@xkova/sdk 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/client.js

@@ -1,4 +1,5 @@
 import { XKOVAApiError } from './errors.js';
+import { isAllowedProtocol } from './url.js';
 import { generateIdempotencyKey } from './idempotency.js';
 import { signXKOVARequest, validateXKOVARequestSigner, xkovaContentDigest, } from './request-signing.js';
 import { AccountHoldersResource, } from './resources/account-holders.js';
@@ -15,6 +16,7 @@ import { RampsResource } from './resources/ramps.js';
 import { RwaResource } from './resources/rwa.js';
 import { TenantResource } from './resources/tenant.js';
 import { TokenizationResource } from './resources/tokenization.js';
+import { TreasuryResource } from './resources/treasury.js';
 import { TransactionsResource } from './resources/transactions.js';
 import { WalletsResource } from './resources/wallets.js';
 import { WebhooksResource } from './resources/webhooks.js';
@@ -24,11 +26,13 @@ import { WorkspacesResource } from './resources/workspaces.js';
 export class XKOVAClient {
     config;
     memberContext;
+    workforceContext;
     apiBaseUrl;
     fetchImpl;
-    constructor(config, memberContext) {
+    constructor(config, memberContext, workforceContext) {
         this.config = config;
         this.memberContext = memberContext;
+        this.workforceContext = workforceContext;
         if (config.timeoutMs !== undefined &&
             (!Number.isFinite(config.timeoutMs) || config.timeoutMs <= 0)) {
             throw new Error('XKOVAClient timeoutMs must be a positive finite number');
@@ -82,6 +86,10 @@ export class XKOVAClient {
     get tokenization() {
         return (this.namespaces.tokenization ??= new TokenizationResource(this));
     }
+    /** Tenant treasury operations retain server-side roles, governance and signer checks. */
+    get treasury() {
+        return (this.namespaces.treasury ??= new TreasuryResource(this));
+    }
     get transactions() {
         return (this.namespaces.transactions ??= new TransactionsResource(this));
     }
@@ -107,6 +115,20 @@ export class XKOVAClient {
     static forMemberSession(options, context) {
         return new XKOVAClient(options, Object.freeze({ ...context }));
     }
+    /** @internal Created only after the workforce BFF resolves its confidential store. */
+    static forWorkforceSession(options, context) {
+        if (!/^xkova_wf_[A-Za-z0-9_-]{43}$/.test(context.workforceKey) ||
+            !/^xwfs_[A-Za-z0-9_-]{43}$/.test(context.sessionToken) ||
+            (context.humanAuthorization !== undefined &&
+                !/^[A-Za-z0-9_-]{43}$/.test(context.humanAuthorization))) {
+            throw new TypeError('Invalid workforce session material');
+        }
+        const origin = new URL(context.browserOrigin);
+        if (origin.origin !== context.browserOrigin || !isAllowedProtocol(origin)) {
+            throw new TypeError('Invalid workforce application origin');
+        }
+        return new XKOVAClient(options, undefined, Object.freeze({ ...context }));
+    }
     /** @internal Resource transport. Use typed namespaces instead. */
     async requestJson(options) {
         const prepared = await this.prepareRequest(options);
@@ -210,6 +232,9 @@ export class XKOVAClient {
             headers.set(name, value);
         }
         if (this.memberContext) {
+            if (headers.has('X-Workforce-Session') || headers.has('X-XKOVA-Workforce-Key')) {
+                throw new TypeError('Member and workforce authority cannot be combined');
+            }
             const authority = {
                 Authorization: `Bearer ${this.config.apiKey}`,
                 'X-Member-Session-Id': this.memberContext.memberSessionId,
@@ -223,6 +248,40 @@ export class XKOVAClient {
                 headers.set(name, value);
             }
         }
+        if (this.workforceContext) {
+            if (headers.has('X-XKOVA-Human-Authorization') && !this.workforceContext.humanAuthorization) {
+                throw new TypeError('A workforce action grant must come from the confidential context');
+            }
+            for (const name of [
+                'Cookie',
+                'X-Member-Session-Id',
+                'X-XKOVA-Publishable-Key',
+                'X-Account-Holder-Id',
+                'X-End-User-Id',
+                'X-OIDC-ID-Token',
+                'X-Active-Scope',
+                'X-Workspace-Id',
+                'X-Workspace-Type',
+            ]) {
+                if (headers.has(name))
+                    throw new TypeError('A workforce operation cannot mix identity or workspace contexts');
+            }
+            const authority = {
+                Authorization: `Bearer ${this.config.apiKey}`,
+                'X-XKOVA-Workforce-Key': this.workforceContext.workforceKey,
+                'X-Workforce-Session': this.workforceContext.sessionToken,
+                Origin: this.workforceContext.browserOrigin,
+                ...(this.workforceContext.humanAuthorization !== undefined && {
+                    'X-XKOVA-Human-Authorization': this.workforceContext.humanAuthorization,
+                }),
+            };
+            for (const [name, value] of Object.entries(authority)) {
+                if (headers.has(name) && headers.get(name) !== value) {
+                    throw new TypeError('A workforce-bound operation cannot replace its session authority');
+                }
+                headers.set(name, value);
+            }
+        }
         return headers;
     }
     requestSignal(signal) {
@@ -240,8 +299,8 @@ function normalizeApiBaseUrl(baseUrl) {
     if (url.username || url.password || url.search || url.hash) {
         throw new TypeError('XKOVA SDK baseUrl must be an API origin or /v1 base URL');
     }
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost')) {
-        throw new TypeError('XKOVA SDK baseUrl must use HTTPS or localhost HTTP');
+    if (!isAllowedProtocol(url)) {
+        throw new TypeError('XKOVA SDK baseUrl must use HTTPS or loopback HTTP');
     }
     const pathname = url.pathname.replace(/\/+$/, '');
     if (pathname !== '' && pathname !== '/v1') {