@qlever-llc/trellis 0.6.1 → 0.7.0-rc.3

package/script/trellis/workload.js

@@ -1,172 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TrellisWorkload = void 0;
-exports.loadDefaultTransport = loadDefaultTransport;
-exports.connectWorkloadWithDeps = connectWorkloadWithDeps;
-const nats_core_1 = require("@nats-io/nats-core");
-const auth_ts_1 = require("./auth.ts");
-function normalizeRootSecret(rootSecret) {
-    if (typeof rootSecret === "string") {
-        const decoded = (0, auth_ts_1.base64urlDecode)(rootSecret.trim());
-        if (decoded.length === 0)
-            throw new Error("rootSecret must not be empty");
-        return decoded;
-    }
-    if (rootSecret.length === 0)
-        throw new Error("rootSecret must not be empty");
-    return rootSecret;
-}
-async function signIdentityBytes(identitySeed, data) {
-    const { importEd25519PrivateKeyFromSeedBase64url } = await Promise.resolve().then(() => __importStar(require("../auth/keys.ts")));
-    const { base64urlEncode, toArrayBuffer } = await Promise.resolve().then(() => __importStar(require("../auth/utils.ts")));
-    const privateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
-    return new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, toArrayBuffer(data)));
-}
-async function runtimeImport(specifier) {
-    const load = new Function("specifier", "return import(specifier);");
-    return await load(specifier);
-}
-async function loadDefaultTransport(importModule = runtimeImport) {
-    if ("Deno" in globalThis) {
-        const mod = await importModule("@nats-io/nats-core");
-        return {
-            connect: mod.wsconnect,
-        };
-    }
-    const mod = await runtimeImport("@nats-io/transport-node");
-    return {
-        connect: mod.connect,
-    };
-}
-const defaultDeps = {
-    loadTransport: loadDefaultTransport,
-    now: () => Date.now(),
-};
-function activationRequiredError() {
-    return new Error("Workload activation required but no activation handler was provided");
-}
-function isConnectInfoUnavailable(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return message.includes("404") || message.includes("unknown_workload");
-}
-async function connectWorkloadWithDeps(args, deps) {
-    const rootSecret = normalizeRootSecret(args.rootSecret);
-    const identity = await (0, auth_ts_1.deriveWorkloadIdentity)(rootSecret);
-    const contractDigest = args.contract.CONTRACT_DIGEST;
-    let connectInfo = null;
-    try {
-        connectInfo = (await (0, auth_ts_1.getWorkloadConnectInfo)({
-            trellisUrl: args.authUrl,
-            publicIdentityKey: identity.publicIdentityKey,
-            identitySeed: identity.identitySeed,
-            contractDigest,
-        })).connectInfo;
-    }
-    catch (error) {
-        if (!isConnectInfoUnavailable(error))
-            throw error;
-    }
-    if (!connectInfo) {
-        if (!args.onActivationRequired)
-            throw activationRequiredError();
-        const nonce = crypto.randomUUID();
-        const payload = await (0, auth_ts_1.buildWorkloadActivationPayload)({
-            activationKey: identity.activationKey,
-            publicIdentityKey: identity.publicIdentityKey,
-            nonce,
-        });
-        const activationUrl = (0, auth_ts_1.buildWorkloadActivationUrl)({
-            trellisUrl: args.authUrl,
-            payload,
-        });
-        let activationCompleted = false;
-        let onlineConnectInfo = null;
-        await args.onActivationRequired({
-            url: activationUrl,
-            waitForOnlineApproval: async (opts) => {
-                if (activationCompleted)
-                    return;
-                const activation = await (0, auth_ts_1.waitForWorkloadActivation)({
-                    trellisUrl: args.authUrl,
-                    publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
-                    identitySeed: identity.identitySeed,
-                    contractDigest,
-                    signal: opts?.signal,
-                });
-                onlineConnectInfo = activation.connectInfo;
-                activationCompleted = true;
-            },
-            acceptConfirmationCode: async (code) => {
-                if (activationCompleted)
-                    return;
-                const ok = await (0, auth_ts_1.verifyWorkloadConfirmationCode)({
-                    activationKey: identity.activationKey,
-                    publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
-                    confirmationCode: code,
-                });
-                if (!ok) {
-                    throw new Error("Invalid workload confirmation code");
-                }
-                activationCompleted = true;
-            },
-        });
-        if (!activationCompleted) {
-            throw new Error("Workload activation did not complete");
-        }
-        connectInfo = onlineConnectInfo ?? (await (0, auth_ts_1.getWorkloadConnectInfo)({
-            trellisUrl: args.authUrl,
-            publicIdentityKey: identity.publicIdentityKey,
-            identitySeed: identity.identitySeed,
-            contractDigest,
-        })).connectInfo;
-    }
-    const transport = await deps.loadTransport();
-    const iat = Math.floor(deps.now() / 1_000);
-    const authToken = await (0, auth_ts_1.createWorkloadNatsAuthToken)({
-        publicIdentityKey: identity.publicIdentityKey,
-        identitySeed: identity.identitySeed,
-        contractDigest,
-        iat,
-    });
-    const nc = await transport.connect({
-        servers: connectInfo.transport.natsServers,
-        token: JSON.stringify(authToken),
-        inboxPrefix: `_INBOX.${identity.publicIdentityKey.slice(0, 16)}`,
-        authenticator: (0, nats_core_1.jwtAuthenticator)(connectInfo.transport.sentinel.jwt, new TextEncoder().encode(connectInfo.transport.sentinel.seed)),
-    });
-    return args.contract.createClient(nc, {
-        sessionKey: identity.publicIdentityKey,
-        sign: (data) => signIdentityBytes(identity.identitySeed, data),
-    });
-}
-class TrellisWorkload {
-    static connect(args) {
-        return connectWorkloadWithDeps(args, defaultDeps);
-    }
-}
-exports.TrellisWorkload = TrellisWorkload;