e2ee-client-backend 0.1.1

package/dist/index.d.ts

@@ -0,0 +1,408 @@
+interface CrudAdapter<TRemote, TId = string> {
+    create(input: TRemote): Promise<TRemote>;
+    delete(id: TId): Promise<void>;
+    getById(id: TId): Promise<TRemote | null>;
+    list(): Promise<TRemote[]>;
+    update(id: TId, input: TRemote): Promise<TRemote>;
+}
+interface GraphqlTransport {
+    mutate<TResult, TVariables = Record<string, unknown>>(document: unknown, variables?: TVariables): Promise<TResult>;
+    query<TResult, TVariables = Record<string, unknown>>(document: unknown, variables?: TVariables): Promise<TResult>;
+}
+type RestMethod = "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+interface RestRequest<TBody = unknown> {
+    body?: TBody;
+    headers?: Record<string, string>;
+    method: RestMethod;
+    path: string;
+    query?: Record<string, boolean | number | string | null | undefined>;
+}
+interface RestTransport {
+    request<TResult, TBody = unknown>(request: RestRequest<TBody>): Promise<TResult>;
+}
+
+type GraphqlOperationKind = "mutation" | "query";
+interface GraphqlExecutorInput<TVariables = Record<string, unknown>> {
+    document: unknown;
+    kind: GraphqlOperationKind;
+    variables?: TVariables;
+}
+type GraphqlExecutor = <TResult, TVariables = Record<string, unknown>>(input: GraphqlExecutorInput<TVariables>) => Promise<TResult>;
+declare class FunctionGraphqlTransport implements GraphqlTransport {
+    private readonly executor;
+    constructor(executor: GraphqlExecutor);
+    mutate<TResult, TVariables = Record<string, unknown>>(document: unknown, variables?: TVariables): Promise<TResult>;
+    query<TResult, TVariables = Record<string, unknown>>(document: unknown, variables?: TVariables): Promise<TResult>;
+}
+type VariablesFactory<TResult> = Record<string, unknown> | ((result?: TResult) => Record<string, unknown> | undefined);
+interface GraphqlCrudAdapterConfig<TRemote, TId = string> {
+    create?: {
+        buildVariables: (input: TRemote) => Record<string, unknown>;
+        document: unknown;
+        select: (result: unknown) => TRemote;
+    };
+    delete?: {
+        buildVariables: (id: TId) => Record<string, unknown>;
+        document: unknown;
+    };
+    getById?: {
+        buildVariables: (id: TId) => Record<string, unknown>;
+        document: unknown;
+        select: (result: unknown) => TRemote | null;
+    };
+    list?: {
+        document: unknown;
+        select: (result: unknown) => TRemote[];
+        variables?: VariablesFactory<TRemote[]>;
+    };
+    update?: {
+        buildVariables: (id: TId, input: TRemote) => Record<string, unknown>;
+        document: unknown;
+        select: (result: unknown) => TRemote;
+    };
+}
+declare class GraphqlCrudAdapter<TRemote, TId = string> implements CrudAdapter<TRemote, TId> {
+    private readonly transport;
+    private readonly config;
+    constructor(transport: GraphqlTransport, config: GraphqlCrudAdapterConfig<TRemote, TId>);
+    create(input: TRemote): Promise<TRemote>;
+    delete(id: TId): Promise<void>;
+    getById(id: TId): Promise<TRemote | null>;
+    list(): Promise<TRemote[]>;
+    update(id: TId, input: TRemote): Promise<TRemote>;
+}
+declare function createGraphqlTransport(executor: GraphqlExecutor): FunctionGraphqlTransport;
+
+interface FetchRestTransportOptions {
+    baseUrl: string;
+    defaultHeaders?: Record<string, string>;
+    fetch?: typeof fetch;
+}
+declare class FetchRestTransport implements RestTransport {
+    private readonly options;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(options: FetchRestTransportOptions);
+    request<TResult, TBody = unknown>(request: RestRequest<TBody>): Promise<TResult>;
+}
+interface RestCrudAdapterConfig<TRemote, TId = string> {
+    create?: {
+        path: string | (() => string);
+        select?: (result: unknown) => TRemote;
+        serialize?: (input: TRemote) => unknown;
+    };
+    delete?: {
+        path: (id: TId) => string;
+    };
+    getById?: {
+        path: (id: TId) => string;
+        select?: (result: unknown) => TRemote | null;
+    };
+    list?: {
+        path: string | (() => string);
+        query?: Record<string, boolean | number | string | null | undefined>;
+        select?: (result: unknown) => TRemote[];
+    };
+    update?: {
+        path: (id: TId) => string;
+        select?: (result: unknown) => TRemote;
+        serialize?: (input: TRemote) => unknown;
+    };
+}
+declare class RestCrudAdapter<TRemote, TId = string> implements CrudAdapter<TRemote, TId> {
+    private readonly transport;
+    private readonly config;
+    constructor(transport: RestTransport, config: RestCrudAdapterConfig<TRemote, TId>);
+    create(input: TRemote): Promise<TRemote>;
+    delete(id: TId): Promise<void>;
+    getById(id: TId): Promise<TRemote | null>;
+    list(): Promise<TRemote[]>;
+    update(id: TId, input: TRemote): Promise<TRemote>;
+}
+declare function createFetchRestTransport(options: FetchRestTransportOptions): FetchRestTransport;
+
+interface PasswordAuthResult<TUser> {
+    message?: string | null;
+    ok: boolean;
+    user?: TUser | null;
+}
+interface PasswordAuthAdapter<TUser> {
+    getKdfSalt(email: string): Promise<string>;
+    login(email: string, authKeyMaterialHex: string): Promise<PasswordAuthResult<TUser>>;
+    logout(): Promise<boolean | void>;
+    refresh(): Promise<PasswordAuthResult<TUser>>;
+    registerBegin(email: string): Promise<{
+        kdfSaltBase64: string;
+    }>;
+    registerComplete(email: string, authKeyMaterialHex: string): Promise<PasswordAuthResult<TUser>>;
+}
+interface PasswordAuthAttempt<TUser> {
+    kAuthHex: string;
+    kEnc: Uint8Array;
+    normalizedEmail: string;
+    result: PasswordAuthResult<TUser>;
+}
+declare function normalizeAuthEmail(email: string): string;
+declare class PasswordAuthClient<TUser> {
+    private readonly adapter;
+    constructor(adapter: PasswordAuthAdapter<TUser>);
+    beginRegistration(email: string): Promise<string>;
+    completeRegistrationWithPassword(email: string, password: string, kdfSaltBase64: string): Promise<PasswordAuthAttempt<TUser>>;
+    loginWithPassword(email: string, password: string): Promise<PasswordAuthAttempt<TUser>>;
+    logout(): Promise<boolean | void>;
+    refreshSession(): Promise<PasswordAuthResult<TUser>>;
+    registerWithPassword(email: string, password: string): Promise<PasswordAuthAttempt<TUser>>;
+}
+declare function createPasswordAuthClient<TUser>(adapter: PasswordAuthAdapter<TUser>): PasswordAuthClient<TUser>;
+
+interface CacheStore<TEntity, TId = string> {
+    clear(): void;
+    clearCollection(collectionName: string): void;
+    get(collectionName: string, id: TId): TEntity | null;
+    list(collectionName: string): TEntity[];
+    put(collectionName: string, id: TId, value: TEntity): void;
+    remove(collectionName: string, id: TId): void;
+}
+declare class LokiCacheStore<TEntity, TId = string> implements CacheStore<TEntity, TId> {
+    private readonly collections;
+    private readonly db;
+    clear(): void;
+    clearCollection(collectionName: string): void;
+    get(collectionName: string, id: TId): TEntity | null;
+    list(collectionName: string): TEntity[];
+    put(collectionName: string, id: TId, value: TEntity): void;
+    remove(collectionName: string, id: TId): void;
+    private ensureCollection;
+}
+declare function createLokiCacheStore<TEntity, TId = string>(): LokiCacheStore<TEntity, TId>;
+
+type EncryptionAlgorithmId = "aes-256-gcm" | "ml-kem-768-aes-256-gcm";
+type EncryptedFieldMetadata = Record<string, boolean | number | string | null>;
+interface EncryptedFieldValue {
+    version: 1;
+    algorithm: string;
+    ciphertextBase64: string;
+    nonceBase64?: string;
+    encapsulatedKeyCiphertextBase64?: string;
+    metadata?: EncryptedFieldMetadata;
+}
+interface EncryptionStrategy<TEncryptContext = unknown, TDecryptContext = TEncryptContext> {
+    readonly id: string;
+    encrypt(plaintext: Uint8Array, context: TEncryptContext): Promise<EncryptedFieldValue>;
+    decrypt(payload: EncryptedFieldValue, context: TDecryptContext): Promise<Uint8Array>;
+}
+declare function isEncryptedFieldValue(value: unknown): value is EncryptedFieldValue;
+
+interface LegacyEncryptedJsonBlob {
+    ciphertextBase64: string;
+    nonceBase64: string;
+}
+declare function decryptJsonFromLegacyBlob<TValue>(blob: LegacyEncryptedJsonBlob, key: Uint8Array): Promise<TValue>;
+declare function encryptedFieldToLegacyBlob(payload: EncryptedFieldValue): LegacyEncryptedJsonBlob;
+declare function encryptJsonToLegacyBlob<TValue>(value: TValue, key: Uint8Array): Promise<LegacyEncryptedJsonBlob>;
+declare function legacyBlobToEncryptedField(blob: LegacyEncryptedJsonBlob, algorithm?: string): EncryptedFieldValue;
+
+interface Aes256GcmContext {
+    additionalData?: Uint8Array;
+    key: Uint8Array;
+}
+declare class Aes256GcmStrategy implements EncryptionStrategy<Aes256GcmContext, Aes256GcmContext> {
+    readonly id = "aes-256-gcm";
+    readonly nonceLength = 12;
+    encrypt(plaintext: Uint8Array, context: Aes256GcmContext): Promise<{
+        version: 1;
+        algorithm: string;
+        ciphertextBase64: string;
+        nonceBase64: string;
+    }>;
+    decrypt(payload: {
+        ciphertextBase64: string;
+        nonceBase64?: string;
+    }, context: Aes256GcmContext): Promise<Uint8Array<ArrayBuffer>>;
+    private importKey;
+}
+declare function createAes256GcmStrategy(): Aes256GcmStrategy;
+
+declare const DEFAULT_SCRYPT_PARAMS: {
+    readonly N: number;
+    readonly r: 8;
+    readonly p: 1;
+    readonly dkLen: 32;
+    readonly maxmem: number;
+};
+declare function kdfSaltFromBase64(kdfSaltBase64: string): Uint8Array;
+declare function deriveAes256KeyFromPassword(password: string, salt: Uint8Array): Promise<Uint8Array>;
+declare function deriveAuthKeyMaterial(kEnc: Uint8Array): Uint8Array;
+declare function deriveClientKeyMaterial(password: string, kdfSaltBase64: string): Promise<{
+    kAuthHex: string;
+    kEnc: Uint8Array;
+}>;
+declare function authKeyMaterialHex(password: string, kdfSaltBase64: string): Promise<string>;
+
+interface MlKemAes256GcmEncryptContext {
+    additionalData?: Uint8Array;
+    recipientPublicKey: Uint8Array;
+}
+interface MlKemAes256GcmDecryptContext {
+    additionalData?: Uint8Array;
+    recipientPrivateKey: Uint8Array;
+}
+interface MlKemKeyPair {
+    privateKeySeed: Uint8Array;
+    publicKey: Uint8Array;
+}
+declare function generateMlKemKeyPair(): Promise<MlKemKeyPair>;
+declare class MlKemAes256GcmStrategy implements EncryptionStrategy<MlKemAes256GcmEncryptContext, MlKemAes256GcmDecryptContext> {
+    readonly id = "ml-kem-768-aes-256-gcm";
+    readonly nonceLength = 12;
+    encrypt(plaintext: Uint8Array, context: MlKemAes256GcmEncryptContext): Promise<{
+        version: 1;
+        algorithm: string;
+        ciphertextBase64: string;
+        nonceBase64: string;
+        encapsulatedKeyCiphertextBase64: string;
+        metadata: {
+            kem: string;
+        };
+    }>;
+    decrypt(payload: {
+        ciphertextBase64: string;
+        encapsulatedKeyCiphertextBase64?: string;
+        nonceBase64?: string;
+    }, context: MlKemAes256GcmDecryptContext): Promise<Uint8Array>;
+}
+declare function createMlKemAes256GcmStrategy(): MlKemAes256GcmStrategy;
+
+declare class StrategyRegistry {
+    private readonly strategies;
+    constructor(strategies?: EncryptionStrategy<any, any>[]);
+    register(strategy: EncryptionStrategy<any, any>): void;
+    get<TEncryptContext, TDecryptContext>(id: string): EncryptionStrategy<TEncryptContext, TDecryptContext>;
+    encrypt<TEncryptContext>(id: string, plaintext: Uint8Array, context: TEncryptContext): Promise<EncryptedFieldValue>;
+    decrypt<TDecryptContext>(payload: EncryptedFieldValue, context: TDecryptContext): Promise<Uint8Array>;
+}
+declare function createStrategyRegistry(...strategies: EncryptionStrategy<any, any>[]): StrategyRegistry;
+
+declare function toUint8Array(value: ArrayBuffer | ArrayBufferView): Uint8Array;
+declare function toArrayBuffer(value: ArrayBuffer | ArrayBufferView): ArrayBuffer;
+declare function bytesToBase64(value: ArrayBuffer | ArrayBufferView): string;
+declare function base64ToBytes(base64: string): Uint8Array;
+declare function utf8ToBytes(value: string): Uint8Array;
+declare function bytesToUtf8(value: ArrayBuffer | ArrayBufferView): string;
+
+interface ExternalE2eeApiProvider<TConfig, TSession, TProject, TTask, TProjectQuery = undefined, TTaskQuery = undefined> {
+    authenticate(config: TConfig): Promise<TSession>;
+    listProjects(config: TConfig, session: TSession, query?: TProjectQuery): Promise<TProject[]>;
+    listTasks(config: TConfig, session: TSession, query?: TTaskQuery): Promise<TTask[]>;
+    validateAccess?(config: TConfig, session: TSession): Promise<void>;
+}
+declare class ExternalE2eeApiClient<TConfig, TSession, TProject, TTask, TProjectQuery = undefined, TTaskQuery = undefined> {
+    private readonly provider;
+    constructor(provider: ExternalE2eeApiProvider<TConfig, TSession, TProject, TTask, TProjectQuery, TTaskQuery>);
+    authenticate(config: TConfig): Promise<TSession>;
+    ensureAccess(config: TConfig): Promise<void>;
+    listProjects(config: TConfig, query?: TProjectQuery): Promise<TProject[]>;
+    listTasks(config: TConfig, query?: TTaskQuery): Promise<TTask[]>;
+}
+declare function createExternalE2eeApiClient<TConfig, TSession, TProject, TTask, TProjectQuery = undefined, TTaskQuery = undefined>(provider: ExternalE2eeApiProvider<TConfig, TSession, TProject, TTask, TProjectQuery, TTaskQuery>): ExternalE2eeApiClient<TConfig, TSession, TProject, TTask, TProjectQuery, TTaskQuery>;
+
+interface FieldPolicy<TEntity, TRemote> {
+    deserialize?: (value: unknown, remote: TRemote) => unknown;
+    encrypted?: boolean;
+    entityPath: string;
+    remotePath?: string;
+    serialize?: (value: unknown, entity: TEntity) => unknown;
+    strategyId?: string;
+}
+interface EntitySchema<TEntity, TRemote, TId = string> {
+    cacheCollection?: string;
+    createEntity(remote: TRemote): TEntity;
+    createRemote(entity: TEntity): TRemote;
+    defaultStrategyId?: string;
+    fields: FieldPolicy<TEntity, TRemote>[];
+    idPath?: string;
+    name: string;
+}
+interface StrategyContextResolver<TEntity, TRemote> {
+    resolve(args: {
+        entity?: TEntity;
+        field: FieldPolicy<TEntity, TRemote>;
+        payload?: EncryptedFieldValue;
+        phase: "decrypt" | "encrypt";
+        remote?: TRemote;
+        schema: EntitySchema<TEntity, TRemote, any>;
+    }): Promise<unknown>;
+}
+interface RepositoryReadOptions {
+    cacheMode?: "cache-first" | "network-first" | "no-cache";
+}
+interface EntityRepositoryOptions<TEntity, TRemote, TId = string> {
+    adapter: CrudAdapter<TRemote, TId>;
+    cache?: CacheStore<TEntity, TId>;
+    contextResolver: StrategyContextResolver<TEntity, TRemote>;
+    schema: EntitySchema<TEntity, TRemote, TId>;
+    strategies: StrategyRegistry;
+}
+declare class EntityRepository<TEntity, TRemote, TId = string> {
+    private readonly options;
+    private readonly cacheCollection;
+    private readonly idPath;
+    constructor(options: EntityRepositoryOptions<TEntity, TRemote, TId>);
+    create(entity: TEntity): Promise<TEntity>;
+    delete(id: TId): Promise<void>;
+    getById(id: TId, options?: RepositoryReadOptions): Promise<TEntity | null>;
+    list(options?: RepositoryReadOptions): Promise<TEntity[]>;
+    update(id: TId, entity: TEntity): Promise<TEntity>;
+    private hydrateRemote;
+    private resolveEntityId;
+    private hydrateField;
+    private serializeEntity;
+}
+declare function createEntityRepository<TEntity, TRemote, TId = string>(options: EntityRepositoryOptions<TEntity, TRemote, TId>): EntityRepository<TEntity, TRemote, TId>;
+
+interface DashboardEntity<TConfig = Record<string, unknown>> {
+    config: TConfig | null;
+    createdAt: string;
+    id: string;
+    name: string;
+    updatedAt: string;
+}
+interface DashboardRemoteRecord<TConfig = Record<string, unknown>> {
+    configEnvelope: EncryptedFieldValue | TConfig | null;
+    createdAt: string;
+    id: string;
+    name: string;
+    updatedAt: string;
+}
+declare function createDashboardSchema<TConfig = Record<string, unknown>>(strategyId?: string): EntitySchema<DashboardEntity<TConfig>, DashboardRemoteRecord<TConfig>, string>;
+
+type IntegrationRemoteFieldValue = EncryptedFieldValue | string | null;
+interface IntegrationEntity {
+    apiUrl: string;
+    authHash: string | null;
+    credentialMode: string;
+    displayName: string;
+    encryptionKey: string | null;
+    id: string;
+    lastSyncedAt: string | null;
+    provider: string;
+    providerSecret: string | null;
+    status: string;
+    username: string;
+}
+interface IntegrationRemoteRecord {
+    apiUrl: string;
+    authHash: IntegrationRemoteFieldValue;
+    credentialMode: string;
+    displayName: string;
+    encryptionKey: IntegrationRemoteFieldValue;
+    id: string;
+    lastSyncedAt: string | null;
+    provider: string;
+    providerSecret: IntegrationRemoteFieldValue;
+    status: string;
+    username: string;
+}
+declare function createIntegrationSchema(strategyId?: string): EntitySchema<IntegrationEntity, IntegrationRemoteRecord, string>;
+
+export { type Aes256GcmContext, Aes256GcmStrategy, type CacheStore, type CrudAdapter, DEFAULT_SCRYPT_PARAMS, type DashboardEntity, type DashboardRemoteRecord, type EncryptedFieldMetadata, type EncryptedFieldValue, type EncryptionAlgorithmId, type EncryptionStrategy, EntityRepository, type EntityRepositoryOptions, type EntitySchema, ExternalE2eeApiClient, type ExternalE2eeApiProvider, FetchRestTransport, type FetchRestTransportOptions, type FieldPolicy, FunctionGraphqlTransport, GraphqlCrudAdapter, type GraphqlCrudAdapterConfig, type GraphqlExecutor, type GraphqlExecutorInput, type GraphqlOperationKind, type GraphqlTransport, type IntegrationEntity, type IntegrationRemoteRecord, type LegacyEncryptedJsonBlob, LokiCacheStore, type MlKemAes256GcmDecryptContext, type MlKemAes256GcmEncryptContext, MlKemAes256GcmStrategy, type MlKemKeyPair, type PasswordAuthAdapter, type PasswordAuthAttempt, PasswordAuthClient, type PasswordAuthResult, type RepositoryReadOptions, RestCrudAdapter, type RestCrudAdapterConfig, type RestMethod, type RestRequest, type RestTransport, type StrategyContextResolver, StrategyRegistry, authKeyMaterialHex, base64ToBytes, bytesToBase64, bytesToUtf8, createAes256GcmStrategy, createDashboardSchema, createEntityRepository, createExternalE2eeApiClient, createFetchRestTransport, createGraphqlTransport, createIntegrationSchema, createLokiCacheStore, createMlKemAes256GcmStrategy, createPasswordAuthClient, createStrategyRegistry, decryptJsonFromLegacyBlob, deriveAes256KeyFromPassword, deriveAuthKeyMaterial, deriveClientKeyMaterial, encryptJsonToLegacyBlob, encryptedFieldToLegacyBlob, generateMlKemKeyPair, isEncryptedFieldValue, kdfSaltFromBase64, legacyBlobToEncryptedField, normalizeAuthEmail, toArrayBuffer, toUint8Array, utf8ToBytes };