@ankhorage/contracts 7.7.0 → 7.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/dist/auth.d.ts +50 -0
  3. package/dist/auth.d.ts.map +1 -1
  4. package/dist/auth.js +7 -0
  5. package/dist/auth.js.map +1 -1
  6. package/package.json +1 -1
  7. package/src/auth-oauth-setup.test.ts +68 -0
  8. package/src/auth.ts +65 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # @ankhorage/contracts
2
2
 
3
+ ## 7.8.0
4
+
5
+ ### Minor Changes
6
+
7
+ - e0358fc: Add neutral setup requirement metadata for target-, environment-, and transport-aware administration planning.
8
+
3
9
  ## 7.7.0
4
10
 
5
11
  ### Minor Changes
package/dist/auth.d.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
  export declare const AUTH_IDENTIFIER_KINDS: readonly ["email", "phone", "username"];
@@ -8,6 +9,55 @@ export type AuthSignUpField = KnownAuthSignUpField | (string & {});
8
9
  export declare const AUTH_OAUTH_PROVIDER_IDS: readonly ["apple", "azure", "bitbucket", "discord", "facebook", "figma", "github", "gitlab", "google", "kakao", "keycloak", "linkedin", "notion", "slack", "spotify", "twitch", "twitter", "workos", "zoom"];
9
10
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
10
11
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
12
+ export declare const AUTH_OAUTH_TRANSPORT_IDS: readonly ["brokeredRedirect"];
13
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
14
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
15
+ export declare const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS: readonly ["trustedCredential", "publicConfig"];
16
+ export type AuthOAuthSetupFieldPersistence = (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
17
+ export declare const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES: readonly ["public", "secret"];
18
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
19
+ export declare const AUTH_OAUTH_SETUP_CALLBACK_ROLES: readonly ["provider", "app"];
20
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
21
+ export interface AuthOAuthSetupFieldRequirement {
22
+ readonly kind: 'field';
23
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
24
+ readonly key: string;
25
+ readonly label: string;
26
+ readonly required: boolean;
27
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
28
+ readonly persistence: AuthOAuthSetupFieldPersistence;
29
+ /** Present only when a field belongs to one application target rather than the backend setup. */
30
+ readonly target?: AppDeployTargetId;
31
+ readonly description?: string;
32
+ }
33
+ export interface AuthOAuthSetupCallbackRequirement {
34
+ readonly kind: 'callback';
35
+ readonly role: AuthOAuthSetupCallbackRole;
36
+ readonly label: string;
37
+ readonly required: boolean;
38
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
39
+ readonly target?: AppDeployTargetId;
40
+ readonly description?: string;
41
+ }
42
+ export type AuthOAuthSetupRequirement = AuthOAuthSetupFieldRequirement | AuthOAuthSetupCallbackRequirement;
43
+ /**
44
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
45
+ * provider/transport/environment combination. It contains requirements only, never credential
46
+ * values, tokens, callback authorization data, or other secret material.
47
+ */
48
+ export interface AuthOAuthSetupPlan {
49
+ readonly provider: AuthOAuthProviderId;
50
+ readonly transport: AuthOAuthTransportId;
51
+ readonly environment: AppDeployEnvironmentId;
52
+ /** Enabled application targets considered while deriving this plan. */
53
+ readonly targets: readonly AppDeployTargetId[];
54
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
55
+ }
56
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
57
+ export interface AuthOAuthSetupCapabilities {
58
+ readonly providers: readonly AuthOAuthProviderId[];
59
+ readonly transports: readonly AuthOAuthTransportId[];
60
+ }
11
61
  export interface AuthIdentifier {
12
62
  kind: AuthIdentifierKind;
13
63
  value: string;
package/dist/auth.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,eAAO,MAAM,wBAAwB,+BAAgC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE7E,eAAO,MAAM,wCAAwC,gDAG3C,CAAC;AACX,MAAM,MAAM,8BAA8B,GACxC,CAAC,OAAO,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,oCAAoC,+BAAgC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnG,eAAO,MAAM,+BAA+B,8BAA+B,CAAC;AAC5E,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1F,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,iCAAiC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC7D;AAED,qGAAqG;AACrG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
package/dist/auth.js CHANGED
@@ -27,6 +27,13 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
27
27
  'workos',
28
28
  'zoom',
29
29
  ];
30
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'];
31
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
32
+ 'trustedCredential',
33
+ 'publicConfig',
34
+ ];
35
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'];
36
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'];
30
37
  export const DEFAULT_AUTH_FLOW = {
31
38
  signInRoute: 'sign-in',
32
39
  signUpRoute: 'sign-up',
package/dist/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAmBX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
1
+ {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAItE,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,mBAAmB;IACnB,cAAc;CACN,CAAC;AAIX,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGlF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAC;AAiE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';\nimport type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;\nexport type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];\nexport type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});\n\nexport const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [\n 'trustedCredential',\n 'publicConfig',\n] as const;\nexport type AuthOAuthSetupFieldPersistence =\n (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];\n\nexport const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;\nexport type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];\n\nexport const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;\nexport type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];\n\nexport interface AuthOAuthSetupFieldRequirement {\n readonly kind: 'field';\n /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */\n readonly key: string;\n readonly label: string;\n readonly required: boolean;\n readonly sensitivity: AuthOAuthSetupFieldSensitivity;\n readonly persistence: AuthOAuthSetupFieldPersistence;\n /** Present only when a field belongs to one application target rather than the backend setup. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport interface AuthOAuthSetupCallbackRequirement {\n readonly kind: 'callback';\n readonly role: AuthOAuthSetupCallbackRole;\n readonly label: string;\n readonly required: boolean;\n /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport type AuthOAuthSetupRequirement =\n | AuthOAuthSetupFieldRequirement\n | AuthOAuthSetupCallbackRequirement;\n\n/**\n * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one\n * provider/transport/environment combination. It contains requirements only, never credential\n * values, tokens, callback authorization data, or other secret material.\n */\nexport interface AuthOAuthSetupPlan {\n readonly provider: AuthOAuthProviderId;\n readonly transport: AuthOAuthTransportId;\n readonly environment: AppDeployEnvironmentId;\n /** Enabled application targets considered while deriving this plan. */\n readonly targets: readonly AppDeployTargetId[];\n readonly requirements: readonly AuthOAuthSetupRequirement[];\n}\n\n/** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */\nexport interface AuthOAuthSetupCapabilities {\n readonly providers: readonly AuthOAuthProviderId[];\n readonly transports: readonly AuthOAuthTransportId[];\n}\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ankhorage/contracts",
3
- "version": "7.7.0",
3
+ "version": "7.8.0",
4
4
  "main": "./dist/index.js",
5
5
  "ankh": {
6
6
  "category": "contracts",
package/src/auth-oauth-setup.test.ts ADDED
@@ -0,0 +1,68 @@
1
+ import { describe, expect, it } from 'bun:test';
2
+
3
+ import {
4
+ AUTH_OAUTH_SETUP_CALLBACK_ROLES,
5
+ AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS,
6
+ AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES,
7
+ AUTH_OAUTH_TRANSPORT_IDS,
8
+ type AuthOAuthSetupPlan,
9
+ type AuthOAuthTransportId,
10
+ } from './auth';
11
+
12
+ describe('OAuth setup requirement contracts', () => {
13
+ it('models target and environment aware requirements without credential values', () => {
14
+ const plan: AuthOAuthSetupPlan = {
15
+ provider: 'google',
16
+ transport: 'brokeredRedirect',
17
+ environment: 'local',
18
+ targets: ['web', 'ios', 'android'],
19
+ requirements: [
20
+ {
21
+ kind: 'field',
22
+ key: 'webClientId',
23
+ label: 'Web Client ID',
24
+ required: true,
25
+ sensitivity: 'public',
26
+ persistence: 'trustedCredential',
27
+ },
28
+ {
29
+ kind: 'field',
30
+ key: 'webClientSecret',
31
+ label: 'Web Client Secret',
32
+ required: true,
33
+ sensitivity: 'secret',
34
+ persistence: 'trustedCredential',
35
+ },
36
+ {
37
+ kind: 'callback',
38
+ role: 'provider',
39
+ label: 'Provider callback URI',
40
+ required: true,
41
+ },
42
+ {
43
+ kind: 'callback',
44
+ role: 'app',
45
+ target: 'ios',
46
+ label: 'iOS app callback',
47
+ required: true,
48
+ },
49
+ ],
50
+ };
51
+
52
+ expect(AUTH_OAUTH_TRANSPORT_IDS).toEqual(['brokeredRedirect']);
53
+ expect(AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS).toEqual(['trustedCredential', 'publicConfig']);
54
+ expect(AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES).toEqual(['public', 'secret']);
55
+ expect(AUTH_OAUTH_SETUP_CALLBACK_ROLES).toEqual(['provider', 'app']);
56
+ expect(plan.environment).toBe('local');
57
+ expect(plan.targets).toEqual(['web', 'ios', 'android']);
58
+ expect(plan.requirements.filter((requirement) => requirement.kind === 'field')).toHaveLength(2);
59
+ expect(JSON.stringify(plan)).not.toContain('credentialValue');
60
+ });
61
+
62
+ it('keeps transport identifiers extensible for later native capabilities', () => {
63
+ const futureTransport: AuthOAuthTransportId = 'nativeIdToken';
64
+
65
+ expect(futureTransport).toBe('nativeIdToken');
66
+ expect(AUTH_OAUTH_TRANSPORT_IDS).not.toContain(futureTransport);
67
+ });
68
+ });
package/src/auth.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
 
@@ -38,6 +39,70 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
38
39
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
39
40
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
40
41
 
42
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;
43
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
44
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
45
+
46
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
47
+ 'trustedCredential',
48
+ 'publicConfig',
49
+ ] as const;
50
+ export type AuthOAuthSetupFieldPersistence =
51
+ (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
52
+
53
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;
54
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
55
+
56
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;
57
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
58
+
59
+ export interface AuthOAuthSetupFieldRequirement {
60
+ readonly kind: 'field';
61
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
62
+ readonly key: string;
63
+ readonly label: string;
64
+ readonly required: boolean;
65
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
66
+ readonly persistence: AuthOAuthSetupFieldPersistence;
67
+ /** Present only when a field belongs to one application target rather than the backend setup. */
68
+ readonly target?: AppDeployTargetId;
69
+ readonly description?: string;
70
+ }
71
+
72
+ export interface AuthOAuthSetupCallbackRequirement {
73
+ readonly kind: 'callback';
74
+ readonly role: AuthOAuthSetupCallbackRole;
75
+ readonly label: string;
76
+ readonly required: boolean;
77
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
78
+ readonly target?: AppDeployTargetId;
79
+ readonly description?: string;
80
+ }
81
+
82
+ export type AuthOAuthSetupRequirement =
83
+ | AuthOAuthSetupFieldRequirement
84
+ | AuthOAuthSetupCallbackRequirement;
85
+
86
+ /**
87
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
88
+ * provider/transport/environment combination. It contains requirements only, never credential
89
+ * values, tokens, callback authorization data, or other secret material.
90
+ */
91
+ export interface AuthOAuthSetupPlan {
92
+ readonly provider: AuthOAuthProviderId;
93
+ readonly transport: AuthOAuthTransportId;
94
+ readonly environment: AppDeployEnvironmentId;
95
+ /** Enabled application targets considered while deriving this plan. */
96
+ readonly targets: readonly AppDeployTargetId[];
97
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
98
+ }
99
+
100
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
101
+ export interface AuthOAuthSetupCapabilities {
102
+ readonly providers: readonly AuthOAuthProviderId[];
103
+ readonly transports: readonly AuthOAuthTransportId[];
104
+ }
105
+
41
106
  export interface AuthIdentifier {
42
107
  kind: AuthIdentifierKind;
43
108
  value: string;