t44 0.2.0-rc.1

package/lib/crypto.ts

@@ -0,0 +1,53 @@
+
+import * as crypto from 'crypto'
+
+/**
+ * Encrypt a string using AES-256-GCM with a key derived from the private key
+ */
+export function encryptString(plaintext: string, privateKeyBase64: string): string {
+    // Derive a 32-byte symmetric key from the private key using SHA-256
+    const keyBytes = Buffer.from(privateKeyBase64, 'base64')
+    const symmetricKey = crypto.createHash('sha256').update(keyBytes).digest()
+    
+    // Generate a random IV
+    const iv = crypto.randomBytes(16)
+    
+    // Encrypt using AES-256-GCM
+    const cipher = crypto.createCipheriv('aes-256-gcm', symmetricKey, iv)
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final()
+    ])
+    const authTag = cipher.getAuthTag()
+    
+    // Combine IV + authTag + encrypted data and encode as base64
+    const combined = Buffer.concat([iv, authTag, encrypted])
+    return combined.toString('base64')
+}
+
+/**
+ * Decrypt a string using AES-256-GCM with a key derived from the private key
+ */
+export function decryptString(ciphertext: string, privateKeyBase64: string): string {
+    // Derive the same symmetric key from the private key
+    const keyBytes = Buffer.from(privateKeyBase64, 'base64')
+    const symmetricKey = crypto.createHash('sha256').update(keyBytes).digest()
+    
+    // Decode the combined data
+    const combined = Buffer.from(ciphertext, 'base64')
+    
+    // Extract IV (16 bytes), authTag (16 bytes), and encrypted data
+    const iv = combined.subarray(0, 16)
+    const authTag = combined.subarray(16, 32)
+    const encrypted = combined.subarray(32)
+    
+    // Decrypt using AES-256-GCM
+    const decipher = crypto.createDecipheriv('aes-256-gcm', symmetricKey, iv)
+    decipher.setAuthTag(authTag)
+    const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final()
+    ])
+    
+    return decrypted.toString('utf8')
+}

package/lib/openapi.ts

@@ -0,0 +1,132 @@
+
+import Ajv from 'ajv'
+import addFormats from 'ajv-formats'
+
+/**
+ * Convert OpenAPI schema to JSON Schema compatible format
+ */
+export function convertOpenApiToJsonSchema(obj: any, root: any, warnings: any[] = [], visited = new WeakSet()): any {
+    if (typeof obj !== 'object' || obj === null) return obj
+    if (visited.has(obj)) return obj
+    visited.add(obj)
+
+    if (obj.$ref) {
+        const refPath = obj.$ref.replace(/^#\//, '').split('/')
+        let resolved = root
+        for (const part of refPath) {
+            const decodedPart = part.replace(/~1/g, '/').replace(/~0/g, '~')
+            resolved = resolved?.[decodedPart]
+            if (!resolved) {
+                warnings.push({
+                    type: 'unresolved_reference',
+                    message: `Cannot resolve reference ${obj.$ref}, using permissive schema`,
+                    ref: obj.$ref
+                })
+                return {}
+            }
+        }
+        return convertOpenApiToJsonSchema(resolved, root, warnings, visited)
+    }
+
+    const result: any = Array.isArray(obj) ? [] : {}
+    for (const key in obj) {
+        if (key === 'nullable' && obj.nullable === true) {
+            if (obj.type) {
+                result.type = Array.isArray(obj.type) ? [...obj.type, 'null'] : [obj.type, 'null']
+            } else {
+                result.type = 'null'
+            }
+        } else if (key === 'example' || key === 'discriminator') {
+            continue
+        } else {
+            result[key] = convertOpenApiToJsonSchema(obj[key], root, warnings, visited)
+        }
+    }
+    return result
+}
+
+/**
+ * Create a configured AJV instance for OpenAPI/JSON Schema validation
+ */
+export function createAjvInstance(): Ajv {
+    const ajv = new Ajv({
+        allErrors: true,
+        strict: false,
+        validateFormats: true,
+        logger: false
+    })
+    addFormats(ajv)
+    return ajv
+}
+
+/**
+ * Validate data against a JSON Schema
+ */
+export function validateWithSchema(
+    schema: any,
+    data: any,
+    ajv?: Ajv
+): { valid: boolean; errors: any[] } {
+    const validator = ajv || createAjvInstance()
+    
+    let validate
+    try {
+        validate = validator.compile(schema)
+    } catch (error: any) {
+        return {
+            valid: false,
+            errors: [{
+                type: 'schema_compilation_failed',
+                message: `Schema compilation failed: ${error.message}`,
+                error: error.message
+            }]
+        }
+    }
+
+    if (!validate(data)) {
+        const validationErrors = validate.errors?.map(err => ({
+            path: err.instancePath || '/',
+            message: err.message,
+            params: err.params,
+            keyword: err.keyword,
+            schemaPath: err.schemaPath
+        })) || []
+
+        return {
+            valid: false,
+            errors: validationErrors
+        }
+    }
+
+    return { valid: true, errors: [] }
+}
+
+/**
+ * Validate a single value against a property schema
+ */
+export function validatePropertyValue(
+    propertySchema: any,
+    value: any,
+    propertyName: string
+): { valid: boolean; error?: string } {
+    // Build a minimal schema for the single property
+    const schema = {
+        type: 'object',
+        properties: {
+            [propertyName]: propertySchema
+        },
+        required: [propertyName]
+    }
+
+    const result = validateWithSchema(schema, { [propertyName]: value })
+    
+    if (!result.valid && result.errors.length > 0) {
+        const error = result.errors[0]
+        return {
+            valid: false,
+            error: error.message || `Invalid value for ${propertyName}`
+        }
+    }
+
+    return { valid: true }
+}

package/lib/ucan.ts

@@ -0,0 +1,137 @@
+
+import { ed25519 } from '@ucanto/principal';
+import * as Server from '@ucanto/server';
+
+
+export async function generateKeypair(): Promise<{ did: string; privateKey: string }> {
+    const principal = await ed25519.generate();
+    // The principal itself is a Uint8Array containing the private key
+    const privateKeyBytes = new Uint8Array(principal as any);
+    return {
+        did: principal.did(),
+        privateKey: Buffer.from(privateKeyBytes).toString('base64'),
+    };
+}
+
+/**
+ * Extract DID from a base64-encoded private key
+ * @param privateKeyBase64 - Base64-encoded private key
+ * @returns The DID string
+ */
+export function didForPrivateKey(privateKeyBase64: string): string {
+    const keyBytes = Buffer.from(privateKeyBase64, 'base64');
+    const principal = ed25519.decode(new Uint8Array(keyBytes));
+    return principal.did();
+}
+
+/**
+ * Issue a UCAN capability delegation
+ * @param options.issuerPrivateKey - Base64-encoded private key of the issuer
+ * @param options.audienceDID - DID of the audience (recipient)
+ * @param options.capabilities - Array of capabilities to delegate
+ * @param options.expiresIn - Expiration time in seconds from now (default: 1 year)
+ * @returns Base64-encoded UCAN token
+ */
+export async function issueCapability(options: {
+    issuerPrivateKey: string;
+    audienceDID: string;
+    capabilities: Array<{ with: string; can: string }>;
+    expiresIn?: number;
+}): Promise<string> {
+    // Decode the issuer's private key
+    const keyBytes = Buffer.from(options.issuerPrivateKey, 'base64');
+    const issuer = ed25519.decode(new Uint8Array(keyBytes));
+
+    // Parse the audience DID
+    const audience = ed25519.Verifier.parse(options.audienceDID);
+
+    const expiresIn = options.expiresIn || 365 * 24 * 60 * 60; // 1 year
+    const expiration = Math.floor(Date.now() / 1000) + expiresIn;
+
+    const delegation = await Server.delegate({
+        issuer,
+        audience,
+        capabilities: options.capabilities,
+        expiration,
+    });
+
+    const archive = await delegation.archive();
+    if (!archive.ok) {
+        throw new Error('Failed to archive delegation');
+    }
+    return Buffer.from(archive.ok).toString('base64');
+};
+
+/**
+ * Validate a UCAN capability delegation
+ * @param options.ucanToken - Base64-encoded UCAN token
+ * @param options.issuerDID - Expected DID of the issuer
+ * @param options.expectedCapability - Expected capability (optional)
+ * @returns Validation result with delegation details
+ */
+export async function validateCapability(options: {
+    ucanToken: string;
+    issuerDID: string;
+    expectedCapability?: { can: string };
+}): Promise<{
+    valid: boolean;
+    error?: string;
+    issuer?: string;
+    audience?: string;
+    capabilities?: Array<{ with: string; can: string }>;
+    expiration?: number;
+}> {
+    try {
+        // Parse the UCAN from the token
+        const carBytes = Buffer.from(options.ucanToken, 'base64');
+        const result: any = await Server.Delegation.extract(carBytes);
+        if (!result.ok) {
+            return {
+                valid: false,
+                error: `Failed to parse UCAN: ${result.error.message}`,
+            };
+        }
+        const delegation: any = result.ok;
+
+        // Basic validation: check expiration
+        const now = Math.floor(Date.now() / 1000);
+        if (delegation.expiration && delegation.expiration < now) {
+            return {
+                valid: false,
+                error: 'UCAN has expired',
+            };
+        }
+
+        // Verify issuer matches expected
+        if (delegation.issuer.did() !== options.issuerDID) {
+            return {
+                valid: false,
+                error: `UCAN not issued by expected issuer. Expected: ${options.issuerDID}, Got: ${delegation.issuer.did()}`,
+            };
+        }
+
+        // Validate capability if specified
+        if (options.expectedCapability) {
+            const capability = delegation.capabilities[0];
+            if (capability.can !== options.expectedCapability.can) {
+                return {
+                    valid: false,
+                    error: `Invalid capability: expected '${options.expectedCapability.can}', got '${capability.can}'`,
+                };
+            }
+        }
+
+        return {
+            valid: true,
+            issuer: delegation.issuer.did(),
+            audience: delegation.audience.did(),
+            capabilities: delegation.capabilities,
+            expiration: delegation.expiration,
+        };
+    } catch (error: any) {
+        return {
+            valid: false,
+            error: `Failed to validate UCAN: ${error.message}`,
+        };
+    }
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+    "name": "t44",
+    "version": "0.2.0-rc.1",
+    "license": "Apache-2.0",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Stream44/t44.git"
+    },
+    "type": "module",
+    "bin": {
+        "t44": "./bin/t44"
+    },
+    "exports": {
+        "./caps/WorkspaceConfig.v0": "./caps/WorkspaceConfig.v0.ts"
+    },
+    "dependencies": {
+        "js-yaml": "^4.1.0",
+        "commander": "^14.0.0",
+        "chalk": "^5.6.2",
+        "dotenv": "^17.2.3",
+        "fast-glob": "^3.3.3",
+        "inquirer": "^12.4.0",
+        "@ucanto/principal": "^9.0.3",
+        "@ucanto/server": "^11.0.3",
+        "t44": "^0.2.0-rc.1",
+        "@stream44.studio/encapsulate": "^0.2.0-rc.5"
+    },
+    "devDependencies": {
+        "@types/bun": "^1.3.4",
+        "@types/node": "^25.0.3",
+        "@types/js-yaml": "^4.0.9",
+        "bun-types": "^1.3.4",
+        "upload-to-bunny": "^2.1.0",
+        "axios": "^1.13.4",
+        "vercel": "^50.4.9",
+        "turbo": "^2.7.5"
+    },
+    "workspaces": [
+        "caps/providers/vercel.com"
+    ]
+}

package/structs/HomeRegistryConfig.v0.ts

@@ -0,0 +1,27 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                schema: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: {}
+                },
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityConfig.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/HomeRegistryConfig.v0'

package/structs/ProjectDeploymentConfig.v0.ts

@@ -0,0 +1,27 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                schema: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: {}
+                },
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityConfig.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/ProjectDeploymentConfig.v0'

package/structs/ProjectDeploymentFact.v0.ts

@@ -0,0 +1,110 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#t44/caps/OpenApiSchema.v0': {
+                as: 'schema',
+                options: {
+                    '#': {
+                        definitions: {
+                            'ProjectDeploymentStatus': {
+                                type: 'object',
+                                properties: {
+                                    projectName: {
+                                        type: 'string',
+                                        description: 'The name of the deployed project'
+                                    },
+                                    provider: {
+                                        type: 'string',
+                                        description: 'The deployment provider (e.g., vercel.com, bunny.net)'
+                                    },
+                                    status: {
+                                        type: 'string',
+                                        enum: ['READY', 'BUILDING', 'ERROR', 'DISABLED', 'UNKNOWN'],
+                                        description: 'Current deployment status'
+                                    },
+                                    publicUrl: {
+                                        type: 'string',
+                                        format: 'uri',
+                                        description: 'The public URL where the deployment is accessible'
+                                    },
+                                    createdAt: {
+                                        type: 'integer',
+                                        description: 'Timestamp when the deployment was created'
+                                    },
+                                    updatedAt: {
+                                        type: 'integer',
+                                        description: 'Timestamp when the deployment was last updated'
+                                    },
+                                    providerProjectId: {
+                                        type: 'string',
+                                        description: 'Provider-specific project identifier'
+                                    },
+                                    providerPortalUrl: {
+                                        type: 'string',
+                                        format: 'uri',
+                                        description: 'URL to the provider admin portal for this deployment'
+                                    },
+                                    usage: {
+                                        type: 'object',
+                                        properties: {
+                                            storageBytes: {
+                                                type: 'integer',
+                                                description: 'Storage used in bytes'
+                                            },
+                                            filesCount: {
+                                                type: 'integer',
+                                                description: 'Number of files stored'
+                                            },
+                                            bandwidthBytes: {
+                                                type: 'integer',
+                                                description: 'Bandwidth used in bytes (monthly)'
+                                            },
+                                            charges: {
+                                                type: 'number',
+                                                description: 'Monthly charges in USD'
+                                            }
+                                        },
+                                        description: 'Usage statistics for the deployment'
+                                    },
+                                    error: {
+                                        type: 'string',
+                                        description: 'Error message if status retrieval failed'
+                                    },
+                                    rawDefinitionFilepaths: {
+                                        type: 'array',
+                                        items: {
+                                            type: 'string'
+                                        },
+                                        description: 'Relative filepaths to the raw provider-specific definition files'
+                                    }
+                                },
+                                required: ['projectName', 'provider', 'rawDefinitionFilepaths']
+                            }
+                        }
+                    }
+                }
+            },
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                origin: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: 'workspace.foundation'
+                }
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityFact.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/ProjectDeploymentFact.v0'

package/structs/ProjectPublishingFact.v0.ts

@@ -0,0 +1,69 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#t44/caps/OpenApiSchema.v0': {
+                as: 'schema',
+                options: {
+                    '#': {
+                        definitions: {
+                            'ProjectPublishingStatus': {
+                                type: 'object',
+                                properties: {
+                                    projectName: {
+                                        type: 'string',
+                                        description: 'The name of the published project'
+                                    },
+                                    provider: {
+                                        type: 'string',
+                                        description: 'The publishing provider (e.g., github.com, git-scm.com, npmjs.com)'
+                                    },
+                                    status: {
+                                        type: 'string',
+                                        enum: ['READY', 'PUBLISHED', 'ERROR', 'SKIPPED', 'UNKNOWN'],
+                                        description: 'Current publishing status'
+                                    },
+                                    publicUrl: {
+                                        type: 'string',
+                                        format: 'uri',
+                                        description: 'The public URL where the published resource is accessible'
+                                    },
+                                    updatedAt: {
+                                        type: 'string',
+                                        format: 'date-time',
+                                        description: 'Timestamp when the publishing was last updated'
+                                    },
+                                    error: {
+                                        type: 'string',
+                                        description: 'Error message if publishing failed'
+                                    }
+                                },
+                                required: ['projectName', 'provider']
+                            }
+                        }
+                    }
+                }
+            },
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                origin: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: 'workspace.foundation'
+                }
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityFact.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/ProjectPublishingFact.v0'

package/structs/ProjectRackConfig.v0.ts

@@ -0,0 +1,27 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                schema: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: {}
+                },
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityConfig.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/ProjectRackConfig.v0'

package/structs/WorkspaceCliConfig.v0.ts

@@ -0,0 +1,27 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                schema: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: {}
+                },
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityConfig.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/WorkspaceCliConfig.v0'

package/structs/WorkspaceConfig.v0.ts

@@ -0,0 +1,27 @@
+
+export async function capsule({
+    encapsulate,
+    CapsulePropertyTypes,
+    makeImportStack
+}: any) {
+    return encapsulate({
+        '#@stream44.studio/encapsulate/spine-contracts/CapsuleSpineContract.v0': {
+            '#': {
+                capsuleName: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: capsule['#']
+                },
+                schema: {
+                    type: CapsulePropertyTypes.Literal,
+                    value: {}
+                },
+            }
+        }
+    }, {
+        extendsCapsule: 't44/caps/WorkspaceEntityConfig.v0',
+        importMeta: import.meta,
+        importStack: makeImportStack(),
+        capsuleName: capsule['#'],
+    })
+}
+capsule['#'] = 't44/structs/WorkspaceConfig.v0'