@qlever-llc/trellis 0.7.0-rc.5 → 0.7.0

package/esm/trellis/client_connect.js

@@ -1,300 +0,0 @@
-import * as dntShim from "../_dnt.shims.js";
-import { jwtAuthenticator } from "@nats-io/nats-core";
-import { BindResponseSchema, buildLoginUrl, getOrCreateSessionKey, } from "./auth.js";
-import { createAuth } from "./auth.js";
-import { canonicalizeJsonValue, sha256, utf8 } from "./auth.js";
-import { loadDefaultRuntimeTransport, } from "./runtime_transport.js";
-import { Trellis } from "./trellis.js";
-import { Type } from "typebox";
-import { Value } from "typebox/value";
-import { bindFlowSig, getPublicSessionKey, oauthInitSig, signBytes, } from "../auth/browser/session.js";
-const ClientBootstrapReadySchema = Type.Object({
-    status: Type.Literal("ready"),
-    connectInfo: Type.Object({
-        sessionKey: Type.String({ minLength: 1 }),
-        contractId: Type.String({ minLength: 1 }),
-        contractDigest: Type.String({ minLength: 1 }),
-        transport: Type.Object({
-            natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
-            inboxPrefix: Type.String({ minLength: 1 }),
-            sentinel: Type.Object({
-                jwt: Type.String({ minLength: 1 }),
-                seed: Type.String({ minLength: 1 }),
-            }, { additionalProperties: false }),
-        }, { additionalProperties: false }),
-        auth: Type.Object({
-            mode: Type.Literal("binding_token"),
-            bindingToken: Type.String({ minLength: 1 }),
-            expiresAt: Type.String({ format: "date-time" }),
-        }, { additionalProperties: false }),
-    }, { additionalProperties: false }),
-}, { additionalProperties: true });
-const ClientBootstrapAuthRequiredSchema = Type.Object({
-    status: Type.Literal("auth_required"),
-}, { additionalProperties: true });
-const ClientBootstrapNotReadySchema = Type.Object({
-    status: Type.Literal("not_ready"),
-    reason: Type.String({ minLength: 1 }),
-}, { additionalProperties: true });
-function isBrowserRuntime() {
-    return typeof dntShim.dntGlobalThis !== "undefined" && typeof document !== "undefined";
-}
-const defaultDeps = {
-    loadTransport: loadDefaultRuntimeTransport,
-    now: () => Date.now(),
-};
-function normalizeTrellisUrl(trellisUrl) {
-    return new URL(trellisUrl).toString().replace(/\/$/, "");
-}
-function resolveCurrentUrl(auth) {
-    if (auth?.currentUrl instanceof URL)
-        return auth.currentUrl;
-    if (typeof auth?.currentUrl === "string")
-        return new URL(auth.currentUrl);
-    if (isBrowserRuntime())
-        return new URL(globalThis.location.href);
-    return null;
-}
-function resolveRedirectTo(auth, currentUrl) {
-    if (auth.redirectTo) {
-        return new URL(auth.redirectTo, currentUrl.origin).toString();
-    }
-    const queryRedirect = currentUrl.searchParams.get("redirectTo");
-    if (queryRedirect) {
-        return new URL(queryRedirect, currentUrl.origin).toString();
-    }
-    if (auth.landingPath) {
-        return new URL(auth.landingPath, currentUrl.origin).toString();
-    }
-    return currentUrl.toString();
-}
-function encodeJsonForQuery(value) {
-    const json = canonicalizeJsonValue(value);
-    const bytes = new TextEncoder().encode(json);
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-async function signDomainValue(sign, prefix, value) {
-    const digest = await sha256(utf8(`${prefix}:${value}`));
-    const signature = await sign(digest);
-    const binary = String.fromCharCode(...signature);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-async function resolveClientIdentity(auth) {
-    if (auth?.mode === "session_key") {
-        const sessionAuth = await createAuth({ sessionKeySeed: auth.sessionKeySeed });
-        return {
-            mode: "session_key",
-            sessionKey: sessionAuth.sessionKey,
-            sign: sessionAuth.sign,
-            oauthInitSig: sessionAuth.oauthInitSig,
-            bindingTokenSig: sessionAuth.natsConnectSigForBindingToken,
-            bootstrapSig: (iat) => signDomainValue(sessionAuth.sign, "bootstrap-client", String(iat)),
-            bindFlowSig: (flowId) => signDomainValue(sessionAuth.sign, "bind-flow", flowId),
-        };
-    }
-    const handle = auth?.handle ?? await getOrCreateSessionKey();
-    return {
-        mode: "browser",
-        sessionKey: getPublicSessionKey(handle),
-        sign: (data) => signBytes(handle, data),
-        oauthInitSig: (redirectTo, context) => oauthInitSig(handle, redirectTo, context),
-        bindingTokenSig: (bindingToken) => signDomainValue((data) => signBytes(handle, data), "nats-connect", bindingToken),
-        bootstrapSig: (iat) => signDomainValue((data) => signBytes(handle, data), "bootstrap-client", String(iat)),
-        bindFlowSig: (flowId) => bindFlowSig(handle, flowId),
-    };
-}
-async function bindClientFlow(args) {
-    const response = await fetch(`${args.trellisUrl}/auth/flow/${encodeURIComponent(args.flowId)}/bind`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ sessionKey: args.sessionKey, sig: args.sig }),
-    });
-    if (!response.ok) {
-        throw new Error(`Client bind failed: ${response.status} ${await response.text()}`);
-    }
-    const payload = await response.json();
-    const parsed = Value.Parse(BindResponseSchema, payload);
-    if (parsed.status !== "bound") {
-        throw new Error(`Client bind did not complete: ${parsed.status}`);
-    }
-}
-async function fetchClientBootstrap(args) {
-    const response = await fetch(new URL("/bootstrap/client", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            sessionKey: args.sessionKey,
-            iat: args.iat,
-            sig: args.bootstrapSig,
-        }),
-    });
-    const payload = await response.json();
-    if (!response.ok) {
-        const reason = typeof payload?.reason === "string"
-            ? payload.reason
-            : `http_${response.status}`;
-        throw new Error(`Client bootstrap failed: ${reason}`);
-    }
-    if (Value.Check(ClientBootstrapReadySchema, payload)) {
-        return payload;
-    }
-    if (Value.Check(ClientBootstrapAuthRequiredSchema, payload)) {
-        return payload;
-    }
-    if (Value.Check(ClientBootstrapNotReadySchema, payload)) {
-        return payload;
-    }
-    throw new Error("Client bootstrap returned an invalid response");
-}
-function cleanupBrowserCallbackUrl(currentUrl) {
-    if (!isBrowserRuntime())
-        return;
-    if (!currentUrl.searchParams.has("flowId") && !currentUrl.searchParams.has("authError")) {
-        return;
-    }
-    currentUrl.searchParams.delete("flowId");
-    currentUrl.searchParams.delete("authError");
-    globalThis.history.replaceState({}, "", currentUrl.pathname + currentUrl.search);
-}
-async function buildSessionKeyLoginUrl(args) {
-    const url = new URL(`${args.trellisUrl}/auth/login`);
-    url.searchParams.set("redirectTo", args.redirectTo);
-    url.searchParams.set("sessionKey", args.sessionKey);
-    url.searchParams.set("sig", args.oauthInitSig);
-    url.searchParams.set("contract", encodeJsonForQuery(args.contract));
-    if (args.provider) {
-        url.searchParams.set("provider", args.provider);
-    }
-    if (args.context !== undefined) {
-        url.searchParams.set("context", encodeJsonForQuery(args.context));
-    }
-    return url.toString();
-}
-export async function connectClientWithDeps(args, deps) {
-    const trellisUrl = normalizeTrellisUrl(args.trellisUrl);
-    const identity = await resolveClientIdentity(args.auth);
-    const currentUrl = args.auth?.mode === "session_key" ? null : resolveCurrentUrl(args.auth);
-    const callbackFlowId = args.auth?.mode === "session_key"
-        ? args.auth.flowId
-        : currentUrl?.searchParams.get("flowId") ?? undefined;
-    if (callbackFlowId) {
-        await bindClientFlow({
-            trellisUrl,
-            sessionKey: identity.sessionKey,
-            flowId: callbackFlowId,
-            sig: await identity.bindFlowSig(callbackFlowId),
-        });
-        if (currentUrl)
-            cleanupBrowserCallbackUrl(currentUrl);
-    }
-    const bootstrapIat = Math.floor(deps.now() / 1_000);
-    const initialBootstrap = await fetchClientBootstrap({
-        trellisUrl,
-        sessionKey: identity.sessionKey,
-        iat: bootstrapIat,
-        bootstrapSig: await identity.bootstrapSig(bootstrapIat),
-    });
-    const bootstrap = initialBootstrap.status === "auth_required"
-        ? await resolveAuthRequired(args, identity, currentUrl, deps)
-        : initialBootstrap;
-    if (bootstrap.status !== "ready") {
-        if (bootstrap.status === "not_ready") {
-            throw new Error(`Client bootstrap is not ready: ${bootstrap.reason}`);
-        }
-        throw new Error("Client bootstrap still requires authentication");
-    }
-    const transport = await deps.loadTransport();
-    const token = JSON.stringify({
-        v: 1,
-        sessionKey: identity.sessionKey,
-        bindingToken: bootstrap.connectInfo.auth.bindingToken,
-        sig: await identity.bindingTokenSig(bootstrap.connectInfo.auth.bindingToken),
-    });
-    const nc = await transport.connect({
-        servers: bootstrap.connectInfo.transport.natsServers,
-        token,
-        inboxPrefix: bootstrap.connectInfo.transport.inboxPrefix,
-        authenticator: jwtAuthenticator(bootstrap.connectInfo.transport.sentinel.jwt, new TextEncoder().encode(bootstrap.connectInfo.transport.sentinel.seed)),
-    });
-    const clientOpts = {
-        ...(typeof args.name === "string" ? { name: args.name } : {}),
-        ...(args.log ? { log: args.log } : {}),
-        ...(typeof args.timeout === "number" ? { timeout: args.timeout } : {}),
-        ...(typeof args.stream === "string" ? { stream: args.stream } : {}),
-        ...(args.noResponderRetry ? { noResponderRetry: args.noResponderRetry } : {}),
-    };
-    return new Trellis(clientOpts.name ?? "client", nc, {
-        sessionKey: identity.sessionKey,
-        sign: identity.sign,
-    }, {
-        log: clientOpts.log,
-        timeout: clientOpts.timeout,
-        stream: clientOpts.stream,
-        noResponderRetry: clientOpts.noResponderRetry,
-        api: args.contract.API.trellis,
-    });
-}
-async function resolveAuthRequired(args, identity, currentUrl, deps) {
-    const browserAuth = args.auth?.mode === "session_key"
-        ? {}
-        : args.auth ?? {};
-    const redirectTo = args.auth?.mode === "session_key"
-        ? args.auth.redirectTo
-        : currentUrl
-            ? resolveRedirectTo(browserAuth, currentUrl)
-            : undefined;
-    if (!redirectTo) {
-        throw new Error("Client authentication requires a redirectTo URL");
-    }
-    const loginUrl = args.auth?.mode === "session_key"
-        ? await buildSessionKeyLoginUrl({
-            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
-            redirectTo,
-            sessionKey: identity.sessionKey,
-            contract: args.contract.CONTRACT,
-            provider: args.auth.provider,
-            context: args.auth.context,
-            oauthInitSig: await identity.oauthInitSig(redirectTo, args.auth.context),
-        })
-        : await buildLoginUrl({
-            authUrl: normalizeTrellisUrl(args.trellisUrl),
-            redirectTo,
-            handle: browserAuth.handle ?? await getOrCreateSessionKey(),
-            provider: browserAuth.provider,
-            contract: args.contract.CONTRACT,
-            context: browserAuth.context,
-        });
-    const continuation = await args.onAuthRequired?.({
-        loginUrl,
-        sessionKey: identity.sessionKey,
-        mode: identity.mode,
-    });
-    if (continuation && typeof continuation === "object" && "flowId" in continuation) {
-        await bindClientFlow({
-            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
-            sessionKey: identity.sessionKey,
-            flowId: continuation.flowId,
-            sig: await identity.bindFlowSig(continuation.flowId),
-        });
-        const bootstrapIat = Math.floor(deps.now() / 1_000);
-        return await fetchClientBootstrap({
-            trellisUrl: normalizeTrellisUrl(args.trellisUrl),
-            sessionKey: identity.sessionKey,
-            iat: bootstrapIat,
-            bootstrapSig: await identity.bootstrapSig(bootstrapIat),
-        });
-    }
-    if (isBrowserRuntime()) {
-        globalThis.location.href = loginUrl;
-        throw new Error("Redirecting to Trellis login");
-    }
-    throw new Error("Client authentication required and no auth continuation was provided");
-}
-export class TrellisClient {
-    static connect(args) {
-        return connectClientWithDeps(args, defaultDeps);
-    }
-}

package/esm/trellis/codec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/trellis/codec.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,UAAU,EAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAErE,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IACA,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B,CAAC;AAUJ,wBAAgB,KAAK,CAAC,CAAC,SAAS,OAAO,EACrC,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,eAAe,GAAG,eAAe,CAAC,CAU5D;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAC9C,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,GAAG,eAAe,CAAC,CAW/D;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,SAAS,GACd,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAAC,CAWpD;AAED,wBAAgB,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC,CAUnD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC,CAWnD"}

package/esm/trellis/contract.d.ts

@@ -1,20 +0,0 @@
-import { type DefinedContract as BaseDefinedContract, type ContractApiViews, type ContractDependencyUse, type ContractModule, type ContractUseFn, type DefineContractInput, type EmptyApi, type MergeApis, type OwnedApiFromSource, type SdkContractModule, type TrellisApiLike, type TrellisContractV1, type UsedApiFromUses, type UseSpec } from "../contracts/mod.js";
-export type DefinedContract<TOwnedApi extends {
-    rpc: Record<string, unknown>;
-    operations: Record<string, unknown>;
-    events: Record<string, unknown>;
-    subjects: Record<string, unknown>;
-}, TUsedApi extends {
-    rpc: Record<string, unknown>;
-    operations: Record<string, unknown>;
-    events: Record<string, unknown>;
-    subjects: Record<string, unknown>;
-}, TTrellisApi extends {
-    rpc: Record<string, unknown>;
-    operations: Record<string, unknown>;
-    events: Record<string, unknown>;
-    subjects: Record<string, unknown>;
-}, TContractId extends string = string> = BaseDefinedContract<TOwnedApi, TUsedApi, TTrellisApi, TContractId>;
-export declare function defineContract<const T extends DefineContractInput<any, any, any, any, any, any>>(source: T): DefinedContract<OwnedApiFromSource<T>, UsedApiFromUses<T["uses"]>, MergeApis<OwnedApiFromSource<T>, UsedApiFromUses<T["uses"]>>, T["id"]>;
-export type { ContractApiViews, ContractDependencyUse, ContractModule, ContractUseFn, DefineContractInput, EmptyApi, SdkContractModule, TrellisApiLike, TrellisContractV1, UseSpec, };
-//# sourceMappingURL=contract.d.ts.map

package/esm/trellis/contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/trellis/contract.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAExB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,OAAO,EACb,MAAM,qBAAqB,CAAC;AAS7B,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,QAAQ,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS;IAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,EACD,WAAW,SAAS,MAAM,GAAG,MAAM,IACjC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAEvE,wBAAgB,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC9F,MAAM,EAAE,CAAC,GACR,eAAe,CAChB,kBAAkB,CAAC,CAAC,CAAC,EACrB,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAC1B,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAC5D,CAAC,CAAC,IAAI,CAAC,CACR,CAOA;AAED,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,OAAO,GACR,CAAC"}

package/esm/trellis/contract.js

@@ -1,4 +0,0 @@
-import { defineContract as defineContractBase, } from "../contracts/mod.js";
-export function defineContract(source) {
-    return defineContractBase(source);
-}

package/esm/trellis/contracts.d.ts

@@ -1,5 +0,0 @@
-import "../_dnt.polyfills.js";
-export * from "../contracts/mod.js";
-export { defineContract } from "./contract.js";
-export type { DefinedContract } from "./contract.js";
-//# sourceMappingURL=contracts.d.ts.map

package/esm/trellis/contracts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/trellis/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/esm/trellis/contracts.js

@@ -1,3 +0,0 @@
-import "../_dnt.polyfills.js";
-export * from "../contracts/mod.js";
-export { defineContract } from "./contract.js";

package/esm/trellis/device.d.ts

@@ -1,41 +0,0 @@
-import { type NatsConnection } from "@nats-io/nats-core";
-import type { TrellisAPI } from "./contracts.js";
-import { Trellis } from "./trellis.js";
-type DeviceContract<TApi extends TrellisAPI = TrellisAPI> = {
-    CONTRACT_ID: string;
-    CONTRACT_DIGEST: string;
-    API: {
-        trellis: TApi;
-    };
-};
-type DeviceConnectTransport = {
-    connect(options: {
-        servers: string | string[];
-        token?: string;
-        authenticator?: unknown;
-        inboxPrefix?: string;
-    }): Promise<NatsConnection>;
-};
-type DeviceConnectDeps = {
-    loadTransport(): Promise<DeviceConnectTransport>;
-    now(): number;
-};
-export type DeviceActivationController = {
-    url: string;
-    waitForOnlineApproval(opts?: {
-        signal?: AbortSignal;
-    }): Promise<void>;
-    acceptConfirmationCode(code: string): Promise<void>;
-};
-export type TrellisDeviceConnectArgs<TApi extends TrellisAPI = TrellisAPI> = {
-    trellisUrl: string;
-    contract: DeviceContract<TApi>;
-    rootSecret: Uint8Array | string;
-    onActivationRequired?(activation: DeviceActivationController): Promise<void>;
-};
-export declare function connectDeviceWithDeps<TApi extends TrellisAPI>(args: TrellisDeviceConnectArgs<TApi>, deps: DeviceConnectDeps): Promise<Trellis<TApi>>;
-export declare const TrellisDevice: {
-    connect<TApi extends TrellisAPI>(args: TrellisDeviceConnectArgs<TApi>): Promise<Trellis<TApi>>;
-};
-export {};
-//# sourceMappingURL=device.d.ts.map

package/esm/trellis/device.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../src/trellis/device.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAa3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,KAAK,cAAc,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,CAAC;KACf,CAAC;CACH,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,OAAO,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjD,GAAG,IAAI,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,qBAAqB,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,UAAU,GAAG,UAAU,IAAI;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,CAAC,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAAC;AA0GF,wBAAsB,qBAAqB,CAAC,IAAI,SAAS,UAAU,EACjE,IAAI,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACpC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CA2HxB;AAED,eAAO,MAAM,aAAa;YAChB,IAAI,SAAS,UAAU,QACvB,wBAAwB,CAAC,IAAI,CAAC,GACnC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;CAG1B,CAAC"}

package/esm/trellis/device.js

@@ -1,209 +0,0 @@
-import { jwtAuthenticator } from "@nats-io/nats-core";
-import { buildDeviceActivationPayload, buildDeviceActivationUrl, createDeviceNatsAuthToken, deriveDeviceIdentity, signDeviceWaitRequest, verifyDeviceConfirmationCode, waitForDeviceActivation, } from "../auth/device_activation.js";
-import { importEd25519PrivateKeyFromSeedBase64url } from "../auth/keys.js";
-import { base64urlDecode, base64urlEncode, toArrayBuffer } from "../auth/utils.js";
-import { loadDefaultRuntimeTransport } from "./runtime_transport.js";
-import { Trellis } from "./trellis.js";
-import { Type } from "typebox";
-import { Value } from "typebox/value";
-const DeviceBootstrapReadySchema = Type.Object({
-    status: Type.Literal("ready"),
-    connectInfo: Type.Object({
-        instanceId: Type.String({ minLength: 1 }),
-        profileId: Type.String({ minLength: 1 }),
-        contractId: Type.String({ minLength: 1 }),
-        contractDigest: Type.String({ minLength: 1 }),
-        transport: Type.Object({
-            natsServers: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
-            sentinel: Type.Object({
-                jwt: Type.String({ minLength: 1 }),
-                seed: Type.String({ minLength: 1 }),
-            }, { additionalProperties: false }),
-        }, { additionalProperties: false }),
-        auth: Type.Object({
-            mode: Type.Literal("device_identity"),
-            iatSkewSeconds: Type.Integer({ minimum: 1 }),
-        }, { additionalProperties: false }),
-    }, { additionalProperties: false }),
-}, { additionalProperties: false });
-const DeviceBootstrapActivationRequiredSchema = Type.Object({
-    status: Type.Literal("activation_required"),
-}, { additionalProperties: false });
-const DeviceBootstrapNotReadySchema = Type.Object({
-    status: Type.Literal("not_ready"),
-    reason: Type.String({ minLength: 1 }),
-}, { additionalProperties: false });
-function normalizeRootSecret(rootSecret) {
-    if (typeof rootSecret === "string") {
-        const decoded = base64urlDecode(rootSecret.trim());
-        if (decoded.length === 0)
-            throw new Error("rootSecret must not be empty");
-        return decoded;
-    }
-    if (rootSecret.length === 0)
-        throw new Error("rootSecret must not be empty");
-    return rootSecret;
-}
-async function signIdentityBytes(identitySeed, data) {
-    const privateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
-    return new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, toArrayBuffer(data)));
-}
-const defaultDeps = {
-    loadTransport: loadDefaultRuntimeTransport,
-    now: () => Date.now(),
-};
-function activationRequiredError() {
-    return new Error("Device activation required but no activation handler was provided");
-}
-function isConnectInfoUnavailable(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return message.includes("404") || message.includes("unknown_device") || message.includes("activation_required");
-}
-async function fetchDeviceBootstrap(args) {
-    const request = await signDeviceWaitRequest({
-        publicIdentityKey: args.publicIdentityKey,
-        nonce: "connect-info",
-        identitySeed: args.identitySeed,
-        contractDigest: args.contractDigest,
-        iat: args.iat,
-    });
-    const bootstrapRequest = {
-        publicIdentityKey: request.publicIdentityKey,
-        contractDigest: request.contractDigest,
-        iat: request.iat,
-        sig: request.sig,
-    };
-    const response = await fetch(new URL("/bootstrap/device", args.trellisUrl), {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(bootstrapRequest),
-    });
-    if (!response.ok) {
-        throw new Error(`Device bootstrap failed: ${response.status} ${await response.text()}`);
-    }
-    const payload = await response.json();
-    if (Value.Check(DeviceBootstrapReadySchema, payload))
-        return payload;
-    if (Value.Check(DeviceBootstrapActivationRequiredSchema, payload))
-        return payload;
-    if (Value.Check(DeviceBootstrapNotReadySchema, payload))
-        return payload;
-    throw new Error("Device bootstrap returned an invalid response");
-}
-export async function connectDeviceWithDeps(args, deps) {
-    const rootSecret = normalizeRootSecret(args.rootSecret);
-    const identity = await deriveDeviceIdentity(rootSecret);
-    const contractDigest = args.contract.CONTRACT_DIGEST;
-    let connectInfo = null;
-    try {
-        const bootstrap = await fetchDeviceBootstrap({
-            trellisUrl: args.trellisUrl,
-            publicIdentityKey: identity.publicIdentityKey,
-            identitySeed: identity.identitySeed,
-            contractDigest,
-        });
-        if (bootstrap.status === "ready") {
-            connectInfo = bootstrap.connectInfo;
-        }
-        else if (bootstrap.status === "not_ready") {
-            throw new Error(bootstrap.reason);
-        }
-    }
-    catch (error) {
-        if (!isConnectInfoUnavailable(error))
-            throw error;
-    }
-    if (!connectInfo) {
-        if (!args.onActivationRequired)
-            throw activationRequiredError();
-        const nonce = crypto.randomUUID();
-        const payload = await buildDeviceActivationPayload({
-            activationKey: identity.activationKey,
-            publicIdentityKey: identity.publicIdentityKey,
-            nonce,
-        });
-        const activationUrl = buildDeviceActivationUrl({
-            trellisUrl: args.trellisUrl,
-            payload,
-        });
-        let activationCompleted = false;
-        let onlineConnectInfo = null;
-        await args.onActivationRequired({
-            url: activationUrl,
-            waitForOnlineApproval: async (opts) => {
-                if (activationCompleted)
-                    return;
-                const activation = await waitForDeviceActivation({
-                    trellisUrl: args.trellisUrl,
-                    publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
-                    identitySeed: identity.identitySeed,
-                    contractDigest,
-                    signal: opts?.signal,
-                });
-                onlineConnectInfo = activation.connectInfo;
-                activationCompleted = true;
-            },
-            acceptConfirmationCode: async (code) => {
-                if (activationCompleted)
-                    return;
-                const ok = await verifyDeviceConfirmationCode({
-                    activationKey: identity.activationKey,
-                    publicIdentityKey: identity.publicIdentityKey,
-                    nonce,
-                    confirmationCode: code,
-                });
-                if (!ok) {
-                    throw new Error("Invalid device confirmation code");
-                }
-                activationCompleted = true;
-            },
-        });
-        if (!activationCompleted) {
-            throw new Error("Device activation did not complete");
-        }
-        if (onlineConnectInfo) {
-            connectInfo = onlineConnectInfo;
-        }
-        else {
-            const bootstrap = await fetchDeviceBootstrap({
-                trellisUrl: args.trellisUrl,
-                publicIdentityKey: identity.publicIdentityKey,
-                identitySeed: identity.identitySeed,
-                contractDigest,
-            });
-            if (bootstrap.status !== "ready") {
-                throw new Error(`Device bootstrap is not ready: ${bootstrap.status}`);
-            }
-            connectInfo = bootstrap.connectInfo;
-        }
-    }
-    if (!connectInfo) {
-        throw new Error("Device bootstrap did not return runtime connect info");
-    }
-    const transport = await deps.loadTransport();
-    const iat = Math.floor(deps.now() / 1_000);
-    const authToken = await createDeviceNatsAuthToken({
-        publicIdentityKey: identity.publicIdentityKey,
-        identitySeed: identity.identitySeed,
-        contractDigest,
-        iat,
-    });
-    const nc = await transport.connect({
-        servers: connectInfo.transport.natsServers,
-        token: JSON.stringify(authToken),
-        inboxPrefix: `_INBOX.${identity.publicIdentityKey.slice(0, 16)}`,
-        authenticator: jwtAuthenticator(connectInfo.transport.sentinel.jwt, new TextEncoder().encode(connectInfo.transport.sentinel.seed)),
-    });
-    return new Trellis(args.contract.CONTRACT_ID, nc, {
-        sessionKey: identity.publicIdentityKey,
-        sign: (data) => signIdentityBytes(identity.identitySeed, data),
-    }, {
-        api: args.contract.API.trellis,
-    });
-}
-export const TrellisDevice = {
-    connect(args) {
-        return connectDeviceWithDeps(args, defaultDeps);
-    },
-};

package/esm/trellis/env.d.ts

@@ -1,2 +0,0 @@
-export { getEnv } from "../telemetry/env.js";
-//# sourceMappingURL=env.d.ts.map

package/esm/trellis/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/trellis/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC"}

package/esm/trellis/env.js

@@ -1 +0,0 @@
-export { getEnv } from "../telemetry/env.js";

package/esm/trellis/errors/AuthError.d.ts

@@ -1,30 +0,0 @@
-import Type, { type Static } from "typebox";
-import { TrellisError } from "./TrellisError.js";
-export declare const AuthErrorDataSchema: Type.TObject<{
-    id: Type.TString;
-    type: Type.TLiteral<"AuthError">;
-    message: Type.TString;
-    reason: Type.TUnion<[Type.TLiteral<"invalid_request">, Type.TLiteral<"missing_session_key">, Type.TLiteral<"missing_proof">, Type.TLiteral<"session_not_found">, Type.TLiteral<"session_expired">, Type.TLiteral<"invalid_signature">, Type.TLiteral<"user_not_found">, Type.TLiteral<"user_inactive">, Type.TLiteral<"unknown_device">, Type.TLiteral<"device_profile_not_found">, Type.TLiteral<"device_profile_disabled">, Type.TLiteral<"device_activation_revoked">, Type.TLiteral<"unknown_service">, Type.TLiteral<"service_disabled">, Type.TLiteral<"iat_out_of_range">, Type.TLiteral<"invalid_binding_token">, Type.TLiteral<"session_corrupted">, Type.TLiteral<"session_already_bound">, Type.TLiteral<"authtoken_already_used">, Type.TLiteral<"oauth_session_key_mismatch">, Type.TLiteral<"service_role_on_user">, Type.TLiteral<"reply_subject_mismatch">, Type.TLiteral<"insufficient_permissions">, Type.TLiteral<"forbidden">, Type.TLiteral<"missing_handoff_id">, Type.TLiteral<"missing_profile_id">, Type.TLiteral<"device_activation_handoff_not_found">, Type.TLiteral<"device_activation_handoff_expired">, Type.TLiteral<"device_activation_rejected">, Type.TLiteral<"device_identity_key_mismatch">, Type.TLiteral<"invalid_device_qr_mac">]>;
-    context: Type.TOptional<Type.TRecord<"^.*$", Type.TUnknown>>;
-    traceId: Type.TOptional<Type.TString>;
-}>;
-export type AuthErrorData = Static<typeof AuthErrorDataSchema>;
-/**
- * Error for authentication and authorization failures.
- */
-export declare class AuthError extends TrellisError<AuthErrorData> {
-    readonly name: "AuthError";
-    readonly reason: AuthErrorData["reason"];
-    constructor(options: ErrorOptions & {
-        reason: AuthErrorData["reason"];
-        context?: Record<string, unknown>;
-        id?: string;
-    });
-    /**
-     * Serializes error to a plain object.
-     *
-     * @returns Plain object representation of the error
-     */
-    toSerializable(): AuthErrorData;
-}
-//# sourceMappingURL=AuthError.d.ts.map

package/esm/trellis/errors/AuthError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthError.d.ts","sourceRoot":"","sources":["../../../src/trellis/errors/AuthError.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,eAAO,MAAM,mBAAmB;;;;;;;EAuC9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D;;GAEG;AACH,qBAAa,SAAU,SAAQ,YAAY,CAAC,aAAa,CAAC;IACxD,SAAkB,IAAI,cAAwB;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAGvC,OAAO,EAAE,YAAY,GAAG;QACtB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,MAAM,CAAC;KACb;IAOH;;;;OAIG;IACM,cAAc,IAAI,aAAa;CAOzC"}