@holokai/harbor-sdk 0.6.0 → 0.7.0

package/dist/build-inputs.json

@@ -1,6 +1,6 @@
 {
   "package": "@holokai/harbor-sdk",
-  "version": "0.6.0",
-  "digest": "ee14f279ce9678445cfa96aca7c3c14e5a2ed36ad5f7ba0586d49f3a61aa36a8",
-  "commit": "f69548196dbf576779b2e526749a46746ff9c866"
+  "version": "0.7.0",
+  "digest": "8d223c581375c32f0101c6872e3ca430f01471a03af9b5b69760ffdb7c1789df",
+  "commit": "5702055131a3a386352bb78adc3bb969bdff41c8"
 }

package/dist/runtime.d.ts

@@ -25,6 +25,8 @@ export declare const EXTENSIONS_ENV: {
     readonly enabled: "EXTENSIONS_ENABLED";
     /** Comma-separated names of the settings whose value came from Moku rather than harbor's environment. */
     readonly fromMoku: "EXTENSIONS_SETTINGS_FROM_MOKU";
+    /** Comma-separated names of the settings Moku holds and trades with; the server never receives their values. */
+    readonly brokeredByMoku: "EXTENSIONS_SETTINGS_BROKERED_BY_MOKU";
     /** The sign-in return address the providers are given; absent means this server's own `/auth/callback`. */
     readonly callbackAddress: "EXTENSIONS_CALLBACK_ADDRESS";
     /** The connection this server runs for; `/health` names it, so harbor takes an answer only from its own child. */
@@ -37,7 +39,8 @@ export declare const EXTENSIONS_ENV: {
 /**
  * The messages on Node's IPC channel between harbor and an extensions server it started:
  * `catalog_loaded`, `tools_changed`, `page_notification`, `saved_sign_in`, `extension_state` and
- * `provider_account` from the server, `saved_sign_in_answer` and `extension_state_answer` back from harbor.
+ * `provider_account` and `token_trade` from the server, `saved_sign_in_answer`, `extension_state_answer` and
+ * `token_trade_answer` back from harbor.
  */
 export declare const EXTENSIONS_MESSAGE: {
     readonly toolsChanged: "tools_changed";
@@ -47,6 +50,8 @@ export declare const EXTENSIONS_MESSAGE: {
     readonly extensionState: "extension_state";
     readonly extensionStateAnswer: "extension_state_answer";
     readonly providerAccount: "provider_account";
+    readonly tokenTrade: "token_trade";
+    readonly tokenTradeAnswer: "token_trade_answer";
     readonly catalogLoaded: "catalog_loaded";
 };
 /**
@@ -193,6 +198,37 @@ export interface ProviderAccountMessage {
     account: string | null;
     reason: 'restored' | 'signed_in' | 'signed_out';
 }
+/**
+ * The server asks harbor to trade one OAuth grant at the vendor's token endpoint through Moku, which holds the
+ * client secret. The provider is never named here: harbor knows the connection the request came through.
+ */
+export interface TokenTradeRequest {
+    type: typeof EXTENSIONS_MESSAGE.tokenTrade;
+    /** The server's own, unique among its requests still waiting for an answer. */
+    id: string;
+    grantType: 'authorization_code' | 'refresh_token';
+    code?: string;
+    codeVerifier?: string;
+    redirectUri?: string;
+    refreshToken?: string;
+}
+/**
+ * Harbor's answer to one trade: the vendor's status, body and content type, when it named one, as Moku passed them back. `refused` is a request
+ * harbor does not take; `failed` is a trade that did not reach the vendor.
+ */
+export type TokenTradeAnswer = {
+    type: typeof EXTENSIONS_MESSAGE.tokenTradeAnswer;
+    id: string;
+    ok: true;
+    status: number;
+    body: string;
+    contentType?: string;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.tokenTradeAnswer;
+    id: string;
+    ok: false;
+    reason: 'refused' | 'failed';
+};
 /**
  * The JSON Schema keyword that marks a tool input as a local file: a property
  * carrying it, or an array whose items carry it. The AI fills it with a path

package/dist/runtime.js

@@ -12,6 +12,8 @@ var EXTENSIONS_ENV = {
   enabled: "EXTENSIONS_ENABLED",
   /** Comma-separated names of the settings whose value came from Moku rather than harbor's environment. */
   fromMoku: "EXTENSIONS_SETTINGS_FROM_MOKU",
+  /** Comma-separated names of the settings Moku holds and trades with; the server never receives their values. */
+  brokeredByMoku: "EXTENSIONS_SETTINGS_BROKERED_BY_MOKU",
   /** The sign-in return address the providers are given; absent means this server's own `/auth/callback`. */
   callbackAddress: "EXTENSIONS_CALLBACK_ADDRESS",
   /** The connection this server runs for; `/health` names it, so harbor takes an answer only from its own child. */
@@ -29,6 +31,8 @@ var EXTENSIONS_MESSAGE = {
   extensionState: "extension_state",
   extensionStateAnswer: "extension_state_answer",
   providerAccount: "provider_account",
+  tokenTrade: "token_trade",
+  tokenTradeAnswer: "token_trade_answer",
   catalogLoaded: "catalog_loaded"
 };
 var PAGE_NOTIFICATION_NAME = /^[a-z][a-z0-9_.-]{0,63}$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holokai/harbor-sdk",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "The harbor extension to MCP Apps: the public contract a hosted view speaks, and a thin client over @modelcontextprotocol/ext-apps.",
   "exports": {