@treeseed/sdk 0.13.0-rc.105 → 0.13.0-rc.107

package/dist/identity/browser-session.d.ts

@@ -0,0 +1,233 @@
+import { z } from 'zod';
+/** Encrypted, single-use server-side state; never an application cookie value. */
+export declare const browserLoginTransactionSchema: z.ZodObject<{
+    state: z.ZodString;
+    nonce: z.ZodString;
+    verifier: z.ZodString;
+    expiresAt: z.ZodNumber;
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    clientId: z.ZodString;
+    redirectUri: z.ZodEffects<z.ZodString, string, string>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}>;
+export type BrowserLoginTransaction = z.infer<typeof browserLoginTransactionSchema>;
+/** Private BFF protocol, authenticated with a registered application workload.
+ * These operations are not user/browser or agent-tool credential endpoints.
+ * The server chooses the app namespace from authentication, not request fields.
+ */
+export declare const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+export declare const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+export declare const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+export declare const browserSessionRequests: {
+    begin: z.ZodObject<{
+        browserBinding: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+    }, {
+        browserBinding: string;
+    }>;
+    finish: z.ZodObject<{
+        browserBinding: z.ZodString;
+        callback: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+        callback: string;
+    }, {
+        browserBinding: string;
+        callback: string;
+    }>;
+    credentials: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+    logout: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+};
+export declare const browserSessionResponses: {
+    begin: z.ZodObject<{
+        authorizationUrl: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        authorizationUrl: string;
+    }, {
+        authorizationUrl: string;
+    }>;
+    finish: z.ZodObject<{
+        handle: z.ZodString;
+        expiresAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        expiresAt: string;
+        handle: string;
+    }, {
+        expiresAt: string;
+        handle: string;
+    }>;
+    credentials: z.ZodEffects<z.ZodObject<{
+        accessToken: z.ZodString;
+        resource: z.ZodEffects<z.ZodString, string, string>;
+        expiresAt: z.ZodNumber;
+        principal: z.ZodObject<{
+            principalId: z.ZodEffects<z.ZodString, string, string>;
+            kind: z.ZodEnum<["human", "service", "provider", "agent"]>;
+            identity: z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>;
+            actor: z.ZodOptional<z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>>;
+            audience: z.ZodEffects<z.ZodString, string, string>;
+            scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+        }, "strict", z.ZodTypeAny, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>;
+    logout: z.ZodObject<{
+        loggedOut: z.ZodLiteral<true>;
+        upstreamRevoked: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }>;
+};
+export type BrowserSessionCredentials = z.infer<typeof browserSessionResponses.credentials>;

package/dist/identity/browser-session.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { identityEndpointSchema, identityPrincipalSchema, resourceTokenRequestSchema } from "./contracts.js";
+const opaque = z.string().regex(/^[A-Za-z0-9_-]{43}$/u);
+const clientId = z.string().min(1).max(256);
+const authorizationUrl = z.string().url().max(8192).superRefine((value, context) => {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash)
+    context.addIssue({ code: z.ZodIssueCode.custom, message: "Authorization URLs require HTTPS without credentials or fragments." });
+});
+const browserLoginTransactionSchema = z.object({
+  state: opaque,
+  nonce: opaque,
+  verifier: opaque,
+  expiresAt: z.number().int().positive(),
+  issuer: identityEndpointSchema,
+  clientId,
+  redirectUri: identityEndpointSchema,
+  resource: identityEndpointSchema,
+  scopes: resourceTokenRequestSchema.shape.scopes
+}).strict();
+const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+const browserSessionRequests = {
+  begin: z.object({ browserBinding: opaque }).strict(),
+  finish: z.object({ browserBinding: opaque, callback: authorizationUrl }).strict(),
+  credentials: z.object({ handle: opaque }).strict(),
+  logout: z.object({ handle: opaque }).strict()
+};
+const browserSessionResponses = {
+  begin: z.object({ authorizationUrl }).strict(),
+  finish: z.object({ handle: opaque, expiresAt: z.string().datetime() }).strict(),
+  credentials: z.object({
+    accessToken: z.string().min(1).max(16384),
+    resource: identityEndpointSchema,
+    expiresAt: z.number().int().positive(),
+    principal: identityPrincipalSchema
+  }).strict().superRefine((value, context) => {
+    if (value.resource !== value.principal.audience || value.principal.kind !== "human")
+      context.addIssue({ code: z.ZodIssueCode.custom, message: "Browser credentials require a human principal for this resource." });
+  }),
+  logout: z.object({ loggedOut: z.literal(true), upstreamRevoked: z.boolean() }).strict()
+};
+export {
+  BROWSER_SESSION_BRIDGE_PATH,
+  BROWSER_SESSION_PERMISSION,
+  BROWSER_SESSION_SCOPE,
+  browserLoginTransactionSchema,
+  browserSessionRequests,
+  browserSessionResponses
+};

package/dist/identity/contracts.d.ts

@@ -47,6 +47,37 @@ export declare const protectedResourceMetadataSchema: z.ZodObject<{
     resource_documentation?: string | undefined;
 }>;
 export type ProtectedResourceMetadata = z.infer<typeof protectedResourceMetadataSchema>;
+/** Persist with encrypted native-client tokens. Refresh must revalidate this
+ * issuer/subject and client; email or an API URL cannot substitute for it. */
+export declare const publicClientSessionBindingSchema: z.ZodObject<{
+    identity: z.ZodObject<{
+        issuer: z.ZodEffects<z.ZodString, string, string>;
+        subject: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        issuer: string;
+        subject: string;
+    }, {
+        issuer: string;
+        subject: string;
+    }>;
+    clientId: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    clientId: string;
+}, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    clientId: string;
+}>;
+export type PublicClientSessionBinding = z.infer<typeof publicClientSessionBindingSchema>;
 /** Implemented by Identity; implementations must isolate caches by resource and authority. */
 export interface IdentityCredentials {
     token(request: ResourceTokenRequest): Promise<string>;
@@ -79,12 +110,12 @@ export declare const identityPrincipalSchema: z.ZodObject<{
     scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
 }, "strict", z.ZodTypeAny, {
     scopes: string[];
-    principalId: string;
-    kind: "human" | "service" | "provider" | "agent";
     identity: {
         issuer: string;
         subject: string;
     };
+    principalId: string;
+    kind: "human" | "service" | "provider" | "agent";
     audience: string;
     actor?: {
         issuer: string;
@@ -92,12 +123,12 @@ export declare const identityPrincipalSchema: z.ZodObject<{
     } | undefined;
 }, {
     scopes: string[];
-    principalId: string;
-    kind: "human" | "service" | "provider" | "agent";
     identity: {
         issuer: string;
         subject: string;
     };
+    principalId: string;
+    kind: "human" | "service" | "provider" | "agent";
     audience: string;
     actor?: {
         issuer: string;

package/dist/identity/contracts.js

@@ -28,6 +28,11 @@ const protectedResourceMetadataSchema = z.object({
   bearer_methods_supported: z.array(z.literal("header")).length(1).optional(),
   resource_documentation: identityEndpointSchema.optional()
 });
+const publicClientSessionBindingSchema = z.object({
+  identity: externalIdentitySchema,
+  clientId: identifier.refine((value) => value.length <= 256, "Client identifier is too long."),
+  scopes: scopes.refine((value) => value.length <= 256, "Scope inventory is too large.")
+}).strict();
 const identityPrincipalSchema = z.object({
   principalId: identifier,
   kind: z.enum(["human", "service", "provider", "agent"]),
@@ -62,5 +67,6 @@ export {
   identityEndpointSchema,
   identityPrincipalSchema,
   protectedResourceMetadataSchema,
+  publicClientSessionBindingSchema,
   resourceTokenRequestSchema
 };

package/dist/identity/index.d.ts

@@ -1 +1,2 @@
 export * from './contracts.js';
+export * from './browser-session.js';

package/dist/identity/index.js

@@ -1 +1,2 @@
 export * from "./contracts.js";
+export * from "./browser-session.js";

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,5 +1,6 @@
 import { commandPaths } from "./catalog/infrastructure/command-tree-paths.js";
 import { managedSecretCommands } from "./catalog/services/secret-commands.js";
+import { identityLoginCommand } from "./catalog/services/identity-commands.js";
 import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
 const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
   kind: "unavailable",
@@ -15,7 +16,7 @@ const aiNode = () => field("path", "nodeId", "context", "node", true);
 const aiInstance = () => [field("path", "teamId", "context", "team", true), field("path", "instanceId", "context", "node", true)];
 const operationBindings = {
   ...PROVIDER_ENVIRONMENT_COMMAND_BINDINGS,
-  "auth login": protocol("protocol.oauth.device.login"),
+  "auth login": protocol("protocol.identity.login"),
   "auth logout": protocol("protocol.oauth.revoke"),
   "auth status": operation("accounts.current.show"),
   "users create": protocol("protocol.accounts.create"),
@@ -305,13 +306,7 @@ function userCreate() {
   return value;
 }
 function authLogin() {
-  const value = leaf("login", "mutation");
-  if (value.nodeType !== "leaf") throw new Error("Authentication login must be a leaf command.");
-  value.options = [
-    ...value.options ?? [],
-    { name: "--timeout", description: "Maximum seconds to wait for device authorization.", type: "number" }
-  ];
-  return value;
+  return identityLoginCommand(leaf("login", "mutation"));
 }
 function libraryRead(segment, extraArguments = [], extraOptions = []) {
   return {

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -46,8 +46,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 source: string;
                 mediaType: string;
             } | {
-                kind: "oci-image";
                 identity: string;
+                kind: "oci-image";
                 digest: string;
             }>;
             deploymentId: string;
@@ -117,8 +117,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 source: string;
                 mediaType: string;
             } | {
-                kind: "oci-image";
                 identity: string;
+                kind: "oci-image";
                 digest: string;
             }>;
             planId: string;
@@ -155,6 +155,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     }, {}, undefined, {
         operation: Record<string, unknown> | null;
         receipt: {
+            state: "known-good";
             schemaVersion: "treeseed.hosted-topology-receipt/v1";
             resources: {
                 kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -168,7 +169,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             }[];
             planDigest: string;
             teamId: string;
-            state: "known-good";
             environment: "production" | "staging";
             completedAt: string;
             receiptId: string;
@@ -277,8 +277,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 source: string;
                 mediaType: string;
             } | {
-                kind: "oci-image";
                 identity: string;
+                kind: "oci-image";
                 digest: string;
             }>;
             planId: string;
@@ -363,8 +363,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 source: string;
                 mediaType: string;
             } | {
-                kind: "oci-image";
                 identity: string;
+                kind: "oci-image";
                 digest: string;
             }>;
             planId: string;

package/dist/operator-contracts/catalog/inbox-operations.d.ts

@@ -3,8 +3,8 @@ export declare function inboxOperations(): {
         teamId: string;
     }, {
         kind?: "all" | "proposal" | "question" | undefined;
-        projectId?: string | undefined;
         state?: "all" | "outstanding" | undefined;
+        projectId?: string | undefined;
         cursor?: string | undefined;
         limit?: number | undefined;
     }, undefined, {

package/dist/operator-contracts/catalog/services/identity-commands.d.ts

@@ -0,0 +1,2 @@
+import type { CommandNodeDescriptor } from '../../command-tree.js';
+export declare function identityLoginCommand(value: CommandNodeDescriptor): CommandNodeDescriptor;

package/dist/operator-contracts/catalog/services/identity-commands.js

@@ -0,0 +1,12 @@
+function identityLoginCommand(value) {
+  if (value.nodeType !== "leaf") throw new Error("Authentication login must be a leaf command.");
+  return { ...value, options: [
+    ...value.options ?? [],
+    { name: "--timeout", description: "Maximum seconds to wait for identity authorization.", type: "number" },
+    { name: "--device", description: "Use headless device authorization instead of local browser PKCE.", type: "boolean" },
+    { name: "--issuer", description: "Choose an authorization server advertised by the selected API.", type: "string" }
+  ] };
+}
+export {
+  identityLoginCommand
+};

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -102,8 +102,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         source: string;
                         mediaType: string;
                     } | {
-                        kind: "oci-image";
                         identity: string;
+                        kind: "oci-image";
                         digest: string;
                     }>;
                     deploymentId: string;
@@ -173,8 +173,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         source: string;
                         mediaType: string;
                     } | {
-                        kind: "oci-image";
                         identity: string;
+                        kind: "oci-image";
                         digest: string;
                     }>;
                     planId: string;
@@ -211,6 +211,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             }, {}, undefined, {
                 operation: Record<string, unknown> | null;
                 receipt: {
+                    state: "known-good";
                     schemaVersion: "treeseed.hosted-topology-receipt/v1";
                     resources: {
                         kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -224,7 +225,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     }[];
                     planDigest: string;
                     teamId: string;
-                    state: "known-good";
                     environment: "production" | "staging";
                     completedAt: string;
                     receiptId: string;
@@ -333,8 +333,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         source: string;
                         mediaType: string;
                     } | {
-                        kind: "oci-image";
                         identity: string;
+                        kind: "oci-image";
                         digest: string;
                     }>;
                     planId: string;
@@ -419,8 +419,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         source: string;
                         mediaType: string;
                     } | {
-                        kind: "oci-image";
                         identity: string;
+                        kind: "oci-image";
                         digest: string;
                     }>;
                     planId: string;
@@ -622,8 +622,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             teamId: string;
         }, {
             kind?: "all" | "proposal" | "question" | undefined;
-            projectId?: string | undefined;
             state?: "all" | "outstanding" | undefined;
+            projectId?: string | undefined;
             cursor?: string | undefined;
             limit?: number | undefined;
         }, undefined, {

package/dist/operator-contracts/knowledge/contracts.d.ts

@@ -40,9 +40,9 @@ export declare const knowledgeShareSchema: z.ZodEffects<z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     status: "active" | "revoked" | "expired";
     id: string;
+    expiresAt: string | null;
     schemaVersion: "treeseed.knowledge-share/v1";
     createdAt: string;
-    expiresAt: string | null;
     operations: ("read" | "context" | "query" | "graph")[];
     paths: string[];
     updatedAt: string;
@@ -68,9 +68,9 @@ export declare const knowledgeShareSchema: z.ZodEffects<z.ZodObject<{
 }>, {
     status: "active" | "revoked" | "expired";
     id: string;
+    expiresAt: string | null;
     schemaVersion: "treeseed.knowledge-share/v1";
     createdAt: string;
-    expiresAt: string | null;
     operations: ("read" | "context" | "query" | "graph")[];
     paths: string[];
     updatedAt: string;

package/dist/platform/contracts.d.ts

@@ -311,20 +311,20 @@ export declare const providerRegistrationRequestSchema: z.ZodObject<{
     state: z.ZodEnum<["pending-approval", "approved", "rejected", "revoked"]>;
     createdAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    state: "pending-approval" | "approved" | "rejected" | "revoked";
     schemaVersion: "treeseed.provider-registration-request/v1";
     requestId: string;
     teamId: string;
     publicKey: string;
     capabilities: string[];
-    state: "pending-approval" | "approved" | "rejected" | "revoked";
     createdAt: string;
 }, {
+    state: "pending-approval" | "approved" | "rejected" | "revoked";
     schemaVersion: "treeseed.provider-registration-request/v1";
     requestId: string;
     teamId: string;
     publicKey: string;
     capabilities: string[];
-    state: "pending-approval" | "approved" | "rejected" | "revoked";
     createdAt: string;
 }>;
 export declare const providerSessionSchema: z.ZodObject<{
@@ -335,18 +335,18 @@ export declare const providerSessionSchema: z.ZodObject<{
     expiresAt: z.ZodString;
     token: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    expiresAt: string;
     schemaVersion: "treeseed.provider-session/v1";
     providerId: string;
     scope: string[];
     issuedAt: string;
-    expiresAt: string;
     token: string;
 }, {
+    expiresAt: string;
     schemaVersion: "treeseed.provider-session/v1";
     providerId: string;
     scope: string[];
     issuedAt: string;
-    expiresAt: string;
     token: string;
 }>;
 export declare const environmentProfileDescriptorSchema: z.ZodObject<{
@@ -399,8 +399,8 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodObject<{
     }>;
     expiresAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.assignment-environment-grant/v1";
     expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
     variables: string[];
     assignmentId: string;
     profileId: string;
@@ -409,8 +409,8 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodObject<{
         destinations: string[];
     };
 }, {
-    schemaVersion: "treeseed.assignment-environment-grant/v1";
     expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
     variables: string[];
     assignmentId: string;
     profileId: string;