkloadPortalSelectionResponseSchema, AuthSetWorkloadPortalSelectionSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, type AuthMeResponse, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, type AuthenticatedService, type AuthenticatedUser, type AuthenticatedWorkload, AuthenticatedWorkloadSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalSchema, PortalFlowStateSchema, ServiceViewSchema, UserViewSchema, WaitForWorkloadActivationResponseSchema, WorkloadActivationReviewSchema, WorkloadPortalDefaultSchema, WorkloadPortalSelectionSchema, WorkloadActivationRecordSchema, type WorkloadActivationRecord, WorkloadConnectInfoSchema, WorkloadProfileSchema, WorkloadSchema, } from "./protocol.ts";
+export { type ApprovalDecision, ApprovalDecisionSchema, type BindRequest, BindRequestSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ContractApproval, ContractApprovalSchema, type LoginQuery, LoginQuerySchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, } from "./schemas.ts";
+export { createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.ts";
+export { trellisIdFromOriginId } from "./trellis_id.ts";
+export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.ts";
+//# sourceMappingURL=mod.d.ts.map

package/script/auth/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,iCAAiC,EACtC,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EACzC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,EACtC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,SAAS,EACT,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,0BAA0B,EAC1B,2CAA2C,EAC3C,mCAAmC,EACnC,8CAA8C,EAC9C,sCAAsC,EACtC,8BAA8B,EAC9B,sBAAsB,EACtB,uCAAuC,EACvC,+BAA+B,EAC/B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,+BAA+B,EAC/B,uBAAuB,EACvB,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,wCAAwC,EACxC,gCAAgC,EAChC,0CAA0C,EAC1C,kCAAkC,EAClC,2CAA2C,EAC3C,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACpB,8CAA8C,EAC9C,sCAAsC,EACtC,+CAA+C,EAC/C,uCAAuC,EACvC,yCAAyC,EACzC,iCAAiC,EACjC,6CAA6C,EAC7C,qCAAqC,EACrC,uCAAuC,EACvC,+BAA+B,EAC/B,sCAAsC,EACtC,8BAA8B,EAC9B,2CAA2C,EAC3C,mCAAmC,EACpC,gDAAgD,EAChD,wCAAwC,EACxC,gDAAgD,EAChD,0CAA0C,EACzC,kCAAkC,EACnC,uCAAuC,EACvC,+BAA+B,EAC/B,yCAAyC,EACzC,iCAAiC,EACjC,0CAA0C,EAC1C,kCAAkC,EAClC,4CAA4C,EAC5C,oCAAoC,EACpC,sCAAsC,EACtC,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,wCAAwC,EACxC,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,YAAY,EACZ,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACb,uCAAuC,EACxC,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,WAAW,EAChB,iBAAiB,EACjB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/script/auth/mod.js

@@ -0,0 +1,172 @@
+"use strict";
+/**
+ * @module
+ *
+ * Trellis server-side authentication library for session-key based authentication.
+ *
+ * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
+ * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
+ * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGetLoginPortalDefaultResponseSchema = exports.AuthDisablePortalSchema = exports.AuthDisablePortalResponseSchema = exports.AuthCreateWorkloadProfileSchema = exports.AuthCreateWorkloadProfileResponseSchema = exports.AuthCreatePortalSchema = exports.AuthCreatePortalResponseSchema = exports.AuthClearWorkloadPortalSelectionSchema = exports.AuthClearWorkloadPortalSelectionResponseSchema = exports.AuthClearLoginPortalSelectionSchema = exports.AuthClearLoginPortalSelectionResponseSchema = exports.AuthActivateWorkloadSchema = exports.AuthActivateWorkloadResponseSchema = exports.ApprovalRecordViewSchema = exports.verifyProof = exports.createProof = exports.buildProofInput = exports.submitPortalApproval = exports.signBytes = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.natsConnectSigForBindingToken = exports.loadSessionKey = exports.isBindSuccessResponse = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.fetchPortalFlowState = exports.createRpcProof = exports.clearSessionKey = exports.buildLoginUrl = exports.bindSession = exports.bindFlow = exports.waitForWorkloadActivation = exports.verifyWorkloadWaitSignature = exports.verifyWorkloadConfirmationCode = exports.signWorkloadWaitRequest = exports.parseWorkloadActivationPayload = exports.getWorkloadConnectInfo = exports.encodeWorkloadActivationPayload = exports.deriveWorkloadQrMac = exports.deriveWorkloadIdentity = exports.deriveWorkloadConfirmationCode = exports.createWorkloadActivationClient = exports.createWorkloadNatsAuthToken = exports.buildWorkloadWaitProofInput = exports.buildWorkloadActivationUrl = exports.buildWorkloadActivationPayload = void 0;
+exports.AuthListServicesSchema = exports.AuthListServicesResponseSchema = exports.AuthListInstalledContractsSchema = exports.AuthListInstalledContractsResponseSchema = exports.AuthListApprovalsSchema = exports.AuthListApprovalsResponseSchema = exports.AuthInstallServiceSchema = exports.AuthInstallServiceResponseSchema = exports.AuthGetInstalledContractSchema = exports.AuthGetInstalledContractResponseSchema = exports.AuthSetWorkloadPortalSelectionSchema = exports.AuthSetWorkloadPortalSelectionResponseSchema = exports.AuthSetWorkloadPortalDefaultSchema = exports.AuthSetWorkloadPortalDefaultResponseSchema = exports.AuthSetLoginPortalSelectionSchema = exports.AuthSetLoginPortalSelectionResponseSchema = exports.AuthSetLoginPortalDefaultSchema = exports.AuthSetLoginPortalDefaultResponseSchema = exports.AuthRevokeWorkloadActivationSchema = exports.AuthRevokeWorkloadActivationResponseSchema = exports.AuthWorkloadActivationReviewRequestedEventSchema = exports.AuthDecideWorkloadActivationReviewSchema = exports.AuthDecideWorkloadActivationReviewResponseSchema = exports.AuthProvisionWorkloadInstanceSchema = exports.AuthProvisionWorkloadInstanceResponseSchema = exports.AuthListWorkloadProfilesSchema = exports.AuthListWorkloadProfilesResponseSchema = exports.AuthListWorkloadInstancesSchema = exports.AuthListWorkloadInstancesResponseSchema = exports.AuthGetWorkloadActivationStatusSchema = exports.AuthGetWorkloadActivationStatusResponseSchema = exports.AuthListWorkloadActivationsSchema = exports.AuthListWorkloadActivationsResponseSchema = exports.AuthListWorkloadActivationReviewsSchema = exports.AuthListWorkloadActivationReviewsResponseSchema = exports.AuthListWorkloadPortalSelectionsSchema = exports.AuthListWorkloadPortalSelectionsResponseSchema = exports.AuthListPortalsSchema = exports.AuthListPortalsResponseSchema = exports.AuthListLoginPortalSelectionsSchema = exports.AuthListLoginPortalSelectionsResponseSchema = exports.AuthGetWorkloadPortalDefaultSchema = exports.AuthGetWorkloadPortalDefaultResponseSchema = exports.AuthGetWorkloadConnectInfoSchema = exports.AuthGetWorkloadConnectInfoResponseSchema = exports.AuthDisableWorkloadProfileSchema = exports.AuthDisableWorkloadProfileResponseSchema = exports.AuthDisableWorkloadInstanceSchema = exports.AuthDisableWorkloadInstanceResponseSchema = exports.AuthGetLoginPortalDefaultSchema = void 0;
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.canonicalizeJsonValue = exports.base64urlEncode = exports.base64urlDecode = exports.trellisIdFromOriginId = exports.createAuth = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.LoginQuerySchema = exports.ContractApprovalSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.BindRequestSchema = exports.ApprovalDecisionSchema = exports.WorkloadSchema = exports.WorkloadProfileSchema = exports.WorkloadConnectInfoSchema = exports.WorkloadActivationRecordSchema = exports.WorkloadPortalSelectionSchema = exports.WorkloadPortalDefaultSchema = exports.WorkloadActivationReviewSchema = exports.WaitForWorkloadActivationResponseSchema = exports.UserViewSchema = exports.ServiceViewSchema = exports.PortalFlowStateSchema = exports.PortalSchema = exports.OpenObjectSchema = exports.LoginPortalSelectionSchema = exports.LoginPortalDefaultSchema = exports.InstalledContractSchema = exports.InstalledContractDetailSchema = exports.DigestSchema = exports.ContractAnalysisSummarySchema = exports.ContractAnalysisSchema = exports.CallerViewSchema = exports.AuthenticatedWorkloadSchema = exports.AuthValidateRequestSchema = exports.AuthValidateRequestResponseSchema = exports.AuthUpgradeServiceContractSchema = exports.AuthUpgradeServiceContractResponseSchema = exports.AuthUpdateUserSchema = exports.AuthUpdateUserResponseSchema = exports.AuthRevokeApprovalSchema = exports.AuthRevokeApprovalResponseSchema = exports.AuthMeSchema = exports.AuthMeResponseSchema = exports.AuthListUsersSchema = exports.AuthListUsersResponseSchema = void 0;
+var workload_activation_ts_1 = require("./workload_activation.ts");
+Object.defineProperty(exports, "buildWorkloadActivationPayload", { enumerable: true, get: function () { return workload_activation_ts_1.buildWorkloadActivationPayload; } });
+Object.defineProperty(exports, "buildWorkloadActivationUrl", { enumerable: true, get: function () { return workload_activation_ts_1.buildWorkloadActivationUrl; } });
+Object.defineProperty(exports, "buildWorkloadWaitProofInput", { enumerable: true, get: function () { return workload_activation_ts_1.buildWorkloadWaitProofInput; } });
+Object.defineProperty(exports, "createWorkloadNatsAuthToken", { enumerable: true, get: function () { return workload_activation_ts_1.createWorkloadNatsAuthToken; } });
+Object.defineProperty(exports, "createWorkloadActivationClient", { enumerable: true, get: function () { return workload_activation_ts_1.createWorkloadActivationClient; } });
+Object.defineProperty(exports, "deriveWorkloadConfirmationCode", { enumerable: true, get: function () { return workload_activation_ts_1.deriveWorkloadConfirmationCode; } });
+Object.defineProperty(exports, "deriveWorkloadIdentity", { enumerable: true, get: function () { return workload_activation_ts_1.deriveWorkloadIdentity; } });
+Object.defineProperty(exports, "deriveWorkloadQrMac", { enumerable: true, get: function () { return workload_activation_ts_1.deriveWorkloadQrMac; } });
+Object.defineProperty(exports, "encodeWorkloadActivationPayload", { enumerable: true, get: function () { return workload_activation_ts_1.encodeWorkloadActivationPayload; } });
+Object.defineProperty(exports, "getWorkloadConnectInfo", { enumerable: true, get: function () { return workload_activation_ts_1.getWorkloadConnectInfo; } });
+Object.defineProperty(exports, "parseWorkloadActivationPayload", { enumerable: true, get: function () { return workload_activation_ts_1.parseWorkloadActivationPayload; } });
+Object.defineProperty(exports, "signWorkloadWaitRequest", { enumerable: true, get: function () { return workload_activation_ts_1.signWorkloadWaitRequest; } });
+Object.defineProperty(exports, "verifyWorkloadConfirmationCode", { enumerable: true, get: function () { return workload_activation_ts_1.verifyWorkloadConfirmationCode; } });
+Object.defineProperty(exports, "verifyWorkloadWaitSignature", { enumerable: true, get: function () { return workload_activation_ts_1.verifyWorkloadWaitSignature; } });
+Object.defineProperty(exports, "waitForWorkloadActivation", { enumerable: true, get: function () { return workload_activation_ts_1.waitForWorkloadActivation; } });
+var browser_ts_1 = require("./browser.ts");
+Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return browser_ts_1.bindFlow; } });
+Object.defineProperty(exports, "bindSession", { enumerable: true, get: function () { return browser_ts_1.bindSession; } });
+Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return browser_ts_1.buildLoginUrl; } });
+Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return browser_ts_1.clearSessionKey; } });
+Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return browser_ts_1.createRpcProof; } });
+Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return browser_ts_1.fetchPortalFlowState; } });
+Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return browser_ts_1.generateSessionKey; } });
+Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return browser_ts_1.getOrCreateSessionKey; } });
+Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return browser_ts_1.getPublicSessionKey; } });
+Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return browser_ts_1.hasSessionKey; } });
+Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return browser_ts_1.isBindSuccessResponse; } });
+Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return browser_ts_1.loadSessionKey; } });
+Object.defineProperty(exports, "natsConnectSigForBindingToken", { enumerable: true, get: function () { return browser_ts_1.natsConnectSigForBindingToken; } });
+Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return browser_ts_1.portalFlowIdFromUrl; } });
+Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return browser_ts_1.portalProviderLoginUrl; } });
+Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return browser_ts_1.portalRedirectLocation; } });
+Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return browser_ts_1.signBytes; } });
+Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return browser_ts_1.submitPortalApproval; } });
+var proof_ts_1 = require("./proof.ts");
+Object.defineProperty(exports, "buildProofInput", { enumerable: true, get: function () { return proof_ts_1.buildProofInput; } });
+Object.defineProperty(exports, "createProof", { enumerable: true, get: function () { return proof_ts_1.createProof; } });
+Object.defineProperty(exports, "verifyProof", { enumerable: true, get: function () { return proof_ts_1.verifyProof; } });
+var protocol_ts_1 = require("./protocol.ts");
+Object.defineProperty(exports, "ApprovalRecordViewSchema", { enumerable: true, get: function () { return protocol_ts_1.ApprovalRecordViewSchema; } });
+Object.defineProperty(exports, "AuthActivateWorkloadResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthActivateWorkloadResponseSchema; } });
+Object.defineProperty(exports, "AuthActivateWorkloadSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthActivateWorkloadSchema; } });
+Object.defineProperty(exports, "AuthClearLoginPortalSelectionResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthClearLoginPortalSelectionResponseSchema; } });
+Object.defineProperty(exports, "AuthClearLoginPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthClearLoginPortalSelectionSchema; } });
+Object.defineProperty(exports, "AuthClearWorkloadPortalSelectionResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthClearWorkloadPortalSelectionResponseSchema; } });
+Object.defineProperty(exports, "AuthClearWorkloadPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthClearWorkloadPortalSelectionSchema; } });
+Object.defineProperty(exports, "AuthCreatePortalResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthCreatePortalResponseSchema; } });
+Object.defineProperty(exports, "AuthCreatePortalSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthCreatePortalSchema; } });
+Object.defineProperty(exports, "AuthCreateWorkloadProfileResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthCreateWorkloadProfileResponseSchema; } });
+Object.defineProperty(exports, "AuthCreateWorkloadProfileSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthCreateWorkloadProfileSchema; } });
+Object.defineProperty(exports, "AuthDisablePortalResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisablePortalResponseSchema; } });
+Object.defineProperty(exports, "AuthDisablePortalSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisablePortalSchema; } });
+Object.defineProperty(exports, "AuthGetLoginPortalDefaultResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetLoginPortalDefaultResponseSchema; } });
+Object.defineProperty(exports, "AuthGetLoginPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetLoginPortalDefaultSchema; } });
+Object.defineProperty(exports, "AuthDisableWorkloadInstanceResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisableWorkloadInstanceResponseSchema; } });
+Object.defineProperty(exports, "AuthDisableWorkloadInstanceSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisableWorkloadInstanceSchema; } });
+Object.defineProperty(exports, "AuthDisableWorkloadProfileResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisableWorkloadProfileResponseSchema; } });
+Object.defineProperty(exports, "AuthDisableWorkloadProfileSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDisableWorkloadProfileSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadConnectInfoResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadConnectInfoResponseSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadConnectInfoSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadConnectInfoSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadPortalDefaultResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadPortalDefaultResponseSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadPortalDefaultSchema; } });
+Object.defineProperty(exports, "AuthListLoginPortalSelectionsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListLoginPortalSelectionsResponseSchema; } });
+Object.defineProperty(exports, "AuthListLoginPortalSelectionsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListLoginPortalSelectionsSchema; } });
+Object.defineProperty(exports, "AuthListPortalsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListPortalsResponseSchema; } });
+Object.defineProperty(exports, "AuthListPortalsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListPortalsSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadPortalSelectionsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadPortalSelectionsResponseSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadPortalSelectionsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadPortalSelectionsSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadActivationReviewsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadActivationReviewsResponseSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadActivationReviewsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadActivationReviewsSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadActivationsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadActivationsResponseSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadActivationsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadActivationsSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadActivationStatusResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadActivationStatusResponseSchema; } });
+Object.defineProperty(exports, "AuthGetWorkloadActivationStatusSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetWorkloadActivationStatusSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadInstancesResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadInstancesResponseSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadInstancesSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadInstancesSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadProfilesResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadProfilesResponseSchema; } });
+Object.defineProperty(exports, "AuthListWorkloadProfilesSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListWorkloadProfilesSchema; } });
+Object.defineProperty(exports, "AuthProvisionWorkloadInstanceResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthProvisionWorkloadInstanceResponseSchema; } });
+Object.defineProperty(exports, "AuthProvisionWorkloadInstanceSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthProvisionWorkloadInstanceSchema; } });
+Object.defineProperty(exports, "AuthDecideWorkloadActivationReviewResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDecideWorkloadActivationReviewResponseSchema; } });
+Object.defineProperty(exports, "AuthDecideWorkloadActivationReviewSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthDecideWorkloadActivationReviewSchema; } });
+Object.defineProperty(exports, "AuthWorkloadActivationReviewRequestedEventSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthWorkloadActivationReviewRequestedEventSchema; } });
+Object.defineProperty(exports, "AuthRevokeWorkloadActivationResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthRevokeWorkloadActivationResponseSchema; } });
+Object.defineProperty(exports, "AuthRevokeWorkloadActivationSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthRevokeWorkloadActivationSchema; } });
+Object.defineProperty(exports, "AuthSetLoginPortalDefaultResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetLoginPortalDefaultResponseSchema; } });
+Object.defineProperty(exports, "AuthSetLoginPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetLoginPortalDefaultSchema; } });
+Object.defineProperty(exports, "AuthSetLoginPortalSelectionResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetLoginPortalSelectionResponseSchema; } });
+Object.defineProperty(exports, "AuthSetLoginPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetLoginPortalSelectionSchema; } });
+Object.defineProperty(exports, "AuthSetWorkloadPortalDefaultResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetWorkloadPortalDefaultResponseSchema; } });
+Object.defineProperty(exports, "AuthSetWorkloadPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetWorkloadPortalDefaultSchema; } });
+Object.defineProperty(exports, "AuthSetWorkloadPortalSelectionResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetWorkloadPortalSelectionResponseSchema; } });
+Object.defineProperty(exports, "AuthSetWorkloadPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthSetWorkloadPortalSelectionSchema; } });
+Object.defineProperty(exports, "AuthGetInstalledContractResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetInstalledContractResponseSchema; } });
+Object.defineProperty(exports, "AuthGetInstalledContractSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthGetInstalledContractSchema; } });
+Object.defineProperty(exports, "AuthInstallServiceResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthInstallServiceResponseSchema; } });
+Object.defineProperty(exports, "AuthInstallServiceSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthInstallServiceSchema; } });
+Object.defineProperty(exports, "AuthListApprovalsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListApprovalsResponseSchema; } });
+Object.defineProperty(exports, "AuthListApprovalsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListApprovalsSchema; } });
+Object.defineProperty(exports, "AuthListInstalledContractsResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListInstalledContractsResponseSchema; } });
+Object.defineProperty(exports, "AuthListInstalledContractsSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListInstalledContractsSchema; } });
+Object.defineProperty(exports, "AuthListServicesResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListServicesResponseSchema; } });
+Object.defineProperty(exports, "AuthListServicesSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListServicesSchema; } });
+Object.defineProperty(exports, "AuthListUsersResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListUsersResponseSchema; } });
+Object.defineProperty(exports, "AuthListUsersSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthListUsersSchema; } });
+Object.defineProperty(exports, "AuthMeResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthMeResponseSchema; } });
+Object.defineProperty(exports, "AuthMeSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthMeSchema; } });
+Object.defineProperty(exports, "AuthRevokeApprovalResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthRevokeApprovalResponseSchema; } });
+Object.defineProperty(exports, "AuthRevokeApprovalSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthRevokeApprovalSchema; } });
+Object.defineProperty(exports, "AuthUpdateUserResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthUpdateUserResponseSchema; } });
+Object.defineProperty(exports, "AuthUpdateUserSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthUpdateUserSchema; } });
+Object.defineProperty(exports, "AuthUpgradeServiceContractResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthUpgradeServiceContractResponseSchema; } });
+Object.defineProperty(exports, "AuthUpgradeServiceContractSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthUpgradeServiceContractSchema; } });
+Object.defineProperty(exports, "AuthValidateRequestResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthValidateRequestResponseSchema; } });
+Object.defineProperty(exports, "AuthValidateRequestSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthValidateRequestSchema; } });
+Object.defineProperty(exports, "AuthenticatedWorkloadSchema", { enumerable: true, get: function () { return protocol_ts_1.AuthenticatedWorkloadSchema; } });
+Object.defineProperty(exports, "CallerViewSchema", { enumerable: true, get: function () { return protocol_ts_1.CallerViewSchema; } });
+Object.defineProperty(exports, "ContractAnalysisSchema", { enumerable: true, get: function () { return protocol_ts_1.ContractAnalysisSchema; } });
+Object.defineProperty(exports, "ContractAnalysisSummarySchema", { enumerable: true, get: function () { return protocol_ts_1.ContractAnalysisSummarySchema; } });
+Object.defineProperty(exports, "DigestSchema", { enumerable: true, get: function () { return protocol_ts_1.DigestSchema; } });
+Object.defineProperty(exports, "InstalledContractDetailSchema", { enumerable: true, get: function () { return protocol_ts_1.InstalledContractDetailSchema; } });
+Object.defineProperty(exports, "InstalledContractSchema", { enumerable: true, get: function () { return protocol_ts_1.InstalledContractSchema; } });
+Object.defineProperty(exports, "LoginPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.LoginPortalDefaultSchema; } });
+Object.defineProperty(exports, "LoginPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.LoginPortalSelectionSchema; } });
+Object.defineProperty(exports, "OpenObjectSchema", { enumerable: true, get: function () { return protocol_ts_1.OpenObjectSchema; } });
+Object.defineProperty(exports, "PortalSchema", { enumerable: true, get: function () { return protocol_ts_1.PortalSchema; } });
+Object.defineProperty(exports, "PortalFlowStateSchema", { enumerable: true, get: function () { return protocol_ts_1.PortalFlowStateSchema; } });
+Object.defineProperty(exports, "ServiceViewSchema", { enumerable: true, get: function () { return protocol_ts_1.ServiceViewSchema; } });
+Object.defineProperty(exports, "UserViewSchema", { enumerable: true, get: function () { return protocol_ts_1.UserViewSchema; } });
+Object.defineProperty(exports, "WaitForWorkloadActivationResponseSchema", { enumerable: true, get: function () { return protocol_ts_1.WaitForWorkloadActivationResponseSchema; } });
+Object.defineProperty(exports, "WorkloadActivationReviewSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadActivationReviewSchema; } });
+Object.defineProperty(exports, "WorkloadPortalDefaultSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadPortalDefaultSchema; } });
+Object.defineProperty(exports, "WorkloadPortalSelectionSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadPortalSelectionSchema; } });
+Object.defineProperty(exports, "WorkloadActivationRecordSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadActivationRecordSchema; } });
+Object.defineProperty(exports, "WorkloadConnectInfoSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadConnectInfoSchema; } });
+Object.defineProperty(exports, "WorkloadProfileSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadProfileSchema; } });
+Object.defineProperty(exports, "WorkloadSchema", { enumerable: true, get: function () { return protocol_ts_1.WorkloadSchema; } });
+var schemas_ts_1 = require("./schemas.ts");
+Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_ts_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "BindRequestSchema", { enumerable: true, get: function () { return schemas_ts_1.BindRequestSchema; } });
+Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindResponseSchema; } });
+Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_ts_1.ContractApprovalSchema; } });
+Object.defineProperty(exports, "LoginQuerySchema", { enumerable: true, get: function () { return schemas_ts_1.LoginQuerySchema; } });
+Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_ts_1.NatsAuthTokenV1Schema; } });
+Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_ts_1.SentinelCredsSchema; } });
+var session_auth_ts_1 = require("./session_auth.ts");
+Object.defineProperty(exports, "createAuth", { enumerable: true, get: function () { return session_auth_ts_1.createAuth; } });
+var trellis_id_ts_1 = require("./trellis_id.ts");
+Object.defineProperty(exports, "trellisIdFromOriginId", { enumerable: true, get: function () { return trellis_id_ts_1.trellisIdFromOriginId; } });
+var utils_ts_1 = require("./utils.ts");
+Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_ts_1.base64urlDecode; } });
+Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_ts_1.base64urlEncode; } });
+Object.defineProperty(exports, "canonicalizeJsonValue", { enumerable: true, get: function () { return utils_ts_1.canonicalizeJsonValue; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_ts_1.sha256; } });
+Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_ts_1.toArrayBuffer; } });
+Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_ts_1.utf8; } });

package/script/auth/proof.d.ts

@@ -0,0 +1,9 @@
+export type ProofParams = {
+    sessionKey: string;
+    subject: string;
+    payloadHash: Uint8Array;
+};
+export declare function buildProofInput(sessionKey: string, subject: string, payloadHash: Uint8Array): Uint8Array;
+export declare function createProof(privateKey: CryptoKey, params: ProofParams): Promise<string>;
+export declare function verifyProof(publicSessionKey: string, params: ProofParams, proofBase64url: string): Promise<boolean>;
+//# sourceMappingURL=proof.d.ts.map

package/script/auth/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../../auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,GACtB,UAAU,CA8BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/script/auth/proof.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildProofInput = buildProofInput;
+exports.createProof = createProof;
+exports.verifyProof = verifyProof;
+const utils_ts_1 = require("./utils.ts");
+const keys_ts_1 = require("./keys.ts");
+const result_1 = require("@qlever-llc/result");
+function buildProofInput(sessionKey, subject, payloadHash) {
+    const sessionKeyBytes = (0, utils_ts_1.utf8)(sessionKey);
+    const subjectBytes = (0, utils_ts_1.utf8)(subject);
+    const buf = new Uint8Array(4 +
+        sessionKeyBytes.length +
+        4 +
+        subjectBytes.length +
+        4 +
+        payloadHash.length);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    view.setUint32(offset, sessionKeyBytes.length);
+    offset += 4;
+    buf.set(sessionKeyBytes, offset);
+    offset += sessionKeyBytes.length;
+    view.setUint32(offset, subjectBytes.length);
+    offset += 4;
+    buf.set(subjectBytes, offset);
+    offset += subjectBytes.length;
+    view.setUint32(offset, payloadHash.length);
+    offset += 4;
+    buf.set(payloadHash, offset);
+    return buf;
+}
+async function createProof(privateKey, params) {
+    const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+    const digest = await (0, utils_ts_1.sha256)(input);
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, (0, utils_ts_1.toArrayBuffer)(digest));
+    return (0, utils_ts_1.base64urlEncode)(new Uint8Array(sig));
+}
+async function verifyProof(publicSessionKey, params, proofBase64url) {
+    const result = await result_1.AsyncResult.try(async () => {
+        const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+        const digest = await (0, utils_ts_1.sha256)(input);
+        const signature = (0, utils_ts_1.base64urlDecode)(proofBase64url);
+        const pub = await (0, keys_ts_1.importEd25519PublicKeyFromBase64url)(publicSessionKey);
+        return crypto.subtle.verify({ name: "Ed25519" }, pub, (0, utils_ts_1.toArrayBuffer)(signature), (0, utils_ts_1.toArrayBuffer)(digest));
+    });
+    return result.unwrapOr(false);
+}