@vrplatform/api 1.3.1-stage.4776 → 1.3.1-stage.4789

package/build/module/index.d.ts

@@ -1,5 +1,6 @@
 import type { ApiClient } from './types';
 export * from './client';
+export * from './embed-lifecycle';
 export * from './error';
 export type * from './generated/v1';
 export * from './routing';

package/build/module/index.js

@@ -1,4 +1,5 @@
 export * from './client';
+export * from './embed-lifecycle';
 export * from './error';
 export * from './routing';
 export * from './sec';

package/build/module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"src/","sources":["index.ts"],"names":[],"mappings":"AAEA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AAExB,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC","sourcesContent":["import type { ApiClient } from './types';\n\nexport * from './client';\nexport * from './error';\nexport type * from './generated/v1';\nexport * from './routing';\nexport * from './sec';\nexport * from './types';\n\nexport type VRPlatformApi = ApiClient;\n"]}
+{"version":3,"file":"index.js","sourceRoot":"src/","sources":["index.ts"],"names":[],"mappings":"AAEA,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,cAAc,SAAS,CAAC;AAExB,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC","sourcesContent":["import type { ApiClient } from './types';\n\nexport * from './client';\nexport * from './embed-lifecycle';\nexport * from './error';\nexport type * from './generated/v1';\nexport * from './routing';\nexport * from './sec';\nexport * from './types';\n\nexport type VRPlatformApi = ApiClient;\n"]}

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.3.1-stage.4776",
+  "version": "1.3.1-stage.4789",
   "description": "",
   "main": "build/main/index.js",
   "module": "build/module/index.js",
@@ -27,7 +27,8 @@
   "dependencies": {
     "openapi-fetch": "0.15.0",
     "openapi-typescript": "^7.13.0",
-    "openapi-typescript-helpers": "^0.0.15"
+    "openapi-typescript-helpers": "^0.0.15",
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "@vrplatform/utils": "*",

package/src/embed-lifecycle.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+
+const protocol = 'vrplatform.embed.lifecycle';
+const version = 1;
+const envelope = {
+  channelId: z.uuid(),
+  protocol: z.literal(protocol),
+  version: z.literal(version),
+};
+const channelRequestSchema = z
+  .object({
+    ...envelope,
+    requestId: z.uuid(),
+    type: z.literal('channel.request'),
+  })
+  .strict();
+const channelConnectSchema = z
+  .object({
+    ...envelope,
+    replyTo: z.uuid(),
+    type: z.literal('channel.connect'),
+  })
+  .strict();
+const iframeMessageSchema = z.discriminatedUnion('type', [
+  z
+    .object({
+      ...envelope,
+      type: z.literal('ready'),
+    })
+    .strict(),
+  z
+    .object({
+      ...envelope,
+      code: z.enum([
+        'authentication_failed',
+        'access_denied',
+        'session_expired',
+        'renewal_failed',
+        'unsupported_version',
+        'internal_error',
+      ]),
+      correlationId: z.string().min(1).max(128),
+      recoverable: z.boolean(),
+      replyTo: z.uuid().optional(),
+      type: z.literal('error'),
+    })
+    .strict(),
+  z
+    .object({
+      ...envelope,
+      expiresAt: z.iso.datetime({ offset: true }),
+      requestId: z.uuid(),
+      type: z.literal('session.expiring'),
+    })
+    .strict(),
+  z
+    .object({
+      ...envelope,
+      expiresAt: z.iso.datetime({ offset: true }),
+      replyTo: z.uuid(),
+      type: z.literal('session.renewed'),
+    })
+    .strict(),
+  z
+    .object({
+      ...envelope,
+      height: z.number().int().positive(),
+      type: z.literal('resize'),
+    })
+    .strict(),
+]);
+const parentMessageSchema = z.discriminatedUnion('type', [
+  z
+    .object({
+      ...envelope,
+      embedUrl: z.url(),
+      replyTo: z.uuid(),
+      requestId: z.uuid(),
+      type: z.literal('session.renew'),
+    })
+    .strict(),
+]);
+
+export const embedLifecycle = {
+  channelConnectSchema,
+  channelRequestSchema,
+  iframeMessageSchema,
+  parentMessageSchema,
+  protocol,
+  version,
+} as const;
+
+export type EmbedLifecycleChannelConnect = z.infer<typeof channelConnectSchema>;
+export type EmbedLifecycleChannelRequest = z.infer<typeof channelRequestSchema>;
+export type EmbedLifecycleIframeMessage = z.infer<typeof iframeMessageSchema>;
+export type EmbedLifecycleParentMessage = z.infer<typeof parentMessageSchema>;

package/src/generated/v1.ts

@@ -270,7 +270,7 @@ export interface paths {
         /** @description List API token metadata for the current team without revealing token secrets. Requires an authenticated team admin or global VRP admin. */
         get: operations["getApiTokens"];
         put?: never;
-        /** @description Generate an API token for the current team and return its secret. Partner teams may provide capability bundles to restrict the token; omission grants unrestricted partner API access. An optional IP allowlist is enforced on every API-key request. Requires an authenticated team admin or global VRP admin. The token secret is never written to audit records. */
+        /** @description Generate an API token for the current team and return its secret. Partner teams may provide capability bundles to restrict the token; omission grants unrestricted partner API access. An optional IP allowlist is enforced on every API-key request, and an optional exact parent-origin allowlist restricts embedded-session creation and renewal. Requires an authenticated team admin or global VRP admin. The token secret is never written to audit records. */
         post: operations["postApiTokens"];
         delete?: never;
         options?: never;
@@ -2683,6 +2683,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/partner/embed-sessions/{id}/renewals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Issue a single-use successor for an active embedded session without changing its grant or revoking it before exchange.
+         *
+         *     Required scope: embedded-sessions:issue
+         */
+        post: operations["renewEmbedSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/partner/listings": {
         parameters: {
             query?: never;
@@ -8950,6 +8971,7 @@ export interface operations {
                 content: {
                     "application/json": {
                         data: {
+                            allowedEmbedParentOrigins: string[];
                             allowedIpCidrs: string[];
                             bundles: ("embed:exports:v1" | "embed:reports:v1" | "embed:statements:v1" | "partner:accounting-data:v1" | "partner:banking:v1" | "partner:onboarding:v1" | "partner:provisioning:v1" | "partner:reports:v1" | "partner:statements:v1" | "partner:webhooks:v1")[];
                             /** Format: uuid */
@@ -9121,6 +9143,8 @@ export interface operations {
         requestBody?: {
             content: {
                 "application/json": {
+                    /** @description Exact HTTP(S) parent origins allowed when this partner token creates embedded sessions. A non-empty list is enforced exactly on issuance and renewal; omission currently leaves parent origins unrestricted. An empty array is rejected. Rejected for ordinary teams. */
+                    allowedEmbedParentOrigins?: string[];
                     /** @description Optional IPv4 or IPv6 addresses and CIDRs allowed to use this token. Individual addresses are normalized to /32 or /128. Omit or send an empty array for no IP restriction. */
                     allowedIpCidrs?: string[];
                     /** @description Optional capability restrictions for a partner-owned API token. Omit for unrestricted partner API access. Rejected for ordinary teams. */
@@ -9136,6 +9160,7 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
+                        allowedEmbedParentOrigins: string[];
                         allowedIpCidrs: string[];
                         bundles: ("embed:exports:v1" | "embed:reports:v1" | "embed:statements:v1" | "partner:accounting-data:v1" | "partner:banking:v1" | "partner:onboarding:v1" | "partner:provisioning:v1" | "partner:reports:v1" | "partner:statements:v1" | "partner:webhooks:v1")[];
                         /** Format: uuid */
@@ -9306,6 +9331,7 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
+                        allowedEmbedParentOrigins: string[];
                         allowedIpCidrs: string[];
                         bundles: ("embed:exports:v1" | "embed:reports:v1" | "embed:statements:v1" | "partner:accounting-data:v1" | "partner:banking:v1" | "partner:onboarding:v1" | "partner:provisioning:v1" | "partner:reports:v1" | "partner:statements:v1" | "partner:webhooks:v1")[];
                         /** Format: uuid */
@@ -21322,11 +21348,21 @@ export interface operations {
                         accessToken: string;
                         /** @description Embedded capability bundles granted to the session. */
                         bundles: ("embed:exports:v1" | "embed:reports:v1" | "embed:statements:v1")[];
+                        /**
+                         * Format: uuid
+                         * @description Stable lifecycle channel ID for this iframe.
+                         */
+                        channelId: string;
                         /**
                          * Format: date-time
                          * @description Bearer-token expiration timestamp.
                          */
                         expiresAt: string;
+                        /**
+                         * Format: uri
+                         * @description Exact parent-page origin bound to the lifecycle channel.
+                         */
+                        parentOrigin: string;
                         /**
                          * Format: uuid
                          * @description Session ID created by the partner backend.
@@ -42735,6 +42771,16 @@ export interface operations {
                     autoProvision?: boolean;
                     /** @description Embedded capability bundles granted to the session. */
                     bundles: ("embed:exports:v1" | "embed:reports:v1" | "embed:statements:v1")[];
+                    /**
+                     * Format: uri
+                     * @description Exact embedded-application origin that will exchange the bootstrap.
+                     */
+                    embedOrigin: string;
+                    /**
+                     * Format: uri
+                     * @description Exact parent-page origin to bind to this iframe lifecycle channel.
+                     */
+                    parentOrigin: string;
                     /** @description Stable external user identifier in the partner system. */
                     sub: string;
                     /**
@@ -42762,6 +42808,11 @@ export interface operations {
                          * @description Deadline for exchanging the one-time bootstrap code.
                          */
                         bootstrapExpiresAt: string;
+                        /**
+                         * Format: uuid
+                         * @description Stable lifecycle channel ID for this iframe.
+                         */
+                        channelId: string;
                         /**
                          * Format: uri
                          * @description Ready-to-mount embedded application URL.
@@ -42772,6 +42823,11 @@ export interface operations {
                          * @description Session ID used for explicit revocation.
                          */
                         id: string;
+                        /**
+                         * Format: uri
+                         * @description Exact parent-page origin bound to the lifecycle channel.
+                         */
+                        parentOrigin: string;
                         /**
                          * @description Bearer-session lifetime, starting when the code is exchanged.
                          * @constant
@@ -43084,6 +43140,204 @@ export interface operations {
             };
         };
     };
+    renewEmbedSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Active embedded session to replace. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    /** @description Prevents storage of the successor bootstrap URL and code. */
+                    "Cache-Control"?: "no-store";
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: date-time
+                         * @description Deadline for exchanging the one-time bootstrap code.
+                         */
+                        bootstrapExpiresAt: string;
+                        /**
+                         * Format: uuid
+                         * @description Stable lifecycle channel ID for this iframe.
+                         */
+                        channelId: string;
+                        /**
+                         * Format: uri
+                         * @description Ready-to-mount embedded application URL.
+                         */
+                        embedUrl: string;
+                        /**
+                         * Format: uuid
+                         * @description Session ID used for explicit revocation.
+                         */
+                        id: string;
+                        /**
+                         * Format: uri
+                         * @description Exact parent-page origin bound to the lifecycle channel.
+                         */
+                        parentOrigin: string;
+                        /**
+                         * @description Bearer-session lifetime, starting when the code is exchanged.
+                         * @constant
+                         */
+                        sessionTtlSeconds: 900;
+                        /**
+                         * Format: uuid
+                         * @description Team bound to the embedded session.
+                         */
+                        teamId: string;
+                        /**
+                         * Format: uuid
+                         * @description VRPlatform user bound to the session.
+                         */
+                        userId: string;
+                    };
+                };
+            };
+            /** @description Bad request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+            /** @description Not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+            /** @description Service unavailable */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        code: string;
+                        message: string;
+                        links?: {
+                            docs: string;
+                            schema: string;
+                        };
+                        issues?: {
+                            message: string;
+                            path?: (string | number)[];
+                            schema?: string;
+                        }[];
+                        context?: unknown;
+                    };
+                };
+            };
+        };
+    };
     getPartnerListings: {
         parameters: {
             query?: {

package/src/index.ts

@@ -1,6 +1,7 @@
 import type { ApiClient } from './types';
 
 export * from './client';
+export * from './embed-lifecycle';
 export * from './error';
 export type * from './generated/v1';
 export * from './routing';