@sequenceholdings/studio-cli 0.1.13 → 0.1.18

package/dist/auth.d.ts

@@ -10,10 +10,10 @@
  *      cloud agents with no interactive login can still push.
  *      (M2M carries app scopes but NO user identity / workspace membership
  *      — see the `atlas-test-access` rule.)
- *   2. Cached user token — read from the seqapi token file and refreshed
- *      via the Auth0 refresh-token grant when near expiry.
+ *   2. Cached user access token — read from the seqapi token file. When it
+ *      expires, an interactive session performs a bounded PKCE login again.
  *
- * Login and refresh both write the shared file. This mirrors
+ * Login writes the shared file. This mirrors
  * `seqapi._save_tokens` exactly:
  * same fields, same shape, same 0o600 permissions, atomic write via
  * tmpfile + rename. The M2M token is in-memory only (never persisted).
@@ -21,11 +21,50 @@
 export declare const AUTH0_DOMAIN = "dev-n1t8ts403fp8oyxp.us.auth0.com";
 export declare const AUTH0_CLIENT_ID = "GD9riCDWocfc66odpWBjwBiX43qqAX8r";
 export declare const AUTH0_AUDIENCE = "https://api.studio.com";
+/** The realm name the built-in Sequence environments' tokens live under —
+ * also the implicit realm of the legacy flat fields in tokens.json. */
+export declare const SEQUENCE_REALM = "sequence";
+export declare function isSequenceAuthEnvName(envName: string): boolean;
+/**
+ * One Auth0 login context. Mirrors seqapi's `AuthRealm`
+ * (`shared/seqapi/seqapi/config.py`): the Sequence realm is hard-coded;
+ * OpCo-environment realms are read from seqapi's config.json registry,
+ * written by `seq-studio envs add` or `seqapi env add` — both CLIs share one
+ * registry and one token file, so either can log in and the other picks the
+ * session up.
+ */
+export interface AuthRealm {
+    name: string;
+    domain: string;
+    clientId: string;
+    audience: string;
+    organization?: string;
+    m2mClientId?: string;
+}
+/**
+ * A discovery response is not a trust anchor for the host that receives an
+ * M2M client secret. Even another valid *.auth0.com tenant is untrusted;
+ * additional Auth0 tenants/custom domains require an explicit code-reviewed
+ * allowlist entry.
+ */
+export declare function validateAuth0Domain(domain: string): string;
+export declare const SEQUENCE_AUTH_REALM: AuthRealm;
 export interface SeqapiTokens {
-    refresh_token?: string;
     access_token?: string;
     expires_at?: number;
 }
+/**
+ * Resolve the auth realm for an environment name. Undefined, built-ins, and
+ * per-PR preview targets map to the shared Sequence realm. Preview URLs are
+ * constrained to Sequence's preview domain by the environment resolver. Every
+ * other explicit name must have a valid seqapi registry entry; otherwise fail
+ * closed so a shared Sequence bearer token can never be sent to a tenant URL.
+ */
+export declare function realmForEnv(envName?: string): Promise<AuthRealm>;
+/** Env var(s) carrying a realm's M2M client secret — the Sequence realm keeps
+ * the legacy bare name; OpCo realms use a suffixed name so one shell can hold
+ * several credentials unambiguously. Mirrors seqapi's `_m2m_secret_env_names`. */
+export declare function m2mSecretEnvName(realm: AuthRealm): string;
 /**
  * A configured M2M credential failed to mint a token. Typed so callers that
  * normally swallow discovery errors (lazy catalog refresh) can still surface
@@ -38,38 +77,77 @@ export declare function seqapiTokenDir(): string;
 export declare function seqapiTokenPath(): string;
 export declare class NotLoggedInError extends Error {
     readonly name = "NotLoggedInError";
-    constructor();
+    constructor(realmName?: string, reason?: string);
 }
 /**
- * Return a valid access token. Tries the M2M service account first when
- * `AUTH0_M2M_CLIENT_SECRET` is set, then falls back to the cached user
- * token (refreshed via the Auth0 refresh-token grant when within 60s of
- * expiry). Same precedence as seqapi's `get_access_token`, so both CLIs
- * resolve the same identity for the same environment.
+ * Return a valid access token for an environment's auth realm. Tries the
+ * realm's M2M service account first (secret env var), then falls back to the
+ * cached user access token. Expired user sessions perform bounded PKCE login
+ * when browser auto-login is enabled. Same precedence and token file as seqapi's
+ * `get_access_token`, so both CLIs resolve the same identity for the same
+ * environment. No `env` (or a built-in Sequence env) means the shared
+ * Sequence realm — the legacy behavior every existing caller gets unchanged.
  */
-export declare function getAccessToken(): Promise<string>;
+export declare class UnsafeAuthTargetError extends Error {
+}
+export type AuthMode = 'm2m' | 'user';
+export interface ResolvedAccessToken {
+    authMode: AuthMode;
+    token: string;
+}
+export declare function getAccessTokenWithMode(options?: {
+    /** Disable browser PKCE fallback for probe-only and other non-interactive callers. */
+    allowInteractiveLogin?: boolean;
+    env?: string;
+    targetUrl?: string;
+}): Promise<ResolvedAccessToken>;
+export declare function getAccessToken(options?: {
+    /** Disable browser PKCE fallback for probe-only and other non-interactive callers. */
+    allowInteractiveLogin?: boolean;
+    env?: string;
+    targetUrl?: string;
+}): Promise<string>;
 /**
  * Try to load a token without throwing. Returns `null` for any error
  * condition (missing file, parse error, no token fields). Used by
  * `doctor` for non-fatal "are you logged in?" checks.
  */
-export declare function tryGetAccessToken(options?: {
+export declare function tryGetAccessTokenWithMode(options?: {
     /**
      * When the M2M secret is configured, failing to mint an M2M token should fail
      * closed (avoid silently falling back to some other cached identity).
      */
     failClosedForM2m?: boolean;
+    /** Environment name — selects the auth realm (default: Sequence). */
+    env?: string;
+    /** Resolved request origin — checked against the realm before returning credentials. */
+    targetUrl?: string;
+}): Promise<ResolvedAccessToken | null>;
+export declare function tryGetAccessToken(options?: {
+    failClosedForM2m?: boolean;
+    env?: string;
+    targetUrl?: string;
 }): Promise<string | null>;
 /**
- * Decode the `sub` claim from a JWT without verification. Verification is the
- * server's job — this is only used to compare identities locally (e.g. to
- * bind the cached environment catalog to the identity that fetched it).
+ * Refuse to persist a token minted for another audience or Auth0
+ * organization. Auth0/server-side JWT verification remains authoritative;
+ * this local decode is only a cross-realm confusion check on a token received
+ * directly from the configured Auth0 tenant over TLS.
  */
+export declare function verifyTokenMatchesRealm({ accessToken, realm, requireOrganization, }: {
+    accessToken: string;
+    realm: AuthRealm;
+    requireOrganization?: boolean;
+}): void;
 export declare function decodeJwtSub(token: string): string | null;
 /**
  * The Auth0 subject the CLI would authenticate as right now, without any
- * network call: the fixed M2M client subject when the secret is configured,
- * else the `sub` of the cached user token, else null (anonymous).
+ * network call: the requested realm's M2M client subject when its secret is
+ * configured, else the `sub` of that realm's cached user token, else null.
  */
-export declare function currentIdentitySubject(): Promise<string | null>;
-export declare function saveTokens(tokens: SeqapiTokens): Promise<void>;
+export declare function currentIdentitySubject(options?: {
+    env?: string;
+}): Promise<string | null>;
+export declare function loadCachedUserTokens(realmName?: string): Promise<SeqapiTokens | null>;
+export declare function saveTokens(tokens: SeqapiTokens, realmName?: string): Promise<void>;
+export declare function deleteRealmTokens(realmName: string): Promise<void>;