@qlever-llc/trellis 0.7.0 → 0.8.0-rc.3

package/script/npm/src/auth/schemas.d.ts

@@ -0,0 +1,142 @@
+import type { StaticDecode } from "typebox";
+import { Type } from "typebox";
+export declare const ContractDigestSchema: Type.TString;
+export declare const SentinelCredsSchema: Type.TObject<{
+    jwt: Type.TString;
+    seed: Type.TString;
+}>;
+export type SentinelCreds = StaticDecode<typeof SentinelCredsSchema>;
+export declare const ClientTransportEndpointsSchema: Type.TObject<{
+    natsServers: Type.TArray<Type.TString>;
+}>;
+export type ClientTransportEndpoints = StaticDecode<typeof ClientTransportEndpointsSchema>;
+export declare const ClientTransportsSchema: Type.TObject<{
+    native: Type.TOptional<Type.TObject<{
+        natsServers: Type.TArray<Type.TString>;
+    }>>;
+    websocket: Type.TOptional<Type.TObject<{
+        natsServers: Type.TArray<Type.TString>;
+    }>>;
+}>;
+export type ClientTransports = StaticDecode<typeof ClientTransportsSchema>;
+export declare const ApprovalDecisionSchema: Type.TUnion<[Type.TLiteral<"approved">, Type.TLiteral<"denied">]>;
+export type ApprovalDecision = StaticDecode<typeof ApprovalDecisionSchema>;
+export declare const UserParticipantKindSchema: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+export type UserParticipantKind = StaticDecode<typeof UserParticipantKindSchema>;
+export declare const ContractApprovalSchema: Type.TObject<{
+    contractDigest: Type.TString;
+    contractId: Type.TString;
+    displayName: Type.TString;
+    description: Type.TString;
+    participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+    capabilities: Type.TArray<Type.TString>;
+}>;
+export type ContractApproval = StaticDecode<typeof ContractApprovalSchema>;
+export declare const BindSuccessResponseSchema: Type.TObject<{
+    status: Type.TLiteral<"bound">;
+    inboxPrefix: Type.TString;
+    expires: Type.TString;
+    sentinel: Type.TObject<{
+        jwt: Type.TString;
+        seed: Type.TString;
+    }>;
+    transports: Type.TObject<{
+        native: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+        websocket: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+    }>;
+}>;
+export declare const BindInsufficientCapabilitiesResponseSchema: Type.TObject<{
+    status: Type.TLiteral<"insufficient_capabilities">;
+    approval: Type.TObject<{
+        contractDigest: Type.TString;
+        contractId: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        capabilities: Type.TArray<Type.TString>;
+    }>;
+    missingCapabilities: Type.TArray<Type.TString>;
+    userCapabilities: Type.TArray<Type.TString>;
+}>;
+export declare const BindResponseSchema: Type.TUnion<[Type.TObject<{
+    status: Type.TLiteral<"bound">;
+    inboxPrefix: Type.TString;
+    expires: Type.TString;
+    sentinel: Type.TObject<{
+        jwt: Type.TString;
+        seed: Type.TString;
+    }>;
+    transports: Type.TObject<{
+        native: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+        websocket: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+    }>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"insufficient_capabilities">;
+    approval: Type.TObject<{
+        contractDigest: Type.TString;
+        contractId: Type.TString;
+        displayName: Type.TString;
+        description: Type.TString;
+        participantKind: Type.TUnion<[Type.TLiteral<"app">, Type.TLiteral<"agent">]>;
+        capabilities: Type.TArray<Type.TString>;
+    }>;
+    missingCapabilities: Type.TArray<Type.TString>;
+    userCapabilities: Type.TArray<Type.TString>;
+}>]>;
+export type BindResponse = StaticDecode<typeof BindResponseSchema>;
+export type BindSuccessResponse = StaticDecode<typeof BindSuccessResponseSchema>;
+export type BindInsufficientCapabilitiesResponse = StaticDecode<typeof BindInsufficientCapabilitiesResponseSchema>;
+export declare const AuthStartRequestSchema: Type.TObject<{
+    provider: Type.TOptional<Type.TString>;
+    redirectTo: Type.TString;
+    sessionKey: Type.TString;
+    sig: Type.TString;
+    contract: Type.TObject<{}>;
+    context: Type.TOptional<Type.TObject<{}>>;
+}>;
+export declare const AuthStartFlowResponseSchema: Type.TObject<{
+    status: Type.TLiteral<"flow_started">;
+    flowId: Type.TString;
+    loginUrl: Type.TString;
+}>;
+export declare const AuthStartResponseSchema: Type.TUnion<[Type.TObject<{
+    status: Type.TLiteral<"bound">;
+    inboxPrefix: Type.TString;
+    expires: Type.TString;
+    sentinel: Type.TObject<{
+        jwt: Type.TString;
+        seed: Type.TString;
+    }>;
+    transports: Type.TObject<{
+        native: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+        websocket: Type.TOptional<Type.TObject<{
+            natsServers: Type.TArray<Type.TString>;
+        }>>;
+    }>;
+}>, Type.TObject<{
+    status: Type.TLiteral<"flow_started">;
+    flowId: Type.TString;
+    loginUrl: Type.TString;
+}>]>;
+export type AuthStartRequest = StaticDecode<typeof AuthStartRequestSchema>;
+export type AuthStartFlowResponse = StaticDecode<typeof AuthStartFlowResponseSchema>;
+export type AuthStartResponse = StaticDecode<typeof AuthStartResponseSchema>;
+export declare const NatsAuthTokenV1Schema: Type.TObject<{
+    v: Type.TLiteral<1>;
+    sessionKey: Type.TString;
+    sig: Type.TString;
+    iat: Type.TInteger;
+    contractDigest: Type.TString;
+}>;
+export type NatsAuthTokenV1 = StaticDecode<typeof NatsAuthTokenV1Schema>;
+//# sourceMappingURL=schemas.d.ts.map

package/script/npm/src/auth/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAU/B,eAAO,MAAM,oBAAoB,cAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;;EAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAErE,eAAO,MAAM,8BAA8B;;EAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,YAAY,CACjD,OAAO,8BAA8B,CACtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,mEAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB,6DAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;EAMpC,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;EAKrD,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAC5C,OAAO,yBAAyB,CACjC,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,YAAY,CAC7D,OAAO,0CAA0C,CAClD,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;EAOA,CAAC;AAEpC,eAAO,MAAM,2BAA2B;;;;EAItC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;IAGlC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,qBAAqB,GAAG,YAAY,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,eAAO,MAAM,qBAAqB;;;;;;EAMC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/script/npm/src/auth/schemas.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NatsAuthTokenV1Schema = exports.AuthStartResponseSchema = exports.AuthStartFlowResponseSchema = exports.AuthStartRequestSchema = exports.BindResponseSchema = exports.BindInsufficientCapabilitiesResponseSchema = exports.BindSuccessResponseSchema = exports.ContractApprovalSchema = exports.UserParticipantKindSchema = exports.ApprovalDecisionSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.SentinelCredsSchema = exports.ContractDigestSchema = void 0;
+const typebox_1 = require("typebox");
+const SessionKeySchema = typebox_1.Type.String({
+    pattern: "^[A-Za-z0-9_-]{43}$",
+});
+const SignatureSchema = typebox_1.Type.String({
+    pattern: "^[A-Za-z0-9_-]{86}$",
+});
+exports.ContractDigestSchema = typebox_1.Type.String({
+    pattern: "^[A-Za-z0-9_-]+$",
+});
+const OpenObjectSchema = typebox_1.Type.Object({}, { additionalProperties: true });
+exports.SentinelCredsSchema = typebox_1.Type.Object({
+    jwt: typebox_1.Type.String(),
+    seed: typebox_1.Type.String(),
+});
+exports.ClientTransportEndpointsSchema = typebox_1.Type.Object({
+    natsServers: typebox_1.Type.Array(typebox_1.Type.String({ minLength: 1 }), { minItems: 1 }),
+});
+exports.ClientTransportsSchema = typebox_1.Type.Object({
+    native: typebox_1.Type.Optional(exports.ClientTransportEndpointsSchema),
+    websocket: typebox_1.Type.Optional(exports.ClientTransportEndpointsSchema),
+});
+exports.ApprovalDecisionSchema = typebox_1.Type.Union([
+    typebox_1.Type.Literal("approved"),
+    typebox_1.Type.Literal("denied"),
+]);
+exports.UserParticipantKindSchema = typebox_1.Type.Union([
+    typebox_1.Type.Literal("app"),
+    typebox_1.Type.Literal("agent"),
+]);
+exports.ContractApprovalSchema = typebox_1.Type.Object({
+    contractDigest: exports.ContractDigestSchema,
+    contractId: typebox_1.Type.String(),
+    displayName: typebox_1.Type.String(),
+    description: typebox_1.Type.String(),
+    participantKind: exports.UserParticipantKindSchema,
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+});
+exports.BindSuccessResponseSchema = typebox_1.Type.Object({
+    status: typebox_1.Type.Literal("bound"),
+    inboxPrefix: typebox_1.Type.String(),
+    expires: typebox_1.Type.String({ format: "date-time" }),
+    sentinel: exports.SentinelCredsSchema,
+    transports: exports.ClientTransportsSchema,
+});
+exports.BindInsufficientCapabilitiesResponseSchema = typebox_1.Type.Object({
+    status: typebox_1.Type.Literal("insufficient_capabilities"),
+    approval: exports.ContractApprovalSchema,
+    missingCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    userCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+});
+exports.BindResponseSchema = typebox_1.Type.Union([
+    exports.BindSuccessResponseSchema,
+    exports.BindInsufficientCapabilitiesResponseSchema,
+]);
+exports.AuthStartRequestSchema = typebox_1.Type.Object({
+    provider: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    redirectTo: typebox_1.Type.String(),
+    sessionKey: SessionKeySchema,
+    sig: SignatureSchema,
+    contract: OpenObjectSchema,
+    context: typebox_1.Type.Optional(OpenObjectSchema),
+}, { additionalProperties: false });
+exports.AuthStartFlowResponseSchema = typebox_1.Type.Object({
+    status: typebox_1.Type.Literal("flow_started"),
+    flowId: typebox_1.Type.String({ minLength: 1 }),
+    loginUrl: typebox_1.Type.String({ minLength: 1 }),
+});
+exports.AuthStartResponseSchema = typebox_1.Type.Union([
+    exports.BindSuccessResponseSchema,
+    exports.AuthStartFlowResponseSchema,
+]);
+exports.NatsAuthTokenV1Schema = typebox_1.Type.Object({
+    v: typebox_1.Type.Literal(1),
+    sessionKey: SessionKeySchema,
+    sig: SignatureSchema,
+    iat: typebox_1.Type.Integer(),
+    contractDigest: exports.ContractDigestSchema,
+}, { additionalProperties: false });

package/script/npm/src/auth/session_auth.d.ts

@@ -0,0 +1,26 @@
+import { type Authenticator } from "@nats-io/nats-core";
+export type NatsConnectOptions = {
+    authenticator: Authenticator;
+    inboxPrefix: string;
+};
+export type TrellisAuth = {
+    sessionKey: string;
+    sign: (data: Uint8Array) => Promise<Uint8Array>;
+    currentIat: () => number;
+    setServerClockOffsetMs: (clockOffsetMs: number) => void;
+    oauthInitSig: (redirectTo: string, context?: unknown, provider?: string, contract?: Record<string, unknown>) => Promise<string>;
+    bindFlowSig: (flowId: string) => Promise<string>;
+    natsConnectSigForIat: (iat: number, contractDigest: string) => Promise<string>;
+    createProof: (subject: string, payloadHash: Uint8Array) => Promise<string>;
+    natsConnectOptions: (opts: {
+        contractDigest: string;
+    }) => Promise<NatsConnectOptions>;
+};
+/**
+ * Builds the canonical value signed for NATS runtime-auth tokens.
+ */
+export declare function buildNatsConnectSignaturePayload(iat: number, contractDigest: string): string;
+export declare function createAuth(opts: {
+    sessionKeySeed: string;
+}): Promise<TrellisAuth>;
+//# sourceMappingURL=session_auth.d.ts.map

package/script/npm/src/auth/session_auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session_auth.d.ts","sourceRoot":"","sources":["../../../../src/auth/session_auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAmBxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB,sBAAsB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAExD,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,oBAAoB,EAAE,CACpB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IAErB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAClB,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,KAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,CAER;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,WAAW,CAAC,CA+FtB"}

package/script/npm/src/auth/session_auth.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildNatsConnectSignaturePayload = buildNatsConnectSignaturePayload;
+exports.createAuth = createAuth;
+const keys_js_1 = require("./keys.js");
+const proof_js_1 = require("./proof.js");
+const time_js_1 = require("./time.js");
+const utils_js_1 = require("./utils.js");
+/**
+ * Builds the canonical value signed for NATS runtime-auth tokens.
+ */
+function buildNatsConnectSignaturePayload(iat, contractDigest) {
+    return `${iat}:${contractDigest}`;
+}
+async function createAuth(opts) {
+    const seed = (0, utils_js_1.base64urlDecode)(opts.sessionKeySeed);
+    const privateKey = await (0, keys_js_1.importEd25519PrivateKeyFromSeedBase64url)(opts.sessionKeySeed);
+    const sessionKey = (0, keys_js_1.publicKeyBase64urlFromSeed)(seed);
+    let serverClockOffsetMs = 0;
+    const sign = async (data) => {
+        const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, (0, utils_js_1.toArrayBuffer)(data));
+        return new Uint8Array(sig);
+    };
+    const signDomainHash = async (prefix, value) => {
+        const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`${prefix}:${value}`));
+        const sigBytes = await sign(digest);
+        return (0, utils_js_1.base64urlEncode)(sigBytes);
+    };
+    const signOauthInit = async (redirectTo, context, provider, contract) => {
+        const canonicalContext = (0, utils_js_1.canonicalizeJsonValue)(context ?? null);
+        const payload = contract === undefined
+            ? `${redirectTo}:${canonicalContext}`
+            : `${redirectTo}:${provider ?? ""}:${(0, utils_js_1.canonicalizeJsonValue)(contract)}:${canonicalContext}`;
+        return await signDomainHash("oauth-init", payload);
+    };
+    const buildServiceNatsAuthToken = (iat, contractDigest) => {
+        return {
+            v: 1,
+            sessionKey,
+            iat,
+            contractDigest,
+            sig: (0, utils_js_1.base64urlEncode)((0, keys_js_1.signEd25519SeedSha256)(seed, (0, utils_js_1.utf8)(`nats-connect:${buildNatsConnectSignaturePayload(iat, contractDigest)}`))),
+        };
+    };
+    const currentIat = () => (0, time_js_1.correctedIatSeconds)(Date.now(), serverClockOffsetMs);
+    return {
+        sessionKey,
+        sign,
+        currentIat,
+        setServerClockOffsetMs: (clockOffsetMs) => {
+            serverClockOffsetMs = clockOffsetMs;
+        },
+        oauthInitSig: signOauthInit,
+        bindFlowSig: (flowId) => signDomainHash("bind-flow", flowId),
+        natsConnectSigForIat: (iat, contractDigest) => signDomainHash("nats-connect", buildNatsConnectSignaturePayload(iat, contractDigest)),
+        createProof: (subject, payloadHash) => (0, proof_js_1.createProof)(privateKey, { sessionKey, subject, payloadHash }),
+        natsConnectOptions: async (options) => {
+            return {
+                authenticator: () => {
+                    const authToken = buildServiceNatsAuthToken(currentIat(), options.contractDigest);
+                    return { auth_token: JSON.stringify(authToken) };
+                },
+                inboxPrefix: `_INBOX.${sessionKey.slice(0, 16)}`,
+            };
+        },
+    };
+}

package/script/npm/src/auth/time.d.ts

@@ -0,0 +1,7 @@
+export declare function estimateMidpointClockOffsetMs(args: {
+    requestStartedAtMs: number;
+    responseReceivedAtMs: number;
+    serverNowSeconds: number;
+}): number;
+export declare function correctedIatSeconds(nowMs?: number, clockOffsetMs?: number): number;
+//# sourceMappingURL=time.d.ts.map

package/script/npm/src/auth/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../../src/auth/time.ts"],"names":[],"mappings":"AAAA,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,MAAM,CAGT;AAED,wBAAgB,mBAAmB,CACjC,KAAK,GAAE,MAAmB,EAC1B,aAAa,GAAE,MAAU,GACxB,MAAM,CAER"}

package/script/npm/src/auth/time.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateMidpointClockOffsetMs = estimateMidpointClockOffsetMs;
+exports.correctedIatSeconds = correctedIatSeconds;
+function estimateMidpointClockOffsetMs(args) {
+    const midpointMs = (args.requestStartedAtMs + args.responseReceivedAtMs) / 2;
+    return args.serverNowSeconds * 1_000 - midpointMs;
+}
+function correctedIatSeconds(nowMs = Date.now(), clockOffsetMs = 0) {
+    return Math.floor((nowMs + clockOffsetMs) / 1_000);
+}

package/script/npm/src/auth/trellis_id.d.ts

@@ -0,0 +1,2 @@
+export declare function trellisIdFromOriginId(origin: string, id: string): Promise<string>;
+//# sourceMappingURL=trellis_id.d.ts.map

package/script/npm/src/auth/trellis_id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trellis_id.d.ts","sourceRoot":"","sources":["../../../../src/auth/trellis_id.ts"],"names":[],"mappings":"AAEA,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/script/npm/src/auth/types.d.ts

@@ -0,0 +1,4 @@
+import type { StaticDecode } from "typebox";
+import { NatsAuthTokenV1Schema } from "./schemas.js";
+export type NatsAuthTokenV1 = StaticDecode<typeof NatsAuthTokenV1Schema>;
+//# sourceMappingURL=types.d.ts.map

package/script/npm/src/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/script/npm/src/auth/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/script/npm/src/auth/utils.d.ts

@@ -0,0 +1,11 @@
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare function utf8(s: string): Uint8Array;
+export declare function canonicalizeJson(value: JsonValue): string;
+export declare function toArrayBuffer(data: Uint8Array): ArrayBuffer;
+export declare function base64urlEncode(data: Uint8Array): string;
+export declare function base64urlDecode(s: string): Uint8Array;
+export declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+export declare function canonicalizeJsonValue(value: unknown): string;
+//# sourceMappingURL=utils.d.ts.map

package/script/npm/src/auth/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/auth/utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAezD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAQ3D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AA2BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D"}

package/script/npm/src/auth/utils.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = utf8;
+exports.canonicalizeJson = canonicalizeJson;
+exports.toArrayBuffer = toArrayBuffer;
+exports.base64urlEncode = base64urlEncode;
+exports.base64urlDecode = base64urlDecode;
+exports.sha256 = sha256;
+exports.canonicalizeJsonValue = canonicalizeJsonValue;
+function utf8(s) {
+    return new TextEncoder().encode(s);
+}
+function canonicalizeJson(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number")
+        return JSON.stringify(value);
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalizeJson).join(",")}]`;
+    }
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalizeJson(value[key])}`).join(",")}}`;
+}
+function toArrayBuffer(data) {
+    const buf = data.buffer;
+    if (buf instanceof ArrayBuffer) {
+        return buf.slice(data.byteOffset, data.byteOffset + data.byteLength);
+    }
+    const copy = new Uint8Array(data.byteLength);
+    copy.set(data);
+    return copy.buffer;
+}
+function base64urlEncode(data) {
+    const b64 = btoa(String.fromCharCode(...data));
+    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64urlDecode(s) {
+    const normalized = s.replace(/-/g, "+").replace(/_/g, "/");
+    const padLen = (4 - (normalized.length % 4)) % 4;
+    const padded = normalized + "=".repeat(padLen);
+    const bin = atob(padded);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+async function sha256(data) {
+    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(data));
+    return new Uint8Array(digest);
+}
+function canonicalizeUnknownJsonValue(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("JSON numbers must be finite");
+        return JSON.stringify(value);
+    }
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalizeUnknownJsonValue).join(",")}]`;
+    }
+    if (typeof value === "object") {
+        const keys = Object.keys(value).sort();
+        return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalizeUnknownJsonValue(value[key])}`).join(",")}}`;
+    }
+    throw new Error("Value is not JSON-serializable");
+}
+function canonicalizeJsonValue(value) {
+    return canonicalizeUnknownJsonValue(value);
+}

package/script/npm/src/auth.d.ts

@@ -0,0 +1,3 @@
+import "./_dnt.polyfills.js";
+export * from "./auth/mod.js";
+//# sourceMappingURL=auth.d.ts.map

package/script/npm/src/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/script/npm/src/browser.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Browser-safe compatibility alias for @qlever-llc/trellis.
+ */
+import "./_dnt.polyfills.js";
+export * from "./index.js";
+export type { TrellisAuth } from "./trellis.js";
+//# sourceMappingURL=browser.d.ts.map

package/script/npm/src/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,qBAAqB,CAAC;AAG7B,cAAc,YAAY,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/script/npm/src/client.d.ts

@@ -0,0 +1,60 @@
+import type { NatsConnection } from "@nats-io/nats-core";
+import { CONTRACT_STATE_METADATA } from "./contract_support/mod.js";
+import type { ContractStateMetadata } from "./contract_support/mod.js";
+import type { TrellisAPI } from "./contracts.js";
+import type { LoggerLike } from "./globals.js";
+import type { RuntimeStateStoresForContract, TrellisAuth } from "./trellis.js";
+import { Trellis } from "./trellis.js";
+type NoResponderRetryOpts = {
+    maxAttempts?: number;
+    baseDelayMs?: number;
+};
+export type ClientOpts = {
+    /**
+     * Logical name for this client instance (used for logs and consumer names).
+     * Defaults to "client".
+     */
+    name?: string;
+    log?: LoggerLike;
+    timeout?: number;
+    stream?: string;
+    noResponderRetry?: NoResponderRetryOpts;
+};
+type ClientContract<TApi, TContract> = {
+    CONTRACT: TContract;
+    API: {
+        owned?: TApi;
+        trellis?: TApi;
+    };
+    readonly [CONTRACT_STATE_METADATA]?: ContractStateMetadata;
+};
+type ClientContractManifest = {
+    state?: Readonly<Record<string, unknown>>;
+    schemas?: Readonly<Record<string, unknown>>;
+};
+type ClientContractShape = {
+    CONTRACT: ClientContractManifest;
+    API: {
+        owned?: TrellisAPI;
+        trellis?: TrellisAPI;
+    };
+    readonly [CONTRACT_STATE_METADATA]?: ContractStateMetadata;
+};
+type ClientContractForApi<TApi extends TrellisAPI> = ClientContract<TApi, ClientContractManifest>;
+type ApiForClientContract<TContract extends ClientContractShape> = TContract extends {
+    API: {
+        trellis: infer TApi;
+    };
+} ? TApi extends TrellisAPI ? TApi : never : TContract extends {
+    API: {
+        owned: infer TApi;
+    };
+} ? TApi extends TrellisAPI ? TApi : never : never;
+/**
+ * Create a Trellis client typed from a contract module's derived outbound surface.
+ */
+export declare function createClient<TContract extends ClientContractShape>(contract: TContract, nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<ApiForClientContract<TContract>, "client", RuntimeStateStoresForContract<TContract>>;
+export declare function createClient<TApi extends TrellisAPI, TContract extends ClientContractForApi<TApi> = ClientContractForApi<TApi>>(contract: TContract, nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Trellis<TApi, "client", RuntimeStateStoresForContract<TContract>>;
+export declare function createCoreClient(nats: NatsConnection, auth: TrellisAuth, opts?: ClientOpts): Promise<Trellis<TrellisAPI>>;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/script/npm/src/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,6BAA6B,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC,CAAC;AAEF,KAAK,cAAc,CAAC,IAAI,EAAE,SAAS,IAAI;IACrC,QAAQ,EAAE,SAAS,CAAC;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE,IAAI,CAAC;QACb,OAAO,CAAC,EAAE,IAAI,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC7C,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,GAAG,EAAE;QACH,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,OAAO,CAAC,EAAE,UAAU,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC5D,CAAC;AAEF,KAAK,oBAAoB,CAAC,IAAI,SAAS,UAAU,IAAI,cAAc,CACjE,IAAI,EACJ,sBAAsB,CACvB,CAAC;AAEF,KAAK,oBAAoB,CAAC,SAAS,SAAS,mBAAmB,IAC7D,SAAS,SAAS;IAAE,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,GAC9C,IAAI,SAAS,UAAU,GAAG,IAAI,GAAG,KAAK,GACtC,SAAS,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,GAC9C,IAAI,SAAS,UAAU,GAAG,IAAI,GAAG,KAAK,GACxC,KAAK,CAAC;AAEZ;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,mBAAmB,EAChE,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CACR,oBAAoB,CAAC,SAAS,CAAC,EAC/B,QAAQ,EACR,6BAA6B,CAAC,SAAS,CAAC,CACzC,CAAC;AACF,wBAAgB,YAAY,CAC1B,IAAI,SAAS,UAAU,EACvB,SAAS,SAAS,oBAAoB,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAEzE,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;AAoDrE,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,EACjB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAc9B"}

package/script/npm/src/client.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClient = createClient;
+exports.createCoreClient = createCoreClient;
+const mod_js_1 = require("./contract_support/mod.js");
+const trellis_js_1 = require("./trellis.js");
+function createClient(contract, nats, auth, opts) {
+    const api = contract.API.trellis ?? contract.API.owned;
+    if (!api) {
+        throw new Error("Contract is missing an owned or trellis API view");
+    }
+    return new trellis_js_1.Trellis(opts?.name ?? "client", nats, auth, {
+        log: opts?.log,
+        timeout: opts?.timeout,
+        stream: opts?.stream,
+        noResponderRetry: opts?.noResponderRetry,
+        api,
+        state: contract[mod_js_1.CONTRACT_STATE_METADATA],
+    });
+}
+async function loadCoreApi() {
+    try {
+        const mod = await Promise.resolve().then(() => __importStar(require("./sdk/core.js")));
+        const api = mod.core?.API.trellis ?? mod.API?.trellis;
+        if (api) {
+            return api;
+        }
+    }
+    catch (error) {
+        throw new Error("Failed to load the Trellis core SDK. Generate the core SDK first or use createClient(contract, ...) with an explicit contract API.", { cause: error });
+    }
+    throw new Error("Failed to load the Trellis core SDK API surface. Use createClient(contract, ...) with an explicit contract API if you do not need the generated core SDK.");
+}
+async function createCoreClient(nats, auth, opts) {
+    const api = await loadCoreApi();
+    return new trellis_js_1.Trellis(opts?.name ?? "client", nats, auth, {
+        log: opts?.log,
+        timeout: opts?.timeout,
+        stream: opts?.stream,
+        noResponderRetry: opts?.noResponderRetry,
+        api,
+    });
+}