@query-farm/vgi 0.39.0 → 0.40.0

package/dist/rpc-server.d.ts

@@ -1,4 +1,4 @@
-import { type GrantMinter, type Protocol, type TokenResolver, VgiRpcServer } from "@query-farm/vgi-rpc";
+import { GrantKeys, type GrantMinter, type Protocol, type TokenResolver, VgiRpcServer } from "@query-farm/vgi-rpc";
 /** The transport a server is being built for. Only `"http"` changes what is
  *  hosted (identity); the rest are recorded so the decision lives here rather
  *  than at each call site. `"iroh"` is the raw TCP upstream of a
@@ -71,6 +71,19 @@ export interface HostingOptions {
     /** Maximum age of the caller's authentication for `issue_grant`, in
      *  seconds. vgi-rpc's default when omitted. */
     maxAuthAge?: number;
+    /**
+     * Sealed-grant keys (vgi-rpc `GrantKeys`), turning on the framework's own
+     * grants on HTTP: `issue_grant` mints `vgig1.` tokens (unless
+     * {@link mintGrant} is supplied) and the worker's HTTP authentication accepts
+     * them back as bearer credentials, as the grant's owner. When omitted,
+     * `VGI_RPC_GRANT_KEYS` (comma-separated base64, exactly 32 bytes each, first
+     * mints, all verify), `VGI_RPC_GRANT_AUDIENCE` and
+     * `VGI_RPC_GRANT_MAX_TTL_SECONDS` are read; `serveVgiWorker` also accepts
+     * `--grant-key KEY` (repeatable). Unset everywhere, nothing changes. A
+     * malformed key refuses to start. `null` turns grants off regardless of the
+     * environment.
+     */
+    grantKeys?: GrantKeys | null;
 }
 /** Server-level options passed through to `VgiRpcServer`. */
 export interface BuildRpcServerOptions {
@@ -95,3 +108,12 @@ export interface BuildRpcServerOptions {
  *   on HTTP with no introspector allowlist.
  */
 export declare function buildRpcServer(primary: Protocol, hosting: HostingOptions, options: BuildRpcServerOptions): VgiRpcServer;
+/**
+ * Collect `--grant-key KEY` / `--grant-key=KEY` (repeatable, first mints) from
+ * an argv, as a `GrantKeys` -- or `undefined` when none was passed, so the
+ * environment still applies. Audience and lifetime come from
+ * `VGI_RPC_GRANT_AUDIENCE` / `VGI_RPC_GRANT_MAX_TTL_SECONDS`.
+ *
+ * @throws Error A malformed key: a worker refuses to start.
+ */
+export declare function grantKeysFromArgv(argv: readonly string[], env?: Record<string, string | undefined> | undefined): GrantKeys | undefined;

package/dist/serve-entry.d.ts

@@ -1,13 +1,21 @@
 import type { CatalogInterface } from "./catalog/interface.js";
 import type { FunctionRegistry } from "./functions/registry.js";
 import { type AuthenticateFn, type PeerResolutionOptions } from "@query-farm/vgi-rpc";
-import type { HostingOptions } from "./rpc-server.js";
+import { type HostingOptions } from "./rpc-server.js";
 /** Environment variables `serveVgiWorker` reads. Injectable for testing. */
 export interface ServeEnv {
     PORT?: string;
     VGI_SIGNING_KEY?: string;
     VGI_TOKEN_TTL?: string;
     CORS_ORIGINS?: string;
+    /** Sealed-grant keys: comma-separated base64, exactly 32 bytes each, first mints. */
+    VGI_RPC_GRANT_KEYS?: string;
+    /** Audience bound into sealed grants. */
+    VGI_RPC_GRANT_AUDIENCE?: string;
+    /** Sealed-grant lifetime ceiling, seconds (default 7 days). */
+    VGI_RPC_GRANT_MAX_TTL_SECONDS?: string;
+    /** Principals allowed to call `introspect_token`, comma-separated. */
+    VGI_INTROSPECT_PRINCIPALS?: string;
 }
 export declare const DEFAULT_PORT = 8787;
 export declare const DEFAULT_TOKEN_TTL = 3600;
@@ -58,6 +66,10 @@ export interface ServeVgiWorkerOptions extends HostingOptions {
     quiet?: boolean;
     /** Environment source (default `process.env`). */
     env?: ServeEnv;
+    /** Command-line arguments to read `--grant-key KEY` (repeatable, first mints)
+     *  from. Default `process.argv.slice(2)`. A key here takes precedence over
+     *  `VGI_RPC_GRANT_KEYS`; an explicit {@link grantKeys} over both. */
+    argv?: readonly string[];
     /** Authenticates each request, returning the caller's `AuthContext`.
      *  Omit for an anonymous worker (the default). */
     authenticate?: AuthenticateFn;

package/dist/serve-entry.js

@@ -517,7 +517,8 @@ import {
   irohForwardedHeaderIdentityProvider,
   IROH_FORWARDED_ENDPOINT_HEADER,
   observePeerIdentity,
-  peerIdentityPrimary
+  peerIdentityPrimary,
+  GrantKeys as GrantKeys2
 } from "@query-farm/vgi-rpc";
 
 // src/http/fetch.ts
@@ -7004,6 +7005,7 @@ function createLandingRoutes(info) {
 
 // src/rpc-server.ts
 import {
+  GrantKeys,
   IdentityImpl,
   VgiRpcServer
 } from "@query-farm/vgi-rpc";
@@ -7020,7 +7022,8 @@ function buildRpcServer(primary, hosting, options) {
   return new VgiRpcServer(primary, {
     serverId: options.serverId,
     protocols,
-    identity
+    identity,
+    grantKeys: null
   });
 }
 function validatedHostedProtocols(hosting, primary) {
@@ -7063,11 +7066,13 @@ function validatedHostedProtocols(hosting, primary) {
 }
 function buildIdentity(hosting, env) {
   const { resolveToken, mintGrant } = hosting;
-  if (!resolveToken && !mintGrant)
+  const grantKeys = hosting.grantKeys === undefined ? GrantKeys.fromEnv(env ?? processEnv()) : hosting.grantKeys;
+  if (!resolveToken && !mintGrant && !grantKeys)
     return;
   return new IdentityImpl({
     resolveToken,
     mintGrant,
+    grantKeys: grantKeys ?? undefined,
     introspectPrincipals: resolveToken ? resolveIntrospectPrincipals(hosting.introspectPrincipals, env) : undefined,
     maxAuthAge: hosting.maxAuthAge
   });
@@ -7088,6 +7093,26 @@ function resolveIntrospectPrincipals(explicit, env) {
   }
   return principals;
 }
+function processEnv() {
+  return globalThis.process?.env;
+}
+function grantKeysFromArgv(argv, env = processEnv()) {
+  const keys = [];
+  for (let i = 0;i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--grant-key") {
+      if (i + 1 >= argv.length)
+        throw new Error("--grant-key requires a value");
+      keys.push(argv[++i]);
+    } else if (a.startsWith("--grant-key=")) {
+      keys.push(a.slice("--grant-key=".length));
+    }
+  }
+  if (keys.length === 0)
+    return;
+  const fromEnv = GrantKeys.fromEnv({ ...env ?? {}, VGI_RPC_GRANT_KEYS: keys.join(",") });
+  return fromEnv ?? undefined;
+}
 
 // src/http/fetch.ts
 var requestAuthStorage;
@@ -7235,7 +7260,8 @@ function createVgiWorkerFetch(opts) {
     resolveToken: opts.resolveToken,
     mintGrant: opts.mintGrant,
     introspectPrincipals: opts.introspectPrincipals,
-    maxAuthAge: opts.maxAuthAge
+    maxAuthAge: opts.maxAuthAge,
+    grantKeys: opts.grantKeys !== undefined ? opts.grantKeys : grantKeysFromArgv(opts.argv ?? process.argv.slice(2), env) ?? GrantKeys2.fromEnv(env)
   });
 }
 function serveVgiWorker(opts) {
@@ -7283,4 +7309,4 @@ export {
   serveVgiWorker
 };
 
-//# debugId=1342AF43ED836A9764756E2164756E21
+//# debugId=9A6DC12C2CA522B864756E2164756E21