@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/esm/client_connect.js

@@ -0,0 +1,338 @@
+import * as dntShim from "./_dnt.shims.js";
+import { jwtAuthenticator } from "@nats-io/nats-core";
+import { getOrCreateSessionKey, getPublicSessionKey, startAuthRequest, } from "./auth/browser.js";
+import { BindResponseSchema, sha256, toArrayBuffer, utf8 } from "./auth/browser.js";
+import { canonicalizeJsonValue } from "./auth/utils.js";
+import { importEd25519PrivateKeyFromSeedBase64url, publicKeyBase64urlFromPrivateKey, } from "./auth/keys.js";
+import { loadDefaultRuntimeTransport, selectRuntimeTransportServers, } from "./runtime_transport.js";
+import { Trellis } from "./trellis.js";
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+import { bindFlowSig, oauthInitSig, signBytes, } from "./auth/browser/session.js";
+const ClientTransportEndpointsSchema = Type.Object({
+    natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+});
+const ClientTransportsSchema = Type.Object({
+    native: Type.Optional(ClientTransportEndpointsSchema),
+    websocket: Type.Optional(ClientTransportEndpointsSchema),
+});
+const ClientBootstrapReadySchema = Type.Object({
+    status: Type.Literal("ready"),
+    connectInfo: Type.Object({
+        sessionKey: Type.String({ minLength: 1 }),
+        contractId: Type.String({ minLength: 1 }),
+        contractDigest: Type.String({ minLength: 1 }),
+        transports: ClientTransportsSchema,
+        transport: Type.Object({
+            inboxPrefix: Type.String({ minLength: 1 }),
+            sentinel: Type.Object({
+                jwt: Type.String({ minLength: 1 }),
+                seed: Type.String({ minLength: 1 }),
+            }),
+        }),
+        auth: Type.Object({
+            mode: Type.Literal("binding_token"),
+            bindingToken: Type.String({ minLength: 1 }),
+            expiresAt: Type.String({ format: "date-time" }),
+        }),
+    }),
+}, { additionalProperties: true });
+const ClientBootstrapAuthRequiredSchema = Type.Object({
+    status: Type.Literal("auth_required"),
+}, { additionalProperties: true });
+const ClientBootstrapNotReadySchema = Type.Object({
+    status: Type.Literal("not_ready"),
+    reason: Type.String({ minLength: 1 }),
+}, { additionalProperties: true });
+function isBrowserRuntime() {
+    return typeof dntShim.dntGlobalThis !== "undefined" && typeof document !== "undefined";
+}
+const defaultDeps = {
+    loadTransport: loadDefaultRuntimeTransport,
+    now: () => Date.now(),
+};
+function normalizeTrellisUrl(trellisUrl) {
+    return new URL(trellisUrl).toString().replace(/\/$/, "");
+}
+function resolveCurrentUrl(auth) {
+    if (auth?.currentUrl instanceof URL)
+        return auth.currentUrl;
+    if (typeof auth?.currentUrl === "string")
+        return new URL(auth.currentUrl);
+    if (isBrowserRuntime())
+        return new URL(globalThis.location.href);
+    return null;
+}
+function resolveRedirectTo(auth, currentUrl) {
+    if (auth.redirectTo) {
+        return new URL(auth.redirectTo, currentUrl.origin).toString();
+    }
+    const queryRedirect = currentUrl.searchParams.get("redirectTo");
+    if (queryRedirect) {
+        return new URL(queryRedirect, currentUrl.origin).toString();
+    }
+    if (auth.landingPath) {
+        return new URL(auth.landingPath, currentUrl.origin).toString();
+    }
+    return currentUrl.toString();
+}
+async function signDomainValue(sign, prefix, value) {
+    const digest = await sha256(utf8(`${prefix}:${value}`));
+    const signature = await sign(digest);
+    const binary = String.fromCharCode(...signature);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function createSessionKeyRuntimeIdentity(sessionKeySeed) {
+    const privateKey = await importEd25519PrivateKeyFromSeedBase64url(sessionKeySeed);
+    const sessionKey = await publicKeyBase64urlFromPrivateKey(privateKey);
+    const sign = async (data) => {
+        const signature = await crypto.subtle.sign("Ed25519", privateKey, toArrayBuffer(data));
+        return new Uint8Array(signature);
+    };
+    return {
+        mode: "session_key",
+        sessionKey,
+        sign,
+        oauthInitSig: (redirectTo, context) => signDomainValue(sign, "oauth-init", `${redirectTo}:${canonicalizeJsonValue(context ?? null)}`),
+        bindingTokenSig: (bindingToken) => signDomainValue(sign, "nats-connect", bindingToken),
+        bootstrapSig: (iat) => signDomainValue(sign, "bootstrap-client", String(iat)),
+        bindFlowSig: (flowId) => signDomainValue(sign, "bind-flow", flowId),
+    };
+}
+async function resolveClientIdentity(auth) {
+    if (auth?.mode === "session_key") {
+        return await createSessionKeyRuntimeIdentity(auth.sessionKeySeed);
+    }
+    const handle = auth?.handle ?? await getOrCreateSessionKey();
+    return {
+        mode: "browser",
+        sessionKey: getPublicSessionKey(handle),
+        sign: (data) => signBytes(handle, data),
+        oauthInitSig: (redirectTo, context) => oauthInitSig(handle, redirectTo, context),
+        bindingTokenSig: (bindingToken) => signDomainValue((data) => signBytes(handle, data), "nats-connect", bindingToken),
+        bootstrapSig: (iat) => signDomainValue((data) => signBytes(handle, data), "bootstrap-client", String(iat)),
+        bindFlowSig: (flowId) => bindFlowSig(handle, flowId),
+    };
+}
+async function bindClientFlow(args) {
+    const response = await fetch(`${args.trellisUrl}/auth/flow/${encodeURIComponent(args.flowId)}/bind`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionKey: args.sessionKey, sig: args.sig }),
+    });
+    if (!response.ok) {
+        throw new Error(`Client bind failed: ${response.status} ${await response.text()}`);
+    }
+    const payload = await response.json();
+    const parsed = Value.Parse(BindResponseSchema, payload);
+    if (parsed.status !== "bound") {
+        throw new Error(`Client bind did not complete: ${parsed.status}`);
+    }
+}
+async function fetchClientBootstrap(args) {
+    const response = await fetch(new URL("/bootstrap/client", args.trellisUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            sessionKey: args.sessionKey,
+            iat: args.iat,
+            sig: args.bootstrapSig,
+        }),
+    });
+    const payload = await response.json();
+    if (!response.ok) {
+        const reason = typeof payload?.reason === "string"
+            ? payload.reason
+            : `http_${response.status}`;
+        throw new Error(`Client bootstrap failed: ${reason}`);
+    }
+    if (Value.Check(ClientBootstrapReadySchema, payload)) {
+        return payload;
+    }
+    if (Value.Check(ClientBootstrapAuthRequiredSchema, payload)) {
+        return payload;
+    }
+    if (Value.Check(ClientBootstrapNotReadySchema, payload)) {
+        return payload;
+    }
+    throw new Error("Client bootstrap returned an invalid response");
+}
+function cleanupBrowserCallbackUrl(currentUrl) {
+    if (!isBrowserRuntime())
+        return;
+    if (!currentUrl.searchParams.has("flowId") && !currentUrl.searchParams.has("authError")) {
+        return;
+    }
+    currentUrl.searchParams.delete("flowId");
+    currentUrl.searchParams.delete("authError");
+    globalThis.history.replaceState({}, "", currentUrl.pathname + currentUrl.search);
+}
+function needsReauth(bootstrap) {
+    return bootstrap.status === "auth_required" ||
+        (bootstrap.status === "not_ready" && bootstrap.reason === "insufficient_permissions");
+}
+async function buildSessionKeyLoginUrl(args) {
+    const response = await fetch(`${args.trellisUrl}/auth/requests`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            redirectTo: args.redirectTo,
+            sessionKey: args.sessionKey,
+            sig: args.oauthInitSig,
+            contract: args.contract,
+            ...(args.provider ? { provider: args.provider } : {}),
+            ...(args.context && typeof args.context === "object" && !Array.isArray(args.context)
+                ? { context: args.context }
+                : {}),
+        }),
+    });
+    if (!response.ok) {
+        const reason = await response.text();
+        throw new Error(`Login flow creation failed: ${response.status} ${reason}`);
+    }
+    const payload = await response.json();
+    if (payload && typeof payload === "object" &&
+        payload.status === "flow_started" &&
+        typeof payload.loginUrl === "string") {
+        return { status: "flow_started", loginUrl: payload.loginUrl };
+    }
+    if (payload && typeof payload === "object" && payload.status === "bound") {
+        return { status: "bound" };
+    }
+    throw new Error("Login flow creation returned an invalid response");
+}
+export async function connectClientWithDeps(args, deps) {
+    const trellisUrl = normalizeTrellisUrl(args.trellisUrl);
+    const identity = await resolveClientIdentity(args.auth);
+    const currentUrl = args.auth?.mode === "session_key" ? null : resolveCurrentUrl(args.auth);
+    const callbackFlowId = args.auth?.mode === "session_key"
+        ? args.auth.flowId
+        : currentUrl?.searchParams.get("flowId") ?? undefined;
+    if (callbackFlowId) {
+        await bindClientFlow({
+            trellisUrl,
+            sessionKey: identity.sessionKey,
+            flowId: callbackFlowId,
+            sig: await identity.bindFlowSig(callbackFlowId),
+        });
+        if (currentUrl)
+            cleanupBrowserCallbackUrl(currentUrl);
+    }
+    const bootstrapIat = Math.floor(deps.now() / 1_000);
+    const initialBootstrap = await fetchClientBootstrap({
+        trellisUrl,
+        sessionKey: identity.sessionKey,
+        iat: bootstrapIat,
+        bootstrapSig: await identity.bootstrapSig(bootstrapIat),
+    });
+    const bootstrap = needsReauth(initialBootstrap)
+        ? await resolveAuthRequired(args, identity, currentUrl, deps)
+        : initialBootstrap;
+    if (bootstrap.status !== "ready") {
+        if (bootstrap.status === "not_ready") {
+            throw new Error(`Client bootstrap is not ready: ${bootstrap.reason}`);
+        }
+        throw new Error("Client bootstrap still requires authentication");
+    }
+    const transport = await deps.loadTransport();
+    const token = JSON.stringify({
+        v: 1,
+        sessionKey: identity.sessionKey,
+        bindingToken: bootstrap.connectInfo.auth.bindingToken,
+        sig: await identity.bindingTokenSig(bootstrap.connectInfo.auth.bindingToken),
+    });
+    const nc = await transport.connect({
+        servers: selectRuntimeTransportServers(bootstrap.connectInfo.transports),
+        token,
+        inboxPrefix: bootstrap.connectInfo.transport.inboxPrefix,
+        authenticator: jwtAuthenticator(bootstrap.connectInfo.transport.sentinel.jwt, new TextEncoder().encode(bootstrap.connectInfo.transport.sentinel.seed)),
+    });
+    const clientOpts = {
+        ...(typeof args.name === "string" ? { name: args.name } : {}),
+        ...(args.log ? { log: args.log } : {}),
+        ...(typeof args.timeout === "number" ? { timeout: args.timeout } : {}),
+        ...(typeof args.stream === "string" ? { stream: args.stream } : {}),
+        ...(args.noResponderRetry ? { noResponderRetry: args.noResponderRetry } : {}),
+    };
+    return new Trellis(clientOpts.name ?? "client", nc, {
+        sessionKey: identity.sessionKey,
+        sign: identity.sign,
+    }, {
+        log: clientOpts.log,
+        timeout: clientOpts.timeout,
+        stream: clientOpts.stream,
+        noResponderRetry: clientOpts.noResponderRetry,
+        api: args.contract.API.trellis,
+    });
+}
+async function resolveAuthRequired(args, identity, currentUrl, deps) {
+    const browserAuth = args.auth?.mode === "session_key"
+        ? {}
+        : args.auth ?? {};
+    const redirectTo = args.auth?.mode === "session_key"
+        ? args.auth.redirectTo
+        : currentUrl
+            ? resolveRedirectTo(browserAuth, currentUrl)
+            : undefined;
+    if (!redirectTo) {
+        throw new Error("Client authentication requires a redirectTo URL");
+    }
+    const authStart = args.auth?.mode === "session_key"
+        ? await buildSessionKeyLoginUrl({
+            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
+            redirectTo,
+            sessionKey: identity.sessionKey,
+            contract: args.contract.CONTRACT,
+            provider: args.auth.provider,
+            context: args.auth.context,
+            oauthInitSig: await identity.oauthInitSig(redirectTo, args.auth.context),
+        })
+        : await startAuthRequest({
+            authUrl: normalizeTrellisUrl(args.trellisUrl),
+            redirectTo,
+            handle: browserAuth.handle ?? await getOrCreateSessionKey(),
+            provider: browserAuth.provider,
+            contract: args.contract.CONTRACT,
+            context: browserAuth.context,
+        });
+    if (authStart.status === "bound") {
+        const bootstrapIat = Math.floor(deps.now() / 1_000);
+        return await fetchClientBootstrap({
+            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
+            sessionKey: identity.sessionKey,
+            iat: bootstrapIat,
+            bootstrapSig: await identity.bootstrapSig(bootstrapIat),
+        });
+    }
+    const loginUrl = authStart.loginUrl;
+    const continuation = await args.onAuthRequired?.({
+        loginUrl,
+        sessionKey: identity.sessionKey,
+        mode: identity.mode,
+    });
+    if (continuation && typeof continuation === "object" && "flowId" in continuation) {
+        await bindClientFlow({
+            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
+            sessionKey: identity.sessionKey,
+            flowId: continuation.flowId,
+            sig: await identity.bindFlowSig(continuation.flowId),
+        });
+        const bootstrapIat = Math.floor(deps.now() / 1_000);
+        return await fetchClientBootstrap({
+            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
+            sessionKey: identity.sessionKey,
+            iat: bootstrapIat,
+            bootstrapSig: await identity.bootstrapSig(bootstrapIat),
+        });
+    }
+    if (isBrowserRuntime()) {
+        globalThis.location.href = loginUrl;
+        throw new Error("Redirecting to Trellis login");
+    }
+    throw new Error("Client authentication required and no auth continuation was provided");
+}
+export class TrellisClient {
+    static connect(args) {
+        return connectClientWithDeps(args, defaultDeps);
+    }
+}

package/esm/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../src/codec.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,UAAU,EAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAErE,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IACA,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B,CAAC;AAUJ,wBAAgB,KAAK,CAAC,CAAC,SAAS,OAAO,EACrC,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,eAAe,GAAG,eAAe,CAAC,CAU5D;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAC9C,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,GAAG,eAAe,CAAC,CAW/D;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAAC,CAWpD;AAED,wBAAgB,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC,CAUnD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC,CAWnD"}

package/esm/contract.d.ts

@@ -0,0 +1,20 @@
+import { type ContractApiViews, type ContractDependencyUse, type ContractModule, type ContractUseFn, type DefineContractInput, type DefinedContract as BaseDefinedContract, type EmptyApi, type SdkContractModule, type TrellisApiLike, type TrellisContractV1, type UseSpec } from "./contract_support/mod.js";
+export type DefinedContract<TOwnedApi extends {
+    rpc: Record<string, unknown>;
+    operations: Record<string, unknown>;
+    events: Record<string, unknown>;
+    subjects: Record<string, unknown>;
+}, TUsedApi extends {
+    rpc: Record<string, unknown>;
+    operations: Record<string, unknown>;
+    events: Record<string, unknown>;
+    subjects: Record<string, unknown>;
+}, TTrellisApi extends {
+    rpc: Record<string, unknown>;
+    operations: Record<string, unknown>;
+    events: Record<string, unknown>;
+    subjects: Record<string, unknown>;
+}, TContractId extends string = string> = BaseDefinedContract<TOwnedApi, TUsedApi, TTrellisApi, TContractId>;
+export { defineAppContract, defineCliContract, defineDeviceContract, definePortalContract, defineServiceContract, } from "./contract_support/mod.js";
+export type { ContractApiViews, ContractDependencyUse, ContractModule, ContractUseFn, DefineContractInput, EmptyApi, SdkContractModule, TrellisApiLike, TrellisContractV1, UseSpec, };
+//# sourceMappingURL=contract.d.ts.map

package/esm/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AASnC,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,QAAQ,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS,MAAM,GAAG,MAAM,IACjC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAEvE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,OAAO,GACR,CAAC"}

package/esm/contract.js

@@ -0,0 +1 @@
+export { defineAppContract, defineCliContract, defineDeviceContract, definePortalContract, defineServiceContract, } from "./contract_support/mod.js";

package/esm/contract_support/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/contract_support/canonical.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/B,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAiB9D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAoBzD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKnD;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CA+ExD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAID"}