@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/api/auth/memory-provider.d.ts

@@ -1,82 +0,0 @@
-import type { ApiAuthProvider, ApiConfig, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare class MemoryDeviceCodeAuthProvider implements ApiAuthProvider {
-    private readonly config;
-    readonly id = "memory";
-    private readonly devices;
-    private readonly refreshSessions;
-    constructor(config: ApiConfig);
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: {
-            type: "access_token";
-            id: string;
-            label: "service" | "access";
-        };
-    } | null>;
-    authenticateServiceCredential(_serviceId: string, _secret: string): Promise<null>;
-    createPersonalAccessToken(_userId: string, _input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): Promise<{
-        id: string;
-        token: string;
-        prefix: string;
-        name: string;
-        expiresAt: string | null;
-    }>;
-    listPersonalAccessTokens(): Promise<never[]>;
-    revokePersonalAccessToken(): Promise<void>;
-    syncUserIdentity(identity: UserIdentityProfileInput): Promise<{
-        userId: string;
-        identityId: string;
-        principal: {
-            id: string;
-            displayName: string | undefined;
-            scopes: string[];
-            roles: string[];
-            permissions: string[];
-            metadata: {
-                username: string | undefined;
-                firstName: string | undefined;
-                lastName: string | undefined;
-            };
-        };
-    }>;
-    createServiceToken(_input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<{
-        id: string;
-        serviceId: string;
-        secret: string;
-    }>;
-    rotateServiceToken(_serviceId: string): Promise<{
-        id: string;
-        serviceId: string;
-        secret: string;
-    }>;
-    createTrustedUserAssertion(claims: TrustedUserAssertionClaims): string;
-    verifyTrustedUserAssertion(assertion: string): TrustedUserAssertionClaims | null;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): Promise<{
-        ok: true;
-        accessToken: string;
-        tokenType: "Bearer";
-        expiresAt: string;
-        expiresInSeconds: number;
-        principal: ApiPrincipal;
-    }>;
-}

package/dist/api/auth/memory-provider.js

@@ -1,297 +0,0 @@
-import { randomUUID } from "node:crypto";
-import {
-  createAccessToken,
-  nextOpaqueToken,
-  principalFromAccessTokenPayload,
-  verifyAccessToken
-} from "./tokens.js";
-function nowSeconds() {
-  return Math.floor(Date.now() / 1e3);
-}
-function formatExpiry(epochSeconds) {
-  return new Date(epochSeconds * 1e3).toISOString();
-}
-function nextUserCode() {
-  return Math.random().toString(36).slice(2, 6).toUpperCase() + "-" + Math.random().toString(36).slice(2, 6).toUpperCase();
-}
-function approvalUrl(baseUrl, userCode) {
-  const url = new URL("/auth/device/approve", `${baseUrl.replace(/\/+$/u, "")}/`);
-  if (userCode) {
-    url.searchParams.set("user_code", userCode);
-  }
-  return url.toString();
-}
-class MemoryDeviceCodeAuthProvider {
-  constructor(config) {
-    this.config = config;
-  }
-  config;
-  id = "memory";
-  devices = /* @__PURE__ */ new Map();
-  refreshSessions = /* @__PURE__ */ new Map();
-  async startDeviceFlow(request) {
-    const expiresAt = nowSeconds() + this.config.deviceCodeTtlSeconds;
-    const deviceCode = nextOpaqueToken("device");
-    const userCode = nextUserCode();
-    this.devices.set(deviceCode, {
-      deviceCode,
-      userCode,
-      requestedScopes: request.scopes?.length ? [...request.scopes] : ["templates:read", "auth:me", "sdk", "operations"],
-      expiresAt,
-      intervalSeconds: this.config.deviceCodePollIntervalSeconds,
-      status: "pending",
-      principal: null
-    });
-    return {
-      ok: true,
-      deviceCode,
-      userCode,
-      verificationUri: approvalUrl(this.config.baseUrl),
-      verificationUriComplete: approvalUrl(this.config.baseUrl, userCode),
-      intervalSeconds: this.config.deviceCodePollIntervalSeconds,
-      expiresAt: formatExpiry(expiresAt),
-      expiresInSeconds: this.config.deviceCodeTtlSeconds
-    };
-  }
-  async approveDeviceFlow(request) {
-    const record = [...this.devices.values()].find((entry) => entry.userCode === request.userCode);
-    if (!record || record.expiresAt <= nowSeconds()) {
-      throw new Error("Device code approval failed because the user code is unknown or expired.");
-    }
-    record.status = "approved";
-    record.principal = {
-      id: request.principalId,
-      displayName: request.displayName,
-      scopes: request.scopes?.length ? [...request.scopes] : [...record.requestedScopes],
-      roles: ["member"],
-      permissions: ["auth:read:self"],
-      metadata: request.metadata
-    };
-    return { ok: true };
-  }
-  async pollDeviceFlow(request) {
-    const record = this.devices.get(request.deviceCode);
-    if (!record) {
-      return { ok: false, status: "invalid", error: "Unknown device code." };
-    }
-    if (record.expiresAt <= nowSeconds()) {
-      this.devices.delete(request.deviceCode);
-      return { ok: false, status: "expired", error: "Device code expired." };
-    }
-    if (record.status === "pending" || !record.principal) {
-      return {
-        ok: true,
-        status: "pending",
-        intervalSeconds: record.intervalSeconds
-      };
-    }
-    if (record.status === "used") {
-      return { ok: false, status: "already_used", error: "Device code already used." };
-    }
-    record.status = "used";
-    const refreshToken = nextOpaqueToken("refresh");
-    const expiresAt = nowSeconds() + this.config.accessTokenTtlSeconds;
-    const accessToken = createAccessToken({
-      sub: record.principal.id,
-      displayName: record.principal.displayName,
-      scopes: record.principal.scopes,
-      roles: record.principal.roles,
-      permissions: record.principal.permissions,
-      metadata: record.principal.metadata,
-      iat: nowSeconds(),
-      exp: expiresAt,
-      iss: this.config.issuer,
-      jti: randomUUID(),
-      tokenType: "access"
-    }, this.config.authSecret);
-    this.refreshSessions.set(refreshToken, {
-      principal: record.principal,
-      expiresAt: nowSeconds() + this.config.refreshTokenTtlSeconds
-    });
-    return {
-      ok: true,
-      status: "approved",
-      accessToken,
-      refreshToken,
-      tokenType: "Bearer",
-      expiresAt: formatExpiry(expiresAt),
-      expiresInSeconds: this.config.accessTokenTtlSeconds,
-      principal: record.principal
-    };
-  }
-  async refreshAccessToken(request) {
-    const session = this.refreshSessions.get(request.refreshToken);
-    if (!session || session.expiresAt <= nowSeconds()) {
-      throw new Error("Refresh token is invalid or expired.");
-    }
-    const nextRefreshToken = nextOpaqueToken("refresh");
-    this.refreshSessions.delete(request.refreshToken);
-    this.refreshSessions.set(nextRefreshToken, {
-      principal: session.principal,
-      expiresAt: nowSeconds() + this.config.refreshTokenTtlSeconds
-    });
-    const expiresAt = nowSeconds() + this.config.accessTokenTtlSeconds;
-    const accessToken = createAccessToken({
-      sub: session.principal.id,
-      displayName: session.principal.displayName,
-      scopes: session.principal.scopes,
-      roles: session.principal.roles,
-      permissions: session.principal.permissions,
-      metadata: session.principal.metadata,
-      iat: nowSeconds(),
-      exp: expiresAt,
-      iss: this.config.issuer,
-      jti: randomUUID(),
-      tokenType: "access"
-    }, this.config.authSecret);
-    return {
-      ok: true,
-      accessToken,
-      refreshToken: nextRefreshToken,
-      tokenType: "Bearer",
-      expiresAt: formatExpiry(expiresAt),
-      expiresInSeconds: this.config.accessTokenTtlSeconds,
-      principal: session.principal
-    };
-  }
-  async issueUserSession(userId, options = {}) {
-    const principal = {
-      id: userId,
-      displayName: userId,
-      scopes: options.scopes ?? ["auth:me"],
-      roles: ["member"],
-      permissions: ["auth:read:self"],
-      metadata: {
-        ...options.data ?? {},
-        sessionType: options.sessionType ?? "web"
-      }
-    };
-    const refreshToken = nextOpaqueToken("refresh");
-    this.refreshSessions.set(refreshToken, {
-      principal,
-      expiresAt: nowSeconds() + this.config.refreshTokenTtlSeconds
-    });
-    const expiresAt = nowSeconds() + this.config.accessTokenTtlSeconds;
-    return {
-      ok: true,
-      status: "approved",
-      accessToken: createAccessToken({
-        sub: principal.id,
-        displayName: principal.displayName,
-        scopes: principal.scopes,
-        roles: principal.roles,
-        permissions: principal.permissions,
-        metadata: principal.metadata,
-        iat: nowSeconds(),
-        exp: expiresAt,
-        iss: this.config.issuer,
-        jti: randomUUID(),
-        tokenType: "access"
-      }, this.config.authSecret),
-      refreshToken,
-      tokenType: "Bearer",
-      expiresAt: formatExpiry(expiresAt),
-      expiresInSeconds: this.config.accessTokenTtlSeconds,
-      principal
-    };
-  }
-  async authenticateBearerToken(token) {
-    const payload = verifyAccessToken(token, this.config.authSecret);
-    return payload ? {
-      principal: principalFromAccessTokenPayload(payload),
-      credential: {
-        type: "access_token",
-        id: payload.jti,
-        label: payload.tokenType
-      }
-    } : null;
-  }
-  async authenticateServiceCredential(_serviceId, _secret) {
-    return null;
-  }
-  async createPersonalAccessToken(_userId, _input) {
-    throw new Error("Personal access tokens are unavailable in the memory auth provider.");
-  }
-  async listPersonalAccessTokens() {
-    return [];
-  }
-  async revokePersonalAccessToken() {
-  }
-  async syncUserIdentity(identity) {
-    return {
-      userId: identity.providerSubject,
-      identityId: identity.providerSubject,
-      principal: {
-        id: identity.providerSubject,
-        displayName: identity.displayName ?? void 0,
-        scopes: ["auth:me"],
-        roles: ["member"],
-        permissions: ["auth:read:self"],
-        metadata: {
-          ...identity.profile ?? {},
-          username: identity.username ?? void 0,
-          firstName: typeof identity.profile?.firstName === "string" ? identity.profile.firstName : void 0,
-          lastName: typeof identity.profile?.lastName === "string" ? identity.profile.lastName : void 0
-        }
-      }
-    };
-  }
-  async createServiceToken(_input) {
-    throw new Error("Service credentials are unavailable in the memory auth provider.");
-  }
-  async rotateServiceToken(_serviceId) {
-    throw new Error("Service credentials are unavailable in the memory auth provider.");
-  }
-  createTrustedUserAssertion(claims) {
-    return Buffer.from(JSON.stringify(claims)).toString("base64url");
-  }
-  verifyTrustedUserAssertion(assertion) {
-    try {
-      return JSON.parse(Buffer.from(assertion, "base64url").toString("utf8"));
-    } catch {
-      return null;
-    }
-  }
-  async exchangeTrustedUserAssertion(claims) {
-    const principal = {
-      id: claims.userId,
-      displayName: claims.userId,
-      scopes: ["auth:me"],
-      roles: ["member"],
-      permissions: ["auth:read:self"],
-      metadata: {
-        sessionId: claims.sessionId,
-        identityId: claims.identityId,
-        teamId: claims.teamId ?? null,
-        projectId: claims.projectId ?? null,
-        membershipId: claims.membershipId ?? null,
-        teamRoles: claims.teamRoles ?? [],
-        teamCapabilities: claims.teamCapabilities ?? []
-      }
-    };
-    const expiresAt = nowSeconds() + this.config.accessTokenTtlSeconds;
-    return {
-      ok: true,
-      accessToken: createAccessToken({
-        sub: principal.id,
-        displayName: principal.displayName,
-        scopes: principal.scopes,
-        roles: principal.roles,
-        permissions: principal.permissions,
-        metadata: principal.metadata,
-        iat: nowSeconds(),
-        exp: expiresAt,
-        iss: this.config.issuer,
-        jti: randomUUID(),
-        tokenType: "access"
-      }, this.config.authSecret),
-      tokenType: "Bearer",
-      expiresAt: formatExpiry(expiresAt),
-      expiresInSeconds: this.config.accessTokenTtlSeconds,
-      principal
-    };
-  }
-}
-export {
-  MemoryDeviceCodeAuthProvider
-};

package/dist/api/auth/rbac.d.ts

@@ -1,22 +0,0 @@
-export declare const CONTENT_RESOURCES: readonly ["pages", "notes", "questions", "objectives", "proposals", "decisions", "people", "agents", "books", "templates", "knowledge_packs", "workdays"];
-export declare const PLATFORM_RESOURCES: readonly ["users", "roles", "api_tokens", "services", "jobs", "audit", "auth", "sdk", "agent", "operations"];
-export declare const ALL_PERMISSION_RESOURCES: readonly ["pages", "notes", "questions", "objectives", "proposals", "decisions", "people", "agents", "books", "templates", "knowledge_packs", "workdays", "users", "roles", "api_tokens", "services", "jobs", "audit", "auth", "sdk", "agent", "operations"];
-export type PermissionResource = (typeof ALL_PERMISSION_RESOURCES)[number];
-export type PermissionAction = 'read' | 'create' | 'update' | 'delete' | 'manage' | 'execute' | 'impersonate';
-export type PermissionScope = 'self' | 'global';
-export interface PermissionDefinition {
-    key: string;
-    resource: PermissionResource | '*';
-    action: PermissionAction | '*';
-    scope: PermissionScope | '*';
-    description: string;
-}
-export interface RoleDefinition {
-    key: string;
-    description: string;
-    permissions: string[];
-}
-export declare function permissionKey(resource: PermissionDefinition['resource'], action: PermissionDefinition['action'], scope: PermissionDefinition['scope']): string;
-export declare const DEFAULT_PERMISSIONS: PermissionDefinition[];
-export declare const DEFAULT_ROLES: RoleDefinition[];
-export declare function permissionGranted(granted: string[], required: string): boolean;

package/dist/api/auth/rbac.js

@@ -1,162 +0,0 @@
-const CONTENT_RESOURCES = [
-  "pages",
-  "notes",
-  "questions",
-  "objectives",
-  "proposals",
-  "decisions",
-  "people",
-  "agents",
-  "books",
-  "templates",
-  "knowledge_packs",
-  "workdays"
-];
-const PLATFORM_RESOURCES = [
-  "users",
-  "roles",
-  "api_tokens",
-  "services",
-  "jobs",
-  "audit",
-  "auth",
-  "sdk",
-  "agent",
-  "operations"
-];
-const ALL_PERMISSION_RESOURCES = [...CONTENT_RESOURCES, ...PLATFORM_RESOURCES];
-function permissionKey(resource, action, scope) {
-  return `${resource}:${action}:${scope}`;
-}
-function contentPermission(resource, action, scope, description) {
-  return {
-    key: permissionKey(resource, action, scope),
-    resource,
-    action,
-    scope,
-    description
-  };
-}
-const permissionDefinitions = [
-  {
-    key: permissionKey("*", "*", "*"),
-    resource: "*",
-    action: "*",
-    scope: "*",
-    description: "Full platform access."
-  },
-  contentPermission("auth", "read", "self", "Read the authenticated principal."),
-  contentPermission("api_tokens", "read", "self", "List personal API tokens."),
-  contentPermission("api_tokens", "create", "self", "Create personal API tokens."),
-  contentPermission("api_tokens", "delete", "self", "Revoke personal API tokens."),
-  contentPermission("services", "impersonate", "global", "Allow trusted web and service impersonation flows."),
-  contentPermission("services", "manage", "global", "Manage service credentials and internal service auth."),
-  contentPermission("users", "read", "global", "Read user records."),
-  contentPermission("users", "manage", "global", "Manage user records."),
-  contentPermission("roles", "manage", "global", "Manage role assignments."),
-  contentPermission("audit", "read", "global", "Read audit events."),
-  contentPermission("jobs", "manage", "global", "Manage internal job and worker control surfaces."),
-  contentPermission("sdk", "execute", "global", "Execute SDK routes."),
-  contentPermission("agent", "execute", "global", "Execute agent routes."),
-  contentPermission("operations", "execute", "global", "Execute workflow operation routes.")
-];
-for (const resource of CONTENT_RESOURCES) {
-  permissionDefinitions.push(
-    contentPermission(resource, "read", "global", `Read ${resource}.`),
-    contentPermission(resource, "create", "global", `Create ${resource}.`),
-    contentPermission(resource, "update", "global", `Update ${resource}.`),
-    contentPermission(resource, "delete", "global", `Delete ${resource}.`)
-  );
-}
-const DEFAULT_PERMISSIONS = permissionDefinitions;
-const DEFAULT_ROLES = [
-  {
-    key: "platform_admin",
-    description: "Full platform administration.",
-    permissions: [permissionKey("*", "*", "*")]
-  },
-  {
-    key: "market_admin",
-    description: "Manage market content and core operational surfaces.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self"),
-      permissionKey("sdk", "execute", "global"),
-      permissionKey("agent", "execute", "global"),
-      permissionKey("operations", "execute", "global"),
-      permissionKey("users", "read", "global"),
-      permissionKey("audit", "read", "global"),
-      permissionKey("jobs", "manage", "global")
-    ]
-  },
-  {
-    key: "content_admin",
-    description: "Manage all content resources.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "content_editor",
-    description: "Edit marketplace content.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "member",
-    description: "Authenticated member with personal API tokens.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "viewer",
-    description: "Read-only marketplace viewer.",
-    permissions: [permissionKey("auth", "read", "self")]
-  }
-];
-for (const role of DEFAULT_ROLES) {
-  if (role.key === "content_admin") {
-    for (const resource of CONTENT_RESOURCES) {
-      role.permissions.push(
-        permissionKey(resource, "read", "global"),
-        permissionKey(resource, "create", "global"),
-        permissionKey(resource, "update", "global"),
-        permissionKey(resource, "delete", "global")
-      );
-    }
-  }
-  if (role.key === "content_editor") {
-    for (const resource of CONTENT_RESOURCES) {
-      role.permissions.push(
-        permissionKey(resource, "read", "global"),
-        permissionKey(resource, "create", "global"),
-        permissionKey(resource, "update", "global")
-      );
-    }
-  }
-}
-function permissionGranted(granted, required) {
-  return granted.includes(permissionKey("*", "*", "*")) || granted.includes(required);
-}
-export {
-  ALL_PERMISSION_RESOURCES,
-  CONTENT_RESOURCES,
-  DEFAULT_PERMISSIONS,
-  DEFAULT_ROLES,
-  PLATFORM_RESOURCES,
-  permissionGranted,
-  permissionKey
-};

package/dist/api/auth/tokens.d.ts

@@ -1,18 +0,0 @@
-import type { ApiPrincipal } from '../types.js';
-export interface AccessTokenPayload {
-    sub: string;
-    displayName?: string;
-    scopes: string[];
-    roles: string[];
-    permissions: string[];
-    iat: number;
-    exp: number;
-    iss: string;
-    jti: string;
-    tokenType: 'access' | 'service';
-    metadata?: Record<string, unknown>;
-}
-export declare function nextOpaqueToken(prefix: string): string;
-export declare function createAccessToken(payload: AccessTokenPayload, secret: string): string;
-export declare function verifyAccessToken(token: string, secret: string): AccessTokenPayload | null;
-export declare function principalFromAccessTokenPayload(payload: AccessTokenPayload): ApiPrincipal;

package/dist/api/auth/tokens.js

@@ -1,56 +0,0 @@
-import { createHmac, randomBytes } from "node:crypto";
-function encodeBase64Url(value) {
-  return Buffer.from(value).toString("base64url");
-}
-function decodeBase64Url(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-function sign(input, secret) {
-  return createHmac("sha256", secret).update(input).digest("base64url");
-}
-function nextOpaqueToken(prefix) {
-  return `${prefix}_${randomBytes(24).toString("base64url")}`;
-}
-function createAccessToken(payload, secret) {
-  const encodedPayload = encodeBase64Url(JSON.stringify(payload));
-  const encodedSignature = sign(encodedPayload, secret);
-  return `${encodedPayload}.${encodedSignature}`;
-}
-function verifyAccessToken(token, secret) {
-  const [encodedPayload, encodedSignature] = token.split(".");
-  if (!encodedPayload || !encodedSignature) {
-    return null;
-  }
-  const expected = sign(encodedPayload, secret);
-  if (expected !== encodedSignature) {
-    return null;
-  }
-  try {
-    const payload = JSON.parse(decodeBase64Url(encodedPayload));
-    if (!payload.sub || !Array.isArray(payload.scopes) || !payload.exp) {
-      return null;
-    }
-    if (payload.exp <= Math.floor(Date.now() / 1e3)) {
-      return null;
-    }
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function principalFromAccessTokenPayload(payload) {
-  return {
-    id: payload.sub,
-    displayName: payload.displayName,
-    scopes: [...payload.scopes],
-    roles: [...payload.roles],
-    permissions: [...payload.permissions],
-    metadata: payload.metadata
-  };
-}
-export {
-  createAccessToken,
-  nextOpaqueToken,
-  principalFromAccessTokenPayload,
-  verifyAccessToken
-};

package/dist/api/config.d.ts

@@ -1,4 +0,0 @@
-import type { ApiConfig } from './types.js';
-export declare function resolveLocalApiDatabaseUrl(env?: NodeJS.ProcessEnv): string;
-export declare function resolveApiDatabaseUrl(env?: NodeJS.ProcessEnv, baseUrl?: string): string | undefined;
-export declare function resolveApiConfig(env?: NodeJS.ProcessEnv): ApiConfig;