@sema-agent/settings-schema 2.1.0 → 3.0.0

package/dist/api/wire.js

@@ -1,89 +0,0 @@
-/**
- * `api/wire` — the ZERO-DEPENDENCY wire subset of the auth/scopes contracts (server AI 接手首车,
- * 2026-07-27,跨仓 candidate 落地):endpoint paths, protocol constants and PURE helper functions,
- * with **no zod import** — so a zero-runtime-dependency client (e.g. `@sema-agent/sdk/registry`) can
- * import these at RUNTIME instead of value-copying them behind a same-source anchor test.
- *
- * ⚠️ 拆分纪律:这里只放**纯**件(常量/纯函数/字面量类型)。zod schema 留在 `api/auth.ts` /
- * `api/scopes.ts`(它们 re-export 本文件 ⇒ 既有导入面字节兼容,谁都不用改)。给本文件加东西前
- * 自问:它 import 了任何东西吗?——答案必须是 no(test/wire-purity 打包门盯着)。
- */
-// ── auth: endpoint paths + protocol constants(api/auth.ts 原件,shipped values 冻结)─────────────────
-/** The five auth endpoints, relative to the registry origin. */
-export const AUTH_V1_PATHS = {
-    deviceCode: "/api/v1/auth/device/code",
-    deviceToken: "/api/v1/auth/device/token",
-    deviceApprove: "/api/v1/auth/device/approve",
-    tokenRefresh: "/api/v1/auth/token/refresh",
-    logout: "/api/v1/auth/logout",
-};
-/** The RFC 8628 grant_type the device token endpoint requires. */
-export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-/** Minimum seconds between token-endpoint polls (RFC 8628 `interval`); polling faster → `slow_down`. */
-export const DEVICE_POLL_INTERVAL_SECONDS = 5;
-/** Device-code handshake lifetime (seconds) — the user has 15 minutes to open /activate and approve. */
-export const DEVICE_CODE_TTL_SECONDS = 15 * 60;
-/** Access-token (RS256 JWT) lifetime in seconds — 1h, re-minted via refresh. */
-export const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-/** Refresh-grant lifetime (seconds) — 30d SLIDING: every rotation opens a fresh 30d window. */
-export const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
-/** Every error code the /api/v1/auth/* endpoints answer (HTTP 400 unless noted). */
-export const OAUTH_ERROR_CODES = [
-    /** device/token: the user has not approved (or denied) the handshake yet — keep polling. */
-    "authorization_pending",
-    /** device/token: polling faster than `interval` — RFC 8628 §3.5: ADD 5 seconds to the interval. */
-    "slow_down",
-    /** device/token: handshake expired, unknown, or already exchanged — restart the flow.
-     *  (Deliberately covers "never existed": the server does not disclose handshake existence.) */
-    "expired_token",
-    /** device/token: the user explicitly denied the handshake — stop polling, do not restart silently. */
-    "access_denied",
-    /** any endpoint: malformed body / missing required field / wrong content type. */
-    "invalid_request",
-    /** device/token: grant_type is not DEVICE_GRANT_TYPE. */
-    "unsupported_grant_type",
-    /** token/refresh + device/approve: unknown / expired / revoked / replayed token or code — no detail. */
-    "invalid_grant",
-    /** SSO not configured on the registry (HTTP 503) — a deployment problem, not a client one. */
-    "server_error",
-];
-/** Handshake states a consent-screen lookup can see. (`approved` rows vanish once exchanged/consumed.)
- *  `denied` is contract-reserved for an explicit deny button (pairs with the `access_denied` poll error);
- *  the shipped M1 store carries pending|approved only — adding deny later is implementation, not schema. */
-export const DEVICE_AUTH_STATUSES = ["pending", "approved", "denied"];
-// ── auth: pure client-side helpers(api/auth.ts 原件)────────────────────────────────────────────────────
-/**
- * Canonicalize a human-typed user code to the wire shape "XXXX-XXXX": uppercase, dashes/spaces optional.
- * null = not a plausible code (wrong length/charset after stripping separators). Same normalization the
- * server applies — run it client-side for instant feedback.
- */
-export function normalizeUserCode(input) {
-    if (typeof input !== "string")
-        return null;
-    const raw = input.toUpperCase().replace(/[\s-]/g, "");
-    if (!/^[A-Z0-9]{8}$/.test(raw))
-        return null;
-    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
-}
-/**
- * The RFC 8628 §3.5 poll-loop step: what interval to poll with next, and whether to keep going.
- * - authorization_pending → keep polling at the current interval
- * - slow_down             → keep polling, interval + 5s (the RFC-mandated increment)
- * - anything else         → stop (expired_token/access_denied = terminal; invalid_* = client bug)
- */
-export function nextPollInterval(currentIntervalSeconds, error) {
-    if (error === "authorization_pending")
-        return { continue: true, intervalSeconds: currentIntervalSeconds };
-    if (error === "slow_down")
-        return { continue: true, intervalSeconds: currentIntervalSeconds + 5 };
-    return { continue: false, intervalSeconds: currentIntervalSeconds };
-}
-// ── scopes: endpoint paths + claim(api/scopes.ts 原件)─────────────────────────────────────────────────
-export const SCOPES_V1_PATHS = {
-    /** GET (list) + POST (create). */
-    scopes: "/api/v1/scopes",
-    /** POST — mint a new access token bound to another scope. */
-    authScope: "/api/v1/auth/scope",
-};
-/** The JWT claim carrying the token's active scope. OPTIONAL — absent means GLOBAL_SCOPE (tokenScopeOf). */
-export const SCOPE_CLAIM = "scope";