@tinycloud/courier 0.0.0-stage → 0.1.0-beta.1

package/dist/authority.js

@@ -0,0 +1,99 @@
+import { extractSiweExpiration } from '@tinycloud/node-sdk';
+import { CourierError } from './errors.js';
+import { AGENT_GRANT, AGENT_GRANT_EXPIRY, peerReadPermissions } from './keys.js';
+import { PEER_DELEGATION_EXPIRY } from './pairing.js';
+const DAY_MS = 24 * 3600 * 1000;
+/** `30d`/`7d`/`1h` → ms; undefined when not `<int><s|m|h|d>`. */
+export function durationMs(value) {
+    const match = /^(\d+)([smhd])$/.exec(value);
+    if (!match)
+        return undefined;
+    const factor = { s: 1000, m: 60_000, h: 3_600_000, d: DAY_MS }[match[2]];
+    const duration = Number(match[1]) * factor;
+    return Number.isFinite(duration) ? duration : undefined;
+}
+export const AGENT_GRANT_MAX_MS = durationMs(AGENT_GRANT_EXPIRY);
+export const PEER_DELEGATION_MAX_MS = durationMs(PEER_DELEGATION_EXPIRY);
+export const CLOCK_SKEW_MS = 5 * 60 * 1000;
+export function bareDid(did) {
+    return did.split('#', 1)[0];
+}
+function authorityTuples(entries) {
+    const tuples = new Map();
+    for (const entry of entries) {
+        for (const action of entry.actions) {
+            const tuple = { service: entry.service, space: (entry.space ?? '').toLowerCase(), path: entry.path, action };
+            tuples.set(JSON.stringify([tuple.service, tuple.space, tuple.path, tuple.action]), tuple);
+        }
+    }
+    return tuples;
+}
+function renderTuples(tuples) {
+    const shown = tuples.slice(0, 3).map(({ service, space, path, action }) => `${service} ${space} ${path || '""'} ${action}`);
+    if (tuples.length > 3)
+        shown.push(`(+${tuples.length - 3} more)`);
+    return shown.join('; ');
+}
+/** Require the complete effective authority to equal an explicit allowlist. */
+export function assertExactAuthority(signed, allowed, label) {
+    const signedTuples = authorityTuples(signed);
+    const allowedTuples = authorityTuples(allowed);
+    const extra = [...signedTuples].filter(([tuple]) => !allowedTuples.has(tuple)).map(([, value]) => value);
+    if (extra.length) {
+        throw new CourierError('grant-too-broad', `${label} carries authority Courier does not allow: ${renderTuples(extra)}`);
+    }
+    const missing = [...allowedTuples].filter(([tuple]) => !signedTuples.has(tuple)).map(([, value]) => value);
+    if (missing.length) {
+        throw new CourierError('grant-incomplete', `${label} is missing ${renderTuples(missing)}`);
+    }
+}
+function formatDays(ms) {
+    const days = (ms / DAY_MS).toFixed(2).replace(/\.?0+$/, '');
+    return `${days} days`;
+}
+export function assertLifetime(label, expiresAt, maxMs, now, issuedAt) {
+    if (!expiresAt || !Number.isFinite(expiresAt.getTime())) {
+        throw new CourierError('bad-grant', `${label} has no signed expiry.`);
+    }
+    const expiry = expiresAt.getTime();
+    if (expiry <= now)
+        throw new CourierError('grant-expired', `${label} has expired.`);
+    if (issuedAt !== undefined) {
+        const issued = issuedAt.getTime();
+        if (!Number.isFinite(issued) || issued > now + CLOCK_SKEW_MS) {
+            throw new CourierError('bad-grant', `${label} was issued in the future or has an invalid Issued At.`);
+        }
+        if (expiry - issued > maxMs + CLOCK_SKEW_MS) {
+            throw new CourierError('grant-too-long', `${label} is valid for ${formatDays(expiry - issued)}; Courier accepts at most ${formatDays(maxMs).replace(/ days$/, '')}.`);
+        }
+    }
+    if (expiry - now > maxMs + CLOCK_SKEW_MS) {
+        throw new CourierError('grant-too-long', `${label} is valid for ${formatDays(expiry - now)}; Courier accepts at most ${formatDays(maxMs).replace(/ days$/, '')}.`);
+    }
+}
+export function siweTimes(siwe) {
+    const issued = /^Issued At:\s*(.+)$/m.exec(siwe)?.[1];
+    const expiresAt = extractSiweExpiration(siwe);
+    return {
+        ...(issued !== undefined ? { issuedAt: new Date(issued.trim()) } : {}),
+        ...(expiresAt ? { expiresAt } : {}),
+    };
+}
+export function assertAgentGrant(caps, times, now = Date.now()) {
+    assertExactAuthority(caps, AGENT_GRANT, 'OpenKey grant');
+    if (!times.issuedAt)
+        throw new CourierError('bad-grant', 'OpenKey grant SIWE is missing Issued At.');
+    assertLifetime('OpenKey grant', times.expiresAt, AGENT_GRANT_MAX_MS, now, times.issuedAt);
+}
+export function assertPeerDelegation(active, expected, now = Date.now()) {
+    const issuer = bareDid(active.delegation.delegatorDID ?? '');
+    if (issuer !== expected.issuer) {
+        throw new CourierError('bad-delegation', `Peer delegation is signed by ${issuer || 'an unknown issuer'}, not the advertised courier ${expected.issuer}.`);
+    }
+    if (bareDid(active.audience) !== expected.audience) {
+        throw new CourierError('bad-delegation', `Peer delegation audience ${active.audience} does not match ${expected.audience}.`);
+    }
+    assertExactAuthority(active.effectivePermissions, peerReadPermissions(expected.mailbox, expected.spaceId), 'Peer delegation');
+    assertLifetime('Peer delegation', active.expiry, PEER_DELEGATION_MAX_MS, now);
+}
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhC,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAA0B,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAE,CAAC;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,sBAAsB,CAAE,CAAC;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AASD,SAAS,eAAe,CAAC,OAAmC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7G,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,MAAkC,EAAE,OAAmC,EAAE,KAAa;IACzH,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,8CAA8C,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,KAAK,eAAe,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,IAAI,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,GAAG,IAAI,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,SAA2B,EAAE,KAAa,EAAE,GAAW,EAAE,QAAe;IACpH,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IACpF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;YAC7D,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,GAAG,KAAK,wDAAwD,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC;YAC5C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,GAAG,KAAK,iBAAiB,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,6BAA6B,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACxK,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,GAAG,KAAK,iBAAiB,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,6BAA6B,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrK,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAgC,EAAE,KAA4C,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/H,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACrG,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5F,CAAC;AAgBD,MAAM,UAAU,oBAAoB,CAAC,MAA4B,EAAE,QAAgC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACnH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,gCAAgC,MAAM,IAAI,mBAAmB,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,4BAA4B,MAAM,CAAC,QAAQ,mBAAmB,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,oBAAoB,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC9H,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;AAChF,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { main } from './main.js';
+const code = await main(process.argv.slice(2));
+if (code !== 0)
+    process.exit(code);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,IAAI,IAAI,KAAK,CAAC;IAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,20 @@
+import type { ParsedArgs } from './args.js';
+export declare function cmdInit(args: ParsedArgs): Promise<void>;
+export declare function cmdManifest(): void;
+export declare function cmdPair(args: ParsedArgs): Promise<void>;
+export declare function cmdRevoke(args: ParsedArgs): Promise<void>;
+export declare function cmdSend(args: ParsedArgs): Promise<void>;
+export declare function cmdInbox(args: ParsedArgs): Promise<void>;
+export interface ThreadEntry {
+    kind: 'meta' | 'msg' | 'task';
+    id: string;
+    side: 'me' | 'peer';
+    authority: 'self' | 'counterparty';
+    body: unknown;
+    invalid?: string[];
+}
+export declare function cmdRead(args: ParsedArgs): Promise<void>;
+export declare function renderThreadText(threadId: string, entries: readonly ThreadEntry[]): string;
+export declare function cmdTask(args: ParsedArgs): Promise<void>;
+export declare function cmdRequest(args: ParsedArgs): Promise<void>;
+export declare function cmdOrders(args: ParsedArgs): Promise<void>;