@ankhorage/contracts 7.6.0 → 7.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/README.md +1 -1
  3. package/dist/appManifest/deploy.d.ts.map +1 -1
  4. package/dist/appManifest/deploy.js +8 -2
  5. package/dist/appManifest/deploy.js.map +1 -1
  6. package/dist/auth.d.ts +50 -0
  7. package/dist/auth.d.ts.map +1 -1
  8. package/dist/auth.js +7 -0
  9. package/dist/auth.js.map +1 -1
  10. package/dist/deploy.d.ts +13 -0
  11. package/dist/deploy.d.ts.map +1 -1
  12. package/dist/deploy.js +8 -0
  13. package/dist/deploy.js.map +1 -1
  14. package/package.json +1 -1
  15. package/src/appManifest/deploy.ts +9 -2
  16. package/src/auth-oauth-setup.test.ts +68 -0
  17. package/src/auth.ts +65 -0
  18. package/src/deploy.test.ts +56 -3
  19. package/src/deploy.ts +15 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # @ankhorage/contracts
2
2
 
3
+ ## 7.8.0
4
+
5
+ ### Minor Changes
6
+
7
+ - e0358fc: Add neutral setup requirement metadata for target-, environment-, and transport-aware administration planning.
8
+
9
+ ## 7.7.0
10
+
11
+ ### Minor Changes
12
+
13
+ - 00d608f: Add canonical application environment IDs and stable native scheme identity to app deployment target contracts.
14
+
3
15
  ## 7.6.0
4
16
 
5
17
  ### Minor Changes
package/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
 
4
4
  # CONTRACTS
5
5
 
6
- ![license: MIT](././paradox/badges/license.svg) ![npm: v7.5.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
6
+ ![license: MIT](././paradox/badges/license.svg) ![npm: v7.6.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
7
7
 
8
8
  Serializable app, action, theme, auth, and secret-store contracts for Ankhorage.
9
9
 
package/dist/appManifest/deploy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/appManifest/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAUnB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E"}
1
+ {"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/appManifest/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAWnB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E"}
package/dist/appManifest/deploy.js CHANGED
@@ -3,8 +3,9 @@ const DEPLOY_KEYS = new Set(['targets']);
3
3
  const TARGET_KEYS = new Set(['web', 'android', 'ios']);
4
4
  const PROVIDER_KEYS = new Set(['build', 'publish']);
5
5
  const WEB_KEYS = new Set(['enabled', 'providers']);
6
- const ANDROID_KEYS = new Set(['enabled', 'package', 'providers']);
7
- const IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'providers']);
6
+ const ANDROID_KEYS = new Set(['enabled', 'package', 'scheme', 'providers']);
7
+ const IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'scheme', 'providers']);
8
+ const URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
8
9
  export function isAppDeployManifest(value) {
9
10
  return isRecord(value) && hasOnlyKeys(value, DEPLOY_KEYS) && isAppDeployTargets(value.targets);
10
11
  }
@@ -26,6 +27,7 @@ function isAndroidTarget(value) {
26
27
  hasOnlyKeys(value, ANDROID_KEYS) &&
27
28
  typeof value.enabled === 'boolean' &&
28
29
  isNonEmptyString(value.package) &&
30
+ isOptionalScheme(value.scheme) &&
29
31
  isOptionalProviders(value.providers));
30
32
  }
31
33
  function isIosTarget(value) {
@@ -33,8 +35,12 @@ function isIosTarget(value) {
33
35
  hasOnlyKeys(value, IOS_KEYS) &&
34
36
  typeof value.enabled === 'boolean' &&
35
37
  isNonEmptyString(value.bundleIdentifier) &&
38
+ isOptionalScheme(value.scheme) &&
36
39
  isOptionalProviders(value.providers));
37
40
  }
41
+ function isOptionalScheme(value) {
42
+ return value === undefined || (typeof value === 'string' && URI_SCHEME_PATTERN.test(value));
43
+ }
38
44
  function isOptionalProviders(value) {
39
45
  return value === undefined || isProviderSelection(value);
40
46
  }
package/dist/appManifest/deploy.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/appManifest/deploy.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;QAC/B,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACxC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC;QACjC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA4B;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import type {\n AppDeployAndroidTargetConfig,\n AppDeployIosTargetConfig,\n AppDeployManifest,\n AppDeployProviderSelection,\n AppDeployTargets,\n AppDeployWebTargetConfig,\n} from '../deploy';\nimport { isRecord } from './shared';\n\nconst DEPLOY_KEYS = new Set(['targets']);\nconst TARGET_KEYS = new Set(['web', 'android', 'ios']);\nconst PROVIDER_KEYS = new Set(['build', 'publish']);\nconst WEB_KEYS = new Set(['enabled', 'providers']);\nconst ANDROID_KEYS = new Set(['enabled', 'package', 'providers']);\nconst IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'providers']);\n\nexport function isAppDeployManifest(value: unknown): value is AppDeployManifest {\n return isRecord(value) && hasOnlyKeys(value, DEPLOY_KEYS) && isAppDeployTargets(value.targets);\n}\n\nfunction isAppDeployTargets(value: unknown): value is AppDeployTargets {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, TARGET_KEYS) &&\n (value.web === undefined || isWebTarget(value.web)) &&\n (value.android === undefined || isAndroidTarget(value.android)) &&\n (value.ios === undefined || isIosTarget(value.ios))\n );\n}\n\nfunction isWebTarget(value: unknown): value is AppDeployWebTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, WEB_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isAndroidTarget(value: unknown): value is AppDeployAndroidTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, ANDROID_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isNonEmptyString(value.package) &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isIosTarget(value: unknown): value is AppDeployIosTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, IOS_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isNonEmptyString(value.bundleIdentifier) &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isOptionalProviders(value: unknown): value is AppDeployProviderSelection | undefined {\n return value === undefined || isProviderSelection(value);\n}\n\nfunction isProviderSelection(value: unknown): value is AppDeployProviderSelection {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, PROVIDER_KEYS) &&\n (value.build === undefined || isNonEmptyString(value.build)) &&\n (value.publish === undefined || isNonEmptyString(value.publish))\n );\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n return typeof value === 'string' && value.trim().length > 0;\n}\n\nfunction hasOnlyKeys(value: Record<string, unknown>, allowed: ReadonlySet<string>): boolean {\n return Object.keys(value).every((key) => allowed.has(key));\n}\n"]}
1
+ {"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/appManifest/deploy.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AACjF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;QAC/B,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAClC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACxC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC;QACjC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA4B;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import type {\n AppDeployAndroidTargetConfig,\n AppDeployIosTargetConfig,\n AppDeployManifest,\n AppDeployProviderSelection,\n AppDeployTargets,\n AppDeployWebTargetConfig,\n} from '../deploy';\nimport { isRecord } from './shared';\n\nconst DEPLOY_KEYS = new Set(['targets']);\nconst TARGET_KEYS = new Set(['web', 'android', 'ios']);\nconst PROVIDER_KEYS = new Set(['build', 'publish']);\nconst WEB_KEYS = new Set(['enabled', 'providers']);\nconst ANDROID_KEYS = new Set(['enabled', 'package', 'scheme', 'providers']);\nconst IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'scheme', 'providers']);\nconst URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*$/u;\n\nexport function isAppDeployManifest(value: unknown): value is AppDeployManifest {\n return isRecord(value) && hasOnlyKeys(value, DEPLOY_KEYS) && isAppDeployTargets(value.targets);\n}\n\nfunction isAppDeployTargets(value: unknown): value is AppDeployTargets {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, TARGET_KEYS) &&\n (value.web === undefined || isWebTarget(value.web)) &&\n (value.android === undefined || isAndroidTarget(value.android)) &&\n (value.ios === undefined || isIosTarget(value.ios))\n );\n}\n\nfunction isWebTarget(value: unknown): value is AppDeployWebTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, WEB_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isAndroidTarget(value: unknown): value is AppDeployAndroidTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, ANDROID_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isNonEmptyString(value.package) &&\n isOptionalScheme(value.scheme) &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isIosTarget(value: unknown): value is AppDeployIosTargetConfig {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, IOS_KEYS) &&\n typeof value.enabled === 'boolean' &&\n isNonEmptyString(value.bundleIdentifier) &&\n isOptionalScheme(value.scheme) &&\n isOptionalProviders(value.providers)\n );\n}\n\nfunction isOptionalScheme(value: unknown): value is string | undefined {\n return value === undefined || (typeof value === 'string' && URI_SCHEME_PATTERN.test(value));\n}\n\nfunction isOptionalProviders(value: unknown): value is AppDeployProviderSelection | undefined {\n return value === undefined || isProviderSelection(value);\n}\n\nfunction isProviderSelection(value: unknown): value is AppDeployProviderSelection {\n return (\n isRecord(value) &&\n hasOnlyKeys(value, PROVIDER_KEYS) &&\n (value.build === undefined || isNonEmptyString(value.build)) &&\n (value.publish === undefined || isNonEmptyString(value.publish))\n );\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n return typeof value === 'string' && value.trim().length > 0;\n}\n\nfunction hasOnlyKeys(value: Record<string, unknown>, allowed: ReadonlySet<string>): boolean {\n return Object.keys(value).every((key) => allowed.has(key));\n}\n"]}
package/dist/auth.d.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
  export declare const AUTH_IDENTIFIER_KINDS: readonly ["email", "phone", "username"];
@@ -8,6 +9,55 @@ export type AuthSignUpField = KnownAuthSignUpField | (string & {});
8
9
  export declare const AUTH_OAUTH_PROVIDER_IDS: readonly ["apple", "azure", "bitbucket", "discord", "facebook", "figma", "github", "gitlab", "google", "kakao", "keycloak", "linkedin", "notion", "slack", "spotify", "twitch", "twitter", "workos", "zoom"];
9
10
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
10
11
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
12
+ export declare const AUTH_OAUTH_TRANSPORT_IDS: readonly ["brokeredRedirect"];
13
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
14
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
15
+ export declare const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS: readonly ["trustedCredential", "publicConfig"];
16
+ export type AuthOAuthSetupFieldPersistence = (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
17
+ export declare const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES: readonly ["public", "secret"];
18
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
19
+ export declare const AUTH_OAUTH_SETUP_CALLBACK_ROLES: readonly ["provider", "app"];
20
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
21
+ export interface AuthOAuthSetupFieldRequirement {
22
+ readonly kind: 'field';
23
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
24
+ readonly key: string;
25
+ readonly label: string;
26
+ readonly required: boolean;
27
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
28
+ readonly persistence: AuthOAuthSetupFieldPersistence;
29
+ /** Present only when a field belongs to one application target rather than the backend setup. */
30
+ readonly target?: AppDeployTargetId;
31
+ readonly description?: string;
32
+ }
33
+ export interface AuthOAuthSetupCallbackRequirement {
34
+ readonly kind: 'callback';
35
+ readonly role: AuthOAuthSetupCallbackRole;
36
+ readonly label: string;
37
+ readonly required: boolean;
38
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
39
+ readonly target?: AppDeployTargetId;
40
+ readonly description?: string;
41
+ }
42
+ export type AuthOAuthSetupRequirement = AuthOAuthSetupFieldRequirement | AuthOAuthSetupCallbackRequirement;
43
+ /**
44
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
45
+ * provider/transport/environment combination. It contains requirements only, never credential
46
+ * values, tokens, callback authorization data, or other secret material.
47
+ */
48
+ export interface AuthOAuthSetupPlan {
49
+ readonly provider: AuthOAuthProviderId;
50
+ readonly transport: AuthOAuthTransportId;
51
+ readonly environment: AppDeployEnvironmentId;
52
+ /** Enabled application targets considered while deriving this plan. */
53
+ readonly targets: readonly AppDeployTargetId[];
54
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
55
+ }
56
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
57
+ export interface AuthOAuthSetupCapabilities {
58
+ readonly providers: readonly AuthOAuthProviderId[];
59
+ readonly transports: readonly AuthOAuthTransportId[];
60
+ }
11
61
  export interface AuthIdentifier {
12
62
  kind: AuthIdentifierKind;
13
63
  value: string;
package/dist/auth.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,eAAO,MAAM,wBAAwB,+BAAgC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE7E,eAAO,MAAM,wCAAwC,gDAG3C,CAAC;AACX,MAAM,MAAM,8BAA8B,GACxC,CAAC,OAAO,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,oCAAoC,+BAAgC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnG,eAAO,MAAM,+BAA+B,8BAA+B,CAAC;AAC5E,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1F,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,iCAAiC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC7D;AAED,qGAAqG;AACrG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
package/dist/auth.js CHANGED
@@ -27,6 +27,13 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
27
27
  'workos',
28
28
  'zoom',
29
29
  ];
30
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'];
31
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
32
+ 'trustedCredential',
33
+ 'publicConfig',
34
+ ];
35
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'];
36
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'];
30
37
  export const DEFAULT_AUTH_FLOW = {
31
38
  signInRoute: 'sign-in',
32
39
  signUpRoute: 'sign-up',
package/dist/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAmBX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
1
+ {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAItE,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,mBAAmB;IACnB,cAAc;CACN,CAAC;AAIX,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGlF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAC;AAiE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';\nimport type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;\nexport type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];\nexport type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});\n\nexport const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [\n 'trustedCredential',\n 'publicConfig',\n] as const;\nexport type AuthOAuthSetupFieldPersistence =\n (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];\n\nexport const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;\nexport type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];\n\nexport const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;\nexport type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];\n\nexport interface AuthOAuthSetupFieldRequirement {\n readonly kind: 'field';\n /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */\n readonly key: string;\n readonly label: string;\n readonly required: boolean;\n readonly sensitivity: AuthOAuthSetupFieldSensitivity;\n readonly persistence: AuthOAuthSetupFieldPersistence;\n /** Present only when a field belongs to one application target rather than the backend setup. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport interface AuthOAuthSetupCallbackRequirement {\n readonly kind: 'callback';\n readonly role: AuthOAuthSetupCallbackRole;\n readonly label: string;\n readonly required: boolean;\n /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport type AuthOAuthSetupRequirement =\n | AuthOAuthSetupFieldRequirement\n | AuthOAuthSetupCallbackRequirement;\n\n/**\n * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one\n * provider/transport/environment combination. It contains requirements only, never credential\n * values, tokens, callback authorization data, or other secret material.\n */\nexport interface AuthOAuthSetupPlan {\n readonly provider: AuthOAuthProviderId;\n readonly transport: AuthOAuthTransportId;\n readonly environment: AppDeployEnvironmentId;\n /** Enabled application targets considered while deriving this plan. */\n readonly targets: readonly AppDeployTargetId[];\n readonly requirements: readonly AuthOAuthSetupRequirement[];\n}\n\n/** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */\nexport interface AuthOAuthSetupCapabilities {\n readonly providers: readonly AuthOAuthProviderId[];\n readonly transports: readonly AuthOAuthTransportId[];\n}\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
package/dist/deploy.d.ts CHANGED
@@ -1,5 +1,14 @@
1
1
  export declare const APP_DEPLOY_TARGET_IDS: readonly ["web", "android", "ios"];
2
2
  export type AppDeployTargetId = (typeof APP_DEPLOY_TARGET_IDS)[number];
3
+ /**
4
+ * Logical application environments shared across platform-specific planning.
5
+ *
6
+ * `local` maps to local Web, iOS development, and Android debug execution.
7
+ * Environment-specific endpoints, signing material, and credentials are owned
8
+ * by their dedicated deployment/infra configuration rather than this identity contract.
9
+ */
10
+ export declare const APP_DEPLOY_ENVIRONMENT_IDS: readonly ["local", "preview", "production"];
11
+ export type AppDeployEnvironmentId = (typeof APP_DEPLOY_ENVIRONMENT_IDS)[number];
3
12
  export interface AppDeployProviderSelection {
4
13
  readonly build?: string;
5
14
  readonly publish?: string;
@@ -11,11 +20,15 @@ export interface AppDeployWebTargetConfig {
11
20
  export interface AppDeployAndroidTargetConfig {
12
21
  readonly enabled: boolean;
13
22
  readonly package: string;
23
+ /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */
24
+ readonly scheme?: string;
14
25
  readonly providers?: AppDeployProviderSelection;
15
26
  }
16
27
  export interface AppDeployIosTargetConfig {
17
28
  readonly enabled: boolean;
18
29
  readonly bundleIdentifier: string;
30
+ /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */
31
+ readonly scheme?: string;
19
32
  readonly providers?: AppDeployProviderSelection;
20
33
  }
21
34
  export interface AppDeployTargets {
package/dist/deploy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,oCAAqC,CAAC;AAExE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC"}
1
+ {"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,oCAAqC,CAAC;AAExE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,6CAA8C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC"}
package/dist/deploy.js CHANGED
@@ -1,3 +1,11 @@
1
1
  export const APP_DEPLOY_TARGET_IDS = ['web', 'android', 'ios'];
2
+ /**
3
+ * Logical application environments shared across platform-specific planning.
4
+ *
5
+ * `local` maps to local Web, iOS development, and Android debug execution.
6
+ * Environment-specific endpoints, signing material, and credentials are owned
7
+ * by their dedicated deployment/infra configuration rather than this identity contract.
8
+ */
9
+ export const APP_DEPLOY_ENVIRONMENT_IDS = ['local', 'preview', 'production'];
2
10
  export { isAppDeployManifest } from './appManifest/deploy';
3
11
  //# sourceMappingURL=deploy.js.map
package/dist/deploy.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAoCxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC","sourcesContent":["export const APP_DEPLOY_TARGET_IDS = ['web', 'android', 'ios'] as const;\n\nexport type AppDeployTargetId = (typeof APP_DEPLOY_TARGET_IDS)[number];\n\nexport interface AppDeployProviderSelection {\n readonly build?: string;\n readonly publish?: string;\n}\n\nexport interface AppDeployWebTargetConfig {\n readonly enabled: boolean;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployAndroidTargetConfig {\n readonly enabled: boolean;\n readonly package: string;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployIosTargetConfig {\n readonly enabled: boolean;\n readonly bundleIdentifier: string;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployTargets {\n readonly web?: AppDeployWebTargetConfig;\n readonly android?: AppDeployAndroidTargetConfig;\n readonly ios?: AppDeployIosTargetConfig;\n}\n\nexport interface AppDeployManifest {\n readonly targets: AppDeployTargets;\n}\n\nexport { isAppDeployManifest } from './appManifest/deploy';\n"]}
1
+ {"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAIxE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAwCtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC","sourcesContent":["export const APP_DEPLOY_TARGET_IDS = ['web', 'android', 'ios'] as const;\n\nexport type AppDeployTargetId = (typeof APP_DEPLOY_TARGET_IDS)[number];\n\n/**\n * Logical application environments shared across platform-specific planning.\n *\n * `local` maps to local Web, iOS development, and Android debug execution.\n * Environment-specific endpoints, signing material, and credentials are owned\n * by their dedicated deployment/infra configuration rather than this identity contract.\n */\nexport const APP_DEPLOY_ENVIRONMENT_IDS = ['local', 'preview', 'production'] as const;\n\nexport type AppDeployEnvironmentId = (typeof APP_DEPLOY_ENVIRONMENT_IDS)[number];\n\nexport interface AppDeployProviderSelection {\n readonly build?: string;\n readonly publish?: string;\n}\n\nexport interface AppDeployWebTargetConfig {\n readonly enabled: boolean;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployAndroidTargetConfig {\n readonly enabled: boolean;\n readonly package: string;\n /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */\n readonly scheme?: string;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployIosTargetConfig {\n readonly enabled: boolean;\n readonly bundleIdentifier: string;\n /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */\n readonly scheme?: string;\n readonly providers?: AppDeployProviderSelection;\n}\n\nexport interface AppDeployTargets {\n readonly web?: AppDeployWebTargetConfig;\n readonly android?: AppDeployAndroidTargetConfig;\n readonly ios?: AppDeployIosTargetConfig;\n}\n\nexport interface AppDeployManifest {\n readonly targets: AppDeployTargets;\n}\n\nexport { isAppDeployManifest } from './appManifest/deploy';\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ankhorage/contracts",
3
- "version": "7.6.0",
3
+ "version": "7.8.0",
4
4
  "main": "./dist/index.js",
5
5
  "ankh": {
6
6
  "category": "contracts",
package/src/appManifest/deploy.ts CHANGED
@@ -12,8 +12,9 @@ const DEPLOY_KEYS = new Set(['targets']);
12
12
  const TARGET_KEYS = new Set(['web', 'android', 'ios']);
13
13
  const PROVIDER_KEYS = new Set(['build', 'publish']);
14
14
  const WEB_KEYS = new Set(['enabled', 'providers']);
15
- const ANDROID_KEYS = new Set(['enabled', 'package', 'providers']);
16
- const IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'providers']);
15
+ const ANDROID_KEYS = new Set(['enabled', 'package', 'scheme', 'providers']);
16
+ const IOS_KEYS = new Set(['enabled', 'bundleIdentifier', 'scheme', 'providers']);
17
+ const URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
17
18
 
18
19
  export function isAppDeployManifest(value: unknown): value is AppDeployManifest {
19
20
  return isRecord(value) && hasOnlyKeys(value, DEPLOY_KEYS) && isAppDeployTargets(value.targets);
@@ -44,6 +45,7 @@ function isAndroidTarget(value: unknown): value is AppDeployAndroidTargetConfig
44
45
  hasOnlyKeys(value, ANDROID_KEYS) &&
45
46
  typeof value.enabled === 'boolean' &&
46
47
  isNonEmptyString(value.package) &&
48
+ isOptionalScheme(value.scheme) &&
47
49
  isOptionalProviders(value.providers)
48
50
  );
49
51
  }
@@ -54,10 +56,15 @@ function isIosTarget(value: unknown): value is AppDeployIosTargetConfig {
54
56
  hasOnlyKeys(value, IOS_KEYS) &&
55
57
  typeof value.enabled === 'boolean' &&
56
58
  isNonEmptyString(value.bundleIdentifier) &&
59
+ isOptionalScheme(value.scheme) &&
57
60
  isOptionalProviders(value.providers)
58
61
  );
59
62
  }
60
63
 
64
+ function isOptionalScheme(value: unknown): value is string | undefined {
65
+ return value === undefined || (typeof value === 'string' && URI_SCHEME_PATTERN.test(value));
66
+ }
67
+
61
68
  function isOptionalProviders(value: unknown): value is AppDeployProviderSelection | undefined {
62
69
  return value === undefined || isProviderSelection(value);
63
70
  }
package/src/auth-oauth-setup.test.ts ADDED
@@ -0,0 +1,68 @@
1
+ import { describe, expect, it } from 'bun:test';
2
+
3
+ import {
4
+ AUTH_OAUTH_SETUP_CALLBACK_ROLES,
5
+ AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS,
6
+ AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES,
7
+ AUTH_OAUTH_TRANSPORT_IDS,
8
+ type AuthOAuthSetupPlan,
9
+ type AuthOAuthTransportId,
10
+ } from './auth';
11
+
12
+ describe('OAuth setup requirement contracts', () => {
13
+ it('models target and environment aware requirements without credential values', () => {
14
+ const plan: AuthOAuthSetupPlan = {
15
+ provider: 'google',
16
+ transport: 'brokeredRedirect',
17
+ environment: 'local',
18
+ targets: ['web', 'ios', 'android'],
19
+ requirements: [
20
+ {
21
+ kind: 'field',
22
+ key: 'webClientId',
23
+ label: 'Web Client ID',
24
+ required: true,
25
+ sensitivity: 'public',
26
+ persistence: 'trustedCredential',
27
+ },
28
+ {
29
+ kind: 'field',
30
+ key: 'webClientSecret',
31
+ label: 'Web Client Secret',
32
+ required: true,
33
+ sensitivity: 'secret',
34
+ persistence: 'trustedCredential',
35
+ },
36
+ {
37
+ kind: 'callback',
38
+ role: 'provider',
39
+ label: 'Provider callback URI',
40
+ required: true,
41
+ },
42
+ {
43
+ kind: 'callback',
44
+ role: 'app',
45
+ target: 'ios',
46
+ label: 'iOS app callback',
47
+ required: true,
48
+ },
49
+ ],
50
+ };
51
+
52
+ expect(AUTH_OAUTH_TRANSPORT_IDS).toEqual(['brokeredRedirect']);
53
+ expect(AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS).toEqual(['trustedCredential', 'publicConfig']);
54
+ expect(AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES).toEqual(['public', 'secret']);
55
+ expect(AUTH_OAUTH_SETUP_CALLBACK_ROLES).toEqual(['provider', 'app']);
56
+ expect(plan.environment).toBe('local');
57
+ expect(plan.targets).toEqual(['web', 'ios', 'android']);
58
+ expect(plan.requirements.filter((requirement) => requirement.kind === 'field')).toHaveLength(2);
59
+ expect(JSON.stringify(plan)).not.toContain('credentialValue');
60
+ });
61
+
62
+ it('keeps transport identifiers extensible for later native capabilities', () => {
63
+ const futureTransport: AuthOAuthTransportId = 'nativeIdToken';
64
+
65
+ expect(futureTransport).toBe('nativeIdToken');
66
+ expect(AUTH_OAUTH_TRANSPORT_IDS).not.toContain(futureTransport);
67
+ });
68
+ });
package/src/auth.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
 
@@ -38,6 +39,70 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
38
39
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
39
40
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
40
41
 
42
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;
43
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
44
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
45
+
46
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
47
+ 'trustedCredential',
48
+ 'publicConfig',
49
+ ] as const;
50
+ export type AuthOAuthSetupFieldPersistence =
51
+ (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
52
+
53
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;
54
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
55
+
56
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;
57
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
58
+
59
+ export interface AuthOAuthSetupFieldRequirement {
60
+ readonly kind: 'field';
61
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
62
+ readonly key: string;
63
+ readonly label: string;
64
+ readonly required: boolean;
65
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
66
+ readonly persistence: AuthOAuthSetupFieldPersistence;
67
+ /** Present only when a field belongs to one application target rather than the backend setup. */
68
+ readonly target?: AppDeployTargetId;
69
+ readonly description?: string;
70
+ }
71
+
72
+ export interface AuthOAuthSetupCallbackRequirement {
73
+ readonly kind: 'callback';
74
+ readonly role: AuthOAuthSetupCallbackRole;
75
+ readonly label: string;
76
+ readonly required: boolean;
77
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
78
+ readonly target?: AppDeployTargetId;
79
+ readonly description?: string;
80
+ }
81
+
82
+ export type AuthOAuthSetupRequirement =
83
+ | AuthOAuthSetupFieldRequirement
84
+ | AuthOAuthSetupCallbackRequirement;
85
+
86
+ /**
87
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
88
+ * provider/transport/environment combination. It contains requirements only, never credential
89
+ * values, tokens, callback authorization data, or other secret material.
90
+ */
91
+ export interface AuthOAuthSetupPlan {
92
+ readonly provider: AuthOAuthProviderId;
93
+ readonly transport: AuthOAuthTransportId;
94
+ readonly environment: AppDeployEnvironmentId;
95
+ /** Enabled application targets considered while deriving this plan. */
96
+ readonly targets: readonly AppDeployTargetId[];
97
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
98
+ }
99
+
100
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
101
+ export interface AuthOAuthSetupCapabilities {
102
+ readonly providers: readonly AuthOAuthProviderId[];
103
+ readonly transports: readonly AuthOAuthTransportId[];
104
+ }
105
+
41
106
  export interface AuthIdentifier {
42
107
  kind: AuthIdentifierKind;
43
108
  value: string;
package/src/deploy.test.ts CHANGED
@@ -4,7 +4,7 @@ import { join } from 'node:path';
4
4
  import { describe, expect, it } from 'bun:test';
5
5
 
6
6
  import { isAppManifest } from './appManifest';
7
- import { APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from './deploy';
7
+ import { APP_DEPLOY_ENVIRONMENT_IDS, APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from './deploy';
8
8
  import { DEPLOYMENT_TARGETS } from './types';
9
9
 
10
10
  function createManifest(deploy?: unknown): Record<string, unknown> {
@@ -39,18 +39,24 @@ describe('app deployment contracts', () => {
39
39
  expect(DEPLOYMENT_TARGETS).toEqual(['minikube']);
40
40
  });
41
41
 
42
- it('accepts canonical web, Android, and iOS desired state', () => {
42
+ it('defines one logical environment vocabulary across platform-specific execution', () => {
43
+ expect(APP_DEPLOY_ENVIRONMENT_IDS).toEqual(['local', 'preview', 'production']);
44
+ });
45
+
46
+ it('accepts canonical web, Android, and iOS desired state with stable native schemes', () => {
43
47
  const deploy = {
44
48
  targets: {
45
49
  web: { enabled: true, providers: { publish: 'eas' } },
46
50
  android: {
47
51
  enabled: true,
48
52
  package: 'com.example.app',
53
+ scheme: 'example-app',
49
54
  providers: { build: 'eas', publish: 'google-play' },
50
55
  },
51
56
  ios: {
52
57
  enabled: false,
53
58
  bundleIdentifier: 'com.example.app',
59
+ scheme: 'example-app',
54
60
  providers: { build: 'eas', publish: 'app-store-connect' },
55
61
  },
56
62
  },
@@ -60,6 +66,40 @@ describe('app deployment contracts', () => {
60
66
  expect(isAppManifest(createManifest(deploy))).toBe(true);
61
67
  });
62
68
 
69
+ it('keeps native schemes optional for existing deployment manifests', () => {
70
+ expect(
71
+ isAppDeployManifest({
72
+ targets: {
73
+ android: { enabled: true, package: 'com.example.app' },
74
+ ios: { enabled: true, bundleIdentifier: 'com.example.app' },
75
+ },
76
+ }),
77
+ ).toBe(true);
78
+ });
79
+
80
+ it('accepts every supported platform combination', () => {
81
+ const web = { enabled: true };
82
+ const android = { enabled: true, package: 'com.example.app', scheme: 'example-app' };
83
+ const ios = {
84
+ enabled: true,
85
+ bundleIdentifier: 'com.example.app',
86
+ scheme: 'example-app',
87
+ };
88
+ const combinations = [
89
+ { web },
90
+ { android },
91
+ { ios },
92
+ { web, android },
93
+ { web, ios },
94
+ { android, ios },
95
+ { web, android, ios },
96
+ ];
97
+
98
+ for (const targets of combinations) {
99
+ expect(isAppDeployManifest({ targets })).toBe(true);
100
+ }
101
+ });
102
+
63
103
  it('keeps deployment optional and accepts an empty target registry structurally', () => {
64
104
  expect(isAppManifest(createManifest())).toBe(true);
65
105
  expect(isAppDeployManifest({ targets: {} })).toBe(true);
@@ -86,7 +126,14 @@ describe('app deployment contracts', () => {
86
126
  { targets: { desktop: { enabled: true } } },
87
127
  { targets: { web: { enabled: 'yes' } } },
88
128
  { targets: { android: { enabled: true, package: '' } } },
129
+ { targets: { android: { enabled: true, package: 'com.example.app', scheme: '' } } },
130
+ { targets: { android: { enabled: true, package: 'com.example.app', scheme: '9app' } } },
89
131
  { targets: { ios: { enabled: true, bundleIdentifier: ' ' } } },
132
+ {
133
+ targets: {
134
+ ios: { enabled: true, bundleIdentifier: 'com.example.app', scheme: 'bad scheme' },
135
+ },
136
+ },
90
137
  { targets: { web: { enabled: true, providers: { publish: '' } } } },
91
138
  { targets: { web: { enabled: true, providerConfig: { region: 'eu' } } } },
92
139
  { targets: { web: { enabled: true, credentials: { token: 'secret' } } } },
@@ -102,7 +149,13 @@ describe('app deployment contracts', () => {
102
149
  expect(
103
150
  isAppManifest(
104
151
  createManifest({
105
- targets: { android: { enabled: true, package: 'com.example.app', credentials: {} } },
152
+ targets: {
153
+ android: {
154
+ enabled: true,
155
+ package: 'com.example.app',
156
+ credentials: {},
157
+ },
158
+ },
106
159
  }),
107
160
  ),
108
161
  ).toBe(false);
package/src/deploy.ts CHANGED
@@ -2,6 +2,17 @@ export const APP_DEPLOY_TARGET_IDS = ['web', 'android', 'ios'] as const;
2
2
 
3
3
  export type AppDeployTargetId = (typeof APP_DEPLOY_TARGET_IDS)[number];
4
4
 
5
+ /**
6
+ * Logical application environments shared across platform-specific planning.
7
+ *
8
+ * `local` maps to local Web, iOS development, and Android debug execution.
9
+ * Environment-specific endpoints, signing material, and credentials are owned
10
+ * by their dedicated deployment/infra configuration rather than this identity contract.
11
+ */
12
+ export const APP_DEPLOY_ENVIRONMENT_IDS = ['local', 'preview', 'production'] as const;
13
+
14
+ export type AppDeployEnvironmentId = (typeof APP_DEPLOY_ENVIRONMENT_IDS)[number];
15
+
5
16
  export interface AppDeployProviderSelection {
6
17
  readonly build?: string;
7
18
  readonly publish?: string;
@@ -15,12 +26,16 @@ export interface AppDeployWebTargetConfig {
15
26
  export interface AppDeployAndroidTargetConfig {
16
27
  readonly enabled: boolean;
17
28
  readonly package: string;
29
+ /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */
30
+ readonly scheme?: string;
18
31
  readonly providers?: AppDeployProviderSelection;
19
32
  }
20
33
 
21
34
  export interface AppDeployIosTargetConfig {
22
35
  readonly enabled: boolean;
23
36
  readonly bundleIdentifier: string;
37
+ /** Stable application URI scheme used for target-aware deep links such as OAuth callbacks. */
38
+ readonly scheme?: string;
24
39
  readonly providers?: AppDeployProviderSelection;
25
40
  }
26
41