@vertesia/common 1.2.0 → 1.4.0-dev.20260614.160504Z

package/lib/{types/oauth-server.d.ts → oauth-server.d.ts}

@@ -1,14 +1,20 @@
-import type { AuthTokenPayload } from './apikey.js';
+import type { AuthTokenPayload, PrincipalType } from './apikey.js';
 import type { ProjectRef } from './project.js';
 export type OAuthClientType = 'public' | 'confidential';
 export type OAuthClientStatus = 'active' | 'disabled';
 export type OAuthRegistrationSource = 'admin' | 'dynamic';
 export type OAuthProjectBindingMode = 'user_select' | 'fixed';
 export type OAuthTokenEndpointAuthMethod = 'none' | 'client_secret_post' | 'client_secret_basic';
-export type OAuthGrantType = 'authorization_code' | 'refresh_token';
+export type OAuthGrantType = 'authorization_code' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:device_code';
 export type OAuthResponseType = 'code';
 export type OAuthAuthorizationRequestStatus = 'pending' | 'denied' | 'consumed';
 export type OAuthClientRegistrationMode = 'registered' | 'client_id_metadata_document';
+/**
+ * How Vertesia identified itself to a *remote* authorization server when connecting
+ * out as an OAuth client. Distinct from {@link OAuthClientRegistrationMode}, which
+ * describes how inbound clients identified themselves to Vertesia's own AS.
+ */
+export type RemoteOAuthRegistrationMode = 'dynamic_client_registration' | 'client_id_metadata_document';
 export type OAuthGrantStatus = 'active' | 'revoked' | 'expired';
 export type OAuthGrantSortField = 'granted_at' | 'client_name' | 'user_name' | 'resource' | 'last_used_at' | 'expires_at' | 'status';
 export type OAuthGrantSortOrder = 'asc' | 'desc';
@@ -20,6 +26,7 @@ export interface OAuthClientData {
     response_types: OAuthResponseType[];
     token_endpoint_auth_method: OAuthTokenEndpointAuthMethod;
     allowed_scopes: string[];
+    default_scopes?: string[];
     registration_source: OAuthRegistrationSource;
     status: OAuthClientStatus;
     project_binding_mode: OAuthProjectBindingMode;
@@ -36,6 +43,9 @@ export interface OAuthClient extends OAuthClientData {
 export interface OAuthClientCreateResponse extends OAuthClient {
     client_secret?: string;
 }
+export interface OAuthClientScopeMetadata {
+    supported_scopes: string[];
+}
 export interface OAuthGrant {
     grant_id: string;
     client_id: string;
@@ -88,6 +98,7 @@ export interface CreateOAuthClientPayload {
     response_types?: OAuthResponseType[];
     token_endpoint_auth_method?: OAuthTokenEndpointAuthMethod;
     allowed_scopes?: string[];
+    default_scopes?: string[];
     project_binding_mode?: OAuthProjectBindingMode;
     fixed_project_id?: string;
     client_secret?: string;
@@ -100,6 +111,7 @@ export interface UpdateOAuthClientPayload {
     response_types?: OAuthResponseType[];
     token_endpoint_auth_method?: OAuthTokenEndpointAuthMethod;
     allowed_scopes?: string[];
+    default_scopes?: string[];
     status?: OAuthClientStatus;
     project_binding_mode?: OAuthProjectBindingMode;
     fixed_project_id?: string;
@@ -119,6 +131,7 @@ export interface OAuthAuthorizationServerMetadata {
     token_endpoint_auth_methods_supported: string[];
     scopes_supported: string[];
     client_id_metadata_document_supported?: boolean;
+    device_authorization_endpoint?: string;
 }
 export interface OAuthClientMetadataDocument {
     client_id: string;
@@ -162,6 +175,7 @@ export interface OAuthAuthorizationRequest {
     redirect_origin: string;
     resource?: string;
     requested_scopes: string[];
+    optional_scopes?: string[];
     requested_project_id?: string;
     project_binding_mode: OAuthProjectBindingMode;
     fixed_project_id?: string;
@@ -171,10 +185,31 @@ export interface OAuthAuthorizationRequest {
 }
 export interface ApproveOAuthAuthorizationRequestPayload {
     project_id?: string;
+    granted_scopes: string[];
+}
+export interface OAuthGrantableScopesResponse {
+    project_id: string;
+    requested_permission_scopes: string[];
+    grantable_permission_scopes: string[];
+    unavailable_permission_scopes: string[];
 }
 export interface OAuthAuthorizationDecisionResponse {
     redirect_url: string;
 }
+export interface OAuthDeviceAuthorizationRequest {
+    client_id: string;
+    resource?: string;
+    scope?: string;
+    project_id?: string;
+}
+export interface OAuthDeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
 export interface OAuthTokenRequestAuthorizationCode {
     grant_type: 'authorization_code';
     code: string;
@@ -189,9 +224,16 @@ export interface OAuthTokenRequestRefreshToken {
     refresh_token: string;
     client_id: string;
     resource?: string;
+    project_id?: string;
+    client_secret?: string;
+}
+export interface OAuthTokenRequestDeviceCode {
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code';
+    device_code: string;
+    client_id: string;
     client_secret?: string;
 }
-export type OAuthTokenRequest = OAuthTokenRequestAuthorizationCode | OAuthTokenRequestRefreshToken;
+export type OAuthTokenRequest = OAuthTokenRequestAuthorizationCode | OAuthTokenRequestRefreshToken | OAuthTokenRequestDeviceCode;
 export interface OAuthTokenResponse {
     access_token: string;
     token_type: 'Bearer';
@@ -223,7 +265,7 @@ export interface OAuthConsentRecord {
     revoked_at?: string;
 }
 export interface OAuthAccessTokenPayload extends Omit<AuthTokenPayload, 'type' | 'project'> {
-    type: 'oauth_access';
+    type: PrincipalType.OAuthAccess;
     client_id: string;
     scope: string;
     user_id: string;
@@ -231,3 +273,21 @@ export interface OAuthAccessTokenPayload extends Omit<AuthTokenPayload, 'type' |
     allowed_collections?: string[];
     resource?: string;
 }
+export interface OAuthIdTokenPayload {
+    sub: string;
+    user_id: string;
+    name?: string;
+    email?: string;
+    picture?: string;
+    type: 'oauth_id';
+    client_id: string;
+    account?: AuthTokenPayload['account'];
+    accounts?: AuthTokenPayload['accounts'];
+    project?: ProjectRef;
+    /** User groups */
+    groups?: AuthTokenPayload['groups'];
+    iss: string;
+    aud: string;
+    exp: number;
+}
+//# sourceMappingURL=oauth-server.d.ts.map

package/lib/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../src/oauth-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,cAAc,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAAC;AACtD,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AACjG,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,eAAe,GAAG,8CAA8C,CAAC;AACrH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACvC,MAAM,MAAM,+BAA+B,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,YAAY,GAAG,6BAA6B,CAAC;AACvF;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,6BAA6B,GAAG,6BAA6B,CAAC;AACxG,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAChE,MAAM,MAAM,mBAAmB,GACzB,YAAY,GACZ,aAAa,GACb,WAAW,GACX,UAAU,GACV,cAAc,GACd,YAAY,GACZ,QAAQ,CAAC;AACf,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,eAAe,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,cAAc,EAAE,iBAAiB,EAAE,CAAC;IACpC,0BAA0B,EAAE,4BAA4B,CAAC;IACzD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,oBAAoB,EAAE,uBAAuB,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAY,SAAQ,eAAe;IAChD,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAA0B,SAAQ,WAAW;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACnC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACtE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACrC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACrC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gCAAgC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC,CAAC,EAAE,OAAO,CAAC;IAChD,6BAA6B,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,2BAA2B;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACrC,0BAA0B,CAAC,EAAE,4BAA4B,CAAC;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sCAAuC,SAAQ,mBAAmB;CAAG;AAEtF,MAAM,WAAW,yBAAyB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,0BAA0B,CAAC;IAC7C,wBAAwB,CAAC,EAAE,2BAA2B,CAAC;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,uBAAuB,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,+BAA+B,CAAC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uCAAuC;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,6BAA6B,EAAE,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kCAAkC;IAC/C,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gCAAgC;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kCAAkC;IAC/C,UAAU,EAAE,oBAAoB,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC1C,UAAU,EAAE,eAAe,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IACxC,UAAU,EAAE,8CAA8C,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iBAAiB,GACvB,kCAAkC,GAClC,6BAA6B,GAC7B,2BAA2B,CAAC;AAElC,MAAM,WAAW,kBAAkB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvF,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,kBAAkB;IAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf"}

package/lib/{cjs/oauth-server.js.map → oauth-server.js.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/oauth-server.ts"],"names":[],"mappings":""}
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../src/oauth-server.ts"],"names":[],"mappings":""}

package/lib/{types/oauth.d.ts → oauth.d.ts}

@@ -122,3 +122,4 @@ export interface OAuthProviderExchangePayload {
     code: string;
     state: string;
 }
+//# sourceMappingURL=oauth.d.ts.map

package/lib/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,UAAU,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAEzD;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACpD,EAAE,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IACzD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gCAAgC;IAC7C,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACjB"}

package/lib/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/lib/{types/payload.d.ts → payload.d.ts}

@@ -1,6 +1,6 @@
-import { FacetSpec } from "./facets.js";
-import { ComplexCollectionSearchQuery, ComplexSearchQuery, InteractionSearchQuery, ObjectSearchQuery, ObjectTypeSearchQuery, PromptSearchQuery, RunSearchQuery, SimpleSearchQuery } from "./query.js";
-import { ColumnLayout } from "./store/store.js";
+import type { FacetSpec } from './facets.js';
+import type { ComplexCollectionSearchQuery, ComplexSearchQuery, InteractionSearchQuery, ObjectSearchQuery, ObjectTypeSearchQuery, PromptSearchQuery, RunSearchQuery, SimpleSearchQuery } from './query.js';
+import type { ColumnLayout } from './store/store.js';
 export type SortOrder = 'asc' | 'desc';
 export interface SortOption {
     /** Field path to sort by (e.g. 'updated_at', 'name', 'properties.title') */
@@ -69,5 +69,6 @@ export interface ExportPropertiesPayload {
 export interface ExportPropertiesResponse {
     type: string;
     name: string;
-    data: Blob;
+    data: string;
 }
+//# sourceMappingURL=payload.d.ts.map

package/lib/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACR,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvC,MAAM,WAAW,UAAU;IACvB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC1B,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAChC,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC3D,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC1D,KAAK,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACnD,KAAK,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA8B,SAAQ,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACrF,KAAK,CAAC,EAAE,4BAA4B,CAAC;CACxC;AAED,MAAM,WAAW,8BAA+B,SAAQ,mBAAmB;IACvE,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IAClE,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IAClE,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAC/D,KAAK,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CAChB"}

package/lib/{cjs/payload.js.map → payload.js.map}

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/payload.ts"],"names":[],"mappings":""}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":""}

package/lib/{types/pending-asks.d.ts → pending-asks.d.ts}

@@ -2,7 +2,8 @@
  * Types for tracking pending ask_user requests and webhook notifications.
  * Used to notify external systems when agents are waiting for user input.
  */
-import { UserChannel } from "./email.js";
+import type { UserChannel } from './email.js';
+import type { TaskField } from './store/task.js';
 /**
  * Status of a pending ask request.
  */
@@ -37,6 +38,8 @@ export interface PendingAskData {
     expiresAt: number;
     /** Current status of the ask */
     status: PendingAskStatus;
+    /** Durable task created for this ask_user request. */
+    taskId?: string;
     /** Timestamp when resolved (ms since epoch) */
     resolvedAt?: number;
     /** User's response (after resolution) */
@@ -91,3 +94,7 @@ export interface AskUserWebhookEvent {
 export interface ListPendingAsksResponse {
     asks: PendingAskData[];
 }
+export interface AskUserTaskMetadata {
+    taskFields?: TaskField[];
+}
+//# sourceMappingURL=pending-asks.d.ts.map

package/lib/pending-asks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-asks.d.ts","sourceRoot":"","sources":["../src/pending-asks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC3B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IAC9B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC,iBAAiB;IACjB,KAAK,EAAE,uBAAuB,CAAC;IAC/B,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,uCAAuC;IACvC,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAChC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC5B"}

package/lib/pending-asks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-asks.js","sourceRoot":"","sources":["../src/pending-asks.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/lib/principal-context.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Resolved per-user context consumed by PrincipalSet condition evaluation
+ * (`matchConditions` / `resolveConditions`) and by ABAC client-side tooling.
+ *
+ * Mirrors what the token server builds for `$principal.*` resolution at JWT
+ * issue time, with the same defaults (clearance = 0, compartments = [],
+ * tags = [], properties = {}). Lives in @vertesia/common so both server-side
+ * builders and client-side consumers share the exact same shape.
+ */
+export interface PrincipalContext {
+    clearance: number;
+    compartments: string[];
+    email?: string;
+    tags: string[];
+    properties: Record<string, unknown>;
+}
+/**
+ * Response shape of the `/iam/users/identity` endpoint: the current principal's
+ * {@link PrincipalContext} plus its id. Distinct from `PrincipalContext` itself
+ * because the id is identity metadata, not a merged BLP field — adding it to
+ * `PrincipalContext` would unintentionally expose `$principal.id` to
+ * PrincipalSet rule evaluation.
+ */
+export interface PrincipalIdentity extends PrincipalContext {
+    id: string;
+}
+//# sourceMappingURL=principal-context.d.ts.map

package/lib/principal-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-context.d.ts","sourceRoot":"","sources":["../src/principal-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACvD,EAAE,EAAE,MAAM,CAAC;CACd"}

package/lib/principal-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=principal-context.js.map

package/lib/principal-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-context.js","sourceRoot":"","sources":["../src/principal-context.ts"],"names":[],"mappings":""}