actas 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -45,10 +45,12 @@ export async function runAccountCommand(consumer,env,spawnChild){
|
|
|
45
45
|
export async function vaultLogin(request,scope,path){
|
|
46
46
|
const read=body=>request('/vault/read','POST',{...scope,path,...body});
|
|
47
47
|
const entry=await read({action:'read'});if(entry.kind!=='login')throw Error('Not a login item.');
|
|
48
|
+
const signInMethod=entry.login?.signInMethod??'password',ssoAccountId=entry.login?.ssoAccountId??null;
|
|
49
|
+
if(!['password','google','github','apple'].includes(signInMethod))throw Error('Invalid login sign-in metadata.');
|
|
48
50
|
const field=async name=>(await read({action:'reveal',field:name})).value||null;
|
|
49
|
-
const [username,email,password]=await Promise.all([field('username'),field('email'),entry.login?.hasPassword?field('password'):null]);
|
|
51
|
+
const [username,email,password]=await Promise.all([field('username'),field('email'),signInMethod==='password'&&entry.login?.hasPassword?field('password'):null]);
|
|
50
52
|
const totp=entry.login?.hasTotp?await read({action:'totp:code'}):null;
|
|
51
|
-
return {path,username,email,password,totp:totp?{code:totp.code,secondsRemaining:totp.secondsRemaining}:null};
|
|
53
|
+
return {path,signInMethod,ssoAccountId,username,email,password,totp:totp?{code:totp.code,secondsRemaining:totp.secondsRemaining}:null};
|
|
52
54
|
}
|
|
53
55
|
export function createAccountsRuntime({request,codesRequest=request,scope,identityId,browserAdapter,spawnChild,runConsumer,values=new PrivateValues()}){
|
|
54
56
|
const call=(route,body={})=>request('/account-tools'+route,'POST',{...body,...scope});
|
|
@@ -10,7 +10,7 @@ export function createAccountsMcp(runtime){
|
|
|
10
10
|
['actas_inbox_wait_for_code','Wait up to 60s for one sign-in code from an authenticated sender (emails:codes). Returns only the code.',{inboxId:z.string().min(1).max(160),sender:z.string().email().max(254),subject:z.string().min(1).max(200),after:z.string().datetime(),pattern:z.string().regex(/^(?:\\d|\[A-Z0-9\])\{(?:[4-9]|1[0-2])\}$/).optional(),timeoutMs:z.number().int().min(0).max(60000).optional()}],
|
|
11
11
|
['actas_passkey_register','Create an ES256 passkey for a granted login; private key stays encrypted in hosted ActAs. Requires read, reveal and write grants.',{path,rpId:z.string().min(3).max(253),origin:z.string().url(),challenge:z.string().max(1368),userHandle:z.string().max(86),userVerification:z.enum(['required','preferred','discouraged']).optional()}],
|
|
12
12
|
['actas_passkey_sign','Sign a WebAuthn assertion for a granted login; private key never leaves hosted ActAs. Requires read and reveal grants.',{path,rpId:z.string().min(3).max(253),origin:z.string().url(),challenge:z.string().max(1368),credentialId:z.string().max(128).optional(),allowCredentials:z.array(z.string().max(128)).max(64).optional(),userVerification:z.enum(['required','preferred','discouraged']).optional()}],
|
|
13
|
-
['actas_vault_login','Return a granted login item
|
|
13
|
+
['actas_vault_login','Return a granted login item with its sign-in method and SSO account reference; password sign-in can include a saved password and current TOTP code. SSO references never grant provider-account access. Never the TOTP seed (secrets:reveal plus read, reveal and totp:code grants).',{path}],
|
|
14
14
|
['actas_domains_list','List workspace domains and exact DNS records (domain management).',{}],
|
|
15
15
|
['actas_domains_add','Claim a workspace mail domain (domain management); reconcile by checking the same domain.',{domain:z.string().min(3).max(253)}],
|
|
16
16
|
['actas_domains_verify','Check ownership, DKIM and MX and reconcile SES setup (domain management).',{domain:z.string().min(3).max(253)}],
|