@abloatai/transaction 0.37.0

package/dist/auth/index.js

@@ -0,0 +1,312 @@
+/**
+ * Exchanges an API key for a capability token and the scope it grants.
+ *
+ * The `Ablo({...})` factory calls this during startup when you provide an
+ * `apiKey` but no explicit capability token, organization, or user identity. It
+ * sends one `POST /v1/capabilities` request; the server responds with the
+ * granted scope and any user metadata, which the client uses to populate its
+ * session state. The API key is the only credential you handle directly — this
+ * exchange happens automatically behind it.
+ */
+import { parseCapabilityMintResponse, parseEphemeralKeyResponse, parseIdentityResolveResponse, } from './schemas.js';
+import { AbloAuthenticationError, hasWireCode, translateHttpError } from '../errors.js';
+export { ABLO_DEFAULT_BASE_URL, ABLO_HOSTED_API_DOMAIN, ABLO_HOSTED_HTTP_BASE_URL, } from './hostedEndpoints.js';
+export { normalizeAbloHostedBaseUrl } from './apiKey.js';
+export { parseCapabilityMintResponse } from './schemas.js';
+export { credentialEndpointErrorSchema, credentialEndpointKindSchema, credentialEndpointSuccessSchema, credentialEndpointErrorCode, parseCredentialEndpointSuccess, } from './credentialEndpointProtocol.js';
+export { capabilityRotationRequestSchema, capabilityRotationResponseSchema, sessionRevocationResponseSchema, revokeCapability, rotateCapability, } from './capabilityLifecycle.js';
+// The capability vocabulary — what a grant is, on both axes, in one place.
+// Served from this barrel so every minter reaches it through one import.
+export { capabilityOperationSchema, capabilityCanSchema, capabilityCanSchemaFor, capabilityScopeSchema, capabilityRequestSchema, capabilityMintResponseSchema, grantedOperationSchema, grantedOperations, expandReadYourWrites, modelWireNames, capabilityModelAliases, unresolvableOperations, } from './capability.js';
+export async function exchangeApiKey(options) {
+    if (!options.apiKey) {
+        throw new AbloAuthenticationError('No API key found. Set ABLO_API_KEY in your environment — `npx ablo login` ' +
+            'then `npx ablo dev` writes it into .env.local for you — or pass ' +
+            '`apiKey` to Ablo({ ... }) directly.', { code: 'apikey_missing' });
+    }
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for capability exchange', { code: 'base_url_missing' });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/v1/capabilities`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            body: JSON.stringify({
+                participantKind: options.participantKind,
+                ...(options.participantId ? { participantId: options.participantId } : {}),
+                ...(options.organizationId ? { organizationId: options.organizationId } : {}),
+                syncGroups: options.syncGroups,
+                operations: options.operations,
+                wideScope: options.wideScope,
+                ttlSeconds: options.ttlSeconds,
+                label: options.label,
+                userMeta: options.userMeta,
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`apiKey exchange failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'exchange_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore — server returned non-JSON error
+        }
+        // Route the error through the wire-error translator so the server's envelope
+        // (`code`, `message`, `doc_url`) is preserved and mapped to the matching
+        // AbloError subclass. Fall back to `exchange_failed` only when the body
+        // carried no recognizable error code.
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`apiKey exchange rejected (${response.status})`, { code: 'exchange_failed', httpStatus: response.status });
+    }
+    return parseCapabilityMintResponse(await response.json());
+}
+/**
+ * Mints an end-user session key (an `ek_` key) by calling
+ * `POST /v1/ephemeral_keys`, using your secret key as authorization. Your
+ * backend calls this to issue a session that a browser can present as its bearer
+ * credential; the server trusts the resulting key because a secret key minted it.
+ *
+ * This is a distinct endpoint from `/v1/capabilities`, which exchanges keys for
+ * agents and systems and cannot mint sessions for human users.
+ */
+export async function mintUserSessionKey(options) {
+    if (!options.apiKey) {
+        throw new AbloAuthenticationError('No API key found. Set ABLO_API_KEY in your environment or pass `apiKey` ' +
+            'to Ablo({ ... }) directly — user sessions are minted by your backend.', { code: 'apikey_missing' });
+    }
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for user-session mint', { code: 'base_url_missing' });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/v1/ephemeral_keys`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        response = await fetcher(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${options.apiKey}`,
+            },
+            body: JSON.stringify({
+                user: { id: options.userId },
+                ...(options.organizationId ? { organizationId: options.organizationId } : {}),
+                // The public option is project-centric; map it to the flat wire keys the
+                // endpoint expects.
+                ...(options.schemaProject
+                    ? {
+                        schemaProjectId: options.schemaProject.projectId,
+                        schemaOwnerOrgId: options.schemaProject.organizationId,
+                    }
+                    : {}),
+                ...(options.syncGroups ? { syncGroups: options.syncGroups } : {}),
+                operations: options.operations,
+                ttlSeconds: options.ttlSeconds,
+                ...(options.label ? { label: options.label } : {}),
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`user-session mint failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'exchange_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore — server returned non-JSON error
+        }
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`user-session mint rejected (${response.status})`, { code: 'exchange_failed', httpStatus: response.status });
+    }
+    return parseEphemeralKeyResponse(await response.json());
+}
+/**
+ * Resolves the caller's identity from an authenticated request by calling
+ * `GET /auth/identity`. This lets browser and session flows learn who the
+ * current user is without requiring the application to pass a user id up front —
+ * for example, to key local storage.
+ */
+export async function resolveIdentity(options) {
+    if (!options.baseUrl) {
+        throw new AbloAuthenticationError('baseUrl is required for identity resolve', {
+            code: 'base_url_missing',
+        });
+    }
+    const fetcher = options.fetch ?? fetch;
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/auth/identity`;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    let response;
+    try {
+        const headers = { Accept: 'application/json' };
+        if (options.authToken) {
+            headers.Authorization = `Bearer ${options.authToken}`;
+        }
+        response = await fetcher(url, {
+            method: 'GET',
+            headers,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        throw new AbloAuthenticationError(`identity resolve failed: ${err instanceof Error ? err.message : String(err)}`, { code: 'identity_network_error', cause: err });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // ignore non-JSON auth errors
+        }
+        // Translate the error envelope the same way `exchangeApiKey` does, so the
+        // server's precise auth diagnosis (for example `jwt_issuer_untrusted` with
+        // its full message) reaches the caller instead of collapsing every 401 to a
+        // generic `identity_resolve_failed`.
+        const requestId = response.headers.get('x-request-id') ?? undefined;
+        throw hasWireCode(body)
+            ? translateHttpError(response.status, body, requestId)
+            : new AbloAuthenticationError(`identity resolve rejected (${response.status})`, { code: 'identity_resolve_failed', httpStatus: response.status });
+    }
+    return parseIdentityResolveResponse(await response.json());
+}
+const DEFAULT_BUFFER_FLOOR_MS = 60_000;
+const DEFAULT_BUFFER_RATIO = 0.1;
+export function createRefreshScheduler(options) {
+    const now = options.now ?? Date.now;
+    const setTimer = options.setTimer ?? setTimeout;
+    const clearTimer = options.clearTimer ?? clearTimeout;
+    let expiresAtMs = options.initialExpiresAtMs;
+    let timer = null;
+    let inFlight = null;
+    let disposed = false;
+    // Attach the visibility listener only in a browser-like environment. A
+    // non-browser runtime has no `document`, so the default behaves correctly
+    // without an explicit opt-out.
+    const wantsVisibility = options.attachVisibilityListener ?? true;
+    const hasDocument = typeof document !== 'undefined';
+    const visibilityActive = wantsVisibility && hasDocument;
+    function bufferFor(currentExpiresAtMs) {
+        if (typeof options.bufferMs === 'number')
+            return options.bufferMs;
+        const ttl = currentExpiresAtMs - now();
+        return Math.max(DEFAULT_BUFFER_FLOOR_MS, Math.floor(ttl * DEFAULT_BUFFER_RATIO));
+    }
+    function clearTimerIfAny() {
+        if (timer !== null) {
+            clearTimer(timer);
+            timer = null;
+        }
+    }
+    function schedule() {
+        if (disposed)
+            return;
+        clearTimerIfAny();
+        const buffer = bufferFor(expiresAtMs);
+        const delay = Math.max(0, expiresAtMs - buffer - now());
+        timer = setTimer(() => {
+            void refreshNow().catch(() => {
+                // onError already fired inside refreshNow; swallow here so
+                // the timer callback doesn't surface as an unhandled rejection.
+            });
+        }, delay);
+    }
+    function refreshNow() {
+        if (disposed) {
+            return Promise.reject(new Error('refreshScheduler: disposed'));
+        }
+        if (inFlight)
+            return inFlight;
+        inFlight = (async () => {
+            try {
+                const result = await options.refresh();
+                if (disposed)
+                    return result;
+                expiresAtMs = result.expiresAtMs;
+                options.onRefreshed?.({ expiresAtMs });
+                schedule();
+                return result;
+            }
+            catch (err) {
+                const error = err instanceof Error ? err : new Error(String(err));
+                options.onError?.(error);
+                // Reschedule even on failure so the next window still triggers.
+                // The user's apiKey may have been temporarily unreachable.
+                if (!disposed)
+                    schedule();
+                throw error;
+            }
+            finally {
+                inFlight = null;
+            }
+        })();
+        return inFlight;
+    }
+    function onVisibilityChange() {
+        if (disposed)
+            return;
+        if (typeof document === 'undefined')
+            return;
+        if (document.visibilityState !== 'visible')
+            return;
+        const buffer = bufferFor(expiresAtMs);
+        if (expiresAtMs - now() <= buffer) {
+            void refreshNow().catch(() => {
+                // already routed through onError
+            });
+        }
+    }
+    if (visibilityActive) {
+        document.addEventListener('visibilitychange', onVisibilityChange);
+    }
+    schedule();
+    return {
+        refreshNow,
+        dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            clearTimerIfAny();
+            if (visibilityActive) {
+                document.removeEventListener('visibilitychange', onVisibilityChange);
+            }
+        },
+        get expiresAtMs() {
+            return expiresAtMs;
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAGL,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAMxF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAazD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AASzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,EAChC,+BAA+B,EAC/B,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAMlC,2EAA2E;AAC3E,yEAAyE;AACzE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAoCzB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,4EAA4E;YAC1E,kEAAkE;YAClE,qCAAqC,EACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,EAC7C,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aAC1C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,6BAA6B,QAAQ,CAAC,MAAM,GAAG,EAC/C,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACzD,CAAC;IACR,CAAC;IAED,OAAO,2BAA2B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AA0CD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E;YACxE,uEAAuE,EACzE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,EAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;aAC1C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,yEAAyE;gBACzE,oBAAoB;gBACpB,GAAG,CAAC,OAAO,CAAC,aAAa;oBACvB,CAAC,CAAC;wBACE,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS;wBAChD,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,cAAc;qBACvD;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,EACjD,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACzD,CAAC;IACR,CAAC;IAED,OAAO,yBAAyB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,EAAE;YAC5E,IAAI,EAAE,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEnE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACxD,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAC/C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;YACtD,CAAC,CAAC,IAAI,uBAAuB,CACzB,8BAA8B,QAAQ,CAAC,MAAM,GAAG,EAChD,EAAE,IAAI,EAAE,yBAAyB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;IACR,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAoFD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IAEtD,IAAI,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC7C,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,QAAQ,GAA4C,IAAI,CAAC;IAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,uEAAuE;IACvE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,IAAI,IAAI,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,WAAW,CAAC;IACpD,MAAM,gBAAgB,GAAG,eAAe,IAAI,WAAW,CAAC;IAExD,SAAS,SAAS,CAAC,kBAA0B;QAC3C,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QAClE,MAAM,GAAG,GAAG,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,SAAS,eAAe;QACtB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,QAAQ;QACf,IAAI,QAAQ;YAAE,OAAO;QACrB,eAAe,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACxD,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE;YACpB,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,2DAA2D;gBAC3D,gEAAgE;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,SAAS,UAAU;QACjB,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC5B,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvC,QAAQ,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBACzB,gEAAgE;gBAChE,2DAA2D;gBAC3D,IAAI,CAAC,QAAQ;oBAAE,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,kBAAkB;QACzB,IAAI,QAAQ;YAAE,OAAO;QACrB,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,OAAO;QAC5C,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,WAAW,GAAG,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YAClC,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,iCAAiC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,QAAQ,EAAE,CAAC;IAEX,OAAO;QACL,UAAU;QACV,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,WAAW;YACb,OAAO,WAAW,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/schemas.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { type CapabilityMintResponse } from './capability.js';
+export declare const IdentityResolveResponseSchema: z.ZodObject<{
+    participantKind: z.ZodEnum<{
+        user: "user";
+        agent: "agent";
+        system: "system";
+    }>;
+    participantId: z.ZodString;
+    accountScope: z.ZodString;
+    projectId: z.ZodNullable<z.ZodString>;
+    environment: z.ZodNullable<z.ZodEnum<{
+        production: "production";
+        sandbox: "sandbox";
+    }>>;
+    sandboxId: z.ZodNullable<z.ZodString>;
+    syncGroups: z.ZodArray<z.ZodString>;
+    userMeta: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type IdentityResolveResponse = z.infer<typeof IdentityResolveResponseSchema>;
+/**
+ * The response shape of `POST /v1/ephemeral_keys`, the endpoint that mints an
+ * end-user session key (an `ek_` key). The shape is flat, with no nested scope
+ * block. It still echoes the effective operations stored on the key so the
+ * client reports enforced authority rather than reconstructing it from input.
+ */
+export declare const EphemeralKeyResponseSchema: z.ZodObject<{
+    object: z.ZodOptional<z.ZodLiteral<"ephemeral_key">>;
+    id: z.ZodString;
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+    organizationId: z.ZodString;
+    participantId: z.ZodString;
+    syncGroups: z.ZodArray<z.ZodString>;
+    operations: z.ZodArray<z.ZodTemplateLiteral<`${string}.update` | `${string}.create` | `${string}.delete` | `${string}.read`>>;
+}, z.core.$strip>;
+export type EphemeralKeyResponse = z.infer<typeof EphemeralKeyResponseSchema>;
+export declare function parseCapabilityMintResponse(raw: unknown): CapabilityMintResponse;
+export declare function parseEphemeralKeyResponse(raw: unknown): EphemeralKeyResponse;
+export declare function parseIdentityResolveResponse(raw: unknown): IdentityResolveResponse;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/auth/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAUzB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAWxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;iBAUrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAW9E,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,sBAAsB,CASxB;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAS5E;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,CASlF"}

package/dist/auth/schemas.js

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+import { participantKindSchema } from '../coordination/schema.js';
+import { capabilityMintResponseSchema, grantedOperationSchema, } from './capability.js';
+import { AbloAuthenticationError } from '../errors.js';
+import { authTokenSchema } from './token.js';
+// Not a second enum. The auth responses carry the same participant vocabulary
+// the coordination plane parses, so they validate against the same schema — a
+// kind the delta plane accepts must not throw here on an otherwise-valid
+// identity-resolve response.
+const AuthParticipantKindSchema = participantKindSchema;
+export const IdentityResolveResponseSchema = z.object({
+    participantKind: AuthParticipantKindSchema,
+    participantId: z.string().min(1),
+    accountScope: z.string().min(1),
+    // The rest of the resolved plane. The server always emits these keys; null
+    // means the credential does not bind that axis.
+    projectId: z.string().min(1).nullable(),
+    environment: z.enum(['sandbox', 'production']).nullable(),
+    sandboxId: z.string().min(1).nullable(),
+    syncGroups: z.array(z.string()),
+    userMeta: z.record(z.string(), z.unknown()),
+});
+/**
+ * The response shape of `POST /v1/ephemeral_keys`, the endpoint that mints an
+ * end-user session key (an `ek_` key). The shape is flat, with no nested scope
+ * block. It still echoes the effective operations stored on the key so the
+ * client reports enforced authority rather than reconstructing it from input.
+ */
+export const EphemeralKeyResponseSchema = z.object({
+    object: z.literal('ephemeral_key').optional(),
+    id: z.string().min(1),
+    token: authTokenSchema,
+    expiresAt: z.string().min(1),
+    organizationId: z.string().min(1),
+    participantId: z.string().min(1),
+    syncGroups: z.array(z.string()),
+    /** Effective operation grant stored on the credential. */
+    operations: z.array(grantedOperationSchema).min(1),
+});
+function formatIssues(error) {
+    return error.issues
+        .map((issue) => {
+        const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+        return `${path}: ${issue.message}`;
+    })
+        .join('; ');
+}
+export function parseCapabilityMintResponse(raw) {
+    const parsed = capabilityMintResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new AbloAuthenticationError(`apiKey exchange response was malformed: ${formatIssues(parsed.error)}`, { code: 'exchange_malformed_response', cause: parsed.error });
+    }
+    return parsed.data;
+}
+export function parseEphemeralKeyResponse(raw) {
+    const parsed = EphemeralKeyResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new AbloAuthenticationError(`user-session mint response was malformed: ${formatIssues(parsed.error)}`, { code: 'exchange_malformed_response', cause: parsed.error });
+    }
+    return parsed.data;
+}
+export function parseIdentityResolveResponse(raw) {
+    const parsed = IdentityResolveResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new AbloAuthenticationError(`identity resolve response was malformed: ${formatIssues(parsed.error)}`, { code: 'identity_resolve_failed', cause: parsed.error });
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=schemas.js.map

package/dist/auth/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GAEvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,6BAA6B;AAC7B,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAExD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,yBAAyB;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,2EAA2E;IAC3E,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,eAAe;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAIH,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAY;IAEZ,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvE,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACzE,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,4CAA4C,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxE,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/auth/sessionMint.d.ts

@@ -0,0 +1,29 @@
+import type { SchemaRecord } from '../schema/schema.js';
+import type { AbloSession, CreateSessionParams } from '../resources/httpResources.js';
+/**
+ * The resolved control-plane details a mint needs: a secret key, a base URL,
+ * and an optional `fetch`. When `fetch` is omitted, the auth helpers fall back
+ * to the runtime's global `fetch`.
+ */
+export interface MintSessionContext {
+    readonly apiKey: string;
+    readonly baseUrl: string;
+    readonly fetch?: typeof fetch;
+    /**
+     * Each schema key mapped to its wire type name, from
+     * {@link modelWireNames} over the client's own schema. Required, and derived
+     * rather than assembled: `can` is keyed by schema key while a capability is
+     * scoped by the type name the server checks, so
+     * `can: { documents: ['update'] }` on a model whose type name is overridden
+     * to `Document` must mint `document.update`. A caller who leaves this out
+     * mints a grant the server denies on the first write.
+     */
+    readonly modelTypenames: Readonly<Record<string, string>>;
+}
+/**
+ * Mints a session token from an already-resolved secret key and base URL.
+ * Routes the `{ user }` or `{ agent }` request to the matching mint endpoint
+ * and reshapes the response into an {@link AbloSession}.
+ */
+export declare function mintSession<S extends SchemaRecord>(params: CreateSessionParams<S>, ctx: MintSessionContext): Promise<AbloSession>;
+//# sourceMappingURL=sessionMint.d.ts.map

package/dist/auth/sessionMint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionMint.d.ts","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,SAAS,YAAY,EACtD,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC9B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,WAAW,CAAC,CA6DtB"}

package/dist/auth/sessionMint.js

@@ -0,0 +1,92 @@
+/**
+ * Mints a session token. This is the single implementation behind
+ * `sessions.create`, shared by the WebSocket and HTTP clients so the two never
+ * disagree on how a token is produced.
+ *
+ * Minting is a plain control-plane HTTP call — no socket, no synced data. A
+ * backend holding a secret key (`sk_`) exchanges it for a short-lived, scoped
+ * token whose kind depends on the session requested:
+ *
+ *   `{ user }`  → POST /v1/ephemeral_keys, returning an `ek_` key carrying the
+ *                 explicit grant in `can`. This is the only route that mints a
+ *                 user session; the capability route rejects a `user`
+ *                 participant with `invalid_participant_kind`.
+ *   `{ agent }` → POST /v1/capabilities, returning an `rk_` key scoped to exactly
+ *                 the operations named in `can`. For example
+ *                 `can: { tasks: ['update'] }` becomes the wire allowlist entry
+ *                 `tasks.update`, which the server matches against the model's
+ *                 registered names.
+ *
+ * The caller supplies the already-resolved secret key and base URL in
+ * {@link MintSessionContext}. Choosing which key to pass — the original secret
+ * key, not a derived key that an earlier exchange may have produced — is the
+ * caller's responsibility.
+ */
+import { exchangeApiKey, mintUserSessionKey, } from '../auth/index.js';
+import { capabilityCanSchemaFor, grantedOperations, } from './capability.js';
+/**
+ * Mints a session token from an already-resolved secret key and base URL.
+ * Routes the `{ user }` or `{ agent }` request to the matching mint endpoint
+ * and reshapes the response into an {@link AbloSession}.
+ */
+export async function mintSession(params, ctx) {
+    const { apiKey, baseUrl } = ctx;
+    // Static typing and runtime validation consume the same schema-bound grant
+    // contract. This catches JavaScript callers, decoded JSON, and unsafe casts
+    // before a credential reaches either mint endpoint.
+    const can = capabilityCanSchemaFor(ctx.modelTypenames).parse(params.can);
+    if (params.user) {
+        const operations = grantedOperations(can, ctx.modelTypenames);
+        const res = await mintUserSessionKey({
+            apiKey,
+            baseUrl,
+            userId: params.user.id,
+            ...(params.organizationId ? { organizationId: params.organizationId } : {}),
+            ...(params.syncGroups ? { syncGroups: [...params.syncGroups] } : {}),
+            operations,
+            ttlSeconds: params.ttlSeconds ?? 900,
+            ...(ctx.fetch ? { fetch: ctx.fetch } : {}),
+        });
+        return {
+            object: 'session',
+            id: res.id,
+            token: res.token,
+            expiresAt: res.expiresAt,
+            organizationId: res.organizationId,
+            // The ephemeral mint stores scope on the key row; reshape its flat
+            // response into the session resource's scope block.
+            scope: {
+                organizationId: res.organizationId,
+                syncGroups: res.syncGroups,
+                operations: res.operations,
+                participantKind: 'user',
+                participantId: res.participantId,
+            },
+            userMeta: params.userMeta ?? { id: res.participantId },
+        };
+    }
+    // One translation from the declared grant to the wire allowlist, shared with
+    // every other door that mints — see `auth/capability.ts`.
+    const operations = grantedOperations(can, ctx.modelTypenames);
+    const res = await exchangeApiKey({
+        apiKey,
+        baseUrl,
+        participantKind: 'agent',
+        participantId: params.agent.id,
+        ...(params.syncGroups ? { syncGroups: [...params.syncGroups] } : {}),
+        operations,
+        ttlSeconds: params.ttlSeconds ?? 900,
+        ...(params.userMeta ? { userMeta: params.userMeta } : {}),
+        ...(ctx.fetch ? { fetch: ctx.fetch } : {}),
+    });
+    return {
+        object: 'session',
+        id: res.capabilityId,
+        token: res.token,
+        expiresAt: res.expiresAt,
+        organizationId: res.organizationId,
+        scope: res.scope,
+        userMeta: res.userMeta,
+    };
+}
+//# sourceMappingURL=sessionMint.js.map

package/dist/auth/sessionMint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionMint.js","sourceRoot":"","sources":["../../src/auth/sessionMint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA8B,EAC9B,GAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAChC,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC;YACnC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;YACpC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,mEAAmE;YACnE,oDAAoD;YACpD,KAAK,EAAE;gBACL,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM;gBACvB,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC/B,MAAM;QACN,OAAO;QACP,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,GAAG,CAAC,YAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC"}

package/dist/auth/token.d.ts

@@ -0,0 +1,4 @@
+import { z } from 'zod';
+/** Canonical bearer-token field used by every successful auth response. */
+export declare const authTokenSchema: z.ZodString;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,2EAA2E;AAC3E,eAAO,MAAM,eAAe,aAA2B,CAAC"}

package/dist/auth/token.js

@@ -0,0 +1,4 @@
+import { z } from 'zod';
+/** Canonical bearer-token field used by every successful auth response. */
+export const authTokenSchema = z.string().trim().min(1);
+//# sourceMappingURL=token.js.map

package/dist/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC"}