Download the PHP package tropikal-ai/connect without Composer
On this page you can find all versions of the php package tropikal-ai/connect. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download tropikal-ai/connect
More information about tropikal-ai/connect
Files in tropikal-ai/connect
Package connect
Short Description Framework-agnostic TROPIKAL Connect protocol primitives.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package connect
TROPIKAL Connect
Framework-agnostic protocol primitives for platform packages that implement TROPIKAL Connect.
tropikal-ai/connect contains OAuth PKCE helpers, signed request creation and verification, resource and capability schema rules, and browser payload safety checks. It has no Laravel, Filament, WordPress, Shopify, database, route, controller, view, storage, HTTP client, or private server implementation.
Requirements
- PHP 8.2 or newer
- Composer 2
Install
For clone-based development, add a path repository to the application that consumes the package:
What It Provides
- PKCE S256 verifier and challenge generation.
- OAuth state generation, hashing, expiry, and validation.
- Exact redirect URI matching.
- OAuth public client registration payloads.
- Authorization and token request payload builders.
- Token response validation and safe redaction.
- Canonical signed server-to-server requests.
- Constant-time signature verification.
- Atomic nonce replay protection through a host-owned port.
- Resource, field, operation, and capability descriptors.
- Explicit read projection and write validation.
- Named action grant validation.
- Recursive browser/public payload safety checks.
Security Model
- OAuth authorization code with PKCE S256 is the only setup primitive.
- OAuth state is stored and compared by hash.
- Redirect URIs must match exactly.
- Signed requests cover method, path, normalized query string, timestamp, nonce, installation id, and body hash.
- Replay protection must be backed by an atomic
NonceStoreimplementation in the host package. - Empty resource grants expose nothing.
- Reads project declared fields only.
- Writes accept declared writable fields only.
- Write grants do not imply delete.
- Destructive operations must be explicit and confirmation-aware in host packages.
- Named actions require explicit grants.
- Secret-shaped keys are rejected in declarations and browser/public payloads.
- Browser payloads never include secrets by contract.
There is no token-paste setup path, no copied-secret setup path, and no browser-visible credential path in this package.
See docs/security/threat-model.md for the release-candidate threat model.
Capability Example
Private Server Boundary
Server and control-plane internals are intentionally absent. Platform packages provide storage, encrypted persistence, HTTP clients, admin UI, and production endpoint configuration.
Use example.com hosts in public documentation and tests.
Troubleshooting
- Redirect validation failed: compare the configured callback URL byte-for-byte with the callback URL used during authorization.
- Signature validation failed: verify method, path, normalized query string, body hash, timestamp, nonce, installation id, and signing key.
- A replay error occurred: make sure the host
NonceStoreclaims nonces atomically. - A field is missing from output: only explicitly declared readable fields are projected.
- A write field is rejected: only explicitly declared writable fields are accepted.
