@qlever-llc/trellis 0.5.1 → 0.6.1

package/script/trellis/workload.d.ts

@@ -0,0 +1,45 @@
+import { type NatsConnection } from "@nats-io/nats-core";
+import type { ClientOpts } from "./client.ts";
+import type { TrellisAPI } from "./contracts.ts";
+import type { TrellisAuth, Trellis } from "./trellis.ts";
+type WorkloadContract<TApi extends TrellisAPI = TrellisAPI> = {
+    CONTRACT_ID: string;
+    CONTRACT_DIGEST: string;
+    API: {
+        trellis: TApi;
+    };
+    createClient(nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<TApi>;
+};
+type WorkloadConnectTransport = {
+    connect(options: {
+        servers: string | string[];
+        token?: string;
+        authenticator?: unknown;
+        inboxPrefix?: string;
+    }): Promise<NatsConnection>;
+};
+type WorkloadConnectDeps = {
+    loadTransport(): Promise<WorkloadConnectTransport>;
+    now(): number;
+};
+export type WorkloadActivationController = {
+    url: string;
+    waitForOnlineApproval(opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    acceptConfirmationCode(code: string): Promise<void>;
+};
+export type TrellisWorkloadConnectArgs<TApi extends TrellisAPI = TrellisAPI> = {
+    authUrl: string;
+    contract: WorkloadContract<TApi>;
+    rootSecret: Uint8Array | string;
+    onActivationRequired?(activation: WorkloadActivationController): Promise<void>;
+};
+declare function runtimeImport<TModule>(specifier: string): Promise<TModule>;
+export declare function loadDefaultTransport(importModule?: typeof runtimeImport): Promise<WorkloadConnectTransport>;
+export declare function connectWorkloadWithDeps<TApi extends TrellisAPI>(args: TrellisWorkloadConnectArgs<TApi>, deps: WorkloadConnectDeps): Promise<Trellis<TApi>>;
+export declare class TrellisWorkload {
+    static connect<TApi extends TrellisAPI>(args: TrellisWorkloadConnectArgs<TApi>): Promise<Trellis<TApi>>;
+}
+export {};
+//# sourceMappingURL=workload.d.ts.map

package/script/trellis/workload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload.d.ts","sourceRoot":"","sources":["../../../workload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAY3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEzD,KAAK,gBAAgB,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;IACF,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzF,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,OAAO,CAAC,OAAO,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,aAAa,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnD,GAAG,IAAI,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,CAAC,UAAU,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF,CAAC;AAqBF,iBAAe,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKzE;AAED,wBAAsB,oBAAoB,CACxC,YAAY,GAAE,OAAO,aAA6B,GACjD,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAgBD,wBAAsB,uBAAuB,CAAC,IAAI,SAAS,UAAU,EACnE,IAAI,EAAE,0BAA0B,CAAC,IAAI,CAAC,EACtC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAmGxB;AAED,qBAAa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,UAAU,EACpC,IAAI,EAAE,0BAA0B,CAAC,IAAI,CAAC,GACrC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;CAG1B"}

package/script/trellis/workload.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrellisWorkload = void 0;
+exports.loadDefaultTransport = loadDefaultTransport;
+exports.connectWorkloadWithDeps = connectWorkloadWithDeps;
+const nats_core_1 = require("@nats-io/nats-core");
+const auth_ts_1 = require("./auth.ts");
+function normalizeRootSecret(rootSecret) {
+    if (typeof rootSecret === "string") {
+        const decoded = (0, auth_ts_1.base64urlDecode)(rootSecret.trim());
+        if (decoded.length === 0)
+            throw new Error("rootSecret must not be empty");
+        return decoded;
+    }
+    if (rootSecret.length === 0)
+        throw new Error("rootSecret must not be empty");
+    return rootSecret;
+}
+async function signIdentityBytes(identitySeed, data) {
+    const { importEd25519PrivateKeyFromSeedBase64url } = await Promise.resolve().then(() => __importStar(require("../auth/keys.ts")));
+    const { base64urlEncode, toArrayBuffer } = await Promise.resolve().then(() => __importStar(require("../auth/utils.ts")));
+    const privateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
+    return new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, toArrayBuffer(data)));
+}
+async function runtimeImport(specifier) {
+    const load = new Function("specifier", "return import(specifier);");
+    return await load(specifier);
+}
+async function loadDefaultTransport(importModule = runtimeImport) {
+    if ("Deno" in globalThis) {
+        const mod = await importModule("@nats-io/nats-core");
+        return {
+            connect: mod.wsconnect,
+        };
+    }
+    const mod = await runtimeImport("@nats-io/transport-node");
+    return {
+        connect: mod.connect,
+    };
+}
+const defaultDeps = {
+    loadTransport: loadDefaultTransport,
+    now: () => Date.now(),
+};
+function activationRequiredError() {
+    return new Error("Workload activation required but no activation handler was provided");
+}
+function isConnectInfoUnavailable(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes("404") || message.includes("unknown_workload");
+}
+async function connectWorkloadWithDeps(args, deps) {
+    const rootSecret = normalizeRootSecret(args.rootSecret);
+    const identity = await (0, auth_ts_1.deriveWorkloadIdentity)(rootSecret);
+    const contractDigest = args.contract.CONTRACT_DIGEST;
+    let connectInfo = null;
+    try {
+        connectInfo = (await (0, auth_ts_1.getWorkloadConnectInfo)({
+            trellisUrl: args.authUrl,
+            publicIdentityKey: identity.publicIdentityKey,
+            identitySeed: identity.identitySeed,
+            contractDigest,
+        })).connectInfo;
+    }
+    catch (error) {
+        if (!isConnectInfoUnavailable(error))
+            throw error;
+    }
+    if (!connectInfo) {
+        if (!args.onActivationRequired)
+            throw activationRequiredError();
+        const nonce = crypto.randomUUID();
+        const payload = await (0, auth_ts_1.buildWorkloadActivationPayload)({
+            activationKey: identity.activationKey,
+            publicIdentityKey: identity.publicIdentityKey,
+            nonce,
+        });
+        const activationUrl = (0, auth_ts_1.buildWorkloadActivationUrl)({
+            trellisUrl: args.authUrl,
+            payload,
+        });
+        let activationCompleted = false;
+        let onlineConnectInfo = null;
+        await args.onActivationRequired({
+            url: activationUrl,
+            waitForOnlineApproval: async (opts) => {
+                if (activationCompleted)
+                    return;
+                const activation = await (0, auth_ts_1.waitForWorkloadActivation)({
+                    trellisUrl: args.authUrl,
+                    publicIdentityKey: identity.publicIdentityKey,
+                    nonce,
+                    identitySeed: identity.identitySeed,
+                    contractDigest,
+                    signal: opts?.signal,
+                });
+                onlineConnectInfo = activation.connectInfo;
+                activationCompleted = true;
+            },
+            acceptConfirmationCode: async (code) => {
+                if (activationCompleted)
+                    return;
+                const ok = await (0, auth_ts_1.verifyWorkloadConfirmationCode)({
+                    activationKey: identity.activationKey,
+                    publicIdentityKey: identity.publicIdentityKey,
+                    nonce,
+                    confirmationCode: code,
+                });
+                if (!ok) {
+                    throw new Error("Invalid workload confirmation code");
+                }
+                activationCompleted = true;
+            },
+        });
+        if (!activationCompleted) {
+            throw new Error("Workload activation did not complete");
+        }
+        connectInfo = onlineConnectInfo ?? (await (0, auth_ts_1.getWorkloadConnectInfo)({
+            trellisUrl: args.authUrl,
+            publicIdentityKey: identity.publicIdentityKey,
+            identitySeed: identity.identitySeed,
+            contractDigest,
+        })).connectInfo;
+    }
+    const transport = await deps.loadTransport();
+    const iat = Math.floor(deps.now() / 1_000);
+    const authToken = await (0, auth_ts_1.createWorkloadNatsAuthToken)({
+        publicIdentityKey: identity.publicIdentityKey,
+        identitySeed: identity.identitySeed,
+        contractDigest,
+        iat,
+    });
+    const nc = await transport.connect({
+        servers: connectInfo.transport.natsServers,
+        token: JSON.stringify(authToken),
+        inboxPrefix: `_INBOX.${identity.publicIdentityKey.slice(0, 16)}`,
+        authenticator: (0, nats_core_1.jwtAuthenticator)(connectInfo.transport.sentinel.jwt, new TextEncoder().encode(connectInfo.transport.sentinel.seed)),
+    });
+    return args.contract.createClient(nc, {
+        sessionKey: identity.publicIdentityKey,
+        sign: (data) => signIdentityBytes(identity.identitySeed, data),
+    });
+}
+class TrellisWorkload {
+    static connect(args) {
+        return connectWorkloadWithDeps(args, defaultDeps);
+    }
+}
+exports.TrellisWorkload = TrellisWorkload;

package/script/_dnt.polyfills.d.ts

@@ -1,7 +0,0 @@
-declare global {
-    interface Error {
-        cause?: unknown;
-    }
-}
-export {};
-//# sourceMappingURL=_dnt.polyfills.d.ts.map

package/script/_dnt.polyfills.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"_dnt.polyfills.d.ts","sourceRoot":"","sources":["../src/_dnt.polyfills.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,KAAK;QACb,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CACF;AAED,OAAO,EAAE,CAAC"}

package/script/trellis/browser.d.ts

@@ -1,11 +0,0 @@
-/**
- * Browser-safe exports for @qlever-llc/trellis
- */
-import "../_dnt.polyfills.js";
-export { Trellis } from "./trellis.js";
-export type { TrellisAuth } from "./trellis.js";
-export { TypedKV, TypedKVEntry } from "./kv.js";
-export type { WatchEvent, WatchOptions } from "./kv.js";
-export { AuthError, KVError, RemoteError, UnexpectedError, ValidationError, } from "./errors/index.js";
-export type { TrellisErrorInstance } from "./errors/index.js";
-//# sourceMappingURL=browser.d.ts.map

package/script/trellis/browser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/trellis/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,sBAAsB,CAAC;AAE9B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGxD,OAAO,EACL,SAAS,EACT,OAAO,EACP,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/script/trellis/browser.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Browser-safe exports for @qlever-llc/trellis
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ValidationError = exports.UnexpectedError = exports.RemoteError = exports.KVError = exports.AuthError = exports.TypedKVEntry = exports.TypedKV = exports.Trellis = void 0;
-// Core Trellis client class (browser-safe)
-require("../_dnt.polyfills.js");
-var trellis_js_1 = require("./trellis.js");
-Object.defineProperty(exports, "Trellis", { enumerable: true, get: function () { return trellis_js_1.Trellis; } });
-// KV utilities (browser-safe)
-var kv_js_1 = require("./kv.js");
-Object.defineProperty(exports, "TypedKV", { enumerable: true, get: function () { return kv_js_1.TypedKV; } });
-Object.defineProperty(exports, "TypedKVEntry", { enumerable: true, get: function () { return kv_js_1.TypedKVEntry; } });
-// Error types (browser-safe)
-var index_js_1 = require("./errors/index.js");
-Object.defineProperty(exports, "AuthError", { enumerable: true, get: function () { return index_js_1.AuthError; } });
-Object.defineProperty(exports, "KVError", { enumerable: true, get: function () { return index_js_1.KVError; } });
-Object.defineProperty(exports, "RemoteError", { enumerable: true, get: function () { return index_js_1.RemoteError; } });
-Object.defineProperty(exports, "UnexpectedError", { enumerable: true, get: function () { return index_js_1.UnexpectedError; } });
-Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return index_js_1.ValidationError; } });

package/script/trellis/env.d.ts

@@ -1,2 +0,0 @@
-export { getEnv } from "@qlever-llc/trellis-telemetry";
-//# sourceMappingURL=env.d.ts.map

package/script/trellis/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/trellis/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC"}

package/script/trellis/env.js

@@ -1,5 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getEnv = void 0;
-var trellis_telemetry_1 = require("@qlever-llc/trellis-telemetry");
-Object.defineProperty(exports, "getEnv", { enumerable: true, get: function () { return trellis_telemetry_1.getEnv; } });