@ankhorage/doctor 0.7.3 → 0.9.0

package/dist/authReadinessProvider.d.ts

@@ -0,0 +1,15 @@
+import type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';
+import type { DoctorDiagnostic } from './diagnostics.js';
+import type { DoctorReadiness } from './readiness.js';
+export declare function analyzeAuthProviderReadiness(input: {
+    readonly authProvider: unknown;
+    readonly callbackRoute: unknown;
+    readonly enabledTargets: readonly AppDeployTargetId[];
+    readonly manifestPath: string;
+    readonly provider: Record<string, unknown>;
+    readonly targets: AppDeployTargets;
+}): {
+    readonly diagnostics: DoctorDiagnostic[];
+    readonly readiness: DoctorReadiness[];
+};
+//# sourceMappingURL=authReadinessProvider.d.ts.map

package/dist/authReadinessProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessProvider.d.ts","sourceRoot":"","sources":["../src/authReadinessProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAOvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC,GAAG;IAAE,QAAQ,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAA;CAAE,CA2CtF"}

package/dist/authReadinessProvider.js

@@ -0,0 +1,44 @@
+import { APP_DEPLOY_ENVIRONMENT_IDS } from '@ankhorage/contracts/deploy';
+import { createNativeAuthCallbackDiagnostic } from './authReadinessNativeDiagnostic.js';
+import { analyzeAuthProviderEnvironment } from './authReadinessProviderEnvironment.js';
+import { createUnsupportedAuthDiagnostic } from './authReadinessUnsupported.js';
+import { analyzeUnsupportedAuthBackend } from './authReadinessUnsupportedBackend.js';
+export function analyzeAuthProviderReadiness(input) {
+    const providerId = typeof input.provider.id === 'string' ? input.provider.id : '';
+    if (providerId === '')
+        return { diagnostics: [], readiness: [] };
+    if (input.authProvider !== 'supabase') {
+        const result = analyzeUnsupportedAuthBackend({
+            enabledTargets: input.enabledTargets,
+            manifestPath: input.manifestPath,
+            provider: providerId,
+        });
+        return { diagnostics: [...result.diagnostics], readiness: [...result.readiness] };
+    }
+    const diagnostics = [];
+    const readiness = [];
+    const missingNativeTargets = new Set();
+    let unsupported = false;
+    for (const environment of APP_DEPLOY_ENVIRONMENT_IDS) {
+        const result = analyzeAuthProviderEnvironment({
+            callbackRoute: input.callbackRoute,
+            credentialsRef: input.provider.credentialsRef,
+            enabledTargets: input.enabledTargets,
+            environment,
+            provider: providerId,
+            targets: input.targets,
+        });
+        readiness.push(...result.readiness);
+        unsupported ||= result.unsupported;
+        result.missingNativeTargets.forEach((target) => missingNativeTargets.add(target));
+    }
+    if (unsupported) {
+        diagnostics.push(createUnsupportedAuthDiagnostic({
+            message: `OAuth provider "${providerId}" is not supported by the Supabase brokeredRedirect setup resolver.`,
+            path: input.manifestPath,
+        }));
+    }
+    missingNativeTargets.forEach((target) => diagnostics.push(createNativeAuthCallbackDiagnostic(target, input.manifestPath)));
+    return { diagnostics, readiness };
+}
+//# sourceMappingURL=authReadinessProvider.js.map

package/dist/authReadinessProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessProvider.js","sourceRoot":"","sources":["../src/authReadinessProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAIrF,MAAM,UAAU,4BAA4B,CAAC,KAO5C;IACC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,6BAA6B,CAAC;YAC3C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1D,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,WAAW,IAAI,0BAA0B,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;QACnC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,IAAI,CACd,+BAA+B,CAAC;YAC9B,OAAO,EAAE,mBAAmB,UAAU,qEAAqE;YAC3G,IAAI,EAAE,KAAK,CAAC,YAAY;SACzB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,WAAW,CAAC,IAAI,CAAC,kCAAkC,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CACjF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';\nimport { APP_DEPLOY_ENVIRONMENT_IDS } from '@ankhorage/contracts/deploy';\n\nimport { createNativeAuthCallbackDiagnostic } from './authReadinessNativeDiagnostic.js';\nimport { analyzeAuthProviderEnvironment } from './authReadinessProviderEnvironment.js';\nimport { createUnsupportedAuthDiagnostic } from './authReadinessUnsupported.js';\nimport { analyzeUnsupportedAuthBackend } from './authReadinessUnsupportedBackend.js';\nimport type { DoctorDiagnostic } from './diagnostics.js';\nimport type { DoctorReadiness } from './readiness.js';\n\nexport function analyzeAuthProviderReadiness(input: {\n  readonly authProvider: unknown;\n  readonly callbackRoute: unknown;\n  readonly enabledTargets: readonly AppDeployTargetId[];\n  readonly manifestPath: string;\n  readonly provider: Record<string, unknown>;\n  readonly targets: AppDeployTargets;\n}): { readonly diagnostics: DoctorDiagnostic[]; readonly readiness: DoctorReadiness[] } {\n  const providerId = typeof input.provider.id === 'string' ? input.provider.id : '';\n  if (providerId === '') return { diagnostics: [], readiness: [] };\n  if (input.authProvider !== 'supabase') {\n    const result = analyzeUnsupportedAuthBackend({\n      enabledTargets: input.enabledTargets,\n      manifestPath: input.manifestPath,\n      provider: providerId,\n    });\n    return { diagnostics: [...result.diagnostics], readiness: [...result.readiness] };\n  }\n\n  const diagnostics: DoctorDiagnostic[] = [];\n  const readiness: DoctorReadiness[] = [];\n  const missingNativeTargets = new Set<AppDeployTargetId>();\n  let unsupported = false;\n\n  for (const environment of APP_DEPLOY_ENVIRONMENT_IDS) {\n    const result = analyzeAuthProviderEnvironment({\n      callbackRoute: input.callbackRoute,\n      credentialsRef: input.provider.credentialsRef,\n      enabledTargets: input.enabledTargets,\n      environment,\n      provider: providerId,\n      targets: input.targets,\n    });\n    readiness.push(...result.readiness);\n    unsupported ||= result.unsupported;\n    result.missingNativeTargets.forEach((target) => missingNativeTargets.add(target));\n  }\n\n  if (unsupported) {\n    diagnostics.push(\n      createUnsupportedAuthDiagnostic({\n        message: `OAuth provider \"${providerId}\" is not supported by the Supabase brokeredRedirect setup resolver.`,\n        path: input.manifestPath,\n      }),\n    );\n  }\n  missingNativeTargets.forEach((target) =>\n    diagnostics.push(createNativeAuthCallbackDiagnostic(target, input.manifestPath)),\n  );\n  return { diagnostics, readiness };\n}\n"]}

package/dist/authReadinessProviderEnvironment.d.ts

@@ -0,0 +1,15 @@
+import type { AppDeployEnvironmentId, AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';
+import type { DoctorReadiness } from './readiness.js';
+export declare function analyzeAuthProviderEnvironment(input: {
+    readonly callbackRoute: unknown;
+    readonly credentialsRef: unknown;
+    readonly enabledTargets: readonly AppDeployTargetId[];
+    readonly environment: AppDeployEnvironmentId;
+    readonly provider: string;
+    readonly targets: AppDeployTargets;
+}): {
+    readonly missingNativeTargets: readonly AppDeployTargetId[];
+    readonly readiness: readonly DoctorReadiness[];
+    readonly unsupported: boolean;
+};
+//# sourceMappingURL=authReadinessProviderEnvironment.d.ts.map

package/dist/authReadinessProviderEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessProviderEnvironment.d.ts","sourceRoot":"","sources":["../src/authReadinessProviderEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC,GAAG;IACF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B,CA+BA"}

package/dist/authReadinessProviderEnvironment.js

@@ -0,0 +1,35 @@
+import { resolveSupabaseOAuthSetupPlan } from '@ankhorage/supabase-auth';
+import { analyzeAuthReadinessEnvironment } from './authReadinessEnvironment.js';
+import { createUnsupportedAuthReadiness } from './authReadinessUnsupported.js';
+export function analyzeAuthProviderEnvironment(input) {
+    const plan = resolveSupabaseOAuthSetupPlan({
+        provider: input.provider,
+        transport: 'brokeredRedirect',
+        environment: input.environment,
+        targets: input.enabledTargets,
+    });
+    if (plan === null) {
+        return {
+            missingNativeTargets: [],
+            readiness: createUnsupportedAuthReadiness({
+                environment: input.environment,
+                provider: input.provider,
+                targets: input.enabledTargets,
+            }),
+            unsupported: true,
+        };
+    }
+    return {
+        ...analyzeAuthReadinessEnvironment({
+            callbackRoute: input.callbackRoute,
+            credentialsRef: input.credentialsRef,
+            enabledTargets: input.enabledTargets,
+            environment: input.environment,
+            plan,
+            provider: input.provider,
+            targets: input.targets,
+        }),
+        unsupported: false,
+    };
+}
+//# sourceMappingURL=authReadinessProviderEnvironment.js.map

package/dist/authReadinessProviderEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessProviderEnvironment.js","sourceRoot":"","sources":["../src/authReadinessProviderEnvironment.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAG/E,MAAM,UAAU,8BAA8B,CAAC,KAO9C;IAKC,MAAM,IAAI,GAAG,6BAA6B,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,kBAAkB;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,cAAc;KAC9B,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,oBAAoB,EAAE,EAAE;YACxB,SAAS,EAAE,8BAA8B,CAAC;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,cAAc;aAC9B,CAAC;YACF,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,+BAA+B,CAAC;YACjC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  AppDeployEnvironmentId,\n  AppDeployTargetId,\n  AppDeployTargets,\n} from '@ankhorage/contracts/deploy';\nimport { resolveSupabaseOAuthSetupPlan } from '@ankhorage/supabase-auth';\n\nimport { analyzeAuthReadinessEnvironment } from './authReadinessEnvironment.js';\nimport { createUnsupportedAuthReadiness } from './authReadinessUnsupported.js';\nimport type { DoctorReadiness } from './readiness.js';\n\nexport function analyzeAuthProviderEnvironment(input: {\n  readonly callbackRoute: unknown;\n  readonly credentialsRef: unknown;\n  readonly enabledTargets: readonly AppDeployTargetId[];\n  readonly environment: AppDeployEnvironmentId;\n  readonly provider: string;\n  readonly targets: AppDeployTargets;\n}): {\n  readonly missingNativeTargets: readonly AppDeployTargetId[];\n  readonly readiness: readonly DoctorReadiness[];\n  readonly unsupported: boolean;\n} {\n  const plan = resolveSupabaseOAuthSetupPlan({\n    provider: input.provider,\n    transport: 'brokeredRedirect',\n    environment: input.environment,\n    targets: input.enabledTargets,\n  });\n  if (plan === null) {\n    return {\n      missingNativeTargets: [],\n      readiness: createUnsupportedAuthReadiness({\n        environment: input.environment,\n        provider: input.provider,\n        targets: input.enabledTargets,\n      }),\n      unsupported: true,\n    };\n  }\n\n  return {\n    ...analyzeAuthReadinessEnvironment({\n      callbackRoute: input.callbackRoute,\n      credentialsRef: input.credentialsRef,\n      enabledTargets: input.enabledTargets,\n      environment: input.environment,\n      plan,\n      provider: input.provider,\n      targets: input.targets,\n    }),\n    unsupported: false,\n  };\n}\n"]}

package/dist/authReadinessRequirements.d.ts

@@ -0,0 +1,10 @@
+import type { AuthOAuthSetupPlan } from '@ankhorage/contracts/auth';
+import type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';
+export declare function collectMissingAuthReadinessRequirements(input: {
+    readonly callbackRoute: unknown;
+    readonly credentialsRef: unknown;
+    readonly plan: AuthOAuthSetupPlan;
+    readonly target: AppDeployTargetId;
+    readonly targets: AppDeployTargets;
+}): readonly string[];
+//# sourceMappingURL=authReadinessRequirements.d.ts.map

package/dist/authReadinessRequirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessRequirements.d.ts","sourceRoot":"","sources":["../src/authReadinessRequirements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAGvF,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC,GAAG,SAAS,MAAM,EAAE,CAoBpB"}

package/dist/authReadinessRequirements.js

@@ -0,0 +1,34 @@
+import { normalizeSecretRef } from '@ankhorage/contracts/secrets';
+export function collectMissingAuthReadinessRequirements(input) {
+    const missing = [];
+    if (requiresTrustedCredential(input.plan) && !hasCanonicalCredentialRef(input.credentialsRef)) {
+        missing.push('credential reference');
+    }
+    const callbackRequired = input.plan.requirements.some((requirement) => requirement.kind === 'callback' &&
+        requirement.role === 'app' &&
+        requirement.required &&
+        requirement.target === input.target);
+    if (!callbackRequired)
+        return missing;
+    if (!isAbsoluteRoute(input.callbackRoute))
+        missing.push('callback route');
+    if (input.target !== 'web' && input.targets[input.target]?.scheme === undefined) {
+        missing.push(`${input.target} deep-link scheme`);
+    }
+    return missing;
+}
+function requiresTrustedCredential(plan) {
+    return plan.requirements.some((requirement) => requirement.kind === 'field' &&
+        requirement.required &&
+        requirement.persistence === 'trustedCredential');
+}
+function hasCanonicalCredentialRef(value) {
+    if (typeof value !== 'string')
+        return false;
+    const result = normalizeSecretRef(value);
+    return result.ok && result.data === value;
+}
+function isAbsoluteRoute(value) {
+    return typeof value === 'string' && value.trim().startsWith('/') && value.trim().length > 0;
+}
+//# sourceMappingURL=authReadinessRequirements.js.map

package/dist/authReadinessRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessRequirements.js","sourceRoot":"","sources":["../src/authReadinessRequirements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,UAAU,uCAAuC,CAAC,KAMvD;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CACnD,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,IAAI,KAAK,UAAU;QAC/B,WAAW,CAAC,IAAI,KAAK,KAAK;QAC1B,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CACtC,CAAC;IACF,IAAI,CAAC,gBAAgB;QAAE,OAAO,OAAO,CAAC;IAEtC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAwB;IACzD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAC3B,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,WAAW,KAAK,mBAAmB,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["import type { AuthOAuthSetupPlan } from '@ankhorage/contracts/auth';\nimport type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';\nimport { normalizeSecretRef } from '@ankhorage/contracts/secrets';\n\nexport function collectMissingAuthReadinessRequirements(input: {\n  readonly callbackRoute: unknown;\n  readonly credentialsRef: unknown;\n  readonly plan: AuthOAuthSetupPlan;\n  readonly target: AppDeployTargetId;\n  readonly targets: AppDeployTargets;\n}): readonly string[] {\n  const missing: string[] = [];\n  if (requiresTrustedCredential(input.plan) && !hasCanonicalCredentialRef(input.credentialsRef)) {\n    missing.push('credential reference');\n  }\n\n  const callbackRequired = input.plan.requirements.some(\n    (requirement) =>\n      requirement.kind === 'callback' &&\n      requirement.role === 'app' &&\n      requirement.required &&\n      requirement.target === input.target,\n  );\n  if (!callbackRequired) return missing;\n\n  if (!isAbsoluteRoute(input.callbackRoute)) missing.push('callback route');\n  if (input.target !== 'web' && input.targets[input.target]?.scheme === undefined) {\n    missing.push(`${input.target} deep-link scheme`);\n  }\n  return missing;\n}\n\nfunction requiresTrustedCredential(plan: AuthOAuthSetupPlan): boolean {\n  return plan.requirements.some(\n    (requirement) =>\n      requirement.kind === 'field' &&\n      requirement.required &&\n      requirement.persistence === 'trustedCredential',\n  );\n}\n\nfunction hasCanonicalCredentialRef(value: unknown): boolean {\n  if (typeof value !== 'string') return false;\n  const result = normalizeSecretRef(value);\n  return result.ok && result.data === value;\n}\n\nfunction isAbsoluteRoute(value: unknown): boolean {\n  return typeof value === 'string' && value.trim().startsWith('/') && value.trim().length > 0;\n}\n"]}

package/dist/authReadinessTargetFallback.d.ts

@@ -0,0 +1,3 @@
+import type { AuthReadinessTargetResolution } from './authReadinessTargetResolution.js';
+export declare function resolveAuthReadinessTargetFallback(deploy: unknown, manifestPath: string): AuthReadinessTargetResolution;
+//# sourceMappingURL=authReadinessTargetFallback.d.ts.map

package/dist/authReadinessTargetFallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargetFallback.d.ts","sourceRoot":"","sources":["../src/authReadinessTargetFallback.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAExF,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,MAAM,GACnB,6BAA6B,CA+B/B"}

package/dist/authReadinessTargetFallback.js

@@ -0,0 +1,32 @@
+import { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';
+export function resolveAuthReadinessTargetFallback(deploy, manifestPath) {
+    if (deploy === undefined) {
+        return {
+            diagnostics: [
+                createAuthReadinessDiagnostic({
+                    code: 'field-missing',
+                    message: 'deploy.targets is missing; Doctor evaluates legacy Web-only readiness until canonical targets are persisted.',
+                    path: manifestPath,
+                    ruleId: 'manifest.deploy.targets.legacy-web',
+                    severity: 'warning',
+                }),
+            ],
+            enabledTargets: ['web'],
+            targets: { web: { enabled: true } },
+        };
+    }
+    return {
+        diagnostics: [
+            createAuthReadinessDiagnostic({
+                code: 'field-invalid',
+                message: 'manifest.deploy must match the canonical Contracts deploy target model.',
+                path: manifestPath,
+                ruleId: 'manifest.deploy.valid-shape',
+                severity: 'error',
+            }),
+        ],
+        enabledTargets: [],
+        targets: null,
+    };
+}
+//# sourceMappingURL=authReadinessTargetFallback.js.map

package/dist/authReadinessTargetFallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargetFallback.js","sourceRoot":"","sources":["../src/authReadinessTargetFallback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAG7E,MAAM,UAAU,kCAAkC,CAChD,MAAe,EACf,YAAoB;IAEpB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,WAAW,EAAE;gBACX,6BAA6B,CAAC;oBAC5B,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,8GAA8G;oBAChH,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,oCAAoC;oBAC5C,QAAQ,EAAE,SAAS;iBACpB,CAAC;aACH;YACD,cAAc,EAAE,CAAC,KAAK,CAAC;YACvB,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,6BAA6B,CAAC;gBAC5B,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,yEAAyE;gBAClF,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,6BAA6B;gBACrC,QAAQ,EAAE,OAAO;aAClB,CAAC;SACH;QACD,cAAc,EAAE,EAAE;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC","sourcesContent":["import { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';\nimport type { AuthReadinessTargetResolution } from './authReadinessTargetResolution.js';\n\nexport function resolveAuthReadinessTargetFallback(\n  deploy: unknown,\n  manifestPath: string,\n): AuthReadinessTargetResolution {\n  if (deploy === undefined) {\n    return {\n      diagnostics: [\n        createAuthReadinessDiagnostic({\n          code: 'field-missing',\n          message:\n            'deploy.targets is missing; Doctor evaluates legacy Web-only readiness until canonical targets are persisted.',\n          path: manifestPath,\n          ruleId: 'manifest.deploy.targets.legacy-web',\n          severity: 'warning',\n        }),\n      ],\n      enabledTargets: ['web'],\n      targets: { web: { enabled: true } },\n    };\n  }\n\n  return {\n    diagnostics: [\n      createAuthReadinessDiagnostic({\n        code: 'field-invalid',\n        message: 'manifest.deploy must match the canonical Contracts deploy target model.',\n        path: manifestPath,\n        ruleId: 'manifest.deploy.valid-shape',\n        severity: 'error',\n      }),\n    ],\n    enabledTargets: [],\n    targets: null,\n  };\n}\n"]}

package/dist/authReadinessTargetResolution.d.ts

@@ -0,0 +1,8 @@
+import type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';
+import type { DoctorDiagnostic } from './diagnostics.js';
+export interface AuthReadinessTargetResolution {
+    readonly diagnostics: readonly DoctorDiagnostic[];
+    readonly enabledTargets: readonly AppDeployTargetId[];
+    readonly targets: AppDeployTargets | null;
+}
+//# sourceMappingURL=authReadinessTargetResolution.d.ts.map

package/dist/authReadinessTargetResolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargetResolution.d.ts","sourceRoot":"","sources":["../src/authReadinessTargetResolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C"}

package/dist/authReadinessTargetResolution.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authReadinessTargetResolution.js.map

package/dist/authReadinessTargetResolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargetResolution.js","sourceRoot":"","sources":["../src/authReadinessTargetResolution.ts"],"names":[],"mappings":"","sourcesContent":["import type { AppDeployTargetId, AppDeployTargets } from '@ankhorage/contracts/deploy';\n\nimport type { DoctorDiagnostic } from './diagnostics.js';\n\nexport interface AuthReadinessTargetResolution {\n  readonly diagnostics: readonly DoctorDiagnostic[];\n  readonly enabledTargets: readonly AppDeployTargetId[];\n  readonly targets: AppDeployTargets | null;\n}\n"]}

package/dist/authReadinessTargets.d.ts

@@ -0,0 +1,3 @@
+import type { AuthReadinessTargetResolution } from './authReadinessTargetResolution.js';
+export declare function resolveAuthReadinessTargets(deploy: unknown, manifestPath: string): AuthReadinessTargetResolution;
+//# sourceMappingURL=authReadinessTargets.d.ts.map

package/dist/authReadinessTargets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargets.d.ts","sourceRoot":"","sources":["../src/authReadinessTargets.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAExF,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,MAAM,GACnB,6BAA6B,CAyB/B"}

package/dist/authReadinessTargets.js

@@ -0,0 +1,26 @@
+import { APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from '@ankhorage/contracts/deploy';
+import { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';
+import { resolveAuthReadinessTargetFallback } from './authReadinessTargetFallback.js';
+export function resolveAuthReadinessTargets(deploy, manifestPath) {
+    if (!isAppDeployManifest(deploy)) {
+        return resolveAuthReadinessTargetFallback(deploy, manifestPath);
+    }
+    const enabledTargets = APP_DEPLOY_TARGET_IDS.filter((target) => deploy.targets[target]?.enabled === true);
+    if (enabledTargets.length > 0) {
+        return { diagnostics: [], enabledTargets, targets: deploy.targets };
+    }
+    return {
+        diagnostics: [
+            createAuthReadinessDiagnostic({
+                code: 'field-missing',
+                message: 'manifest.deploy.targets must enable at least one application target.',
+                path: manifestPath,
+                ruleId: 'manifest.deploy.targets.enabled',
+                severity: 'error',
+            }),
+        ],
+        enabledTargets,
+        targets: deploy.targets,
+    };
+}
+//# sourceMappingURL=authReadinessTargets.js.map

package/dist/authReadinessTargets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessTargets.js","sourceRoot":"","sources":["../src/authReadinessTargets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAGtF,MAAM,UAAU,2BAA2B,CACzC,MAAe,EACf,YAAoB;IAEpB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,kCAAkC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CACrD,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,6BAA6B,CAAC;gBAC5B,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,sEAAsE;gBAC/E,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,iCAAiC;gBACzC,QAAQ,EAAE,OAAO;aAClB,CAAC;SACH;QACD,cAAc;QACd,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC","sourcesContent":["import { APP_DEPLOY_TARGET_IDS, isAppDeployManifest } from '@ankhorage/contracts/deploy';\n\nimport { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';\nimport { resolveAuthReadinessTargetFallback } from './authReadinessTargetFallback.js';\nimport type { AuthReadinessTargetResolution } from './authReadinessTargetResolution.js';\n\nexport function resolveAuthReadinessTargets(\n  deploy: unknown,\n  manifestPath: string,\n): AuthReadinessTargetResolution {\n  if (!isAppDeployManifest(deploy)) {\n    return resolveAuthReadinessTargetFallback(deploy, manifestPath);\n  }\n\n  const enabledTargets = APP_DEPLOY_TARGET_IDS.filter(\n    (target) => deploy.targets[target]?.enabled === true,\n  );\n  if (enabledTargets.length > 0) {\n    return { diagnostics: [], enabledTargets, targets: deploy.targets };\n  }\n\n  return {\n    diagnostics: [\n      createAuthReadinessDiagnostic({\n        code: 'field-missing',\n        message: 'manifest.deploy.targets must enable at least one application target.',\n        path: manifestPath,\n        ruleId: 'manifest.deploy.targets.enabled',\n        severity: 'error',\n      }),\n    ],\n    enabledTargets,\n    targets: deploy.targets,\n  };\n}\n"]}

package/dist/authReadinessUnsupported.d.ts

@@ -0,0 +1,13 @@
+import type { AppDeployEnvironmentId, AppDeployTargetId } from '@ankhorage/contracts/deploy';
+import type { DoctorDiagnostic } from './diagnostics.js';
+import type { DoctorReadiness } from './readiness.js';
+export declare function createUnsupportedAuthReadiness(input: {
+    readonly environment: AppDeployEnvironmentId;
+    readonly provider: string;
+    readonly targets: readonly AppDeployTargetId[];
+}): DoctorReadiness[];
+export declare function createUnsupportedAuthDiagnostic(input: {
+    readonly message: string;
+    readonly path: string;
+}): DoctorDiagnostic;
+//# sourceMappingURL=authReadinessUnsupported.d.ts.map

package/dist/authReadinessUnsupported.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessUnsupported.d.ts","sourceRoot":"","sources":["../src/authReadinessUnsupported.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAChD,GAAG,eAAe,EAAE,CAUpB;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,gBAAgB,CAQnB"}

package/dist/authReadinessUnsupported.js

@@ -0,0 +1,22 @@
+import { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';
+export function createUnsupportedAuthReadiness(input) {
+    return input.targets.map((target) => ({
+        category: 'auth-oauth',
+        environment: input.environment,
+        message: 'The selected backend/provider/transport combination has no setup capability.',
+        provider: input.provider,
+        status: 'unsupported',
+        target,
+        transport: 'brokeredRedirect',
+    }));
+}
+export function createUnsupportedAuthDiagnostic(input) {
+    return createAuthReadinessDiagnostic({
+        code: 'field-invalid',
+        message: input.message,
+        path: input.path,
+        ruleId: 'manifest.auth.oauth.setup.supported',
+        severity: 'error',
+    });
+}
+//# sourceMappingURL=authReadinessUnsupported.js.map

package/dist/authReadinessUnsupported.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessUnsupported.js","sourceRoot":"","sources":["../src/authReadinessUnsupported.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAI7E,MAAM,UAAU,8BAA8B,CAAC,KAI9C;IACC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpC,QAAQ,EAAE,YAAY;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,aAAa;QACrB,MAAM;QACN,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAG/C;IACC,OAAO,6BAA6B,CAAC;QACnC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,qCAAqC;QAC7C,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AppDeployEnvironmentId, AppDeployTargetId } from '@ankhorage/contracts/deploy';\n\nimport { createAuthReadinessDiagnostic } from './authReadinessDiagnostic.js';\nimport type { DoctorDiagnostic } from './diagnostics.js';\nimport type { DoctorReadiness } from './readiness.js';\n\nexport function createUnsupportedAuthReadiness(input: {\n  readonly environment: AppDeployEnvironmentId;\n  readonly provider: string;\n  readonly targets: readonly AppDeployTargetId[];\n}): DoctorReadiness[] {\n  return input.targets.map((target) => ({\n    category: 'auth-oauth',\n    environment: input.environment,\n    message: 'The selected backend/provider/transport combination has no setup capability.',\n    provider: input.provider,\n    status: 'unsupported',\n    target,\n    transport: 'brokeredRedirect',\n  }));\n}\n\nexport function createUnsupportedAuthDiagnostic(input: {\n  readonly message: string;\n  readonly path: string;\n}): DoctorDiagnostic {\n  return createAuthReadinessDiagnostic({\n    code: 'field-invalid',\n    message: input.message,\n    path: input.path,\n    ruleId: 'manifest.auth.oauth.setup.supported',\n    severity: 'error',\n  });\n}\n"]}

package/dist/authReadinessUnsupportedBackend.d.ts

@@ -0,0 +1,12 @@
+import type { AppDeployTargetId } from '@ankhorage/contracts/deploy';
+import type { DoctorDiagnostic } from './diagnostics.js';
+import type { DoctorReadiness } from './readiness.js';
+export declare function analyzeUnsupportedAuthBackend(input: {
+    readonly enabledTargets: readonly AppDeployTargetId[];
+    readonly manifestPath: string;
+    readonly provider: string;
+}): {
+    readonly diagnostics: readonly DoctorDiagnostic[];
+    readonly readiness: readonly DoctorReadiness[];
+};
+//# sourceMappingURL=authReadinessUnsupportedBackend.d.ts.map

package/dist/authReadinessUnsupportedBackend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessUnsupportedBackend.d.ts","sourceRoot":"","sources":["../src/authReadinessUnsupportedBackend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAOrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,cAAc,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GAAG;IACF,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD,CAgBA"}

package/dist/authReadinessUnsupportedBackend.js

@@ -0,0 +1,18 @@
+import { APP_DEPLOY_ENVIRONMENT_IDS } from '@ankhorage/contracts/deploy';
+import { createUnsupportedAuthDiagnostic, createUnsupportedAuthReadiness, } from './authReadinessUnsupported.js';
+export function analyzeUnsupportedAuthBackend(input) {
+    return {
+        diagnostics: [
+            createUnsupportedAuthDiagnostic({
+                message: 'Configured OAuth backend has no Doctor setup resolver.',
+                path: input.manifestPath,
+            }),
+        ],
+        readiness: APP_DEPLOY_ENVIRONMENT_IDS.flatMap((environment) => createUnsupportedAuthReadiness({
+            environment,
+            provider: input.provider,
+            targets: input.enabledTargets,
+        })),
+    };
+}
+//# sourceMappingURL=authReadinessUnsupportedBackend.js.map

package/dist/authReadinessUnsupportedBackend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authReadinessUnsupportedBackend.js","sourceRoot":"","sources":["../src/authReadinessUnsupportedBackend.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AAIvC,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IAIC,OAAO;QACL,WAAW,EAAE;YACX,+BAA+B,CAAC;gBAC9B,OAAO,EAAE,wDAAwD;gBACjE,IAAI,EAAE,KAAK,CAAC,YAAY;aACzB,CAAC;SACH;QACD,SAAS,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5D,8BAA8B,CAAC;YAC7B,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,cAAc;SAC9B,CAAC,CACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { AppDeployTargetId } from '@ankhorage/contracts/deploy';\nimport { APP_DEPLOY_ENVIRONMENT_IDS } from '@ankhorage/contracts/deploy';\n\nimport {\n  createUnsupportedAuthDiagnostic,\n  createUnsupportedAuthReadiness,\n} from './authReadinessUnsupported.js';\nimport type { DoctorDiagnostic } from './diagnostics.js';\nimport type { DoctorReadiness } from './readiness.js';\n\nexport function analyzeUnsupportedAuthBackend(input: {\n  readonly enabledTargets: readonly AppDeployTargetId[];\n  readonly manifestPath: string;\n  readonly provider: string;\n}): {\n  readonly diagnostics: readonly DoctorDiagnostic[];\n  readonly readiness: readonly DoctorReadiness[];\n} {\n  return {\n    diagnostics: [\n      createUnsupportedAuthDiagnostic({\n        message: 'Configured OAuth backend has no Doctor setup resolver.',\n        path: input.manifestPath,\n      }),\n    ],\n    readiness: APP_DEPLOY_ENVIRONMENT_IDS.flatMap((environment) =>\n      createUnsupportedAuthReadiness({\n        environment,\n        provider: input.provider,\n        targets: input.enabledTargets,\n      }),\n    ),\n  };\n}\n"]}

package/dist/bunPolicyAnalysis.d.ts

@@ -0,0 +1,3 @@
+import type { DoctorAnalysisResult } from './analysis.js';
+export declare function applyBunRuntimePolicy(result: DoctorAnalysisResult): Promise<DoctorAnalysisResult>;
+//# sourceMappingURL=bunPolicyAnalysis.d.ts.map

package/dist/bunPolicyAnalysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bunPolicyAnalysis.d.ts","sourceRoot":"","sources":["../src/bunPolicyAnalysis.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAuB1D,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAmB/B"}

package/dist/bunPolicyAnalysis.js

@@ -0,0 +1,190 @@
+import { promises as fs } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+const DEVTOOLS_POLICY_SPECIFIER = '@ankhorage/devtools/policy';
+const REPAIR_HINT = 'Run "ankh devtools sync" to repair the managed Bun state.';
+const BUN_VERSION_PATTERN = /^\s*bun-version:\s*['"]?([^'"\s#]+)['"]?\s*(?:#.*)?$/mu;
+const WORKFLOWS = [
+    {
+        relativePath: path.join('.github', 'workflows', 'ci.yml'),
+        ruleId: 'repo.workflows.ci.bun-policy',
+    },
+    {
+        relativePath: path.join('.github', 'workflows', 'release.yml'),
+        ruleId: 'repo.workflows.release.bun-policy',
+    },
+];
+export async function applyBunRuntimePolicy(result) {
+    if (result.profile !== 'public-package' || !result.hasPackageJson) {
+        return result;
+    }
+    const policy = await loadTargetBunRuntimePolicy(result.targetPath);
+    const packageJsonPath = path.join(result.targetPath, 'package.json');
+    const packageJson = await readPackageJson(packageJsonPath);
+    if (policy === null || packageJson === null) {
+        return result;
+    }
+    const diagnostics = [
+        ...result.diagnostics,
+        ...analyzePackageBunPolicy(packageJson, packageJsonPath, result, policy),
+        ...(await analyzeWorkflowBunPolicy(result, policy)),
+    ];
+    return withDiagnostics(result, diagnostics);
+}
+async function loadTargetBunRuntimePolicy(targetPath) {
+    const requireFromTarget = createRequire(path.join(targetPath, 'package.json'));
+    try {
+        const modulePath = requireFromTarget.resolve(DEVTOOLS_POLICY_SPECIFIER);
+        const importedModule = (await import(pathToFileURL(modulePath).href));
+        return parseBunRuntimePolicy(importedModule);
+    }
+    catch (error) {
+        if (isUnavailablePolicyError(error)) {
+            return null;
+        }
+        throw error;
+    }
+}
+function analyzePackageBunPolicy(packageJson, packageJsonPath, result, policy) {
+    const diagnostics = [];
+    const { packageManager } = packageJson;
+    if (isNonEmptyString(packageManager) && packageManager.startsWith('bun@')) {
+        pushMismatch(diagnostics, {
+            actual: packageManager,
+            expected: policy.packageManager,
+            location: 'package.json#packageManager',
+            path: packageJsonPath,
+            profile: result.profile,
+            ruleId: 'package.json.package-manager.policy',
+        });
+    }
+    const devDependencies = isRecord(packageJson.devDependencies)
+        ? packageJson.devDependencies
+        : null;
+    const bunTypes = devDependencies?.['@types/bun'];
+    if (isNonEmptyString(bunTypes)) {
+        pushMismatch(diagnostics, {
+            actual: bunTypes,
+            expected: policy.typesRange,
+            location: 'package.json#devDependencies.@types/bun',
+            path: packageJsonPath,
+            profile: result.profile,
+            ruleId: 'package.dependencies.types-bun.policy',
+        });
+    }
+    return diagnostics;
+}
+async function analyzeWorkflowBunPolicy(result, policy) {
+    const diagnostics = await Promise.all(WORKFLOWS.map(async (workflow) => await analyzeWorkflow(result, workflow, policy)));
+    return diagnostics.flat();
+}
+async function analyzeWorkflow(result, workflow, policy) {
+    const workflowPath = path.join(result.targetPath, workflow.relativePath);
+    const contents = await readTextOrNull(workflowPath);
+    if (contents === null) {
+        return [createWorkflowDiagnostic(result, workflow, policy, workflowPath, 'missing-path')];
+    }
+    const match = BUN_VERSION_PATTERN.exec(contents);
+    const actual = match?.[1];
+    if (!isNonEmptyString(actual)) {
+        return [createWorkflowDiagnostic(result, workflow, policy, workflowPath, 'field-missing')];
+    }
+    const diagnostics = [];
+    pushMismatch(diagnostics, {
+        actual,
+        expected: policy.version,
+        location: `${workflow.relativePath}#bun-version`,
+        path: workflowPath,
+        profile: result.profile,
+        ruleId: workflow.ruleId,
+    });
+    return diagnostics;
+}
+function createWorkflowDiagnostic(result, workflow, policy, workflowPath, code) {
+    const detail = code === 'missing-path'
+        ? `Managed workflow is missing: ${workflow.relativePath}.`
+        : `${workflow.relativePath} does not define bun-version.`;
+    return {
+        code,
+        message: `${detail} Expected Bun ${policy.version}. ${REPAIR_HINT}`,
+        path: workflowPath,
+        profile: result.profile,
+        ruleId: workflow.ruleId,
+        severity: 'error',
+    };
+}
+function pushMismatch(diagnostics, input) {
+    if (input.actual === input.expected) {
+        return;
+    }
+    diagnostics.push({
+        code: 'field-invalid',
+        message: `Bun policy drift at ${input.location}: expected "${input.expected}", found "${input.actual}". ${REPAIR_HINT}`,
+        path: input.path,
+        profile: input.profile,
+        ruleId: input.ruleId,
+        severity: 'error',
+    });
+}
+function parseBunRuntimePolicy(importedModule) {
+    if (!isRecord(importedModule) || !isRecord(importedModule.bunRuntimePolicy)) {
+        return null;
+    }
+    const { packageManager, typesRange, version } = importedModule.bunRuntimePolicy;
+    return isNonEmptyString(packageManager) &&
+        isNonEmptyString(typesRange) &&
+        isNonEmptyString(version)
+        ? { packageManager, typesRange, version }
+        : null;
+}
+function withDiagnostics(result, diagnostics) {
+    return {
+        ...result,
+        diagnostics,
+        fixPlan: result.fixPlan === null ? null : { ...result.fixPlan, diagnostics },
+    };
+}
+async function readPackageJson(packageJsonPath) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readTextOrNull(filePath) {
+    try {
+        return await fs.readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+function isUnavailablePolicyError(error) {
+    if (isNodeError(error) &&
+        (error.code === 'MODULE_NOT_FOUND' ||
+            error.code === 'ERR_MODULE_NOT_FOUND' ||
+            error.code === 'ERR_PACKAGE_PATH_NOT_EXPORTED')) {
+        return true;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return (message.includes(DEVTOOLS_POLICY_SPECIFIER) &&
+        (message.includes('Cannot find module') ||
+            message.includes('not exported') ||
+            message.includes('Package subpath')));
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim() !== '';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNodeError(error) {
+    return error instanceof Error && 'code' in error;
+}
+//# sourceMappingURL=bunPolicyAnalysis.js.map