@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

package/dist/identity/browser-session.d.ts

@@ -0,0 +1,233 @@
+import { z } from 'zod';
+/** Encrypted, single-use server-side state; never an application cookie value. */
+export declare const browserLoginTransactionSchema: z.ZodObject<{
+    state: z.ZodString;
+    nonce: z.ZodString;
+    verifier: z.ZodString;
+    expiresAt: z.ZodNumber;
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    clientId: z.ZodString;
+    redirectUri: z.ZodEffects<z.ZodString, string, string>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}>;
+export type BrowserLoginTransaction = z.infer<typeof browserLoginTransactionSchema>;
+/** Private BFF protocol, authenticated with a registered application workload.
+ * These operations are not user/browser or agent-tool credential endpoints.
+ * The server chooses the app namespace from authentication, not request fields.
+ */
+export declare const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+export declare const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+export declare const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+export declare const browserSessionRequests: {
+    begin: z.ZodObject<{
+        browserBinding: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+    }, {
+        browserBinding: string;
+    }>;
+    finish: z.ZodObject<{
+        browserBinding: z.ZodString;
+        callback: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+        callback: string;
+    }, {
+        browserBinding: string;
+        callback: string;
+    }>;
+    credentials: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+    logout: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+};
+export declare const browserSessionResponses: {
+    begin: z.ZodObject<{
+        authorizationUrl: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        authorizationUrl: string;
+    }, {
+        authorizationUrl: string;
+    }>;
+    finish: z.ZodObject<{
+        handle: z.ZodString;
+        expiresAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        expiresAt: string;
+        handle: string;
+    }, {
+        expiresAt: string;
+        handle: string;
+    }>;
+    credentials: z.ZodEffects<z.ZodObject<{
+        accessToken: z.ZodString;
+        resource: z.ZodEffects<z.ZodString, string, string>;
+        expiresAt: z.ZodNumber;
+        principal: z.ZodObject<{
+            principalId: z.ZodEffects<z.ZodString, string, string>;
+            kind: z.ZodEnum<["human", "service", "provider", "agent"]>;
+            identity: z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>;
+            actor: z.ZodOptional<z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>>;
+            audience: z.ZodEffects<z.ZodString, string, string>;
+            scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+        }, "strict", z.ZodTypeAny, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>;
+    logout: z.ZodObject<{
+        loggedOut: z.ZodLiteral<true>;
+        upstreamRevoked: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }>;
+};
+export type BrowserSessionCredentials = z.infer<typeof browserSessionResponses.credentials>;

package/dist/identity/browser-session.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { identityEndpointSchema, identityPrincipalSchema, resourceTokenRequestSchema } from "./contracts.js";
+const opaque = z.string().regex(/^[A-Za-z0-9_-]{43}$/u);
+const clientId = z.string().min(1).max(256);
+const authorizationUrl = z.string().url().max(8192).superRefine((value, context) => {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash)
+    context.addIssue({ code: z.ZodIssueCode.custom, message: "Authorization URLs require HTTPS without credentials or fragments." });
+});
+const browserLoginTransactionSchema = z.object({
+  state: opaque,
+  nonce: opaque,
+  verifier: opaque,
+  expiresAt: z.number().int().positive(),
+  issuer: identityEndpointSchema,
+  clientId,
+  redirectUri: identityEndpointSchema,
+  resource: identityEndpointSchema,
+  scopes: resourceTokenRequestSchema.shape.scopes
+}).strict();
+const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+const browserSessionRequests = {
+  begin: z.object({ browserBinding: opaque }).strict(),
+  finish: z.object({ browserBinding: opaque, callback: authorizationUrl }).strict(),
+  credentials: z.object({ handle: opaque }).strict(),
+  logout: z.object({ handle: opaque }).strict()
+};
+const browserSessionResponses = {
+  begin: z.object({ authorizationUrl }).strict(),
+  finish: z.object({ handle: opaque, expiresAt: z.string().datetime() }).strict(),
+  credentials: z.object({
+    accessToken: z.string().min(1).max(16384),
+    resource: identityEndpointSchema,
+    expiresAt: z.number().int().positive(),
+    principal: identityPrincipalSchema
+  }).strict().superRefine((value, context) => {
+    if (value.resource !== value.principal.audience || value.principal.kind !== "human")
+      context.addIssue({ code: z.ZodIssueCode.custom, message: "Browser credentials require a human principal for this resource." });
+  }),
+  logout: z.object({ loggedOut: z.literal(true), upstreamRevoked: z.boolean() }).strict()
+};
+export {
+  BROWSER_SESSION_BRIDGE_PATH,
+  BROWSER_SESSION_PERMISSION,
+  BROWSER_SESSION_SCOPE,
+  browserLoginTransactionSchema,
+  browserSessionRequests,
+  browserSessionResponses
+};

package/dist/identity/contracts.d.ts

@@ -0,0 +1,191 @@
+import { z } from 'zod';
+/** Discovery descriptors are identifiers, not permission to fetch arbitrary URLs. */
+export declare const identityEndpointSchema: z.ZodEffects<z.ZodString, string, string>;
+/** Always qualify a subject by its issuer; email is never an identity key. */
+export declare const externalIdentitySchema: z.ZodObject<{
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    subject: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    subject: string;
+}, {
+    issuer: string;
+    subject: string;
+}>;
+export declare const resourceTokenRequestSchema: z.ZodObject<{
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    resource: string;
+    scopes: string[];
+}, {
+    resource: string;
+    scopes: string[];
+}>;
+export type ResourceTokenRequest = z.infer<typeof resourceTokenRequestSchema>;
+/** RFC 9728 resource discovery. Unknown extensions are not authority. Consumers
+ * must match resource exactly and explicitly select one advertised issuer.
+ * TreeSeed credentials are transported only in the Authorization header.
+ */
+export declare const protectedResourceMetadataSchema: z.ZodObject<{
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    authorization_servers: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    scopes_supported: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>>;
+    bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodLiteral<"header">, "many">>;
+    resource_documentation: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported?: string[] | undefined;
+    bearer_methods_supported?: "header"[] | undefined;
+    resource_documentation?: string | undefined;
+}, {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported?: string[] | undefined;
+    bearer_methods_supported?: "header"[] | undefined;
+    resource_documentation?: string | undefined;
+}>;
+export type ProtectedResourceMetadata = z.infer<typeof protectedResourceMetadataSchema>;
+/** Persist with encrypted native-client tokens. Refresh must revalidate this
+ * issuer/subject and client; email or an API URL cannot substitute for it. */
+export declare const publicClientSessionBindingSchema: z.ZodObject<{
+    identity: z.ZodObject<{
+        issuer: z.ZodEffects<z.ZodString, string, string>;
+        subject: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        issuer: string;
+        subject: string;
+    }, {
+        issuer: string;
+        subject: string;
+    }>;
+    clientId: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    clientId: string;
+}, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    clientId: string;
+}>;
+export type PublicClientSessionBinding = z.infer<typeof publicClientSessionBindingSchema>;
+/** Implemented by Identity; implementations must isolate caches by resource and authority. */
+export interface IdentityCredentials {
+    token(request: ResourceTokenRequest): Promise<string>;
+}
+/** Authenticated input to local authorization, never a role or membership grant. */
+export declare const identityPrincipalSchema: z.ZodObject<{
+    principalId: z.ZodEffects<z.ZodString, string, string>;
+    kind: z.ZodEnum<["human", "service", "provider", "agent"]>;
+    identity: z.ZodObject<{
+        issuer: z.ZodEffects<z.ZodString, string, string>;
+        subject: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        issuer: string;
+        subject: string;
+    }, {
+        issuer: string;
+        subject: string;
+    }>;
+    actor: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodEffects<z.ZodString, string, string>;
+        subject: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        issuer: string;
+        subject: string;
+    }, {
+        issuer: string;
+        subject: string;
+    }>>;
+    audience: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    principalId: string;
+    kind: "human" | "service" | "provider" | "agent";
+    audience: string;
+    actor?: {
+        issuer: string;
+        subject: string;
+    } | undefined;
+}, {
+    scopes: string[];
+    identity: {
+        issuer: string;
+        subject: string;
+    };
+    principalId: string;
+    kind: "human" | "service" | "provider" | "agent";
+    audience: string;
+    actor?: {
+        issuer: string;
+        subject: string;
+    } | undefined;
+}>;
+export declare const federationRelationshipSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodEffects<z.ZodString, string, string>;
+    version: z.ZodNumber;
+    localIssuer: z.ZodEffects<z.ZodString, string, string>;
+    trustedIssuer: z.ZodEffects<z.ZodString, string, string>;
+    status: z.ZodEnum<["active", "disabled"]>;
+    permittedClientIds: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "atleastone">;
+    releasedClaims: z.ZodArray<z.ZodEnum<["name", "email", "email_verified", "preferred_username"]>, "many">;
+    transitive: z.ZodLiteral<false>;
+    accountLinking: z.ZodLiteral<"authenticated-proof">;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "disabled";
+    id: string;
+    version: number;
+    localIssuer: string;
+    trustedIssuer: string;
+    permittedClientIds: [string, ...string[]];
+    releasedClaims: ("name" | "email" | "email_verified" | "preferred_username")[];
+    transitive: false;
+    accountLinking: "authenticated-proof";
+}, {
+    status: "active" | "disabled";
+    id: string;
+    version: number;
+    localIssuer: string;
+    trustedIssuer: string;
+    permittedClientIds: [string, ...string[]];
+    releasedClaims: ("name" | "email" | "email_verified" | "preferred_username")[];
+    transitive: false;
+    accountLinking: "authenticated-proof";
+}>, {
+    status: "active" | "disabled";
+    id: string;
+    version: number;
+    localIssuer: string;
+    trustedIssuer: string;
+    permittedClientIds: [string, ...string[]];
+    releasedClaims: ("name" | "email" | "email_verified" | "preferred_username")[];
+    transitive: false;
+    accountLinking: "authenticated-proof";
+}, {
+    status: "active" | "disabled";
+    id: string;
+    version: number;
+    localIssuer: string;
+    trustedIssuer: string;
+    permittedClientIds: [string, ...string[]];
+    releasedClaims: ("name" | "email" | "email_verified" | "preferred_username")[];
+    transitive: false;
+    accountLinking: "authenticated-proof";
+}>;
+export type ExternalIdentity = z.infer<typeof externalIdentitySchema>;
+export type IdentityPrincipal = z.infer<typeof identityPrincipalSchema>;
+export type FederationRelationship = z.infer<typeof federationRelationshipSchema>;

package/dist/identity/contracts.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+const identityEndpointSchema = z.string().url().superRefine((value, context) => {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.search) {
+    context.addIssue({ code: z.ZodIssueCode.custom, message: "Identity endpoints require HTTPS without credentials, query, or fragment." });
+  }
+});
+const identifier = z.string().min(1).refine((value) => value.trim() === value, "Identifier must not have surrounding whitespace.");
+const scopes = z.array(z.string().regex(/^[\x21\x23-\x5B\x5D-\x7E]+$/u)).refine(
+  (value) => new Set(value).size === value.length,
+  "Scopes must be unique."
+);
+const externalIdentitySchema = z.object({
+  issuer: identityEndpointSchema,
+  subject: identifier
+}).strict();
+const resourceTokenRequestSchema = z.object({
+  resource: identityEndpointSchema,
+  scopes
+}).strict();
+const protectedResourceMetadataSchema = z.object({
+  resource: identityEndpointSchema,
+  authorization_servers: z.array(identityEndpointSchema).min(1).max(16).refine(
+    (value) => new Set(value).size === value.length,
+    "Authorization servers must be unique."
+  ),
+  scopes_supported: scopes.refine((value) => value.length <= 256 && value.every((scope) => scope.length <= 128), "Scope inventory is too large.").optional(),
+  bearer_methods_supported: z.array(z.literal("header")).length(1).optional(),
+  resource_documentation: identityEndpointSchema.optional()
+});
+const publicClientSessionBindingSchema = z.object({
+  identity: externalIdentitySchema,
+  clientId: identifier.refine((value) => value.length <= 256, "Client identifier is too long."),
+  scopes: scopes.refine((value) => value.length <= 256, "Scope inventory is too large.")
+}).strict();
+const identityPrincipalSchema = z.object({
+  principalId: identifier,
+  kind: z.enum(["human", "service", "provider", "agent"]),
+  identity: externalIdentitySchema,
+  actor: externalIdentitySchema.optional(),
+  audience: identityEndpointSchema,
+  scopes
+}).strict();
+const federationRelationshipSchema = z.object({
+  id: identifier,
+  version: z.number().int().positive(),
+  localIssuer: identityEndpointSchema,
+  trustedIssuer: identityEndpointSchema,
+  status: z.enum(["active", "disabled"]),
+  permittedClientIds: z.array(identifier).nonempty(),
+  releasedClaims: z.array(z.enum(["name", "email", "email_verified", "preferred_username"])),
+  transitive: z.literal(false),
+  accountLinking: z.literal("authenticated-proof")
+}).strict().superRefine((value, context) => {
+  if (value.localIssuer === value.trustedIssuer) {
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["trustedIssuer"], message: "Federation must identify a different issuer." });
+  }
+  for (const field of ["permittedClientIds", "releasedClaims"]) {
+    if (new Set(value[field]).size !== value[field].length) {
+      context.addIssue({ code: z.ZodIssueCode.custom, path: [field], message: "Entries must be unique." });
+    }
+  }
+});
+export {
+  externalIdentitySchema,
+  federationRelationshipSchema,
+  identityEndpointSchema,
+  identityPrincipalSchema,
+  protectedResourceMetadataSchema,
+  publicClientSessionBindingSchema,
+  resourceTokenRequestSchema
+};

package/dist/identity/index.d.ts

@@ -0,0 +1,3 @@
+export * from './contracts.js';
+export * from './browser-session.js';
+export * from './runtime.js';

package/dist/identity/index.js

@@ -0,0 +1,3 @@
+export * from "./contracts.js";
+export * from "./browser-session.js";
+export * from "./runtime.js";