@ankhorage/contracts 7.7.0 → 7.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/README.md +1 -1
  3. package/dist/auth.d.ts +50 -0
  4. package/dist/auth.d.ts.map +1 -1
  5. package/dist/auth.js +7 -0
  6. package/dist/auth.js.map +1 -1
  7. package/dist/cli/index.d.ts +6 -1
  8. package/dist/cli/index.d.ts.map +1 -1
  9. package/dist/cli/index.js.map +1 -1
  10. package/package.json +1 -1
  11. package/src/auth-oauth-setup.test.ts +68 -0
  12. package/src/auth.ts +65 -0
  13. package/src/cli/index.ts +6 -1
  14. package/src/cli.test.ts +20 -0
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # @ankhorage/contracts
2
2
 
3
+ ## 7.9.0
4
+
5
+ ### Minor Changes
6
+
7
+ - 1fa1570: Allow CLI provider manifests to declare category-root commands with an empty command path.
8
+
9
+ ## 7.8.0
10
+
11
+ ### Minor Changes
12
+
13
+ - e0358fc: Add neutral setup requirement metadata for target-, environment-, and transport-aware administration planning.
14
+
3
15
  ## 7.7.0
4
16
 
5
17
  ### Minor Changes
package/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
 
4
4
  # CONTRACTS
5
5
 
6
- ![license: MIT](././paradox/badges/license.svg) ![npm: v7.6.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
6
+ ![license: MIT](././paradox/badges/license.svg) ![npm: v7.8.0](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
7
7
 
8
8
  Serializable app, action, theme, auth, and secret-store contracts for Ankhorage.
9
9
 
package/dist/auth.d.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
  export declare const AUTH_IDENTIFIER_KINDS: readonly ["email", "phone", "username"];
@@ -8,6 +9,55 @@ export type AuthSignUpField = KnownAuthSignUpField | (string & {});
8
9
  export declare const AUTH_OAUTH_PROVIDER_IDS: readonly ["apple", "azure", "bitbucket", "discord", "facebook", "figma", "github", "gitlab", "google", "kakao", "keycloak", "linkedin", "notion", "slack", "spotify", "twitch", "twitter", "workos", "zoom"];
9
10
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
10
11
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
12
+ export declare const AUTH_OAUTH_TRANSPORT_IDS: readonly ["brokeredRedirect"];
13
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
14
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
15
+ export declare const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS: readonly ["trustedCredential", "publicConfig"];
16
+ export type AuthOAuthSetupFieldPersistence = (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
17
+ export declare const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES: readonly ["public", "secret"];
18
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
19
+ export declare const AUTH_OAUTH_SETUP_CALLBACK_ROLES: readonly ["provider", "app"];
20
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
21
+ export interface AuthOAuthSetupFieldRequirement {
22
+ readonly kind: 'field';
23
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
24
+ readonly key: string;
25
+ readonly label: string;
26
+ readonly required: boolean;
27
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
28
+ readonly persistence: AuthOAuthSetupFieldPersistence;
29
+ /** Present only when a field belongs to one application target rather than the backend setup. */
30
+ readonly target?: AppDeployTargetId;
31
+ readonly description?: string;
32
+ }
33
+ export interface AuthOAuthSetupCallbackRequirement {
34
+ readonly kind: 'callback';
35
+ readonly role: AuthOAuthSetupCallbackRole;
36
+ readonly label: string;
37
+ readonly required: boolean;
38
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
39
+ readonly target?: AppDeployTargetId;
40
+ readonly description?: string;
41
+ }
42
+ export type AuthOAuthSetupRequirement = AuthOAuthSetupFieldRequirement | AuthOAuthSetupCallbackRequirement;
43
+ /**
44
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
45
+ * provider/transport/environment combination. It contains requirements only, never credential
46
+ * values, tokens, callback authorization data, or other secret material.
47
+ */
48
+ export interface AuthOAuthSetupPlan {
49
+ readonly provider: AuthOAuthProviderId;
50
+ readonly transport: AuthOAuthTransportId;
51
+ readonly environment: AppDeployEnvironmentId;
52
+ /** Enabled application targets considered while deriving this plan. */
53
+ readonly targets: readonly AppDeployTargetId[];
54
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
55
+ }
56
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
57
+ export interface AuthOAuthSetupCapabilities {
58
+ readonly providers: readonly AuthOAuthProviderId[];
59
+ readonly transports: readonly AuthOAuthTransportId[];
60
+ }
11
61
  export interface AuthIdentifier {
12
62
  kind: AuthIdentifierKind;
13
63
  value: string;
package/dist/auth.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,eAAO,MAAM,qBAAqB,yCAA0C,CAAC;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,6FAMtB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,eAAO,MAAM,uBAAuB,8MAoB1B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,eAAO,MAAM,wBAAwB,+BAAgC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE7E,eAAO,MAAM,wCAAwC,gDAG3C,CAAC;AACX,MAAM,MAAM,8BAA8B,GACxC,CAAC,OAAO,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,oCAAoC,+BAAgC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnG,eAAO,MAAM,+BAA+B,8BAA+B,CAAC;AAC5E,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1F,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,iCAAiC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC7D;AAED,qGAAqG;AACrG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB;;;;;;;CAOK,CAAC;AAEpC,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAErE;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,mBAAmB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,cAAc,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,CAAC,KAAK,GAAG,IAAI,IAC/B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,eAAO,MAAM,uBAAuB,+EAO1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB,2WAgBzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,yCAAyC,kDAG5C,CAAC;AACX,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,yCAAyC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,eAAO,MAAM,+BAA+B,qEAGlC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,eAAO,MAAM,gCAAgC,sDAGnC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,6BAA6B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,8BAA8B,GACtC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,oCAAoC,CAAC;CAC9C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,uBAAuB,CAAC;CAChC,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,WAAW,CAAC;CACtB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC;CACrC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;CACvB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,SAAS,EAAE,SAAS,CAAC,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvF,qBAAqB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;IACxC,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAElC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IAE3D,oBAAoB,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;CACrE"}
package/dist/auth.js CHANGED
@@ -27,6 +27,13 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
27
27
  'workos',
28
28
  'zoom',
29
29
  ];
30
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'];
31
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
32
+ 'trustedCredential',
33
+ 'publicConfig',
34
+ ];
35
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'];
36
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'];
30
37
  export const DEFAULT_AUTH_FLOW = {
31
38
  signInRoute: 'sign-in',
32
39
  signUpRoute: 'sign-up',
package/dist/auth.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAmBX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
1
+ {"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAG7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,qBAAqB;IACxB,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;CACF,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;CACE,CAAC;AAIX,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAItE,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,mBAAmB;IACnB,cAAc;CACN,CAAC;AAIX,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGlF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAC;AAiE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,UAAU;IACxB,mBAAmB,EAAE,iBAAiB;IACtC,eAAe,EAAE,GAAG;IACpB,iBAAiB,EAAE,SAAS;CACK,CAAC;AAEpC,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC;AAC5C,CAAC;AA2GD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,eAAe;IACf,4BAA4B;IAC5B,yBAAyB;IACzB,gBAAgB;CACR,CAAC;AAUX,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gBAAgB;IAChB,mBAAmB;CACX,CAAC;AAIX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,iBAAiB;CACT,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,kBAAkB;CACV,CAAC","sourcesContent":["import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';\nimport type { SecretRef } from './secrets';\nimport type { IconSpec } from './types';\n\nexport const AUTH_IDENTIFIER_KINDS = ['email', 'phone', 'username'] as const;\nexport type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];\n\nexport const AUTH_SIGN_UP_FIELDS = [\n ...AUTH_IDENTIFIER_KINDS,\n 'password',\n 'displayName',\n 'firstName',\n 'lastName',\n] as const;\nexport type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];\nexport type AuthSignUpField = KnownAuthSignUpField | (string & {});\n\nexport const AUTH_OAUTH_PROVIDER_IDS = [\n 'apple',\n 'azure',\n 'bitbucket',\n 'discord',\n 'facebook',\n 'figma',\n 'github',\n 'gitlab',\n 'google',\n 'kakao',\n 'keycloak',\n 'linkedin',\n 'notion',\n 'slack',\n 'spotify',\n 'twitch',\n 'twitter',\n 'workos',\n 'zoom',\n] as const;\nexport type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];\nexport type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});\n\nexport const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;\nexport type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];\nexport type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});\n\nexport const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [\n 'trustedCredential',\n 'publicConfig',\n] as const;\nexport type AuthOAuthSetupFieldPersistence =\n (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];\n\nexport const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;\nexport type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];\n\nexport const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;\nexport type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];\n\nexport interface AuthOAuthSetupFieldRequirement {\n readonly kind: 'field';\n /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */\n readonly key: string;\n readonly label: string;\n readonly required: boolean;\n readonly sensitivity: AuthOAuthSetupFieldSensitivity;\n readonly persistence: AuthOAuthSetupFieldPersistence;\n /** Present only when a field belongs to one application target rather than the backend setup. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport interface AuthOAuthSetupCallbackRequirement {\n readonly kind: 'callback';\n readonly role: AuthOAuthSetupCallbackRole;\n readonly label: string;\n readonly required: boolean;\n /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */\n readonly target?: AppDeployTargetId;\n readonly description?: string;\n}\n\nexport type AuthOAuthSetupRequirement =\n | AuthOAuthSetupFieldRequirement\n | AuthOAuthSetupCallbackRequirement;\n\n/**\n * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one\n * provider/transport/environment combination. It contains requirements only, never credential\n * values, tokens, callback authorization data, or other secret material.\n */\nexport interface AuthOAuthSetupPlan {\n readonly provider: AuthOAuthProviderId;\n readonly transport: AuthOAuthTransportId;\n readonly environment: AppDeployEnvironmentId;\n /** Enabled application targets considered while deriving this plan. */\n readonly targets: readonly AppDeployTargetId[];\n readonly requirements: readonly AuthOAuthSetupRequirement[];\n}\n\n/** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */\nexport interface AuthOAuthSetupCapabilities {\n readonly providers: readonly AuthOAuthProviderId[];\n readonly transports: readonly AuthOAuthTransportId[];\n}\n\nexport interface AuthIdentifier {\n kind: AuthIdentifierKind;\n value: string;\n}\n\nexport interface AuthFlowConfig {\n signInRoute: string;\n signUpRoute?: string;\n signOutRoute?: string;\n forgotPasswordRoute?: string;\n otpRoute?: string;\n postSignInRoute: string;\n unauthorizedRoute?: string;\n}\n\nexport const DEFAULT_AUTH_FLOW = {\n signInRoute: 'sign-in',\n signUpRoute: 'sign-up',\n signOutRoute: 'sign-out',\n forgotPasswordRoute: 'forgot-password',\n postSignInRoute: '/',\n unauthorizedRoute: 'sign-in',\n} as const satisfies AuthFlowConfig;\n\nexport function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig {\n return { ...(flow ?? DEFAULT_AUTH_FLOW) };\n}\n\nexport interface AuthSignInConfig {\n identifiers: AuthIdentifierKind[];\n}\n\nexport interface AuthSignUpConfig {\n requiredFields: AuthSignUpField[];\n optionalFields?: AuthSignUpField[];\n}\n\nexport interface AuthOAuthProviderConfig {\n id: AuthOAuthProviderId;\n label?: string;\n enabled?: boolean;\n scopes?: string[];\n queryParams?: Record<string, string>;\n icon?: IconSpec;\n /** Logical server-side secret reference; raw credentials must never be stored here. */\n credentialsRef?: SecretRef;\n}\n\nexport interface AuthOAuthConfig {\n enabled: boolean;\n callbackRoute: string;\n providers: AuthOAuthProviderConfig[];\n}\n\nexport interface AuthProviderConfig {\n provider: string;\n signIn: AuthSignInConfig;\n signUp?: AuthSignUpConfig;\n oauth?: AuthOAuthConfig;\n passwordReset?: {\n enabled: boolean;\n };\n otp?: {\n enabled: boolean;\n };\n}\n\nexport interface AuthUser {\n id: string;\n email?: string;\n phone?: string;\n username?: string;\n displayName?: string;\n avatarUrl?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface AuthSession {\n accessToken: string;\n refreshToken?: string;\n expiresAt?: number;\n tokenType?: string;\n user: AuthUser;\n}\n\nexport interface AuthAdapterError {\n code: string;\n message: string;\n cause?: unknown;\n}\n\nexport type AuthResult<TData = void> =\n | {\n ok: true;\n data?: TData;\n }\n | {\n ok: false;\n error: AuthAdapterError;\n };\n\nexport interface SignInInput {\n identifier: AuthIdentifier;\n password?: string;\n otp?: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignUpInput {\n identifier: AuthIdentifier;\n password?: string;\n profile?: Record<string, unknown>;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface SignOutInput {\n allDevices?: boolean;\n}\n\nexport interface PasswordResetInput {\n identifier: AuthIdentifier;\n redirectTo?: string;\n}\n\nexport interface VerifyOtpInput {\n identifier: AuthIdentifier;\n token: string;\n redirectTo?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport const AUTH_OAUTH_ERROR_STAGES = [\n 'start',\n 'transport',\n 'callback',\n 'exchange',\n 'session',\n 'profile',\n] as const;\nexport type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];\n\nexport const AUTH_OAUTH_ERROR_CODES = [\n 'oauth_unavailable',\n 'provider_disabled',\n 'provider_misconfigured',\n 'invalid_redirect_uri',\n 'authorization_failed',\n 'authorization_attempt_not_found',\n 'invalid_callback',\n 'state_mismatch',\n 'pkce_mismatch',\n 'callback_already_completed',\n 'code_exchange_failed',\n 'network_error',\n 'session_persistence_failed',\n 'profile_creation_failed',\n 'provider_error',\n] as const;\nexport type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];\n\nexport interface AuthOAuthError extends AuthAdapterError {\n code: AuthOAuthErrorCode;\n stage: AuthOAuthErrorStage;\n provider?: AuthOAuthProviderId;\n recoverable: boolean;\n}\n\nexport const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS = [\n 'user_cancelled',\n 'browser_dismissed',\n] as const;\nexport type AuthOAuthTransportCancellationReason =\n (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_CANCELLATION_REASONS = [\n ...AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS,\n 'provider_denied',\n] as const;\nexport type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];\n\nexport const AUTH_OAUTH_TRANSPORT_ERROR_CODES = [\n 'browser_unavailable',\n 'transport_failed',\n] as const;\nexport type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];\n\nexport interface AuthOAuthTransportError {\n code: AuthOAuthTransportErrorCode;\n message: string;\n cause?: unknown;\n}\n\nexport interface StartOAuthAuthorizationInput {\n provider: AuthOAuthProviderId;\n redirectUri: string;\n scopes?: readonly string[];\n queryParams?: Readonly<Record<string, string>>;\n}\n\nexport interface AuthOAuthAuthorizationRequest {\n attemptId: string;\n provider: AuthOAuthProviderId;\n authorizationUrl: string;\n redirectUri: string;\n}\n\nexport type AuthOAuthStartResult =\n | {\n ok: true;\n data: AuthOAuthAuthorizationRequest;\n }\n | {\n ok: false;\n error: AuthOAuthError;\n };\n\nexport type AuthOAuthAuthorizationResponse =\n | {\n type: 'callback';\n url: string;\n }\n | {\n type: 'cancelled';\n reason: AuthOAuthTransportCancellationReason;\n }\n | {\n type: 'error';\n error: AuthOAuthTransportError;\n };\n\nexport interface CompleteOAuthAuthorizationInput {\n attemptId: string;\n response: AuthOAuthAuthorizationResponse;\n}\n\nexport type AuthOAuthCompletionResult =\n | {\n ok: true;\n status: 'authenticated';\n provider: AuthOAuthProviderId;\n session: AuthSession;\n }\n | {\n ok: false;\n status: 'cancelled';\n provider: AuthOAuthProviderId;\n reason: AuthOAuthCancellationReason;\n }\n | {\n ok: false;\n status: 'error';\n error: AuthOAuthError;\n };\n\nexport interface AuthOAuthCapabilities {\n /** Enabled providers for which start and callback completion are operational. */\n providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];\n}\n\nexport interface AuthOAuthAdapter {\n readonly capabilities: AuthOAuthCapabilities;\n\n startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;\n completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;\n}\n\nexport interface AuthAdapterCapabilities {\n signInIdentifiers: AuthIdentifierKind[];\n supportsSignUp: boolean;\n supportsPasswordReset: boolean;\n supportsOtp: boolean;\n supportsSessionRefresh: boolean;\n}\n\nexport interface AuthAdapter {\n readonly capabilities?: AuthAdapterCapabilities;\n /**\n * Presence is the canonical OAuth capability signal. When present, both authorization start and\n * callback completion are mandatory and operational for every advertised provider.\n */\n readonly oauth?: AuthOAuthAdapter;\n\n signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;\n signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;\n signOut(input?: SignOutInput): Promise<AuthResult>;\n\n getSession(): Promise<AuthResult<AuthSession | null>>;\n refreshSession?(): Promise<AuthResult<AuthSession | null>>;\n\n requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;\n verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;\n}\n"]}
package/dist/cli/index.d.ts CHANGED
@@ -2,7 +2,12 @@ export type AnkhCommandCategory = string;
2
2
  export type AnkhProviderReference = `./${string}`;
3
3
  export type AnkhCapabilityId = `${string}.${string}`;
4
4
  export interface AnkhCommandDescriptor {
5
- readonly path: readonly [string, ...string[]];
5
+ /**
6
+ * Command path relative to the provider category.
7
+ *
8
+ * An empty path declares the command at the category root.
9
+ */
10
+ readonly path: readonly string[];
6
11
  readonly summary: string;
7
12
  readonly capability: AnkhCapabilityId;
8
13
  readonly aliases?: readonly string[];
package/dist/cli/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,MAAM,MAAM,qBAAqB,GAAG,KAAK,MAAM,EAAE,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpD"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,MAAM,MAAM,qBAAqB,GAAG,KAAK,MAAM,EAAE,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACpD"}
package/dist/cli/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"","sourcesContent":["export type AnkhCommandCategory = string;\n\nexport type AnkhProviderReference = `./${string}`;\n\nexport type AnkhCapabilityId = `${string}.${string}`;\n\nexport interface AnkhCommandDescriptor {\n readonly path: readonly [string, ...string[]];\n readonly summary: string;\n readonly capability: AnkhCapabilityId;\n readonly aliases?: readonly string[];\n readonly examples?: readonly string[];\n}\n\nexport interface AnkhCommandProviderManifest {\n readonly id: string;\n readonly category: AnkhCommandCategory;\n readonly version: string;\n readonly capabilities: readonly AnkhCapabilityId[];\n readonly commands: readonly AnkhCommandDescriptor[];\n}\n\nexport interface AnkhPackageMetadata {\n readonly category: AnkhCommandCategory;\n readonly provider: AnkhProviderReference | null;\n readonly capabilities: readonly AnkhCapabilityId[];\n}\n"]}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"","sourcesContent":["export type AnkhCommandCategory = string;\n\nexport type AnkhProviderReference = `./${string}`;\n\nexport type AnkhCapabilityId = `${string}.${string}`;\n\nexport interface AnkhCommandDescriptor {\n /**\n * Command path relative to the provider category.\n *\n * An empty path declares the command at the category root.\n */\n readonly path: readonly string[];\n readonly summary: string;\n readonly capability: AnkhCapabilityId;\n readonly aliases?: readonly string[];\n readonly examples?: readonly string[];\n}\n\nexport interface AnkhCommandProviderManifest {\n readonly id: string;\n readonly category: AnkhCommandCategory;\n readonly version: string;\n readonly capabilities: readonly AnkhCapabilityId[];\n readonly commands: readonly AnkhCommandDescriptor[];\n}\n\nexport interface AnkhPackageMetadata {\n readonly category: AnkhCommandCategory;\n readonly provider: AnkhProviderReference | null;\n readonly capabilities: readonly AnkhCapabilityId[];\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ankhorage/contracts",
3
- "version": "7.7.0",
3
+ "version": "7.9.0",
4
4
  "main": "./dist/index.js",
5
5
  "ankh": {
6
6
  "category": "contracts",
package/src/auth-oauth-setup.test.ts ADDED
@@ -0,0 +1,68 @@
1
+ import { describe, expect, it } from 'bun:test';
2
+
3
+ import {
4
+ AUTH_OAUTH_SETUP_CALLBACK_ROLES,
5
+ AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS,
6
+ AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES,
7
+ AUTH_OAUTH_TRANSPORT_IDS,
8
+ type AuthOAuthSetupPlan,
9
+ type AuthOAuthTransportId,
10
+ } from './auth';
11
+
12
+ describe('OAuth setup requirement contracts', () => {
13
+ it('models target and environment aware requirements without credential values', () => {
14
+ const plan: AuthOAuthSetupPlan = {
15
+ provider: 'google',
16
+ transport: 'brokeredRedirect',
17
+ environment: 'local',
18
+ targets: ['web', 'ios', 'android'],
19
+ requirements: [
20
+ {
21
+ kind: 'field',
22
+ key: 'webClientId',
23
+ label: 'Web Client ID',
24
+ required: true,
25
+ sensitivity: 'public',
26
+ persistence: 'trustedCredential',
27
+ },
28
+ {
29
+ kind: 'field',
30
+ key: 'webClientSecret',
31
+ label: 'Web Client Secret',
32
+ required: true,
33
+ sensitivity: 'secret',
34
+ persistence: 'trustedCredential',
35
+ },
36
+ {
37
+ kind: 'callback',
38
+ role: 'provider',
39
+ label: 'Provider callback URI',
40
+ required: true,
41
+ },
42
+ {
43
+ kind: 'callback',
44
+ role: 'app',
45
+ target: 'ios',
46
+ label: 'iOS app callback',
47
+ required: true,
48
+ },
49
+ ],
50
+ };
51
+
52
+ expect(AUTH_OAUTH_TRANSPORT_IDS).toEqual(['brokeredRedirect']);
53
+ expect(AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS).toEqual(['trustedCredential', 'publicConfig']);
54
+ expect(AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES).toEqual(['public', 'secret']);
55
+ expect(AUTH_OAUTH_SETUP_CALLBACK_ROLES).toEqual(['provider', 'app']);
56
+ expect(plan.environment).toBe('local');
57
+ expect(plan.targets).toEqual(['web', 'ios', 'android']);
58
+ expect(plan.requirements.filter((requirement) => requirement.kind === 'field')).toHaveLength(2);
59
+ expect(JSON.stringify(plan)).not.toContain('credentialValue');
60
+ });
61
+
62
+ it('keeps transport identifiers extensible for later native capabilities', () => {
63
+ const futureTransport: AuthOAuthTransportId = 'nativeIdToken';
64
+
65
+ expect(futureTransport).toBe('nativeIdToken');
66
+ expect(AUTH_OAUTH_TRANSPORT_IDS).not.toContain(futureTransport);
67
+ });
68
+ });
package/src/auth.ts CHANGED
@@ -1,3 +1,4 @@
1
+ import type { AppDeployEnvironmentId, AppDeployTargetId } from './deploy';
1
2
  import type { SecretRef } from './secrets';
2
3
  import type { IconSpec } from './types';
3
4
 
@@ -38,6 +39,70 @@ export const AUTH_OAUTH_PROVIDER_IDS = [
38
39
  export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
39
40
  export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
40
41
 
42
+ export const AUTH_OAUTH_TRANSPORT_IDS = ['brokeredRedirect'] as const;
43
+ export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
44
+ export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
45
+
46
+ export const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS = [
47
+ 'trustedCredential',
48
+ 'publicConfig',
49
+ ] as const;
50
+ export type AuthOAuthSetupFieldPersistence =
51
+ (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
52
+
53
+ export const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES = ['public', 'secret'] as const;
54
+ export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
55
+
56
+ export const AUTH_OAUTH_SETUP_CALLBACK_ROLES = ['provider', 'app'] as const;
57
+ export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
58
+
59
+ export interface AuthOAuthSetupFieldRequirement {
60
+ readonly kind: 'field';
61
+ /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
62
+ readonly key: string;
63
+ readonly label: string;
64
+ readonly required: boolean;
65
+ readonly sensitivity: AuthOAuthSetupFieldSensitivity;
66
+ readonly persistence: AuthOAuthSetupFieldPersistence;
67
+ /** Present only when a field belongs to one application target rather than the backend setup. */
68
+ readonly target?: AppDeployTargetId;
69
+ readonly description?: string;
70
+ }
71
+
72
+ export interface AuthOAuthSetupCallbackRequirement {
73
+ readonly kind: 'callback';
74
+ readonly role: AuthOAuthSetupCallbackRole;
75
+ readonly label: string;
76
+ readonly required: boolean;
77
+ /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
78
+ readonly target?: AppDeployTargetId;
79
+ readonly description?: string;
80
+ }
81
+
82
+ export type AuthOAuthSetupRequirement =
83
+ | AuthOAuthSetupFieldRequirement
84
+ | AuthOAuthSetupCallbackRequirement;
85
+
86
+ /**
87
+ * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
88
+ * provider/transport/environment combination. It contains requirements only, never credential
89
+ * values, tokens, callback authorization data, or other secret material.
90
+ */
91
+ export interface AuthOAuthSetupPlan {
92
+ readonly provider: AuthOAuthProviderId;
93
+ readonly transport: AuthOAuthTransportId;
94
+ readonly environment: AppDeployEnvironmentId;
95
+ /** Enabled application targets considered while deriving this plan. */
96
+ readonly targets: readonly AppDeployTargetId[];
97
+ readonly requirements: readonly AuthOAuthSetupRequirement[];
98
+ }
99
+
100
+ /** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
101
+ export interface AuthOAuthSetupCapabilities {
102
+ readonly providers: readonly AuthOAuthProviderId[];
103
+ readonly transports: readonly AuthOAuthTransportId[];
104
+ }
105
+
41
106
  export interface AuthIdentifier {
42
107
  kind: AuthIdentifierKind;
43
108
  value: string;
package/src/cli/index.ts CHANGED
@@ -5,7 +5,12 @@ export type AnkhProviderReference = `./${string}`;
5
5
  export type AnkhCapabilityId = `${string}.${string}`;
6
6
 
7
7
  export interface AnkhCommandDescriptor {
8
- readonly path: readonly [string, ...string[]];
8
+ /**
9
+ * Command path relative to the provider category.
10
+ *
11
+ * An empty path declares the command at the category root.
12
+ */
13
+ readonly path: readonly string[];
9
14
  readonly summary: string;
10
15
  readonly capability: AnkhCapabilityId;
11
16
  readonly aliases?: readonly string[];
package/src/cli.test.ts CHANGED
@@ -38,6 +38,26 @@ describe('cli contracts', () => {
38
38
  expect(manifest.commands[0].path).toEqual(['up']);
39
39
  });
40
40
 
41
+ it('accepts an empty path as a category-root command', () => {
42
+ const deployCommand = {
43
+ path: [],
44
+ summary: 'Deploy the authored release',
45
+ capability: 'deploy.release',
46
+ examples: ['ankh deploy'],
47
+ } as const satisfies AnkhCommandDescriptor;
48
+
49
+ const manifest = {
50
+ id: '@ankhorage/deploy',
51
+ category: 'deploy',
52
+ version: '1.0.0',
53
+ capabilities: ['deploy.release'],
54
+ commands: [deployCommand],
55
+ } as const satisfies AnkhCommandProviderManifest;
56
+
57
+ expect(manifest.commands[0].path).toEqual([]);
58
+ expect(JSON.parse(JSON.stringify(manifest))).toEqual(manifest);
59
+ });
60
+
41
61
  it('accepts metadata-only packages without a provider module', () => {
42
62
  const packageMetadata = {
43
63
  category: 'contracts',