@camstack/addon-auth 1.2.137 → 1.2.140

package/dist/{dist-Q8DExvTl.mjs → dist-BOK-Ox5c.mjs}

@@ -18246,14 +18246,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$2
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19382,7 +19382,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19419,7 +19419,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22718,6 +22718,77 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+var oidcConnectionsCapability = {
+	name: "oidc-connections",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Form fields for Add/Edit (ConfigFormBuilder). */
+		connectionFormSchema: method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }),
+		listConnections: method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create a row with the operator-chosen URL slug. Credentials follow via
+		* `updateConnection` (same Save path as Training Providers).
+		*/
+		createConnection: method(object({
+			id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+			displayName: string().min(1)
+		}), object({ id: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateConnection: method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteConnection: method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -44093,6 +44164,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -52874,4 +52975,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { buildAddonRouteProvider as a, userPasskeysCapability as c, array as d, boolean as f, string as h, authProviderCapability as i, errMsg as l, object as m, addonRoutesCapability as n, isDisplayIconKey as o, number as p, addonWidgetsSourceCapability as r, loginMethodCapability as s, SSO_STATE_COOKIE as t, BaseAddon as u };
+export { string as S, toSecretFieldView as _, buildAddonRouteProvider as a, number as b, oidcConnectionsCapability as c, BaseAddon as d, SECRET_CLEAR as f, isSecretMarker as g, isSecretClear as h, authProviderCapability as i, userPasskeysCapability as l, globalSecretScope as m, addonRoutesCapability as n, isDisplayIconKey as o, arrayItemFieldPath as p, addonWidgetsSourceCapability as r, loginMethodCapability as s, SSO_STATE_COOKIE as t, errMsg as u, array as v, object as x, boolean as y };

package/dist/{dist-C3Gd6eZD.js → dist-CiG_dP05.js}

@@ -18280,14 +18280,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$2
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19416,7 +19416,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19453,7 +19453,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22752,6 +22752,77 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+var oidcConnectionsCapability = {
+	name: "oidc-connections",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Form fields for Add/Edit (ConfigFormBuilder). */
+		connectionFormSchema: method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }),
+		listConnections: method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create a row with the operator-chosen URL slug. Credentials follow via
+		* `updateConnection` (same Save path as Training Providers).
+		*/
+		createConnection: method(object({
+			id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+			displayName: string().min(1)
+		}), object({ id: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateConnection: method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteConnection: method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -44127,6 +44198,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -52914,6 +53015,12 @@ Object.defineProperty(exports, "BaseAddon", {
 		return BaseAddon;
 	}
 });
+Object.defineProperty(exports, "SECRET_CLEAR", {
+	enumerable: true,
+	get: function() {
+		return SECRET_CLEAR;
+	}
+});
 Object.defineProperty(exports, "SSO_STATE_COOKIE", {
 	enumerable: true,
 	get: function() {
@@ -52968,6 +53075,12 @@ Object.defineProperty(exports, "array", {
 		return array;
 	}
 });
+Object.defineProperty(exports, "arrayItemFieldPath", {
+	enumerable: true,
+	get: function() {
+		return arrayItemFieldPath;
+	}
+});
 Object.defineProperty(exports, "authProviderCapability", {
 	enumerable: true,
 	get: function() {
@@ -52992,12 +53105,30 @@ Object.defineProperty(exports, "errMsg", {
 		return errMsg;
 	}
 });
+Object.defineProperty(exports, "globalSecretScope", {
+	enumerable: true,
+	get: function() {
+		return globalSecretScope;
+	}
+});
 Object.defineProperty(exports, "isDisplayIconKey", {
 	enumerable: true,
 	get: function() {
 		return isDisplayIconKey;
 	}
 });
+Object.defineProperty(exports, "isSecretClear", {
+	enumerable: true,
+	get: function() {
+		return isSecretClear;
+	}
+});
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
 Object.defineProperty(exports, "loginMethodCapability", {
 	enumerable: true,
 	get: function() {
@@ -53016,12 +53147,24 @@ Object.defineProperty(exports, "object", {
 		return object;
 	}
 });
+Object.defineProperty(exports, "oidcConnectionsCapability", {
+	enumerable: true,
+	get: function() {
+		return oidcConnectionsCapability;
+	}
+});
 Object.defineProperty(exports, "string", {
 	enumerable: true,
 	get: function() {
 		return string;
 	}
 });
+Object.defineProperty(exports, "toSecretFieldView", {
+	enumerable: true,
+	get: function() {
+		return toSecretFieldView;
+	}
+});
 Object.defineProperty(exports, "userPasskeysCapability", {
 	enumerable: true,
 	get: function() {