@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/script/auth/schemas.d.ts

@@ -1,93 +0,0 @@
-import type { StaticDecode } from "typebox";
-import { Type } from "typebox";
-export declare const LoginQuerySchema: Type.TObject<{
-    provider: Type.TOptional<Type.TString>;
-    redirectTo: Type.TString;
-    sessionKey: Type.TString;
-    sig: Type.TString;
-    contract: Type.TString;
-    context: Type.TOptional<Type.TString>;
-}>;
-export type LoginQuery = StaticDecode<typeof LoginQuerySchema>;
-export declare const SentinelCredsSchema: Type.TObject<{
-    jwt: Type.TString;
-    seed: Type.TString;
-}>;
-export type SentinelCreds = StaticDecode<typeof SentinelCredsSchema>;
-export declare const ApprovalDecisionSchema: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
-export type ApprovalDecision = StaticDecode<typeof ApprovalDecisionSchema>;
-export declare const ContractApprovalSchema: Type.TObject<{
-    contractDigest: Type.TString;
-    contractId: Type.TString;
-    displayName: Type.TString;
-    description: Type.TString;
-    kind: Type.TOptional<Type.TString>;
-    capabilities: Type.TArray<Type.TString>;
-}>;
-export type ContractApproval = StaticDecode<typeof ContractApprovalSchema>;
-export declare const BindRequestSchema: Type.TObject<{
-    authToken: Type.TString;
-    sessionKey: Type.TString;
-    sig: Type.TString;
-}>;
-export type BindRequest = StaticDecode<typeof BindRequestSchema>;
-export declare const BindSuccessResponseSchema: Type.TObject<{
-    status: Type.TLiteral<"bound">;
-    bindingToken: Type.TString;
-    inboxPrefix: Type.TString;
-    expires: Type.TString;
-    sentinel: Type.TObject<{
-        jwt: Type.TString;
-        seed: Type.TString;
-    }>;
-    natsServers: Type.TArray<Type.TString>;
-}>;
-export declare const BindInsufficientCapabilitiesResponseSchema: Type.TObject<{
-    status: Type.TLiteral<"insufficient_capabilities">;
-    approval: Type.TObject<{
-        contractDigest: Type.TString;
-        contractId: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        kind: Type.TOptional<Type.TString>;
-        capabilities: Type.TArray<Type.TString>;
-    }>;
-    missingCapabilities: Type.TArray<Type.TString>;
-    userCapabilities: Type.TArray<Type.TString>;
-}>;
-export declare const BindResponseSchema: Type.TUnion<[Type.TObject<{
-    status: Type.TLiteral<"bound">;
-    bindingToken: Type.TString;
-    inboxPrefix: Type.TString;
-    expires: Type.TString;
-    sentinel: Type.TObject<{
-        jwt: Type.TString;
-        seed: Type.TString;
-    }>;
-    natsServers: Type.TArray<Type.TString>;
-}>, Type.TObject<{
-    status: Type.TLiteral<"insufficient_capabilities">;
-    approval: Type.TObject<{
-        contractDigest: Type.TString;
-        contractId: Type.TString;
-        displayName: Type.TString;
-        description: Type.TString;
-        kind: Type.TOptional<Type.TString>;
-        capabilities: Type.TArray<Type.TString>;
-    }>;
-    missingCapabilities: Type.TArray<Type.TString>;
-    userCapabilities: Type.TArray<Type.TString>;
-}>]>;
-export type BindResponse = StaticDecode<typeof BindResponseSchema>;
-export type BindSuccessResponse = StaticDecode<typeof BindSuccessResponseSchema>;
-export type BindInsufficientCapabilitiesResponse = StaticDecode<typeof BindInsufficientCapabilitiesResponseSchema>;
-export declare const NatsAuthTokenV1Schema: Type.TObject<{
-    v: Type.TLiteral<1>;
-    sessionKey: Type.TString;
-    sig: Type.TString;
-    bindingToken: Type.TOptional<Type.TString>;
-    iat: Type.TOptional<Type.TInteger>;
-    contractDigest: Type.TOptional<Type.TString>;
-}>;
-export type NatsAuthTokenV1 = StaticDecode<typeof NatsAuthTokenV1Schema>;
-//# sourceMappingURL=schemas.d.ts.map

package/script/auth/schemas.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,gBAAgB;;;;;;;EAOM,CAAC;AAEpC,MAAM,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE/D,eAAO,MAAM,mBAAmB;;;EAGG,CAAC;AAEpC,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB;;;;;;;EASA,CAAC;AAEpC,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,iBAAiB;;;;EAIK,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEjE,eAAO,MAAM,yBAAyB;;;;;;;;;;EAOH,CAAC;AAEpC,eAAO,MAAM,0CAA0C;;;;;;;;;;;;EAKpB,CAAC;AAEpC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACjF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;EAOC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/script/auth/schemas.js

@@ -1,67 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NatsAuthTokenV1Schema = exports.BindResponseSchema = exports.BindInsufficientCapabilitiesResponseSchema = exports.BindSuccessResponseSchema = exports.BindRequestSchema = exports.ContractApprovalSchema = exports.ApprovalDecisionSchema = exports.SentinelCredsSchema = exports.LoginQuerySchema = void 0;
-const typebox_1 = require("typebox");
-const SessionKeySchema = typebox_1.Type.String({
-    pattern: "^[A-Za-z0-9_-]{43}$",
-});
-const SignatureSchema = typebox_1.Type.String({
-    pattern: "^[A-Za-z0-9_-]{86}$",
-});
-exports.LoginQuerySchema = typebox_1.Type.Object({
-    provider: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
-    redirectTo: typebox_1.Type.String(),
-    sessionKey: SessionKeySchema,
-    sig: SignatureSchema,
-    contract: typebox_1.Type.String({ minLength: 1 }),
-    context: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
-}, { additionalProperties: false });
-exports.SentinelCredsSchema = typebox_1.Type.Object({
-    jwt: typebox_1.Type.String(),
-    seed: typebox_1.Type.String(),
-}, { additionalProperties: false });
-exports.ApprovalDecisionSchema = typebox_1.Type.Union([
-    typebox_1.Type.Literal("approved"),
-    typebox_1.Type.Literal("denied"),
-]);
-exports.ContractApprovalSchema = typebox_1.Type.Object({
-    contractDigest: typebox_1.Type.String(),
-    contractId: typebox_1.Type.String(),
-    displayName: typebox_1.Type.String(),
-    description: typebox_1.Type.String(),
-    // Preserve legacy persisted approval records written before `kind` was removed
-    // from the public flow state shape.
-    kind: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
-    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
-}, { additionalProperties: false });
-exports.BindRequestSchema = typebox_1.Type.Object({
-    authToken: typebox_1.Type.String(),
-    sessionKey: SessionKeySchema,
-    sig: SignatureSchema,
-}, { additionalProperties: false });
-exports.BindSuccessResponseSchema = typebox_1.Type.Object({
-    status: typebox_1.Type.Literal("bound"),
-    bindingToken: typebox_1.Type.String(),
-    inboxPrefix: typebox_1.Type.String(),
-    expires: typebox_1.Type.String({ format: "date-time" }),
-    sentinel: exports.SentinelCredsSchema,
-    natsServers: typebox_1.Type.Array(typebox_1.Type.String()),
-}, { additionalProperties: false });
-exports.BindInsufficientCapabilitiesResponseSchema = typebox_1.Type.Object({
-    status: typebox_1.Type.Literal("insufficient_capabilities"),
-    approval: exports.ContractApprovalSchema,
-    missingCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
-    userCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
-}, { additionalProperties: false });
-exports.BindResponseSchema = typebox_1.Type.Union([
-    exports.BindSuccessResponseSchema,
-    exports.BindInsufficientCapabilitiesResponseSchema,
-]);
-exports.NatsAuthTokenV1Schema = typebox_1.Type.Object({
-    v: typebox_1.Type.Literal(1),
-    sessionKey: SessionKeySchema,
-    sig: SignatureSchema,
-    bindingToken: typebox_1.Type.Optional(typebox_1.Type.String()),
-    iat: typebox_1.Type.Optional(typebox_1.Type.Integer()),
-    contractDigest: typebox_1.Type.Optional(typebox_1.Type.String()),
-}, { additionalProperties: false });

package/script/auth/session_auth.d.ts

@@ -1,20 +0,0 @@
-import type { NatsAuthTokenV1 } from "./types.ts";
-export type NatsConnectOptions = {
-    token: string;
-    inboxPrefix: string;
-};
-export type TrellisAuth = {
-    sessionKey: string;
-    sign: (data: Uint8Array) => Promise<Uint8Array>;
-    oauthInitSig: (redirectTo: string, context?: unknown) => Promise<string>;
-    bindSig: (authToken: string) => Promise<string>;
-    natsConnectSigForBindingToken: (bindingToken: string) => Promise<string>;
-    natsConnectSigForIat: (iat: number) => Promise<string>;
-    createProof: (subject: string, payloadHash: Uint8Array) => Promise<string>;
-    createNatsAuthTokenForService: (iat: number) => Promise<NatsAuthTokenV1>;
-    natsConnectOptions: () => Promise<NatsConnectOptions>;
-};
-export declare function createAuth(opts: {
-    sessionKeySeed: string;
-}): Promise<TrellisAuth>;
-//# sourceMappingURL=session_auth.d.ts.map

package/script/auth/session_auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../../../auth/session_auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhD,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,6BAA6B,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,6BAA6B,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,kBAAkB,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACvD,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CAgDtB"}

package/script/auth/session_auth.js

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAuth = createAuth;
-const keys_ts_1 = require("./keys.ts");
-const proof_ts_1 = require("./proof.ts");
-const utils_ts_1 = require("./utils.ts");
-async function createAuth(opts) {
-    const privateKey = await (0, keys_ts_1.importEd25519PrivateKeyFromSeedBase64url)(opts.sessionKeySeed);
-    const sessionKey = await (0, keys_ts_1.publicKeyBase64urlFromPrivateKey)(privateKey);
-    const sign = async (data) => {
-        const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, (0, utils_ts_1.toArrayBuffer)(data));
-        return new Uint8Array(sig);
-    };
-    const signDomainHash = async (prefix, value) => {
-        const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`${prefix}:${value}`));
-        const sigBytes = await sign(digest);
-        return (0, utils_ts_1.base64urlEncode)(sigBytes);
-    };
-    const signOauthInit = async (redirectTo, context) => {
-        const canonicalContext = (0, utils_ts_1.canonicalizeJsonValue)(context ?? null);
-        return await signDomainHash("oauth-init", `${redirectTo}:${canonicalContext}`);
-    };
-    return {
-        sessionKey,
-        sign,
-        oauthInitSig: signOauthInit,
-        bindSig: (authToken) => signDomainHash("bind", authToken),
-        natsConnectSigForBindingToken: (bindingToken) => signDomainHash("nats-connect", bindingToken),
-        natsConnectSigForIat: (iat) => signDomainHash("nats-connect", String(iat)),
-        createProof: (subject, payloadHash) => (0, proof_ts_1.createProof)(privateKey, { sessionKey, subject, payloadHash }),
-        createNatsAuthTokenForService: async (iat) => {
-            const sig = await signDomainHash("nats-connect", String(iat));
-            return { v: 1, sessionKey, iat, sig };
-        },
-        natsConnectOptions: async () => {
-            const iat = Math.floor(Date.now() / 1000);
-            const sig = await signDomainHash("nats-connect", String(iat));
-            const authToken = { v: 1, sessionKey, iat, sig };
-            return {
-                token: JSON.stringify(authToken),
-                inboxPrefix: `_INBOX.${sessionKey.slice(0, 16)}`,
-            };
-        },
-    };
-}

package/script/auth/trellis_id.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trellis_id.d.ts","sourceRoot":"","sources":["../../../../auth/trellis_id.ts"],"names":[],"mappings":"AAEA,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvF"}

package/script/auth/trellis_id.js

@@ -1,8 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.trellisIdFromOriginId = trellisIdFromOriginId;
-const utils_ts_1 = require("./utils.ts");
-async function trellisIdFromOriginId(origin, id) {
-    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`${origin}:${id}`));
-    return (0, utils_ts_1.base64urlEncode)(digest).slice(0, 22);
-}

package/script/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC"}

package/script/auth/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../auth/utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAWzD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAQ3D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AAmBD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D"}

package/script/contracts/canonical.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../contracts/canonical.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/B,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAiB9D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAoBzD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKnD;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CA+ExD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAID"}