@pugi/sdk 0.1.0-alpha.3

package/dist/audit-trace.d.ts

@@ -0,0 +1,387 @@
+import { z } from 'zod';
+export declare const auditEventBaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    sessionId: string;
+    timestamp: string;
+}, {
+    id: string;
+    sessionId: string;
+    timestamp: string;
+}>;
+export declare const toolCallEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"tool_call">;
+    tool: z.ZodString;
+    inputSummary: z.ZodString;
+    permissionDecision: z.ZodOptional<z.ZodDiscriminatedUnion<"decision", [z.ZodObject<{
+        decision: z.ZodLiteral<"allow">;
+        reason: z.ZodString;
+        source: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    }, {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    }>, z.ZodObject<{
+        decision: z.ZodLiteral<"ask">;
+        reason: z.ZodString;
+        risk: z.ZodEnum<["low", "medium", "high"]>;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    }, {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    }>, z.ZodObject<{
+        decision: z.ZodLiteral<"deny">;
+        reason: z.ZodString;
+        source: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "deny";
+        source: string;
+    }, {
+        reason: string;
+        decision: "deny";
+        source: string;
+    }>]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "tool_call";
+    tool: string;
+    id: string;
+    sessionId: string;
+    timestamp: string;
+    inputSummary: string;
+    permissionDecision?: {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    } | {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    } | {
+        reason: string;
+        decision: "deny";
+        source: string;
+    } | undefined;
+}, {
+    type: "tool_call";
+    tool: string;
+    id: string;
+    sessionId: string;
+    timestamp: string;
+    inputSummary: string;
+    permissionDecision?: {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    } | {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    } | {
+        reason: string;
+        decision: "deny";
+        source: string;
+    } | undefined;
+}>;
+export declare const toolResultEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"tool_result">;
+    toolCallId: z.ZodString;
+    status: z.ZodEnum<["success", "error", "cancelled"]>;
+    outputSummary: z.ZodString;
+    outputRef: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "tool_result";
+    status: "error" | "success" | "cancelled";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    outputSummary: string;
+    outputRef?: string | undefined;
+}, {
+    type: "tool_result";
+    status: "error" | "success" | "cancelled";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    outputSummary: string;
+    outputRef?: string | undefined;
+}>;
+export declare const fileMutationEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"file_mutation">;
+    toolCallId: z.ZodString;
+    path: z.ZodString;
+    operation: z.ZodEnum<["create", "update", "delete", "move"]>;
+    beforeBlob: z.ZodOptional<z.ZodString>;
+    afterBlob: z.ZodOptional<z.ZodString>;
+    beforeHash: z.ZodOptional<z.ZodString>;
+    afterHash: z.ZodOptional<z.ZodString>;
+    diffRef: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    type: "file_mutation";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    operation: "create" | "update" | "delete" | "move";
+    beforeBlob?: string | undefined;
+    afterBlob?: string | undefined;
+    beforeHash?: string | undefined;
+    afterHash?: string | undefined;
+    diffRef?: string | undefined;
+}, {
+    path: string;
+    type: "file_mutation";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    operation: "create" | "update" | "delete" | "move";
+    beforeBlob?: string | undefined;
+    afterBlob?: string | undefined;
+    beforeHash?: string | undefined;
+    afterHash?: string | undefined;
+    diffRef?: string | undefined;
+}>;
+export declare const sessionEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"session">;
+    name: z.ZodEnum<["created", "command_started", "command_completed"]>;
+    command: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<["success", "error"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "session";
+    id: string;
+    name: "created" | "command_started" | "command_completed";
+    sessionId: string;
+    timestamp: string;
+    status?: "error" | "success" | undefined;
+    command?: string | undefined;
+}, {
+    type: "session";
+    id: string;
+    name: "created" | "command_started" | "command_completed";
+    sessionId: string;
+    timestamp: string;
+    status?: "error" | "success" | undefined;
+    command?: string | undefined;
+}>;
+export declare const auditEventSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"session">;
+    name: z.ZodEnum<["created", "command_started", "command_completed"]>;
+    command: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<["success", "error"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "session";
+    id: string;
+    name: "created" | "command_started" | "command_completed";
+    sessionId: string;
+    timestamp: string;
+    status?: "error" | "success" | undefined;
+    command?: string | undefined;
+}, {
+    type: "session";
+    id: string;
+    name: "created" | "command_started" | "command_completed";
+    sessionId: string;
+    timestamp: string;
+    status?: "error" | "success" | undefined;
+    command?: string | undefined;
+}>, z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"tool_call">;
+    tool: z.ZodString;
+    inputSummary: z.ZodString;
+    permissionDecision: z.ZodOptional<z.ZodDiscriminatedUnion<"decision", [z.ZodObject<{
+        decision: z.ZodLiteral<"allow">;
+        reason: z.ZodString;
+        source: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    }, {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    }>, z.ZodObject<{
+        decision: z.ZodLiteral<"ask">;
+        reason: z.ZodString;
+        risk: z.ZodEnum<["low", "medium", "high"]>;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    }, {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    }>, z.ZodObject<{
+        decision: z.ZodLiteral<"deny">;
+        reason: z.ZodString;
+        source: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        reason: string;
+        decision: "deny";
+        source: string;
+    }, {
+        reason: string;
+        decision: "deny";
+        source: string;
+    }>]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "tool_call";
+    tool: string;
+    id: string;
+    sessionId: string;
+    timestamp: string;
+    inputSummary: string;
+    permissionDecision?: {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    } | {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    } | {
+        reason: string;
+        decision: "deny";
+        source: string;
+    } | undefined;
+}, {
+    type: "tool_call";
+    tool: string;
+    id: string;
+    sessionId: string;
+    timestamp: string;
+    inputSummary: string;
+    permissionDecision?: {
+        reason: string;
+        decision: "allow";
+        source: string;
+        expiresAt?: string | undefined;
+    } | {
+        reason: string;
+        decision: "ask";
+        risk: "low" | "medium" | "high";
+    } | {
+        reason: string;
+        decision: "deny";
+        source: string;
+    } | undefined;
+}>, z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"tool_result">;
+    toolCallId: z.ZodString;
+    status: z.ZodEnum<["success", "error", "cancelled"]>;
+    outputSummary: z.ZodString;
+    outputRef: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "tool_result";
+    status: "error" | "success" | "cancelled";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    outputSummary: string;
+    outputRef?: string | undefined;
+}, {
+    type: "tool_result";
+    status: "error" | "success" | "cancelled";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    outputSummary: string;
+    outputRef?: string | undefined;
+}>, z.ZodObject<{
+    id: z.ZodString;
+    sessionId: z.ZodString;
+    timestamp: z.ZodString;
+} & {
+    type: z.ZodLiteral<"file_mutation">;
+    toolCallId: z.ZodString;
+    path: z.ZodString;
+    operation: z.ZodEnum<["create", "update", "delete", "move"]>;
+    beforeBlob: z.ZodOptional<z.ZodString>;
+    afterBlob: z.ZodOptional<z.ZodString>;
+    beforeHash: z.ZodOptional<z.ZodString>;
+    afterHash: z.ZodOptional<z.ZodString>;
+    diffRef: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    type: "file_mutation";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    operation: "create" | "update" | "delete" | "move";
+    beforeBlob?: string | undefined;
+    afterBlob?: string | undefined;
+    beforeHash?: string | undefined;
+    afterHash?: string | undefined;
+    diffRef?: string | undefined;
+}, {
+    path: string;
+    type: "file_mutation";
+    id: string;
+    toolCallId: string;
+    sessionId: string;
+    timestamp: string;
+    operation: "create" | "update" | "delete" | "move";
+    beforeBlob?: string | undefined;
+    afterBlob?: string | undefined;
+    beforeHash?: string | undefined;
+    afterHash?: string | undefined;
+    diffRef?: string | undefined;
+}>]>;
+export type AuditEvent = z.infer<typeof auditEventSchema>;
+//# sourceMappingURL=audit-trace.d.ts.map

package/dist/audit-trace.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { permissionDecisionSchema } from './permission-rules.js';
+export const auditEventBaseSchema = z.object({
+    id: z.string().min(1),
+    sessionId: z.string().min(1),
+    timestamp: z.string().datetime(),
+});
+export const toolCallEventSchema = auditEventBaseSchema.extend({
+    type: z.literal('tool_call'),
+    tool: z.string().min(1),
+    inputSummary: z.string().min(1),
+    permissionDecision: permissionDecisionSchema.optional(),
+});
+export const toolResultEventSchema = auditEventBaseSchema.extend({
+    type: z.literal('tool_result'),
+    toolCallId: z.string().min(1),
+    status: z.enum(['success', 'error', 'cancelled']),
+    outputSummary: z.string().min(1),
+    outputRef: z.string().min(1).optional(),
+});
+export const fileMutationEventSchema = auditEventBaseSchema.extend({
+    type: z.literal('file_mutation'),
+    toolCallId: z.string().min(1),
+    path: z.string().min(1),
+    operation: z.enum(['create', 'update', 'delete', 'move']),
+    beforeBlob: z.string().min(1).optional(),
+    afterBlob: z.string().min(1).optional(),
+    beforeHash: z.string().min(1).optional(),
+    afterHash: z.string().min(1).optional(),
+    diffRef: z.string().min(1).optional(),
+});
+export const sessionEventSchema = auditEventBaseSchema.extend({
+    type: z.literal('session'),
+    name: z.enum(['created', 'command_started', 'command_completed']),
+    command: z.string().min(1).optional(),
+    status: z.enum(['success', 'error']).optional(),
+});
+export const auditEventSchema = z.discriminatedUnion('type', [
+    sessionEventSchema,
+    toolCallEventSchema,
+    toolResultEventSchema,
+    fileMutationEventSchema,
+]);
+//# sourceMappingURL=audit-trace.js.map

package/dist/device-flow.d.ts

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * OAuth 2.0 Device Authorization Grant (RFC 8628) wire contracts.
+ *
+ * The CLI hits two endpoints:
+ *   POST /api/auth/device/start
+ *   POST /api/auth/device/poll
+ *
+ * The cabinet UI hits two more (JWT-authenticated):
+ *   POST /api/auth/device/approve
+ *   POST /api/auth/device/deny
+ *
+ * Field naming follows RFC 8628 (snake_case) on the wire, not the
+ * camelCase server type used by Prisma — Zod schemas below are the
+ * canonical wire shape. CLI consumers parse the response with these
+ * schemas to defeat a hostile or buggy runtime returning malformed
+ * fields.
+ */
+export declare const pugiDeviceStartRequestSchema: z.ZodObject<{
+    clientId: z.ZodLiteral<"pugi-cli">;
+}, "strip", z.ZodTypeAny, {
+    clientId: "pugi-cli";
+}, {
+    clientId: "pugi-cli";
+}>;
+export type PugiDeviceStartRequest = z.infer<typeof pugiDeviceStartRequestSchema>;
+export declare const pugiDeviceStartResponseSchema: z.ZodObject<{
+    device_code: z.ZodString;
+    user_code: z.ZodString;
+    verification_uri: z.ZodString;
+    verification_uri_complete: z.ZodString;
+    expires_in: z.ZodNumber;
+    interval: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}, {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}>;
+export type PugiDeviceStartResponse = z.infer<typeof pugiDeviceStartResponseSchema>;
+export declare const pugiDevicePollRequestSchema: z.ZodObject<{
+    deviceCode: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deviceCode: string;
+}, {
+    deviceCode: string;
+}>;
+export type PugiDevicePollRequest = z.infer<typeof pugiDevicePollRequestSchema>;
+export declare const pugiDevicePollStatusSchema: z.ZodEnum<["pending", "authorized", "denied", "expired", "redeemed"]>;
+export type PugiDevicePollStatus = z.infer<typeof pugiDevicePollStatusSchema>;
+export declare const pugiDevicePollResponseSchema: z.ZodDiscriminatedUnion<"status", [z.ZodObject<{
+    status: z.ZodLiteral<"authorized">;
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+}, "strip", z.ZodTypeAny, {
+    status: "authorized";
+    access_token: string;
+    token_type: "Bearer";
+}, {
+    status: "authorized";
+    access_token: string;
+    token_type: "Bearer";
+}>, z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+}, "strip", z.ZodTypeAny, {
+    status: "pending";
+}, {
+    status: "pending";
+}>, z.ZodObject<{
+    status: z.ZodLiteral<"denied">;
+}, "strip", z.ZodTypeAny, {
+    status: "denied";
+}, {
+    status: "denied";
+}>, z.ZodObject<{
+    status: z.ZodLiteral<"expired">;
+}, "strip", z.ZodTypeAny, {
+    status: "expired";
+}, {
+    status: "expired";
+}>, z.ZodObject<{
+    status: z.ZodLiteral<"redeemed">;
+}, "strip", z.ZodTypeAny, {
+    status: "redeemed";
+}, {
+    status: "redeemed";
+}>]>;
+export type PugiDevicePollResponse = z.infer<typeof pugiDevicePollResponseSchema>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/device-flow.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+/**
+ * OAuth 2.0 Device Authorization Grant (RFC 8628) wire contracts.
+ *
+ * The CLI hits two endpoints:
+ *   POST /api/auth/device/start
+ *   POST /api/auth/device/poll
+ *
+ * The cabinet UI hits two more (JWT-authenticated):
+ *   POST /api/auth/device/approve
+ *   POST /api/auth/device/deny
+ *
+ * Field naming follows RFC 8628 (snake_case) on the wire, not the
+ * camelCase server type used by Prisma — Zod schemas below are the
+ * canonical wire shape. CLI consumers parse the response with these
+ * schemas to defeat a hostile or buggy runtime returning malformed
+ * fields.
+ */
+export const pugiDeviceStartRequestSchema = z.object({
+    clientId: z.literal('pugi-cli'),
+});
+export const pugiDeviceStartResponseSchema = z.object({
+    device_code: z.string().length(64),
+    user_code: z.string().min(8).max(16),
+    verification_uri: z.string().url(),
+    verification_uri_complete: z.string().url(),
+    // Cap `expires_in` at 1 hour so a hostile or misconfigured runtime
+    // cannot trap the CLI in a year-long poll loop by returning a huge
+    // expiration. The server today uses 10 min; this is just the upper
+    // bound the SDK trusts.
+    expires_in: z.number().int().positive().max(3600),
+    interval: z.number().int().min(1).max(60),
+});
+export const pugiDevicePollRequestSchema = z.object({
+    deviceCode: z.string().min(32).max(128),
+});
+export const pugiDevicePollStatusSchema = z.enum([
+    'pending',
+    'authorized',
+    'denied',
+    'expired',
+    'redeemed',
+]);
+export const pugiDevicePollResponseSchema = z.discriminatedUnion('status', [
+    z.object({
+        status: z.literal('authorized'),
+        access_token: z.string().min(1),
+        token_type: z.literal('Bearer'),
+    }),
+    z.object({ status: z.literal('pending') }),
+    z.object({ status: z.literal('denied') }),
+    z.object({ status: z.literal('expired') }),
+    z.object({ status: z.literal('redeemed') }),
+]);
+//# sourceMappingURL=device-flow.js.map