@ankhorage/contracts 2.0.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/dist/auth.d.ts +80 -14
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +37 -0
- package/dist/auth.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/secretManifest.d.ts +11 -0
- package/dist/secretManifest.d.ts.map +1 -0
- package/dist/secretManifest.js +2 -0
- package/dist/secretManifest.js.map +1 -0
- package/dist/secrets.d.ts +85 -0
- package/dist/secrets.d.ts.map +1 -0
- package/dist/secrets.js +83 -0
- package/dist/secrets.js.map +1 -0
- package/package.json +8 -2
- package/src/auth-oauth.test.ts +189 -44
- package/src/auth.ts +135 -16
- package/src/index.ts +2 -0
- package/src/secretManifest.ts +12 -0
- package/src/secrets.test.ts +88 -0
- package/src/secrets.ts +188 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# @ankhorage/contracts
|
|
2
2
|
|
|
3
|
+
## 3.0.0
|
|
4
|
+
|
|
5
|
+
### Major Changes
|
|
6
|
+
|
|
7
|
+
- d46f70b: Replace the optional URL-only OAuth adapter methods with one canonical provider-neutral OAuth capability that requires authorization start and callback completion, models transport cancellation and failures explicitly, and resolves successful OAuth sign-in to the existing `AuthSession` contract.
|
|
8
|
+
|
|
9
|
+
## 2.1.0
|
|
10
|
+
|
|
11
|
+
### Minor Changes
|
|
12
|
+
|
|
13
|
+
- 7249c06: Add provider-neutral secret-store contracts, canonical `infra.secretStore` provider selection, logical OAuth `credentialsRef` support, and validation helpers that reject inline secret fields.
|
|
14
|
+
|
|
3
15
|
## 2.0.0
|
|
4
16
|
|
|
5
17
|
### Major Changes
|
package/dist/auth.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { SecretRef } from './secrets';
|
|
1
2
|
import type { IconSpec } from './types';
|
|
2
3
|
export declare const AUTH_IDENTIFIER_KINDS: readonly ["email", "phone", "username"];
|
|
3
4
|
export type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];
|
|
@@ -41,9 +42,10 @@ export interface AuthOAuthProviderConfig {
|
|
|
41
42
|
label?: string;
|
|
42
43
|
enabled?: boolean;
|
|
43
44
|
scopes?: string[];
|
|
44
|
-
redirectTo?: string;
|
|
45
45
|
queryParams?: Record<string, string>;
|
|
46
46
|
icon?: IconSpec;
|
|
47
|
+
/** Logical server-side secret reference; raw credentials must never be stored here. */
|
|
48
|
+
credentialsRef?: SecretRef;
|
|
47
49
|
}
|
|
48
50
|
export interface AuthOAuthConfig {
|
|
49
51
|
enabled: boolean;
|
|
@@ -117,20 +119,83 @@ export interface VerifyOtpInput {
|
|
|
117
119
|
redirectTo?: string;
|
|
118
120
|
metadata?: Record<string, unknown>;
|
|
119
121
|
}
|
|
120
|
-
export
|
|
122
|
+
export declare const AUTH_OAUTH_ERROR_STAGES: readonly ["start", "transport", "callback", "exchange", "session", "profile"];
|
|
123
|
+
export type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];
|
|
124
|
+
export declare const AUTH_OAUTH_ERROR_CODES: readonly ["oauth_unavailable", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "authorization_failed", "authorization_attempt_not_found", "invalid_callback", "state_mismatch", "pkce_mismatch", "callback_already_completed", "code_exchange_failed", "network_error", "session_persistence_failed", "profile_creation_failed", "provider_error"];
|
|
125
|
+
export type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];
|
|
126
|
+
export interface AuthOAuthError extends AuthAdapterError {
|
|
127
|
+
code: AuthOAuthErrorCode;
|
|
128
|
+
stage: AuthOAuthErrorStage;
|
|
129
|
+
provider?: AuthOAuthProviderId;
|
|
130
|
+
recoverable: boolean;
|
|
131
|
+
}
|
|
132
|
+
export declare const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS: readonly ["user_cancelled", "browser_dismissed"];
|
|
133
|
+
export type AuthOAuthTransportCancellationReason = (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];
|
|
134
|
+
export declare const AUTH_OAUTH_CANCELLATION_REASONS: readonly ["user_cancelled", "browser_dismissed", "provider_denied"];
|
|
135
|
+
export type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];
|
|
136
|
+
export declare const AUTH_OAUTH_TRANSPORT_ERROR_CODES: readonly ["browser_unavailable", "transport_failed"];
|
|
137
|
+
export type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];
|
|
138
|
+
export interface AuthOAuthTransportError {
|
|
139
|
+
code: AuthOAuthTransportErrorCode;
|
|
140
|
+
message: string;
|
|
141
|
+
cause?: unknown;
|
|
142
|
+
}
|
|
143
|
+
export interface StartOAuthAuthorizationInput {
|
|
121
144
|
provider: AuthOAuthProviderId;
|
|
122
|
-
|
|
123
|
-
scopes?: string[];
|
|
124
|
-
queryParams?: Record<string, string
|
|
125
|
-
metadata?: Record<string, unknown>;
|
|
145
|
+
redirectUri: string;
|
|
146
|
+
scopes?: readonly string[];
|
|
147
|
+
queryParams?: Readonly<Record<string, string>>;
|
|
126
148
|
}
|
|
127
|
-
export interface
|
|
149
|
+
export interface AuthOAuthAuthorizationRequest {
|
|
150
|
+
attemptId: string;
|
|
128
151
|
provider: AuthOAuthProviderId;
|
|
129
|
-
|
|
152
|
+
authorizationUrl: string;
|
|
153
|
+
redirectUri: string;
|
|
130
154
|
}
|
|
131
|
-
export
|
|
155
|
+
export type AuthOAuthStartResult = {
|
|
156
|
+
ok: true;
|
|
157
|
+
data: AuthOAuthAuthorizationRequest;
|
|
158
|
+
} | {
|
|
159
|
+
ok: false;
|
|
160
|
+
error: AuthOAuthError;
|
|
161
|
+
};
|
|
162
|
+
export type AuthOAuthAuthorizationResponse = {
|
|
163
|
+
type: 'callback';
|
|
132
164
|
url: string;
|
|
133
|
-
|
|
165
|
+
} | {
|
|
166
|
+
type: 'cancelled';
|
|
167
|
+
reason: AuthOAuthTransportCancellationReason;
|
|
168
|
+
} | {
|
|
169
|
+
type: 'error';
|
|
170
|
+
error: AuthOAuthTransportError;
|
|
171
|
+
};
|
|
172
|
+
export interface CompleteOAuthAuthorizationInput {
|
|
173
|
+
attemptId: string;
|
|
174
|
+
response: AuthOAuthAuthorizationResponse;
|
|
175
|
+
}
|
|
176
|
+
export type AuthOAuthCompletionResult = {
|
|
177
|
+
ok: true;
|
|
178
|
+
status: 'authenticated';
|
|
179
|
+
provider: AuthOAuthProviderId;
|
|
180
|
+
session: AuthSession;
|
|
181
|
+
} | {
|
|
182
|
+
ok: false;
|
|
183
|
+
status: 'cancelled';
|
|
184
|
+
provider: AuthOAuthProviderId;
|
|
185
|
+
reason: AuthOAuthCancellationReason;
|
|
186
|
+
} | {
|
|
187
|
+
ok: false;
|
|
188
|
+
status: 'error';
|
|
189
|
+
error: AuthOAuthError;
|
|
190
|
+
};
|
|
191
|
+
export interface AuthOAuthCapabilities {
|
|
192
|
+
/** Enabled providers for which start and callback completion are operational. */
|
|
193
|
+
providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];
|
|
194
|
+
}
|
|
195
|
+
export interface AuthOAuthAdapter {
|
|
196
|
+
readonly capabilities: AuthOAuthCapabilities;
|
|
197
|
+
startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;
|
|
198
|
+
completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;
|
|
134
199
|
}
|
|
135
200
|
export interface AuthAdapterCapabilities {
|
|
136
201
|
signInIdentifiers: AuthIdentifierKind[];
|
|
@@ -138,11 +203,14 @@ export interface AuthAdapterCapabilities {
|
|
|
138
203
|
supportsPasswordReset: boolean;
|
|
139
204
|
supportsOtp: boolean;
|
|
140
205
|
supportsSessionRefresh: boolean;
|
|
141
|
-
supportsOAuth?: boolean;
|
|
142
|
-
oauthProviders?: AuthOAuthProviderId[];
|
|
143
206
|
}
|
|
144
207
|
export interface AuthAdapter {
|
|
145
208
|
readonly capabilities?: AuthAdapterCapabilities;
|
|
209
|
+
/**
|
|
210
|
+
* Presence is the canonical OAuth capability signal. When present, both authorization start and
|
|
211
|
+
* callback completion are mandatory and operational for every advertised provider.
|
|
212
|
+
*/
|
|
213
|
+
readonly oauth?: AuthOAuthAdapter;
|
|
146
214
|
signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;
|
|
147
215
|
signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;
|
|
148
216
|
signOut(input?: SignOutInput): Promise<AuthResult>;
|
|
@@ -150,7 +218,5 @@ export interface AuthAdapter {
|
|
|
150
218
|
refreshSession?(): Promise<AuthResult<AuthSession | null>>;
|
|
151
219
|
requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;
|
|
152
220
|
verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;
|
|
153
|
-
signInWithOAuth?(input: SignInWithOAuthInput): Promise<AuthResult<AuthOAuthRedirect>>;
|
|
154
|
-
completeOAuthSignIn?(input: CompleteOAuthSignInInput): Promise<AuthResult<AuthSession>>;
|
|
155
221
|
}
|
|
156
222
|
//# sourceMappingURL=auth.d.ts.map
|
package/dist/auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
|
package/dist/auth.js
CHANGED
|
@@ -38,4 +38,41 @@ export const DEFAULT_AUTH_FLOW = {
|
|
|
38
38
|
export function resolveAuthFlow(flow) {
|
|
39
39
|
return { ...(flow ?? DEFAULT_AUTH_FLOW) };
|
|
40
40
|
}
|
|
41
|
+
export const AUTH_OAUTH_ERROR_STAGES = [
|
|
42
|
+
'start',
|
|
43
|
+
'transport',
|
|
44
|
+
'callback',
|
|
45
|
+
'exchange',
|
|
46
|
+
'session',
|
|
47
|
+
'profile',
|
|
48
|
+
];
|
|
49
|
+
export const AUTH_OAUTH_ERROR_CODES = [
|
|
50
|
+
'oauth_unavailable',
|
|
51
|
+
'provider_disabled',
|
|
52
|
+
'provider_misconfigured',
|
|
53
|
+
'invalid_redirect_uri',
|
|
54
|
+
'authorization_failed',
|
|
55
|
+
'authorization_attempt_not_found',
|
|
56
|
+
'invalid_callback',
|
|
57
|
+
'state_mismatch',
|
|
58
|
+
'pkce_mismatch',
|
|
59
|
+
'callback_already_completed',
|
|
60
|
+
'code_exchange_failed',
|
|
61
|
+
'network_error',
|
|
62
|
+
'session_persistence_failed',
|
|
63
|
+
'profile_creation_failed',
|
|
64
|
+
'provider_error',
|
|
65
|
+
];
|
|
66
|
+
export const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [
|
|
67
|
+
'user_cancelled',
|
|
68
|
+
'browser_dismissed',
|
|
69
|
+
];
|
|
70
|
+
export const AUTH_OAUTH_CANCELLATION_REASONS = [
|
|
71
|
+
...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,
|
|
72
|
+
'provider_denied',
|
|
73
|
+
];
|
|
74
|
+
export const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [
|
|
75
|
+
'browser_unavailable',
|
|
76
|
+
'transport_failed',
|
|
77
|
+
];
|
|
41
78
|
//# sourceMappingURL=auth.js.map
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAmBX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
|
package/dist/index.d.ts
CHANGED
|
@@ -6,6 +6,8 @@ export * from './db';
|
|
|
6
6
|
export * from './nutrition';
|
|
7
7
|
export * from './requirements';
|
|
8
8
|
export * from './runtimeCallbacks';
|
|
9
|
+
export * from './secretManifest';
|
|
10
|
+
export * from './secrets';
|
|
9
11
|
export * from './state';
|
|
10
12
|
export * from './storage';
|
|
11
13
|
export * from './types';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,MAAM,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,MAAM,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -6,6 +6,8 @@ export * from './db';
|
|
|
6
6
|
export * from './nutrition';
|
|
7
7
|
export * from './requirements';
|
|
8
8
|
export * from './runtimeCallbacks';
|
|
9
|
+
export * from './secretManifest';
|
|
10
|
+
export * from './secrets';
|
|
9
11
|
export * from './state';
|
|
10
12
|
export * from './storage';
|
|
11
13
|
export * from './types';
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,MAAM,CAAC","sourcesContent":["export * from './auth';\nexport * from './bindings';\nexport * from './cli';\nexport * from './data';\nexport * from './db';\nexport * from './nutrition';\nexport * from './requirements';\nexport * from './runtimeCallbacks';\nexport * from './state';\nexport * from './storage';\nexport * from './types';\nexport * from './ui';\n"]}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,MAAM,CAAC","sourcesContent":["export * from './auth';\nexport * from './bindings';\nexport * from './cli';\nexport * from './data';\nexport * from './db';\nexport * from './nutrition';\nexport * from './requirements';\nexport * from './runtimeCallbacks';\nexport * from './secretManifest';\nexport * from './secrets';\nexport * from './state';\nexport * from './storage';\nexport * from './types';\nexport * from './ui';\n"]}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import type { SecretStoreProvider } from './secrets';
|
|
2
|
+
export interface InfraSecretStoreSpec {
|
|
3
|
+
provider: SecretStoreProvider;
|
|
4
|
+
}
|
|
5
|
+
declare module './types' {
|
|
6
|
+
interface InfraManifest {
|
|
7
|
+
/** Non-secret provider selection. Bootstrap credentials stay in trusted environment config. */
|
|
8
|
+
secretStore?: InfraSecretStoreSpec;
|
|
9
|
+
}
|
|
10
|
+
}
|
|
11
|
+
//# sourceMappingURL=secretManifest.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secretManifest.d.ts","sourceRoot":"","sources":["../src/secretManifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,aAAa;QACrB,+FAA+F;QAC/F,WAAW,CAAC,EAAE,oBAAoB,CAAC;KACpC;CACF"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secretManifest.js","sourceRoot":"","sources":["../src/secretManifest.ts"],"names":[],"mappings":"","sourcesContent":["import type { SecretStoreProvider } from './secrets';\n\nexport interface InfraSecretStoreSpec {\n provider: SecretStoreProvider;\n}\n\ndeclare module './types' {\n interface InfraManifest {\n /** Non-secret provider selection. Bootstrap credentials stay in trusted environment config. */\n secretStore?: InfraSecretStoreSpec;\n }\n}\n"]}
|
|
@@ -0,0 +1,85 @@
|
|
|
1
|
+
export declare const SECRET_STORE_PROVIDERS: readonly ["supabase-vault"];
|
|
2
|
+
export type KnownSecretStoreProvider = (typeof SECRET_STORE_PROVIDERS)[number];
|
|
3
|
+
export type SecretStoreProvider = KnownSecretStoreProvider | (string & {});
|
|
4
|
+
export type SecretRef = string;
|
|
5
|
+
export interface SecretScope {
|
|
6
|
+
projectId: string;
|
|
7
|
+
environment: string;
|
|
8
|
+
}
|
|
9
|
+
export type SecretPayload = Readonly<Record<string, string>>;
|
|
10
|
+
export interface SecretMetadata {
|
|
11
|
+
ref: SecretRef;
|
|
12
|
+
scope: SecretScope;
|
|
13
|
+
kind: string;
|
|
14
|
+
provider?: string;
|
|
15
|
+
configuredFields: readonly string[];
|
|
16
|
+
createdAt: string;
|
|
17
|
+
updatedAt: string;
|
|
18
|
+
}
|
|
19
|
+
export declare const SECRET_STORE_ERROR_CODES: readonly ["invalid_config", "invalid_reference", "invalid_payload", "not_found", "conflict", "permission_denied", "unavailable", "provider_error"];
|
|
20
|
+
export type SecretStoreErrorCode = (typeof SECRET_STORE_ERROR_CODES)[number];
|
|
21
|
+
export interface SecretStoreError {
|
|
22
|
+
code: SecretStoreErrorCode;
|
|
23
|
+
message: string;
|
|
24
|
+
cause?: unknown;
|
|
25
|
+
}
|
|
26
|
+
export type SecretStoreOkResult<TData> = [TData] extends [void] ? {
|
|
27
|
+
ok: true;
|
|
28
|
+
data?: undefined;
|
|
29
|
+
} : {
|
|
30
|
+
ok: true;
|
|
31
|
+
data: TData;
|
|
32
|
+
};
|
|
33
|
+
export type SecretStoreResult<TData = void> = SecretStoreOkResult<TData> | {
|
|
34
|
+
ok: false;
|
|
35
|
+
error: SecretStoreError;
|
|
36
|
+
};
|
|
37
|
+
export interface SecretListInput {
|
|
38
|
+
scope: SecretScope;
|
|
39
|
+
kind?: string;
|
|
40
|
+
provider?: string;
|
|
41
|
+
}
|
|
42
|
+
export interface SecretGetMetadataInput {
|
|
43
|
+
scope: SecretScope;
|
|
44
|
+
ref: SecretRef;
|
|
45
|
+
}
|
|
46
|
+
export interface SecretCreateInput {
|
|
47
|
+
scope: SecretScope;
|
|
48
|
+
ref: SecretRef;
|
|
49
|
+
kind: string;
|
|
50
|
+
provider?: string;
|
|
51
|
+
payload: SecretPayload;
|
|
52
|
+
}
|
|
53
|
+
export interface SecretReplaceInput {
|
|
54
|
+
scope: SecretScope;
|
|
55
|
+
ref: SecretRef;
|
|
56
|
+
payload: SecretPayload;
|
|
57
|
+
}
|
|
58
|
+
export interface SecretRemoveInput {
|
|
59
|
+
scope: SecretScope;
|
|
60
|
+
ref: SecretRef;
|
|
61
|
+
}
|
|
62
|
+
export interface SecretResolveInput {
|
|
63
|
+
scope: SecretScope;
|
|
64
|
+
ref: SecretRef;
|
|
65
|
+
}
|
|
66
|
+
/**
|
|
67
|
+
* Provider-neutral server-side secret-store boundary.
|
|
68
|
+
*
|
|
69
|
+
* `resolve` is for trusted server/deployment code only. Browser bridges must expose
|
|
70
|
+
* metadata operations without forwarding raw secret payloads.
|
|
71
|
+
*/
|
|
72
|
+
export interface SecretStoreAdapter {
|
|
73
|
+
list(input: SecretListInput): Promise<SecretStoreResult<readonly SecretMetadata[]>>;
|
|
74
|
+
getMetadata(input: SecretGetMetadataInput): Promise<SecretStoreResult<SecretMetadata>>;
|
|
75
|
+
create(input: SecretCreateInput): Promise<SecretStoreResult<SecretMetadata>>;
|
|
76
|
+
replace(input: SecretReplaceInput): Promise<SecretStoreResult<SecretMetadata>>;
|
|
77
|
+
remove(input: SecretRemoveInput): Promise<SecretStoreResult>;
|
|
78
|
+
resolve(input: SecretResolveInput): Promise<SecretStoreResult<SecretPayload>>;
|
|
79
|
+
}
|
|
80
|
+
export declare function normalizeSecretRef(value: string): SecretStoreResult<SecretRef>;
|
|
81
|
+
export declare function normalizeSecretScope(scope: SecretScope): SecretStoreResult<SecretScope>;
|
|
82
|
+
export declare function validateSecretPayload(payload: SecretPayload): SecretStoreResult<SecretPayload>;
|
|
83
|
+
export declare const FORBIDDEN_INLINE_SECRET_FIELDS: readonly ["apiKey", "clientSecret", "databasePassword", "privateKey", "serviceRoleKey", "token"];
|
|
84
|
+
export declare function findForbiddenInlineSecretFields(value: unknown): readonly string[];
|
|
85
|
+
//# sourceMappingURL=secrets.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,6BAA8B,CAAC;AAClE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/E,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,wBAAwB,oJAS3B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,iBAAiB,CAAC,KAAK,GAAG,IAAI,IACtC,mBAAmB,CAAC,KAAK,CAAC,GAC1B;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACpF,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;CAC/E;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAsB9E;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAevF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,iBAAiB,CAAC,aAAa,CAAC,CA0B9F;AAED,eAAO,MAAM,8BAA8B,kGAOjC,CAAC;AAEX,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAKjF"}
|
package/dist/secrets.js
ADDED
|
@@ -0,0 +1,83 @@
|
|
|
1
|
+
export const SECRET_STORE_PROVIDERS = ['supabase-vault'];
|
|
2
|
+
export const SECRET_STORE_ERROR_CODES = [
|
|
3
|
+
'invalid_config',
|
|
4
|
+
'invalid_reference',
|
|
5
|
+
'invalid_payload',
|
|
6
|
+
'not_found',
|
|
7
|
+
'conflict',
|
|
8
|
+
'permission_denied',
|
|
9
|
+
'unavailable',
|
|
10
|
+
'provider_error',
|
|
11
|
+
];
|
|
12
|
+
const SECRET_REF_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;
|
|
13
|
+
export function normalizeSecretRef(value) {
|
|
14
|
+
const normalized = value
|
|
15
|
+
.trim()
|
|
16
|
+
.replace(/^\/+|\/+$/g, '')
|
|
17
|
+
.replace(/\/{2,}/g, '/');
|
|
18
|
+
if (normalized.length === 0 ||
|
|
19
|
+
normalized.length > 255 ||
|
|
20
|
+
normalized.split('/').some((segment) => !SECRET_REF_SEGMENT_PATTERN.test(segment))) {
|
|
21
|
+
return {
|
|
22
|
+
ok: false,
|
|
23
|
+
error: {
|
|
24
|
+
code: 'invalid_reference',
|
|
25
|
+
message: 'Secret reference must contain lowercase path segments using letters, numbers, dots, underscores, or hyphens.',
|
|
26
|
+
},
|
|
27
|
+
};
|
|
28
|
+
}
|
|
29
|
+
return { ok: true, data: normalized };
|
|
30
|
+
}
|
|
31
|
+
export function normalizeSecretScope(scope) {
|
|
32
|
+
const projectId = scope.projectId.trim();
|
|
33
|
+
const environment = scope.environment.trim();
|
|
34
|
+
if (projectId.length === 0 || environment.length === 0) {
|
|
35
|
+
return {
|
|
36
|
+
ok: false,
|
|
37
|
+
error: {
|
|
38
|
+
code: 'invalid_config',
|
|
39
|
+
message: 'Secret scope requires non-empty projectId and environment values.',
|
|
40
|
+
},
|
|
41
|
+
};
|
|
42
|
+
}
|
|
43
|
+
return { ok: true, data: { projectId, environment } };
|
|
44
|
+
}
|
|
45
|
+
export function validateSecretPayload(payload) {
|
|
46
|
+
const entries = Object.entries(payload);
|
|
47
|
+
if (entries.length === 0) {
|
|
48
|
+
return {
|
|
49
|
+
ok: false,
|
|
50
|
+
error: {
|
|
51
|
+
code: 'invalid_payload',
|
|
52
|
+
message: 'Secret payload must contain at least one field.',
|
|
53
|
+
},
|
|
54
|
+
};
|
|
55
|
+
}
|
|
56
|
+
for (const [field, value] of entries) {
|
|
57
|
+
if (field.trim().length === 0 || typeof value !== 'string' || value.length === 0) {
|
|
58
|
+
return {
|
|
59
|
+
ok: false,
|
|
60
|
+
error: {
|
|
61
|
+
code: 'invalid_payload',
|
|
62
|
+
message: `Secret payload field ${field.trim().length === 0 ? '<empty>' : field} must contain a non-empty string value.`,
|
|
63
|
+
},
|
|
64
|
+
};
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
return { ok: true, data: Object.freeze(Object.fromEntries(entries)) };
|
|
68
|
+
}
|
|
69
|
+
export const FORBIDDEN_INLINE_SECRET_FIELDS = [
|
|
70
|
+
'apiKey',
|
|
71
|
+
'clientSecret',
|
|
72
|
+
'databasePassword',
|
|
73
|
+
'privateKey',
|
|
74
|
+
'serviceRoleKey',
|
|
75
|
+
'token',
|
|
76
|
+
];
|
|
77
|
+
export function findForbiddenInlineSecretFields(value) {
|
|
78
|
+
if (typeof value !== 'object' || value === null || Array.isArray(value))
|
|
79
|
+
return [];
|
|
80
|
+
const record = value;
|
|
81
|
+
return FORBIDDEN_INLINE_SECRET_FIELDS.filter((field) => field in record);
|
|
82
|
+
}
|
|
83
|
+
//# sourceMappingURL=secrets.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,gBAAgB,CAAU,CAAC;AAuBlE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;IACX,UAAU;IACV,mBAAmB;IACnB,aAAa;IACb,gBAAgB;CACR,CAAC;AAsEX,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEzE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,UAAU,GAAG,KAAK;SACrB,IAAI,EAAE;SACN,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAE3B,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,MAAM,GAAG,GAAG;QACvB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAClF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,8GAA8G;aACjH;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,mEAAmE;aAC7E;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,iDAAiD;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,yCAAyC;iBACxH;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,OAAO;CACC,CAAC;AAEX,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["export const SECRET_STORE_PROVIDERS = ['supabase-vault'] as const;\nexport type KnownSecretStoreProvider = (typeof SECRET_STORE_PROVIDERS)[number];\nexport type SecretStoreProvider = KnownSecretStoreProvider | (string & {});\n\nexport type SecretRef = string;\n\nexport interface SecretScope {\n projectId: string;\n environment: string;\n}\n\nexport type SecretPayload = Readonly<Record<string, string>>;\n\nexport interface SecretMetadata {\n ref: SecretRef;\n scope: SecretScope;\n kind: string;\n provider?: string;\n configuredFields: readonly string[];\n createdAt: string;\n updatedAt: string;\n}\n\nexport const SECRET_STORE_ERROR_CODES = [\n 'invalid_config',\n 'invalid_reference',\n 'invalid_payload',\n 'not_found',\n 'conflict',\n 'permission_denied',\n 'unavailable',\n 'provider_error',\n] as const;\nexport type SecretStoreErrorCode = (typeof SECRET_STORE_ERROR_CODES)[number];\n\nexport interface SecretStoreError {\n code: SecretStoreErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport type SecretStoreOkResult<TData> = [TData] extends [void]\n ? { ok: true; data?: undefined }\n : { ok: true; data: TData };\n\nexport type SecretStoreResult<TData = void> =\n | SecretStoreOkResult<TData>\n | {\n ok: false;\n error: SecretStoreError;\n };\n\nexport interface SecretListInput {\n scope: SecretScope;\n kind?: string;\n provider?: string;\n}\n\nexport interface SecretGetMetadataInput {\n scope: SecretScope;\n ref: SecretRef;\n}\n\nexport interface SecretCreateInput {\n scope: SecretScope;\n ref: SecretRef;\n kind: string;\n provider?: string;\n payload: SecretPayload;\n}\n\nexport interface SecretReplaceInput {\n scope: SecretScope;\n ref: SecretRef;\n payload: SecretPayload;\n}\n\nexport interface SecretRemoveInput {\n scope: SecretScope;\n ref: SecretRef;\n}\n\nexport interface SecretResolveInput {\n scope: SecretScope;\n ref: SecretRef;\n}\n\n/**\n * Provider-neutral server-side secret-store boundary.\n *\n * `resolve` is for trusted server/deployment code only. Browser bridges must expose\n * metadata operations without forwarding raw secret payloads.\n */\nexport interface SecretStoreAdapter {\n list(input: SecretListInput): Promise<SecretStoreResult<readonly SecretMetadata[]>>;\n getMetadata(input: SecretGetMetadataInput): Promise<SecretStoreResult<SecretMetadata>>;\n create(input: SecretCreateInput): Promise<SecretStoreResult<SecretMetadata>>;\n replace(input: SecretReplaceInput): Promise<SecretStoreResult<SecretMetadata>>;\n remove(input: SecretRemoveInput): Promise<SecretStoreResult>;\n resolve(input: SecretResolveInput): Promise<SecretStoreResult<SecretPayload>>;\n}\n\nconst SECRET_REF_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;\n\nexport function normalizeSecretRef(value: string): SecretStoreResult<SecretRef> {\n const normalized = value\n .trim()\n .replace(/^\\/+|\\/+$/g, '')\n .replace(/\\/{2,}/g, '/');\n\n if (\n normalized.length === 0 ||\n normalized.length > 255 ||\n normalized.split('/').some((segment) => !SECRET_REF_SEGMENT_PATTERN.test(segment))\n ) {\n return {\n ok: false,\n error: {\n code: 'invalid_reference',\n message:\n 'Secret reference must contain lowercase path segments using letters, numbers, dots, underscores, or hyphens.',\n },\n };\n }\n\n return { ok: true, data: normalized };\n}\n\nexport function normalizeSecretScope(scope: SecretScope): SecretStoreResult<SecretScope> {\n const projectId = scope.projectId.trim();\n const environment = scope.environment.trim();\n\n if (projectId.length === 0 || environment.length === 0) {\n return {\n ok: false,\n error: {\n code: 'invalid_config',\n message: 'Secret scope requires non-empty projectId and environment values.',\n },\n };\n }\n\n return { ok: true, data: { projectId, environment } };\n}\n\nexport function validateSecretPayload(payload: SecretPayload): SecretStoreResult<SecretPayload> {\n const entries = Object.entries(payload);\n\n if (entries.length === 0) {\n return {\n ok: false,\n error: {\n code: 'invalid_payload',\n message: 'Secret payload must contain at least one field.',\n },\n };\n }\n\n for (const [field, value] of entries) {\n if (field.trim().length === 0 || typeof value !== 'string' || value.length === 0) {\n return {\n ok: false,\n error: {\n code: 'invalid_payload',\n message: `Secret payload field ${field.trim().length === 0 ? '<empty>' : field} must contain a non-empty string value.`,\n },\n };\n }\n }\n\n return { ok: true, data: Object.freeze(Object.fromEntries(entries)) };\n}\n\nexport const FORBIDDEN_INLINE_SECRET_FIELDS = [\n 'apiKey',\n 'clientSecret',\n 'databasePassword',\n 'privateKey',\n 'serviceRoleKey',\n 'token',\n] as const;\n\nexport function findForbiddenInlineSecretFields(value: unknown): readonly string[] {\n if (typeof value !== 'object' || value === null || Array.isArray(value)) return [];\n\n const record = value as Record<string, unknown>;\n return FORBIDDEN_INLINE_SECRET_FIELDS.filter((field) => field in record);\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ankhorage/contracts",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "3.0.0",
|
|
4
4
|
"main": "./dist/index.js",
|
|
5
5
|
"ankh": {
|
|
6
6
|
"category": "contracts",
|
|
@@ -53,6 +53,10 @@
|
|
|
53
53
|
"types": "./dist/runtimeCallbacks.d.ts",
|
|
54
54
|
"default": "./dist/runtimeCallbacks.js"
|
|
55
55
|
},
|
|
56
|
+
"./secrets": {
|
|
57
|
+
"types": "./dist/secrets.d.ts",
|
|
58
|
+
"default": "./dist/secrets.js"
|
|
59
|
+
},
|
|
56
60
|
"./state": {
|
|
57
61
|
"types": "./dist/state.d.ts",
|
|
58
62
|
"default": "./dist/state.js"
|
|
@@ -66,13 +70,15 @@
|
|
|
66
70
|
"default": "./dist/ui.js"
|
|
67
71
|
}
|
|
68
72
|
},
|
|
69
|
-
"description": "Serializable app, action, and
|
|
73
|
+
"description": "Serializable app, action, theme, auth, and secret-store contracts for Ankhorage.",
|
|
70
74
|
"keywords": [
|
|
71
75
|
"typescript",
|
|
72
76
|
"contracts",
|
|
73
77
|
"schema",
|
|
74
78
|
"manifest",
|
|
75
79
|
"auth",
|
|
80
|
+
"secrets",
|
|
81
|
+
"secret-store",
|
|
76
82
|
"storage",
|
|
77
83
|
"adapter"
|
|
78
84
|
],
|