@vinaverse/server 0.0.0-stage → 0.1.0-alpha.1

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing.ts"],"names":[],"mappings":";;;;AAmBA,eAAsB,YACpB,OAAA,EACiB;AACjB,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,SAAA,wBAAiB,IAAA,EAAK,EAAG,OAAA,EAAQ,GAAI,GAAI,CAAA;AACvE,EAAA,MAAM,IAAA,GACJ,OAAO,OAAA,CAAQ,IAAA,KAAS,WAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAA,CAAQ,IAAA;AAClE,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,IAAI,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAClC,EAAA,MAAM,OAAA,GACJ,OAAO,OAAA,CAAQ,MAAA,KAAW,WAAW,CAAC,OAAA,CAAQ,MAAM,CAAA,GAAI,OAAA,CAAQ,MAAA;AAClE,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACvB,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAM,OAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAC,CAAA;AAClE,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,GAAA,EAAM,UAAA,CAAW,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAmBA,eAAsB,aACpB,OAAA,EACiB;AACjB,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAA,CAAO,OAAA,CAAQ,SAAA,wBAAiB,IAAA,EAAK,EAAG,OAAA,EAAQ,GAAI,GAAI,CAAA;AACvE,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,KAAA,IAAU,MAAM,UAAA,EAAW;AAC7C,EAAA,MAAM,IAAA,GACJ,OAAO,OAAA,CAAQ,IAAA,KAAS,WAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,GAAI,OAAA,CAAQ,IAAA;AAClE,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB;AAAA,IACtC,CAAA;AAAA,IACA,CAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAClC,EAAA,MAAM,OAAA,GACJ,OAAO,OAAA,CAAQ,MAAA,KAAW,WAAW,CAAC,OAAA,CAAQ,MAAM,CAAA,GAAI,OAAA,CAAQ,MAAA;AAClE,EAAA,MAAM,QAAQ,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAA,EAAI,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACjC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA;AACxC,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA,GAAA,EAAM,UAAA,CAAW,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAAA,KAC3E;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAEA,eAAe,UAAA,GAA8B;AAC3C,EAAA,MAAM,MAAA,GAAA,CAAU,MAAM,SAAA,EAAU,EAAG,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACrE,EAAA,OAAO,KAAK,MAAA,CAAO,YAAA,CAAa,GAAG,MAAM,CAAC,CAAA,CACvC,UAAA,CAAW,GAAA,EAAK,GAAG,EACnB,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CACnB,UAAA,CAAW,KAAK,EAAE,CAAA;AACvB","file":"testing.js","sourcesContent":["// For the tenant's own tests: sign a body the way Vinaverse does, so a test can\n// deliver a webhook to its route without the Vinaverse API.\n//\n//   import { signWebhook } from '@vinaverse/server/testing';\n//   const header = await signWebhook({ body, secret });\nimport { bytesToHex, concat, hmacKey, utf8 } from './internal/bytes.js';\nimport { toolSigningString } from './tools/signature.js';\nimport { subtleCrypto, webCrypto } from './webhooks/crypto.js';\n\nexport interface SignWebhookOptions {\n  /** The exact body to send. */\n  body: string | Uint8Array;\n  /** One signing secret, or several (one `v1` each, as during a rotation). */\n  secret: string | readonly string[];\n  /** The signature's time; default now. */\n  timestamp?: Date;\n}\n\n/** The `Vinaverse-Signature` header value for `body`. */\nexport async function signWebhook(\n  options: SignWebhookOptions,\n): Promise<string> {\n  const t = Math.floor((options.timestamp ?? new Date()).getTime() / 1000);\n  const body =\n    typeof options.body === 'string' ? utf8(options.body) : options.body;\n  const message = concat(utf8(`${t}.`), body);\n  const subtle = await subtleCrypto();\n  const secrets =\n    typeof options.secret === 'string' ? [options.secret] : options.secret;\n  const parts = [`t=${t}`];\n  for (const secret of secrets) {\n    const key = await hmacKey(secret, 'sign');\n    const mac = new Uint8Array(await subtle.sign('HMAC', key, message));\n    parts.push(`v1=${bytesToHex(mac)}`);\n  }\n  return parts.join(',');\n}\n\nexport interface SignToolCallOptions {\n  /** The tool signing secret, or several (one `v2` each, as during a rotation). */\n  secret: string | readonly string[];\n  method: string;\n  /** The request target as it will be sent: path and query, percent-escaped. */\n  target: string;\n  /** The session's delegated token. */\n  token: string;\n  /** The exact body, if any. */\n  body?: string | Uint8Array | undefined;\n  /** The signature's time; default now. */\n  timestamp?: Date;\n  /** The nonce; default a fresh one (32 URL-safe characters). */\n  nonce?: string;\n}\n\n/** The `Vinaverse-Signature` value (signature v2) Vinaverse would send with this tool call. */\nexport async function signToolCall(\n  options: SignToolCallOptions,\n): Promise<string> {\n  const t = Math.floor((options.timestamp ?? new Date()).getTime() / 1000);\n  const n = options.nonce ?? (await freshNonce());\n  const body =\n    typeof options.body === 'string' ? utf8(options.body) : options.body;\n  const message = await toolSigningString({\n    t,\n    n,\n    method: options.method,\n    target: options.target,\n    token: options.token,\n    body,\n  });\n  const subtle = await subtleCrypto();\n  const secrets =\n    typeof options.secret === 'string' ? [options.secret] : options.secret;\n  const parts = [`t=${t}`, `n=${n}`];\n  for (const secret of secrets) {\n    const key = await hmacKey(secret, 'sign');\n    parts.push(\n      `v2=${bytesToHex(new Uint8Array(await subtle.sign('HMAC', key, message)))}`,\n    );\n  }\n  return parts.join(',');\n}\n\nasync function freshNonce(): Promise<string> {\n  const random = (await webCrypto()).getRandomValues(new Uint8Array(24));\n  return btoa(String.fromCharCode(...random))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n}\n"]}