@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/api/support/app.js

@@ -1,410 +0,0 @@
-import { Hono } from "hono";
-import crypto from "node:crypto";
-import { REMOTE_CONTRACT_HEADER, REMOTE_CONTRACT_VERSION } from "../../entrypoints/clients/remote.js";
-import { AgentSdk } from "../../entrypoints/models/sdk.js";
-import { resolveApiRuntimeProviders } from "../capacity/providers/providers.js";
-import { resolveApiConfig } from "../configuration/config.js";
-import { registerOperationRoutes } from "../operations/operations-routes.js";
-import { bearerTokenFromRequest, jsonError, requirePermission, requireScope } from "./http.js";
-import { registerSdkRoutes } from "./sdk-routes.js";
-import { loadTemplateCatalog } from "./templates.js";
-function mergeApiOptions(options) {
-  const baseConfig = resolveApiConfig();
-  return {
-    config: {
-      ...baseConfig,
-      ...options.config ?? {},
-      providers: {
-        ...baseConfig.providers,
-        ...options.config?.providers ?? {},
-        agents: {
-          ...baseConfig.providers.agents,
-          ...options.config?.providers?.agents ?? {}
-        }
-      }
-    },
-    surfaces: {
-      auth: true,
-      templates: true,
-      sdk: true,
-      operations: true,
-      ...options.surfaces ?? {}
-    },
-    scopes: {
-      authMe: "auth:me",
-      sdk: "sdk",
-      operations: "operations",
-      ...options.scopes ?? {}
-    }
-  };
-}
-function normalizePrefix(prefix) {
-  if (!prefix?.trim()) return "";
-  const normalized = prefix.trim().replace(/\/+$/u, "");
-  return normalized.startsWith("/") ? normalized : `/${normalized}`;
-}
-function authApprovalUrl(config, userCode) {
-  const baseUrl = (config.authApprovalBaseUrl ?? config.baseUrl).replace(/\/+$/u, "");
-  const url = new URL("/auth/device/approve", `${baseUrl}/`);
-  if (userCode) {
-    url.searchParams.set("user_code", userCode);
-  }
-  return url.toString();
-}
-async function readJsonOrFormBody(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    const json = await c.req.json().catch(() => null);
-    return json && typeof json === "object" && !Array.isArray(json) ? json : {};
-  }
-  const form = await c.req.parseBody?.().catch(() => null);
-  return form && typeof form === "object" ? form : {};
-}
-function principalScopes(permissions) {
-  const scopes = /* @__PURE__ */ new Set(["auth:me"]);
-  if (permissions.includes("*:*:*") || permissions.includes("sdk:execute:global")) scopes.add("sdk");
-  if (permissions.includes("*:*:*") || permissions.includes("agent:execute:global")) scopes.add("agent");
-  if (permissions.includes("*:*:*") || permissions.includes("operations:execute:global")) scopes.add("operations");
-  return [...scopes];
-}
-function buildProjectApiPrincipal(config) {
-  return {
-    id: `project:${config.projectId}`,
-    displayName: config.projectApiLabel,
-    roles: ["project_api"],
-    permissions: [...config.projectApiPermissions],
-    scopes: principalScopes(config.projectApiPermissions),
-    metadata: {
-      projectId: config.projectId
-    }
-  };
-}
-function matchesProjectApiKey(token, projectApiKey) {
-  if (!projectApiKey) return false;
-  const left = Buffer.from(token);
-  const right = Buffer.from(projectApiKey);
-  return left.length === right.length && crypto.timingSafeEqual(left, right);
-}
-function createApiRouter(options = {}) {
-  const resolved = mergeApiOptions(options);
-  const runtimeProviders = resolveApiRuntimeProviders(resolved.config, options.runtimeProviders);
-  const sharedSdk = options.sdk ?? new AgentSdk({ repoRoot: resolved.config.repoRoot });
-  const app = new Hono();
-  const internalPrefix = normalizePrefix(options.internalPrefix);
-  const runtime = {
-    resolved,
-    runtimeProviders,
-    sharedSdk,
-    internalPrefix
-  };
-  const extensionMounts = [];
-  app.use("*", async (c, next) => {
-    c.set("requestId", crypto.randomUUID());
-    c.set("config", resolved.config);
-    c.set("principal", null);
-    c.set("actingUser", null);
-    c.set("credential", null);
-    c.set("actorType", "anonymous");
-    c.set("permissionGrants", []);
-    c.header(REMOTE_CONTRACT_HEADER, String(REMOTE_CONTRACT_VERSION));
-    await next();
-  });
-  app.use("*", async (c, next) => {
-    const serviceId = c.req.header("x-treeseed-service-id");
-    const serviceSecret = c.req.header("x-treeseed-service-secret");
-    if (serviceId && serviceSecret) {
-      const result = await runtimeProviders.auth.authenticateServiceCredential(serviceId, serviceSecret);
-      if (!result) {
-        return jsonError(c, 401, "Invalid internal service credential.");
-      }
-      c.set("principal", result.principal);
-      c.set("credential", result.credential);
-      c.set("actorType", "service");
-      c.set("permissionGrants", result.principal.permissions);
-    }
-    await next();
-  });
-  app.use("*", async (c, next) => {
-    const token = bearerTokenFromRequest(c.req.raw);
-    if (token) {
-      const override = await options.authenticateBearerOverride?.(token) ?? null;
-      if (override) {
-        c.set("principal", override.principal);
-        c.set("credential", override.credential);
-        c.set("actorType", override.credential.type === "service_token" ? "service" : "user");
-        c.set("permissionGrants", override.principal.permissions);
-      } else if (matchesProjectApiKey(token, resolved.config.projectApiKey)) {
-        const principal = buildProjectApiPrincipal(resolved.config);
-        c.set("principal", principal);
-        c.set("credential", {
-          type: "project_api_key",
-          id: resolved.config.projectId,
-          label: resolved.config.projectApiLabel
-        });
-        c.set("actorType", "project");
-        c.set("permissionGrants", principal.permissions);
-        await next();
-        return;
-      }
-      const result = await runtimeProviders.auth.authenticateBearerToken(token);
-      if (result) {
-        c.set("principal", result.principal);
-        c.set("credential", result.credential);
-        c.set("actorType", result.credential.type === "service_token" ? "service" : "user");
-        c.set("permissionGrants", result.principal.permissions);
-      }
-    }
-    await next();
-  });
-  app.use("*", async (c, next) => {
-    const assertion = c.req.header("x-treeseed-user-assertion");
-    if (c.get("actorType") === "service" && assertion) {
-      const claims = runtimeProviders.auth.verifyTrustedUserAssertion(assertion);
-      if (!claims) {
-        return jsonError(c, 401, "Invalid trusted user assertion.");
-      }
-      const exchange = await runtimeProviders.auth.exchangeTrustedUserAssertion(claims);
-      c.set("actingUser", exchange.principal);
-      c.set("principal", exchange.principal);
-      c.set("actorType", "user");
-      c.set("permissionGrants", exchange.principal.permissions);
-    }
-    await next();
-  });
-  app.get("/healthz", (c) => c.json({
-    ok: true,
-    service: resolved.config.name,
-    status: "ok",
-    requestId: c.get("requestId")
-  }));
-  app.get("/readyz", (c) => c.json({
-    ok: true,
-    ready: true,
-    providers: runtimeProviders.selections,
-    surfaces: resolved.surfaces
-  }));
-  app.get("/internal/capabilities", (c) => c.json({
-    ok: true,
-    payload: {
-      service: resolved.config.name,
-      capabilities: [
-        "sdk.execute",
-        "operations.execute"
-      ]
-    }
-  }));
-  if (resolved.surfaces.templates) {
-    app.get("/templates", (c) => c.json(loadTemplateCatalog(resolved.config)));
-    app.get("/search/templates", (c) => c.json(loadTemplateCatalog(resolved.config)));
-    app.get("/templates/:id", (c) => {
-      const catalog = loadTemplateCatalog(resolved.config);
-      const item = catalog.items.find((entry) => entry.id === c.req.param("id"));
-      return item ? c.json({ ok: true, payload: item }) : jsonError(c, 404, `Unknown template "${c.req.param("id")}".`);
-    });
-  }
-  if (resolved.surfaces.auth) {
-    app.get("/auth/device/approve", (c) => {
-      const target = authApprovalUrl(resolved.config, c.req.query("user_code"));
-      if (target === c.req.url) {
-        return jsonError(c, 404, "Open the TreeSeed web app to approve CLI device login.");
-      }
-      return c.redirect(target, 302);
-    });
-    app.post("/auth/device/start", async (c) => {
-      const body = await c.req.json().catch(() => ({}));
-      return c.json(await runtimeProviders.auth.startDeviceFlow(body));
-    });
-    app.post("/auth/device/poll", async (c) => {
-      const body = await c.req.json().catch(() => ({}));
-      const response = await runtimeProviders.auth.pollDeviceFlow(body);
-      return c.json(response, { status: response.ok ? 200 : response.status === "expired" ? 410 : 400 });
-    });
-    app.post("/auth/device/approve", async (c) => {
-      const body = await readJsonOrFormBody(c);
-      try {
-        const approved = await runtimeProviders.auth.approveDeviceFlow({
-          userCode: String(body.userCode ?? ""),
-          principalId: String(body.principalId ?? ""),
-          displayName: typeof body.displayName === "string" ? body.displayName : void 0,
-          metadata: typeof body.metadata === "string" ? JSON.parse(body.metadata || "{}") : body.metadata && typeof body.metadata === "object" ? body.metadata : void 0,
-          scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : void 0
-        });
-        if (typeof body.redirectTo === "string" && body.redirectTo.startsWith("http")) {
-          return c.redirect(body.redirectTo, 303);
-        }
-        return c.json(approved);
-      } catch (error) {
-        return jsonError(c, 400, error instanceof Error ? error.message : String(error));
-      }
-    });
-    app.post("/auth/token/refresh", async (c) => {
-      const body = await c.req.json().catch(() => ({}));
-      try {
-        return c.json(await runtimeProviders.auth.refreshAccessToken(body));
-      } catch (error) {
-        return jsonError(c, 401, error instanceof Error ? error.message : String(error));
-      }
-    });
-    app.get("/auth/me", (c) => {
-      const unauthorized = requireScope(c, resolved.scopes.authMe);
-      if (unauthorized) return unauthorized;
-      return c.json({
-        ok: true,
-        payload: c.get("principal")
-      });
-    });
-    app.post("/auth/pat", async (c) => {
-      const unauthorized = requirePermission(c, "api_tokens:create:self");
-      if (unauthorized) return unauthorized;
-      const principal = c.get("principal");
-      const body = await c.req.json().catch(() => ({}));
-      if (!body.name?.trim() || !principal) {
-        return jsonError(c, 400, "Token name is required.");
-      }
-      return c.json({
-        ok: true,
-        payload: await runtimeProviders.auth.createPersonalAccessToken(principal.id, {
-          name: body.name.trim(),
-          scopes: body.scopes,
-          expiresAt: body.expiresAt ?? null
-        })
-      });
-    });
-    app.get("/auth/pat", async (c) => {
-      const unauthorized = requirePermission(c, "api_tokens:read:self");
-      if (unauthorized) return unauthorized;
-      const principal = c.get("principal");
-      if (!principal) return jsonError(c, 401, "Authentication required.");
-      return c.json({
-        ok: true,
-        payload: await runtimeProviders.auth.listPersonalAccessTokens(principal.id)
-      });
-    });
-    app.delete("/auth/pat/:id", async (c) => {
-      const unauthorized = requirePermission(c, "api_tokens:delete:self");
-      if (unauthorized) return unauthorized;
-      const principal = c.get("principal");
-      if (!principal) return jsonError(c, 401, "Authentication required.");
-      await runtimeProviders.auth.revokePersonalAccessToken(principal.id, c.req.param("id"));
-      return c.json({ ok: true });
-    });
-    app.post("/auth/admin/users", async (c) => {
-      const unauthorized = requirePermission(c, "users:manage:global");
-      if (unauthorized) return unauthorized;
-      if (!runtimeProviders.auth.createUser) {
-        return jsonError(c, 501, "User management is unavailable for this auth provider.");
-      }
-      const body = await c.req.json().catch(() => ({}));
-      return c.json({
-        ok: true,
-        payload: await runtimeProviders.auth.createUser({
-          email: body.email ?? null,
-          displayName: body.displayName ?? null,
-          metadata: typeof body.metadata === "object" && body.metadata ? body.metadata : {}
-        })
-      });
-    });
-    app.post("/auth/admin/users/:userId/roles", async (c) => {
-      const unauthorized = requirePermission(c, "roles:manage:global");
-      if (unauthorized) return unauthorized;
-      if (!runtimeProviders.auth.setUserRoles) {
-        return jsonError(c, 501, "Role management is unavailable for this auth provider.");
-      }
-      const body = await c.req.json().catch(() => ({}));
-      const roles = Array.isArray(body.roles) ? body.roles.map(String) : [];
-      return c.json({
-        ok: true,
-        payload: await runtimeProviders.auth.setUserRoles(c.req.param("userId"), roles)
-      });
-    });
-  }
-  app.post("/internal/auth/web/sync-user", async (c) => {
-    if (c.get("actorType") !== "service") {
-      return jsonError(c, 401, "Trusted service authentication required.");
-    }
-    const unauthorized = requirePermission(c, "services:impersonate:global");
-    if (unauthorized) return unauthorized;
-    const body = await c.req.json().catch(() => ({}));
-    return c.json({
-      ok: true,
-      payload: await runtimeProviders.auth.syncUserIdentity(body)
-    });
-  });
-  app.post("/internal/auth/web/exchange", async (c) => {
-    if (c.get("actorType") !== "service") {
-      return jsonError(c, 401, "Trusted service authentication required.");
-    }
-    const unauthorized = requirePermission(c, "services:impersonate:global");
-    if (unauthorized) return unauthorized;
-    const body = await c.req.json().catch(() => ({}));
-    return c.json(await runtimeProviders.auth.exchangeTrustedUserAssertion(body));
-  });
-  app.post("/internal/auth/service/token", async (c) => {
-    const unauthorized = requirePermission(c, "services:manage:global");
-    if (unauthorized) return unauthorized;
-    const body = await c.req.json().catch(() => ({}));
-    if (!body.serviceId?.trim() || !body.name?.trim()) {
-      return jsonError(c, 400, "serviceId and name are required.");
-    }
-    return c.json({
-      ok: true,
-      payload: await runtimeProviders.auth.createServiceToken({
-        serviceId: body.serviceId.trim(),
-        name: body.name.trim(),
-        roles: body.roles,
-        permissions: body.permissions
-      })
-    });
-  });
-  app.post("/internal/auth/service/rotate", async (c) => {
-    const unauthorized = requirePermission(c, "services:manage:global");
-    if (unauthorized) return unauthorized;
-    const body = await c.req.json().catch(() => ({}));
-    if (!body.serviceId?.trim()) {
-      return jsonError(c, 400, "serviceId is required.");
-    }
-    return c.json({
-      ok: true,
-      payload: await runtimeProviders.auth.rotateServiceToken(body.serviceId.trim())
-    });
-  });
-  if (resolved.surfaces.sdk) {
-    registerSdkRoutes(app, {
-      config: resolved.config,
-      sharedSdk,
-      scope: resolved.scopes.sdk,
-      prefix: internalPrefix
-    });
-  }
-  if (resolved.surfaces.operations) {
-    registerOperationRoutes(app, {
-      config: resolved.config,
-      scope: resolved.scopes.operations,
-      prefix: internalPrefix,
-      sdk: sharedSdk,
-      executeOperation: options.workflowExecutor
-    });
-  }
-  for (const extension of options.extensions ?? []) {
-    const mounted = extension.mount(app, runtime);
-    if (mounted && typeof mounted.then === "function") {
-      extensionMounts.push(mounted);
-    }
-  }
-  options.extendApp?.(app, runtime);
-  if (extensionMounts.length > 0) {
-    app.use("*", async (_c, next) => {
-      await Promise.all(extensionMounts);
-      await next();
-    });
-  }
-  app.notFound((c) => jsonError(c, 404, "Not found."));
-  return app;
-}
-function createApiApp(options = {}) {
-  return createApiRouter(options);
-}
-export {
-  createApiApp,
-  createApiRouter
-};

package/dist/api/support/http.d.ts

@@ -1,28 +0,0 @@
-import type { Context } from 'hono';
-import type { ApiPrincipal, ApiScope } from '../../entrypoints/clients/remote.js';
-import type { AppVariables } from '../types.js';
-export type ApiContext = Context<{
-    Variables: AppVariables;
-}>;
-export declare function jsonError(c: Context, status: number, error: string, details?: Record<string, unknown>): Response & import("hono").TypedResponse<{
-    ok: false;
-    error: string;
-}, never, "json">;
-export declare function bearerTokenFromRequest(request: Request): string | null;
-export declare function hasScope(principal: ApiPrincipal | null, requiredScope: ApiScope): boolean;
-export declare function requireScope(c: ApiContext, requiredScope: ApiScope): (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: string;
-}, never, "json">) | null;
-export declare function requireAuthentication(c: ApiContext): (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: string;
-}, never, "json">) | null;
-export declare function requireActorType(c: ApiContext, actorType: 'anonymous' | 'user' | 'service' | 'project', message?: string): (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: string;
-}, never, "json">) | null;
-export declare function requirePermission(c: ApiContext, permission: string): (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: string;
-}, never, "json">) | null;

package/dist/api/support/http.js

@@ -1,51 +0,0 @@
-import { permissionGranted } from "../auth/rbac.js";
-function jsonError(c, status, error, details) {
-  return c.json({
-    ok: false,
-    error,
-    ...details ?? {}
-  }, { status });
-}
-function bearerTokenFromRequest(request) {
-  const header = request.headers.get("authorization");
-  if (!header) return null;
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  return match?.[1] ?? null;
-}
-function hasScope(principal, requiredScope) {
-  return Boolean(principal && (principal.scopes.includes(requiredScope) || principal.scopes.includes("*")));
-}
-function requireScope(c, requiredScope) {
-  if (!hasScope(c.get("principal"), requiredScope)) {
-    return jsonError(c, 401, "Authentication required.", { requiredScope });
-  }
-  return null;
-}
-function requireAuthentication(c) {
-  if (!c.get("principal")) {
-    return jsonError(c, 401, "Authentication required.");
-  }
-  return null;
-}
-function requireActorType(c, actorType, message = "Trusted service authentication required.") {
-  if (c.get("actorType") !== actorType) {
-    return jsonError(c, 401, message);
-  }
-  return null;
-}
-function requirePermission(c, permission) {
-  const principal = c.get("principal");
-  if (!principal || !permissionGranted(c.get("permissionGrants"), permission)) {
-    return jsonError(c, 403, "Permission denied.", { permission });
-  }
-  return null;
-}
-export {
-  bearerTokenFromRequest,
-  hasScope,
-  jsonError,
-  requireActorType,
-  requireAuthentication,
-  requirePermission,
-  requireScope
-};

package/dist/api/support/sdk-dispatch.d.ts

@@ -1,6 +0,0 @@
-import type { RemoteSdkOperationRequest } from '../../entrypoints/clients/remote.js';
-import { executeSdkOperation, findSdkOperation, listSdkOperationNames } from '../../entrypoints/models/sdk-dispatch.js';
-import type { AgentSdk } from '../../entrypoints/models/sdk.js';
-import type { ApiConfig } from '../types.js';
-export { executeSdkOperation, findSdkOperation, listSdkOperationNames };
-export declare function resolveSdkInstance(sharedSdk: AgentSdk | undefined, config: ApiConfig, request: RemoteSdkOperationRequest): AgentSdk;

package/dist/api/support/sdk-dispatch.js

@@ -1,14 +0,0 @@
-import { executeSdkOperation, findSdkOperation, listSdkOperationNames } from "../../entrypoints/models/sdk-dispatch.js";
-import { AgentSdk as AgentSdkClass } from "../../entrypoints/models/sdk.js";
-function resolveSdkInstance(sharedSdk, config, request) {
-  if (!request.repoRoot || request.repoRoot === config.repoRoot) {
-    return sharedSdk ?? new AgentSdkClass({ repoRoot: config.repoRoot });
-  }
-  return new AgentSdkClass({ repoRoot: request.repoRoot });
-}
-export {
-  executeSdkOperation,
-  findSdkOperation,
-  listSdkOperationNames,
-  resolveSdkInstance
-};

package/dist/api/support/sdk-routes.d.ts

@@ -1,11 +0,0 @@
-import type { Hono } from 'hono';
-import type { AgentSdk } from '../../entrypoints/models/sdk.js';
-import type { ApiConfig } from '../types.js';
-interface RegisterSdkRoutesOptions {
-    config: ApiConfig;
-    sharedSdk?: AgentSdk;
-    scope: string;
-    prefix?: string;
-}
-export declare function registerSdkRoutes(app: Hono<any>, options: RegisterSdkRoutesOptions): void;
-export {};

package/dist/api/support/sdk-routes.js

@@ -1,29 +0,0 @@
-import { jsonError, requireScope } from "./http.js";
-import { executeSdkOperation, resolveSdkInstance } from "./sdk-dispatch.js";
-function withPrefix(prefix, path) {
-  if (!prefix) return path;
-  return `${prefix}${path}`.replace(/\/{2,}/g, "/");
-}
-function registerSdkRoutes(app, options) {
-  app.post(withPrefix(options.prefix ?? "", "/sdk/:operation"), async (c) => {
-    const unauthorized = requireScope(c, options.scope);
-    if (unauthorized) return unauthorized;
-    const operation = c.req.param("operation");
-    const body = await c.req.json().catch(() => ({}));
-    try {
-      const result = await executeSdkOperation(
-        resolveSdkInstance(options.sharedSdk, options.config, body),
-        operation,
-        body.input ?? {}
-      );
-      return c.json(result);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      const status = /Unknown SDK operation/.test(message) ? 400 : 500;
-      return jsonError(c, status, message, { operation });
-    }
-  });
-}
-export {
-  registerSdkRoutes
-};

package/dist/api/support/templates.d.ts

@@ -1,3 +0,0 @@
-import type { SdkTemplateCatalogResponse } from '../../entrypoints/models/sdk-types.js';
-import type { ApiConfig } from '../types.js';
-export declare function loadTemplateCatalog(config: ApiConfig): SdkTemplateCatalogResponse;

package/dist/api/support/templates.js

@@ -1,31 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, resolve } from "node:path";
-import { parseTemplateCatalogResponse } from "../../commerce/catalog/template-catalog.js";
-const require2 = createRequire(import.meta.url);
-function resolveSdkPackageRoot() {
-  const exportedEntrypoint = require2.resolve("@treeseed/sdk");
-  const distRoot = dirname(exportedEntrypoint);
-  const packageRoot = resolve(distRoot, "..");
-  return packageRoot;
-}
-function resolveDefaultCatalogPath() {
-  const sdkRoot = resolveSdkPackageRoot();
-  const candidates = [
-    resolve(sdkRoot, "dist", "treeseed", "template-catalog", "catalog.fixture.json"),
-    resolve(sdkRoot, "src", "treeseed", "template-catalog", "catalog.fixture.json")
-  ];
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) {
-      return candidate;
-    }
-  }
-  throw new Error("Unable to resolve the bundled Treeseed template catalog fixture.");
-}
-function loadTemplateCatalog(config) {
-  const catalogPath = config.templateCatalogPath ?? resolveDefaultCatalogPath();
-  return parseTemplateCatalogResponse(JSON.parse(readFileSync(catalogPath, "utf8")));
-}
-export {
-  loadTemplateCatalog
-};