@tiangong-lca/cli 0.1.0 → 0.1.2

package/dist/src/lib/auth-identity-receipt.d.ts

@@ -0,0 +1,160 @@
+import type { FetchLike } from './http.js';
+import { type SupabaseRestRuntime } from './supabase-client.js';
+import { type ResolvedSupabaseUserSession } from './supabase-session.js';
+export declare const AUTH_IDENTITY_RECEIPT_SCHEMA: 'tiangong-lca.auth-identity-receipt.v1';
+export declare const AUTH_IDENTITY_MAX_TIMEOUT_MS = 2147483647;
+declare const CLI_PACKAGE_NAME: '@tiangong-lca/cli';
+declare const SESSION_SOURCES: readonly ['memory', 'cache', 'refresh', 'signin'];
+declare const CACHE_MODES: readonly ['disabled', 'custom-file', 'platform-default'];
+type SessionSource = (typeof SESSION_SOURCES)[number];
+type CacheMode = (typeof CACHE_MODES)[number];
+type JsonObject = Record<string, unknown>;
+export type AuthIdentityReceiptScope = {
+    schema: typeof AUTH_IDENTITY_RECEIPT_SCHEMA;
+    status: 'passed';
+    operation: 'current-user-read';
+    remote_write_mode: 'read-only';
+    captured_at_utc: string;
+    cli: {
+        package_name: typeof CLI_PACKAGE_NAME;
+        package_version: string;
+    };
+    project: {
+        project_ref: string;
+        project_base_url: string;
+    };
+    identity: {
+        user_id: string;
+        display_email: string;
+    };
+    session: {
+        source: SessionSource;
+        cache_mode: CacheMode;
+        force_reauth: boolean;
+        expires_at_utc: string | null;
+    };
+    bindings: {
+        request_sha256: string;
+        response_sha256: string;
+    };
+    assertions: {
+        mode: 'observed' | 'partial' | 'intent-bound';
+        requested_count: 0 | 1 | 2;
+        expected_project_ref: string | null;
+        expected_user_id: string | null;
+        project_ref_passed: true | null;
+        user_id_passed: true | null;
+        passed: true;
+    };
+};
+export type AuthIdentityReceipt = AuthIdentityReceiptScope & {
+    receipt_scope_sha256: string;
+};
+export type ResolveAuthIdentitySession = (options: {
+    runtime: SupabaseRestRuntime;
+    fetchImpl: FetchLike;
+    timeoutMs?: number;
+    now?: Date;
+    forceRefresh?: boolean;
+}) => Promise<ResolvedSupabaseUserSession>;
+export type RunAuthIdentityReceiptOptions = {
+    env: NodeJS.ProcessEnv;
+    fetchImpl: FetchLike;
+    cliVersion: string;
+    expectedProjectRef?: string | null;
+    expectedUserId?: string | null;
+    timeoutMs?: number;
+    now?: Date;
+    resolveSessionImpl?: ResolveAuthIdentitySession;
+};
+declare function stableJsonValue(value: unknown): unknown;
+declare function sha256Json(value: unknown): string;
+declare function token(value: unknown): string | null;
+declare function normalizeEmail(value: unknown): string | null;
+declare function isCanonicalUuid(value: unknown): value is string;
+declare function normalizeExpectation(value: string | null | undefined, label: string): string | null;
+declare function normalizeExpectedUserId(value: string | null | undefined): string | null;
+declare function normalizeTimeoutMs(value: number | undefined): number;
+declare function canonicalTimestamp(value: unknown): value is string;
+declare function canonicalProjectIdentity(projectBaseUrl: unknown): {
+    projectBaseUrl: string;
+    projectRef: string;
+} | null;
+declare function projectRefFromBaseUrl(projectBaseUrl: string): string;
+declare function resolveProjectIdentity(apiBaseUrl: string): {
+    projectBaseUrl: string;
+    projectRef: string;
+};
+declare function cacheMode(runtime: SupabaseRestRuntime): CacheMode;
+declare function sessionExpiresAtUtc(expiresAt: number | null): string | null;
+declare function assertSessionBinding(options: {
+    runtime: SupabaseRestRuntime;
+    session: ResolvedSupabaseUserSession;
+    projectBaseUrl: string;
+    apiKeyEmail: string;
+    now: Date;
+}): void;
+declare function currentUserFailureStatus(error: unknown): number | null;
+declare function declaredResponseBytes(response: {
+    headers: {
+        get(name: string): string | null;
+    };
+}): number | null;
+declare function readBoundedResponseText(response: {
+    body?: ReadableStream<Uint8Array> | null;
+    headers: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+}): Promise<string>;
+declare function fetchCurrentUser(options: {
+    projectBaseUrl: string;
+    publishableKey: string;
+    accessToken: string;
+    timeoutMs: number;
+    fetchImpl: FetchLike;
+}): Promise<{
+    userId: string;
+    email: string;
+}>;
+declare function requestFingerprint(projectRef: string): string;
+declare function responseFingerprint(options: {
+    projectRef: string;
+    userId: string;
+    displayEmail: string;
+}): string;
+declare function hasExactKeys(value: JsonObject, expected: readonly string[]): boolean;
+declare function isOneOf<T extends string>(value: unknown, values: readonly T[]): value is T;
+declare function isCanonicalToken(value: unknown): value is string;
+declare function isMaskedEmail(value: unknown): value is string;
+export declare function parseAuthIdentityReceipt(value: unknown): AuthIdentityReceipt;
+export declare function runAuthIdentityReceipt(options: RunAuthIdentityReceiptOptions): Promise<AuthIdentityReceipt>;
+export declare const __testInternals: {
+    MAX_RESPONSE_BYTES: number;
+    assertSessionBinding: typeof assertSessionBinding;
+    cacheMode: typeof cacheMode;
+    canonicalTimestamp: typeof canonicalTimestamp;
+    canonicalProjectIdentity: typeof canonicalProjectIdentity;
+    currentUserFailureStatus: typeof currentUserFailureStatus;
+    declaredResponseBytes: typeof declaredResponseBytes;
+    fetchCurrentUser: typeof fetchCurrentUser;
+    hasExactKeys: typeof hasExactKeys;
+    isCanonicalToken: typeof isCanonicalToken;
+    isCanonicalUuid: typeof isCanonicalUuid;
+    isMaskedEmail: typeof isMaskedEmail;
+    isOneOf: typeof isOneOf;
+    normalizeEmail: typeof normalizeEmail;
+    normalizeExpectation: typeof normalizeExpectation;
+    normalizeExpectedUserId: typeof normalizeExpectedUserId;
+    normalizeTimeoutMs: typeof normalizeTimeoutMs;
+    projectRefFromBaseUrl: typeof projectRefFromBaseUrl;
+    readBoundedResponseText: typeof readBoundedResponseText;
+    requestFingerprint: typeof requestFingerprint;
+    responseFingerprint: typeof responseFingerprint;
+    resolveProjectIdentity: typeof resolveProjectIdentity;
+    sessionExpiresAtUtc: typeof sessionExpiresAtUtc;
+    sha256Json: typeof sha256Json;
+    stableJsonValue: typeof stableJsonValue;
+    token: typeof token;
+};
+export {};