@rockcarver/frodo-lib 4.10.0-1 → 4.11.0-1

package/types/ops/AuthenticateOps.d.ts

@@ -0,0 +1,196 @@
+import { AuthenticateSuccessResponse } from '../api/AuthenticateApi';
+import { State } from '../shared/State';
+import { BrowserLoginPromptHandler } from './BrowserAuthenticateOps';
+import { CallbackHandler } from './CallbackOps';
+import { JwkRsa } from './JoseOps';
+import { type AccessTokenMetaType } from './OAuth2OidcOps';
+export type Authenticate = {
+    /**
+     * Get tokens and store them in State
+     * @param {boolean} forceLoginAsUser true to force login as user even if a service account or Amster account is available (default: false)
+     * @param {boolean} autoRefresh true to automatically refresh tokens before they expire (default: true)
+     * @param {string[]} types Array of supported deployment types. The function will throw an error if an unsupported type is detected (default: ['classic', 'cloud', 'forgeops'])
+     * @param {CallbackHandler} callbackHandler function allowing the library to collect responses from the user through callbacks
+     * @param {boolean} useDeviceFlow only consulted when a loaded connection profile prefers browser login (`preferredCredential: 'browser'`, or the legacy `authMode: 'interactive'` for a profile predating that field) — falls back to the profile's own `preferredDeviceFlow` when not explicitly passed; see `getTokensInteractive()` (default: false)
+     * @param {BrowserLoginPromptHandler} promptHandler required only when a loaded connection profile prefers browser login; every other case ignores it
+     * @returns {Promise<Tokens>} object containing the tokens
+     */
+    getTokens(forceLoginAsUser?: boolean, autoRefresh?: boolean, types?: string[], callbackHandler?: CallbackHandler, useDeviceFlow?: boolean, promptHandler?: BrowserLoginPromptHandler, credentialOverride?: 'user' | 'svcacct' | 'amster' | 'browser'): Promise<Tokens>;
+    /**
+     * Get tokens via a real interactive browser login (loopback-redirect or
+     * device-authorization grant) instead of a CLI-driven password/service-
+     * account/Amster login. Alongside `getTokens()`, not a replacement for it.
+     * @param {BrowserLoginOptions} options browser-login options
+     * @returns {Promise<Tokens>} object containing the tokens
+     */
+    getTokensInteractive(options: BrowserLoginOptions): Promise<Tokens>;
+    /**
+     * Applies an already-obtained, externally-issued OAuth2 access token to
+     * `state`, ready for immediate use. Unlike `getTokens()`/
+     * `getTokensInteractive()`, this never talks to an authorization endpoint
+     * itself — the token was already minted (and, by the caller's own
+     * contract, already verified) elsewhere; this only wires it onto `state`
+     * using the exact same deployment-type-specific handling a real browser
+     * login uses. Intended for hosts that resolve their own caller identity
+     * per request (e.g. an MCP server acting as an OAuth2 resource server)
+     * rather than performing a login themselves.
+     * @param {AccessTokenMetaType} token the already-obtained access token
+     * @returns {Promise<Tokens>} object containing the tokens
+     */
+    applyAccessToken(token: AccessTokenMetaType): Promise<Tokens>;
+};
+declare const _default: (state: State) => Authenticate;
+export default _default;
+export type UserSessionMetaType = AuthenticateSuccessResponse & {
+    expires: number;
+    from_cache?: boolean;
+    universalId?: string;
+    latestAccessTime?: string;
+    amCtxId?: string;
+};
+/**
+ * Helper function to extract the semantic version string from a version info object
+ * @param {Object} versionInfo version info object
+ * @returns {String} semantic version
+ */
+export declare function getSemanticVersion(versionInfo: any): string;
+export declare function createPayload(serviceAccountId: string, host: string): {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    jti: string;
+};
+/**
+ * Get fresh access token for service account
+ * @param {State} state library state
+ * @returns {Promise<AccessTokenResponseType>} response object containg token, scope, type, and expiration in seconds
+ */
+export declare function getFreshSaBearerToken({ saId, saJwk, state, }: {
+    saId?: string;
+    saJwk?: JwkRsa;
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Get fresh PingFed access token for service account
+ * @param {State} state library state
+ * @returns {Promise<AccessTokenResponseType>} response object containg token, scope, type, and expiration in seconds
+ */
+export declare function getFreshPfSaBearerToken({ saId, saJwk, state, }: {
+    saId?: string;
+    saJwk?: JwkRsa;
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Get cached or fresh access token for service account
+ * @param {State} state library state
+ * @returns {Promise<AccessTokenResponseType>} response object containg token, scope, type, and expiration in seconds
+ */
+export declare function getSaBearerToken({ state, }: {
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Get cached or fresh PingFed access token for service account
+ * @param {State} state library state
+ * @returns {Promise<AccessTokenResponseType>} response object containg token, scope, type, and expiration in seconds
+ */
+export declare function getPfSaBearerToken({ state, }: {
+    state: State;
+}): Promise<AccessTokenMetaType>;
+export type Tokens = {
+    bearerToken?: AccessTokenMetaType;
+    userSessionToken?: UserSessionMetaType;
+    pfBearerToken?: AccessTokenMetaType;
+    subject?: string;
+    host?: string;
+    realm?: string;
+};
+/**
+ * Get tokens
+ * @param {boolean} forceLoginAsUser true to force login as user even if a service account or Amster account is available (default: false)
+ * @param {boolean} autoRefresh true to automatically refresh tokens before they expire (default: true)
+ * @param {string[]} types Array of supported deployment types. The function will throw an error if an unsupported type is detected (default: ['classic', 'cloud', 'forgeops'])
+ * @param {CallbackHandler} callbackHandler function allowing the library to collect responses from the user through callbacks
+ * @param {State} state library state
+ * @returns {Promise<Tokens>} object containing the tokens
+ */
+export declare function getTokens({ forceLoginAsUser, credentialOverride, autoRefresh, types, callbackHandler, useDeviceFlow, promptHandler, state, }: {
+    forceLoginAsUser?: boolean;
+    /**
+     * Force this one invocation to use a specific configured credential type,
+     * overriding ambient browser-session cache reuse and any saved
+     * defaultCredential/forceLoginAsUser preference (the generalized,
+     * stateless successor to forceLoginAsUser — see `--credential` on the
+     * CLI). 'browser' means "use my cached browser-login session"; if none
+     * is valid, this throws rather than falling back to a different
+     * credential or popping a fresh interactive login. Every other value
+     * means "don't even consider a cached browser session"; if the requested
+     * type isn't actually configured, this falls through to the same
+     * "Incomplete or no credentials" error any other unconfigured credential
+     * hits today.
+     */
+    credentialOverride?: 'user' | 'svcacct' | 'amster' | 'browser';
+    autoRefresh?: boolean;
+    types?: string[];
+    callbackHandler?: CallbackHandler;
+    /** Only consulted when a loaded connection profile prefers browser login — see below; falls back to the profile's own `preferredDeviceFlow` when not explicitly passed. */
+    useDeviceFlow?: boolean;
+    /** Required only when a loaded connection profile prefers browser login; every other case ignores it. */
+    promptHandler?: BrowserLoginPromptHandler;
+    state: State;
+}): Promise<Tokens>;
+export type BrowserLoginOptions = {
+    /**
+     * Deployment type to authenticate against. Required — unlike `getTokens()`,
+     * there is no AM session yet at the start of a browser login for
+     * `determineDeploymentType()` to probe with, so it can't be auto-detected.
+     */
+    deploymentType?: string;
+    /** Use the OAuth2 Device Authorization Grant instead of a loopback redirect. */
+    useDeviceFlow?: boolean;
+    /** Override the built-in OAuth2 client id for the target deployment type. */
+    loginClientId?: string;
+    /** Override the default scope requested for the target deployment type. */
+    loginScope?: string;
+    /**
+     * Full, absolute redirect URI to use for browser login, for a client
+     * registered with an exact-match redirect URI. Shared with the
+     * non-interactive synthetic login flow's own `--login-redirect-uri` (see
+     * `state.getAdminClientRedirectUri()`) — when omitted here, that value is
+     * used as the fallback, exactly like `loginClientId` already falls back
+     * to `state.getAdminClientId()`. When both are absent, falls through to
+     * an auto-generated loopback redirect on an OS-assigned ephemeral port
+     * (or, for cloud's built-in client specifically, its one confirmed-fixed
+     * redirect URI — see `CLOUD_BROWSER_LOGIN_REDIRECT_URI`).
+     */
+    loginRedirectUri?: string;
+    /** Presents the login step (a URL, or a device code) to the human completing it. */
+    promptHandler: BrowserLoginPromptHandler;
+    /** How long to wait for the human to complete the login step. */
+    timeoutMs?: number;
+};
+/**
+ * Checks whether AM's REST API accepts a bearer token directly for this
+ * session, performing one cheap authenticated read call. This is ForgeOps
+ * browser-login's Tier B fallback (see the plan doc's Phase C): AM's REST
+ * API is not a resource server by default, so whether a plain bearer token
+ * works at all is genuinely undecided until probed — the *recommended* path
+ * (a session-capture script on the OAuth2 client) never needs this at all,
+ * since it gets a real session cookie instead. Cached on `state` for the
+ * life of the session so the probe only ever runs once.
+ * @param {State} state library state
+ * @returns {Promise<boolean>} whether AM accepted the bearer token
+ */
+export declare function probeAmBearerTokenAcceptance({ state, }: {
+    state: State;
+}): Promise<boolean>;
+/**
+ * Get tokens via a real interactive browser login.
+ * @param {BrowserLoginOptions} options browser-login options
+ * @param {State} state library state
+ * @returns {Promise<Tokens>} object containing the tokens
+ */
+export declare function getTokensInteractive({ deploymentType, useDeviceFlow, loginClientId, loginScope, loginRedirectUri, promptHandler, timeoutMs, state, }: BrowserLoginOptions & {
+    state: State;
+}): Promise<Tokens>;
+//# sourceMappingURL=AuthenticateOps.d.ts.map

package/types/ops/AuthenticateOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticateOps.d.ts","sourceRoot":"","sources":["../../src/ops/AuthenticateOps.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,2BAA2B,EAE5B,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAMxC,OAAO,EACL,yBAAyB,EAM1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,eAAe,EAGhB,MAAM,eAAe,CAAC;AAgBvB,OAAO,EAAwB,MAAM,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AA0BzB,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;;;;;OASG;IACH,SAAS,CACP,gBAAgB,CAAC,EAAE,OAAO,EAC1B,WAAW,CAAC,EAAE,OAAO,EACrB,KAAK,CAAC,EAAE,MAAM,EAAE,EAChB,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,OAAO,EACvB,aAAa,CAAC,EAAE,yBAAyB,EACzC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAC7D,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;;;OAMG;IACH,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/D,CAAC;yBAEc,OAAO,KAAK,KAAG,YAAY;AAA3C,wBA6BE;AAmFF,MAAM,MAAM,mBAAmB,GAAG,2BAA2B,GAAG;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IAOrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAyQF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,KAAA,UAe7C;AAsgBD,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;EAmBnE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,IAAgB,EAChB,KAAiB,EACjB,KAAK,GACN,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0D/B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,IAAgB,EAChB,KAAiB,EACjB,KAAK,GACN,EAAE;IACD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0D/B;AAsCD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6C/B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+C/B;AA4VD,MAAM,MAAM,MAAM,GAAG;IACnB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,EAC9B,gBAAuE,EACvE,kBAAkB,EAClB,WAAkB,EAClB,KAAkC,EAClC,eAAsB,EACtB,aAAqB,EACrB,aAAa,EACb,KAAK,GACN,EAAE;IACD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,2KAA2K;IAC3K,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yGAAyG;IACzG,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAyelB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,aAAa,EAAE,yBAAyB,CAAC;IACzC,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;AAkaD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,cAAc,EACd,aAAqB,EACrB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,KAAK,GACN,EAAE,mBAAmB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2V1D"}

package/types/ops/AuthenticationSettingsOps.d.ts

@@ -0,0 +1,78 @@
+import { type AuthenticationSettingsSkeleton } from '../api/AuthenticationSettingsApi';
+import { State } from '../shared/State';
+import { type ExportMetaData } from './OpsTypes';
+export type AuthenticationSettings = {
+    /**
+     * Read authentication settings
+     * @param {boolean} globalConfig true if global authentication settings is the target of the operation, false otherwise. Default: false.
+     * @returns {Promise<AuthenticationSettingsSkeleton>} a promise that resolves an authentication settings object
+     */
+    readAuthenticationSettings(globalConfig: boolean): Promise<AuthenticationSettingsSkeleton>;
+    /**
+     * Update authentication settings
+     * @param {AuthenticationSettingsSkeleton} settings authentication settings data
+     * @param {boolean} globalConfig true if global authentication settings are the target of the operation, false otherwise. Default: false.
+     * @returns {Promise<AuthenticationSettingsSkeleton>} a promise that resolves an authentication settings object
+     */
+    updateAuthenticationSettings(settings: AuthenticationSettingsSkeleton, globalConfig: boolean): Promise<AuthenticationSettingsSkeleton>;
+    /**
+     * Export authentication settings
+     * @param {boolean} globalConfig true if global authentication settings is the target of the operation, false otherwise. Default: false.
+     * @returns {Promise<AuthenticationSettingsExportInterface>} a promise that resolves to an AuthenticationSettingsExportInterface object
+     */
+    exportAuthenticationSettings(globalConfig: boolean): Promise<AuthenticationSettingsExportInterface>;
+    /**
+     * Import authentication settings
+     * @param {AuthenticationSettingsExportInterface} importData import data
+     * @param {boolean} globalConfig true if global authentication settings are the target of the operation, false otherwise. Default: false.
+     */
+    importAuthenticationSettings(importData: AuthenticationSettingsExportInterface, globalConfig: boolean): Promise<AuthenticationSettingsSkeleton>;
+};
+declare const _default: (state: State) => AuthenticationSettings;
+export default _default;
+export interface AuthenticationSettingsExportInterface {
+    meta?: ExportMetaData;
+    authentication: AuthenticationSettingsSkeleton;
+}
+/**
+ * Create an empty authentication settings export template
+ * @returns {AuthenticationSettingsExportInterface} an empty authentication settings export template
+ */
+export declare function createAuthenticationSettingsExportTemplate({ state, }: {
+    state: State;
+}): AuthenticationSettingsExportInterface;
+/**
+ * Read authentication settings
+ * @param {boolean} globalConfig true if global agent is the target of the operation, false otherwise. Default: false.
+ * @returns {Promise} a promise that resolves to an object containing an array of authentication settingss
+ */
+export declare function readAuthenticationSettings({ state, globalConfig, }: {
+    state: State;
+    globalConfig: boolean;
+}): Promise<AuthenticationSettingsSkeleton>;
+export declare function updateAuthenticationSettings({ settings, globalConfig, state, }: {
+    settings: AuthenticationSettingsSkeleton;
+    globalConfig: boolean;
+    state: State;
+}): Promise<AuthenticationSettingsSkeleton>;
+/**
+ * Export authentication settings
+ * @param {boolean} globalConfig true if global agent is the target of the operation, false otherwise. Default: false.
+ * @returns {Promise<AuthenticationSettingsExportInterface>} a promise that resolves to a AuthenticationSettingsExportInterface object
+ */
+export declare function exportAuthenticationSettings({ state, globalConfig, }: {
+    state: State;
+    globalConfig: boolean;
+}): Promise<AuthenticationSettingsExportInterface>;
+/**
+ * Import authentication settings
+ * @param {AuthenticationSettingsExportInterface} importData import data
+ * @param {boolean} globalConfig true if global authentication settings are the target of the operation, false otherwise. Default: false.
+ * @returns {Promise<AuthenticationSettingsSkeleton>} a promise resolving to a authentication settings object
+ */
+export declare function importAuthenticationSettings({ importData, globalConfig, state, }: {
+    importData: AuthenticationSettingsExportInterface;
+    globalConfig: boolean;
+    state: State;
+}): Promise<AuthenticationSettingsSkeleton>;
+//# sourceMappingURL=AuthenticationSettingsOps.d.ts.map

package/types/ops/AuthenticationSettingsOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationSettingsOps.d.ts","sourceRoot":"","sources":["../../src/ops/AuthenticationSettingsOps.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAKxC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;;OAIG;IACH,0BAA0B,CACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,4BAA4B,CAC1B,QAAQ,EAAE,8BAA8B,EACxC,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3C;;;;OAIG;IACH,4BAA4B,CAC1B,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAClD;;;;OAIG;IACH,4BAA4B,CAC1B,UAAU,EAAE,qCAAqC,EACjD,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC5C,CAAC;yBAEc,OAAO,KAAK,KAAG,sBAAsB;AAArD,wBA2BE;AAEF,MAAM,WAAW,qCAAqC;IACpD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,EAAE,8BAA8B,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,0CAA0C,CAAC,EACzD,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,qCAAqC,CAKxC;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,KAAK,EACL,YAAoB,GACrB,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAkB1C;AAED,wBAAsB,4BAA4B,CAAC,EACjD,QAAQ,EACR,YAAoB,EACpB,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,8BAA8B,CAAC;IACzC,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAsB1C;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,KAAK,EACL,YAAoB,GACrB,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAuBjD;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACV,YAAY,EACZ,KAAK,GACN,EAAE;IACD,UAAU,EAAE,qCAAqC,CAAC;IAClD,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAe1C"}

package/types/ops/BrowserAuthenticateOps.d.ts

@@ -0,0 +1,188 @@
+import { State } from '../shared/State';
+import { type AccessTokenMetaType } from './OAuth2OidcOps';
+/**
+ * Matches `aic-mcp-server`'s interactive-flow timeout: long enough for a
+ * human to complete MFA/passkey/federation steps, short enough not to leave
+ * an abandoned listener or polling loop running indefinitely.
+ */
+export declare const DEFAULT_INTERACTIVE_LOGIN_TIMEOUT_MS: number;
+/**
+ * Info handed to the caller-supplied {@link BrowserLoginPromptHandler} so it
+ * can present the login step however is appropriate for its environment.
+ */
+export type BrowserLoginPrompt = {
+    /** Set for the loopback-redirect (authorization code + PKCE) flow. */
+    authorizeUrl?: string;
+    /** Set for the device-authorization flow. */
+    userCode?: string;
+    /** Set for the device-authorization flow. */
+    verificationUri?: string;
+    /** When to stop waiting for the user to complete this step. */
+    expiresAt: Date;
+};
+/**
+ * Presents an interactive login step to a human. frodo-lib never opens a
+ * browser or prints to a terminal itself — the caller (frodo-cli, an MCP
+ * server host, a test) decides how to surface `prompt` and is responsible
+ * for getting the user to `prompt.authorizeUrl` or `prompt.verificationUri`.
+ */
+export type BrowserLoginPromptHandler = (prompt: BrowserLoginPrompt) => void | Promise<void>;
+export type LoopbackCallbackResult = {
+    code?: string;
+    state?: string;
+    error?: string;
+    errorDescription?: string;
+};
+export type LoopbackResultPage = {
+    success?: string;
+    failure?: string;
+};
+export type LoopbackRedirectListener = {
+    /** The exact redirect_uri to use in the authorize request. */
+    redirectUri: string;
+    /** The loopback port the listener bound to. */
+    port: number;
+    /** Await the single inbound redirect, or reject on timeout. */
+    waitForCallback(timeoutMs?: number): Promise<LoopbackCallbackResult>;
+    /** Stop listening. Safe to call more than once. */
+    close(): void;
+};
+/**
+ * Generate a fresh CSRF `state` nonce for an OAuth2 authorization request.
+ */
+export declare function generateStateNonce(): string;
+/**
+ * Start a short-lived, loopback-only (`127.0.0.1`) HTTP listener that
+ * catches exactly one OAuth2 authorization_code redirect and validates the
+ * returned `state` parameter against `expectedState` with a constant-time
+ * comparison before resolving.
+ *
+ * @remarks
+ * Mirrors the loopback-redirect pattern `aic-mcp-server` and `gcloud auth
+ * login` both use: a real browser is directed here by the authorization
+ * server, not by this process, so the listener only ever needs to accept
+ * one inbound request before shutting itself down. Binds an OS-assigned
+ * ephemeral port by default; pass `preferredPort` for an OAuth2 client
+ * whose redirect URI is registered against one fixed port.
+ */
+export declare function startLoopbackRedirectListener({ preferredPort, redirectHost, callbackPath, expectedState, resultPage, state, }: {
+    preferredPort?: number;
+    /**
+     * Hostname to advertise in `redirectUri` (the listener always binds the
+     * loopback interface regardless of this value). Some OAuth2 clients'
+     * registered redirect URIs require the literal string `localhost` rather
+     * than `127.0.0.1` — pass `'localhost'` to match one of those exactly.
+     */
+    redirectHost?: string;
+    callbackPath?: string;
+    expectedState: string;
+    resultPage?: LoopbackResultPage;
+    state?: State;
+}): Promise<LoopbackRedirectListener>;
+/**
+ * Drive a full interactive OAuth2 authorization_code + PKCE login: open a
+ * loopback listener, build the `/oauth2/authorize` URL a real browser should
+ * be sent to, hand it to `promptHandler`, wait for the redirect, and
+ * exchange the returned code for a token.
+ *
+ * @remarks
+ * Deployment-agnostic — the caller supplies `clientId`/`scope`/redirect
+ * shape, which differ per deployment type and per candidate OAuth2 client
+ * (see `AuthenticateOps.ts`'s deployment-specific `getTokensInteractive`
+ * branches). Unlike `AuthenticateOps.ts`'s existing synthetic PKCE flow
+ * (`getAuthCode`/`getFreshUserBearerToken`), this never POSTs to
+ * `/oauth2/authorize` itself — the authorize step is driven by the human
+ * in a real browser, and this process only ever sees the resulting
+ * redirect.
+ */
+export declare function runInteractiveAuthorizationCodeFlow({ clientId, scope, redirectHost, callbackPath, preferredPort, redirectUri: redirectUriOverride, promptHandler, timeoutMs, state, }: {
+    clientId: string;
+    scope: string;
+    redirectHost?: string;
+    callbackPath?: string;
+    preferredPort?: number;
+    /**
+     * A complete, literal redirect URI to use verbatim instead of
+     * constructing one from `redirectHost`/`callbackPath`/`preferredPort` —
+     * for an OAuth2 client registered with an exact-match redirect URI (no
+     * wildcard/pattern support), where even a functionally-equivalent
+     * reconstruction could fail validation (a URL parser normalizes a bare
+     * `http://localhost:3000` into `http://localhost:3000/`, for instance,
+     * which is a different string than what a client might be registered
+     * with). When given, its port is used for the local listener (still
+     * bound, as always, to `127.0.0.1` regardless of the advertised
+     * hostname) and its path for the listener's inbound request matching;
+     * `redirectHost`/`callbackPath`/`preferredPort` are ignored. The literal
+     * string itself — never a reconstruction — is what's sent as
+     * `redirect_uri` to both the authorize call and the token exchange.
+     */
+    redirectUri?: string;
+    promptHandler: BrowserLoginPromptHandler;
+    timeoutMs?: number;
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Exchange a subject token for a new, narrower-scoped token via RFC 8693
+ * Token Exchange (`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`).
+ *
+ * @remarks
+ * Confirmed against a real AIC tenant as the mechanism that unlocks AM
+ * REST API access for an interactively-obtained token: the primary
+ * token from `runInteractiveAuthorizationCodeFlow` is rejected by AM
+ * directly, but a token exchanged through the client named in the
+ * primary token's own `may_act` claim is accepted. When `exchangeClientId`
+ * is not supplied, it's read from `subjectToken`'s decoded `may_act.client_id`
+ * claim — do not hardcode a single exchange client, since different
+ * deployments (or a future Ping-side change) may name a different one.
+ * The resulting token is typically extremely short-lived (tens of seconds)
+ * and must never be cached — mint a fresh one immediately before each
+ * AM-domain call that needs it.
+ */
+export declare function exchangeTokenForScope({ subjectToken, scope, exchangeClientId, state, }: {
+    subjectToken: string;
+    scope: string;
+    exchangeClientId?: string;
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Refreshes a browser-login primary token via a plain `grant_type=refresh_token`
+ * exchange — the on-demand counterpart to a fresh interactive login, used
+ * only when the primary token's response actually included a refresh token
+ * (confirmed empirically: cloud's `AICMCPClient`/`AICMCPExchangeClient` never
+ * return one today, so this path exists for the sub-flows/deployment types
+ * that do return one, not as a universal assumption). Public-client exchange
+ * (no client secret), matching how the primary interactive login itself
+ * authenticates. Never call this for the short-lived RFC 8693-exchanged
+ * AM-domain token — that one is mint-and-discard by design and never has a
+ * refresh token to begin with.
+ */
+export declare function refreshBrowserBearerToken({ state, }: {
+    state: State;
+}): Promise<AccessTokenMetaType>;
+/**
+ * Reads the `may_act.client_id` claim off a decoded access token, if
+ * present. Exported so callers can decide *whether* a token needs an RFC
+ * 8693 exchange before attempting one — see `applyCloudInteractiveToken`'s
+ * BYOT (bring-your-own-token) fallback in `AuthenticateOps.ts`.
+ */
+export declare function readMayActClientId(jwt: string): string | undefined;
+/**
+ * Drive an OAuth2 Device Authorization Grant (RFC 8628), PKCE-protected the
+ * same way `aic-mcp-server` layers PKCE on top of its own device flow: the
+ * verifier/challenge are generated once, the challenge is sent on the
+ * device-code request, and the verifier is redeemed on the token poll.
+ *
+ * @remarks
+ * Deployment-agnostic — the caller supplies `clientId`/`scope`, which
+ * differ per deployment type (see `AuthenticateOps.ts`'s deployment-specific
+ * `getTokensInteractive` branches). `state.getHost()` supplies the AM base
+ * URL for both the device-code and token endpoints.
+ */
+export declare function startDeviceAuthorizationFlow({ clientId, scope, promptHandler, timeoutMs, state, }: {
+    clientId: string;
+    scope: string;
+    promptHandler: BrowserLoginPromptHandler;
+    timeoutMs?: number;
+    state: State;
+}): Promise<AccessTokenMetaType>;
+//# sourceMappingURL=BrowserAuthenticateOps.d.ts.map

package/types/ops/BrowserAuthenticateOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserAuthenticateOps.d.ts","sourceRoot":"","sources":["../../src/ops/BrowserAuthenticateOps.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAKxC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,QAAgB,CAAC;AAIlE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,MAAM,EAAE,kBAAkB,KACvB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrE,mDAAmD;IACnD,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,aAAa,EACb,YAA0B,EAC1B,YAAoC,EACpC,aAAa,EACb,UAAU,EACV,KAAK,GACN,EAAE;IACD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0EpC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mCAAmC,CAAC,EACxD,QAAQ,EACR,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,WAAW,EAAE,mBAAmB,EAChC,aAAa,EACb,SAAgD,EAChD,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,yBAAyB,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiE/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,YAAY,EACZ,KAAK,EACL,gBAAgB,EAChB,KAAK,GACN,EAAE;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAe/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB/B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQlE;AAkHD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,QAAQ,EACR,KAAK,EACL,aAAa,EACb,SAAgD,EAChD,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,yBAAyB,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkD/B"}

package/types/ops/CallbackOps.d.ts

@@ -0,0 +1,27 @@
+import { AuthenticateStep } from '../api/AuthenticateApi';
+export type CallbackType = 'NameCallback' | 'PasswordCallback' | 'TextInputCallback' | 'HiddenValueCallback' | 'SelectIdPCallback';
+export type CallbackKeyValuePair = {
+    name: string;
+    value: any;
+};
+export type Callback = {
+    type: CallbackType;
+    output: CallbackKeyValuePair[];
+    input: CallbackKeyValuePair[];
+};
+export type CallbackHandler = (callback: Callback) => Callback;
+/**
+ * Fill callbacks from a map
+ * @param {AuthenticateStep} step authenticate step json response from a call to /authenticate
+ * @param {{ [k: string]: string | number | boolean | string[] }} map name/value map
+ * @returns filled authenticate step body so it can be used as input to another call to /authenticate
+ */
+export declare function fillCallbacks({ step, map, }: {
+    step: AuthenticateStep;
+    map: {
+        [k: string]: string | number | boolean | string[];
+    };
+}): AuthenticateStep;
+export declare function getCallbackValue(name: string, pairs: CallbackKeyValuePair[]): any | undefined;
+export declare function setCallbackValue(name: string, value: any, pairs: CallbackKeyValuePair[]): boolean;
+//# sourceMappingURL=CallbackOps.d.ts.map

package/types/ops/CallbackOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CallbackOps.d.ts","sourceRoot":"","sources":["../../src/ops/CallbackOps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,kBAAkB,GAClB,mBAAmB,GACnB,qBAAqB,GACrB,mBAAmB,CAAC;AACxB,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,GAAG,CAAC;CACZ,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,KAAK,EAAE,oBAAoB,EAAE,CAAC;CAC/B,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAC5B,IAAI,EACJ,GAAG,GACJ,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAC;IACvB,GAAG,EAAE;QAAE,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;CAC5D,GAAG,gBAAgB,CAQnB;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,oBAAoB,EAAE,GAC5B,GAAG,GAAG,SAAS,CAGjB;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,oBAAoB,EAAE,GAC5B,OAAO,CAKT"}

package/types/ops/CallerTrustTierOps.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Determines the caller-privilege tier for the currently-authenticated
+ * session, so the MCP runtime's `assertTrustTierAllowed` (see
+ * `mcp/ToolRuntime.ts`) can decide whether a capability marked
+ * `trustTier: 'full-trust'` (the default — see `mcp/CapabilityTypes.ts`'s
+ * `McpCapabilityTrustTier`) is safe to expose to this caller.
+ *
+ * @remarks
+ * `admin-account`/`service-account`/`state-config` sessions are already
+ * full-trust identities by construction — there is no privilege to probe,
+ * so this short-circuits for every auth mode except a real interactive
+ * (browser) login, which is the only mode that can plausibly represent a
+ * non-admin, delegated end user.
+ *
+ * For a browser-login session, `state.setCallerTrustTierResolver(fn)` (if
+ * set) always wins — a customer's own privilege model, verified against
+ * their own tenant, is preferred over guessing. Failing that, the built-in
+ * heuristic below (`resolveBuiltInCallerTrustTier`) checks the logged-in
+ * identity's own AM-native privilege markers via `frodo.user.readUser()` —
+ * confirmed live, this session, to be self-readable (unlike the equivalent
+ * IDM `teammember` managed-object record, which 403s even for a self-read)
+ * for both ForgeOps/classic (`roles` containing `'ui-global-admin'`) and
+ * cloud (`isMemberOf` containing a known admin-tier group). Any lookup
+ * failure, or no username at all (e.g. a fully custom instance resolver
+ * that never populated `state.getUsername()`), fails toward the more
+ * restrictive `'delegated'` tier rather than guessing.
+ */
+import { State } from '../shared/State';
+/**
+ * The subset of `frodo.user.readUser()`'s result relevant to privilege
+ * classification and display — shared by `resolveBuiltInCallerTrustTier()`
+ * below and by the login-time role/group capture in `AuthenticateOps.ts`
+ * (`session describe`'s "besides the scopes" display), so both consult the
+ * exact same field names/shapes.
+ */
+export type CallerPrivilegeGroups = {
+    roles?: string[];
+    isMemberOf?: string[];
+};
+/**
+ * Looks up the given identity's own AM-native privilege markers
+ * (`frodo.user.readUser()`, root-realm scoped regardless of the caller's
+ * currently-active realm — see `resolveBuiltInCallerTrustTier()`'s own
+ * remarks). Never throws: returns `undefined` for a missing username or any
+ * lookup failure, so a caller can treat "no privilege info available" and
+ * "genuinely no privilege" identically without special-casing errors.
+ */
+export declare function lookupCallerPrivilegeGroups({ username, state, }: {
+    username: string | undefined;
+    state: State;
+}): Promise<CallerPrivilegeGroups | undefined>;
+/**
+ * A customer- (or future built-in-) supplied privilege resolver, plugged in
+ * via `state.setCallerTrustTierResolver()`. Only ever consulted for a real
+ * interactive (browser) login session — every other auth mode already
+ * short-circuits to `'full-trust'` before this would be called.
+ */
+export type CallerTrustTierResolver = (args: {
+    state: State;
+}) => Promise<'full-trust' | 'delegated'>;
+/**
+ * Cloud (AIC) `isMemberOf` group names confirmed live, this session, to
+ * carry full tenant privilege (item 21's privilege-hierarchy tiers 1–2):
+ * `super-admins` ("manages everything... with zero restrictions") and
+ * `tenant-admins` ("everything super admin can do except manage other
+ * admin users and manage admin federation"). Named individually (not just
+ * a combined list) since `ops/PrivilegeEscalationOps.ts` needs to rank
+ * them relative to each other, not just know both are full-trust.
+ * Together, deliberately an allow-list, not a deny-list — any group not
+ * named here (including the two tracked immediately below) fails toward
+ * `'delegated'` by default, so a future, as-yet-unseen AIC admin-group
+ * name can't accidentally grant full trust.
+ */
+export declare const CLOUD_SUPER_ADMIN_GROUP = "super-admins";
+export declare const CLOUD_TENANT_ADMIN_GROUP = "tenant-admins";
+/**
+ * Cloud groups confirmed live this session to exist and be genuinely
+ * narrower than the full-trust tier above (item 21's tiers 6–7) — tracked
+ * explicitly, by name (not just left as an implicit "everything else"), so
+ * a maintainer reading this file can see they were deliberately considered
+ * and excluded, not simply never checked. Not consulted by
+ * `hasCloudFullTrustGroup()` — inclusion here has no effect on the actual
+ * `'delegated'` outcome, which already applies to any group not named in
+ * `CLOUD_FULL_TRUST_GROUPS` above; also reused by
+ * `ops/PrivilegeEscalationOps.ts` to classify these two tiers for the
+ * escalation ladder. `tenant-auditor`: read-only. `brand-admin`: the
+ * narrowest tier, hosted pages/themes only. Both are singular, unlike the
+ * two full-trust groups above — AIC's own group-naming isn't uniformly
+ * pluralized, confirmed by directly inspecting a live identity holding
+ * both simultaneously (`isMemberOf` is additive, not a single value).
+ */
+export declare const CLOUD_TENANT_AUDITOR_GROUP = "tenant-auditor";
+export declare const CLOUD_THEME_ADMIN_GROUP = "brand-admin";
+/**
+ * Resolves and caches (for the life of the session, on `state`) the
+ * caller-privilege tier for the currently-authenticated session.
+ * @param {State} state library state
+ * @returns {Promise<'full-trust' | 'delegated'>} the resolved tier
+ */
+export declare function determineCallerTrustTier({ state, }: {
+    state: State;
+}): Promise<'full-trust' | 'delegated'>;
+//# sourceMappingURL=CallerTrustTierOps.d.ts.map

package/types/ops/CallerTrustTierOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CallerTrustTierOps.d.ts","sourceRoot":"","sources":["../../src/ops/CallerTrustTierOps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAc7C;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,KAAK,CAAC;CACd,KAAK,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC,CAAC;AAe1C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAMxD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAC3D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAmDrD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,KAAK,GACN,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC,CAqBtC"}