@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/script/js/packages/trellis/npm/src/auth/browser/login.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLoginUrl = buildLoginUrl;
+exports.startAuthRequest = startAuthRequest;
+exports.isBindSuccessResponse = isBindSuccessResponse;
+exports.bindFlow = bindFlow;
+exports.bindSession = bindSession;
+const value_1 = require("typebox/value");
+const schemas_js_1 = require("../schemas.js");
+const session_js_1 = require("./session.js");
+function contextRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+async function buildLoginUrl(argsOrConfig, provider, redirectTo, handle, contract, context) {
+    const resolved = isNestedBuildLoginUrlArgs(argsOrConfig)
+        ? argsOrConfig
+        : isFlatBuildLoginUrlArgs(argsOrConfig)
+            ? {
+                config: { authUrl: argsOrConfig.authUrl },
+                provider: argsOrConfig.provider,
+                redirectTo: argsOrConfig.redirectTo,
+                handle: argsOrConfig.handle,
+                contract: argsOrConfig.contract,
+                context: argsOrConfig.context,
+            }
+            : buildLoginUrlArgsFromPositional(argsOrConfig, provider, redirectTo, handle, contract, context);
+    const response = await startAuthRequest({
+        authUrl: resolved.config.authUrl,
+        provider: resolved.provider,
+        redirectTo: resolved.redirectTo,
+        handle: resolved.handle,
+        contract: resolved.contract,
+        context: resolved.context,
+    });
+    if (response.status !== "flow_started") {
+        throw new Error("Auth request completed without starting a browser flow");
+    }
+    return response.loginUrl;
+}
+async function startAuthRequest(args) {
+    const sig = await (0, session_js_1.oauthInitSig)(args.handle, args.redirectTo, args.context);
+    const request = value_1.Value.Parse(schemas_js_1.AuthStartRequestSchema, {
+        redirectTo: args.redirectTo,
+        sessionKey: (0, session_js_1.getPublicSessionKey)(args.handle),
+        sig,
+        contract: args.contract,
+        ...(args.provider ? { provider: args.provider } : {}),
+        ...(contextRecord(args.context) ? { context: contextRecord(args.context) } : {}),
+    });
+    const response = await fetch(`${args.authUrl}/auth/requests`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(request),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Auth request failed: ${response.status} ${text}`);
+    }
+    return value_1.Value.Parse(schemas_js_1.AuthStartResponseSchema, await response.json());
+}
+function buildLoginUrlArgsFromPositional(config, provider, redirectTo, handle, contract, context) {
+    if (redirectTo === undefined || handle === undefined || contract === undefined) {
+        throw new TypeError("buildLoginUrl requires redirectTo, handle, and contract");
+    }
+    return {
+        config,
+        provider,
+        redirectTo,
+        handle,
+        contract,
+        context,
+    };
+}
+function isNestedBuildLoginUrlArgs(value) {
+    return "config" in value;
+}
+function isFlatBuildLoginUrlArgs(value) {
+    return "authUrl" in value && "redirectTo" in value && "handle" in value && "contract" in value;
+}
+function isBindSuccessResponse(response) {
+    return response.status === "bound";
+}
+async function bindFlow(config, handle, flowId) {
+    const sessionKey = (0, session_js_1.getPublicSessionKey)(handle);
+    const sig = await (0, session_js_1.bindFlowSig)(handle, flowId);
+    const response = await fetch(`${config.authUrl}/auth/flow/${encodeURIComponent(flowId)}/bind`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionKey, sig }),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Bind failed: ${response.status} ${text}`);
+    }
+    return value_1.Value.Parse(schemas_js_1.BindResponseSchema, await response.json());
+}
+async function bindSession(config, handle, authToken) {
+    const sessionKey = (0, session_js_1.getPublicSessionKey)(handle);
+    const sig = await (0, session_js_1.bindSig)(handle, authToken);
+    const response = await fetch(`${config.authUrl}/auth/bind`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            authToken,
+            sessionKey,
+            sig,
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Bind failed: ${response.status} ${text}`);
+    }
+    return value_1.Value.Parse(schemas_js_1.BindResponseSchema, await response.json());
+}

package/script/js/packages/trellis/npm/src/auth/browser/portal.d.ts

@@ -0,0 +1,11 @@
+import { type PortalFlowState } from "../protocol.js";
+import type { ApprovalDecision } from "../schemas.js";
+import type { AuthConfig } from "./login.js";
+export type { PortalFlowState } from "../protocol.js";
+export type { ApprovalDecision } from "../schemas.js";
+export declare function portalFlowIdFromUrl(url: URL): string | null;
+export declare function fetchPortalFlowState(config: AuthConfig, flowId: string): Promise<PortalFlowState>;
+export declare function portalProviderLoginUrl(config: AuthConfig, providerId: string, flowId: string): string;
+export declare function submitPortalApproval(config: AuthConfig, flowId: string, decision: ApprovalDecision): Promise<PortalFlowState>;
+export declare function portalRedirectLocation(state: PortalFlowState | null): string | null;
+//# sourceMappingURL=portal.d.ts.map

package/script/js/packages/trellis/npm/src/auth/browser/portal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/browser/portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAGR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAe1B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEnF"}

package/script/js/packages/trellis/npm/src/auth/browser/portal.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.portalFlowIdFromUrl = portalFlowIdFromUrl;
+exports.fetchPortalFlowState = fetchPortalFlowState;
+exports.portalProviderLoginUrl = portalProviderLoginUrl;
+exports.submitPortalApproval = submitPortalApproval;
+exports.portalRedirectLocation = portalRedirectLocation;
+const protocol_js_1 = require("../protocol.js");
+const value_1 = require("typebox/value");
+function authBaseUrl(config) {
+    return config.authUrl.replace(/\/$/, "");
+}
+function portalFlowIdFromUrl(url) {
+    return url.searchParams.get("flowId");
+}
+async function fetchPortalFlowState(config, flowId) {
+    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}`);
+    if (!response.ok) {
+        throw new Error(`Failed to load portal flow (${response.status})`);
+    }
+    return value_1.Value.Parse(protocol_js_1.PortalFlowStateSchema, await response.json());
+}
+function portalProviderLoginUrl(config, providerId, flowId) {
+    const base = `${authBaseUrl(config)}/auth/login/${encodeURIComponent(providerId)}`;
+    return `${base}?flowId=${encodeURIComponent(flowId)}`;
+}
+async function submitPortalApproval(config, flowId, decision) {
+    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}/approval`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ decision }),
+    });
+    if (!response.ok) {
+        throw new Error(`Approval request failed (${response.status})`);
+    }
+    return value_1.Value.Parse(protocol_js_1.PortalFlowStateSchema, await response.json());
+}
+function portalRedirectLocation(state) {
+    return state?.status === "redirect" ? state.location : null;
+}

package/script/js/packages/trellis/npm/src/auth/browser/session.d.ts

@@ -0,0 +1,19 @@
+export type SessionKeyHandle = {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicKeyRaw: Uint8Array;
+    sessionKey: string;
+};
+export declare function generateSessionKey(): Promise<SessionKeyHandle>;
+export declare function loadSessionKey(): Promise<SessionKeyHandle | null>;
+export declare function getOrCreateSessionKey(): Promise<SessionKeyHandle>;
+export declare function signBytes(handle: SessionKeyHandle, data: Uint8Array): Promise<Uint8Array>;
+export declare function getPublicSessionKey(handle: SessionKeyHandle): string;
+export declare function oauthInitSig(handle: SessionKeyHandle, redirectTo: string, context?: unknown): Promise<string>;
+export declare function bindSig(handle: SessionKeyHandle, authToken: string): Promise<string>;
+export declare function bindFlowSig(handle: SessionKeyHandle, flowId: string): Promise<string>;
+export declare function natsConnectSigForBindingToken(handle: SessionKeyHandle, bindingToken: string): Promise<string>;
+export declare function createRpcProof(handle: SessionKeyHandle, subject: string, payload: Uint8Array): Promise<string>;
+export declare function clearSessionKey(): Promise<void>;
+export declare function hasSessionKey(): Promise<boolean>;
+//# sourceMappingURL=session.d.ts.map

package/script/js/packages/trellis/npm/src/auth/browser/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/browser/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAapE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CASvE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAIvE;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAO/F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1F;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI3F;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD"}

package/script/js/packages/trellis/npm/src/auth/browser/session.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSessionKey = generateSessionKey;
+exports.loadSessionKey = loadSessionKey;
+exports.getOrCreateSessionKey = getOrCreateSessionKey;
+exports.signBytes = signBytes;
+exports.getPublicSessionKey = getPublicSessionKey;
+exports.oauthInitSig = oauthInitSig;
+exports.bindSig = bindSig;
+exports.bindFlowSig = bindFlowSig;
+exports.natsConnectSigForBindingToken = natsConnectSigForBindingToken;
+exports.createRpcProof = createRpcProof;
+exports.clearSessionKey = clearSessionKey;
+exports.hasSessionKey = hasSessionKey;
+const utils_js_1 = require("../utils.js");
+const proof_js_1 = require("../proof.js");
+const storage_js_1 = require("./storage.js");
+async function generateSessionKey() {
+    const keyPair = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);
+    const publicKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", keyPair.publicKey));
+    const sessionKey = (0, utils_js_1.base64urlEncode)(publicKeyRaw);
+    await (0, storage_js_1.storeKeyPair)(keyPair, publicKeyRaw);
+    return { privateKey: keyPair.privateKey, publicKey: keyPair.publicKey, publicKeyRaw, sessionKey };
+}
+async function loadSessionKey() {
+    const stored = await (0, storage_js_1.loadKeyPair)();
+    if (!stored)
+        return null;
+    return {
+        privateKey: stored.privateKey,
+        publicKey: stored.publicKey,
+        publicKeyRaw: stored.publicKeyRaw,
+        sessionKey: (0, utils_js_1.base64urlEncode)(stored.publicKeyRaw),
+    };
+}
+async function getOrCreateSessionKey() {
+    const existing = await loadSessionKey();
+    if (existing)
+        return existing;
+    return await generateSessionKey();
+}
+async function signBytes(handle, data) {
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, handle.privateKey, (0, utils_js_1.toArrayBuffer)(data));
+    return new Uint8Array(sig);
+}
+function getPublicSessionKey(handle) {
+    return handle.sessionKey;
+}
+async function oauthInitSig(handle, redirectTo, context) {
+    const canonicalContext = (0, utils_js_1.canonicalizeJsonValue)(context ?? null);
+    const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`oauth-init:${redirectTo}:${canonicalContext}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_js_1.base64urlEncode)(sig);
+}
+async function bindSig(handle, authToken) {
+    const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`bind:${authToken}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_js_1.base64urlEncode)(sig);
+}
+async function bindFlowSig(handle, flowId) {
+    const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`bind-flow:${flowId}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_js_1.base64urlEncode)(sig);
+}
+async function natsConnectSigForBindingToken(handle, bindingToken) {
+    const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`nats-connect:${bindingToken}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_js_1.base64urlEncode)(sig);
+}
+async function createRpcProof(handle, subject, payload) {
+    const payloadHash = await (0, utils_js_1.sha256)(payload);
+    return await (0, proof_js_1.createProof)(handle.privateKey, { sessionKey: handle.sessionKey, subject, payloadHash });
+}
+async function clearSessionKey() {
+    await (0, storage_js_1.deleteKeyPair)();
+}
+async function hasSessionKey() {
+    return await (0, storage_js_1.hasKeyPair)();
+}

package/script/js/packages/trellis/npm/src/auth/browser/storage.d.ts

@@ -0,0 +1,12 @@
+export type StoredKeyPair = {
+    id: string;
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicKeyRaw: Uint8Array;
+    createdAt: number;
+};
+export declare function storeKeyPair(keyPair: CryptoKeyPair, publicKeyRaw: Uint8Array): Promise<void>;
+export declare function loadKeyPair(): Promise<StoredKeyPair | null>;
+export declare function deleteKeyPair(): Promise<void>;
+export declare function hasKeyPair(): Promise<boolean>;
+//# sourceMappingURL=storage.d.ts.map

package/script/js/packages/trellis/npm/src/auth/browser/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/browser/storage.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlG;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAYjE;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAYnD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAGnD"}

package/script/js/packages/trellis/npm/src/auth/browser/storage.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.storeKeyPair = storeKeyPair;
+exports.loadKeyPair = loadKeyPair;
+exports.deleteKeyPair = deleteKeyPair;
+exports.hasKeyPair = hasKeyPair;
+const DB_NAME = "trellis-auth";
+const DB_VERSION = 1;
+const STORE_NAME = "keys";
+const KEY_ID = "trellis-session-key";
+function openDB() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(DB_NAME, DB_VERSION);
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => resolve(request.result);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            if (!db.objectStoreNames.contains(STORE_NAME)) {
+                db.createObjectStore(STORE_NAME, { keyPath: "id" });
+            }
+        };
+    });
+}
+async function storeKeyPair(keyPair, publicKeyRaw) {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readwrite");
+        const store = tx.objectStore(STORE_NAME);
+        const record = {
+            id: KEY_ID,
+            privateKey: keyPair.privateKey,
+            publicKey: keyPair.publicKey,
+            publicKeyRaw,
+            createdAt: Date.now(),
+        };
+        const request = store.put(record);
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => resolve();
+        tx.oncomplete = () => db.close();
+    });
+}
+async function loadKeyPair() {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readonly");
+        const store = tx.objectStore(STORE_NAME);
+        const request = store.get(KEY_ID);
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => resolve(request.result ?? null);
+        tx.oncomplete = () => db.close();
+    });
+}
+async function deleteKeyPair() {
+    const db = await openDB();
+    return new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE_NAME, "readwrite");
+        const store = tx.objectStore(STORE_NAME);
+        const request = store.delete(KEY_ID);
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => resolve();
+        tx.oncomplete = () => db.close();
+    });
+}
+async function hasKeyPair() {
+    const keyPair = await loadKeyPair();
+    return keyPair !== null;
+}

package/script/js/packages/trellis/npm/src/auth/browser.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+import "../_dnt.polyfills.js";
+export { type AuthStartFlowResponse, type AuthStartRequest, type AuthStartResponse, type AuthConfig, startAuthRequest, bindFlow, type BindResponse, bindSession, type BindSuccessResponse, buildLoginUrl, isBindSuccessResponse, type SentinelCreds, } from "./browser/login.js";
+export { type ApprovalDecision, fetchPortalFlowState, portalFlowIdFromUrl, type PortalFlowState, type PortalFlowState as BrowserPortalFlowState, portalProviderLoginUrl, portalRedirectLocation, submitPortalApproval, } from "./browser/portal.js";
+export { bindFlowSig, clearSessionKey, createRpcProof, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, loadSessionKey, natsConnectSigForBindingToken, type SessionKeyHandle, signBytes, } from "./browser/session.js";
+export { deleteKeyPair, hasKeyPair } from "./browser/storage.js";
+export { type ApprovalDecision as ApprovalDecisionData, type AuthStartFlowResponse as AuthStartFlowResponseData, AuthStartFlowResponseSchema, type AuthStartRequest as AuthStartRequestData, AuthStartRequestSchema, type AuthStartResponse as AuthStartResponseData, AuthStartResponseSchema, ApprovalDecisionSchema, type BindResponse as BindResponseData, BindResponseSchema, type BindSuccessResponse as BindSuccessResponseData, BindSuccessResponseSchema, type ClientTransportEndpoints as ClientTransportEndpointsData, ClientTransportEndpointsSchema, type ClientTransports as ClientTransportsData, ClientTransportsSchema, type ContractApproval as ContractApprovalData, ContractApprovalSchema, type NatsAuthTokenV1 as NatsAuthTokenV1Data, NatsAuthTokenV1Schema, type SentinelCreds as SentinelCredsData, SentinelCredsSchema, } from "./schemas.js";
+export type { NatsAuthTokenV1 } from "./types.js";
+export { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+//# sourceMappingURL=browser.d.ts.map

package/script/js/packages/trellis/npm/src/auth/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../../../../../src/auth/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,sBAAsB,CAAC;AAG9B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,QAAQ,EACR,KAAK,YAAY,EACjB,WAAW,EACX,KAAK,mBAAmB,EACxB,aAAa,EACb,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,IAAI,sBAAsB,EAC9C,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,2BAA2B,EAC3B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,iBAAiB,IAAI,qBAAqB,EAC/C,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,YAAY,IAAI,gBAAgB,EACrC,kBAAkB,EAClB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,yBAAyB,EACzB,KAAK,wBAAwB,IAAI,4BAA4B,EAC7D,8BAA8B,EAC9B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,KAAK,aAAa,IAAI,iBAAiB,EACvC,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/script/js/packages/trellis/npm/src/auth/browser.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.ApprovalDecisionSchema = exports.AuthStartResponseSchema = exports.AuthStartRequestSchema = exports.AuthStartFlowResponseSchema = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForBindingToken = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindSession = exports.bindFlow = exports.startAuthRequest = void 0;
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+require("../_dnt.polyfills.js");
+var login_js_1 = require("./browser/login.js");
+Object.defineProperty(exports, "startAuthRequest", { enumerable: true, get: function () { return login_js_1.startAuthRequest; } });
+Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return login_js_1.bindFlow; } });
+Object.defineProperty(exports, "bindSession", { enumerable: true, get: function () { return login_js_1.bindSession; } });
+Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_js_1.buildLoginUrl; } });
+Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_js_1.isBindSuccessResponse; } });
+var portal_js_1 = require("./browser/portal.js");
+Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_js_1.fetchPortalFlowState; } });
+Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_js_1.portalFlowIdFromUrl; } });
+Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return portal_js_1.portalProviderLoginUrl; } });
+Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return portal_js_1.portalRedirectLocation; } });
+Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return portal_js_1.submitPortalApproval; } });
+var session_js_1 = require("./browser/session.js");
+Object.defineProperty(exports, "bindFlowSig", { enumerable: true, get: function () { return session_js_1.bindFlowSig; } });
+Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return session_js_1.clearSessionKey; } });
+Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return session_js_1.createRpcProof; } });
+Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return session_js_1.generateSessionKey; } });
+Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return session_js_1.getOrCreateSessionKey; } });
+Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_js_1.getPublicSessionKey; } });
+Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_js_1.hasSessionKey; } });
+Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_js_1.loadSessionKey; } });
+Object.defineProperty(exports, "natsConnectSigForBindingToken", { enumerable: true, get: function () { return session_js_1.natsConnectSigForBindingToken; } });
+Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_js_1.signBytes; } });
+var storage_js_1 = require("./browser/storage.js");
+Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_js_1.deleteKeyPair; } });
+Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_js_1.hasKeyPair; } });
+var schemas_js_1 = require("./schemas.js");
+Object.defineProperty(exports, "AuthStartFlowResponseSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartFlowResponseSchema; } });
+Object.defineProperty(exports, "AuthStartRequestSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartRequestSchema; } });
+Object.defineProperty(exports, "AuthStartResponseSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartResponseSchema; } });
+Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_js_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_js_1.BindResponseSchema; } });
+Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_js_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "ClientTransportEndpointsSchema", { enumerable: true, get: function () { return schemas_js_1.ClientTransportEndpointsSchema; } });
+Object.defineProperty(exports, "ClientTransportsSchema", { enumerable: true, get: function () { return schemas_js_1.ClientTransportsSchema; } });
+Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_js_1.ContractApprovalSchema; } });
+Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_js_1.NatsAuthTokenV1Schema; } });
+Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_js_1.SentinelCredsSchema; } });
+var utils_js_1 = require("./utils.js");
+Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_js_1.base64urlDecode; } });
+Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_js_1.base64urlEncode; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_js_1.sha256; } });
+Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_js_1.toArrayBuffer; } });
+Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_js_1.utf8; } });

package/script/js/packages/trellis/npm/src/auth/device_activation.d.ts

@@ -0,0 +1,206 @@
+import type { StaticDecode } from "typebox";
+import { Type } from "typebox";
+import type { NatsAuthTokenV1 } from "./schemas.js";
+import { AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthGetDeviceActivationStatusResponseSchema, AuthGetDeviceActivationStatusSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, WaitForDeviceActivationResponseSchema } from "./protocol.js";
+export declare const DeviceActivationPayloadSchema: Type.TObject<{
+    v: Type.TLiteral<1>;
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    qrMac: Type.TString;
+}>;
+export declare const DeviceActivationWaitRequestSchema: Type.TObject<{
+    publicIdentityKey: Type.TString;
+    nonce: Type.TString;
+    contractDigest: Type.TOptional<Type.TString>;
+    iat: Type.TNumber;
+    sig: Type.TString;
+}>;
+export type DeviceActivationPayload = StaticDecode<typeof DeviceActivationPayloadSchema>;
+export type DeviceActivationWaitRequest = StaticDecode<typeof DeviceActivationWaitRequestSchema>;
+export type WaitForDeviceActivationResponse = StaticDecode<typeof WaitForDeviceActivationResponseSchema>;
+export type AuthActivateDeviceInput = StaticDecode<typeof AuthActivateDeviceSchema>;
+export type AuthActivateDeviceOutput = StaticDecode<typeof AuthActivateDeviceResponseSchema>;
+export type AuthGetDeviceActivationStatusInput = StaticDecode<typeof AuthGetDeviceActivationStatusSchema>;
+export type AuthGetDeviceActivationStatusOutput = StaticDecode<typeof AuthGetDeviceActivationStatusResponseSchema>;
+export type AuthListDeviceActivationsInput = StaticDecode<typeof AuthListDeviceActivationsSchema>;
+export type AuthListDeviceActivationsOutput = StaticDecode<typeof AuthListDeviceActivationsResponseSchema>;
+export type AuthRevokeDeviceActivationInput = StaticDecode<typeof AuthRevokeDeviceActivationSchema>;
+export type AuthRevokeDeviceActivationResponse = StaticDecode<typeof AuthRevokeDeviceActivationResponseSchema>;
+export type GetDeviceConnectInfoInput = StaticDecode<typeof AuthGetDeviceConnectInfoSchema>;
+export type GetDeviceConnectInfoOutput = StaticDecode<typeof AuthGetDeviceConnectInfoResponseSchema>;
+export type DeviceIdentity = {
+    identitySeed: Uint8Array;
+    identitySeedBase64url: string;
+    publicIdentityKey: string;
+    activationKey: Uint8Array;
+    activationKeyBase64url: string;
+};
+type DeviceActivationRpcMethod = "Auth.ActivateDevice" | "Auth.GetDeviceActivationStatus" | "Auth.ListDeviceActivations" | "Auth.RevokeDeviceActivation" | "Auth.GetDeviceConnectInfo";
+type DeviceActivationRpcInputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceInput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusInput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsInput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationInput;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoInput;
+};
+type DeviceActivationRpcOutputMap = {
+    "Auth.ActivateDevice": AuthActivateDeviceOutput;
+    "Auth.GetDeviceActivationStatus": AuthGetDeviceActivationStatusOutput;
+    "Auth.ListDeviceActivations": AuthListDeviceActivationsOutput;
+    "Auth.RevokeDeviceActivation": AuthRevokeDeviceActivationResponse;
+    "Auth.GetDeviceConnectInfo": GetDeviceConnectInfoOutput;
+};
+type RequestClient = {
+    requestOrThrow<M extends DeviceActivationRpcMethod>(method: M, input: DeviceActivationRpcInputMap[M], opts?: unknown): Promise<DeviceActivationRpcOutputMap[M]>;
+};
+export type DeviceActivationTransport = RequestClient;
+export declare function deriveDeviceIdentity(deviceRootSecret: Uint8Array): Promise<DeviceIdentity>;
+export declare function deriveDeviceQrMac(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function buildDeviceActivationPayload(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<DeviceActivationPayload>;
+export declare function encodeDeviceActivationPayload(payload: DeviceActivationPayload): string;
+export declare function parseDeviceActivationPayload(value: string): DeviceActivationPayload;
+export declare function startDeviceActivationRequest(args: {
+    trellisUrl: string;
+    payload: DeviceActivationPayload;
+}): Promise<{
+    flowId: string;
+    instanceId: string;
+    profileId: string;
+    activationUrl: string;
+}>;
+export declare function deriveDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+}): Promise<string>;
+export declare function verifyDeviceConfirmationCode(input: {
+    activationKey: Uint8Array | string;
+    publicIdentityKey: string;
+    nonce: string;
+    confirmationCode: string;
+}): Promise<boolean>;
+export declare function buildDeviceWaitProofInput(publicIdentityKey: string, nonce: string, iat: number): Uint8Array;
+export declare function signDeviceWaitRequest(args: {
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest?: string;
+    iat?: number;
+}): Promise<DeviceActivationWaitRequest>;
+export declare function createDeviceNatsAuthToken(args: {
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<NatsAuthTokenV1 & {
+    contractDigest: string;
+}>;
+export declare function waitForDeviceActivation(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    nonce: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+}): Promise<Extract<WaitForDeviceActivationResponse, {
+    status: "activated";
+}>>;
+export declare function getDeviceConnectInfo(args: {
+    trellisUrl: string;
+    publicIdentityKey: string;
+    identitySeed: Uint8Array | string;
+    contractDigest: string;
+    iat?: number;
+}): Promise<GetDeviceConnectInfoOutput>;
+export declare function createDeviceActivationClient(client: DeviceActivationTransport): {
+    activateDevice(input: AuthActivateDeviceInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    getDeviceActivationStatus(input: AuthGetDeviceActivationStatusInput): Promise<{
+        confirmationCode?: string | undefined;
+        status: "activated";
+        profileId: string;
+        instanceId: string;
+        activatedAt: string;
+    } | {
+        status: "pending_review";
+        profileId: string;
+        instanceId: string;
+        reviewId: string;
+        linkRequestId: string;
+        requestedAt: string;
+    } | {
+        reason?: string | undefined;
+        status: "rejected";
+    }>;
+    listDeviceActivations(input?: AuthListDeviceActivationsInput): Promise<{
+        activations: {
+            activatedBy?: {
+                origin: string;
+                id: string;
+            } | undefined;
+            profileId: string;
+            instanceId: string;
+            publicIdentityKey: string;
+            state: "activated" | "revoked";
+            activatedAt: string;
+            revokedAt: string | null;
+        }[];
+    }>;
+    revokeDeviceActivation(input: AuthRevokeDeviceActivationInput): Promise<{
+        success: boolean;
+    }>;
+    getDeviceConnectInfo(input: GetDeviceConnectInfoInput): Promise<{
+        status: "ready";
+        connectInfo: {
+            contractDigest: string;
+            contractId: string;
+            transports: {
+                native?: {
+                    natsServers: string[];
+                } | undefined;
+                websocket?: {
+                    natsServers: string[];
+                } | undefined;
+            };
+            profileId: string;
+            instanceId: string;
+            transport: {
+                sentinel: {
+                    jwt: string;
+                    seed: string;
+                };
+            };
+            auth: {
+                mode: "device_identity";
+                iatSkewSeconds: number;
+            };
+        };
+    }>;
+};
+export declare function verifyDeviceWaitSignature(input: DeviceActivationWaitRequest): Promise<boolean>;
+export {};
+//# sourceMappingURL=device_activation.d.ts.map