@qlever-llc/trellis 0.7.0 → 0.8.0-rc.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qlever-llc/trellis",
-  "version": "0.7.0",
+  "version": "0.8.0-rc.3",
   "description": "Client-side Trellis runtime, models, and contract helpers for TypeScript applications.",
   "homepage": "https://github.com/Qlever-LLC/trellis#readme",
   "repository": {
@@ -11,62 +11,102 @@
   "bugs": {
     "url": "https://github.com/Qlever-LLC/trellis/issues"
   },
-  "main": "./script/js/packages/trellis/npm/src/index.js",
+  "main": "./script/index.js",
   "module": "./esm/index.js",
   "exports": {
     ".": {
       "import": "./esm/index.js",
-      "require": "./script/js/packages/trellis/npm/src/index.js"
+      "require": "./script/index.js"
     },
     "./auth": {
       "import": "./esm/auth.js",
-      "require": "./script/js/packages/trellis/npm/src/auth.js"
+      "require": "./script/auth.js"
     },
     "./auth/browser": {
       "import": "./esm/auth/browser.js",
-      "require": "./script/js/packages/trellis/npm/src/auth/browser.js"
+      "require": "./script/auth/browser.js"
     },
     "./browser": {
-      "import": "./esm/browser.js",
-      "require": "./script/js/packages/trellis/npm/src/browser.js"
+      "import": "./esm/npm/src/browser.js",
+      "require": "./script/npm/src/browser.js"
     },
     "./contracts": {
       "import": "./esm/contracts.js",
-      "require": "./script/js/packages/trellis/npm/src/contracts.js"
+      "require": "./script/contracts.js"
+    },
+    "./device": {
+      "import": "./esm/device.js",
+      "require": "./script/device.js"
+    },
+    "./device/deno": {
+      "import": "./esm/npm/src/device/deno.js",
+      "require": "./script/npm/src/device/deno.js"
     },
     "./health": {
       "import": "./esm/health.js",
-      "require": "./script/js/packages/trellis/npm/src/health.js"
+      "require": "./script/health.js"
+    },
+    "./sdk/activity": {
+      "import": "./esm/npm/src/sdk/activity.js",
+      "require": "./script/npm/src/sdk/activity.js"
+    },
+    "./sdk/auth": {
+      "import": "./esm/npm/src/sdk/auth.js",
+      "require": "./script/npm/src/sdk/auth.js"
+    },
+    "./sdk/core": {
+      "import": "./esm/npm/src/sdk/core.js",
+      "require": "./script/npm/src/sdk/core.js"
+    },
+    "./sdk/health": {
+      "import": "./esm/npm/src/sdk/health.js",
+      "require": "./script/npm/src/sdk/health.js"
+    },
+    "./sdk/jobs": {
+      "import": "./esm/npm/src/sdk/jobs.js",
+      "require": "./script/npm/src/sdk/jobs.js"
+    },
+    "./sdk/state": {
+      "import": "./esm/npm/src/sdk/state.js",
+      "require": "./script/npm/src/sdk/state.js"
     },
     "./errors": {
       "import": "./esm/errors/index.js",
-      "require": "./script/js/packages/trellis/npm/src/errors/index.js"
+      "require": "./script/errors/index.js"
     },
     "./host": {
-      "import": "./esm/host/mod.js",
-      "require": "./script/js/packages/trellis/npm/src/host/mod.js"
-    },
-    "./host/deno": {
-      "import": "./esm/host/deno.js",
-      "require": "./script/js/packages/trellis/npm/src/host/deno.js"
+      "import": "./esm/npm/src/host/mod.js",
+      "require": "./script/npm/src/host/mod.js"
     },
     "./host/node": {
-      "import": "./esm/host/node.js",
-      "require": "./script/js/packages/trellis/npm/src/host/node.js"
+      "import": "./esm/npm/src/host/node.js",
+      "require": "./script/npm/src/host/node.js"
+    },
+    "./service": {
+      "import": "./esm/npm/src/service/mod.js",
+      "require": "./script/npm/src/service/mod.js"
+    },
+    "./service/deno": {
+      "import": "./esm/npm/src/service/deno.js",
+      "require": "./script/npm/src/service/deno.js"
+    },
+    "./service/node": {
+      "import": "./esm/npm/src/service/node.js",
+      "require": "./script/npm/src/service/node.js"
     },
     "./tracing": {
       "import": "./esm/tracing.js",
-      "require": "./script/js/packages/trellis/npm/src/tracing.js"
+      "require": "./script/tracing.js"
     }
   },
+  "scripts": {},
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@qlever-llc/trellis-sdk": "^0.7.0",
     "@deno/shim-deno": "~0.18.0",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.56.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.56.0",
     "@opentelemetry/resources": "^1.30.1",
     "@opentelemetry/sdk-trace-base": "^1.30.1",
     "@opentelemetry/sdk-trace-node": "^1.30.1",
@@ -77,11 +117,13 @@
     "@nats-io/nats-core": "^3.3.1",
     "@nats-io/transport-node": "^3.3.1",
     "json-schema-library": "^10.5.2",
+    "js-sha256": "^0.11.1",
     "pino": "^9.11.0",
+    "tweetnacl": "^1.0.3",
     "ts-deepmerge": "^7.0.3",
     "typebox": "^1.0.15",
     "ulid": "^3.0.1",
-    "@qlever-llc/result": "^0.7.0"
+    "@qlever-llc/result": "^0.8.0-rc.3"
   },
   "devDependencies": {
     "@types/node": "^20.9.0"

package/script/auth/browser/login.d.ts

@@ -0,0 +1,34 @@
+import { type AuthStartResponse, type BindResponse, type BindSuccessResponse } from "../schemas.ts";
+import type { SessionKeyHandle } from "./session.ts";
+export type { AuthStartFlowResponse, AuthStartRequest, AuthStartResponse, BindResponse, BindSuccessResponse, ContractApproval, SentinelCreds, } from "../schemas.ts";
+export type AuthConfig = {
+    authUrl: string;
+};
+export declare function buildLoginUrl(config: AuthConfig, provider: string | undefined, redirectTo: string, handle: SessionKeyHandle, contract: Record<string, unknown>, context?: unknown): Promise<string>;
+export declare function buildLoginUrl(args: {
+    authUrl: string;
+    provider?: string;
+    redirectTo: string;
+    handle: SessionKeyHandle;
+    contract: Record<string, unknown>;
+    context?: unknown;
+}): Promise<string>;
+export declare function buildLoginUrl(args: {
+    config: AuthConfig;
+    provider?: string;
+    redirectTo: string;
+    handle: SessionKeyHandle;
+    contract: Record<string, unknown>;
+    context?: unknown;
+}): Promise<string>;
+export declare function startAuthRequest(args: {
+    authUrl: string;
+    provider?: string;
+    redirectTo: string;
+    handle: SessionKeyHandle;
+    contract: Record<string, unknown>;
+    context?: unknown;
+}): Promise<AuthStartResponse>;
+export declare function isBindSuccessResponse(response: BindResponse): response is BindSuccessResponse;
+export declare function bindFlow(config: AuthConfig, handle: SessionKeyHandle, flowId: string): Promise<BindResponse>;
+//# sourceMappingURL=login.d.ts.map

package/script/auth/browser/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../auth/browser/login.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAEjB,KAAK,mBAAmB,EAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AA2BF,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,aAAa,CACjC,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,aAAa,CACjC,IAAI,EAAE;IACJ,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,MAAM,CAAC,CAAC;AA0CnB,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgC7B;AAwCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GACrB,QAAQ,IAAI,mBAAmB,CAEjC;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAwBvB"}

package/script/auth/browser/login.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLoginUrl = buildLoginUrl;
+exports.startAuthRequest = startAuthRequest;
+exports.isBindSuccessResponse = isBindSuccessResponse;
+exports.bindFlow = bindFlow;
+const value_1 = require("typebox/value");
+const schemas_ts_1 = require("../schemas.js");
+const session_ts_1 = require("./session.js");
+function contextRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+async function buildLoginUrl(argsOrConfig, provider, redirectTo, handle, contract, context) {
+    const resolved = isNestedBuildLoginUrlArgs(argsOrConfig)
+        ? argsOrConfig
+        : isFlatBuildLoginUrlArgs(argsOrConfig)
+            ? {
+                config: { authUrl: argsOrConfig.authUrl },
+                provider: argsOrConfig.provider,
+                redirectTo: argsOrConfig.redirectTo,
+                handle: argsOrConfig.handle,
+                contract: argsOrConfig.contract,
+                context: argsOrConfig.context,
+            }
+            : buildLoginUrlArgsFromPositional(argsOrConfig, provider, redirectTo, handle, contract, context);
+    const response = await startAuthRequest({
+        authUrl: resolved.config.authUrl,
+        provider: resolved.provider,
+        redirectTo: resolved.redirectTo,
+        handle: resolved.handle,
+        contract: resolved.contract,
+        context: resolved.context,
+    });
+    if (response.status !== "flow_started") {
+        throw new Error("Auth request completed without starting a browser flow");
+    }
+    return response.loginUrl;
+}
+async function startAuthRequest(args) {
+    const context = contextRecord(args.context);
+    const sig = await (0, session_ts_1.oauthInitSig)(args.handle, args.redirectTo, context, args.provider, args.contract);
+    const request = value_1.Value.Parse(schemas_ts_1.AuthStartRequestSchema, {
+        redirectTo: args.redirectTo,
+        sessionKey: (0, session_ts_1.getPublicSessionKey)(args.handle),
+        sig,
+        contract: args.contract,
+        ...(args.provider ? { provider: args.provider } : {}),
+        ...(context ? { context } : {}),
+    });
+    const response = await fetch(`${args.authUrl}/auth/requests`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(request),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Auth request failed: ${response.status} ${text}`);
+    }
+    return value_1.Value.Parse(schemas_ts_1.AuthStartResponseSchema, await response.json());
+}
+function buildLoginUrlArgsFromPositional(config, provider, redirectTo, handle, contract, context) {
+    if (redirectTo === undefined || handle === undefined || contract === undefined) {
+        throw new TypeError("buildLoginUrl requires redirectTo, handle, and contract");
+    }
+    return {
+        config,
+        provider,
+        redirectTo,
+        handle,
+        contract,
+        context,
+    };
+}
+function isNestedBuildLoginUrlArgs(value) {
+    return "config" in value;
+}
+function isFlatBuildLoginUrlArgs(value) {
+    return "authUrl" in value && "redirectTo" in value && "handle" in value &&
+        "contract" in value;
+}
+function isBindSuccessResponse(response) {
+    return response.status === "bound";
+}
+async function bindFlow(config, handle, flowId) {
+    const sessionKey = (0, session_ts_1.getPublicSessionKey)(handle);
+    const sig = await (0, session_ts_1.bindFlowSig)(handle, flowId);
+    const response = await fetch(`${config.authUrl}/auth/flow/${encodeURIComponent(flowId)}/bind`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionKey, sig }),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Bind failed: ${response.status} ${text}`);
+    }
+    const payload = await response.json();
+    if (payload && typeof payload === "object" && payload.status === "expired") {
+        throw new Error("Bind failed: expired");
+    }
+    return value_1.Value.Parse(schemas_ts_1.BindResponseSchema, payload);
+}

package/script/auth/browser/portal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../auth/browser/portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAKR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,GAAG,IAAI,GAC5B,MAAM,GAAG,IAAI,CAEf"}

package/script/auth/browser/portal.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.portalFlowIdFromUrl = portalFlowIdFromUrl;
+exports.fetchPortalFlowState = fetchPortalFlowState;
+exports.portalProviderLoginUrl = portalProviderLoginUrl;
+exports.submitPortalApproval = submitPortalApproval;
+exports.portalRedirectLocation = portalRedirectLocation;
+const protocol_ts_1 = require("../protocol.js");
+const value_1 = require("typebox/value");
+function authBaseUrl(config) {
+    return config.authUrl.replace(/\/$/, "");
+}
+function portalFlowIdFromUrl(url) {
+    return url.searchParams.get("flowId");
+}
+async function fetchPortalFlowState(config, flowId) {
+    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}`);
+    if (!response.ok) {
+        throw new Error(`Failed to load portal flow (${response.status})`);
+    }
+    return value_1.Value.Parse(protocol_ts_1.PortalFlowStateSchema, await response.json());
+}
+function portalProviderLoginUrl(config, providerId, flowId) {
+    const base = `${authBaseUrl(config)}/auth/login/${encodeURIComponent(providerId)}`;
+    return `${base}?flowId=${encodeURIComponent(flowId)}`;
+}
+async function submitPortalApproval(config, flowId, decision) {
+    const response = await fetch(`${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}/approval`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ approved: decision === "approved" }),
+    });
+    if (!response.ok) {
+        throw new Error(`Approval request failed (${response.status})`);
+    }
+    return value_1.Value.Parse(protocol_ts_1.PortalFlowStateSchema, await response.json());
+}
+function portalRedirectLocation(state) {
+    return state?.status === "redirect" ? state.location : null;
+}

package/script/auth/browser/session.d.ts

@@ -0,0 +1,18 @@
+export type SessionKeyHandle = {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicKeyRaw: Uint8Array;
+    sessionKey: string;
+};
+export declare function generateSessionKey(): Promise<SessionKeyHandle>;
+export declare function loadSessionKey(): Promise<SessionKeyHandle | null>;
+export declare function getOrCreateSessionKey(): Promise<SessionKeyHandle>;
+export declare function signBytes(handle: SessionKeyHandle, data: Uint8Array): Promise<Uint8Array>;
+export declare function getPublicSessionKey(handle: SessionKeyHandle): string;
+export declare function oauthInitSig(handle: SessionKeyHandle, redirectTo: string, context?: unknown, provider?: string, contract?: Record<string, unknown>): Promise<string>;
+export declare function bindFlowSig(handle: SessionKeyHandle, flowId: string): Promise<string>;
+export declare function natsConnectSigForIat(handle: SessionKeyHandle, iat: number, contractDigest: string): Promise<string>;
+export declare function createRpcProof(handle: SessionKeyHandle, subject: string, payload: Uint8Array): Promise<string>;
+export declare function clearSessionKey(): Promise<void>;
+export declare function hasSessionKey(): Promise<boolean>;
+//# sourceMappingURL=session.d.ts.map

package/script/auth/browser/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../auth/browser/session.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAoBpE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CASvE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAIvE;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD"}

package/script/auth/browser/session.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSessionKey = generateSessionKey;
+exports.loadSessionKey = loadSessionKey;
+exports.getOrCreateSessionKey = getOrCreateSessionKey;
+exports.signBytes = signBytes;
+exports.getPublicSessionKey = getPublicSessionKey;
+exports.oauthInitSig = oauthInitSig;
+exports.bindFlowSig = bindFlowSig;
+exports.natsConnectSigForIat = natsConnectSigForIat;
+exports.createRpcProof = createRpcProof;
+exports.clearSessionKey = clearSessionKey;
+exports.hasSessionKey = hasSessionKey;
+const utils_ts_1 = require("../utils.js");
+const proof_ts_1 = require("../proof.js");
+const session_auth_ts_1 = require("../session_auth.js");
+const storage_ts_1 = require("./storage.js");
+async function generateSessionKey() {
+    const keyPair = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);
+    const publicKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", keyPair.publicKey));
+    const sessionKey = (0, utils_ts_1.base64urlEncode)(publicKeyRaw);
+    await (0, storage_ts_1.storeKeyPair)(keyPair, publicKeyRaw);
+    return {
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        publicKeyRaw,
+        sessionKey,
+    };
+}
+async function loadSessionKey() {
+    const stored = await (0, storage_ts_1.loadKeyPair)();
+    if (!stored)
+        return null;
+    return {
+        privateKey: stored.privateKey,
+        publicKey: stored.publicKey,
+        publicKeyRaw: stored.publicKeyRaw,
+        sessionKey: (0, utils_ts_1.base64urlEncode)(stored.publicKeyRaw),
+    };
+}
+async function getOrCreateSessionKey() {
+    const existing = await loadSessionKey();
+    if (existing)
+        return existing;
+    return await generateSessionKey();
+}
+async function signBytes(handle, data) {
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, handle.privateKey, (0, utils_ts_1.toArrayBuffer)(data));
+    return new Uint8Array(sig);
+}
+function getPublicSessionKey(handle) {
+    return handle.sessionKey;
+}
+async function oauthInitSig(handle, redirectTo, context, provider, contract) {
+    const canonicalContext = (0, utils_ts_1.canonicalizeJsonValue)(context ?? null);
+    const payload = contract === undefined
+        ? `${redirectTo}:${canonicalContext}`
+        : `${redirectTo}:${provider ?? ""}:${(0, utils_ts_1.canonicalizeJsonValue)(contract)}:${canonicalContext}`;
+    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`oauth-init:${payload}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_ts_1.base64urlEncode)(sig);
+}
+async function bindFlowSig(handle, flowId) {
+    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`bind-flow:${flowId}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_ts_1.base64urlEncode)(sig);
+}
+async function natsConnectSigForIat(handle, iat, contractDigest) {
+    const digest = await (0, utils_ts_1.sha256)((0, utils_ts_1.utf8)(`nats-connect:${(0, session_auth_ts_1.buildNatsConnectSignaturePayload)(iat, contractDigest)}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_ts_1.base64urlEncode)(sig);
+}
+async function createRpcProof(handle, subject, payload) {
+    const payloadHash = await (0, utils_ts_1.sha256)(payload);
+    return await (0, proof_ts_1.createProof)(handle.privateKey, {
+        sessionKey: handle.sessionKey,
+        subject,
+        payloadHash,
+    });
+}
+async function clearSessionKey() {
+    await (0, storage_ts_1.deleteKeyPair)();
+}
+async function hasSessionKey() {
+    return await (0, storage_ts_1.hasKeyPair)();
+}

package/script/auth/browser/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../auth/browser/storage.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAYjE;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAYnD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAGnD"}

package/script/auth/browser.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+export { type AuthConfig, type AuthStartFlowResponse, type AuthStartRequest, type AuthStartResponse, bindFlow, type BindResponse, type BindSuccessResponse, buildLoginUrl, isBindSuccessResponse, type SentinelCreds, startAuthRequest, } from "./browser/login.ts";
+export { type ApprovalDecision, fetchPortalFlowState, portalFlowIdFromUrl, type PortalFlowState, type PortalFlowState as BrowserPortalFlowState, portalProviderLoginUrl, portalRedirectLocation, submitPortalApproval, } from "./browser/portal.ts";
+export { bindFlowSig, clearSessionKey, createRpcProof, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, loadSessionKey, natsConnectSigForIat, type SessionKeyHandle, signBytes, } from "./browser/session.ts";
+export { deleteKeyPair, hasKeyPair } from "./browser/storage.ts";
+export { type ApprovalDecision as ApprovalDecisionData, ApprovalDecisionSchema, type AuthStartFlowResponse as AuthStartFlowResponseData, AuthStartFlowResponseSchema, type AuthStartRequest as AuthStartRequestData, AuthStartRequestSchema, type AuthStartResponse as AuthStartResponseData, AuthStartResponseSchema, type BindResponse as BindResponseData, BindResponseSchema, type BindSuccessResponse as BindSuccessResponseData, BindSuccessResponseSchema, type ClientTransportEndpoints as ClientTransportEndpointsData, ClientTransportEndpointsSchema, type ClientTransports as ClientTransportsData, ClientTransportsSchema, type ContractApproval as ContractApprovalData, ContractApprovalSchema, type NatsAuthTokenV1 as NatsAuthTokenV1Data, NatsAuthTokenV1Schema, type SentinelCreds as SentinelCredsData, SentinelCredsSchema, } from "./schemas.ts";
+export type { NatsAuthTokenV1 } from "./types.ts";
+export { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.ts";
+//# sourceMappingURL=browser.d.ts.map

package/script/auth/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../auth/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,aAAa,EACb,qBAAqB,EACrB,KAAK,aAAa,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,IAAI,sBAAsB,EAC9C,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,2BAA2B,EAC3B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,iBAAiB,IAAI,qBAAqB,EAC/C,uBAAuB,EACvB,KAAK,YAAY,IAAI,gBAAgB,EACrC,kBAAkB,EAClB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,yBAAyB,EACzB,KAAK,wBAAwB,IAAI,4BAA4B,EAC7D,8BAA8B,EAC9B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,KAAK,aAAa,IAAI,iBAAiB,EACvC,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/script/auth/browser.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * @module
+ * Browser-based authentication utilities for session-key based authentication.
+ * Uses WebCrypto API and IndexedDB for secure key storage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.AuthStartResponseSchema = exports.AuthStartRequestSchema = exports.AuthStartFlowResponseSchema = exports.ApprovalDecisionSchema = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForIat = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.startAuthRequest = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindFlow = void 0;
+var login_ts_1 = require("./browser/login.js");
+Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function () { return login_ts_1.bindFlow; } });
+Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_ts_1.buildLoginUrl; } });
+Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_ts_1.isBindSuccessResponse; } });
+Object.defineProperty(exports, "startAuthRequest", { enumerable: true, get: function () { return login_ts_1.startAuthRequest; } });
+var portal_ts_1 = require("./browser/portal.js");
+Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_ts_1.fetchPortalFlowState; } });
+Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_ts_1.portalFlowIdFromUrl; } });
+Object.defineProperty(exports, "portalProviderLoginUrl", { enumerable: true, get: function () { return portal_ts_1.portalProviderLoginUrl; } });
+Object.defineProperty(exports, "portalRedirectLocation", { enumerable: true, get: function () { return portal_ts_1.portalRedirectLocation; } });
+Object.defineProperty(exports, "submitPortalApproval", { enumerable: true, get: function () { return portal_ts_1.submitPortalApproval; } });
+var session_ts_1 = require("./browser/session.js");
+Object.defineProperty(exports, "bindFlowSig", { enumerable: true, get: function () { return session_ts_1.bindFlowSig; } });
+Object.defineProperty(exports, "clearSessionKey", { enumerable: true, get: function () { return session_ts_1.clearSessionKey; } });
+Object.defineProperty(exports, "createRpcProof", { enumerable: true, get: function () { return session_ts_1.createRpcProof; } });
+Object.defineProperty(exports, "generateSessionKey", { enumerable: true, get: function () { return session_ts_1.generateSessionKey; } });
+Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get: function () { return session_ts_1.getOrCreateSessionKey; } });
+Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_ts_1.getPublicSessionKey; } });
+Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_ts_1.hasSessionKey; } });
+Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_ts_1.loadSessionKey; } });
+Object.defineProperty(exports, "natsConnectSigForIat", { enumerable: true, get: function () { return session_ts_1.natsConnectSigForIat; } });
+Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_ts_1.signBytes; } });
+var storage_ts_1 = require("./browser/storage.js");
+Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_ts_1.deleteKeyPair; } });
+Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_ts_1.hasKeyPair; } });
+var schemas_ts_1 = require("./schemas.js");
+Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_ts_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "AuthStartFlowResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartFlowResponseSchema; } });
+Object.defineProperty(exports, "AuthStartRequestSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartRequestSchema; } });
+Object.defineProperty(exports, "AuthStartResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.AuthStartResponseSchema; } });
+Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindResponseSchema; } });
+Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_ts_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "ClientTransportEndpointsSchema", { enumerable: true, get: function () { return schemas_ts_1.ClientTransportEndpointsSchema; } });
+Object.defineProperty(exports, "ClientTransportsSchema", { enumerable: true, get: function () { return schemas_ts_1.ClientTransportsSchema; } });
+Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_ts_1.ContractApprovalSchema; } });
+Object.defineProperty(exports, "NatsAuthTokenV1Schema", { enumerable: true, get: function () { return schemas_ts_1.NatsAuthTokenV1Schema; } });
+Object.defineProperty(exports, "SentinelCredsSchema", { enumerable: true, get: function () { return schemas_ts_1.SentinelCredsSchema; } });
+var utils_ts_1 = require("./utils.js");
+Object.defineProperty(exports, "base64urlDecode", { enumerable: true, get: function () { return utils_ts_1.base64urlDecode; } });
+Object.defineProperty(exports, "base64urlEncode", { enumerable: true, get: function () { return utils_ts_1.base64urlEncode; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_ts_1.sha256; } });
+Object.defineProperty(exports, "toArrayBuffer", { enumerable: true, get: function () { return utils_ts_1.toArrayBuffer; } });
+Object.defineProperty(exports, "utf8", { enumerable: true, get: function () { return utils_ts_1.utf8; } });