@chipmobilesdk/rn-auth 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,116 @@
 # @chipmobilesdk/rn-auth
 
+## 0.6.0
+
+### Minor Changes
+
+- Every peer range has an upper bound, and no package declares a peer it does not use. ([#21](https://github.com/operationd8979/chip-mobile-sdk/pull/21))
+
+  A peer range is now a caret, a tilde or an explicit `<`, except for `react` and
+  `react-native`: an app brings exactly one of each, so a floor is the only useful thing
+  to say about them. Every other peer is a library the app installs beside us, and an
+  open `>=` was a promise about versions nobody had run — mmkv 3→4 lost entitlements and
+  pending purchases exactly that way.
+
+  **Four of the new ceilings exclude a version that is already published**, so an app
+  that took the open range at its word may now see a peer warning. The new bound is the
+  major this release is tested against, which is the thing the old range failed to say:
+
+  | Peer | Was | Now | Published above the ceiling |
+  |---|---|---|---|
+  | `react-native-app-auth` (rn-auth) | `>=8` | `^8.0.0` | 9.0.0 |
+  | `react-native-keychain` (rn-auth) | `>=10` | `^10.0.0` | 11.0.0 |
+  | `@op-engineering/op-sqlite` (rn-local-db) | `>=17.1.0` | `^17.1.0` | 18.x, 19.x |
+  | `@react-native-firebase/messaging` (rn-notification) | `>=26.0.0` | `^26.0.0` | 27.x |
+
+  The others — `react-native-vision-camera` `^5.1.1`, `react-native-svg` `^15.15.0`,
+  `react-native-unistyles` `^3.2.0`, `@dr.pogodin/react-native-fs` `^2.39.2`,
+  `react-native-quick-crypto` `^1.0.0`, `react-native-notify-kit` `^10.5.0`,
+  `react-native-localize` `^3.7.0`, `react-native-mmkv` `^4.0.0` — exclude nothing that
+  exists today. rn-payment's mmkv range was already bounded (`>=4.0.0 <5`) and is now
+  written as the caret that means the same thing.
+
+  Peers nothing imports are gone. `rn-theme`, `rn-local-db` and `rn-notification` asked
+  for `react` without having a component or a hook between them; `rn-auth`, `rn-ai` and
+  `rn-i18n` asked for `react-native` without touching a React Native API (rn-auth reaches
+  both native modules through `lazyPeer`, rn-i18n formats on `Intl`); `rn-notification`
+  asked for `@react-native-firebase/app`, which messaging declares itself. `rn-ai` no
+  longer peers on `@chipmobilesdk/rn-auth` at all — it asks for a `TokenProvider`, a
+  two-method interface rn-auth's `auth` satisfies, so an app with its own token source
+  installs nothing extra. An app that enables push or signs in through rn-auth installs
+  the same packages as before; it is the manifest that stopped overstating.
+
+  `react-native-localize` is declared optional, which is what the code already did: the
+  time-zone reader goes through `lazyPeer` and falls back to `Intl` without it. The
+  `peerDependenciesMeta` entries that said `optional: false` are gone — that is npm's
+  default, and writing it down only invited the question of which peers were undecided.
+
+  `npm run check:manifests` now fails on an unbounded peer range, a peer nothing in
+  `src/` imports, and a `peerDependenciesMeta` entry for either, so the policy holds
+  without anyone remembering it.
+
+- Every package now ships built JavaScript with declaration files, instead of asking the
+  app to compile its TypeScript. ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22))
+
+  Each tarball carries `lib/commonjs`, `lib/module` and `lib/typescript` (built with
+  `react-native-builder-bob`), and `src/` alongside them. What that changes for a
+  consumer:
+
+  - **Nothing to add to `transformIgnorePatterns`.** `require` resolves to the CommonJS
+    build, so an app's Jest loads this package without being told to transform it. That
+    was the one thing every consuming app had to know about us (DEP-04).
+  - **Typechecking reads our `.d.ts`** rather than compiling our source under our
+    `tsconfig`. A consumer's stricter — or looser — settings no longer meet our code.
+  - **`import` resolves to ESM**, so a bundler can tree-shake what it does not use.
+
+  No exported name changed, and no subpath moved: `.`, `./testing`, `./push`,
+  `./advanced`, `./app-auth`, `./keychain` and rn-core's twelve subpaths resolve exactly
+  as before, each now with its own declarations for both module systems. publint and
+  `attw --profile node16` pass on all twelve packages, which they could not before.
+
+  Inside the monorepo nothing changed either, and that is deliberate: every subpath also
+  declares a private `chipmobilesdk-source` condition pointing at its TypeScript, and
+  Metro, Jest and `tsc` here ask for that condition first. The demo app bundles 371
+  modules straight from `packages/*/src`, so editing a package still changes the app with
+  no build step, and coverage is still measured on the source. The condition is named for
+  this organization rather than using the conventional `source` because third-party
+  packages declare that one too — `@dr.pogodin/react-native-fs` does — and asking for it
+  pulled their sources into our stricter compile.
+
+  `npm run build:packages` builds everything, `prepack` rebuilds before any `npm pack`,
+  and `lib/` is git-ignored: the published bytes are produced by the release, never
+  committed. `npm run check:manifests` now fails a package whose `main`, `module`,
+  `types`, `source` condition, `files`, build script or `prepack` do not match this shape.
+
+### Patch Changes
+
+- Each package's public API and its weight are now recorded in the repository, so a change
+  to either is reviewed rather than discovered. ([#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23))
+
+  `packages/<pkg>/etc/*.api.md` is an api-extractor report per entrypoint — twenty-seven
+  of them, generated from the declarations the package publishes and committed. A renamed
+  type, a widened union, one more optional field: all of it shows up in a pull request's
+  diff. `npm run check:api` fails when a report is out of date and `npm run api:update`
+  rewrites them.
+
+  A report that moves now needs a **minor or major** changeset for that package.
+  `check:changesets` enforces it, because the report is generated from what the package
+  publishes, and a patch release that moves the public surface is how a consumer's build
+  breaks on `npm update`. A report added for the first time is a baseline, not a change.
+  `./testing` deliberately has no report: test doubles are not a surface a release is
+  gated on.
+
+  `npm run check:size` holds every entrypoint to a budget in `.size-limit.json`, measured
+  on the ESM build with peers and rn-core treated as external — they are what an app
+  installs beside us, not our weight. Each budget started at today's measurement plus five
+  per cent, so growth becomes a decision someone makes instead of a drift nobody sees. The
+  current figures run from 500 B (`rn-core/lazy`) to 19 kB (rn-notification).
+
+  No behaviour or API changed in this release; the entry is here so the changelog records
+  when the reports and the budgets began.
+- Updated dependencies ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22), [#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23)):
+  - @chipmobilesdk/rn-core@0.2.0
+
 ## 0.5.0
 
 ### Minor Changes

package/README.md

@@ -30,9 +30,12 @@ npm install @chipmobilesdk/rn-auth react-native-app-auth react-native-keychain
 cd ios && pod install
 ```
 
-`react`, `react-native`, `react-native-app-auth`, and `react-native-keychain`
-are **peer dependencies**. The two native libraries are only required by the
-default adapters — an app injecting custom ports may omit them.
+`react`, `react-native-app-auth` (`^8.0.0`) and `react-native-keychain`
+(`^10.0.0`) are the **peer dependencies**. The two native libraries are only
+required by the default adapters — an app injecting custom ports may omit them,
+and they are declared optional for that reason. There is no `react-native` peer:
+the controller is plain TypeScript, and both native modules are reached through
+`lazyPeer`.
 
 See [native setup](../../specs/003-mobile-entra-auth/contracts/native-setup.md)
 for the iOS `Info.plist` URL scheme and the Android `appAuthRedirectScheme`
@@ -259,8 +262,8 @@ adapters; run them against a store or client you inject.
 
 ## Compatibility and validation
 
-React ≥19 · React Native ≥0.85 · `react-native-app-auth` ≥8 ·
-`react-native-keychain` ≥10 · iOS + Android · Node ≥22.11 for tooling.
+React ≥19 · React Native ≥0.85 · `react-native-app-auth` `^8.0.0` ·
+`react-native-keychain` `^10.0.0` · iOS + Android · Node ≥22.11 for tooling.
 
 The demo integration lives in `src/screens/AuthDemoScreen.tsx`. Run from the
 repository root:

package/lib/commonjs/access/accessTier.js

@@ -0,0 +1,111 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.evaluateAccessTier = evaluateAccessTier;
+exports.failClosedTier = failClosedTier;
+/**
+ * Access-tier evaluation (FR-010/FR-011/FR-019/FR-020, R6).
+ *
+ * Pure function over the authenticated token's claims and the app-specific
+ * mapping. Object ids are authoritative; display names never grant access.
+ * Missing, stale, ambiguous, or group-overage claims fail closed (premium
+ * denied, verification = 'unverified').
+ */
+
+/** The fail-closed default: free + unverified. */
+function failClosedTier() {
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'unverified'
+  };
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter(entry => typeof entry === 'string');
+  }
+  if (typeof value === 'string') {
+    return [value];
+  }
+  return [];
+}
+
+/**
+ * Entra emits a groups overage indicator (`_claim_names.groups` or `hasgroups`)
+ * instead of inline groups when the list is too large. Reading the full list
+ * would require Graph (out of scope, FR-012), so overage fails closed.
+ */
+function hasGroupOverage(claims) {
+  if (claims.hasgroups === true) {
+    return true;
+  }
+  const claimNames = claims._claim_names;
+  if (claimNames && typeof claimNames === 'object' && 'groups' in claimNames) {
+    return true;
+  }
+  return false;
+}
+function matchesClaim(claims, matcher) {
+  const value = claims[matcher.claim];
+  if (Array.isArray(value)) {
+    return value.includes(matcher.equals);
+  }
+  return value === matcher.equals;
+}
+
+/** Evaluate the access tier, failing closed when entitlement is unverifiable. */
+function evaluateAccessTier(claims, mapping, now = Date.now()) {
+  // Object ids first (authoritative). Display names are never consulted.
+  const groups = toStringArray(claims.groups);
+  if (mapping.premiumGroupObjectIds.length > 0 && groups.some(group => mapping.premiumGroupObjectIds.includes(group))) {
+    return {
+      tier: 'premium',
+      source: 'group',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Roles next.
+  const roles = toStringArray(claims.roles);
+  if (mapping.premiumRoleNames?.length && roles.some(role => mapping.premiumRoleNames.includes(role))) {
+    return {
+      tier: 'premium',
+      source: 'role',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Custom claim matchers last.
+  if (mapping.premiumClaimMatchers?.some(matcher => matchesClaim(claims, matcher))) {
+    return {
+      tier: 'premium',
+      source: 'claim',
+      verification: 'verified',
+      lastRefreshAt: now
+    };
+  }
+
+  // No premium indicator matched. If group claims are unavailable due to
+  // overage and premium depends on groups, we cannot verify → fail closed.
+  if (mapping.premiumGroupObjectIds.length > 0 && hasGroupOverage(claims)) {
+    return {
+      tier: 'free',
+      source: 'default',
+      verification: 'unverified',
+      lastRefreshAt: now
+    };
+  }
+
+  // Verified free: claims were present and simply did not grant premium.
+  return {
+    tier: 'free',
+    source: 'default',
+    verification: 'verified',
+    lastRefreshAt: now
+  };
+}
+//# sourceMappingURL=accessTier.js.map

package/lib/commonjs/access/accessTier.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["failClosedTier","tier","source","verification","toStringArray","value","Array","isArray","filter","entry","hasGroupOverage","claims","hasgroups","claimNames","_claim_names","matchesClaim","matcher","claim","includes","equals","evaluateAccessTier","mapping","now","Date","groups","premiumGroupObjectIds","length","some","group","lastRefreshAt","roles","premiumRoleNames","role","premiumClaimMatchers"],"sourceRoot":"../../../src","sources":["access/accessTier.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACO,SAASA,cAAcA,CAAA,EAAe;EAC5C,OAAO;IAAEC,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE;EAAa,CAAC;AACvE;AAEA,SAASC,aAAaA,CAACC,KAAc,EAAY;EAChD,IAAIC,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACG,MAAM,CAAEC,KAAK,IAAsB,OAAOA,KAAK,KAAK,QAAQ,CAAC;EAC3E;EACA,IAAI,OAAOJ,KAAK,KAAK,QAAQ,EAAE;IAC9B,OAAO,CAACA,KAAK,CAAC;EACf;EACA,OAAO,EAAE;AACV;;AAEA;AACA;AACA;AACA;AACA;AACA,SAASK,eAAeA,CAACC,MAA+B,EAAW;EAClE,IAAIA,MAAM,CAACC,SAAS,KAAK,IAAI,EAAE;IAC9B,OAAO,IAAI;EACZ;EACA,MAAMC,UAAU,GAAGF,MAAM,CAACG,YAAmD;EAC7E,IAAID,UAAU,IAAI,OAAOA,UAAU,KAAK,QAAQ,IAAI,QAAQ,IAAIA,UAAU,EAAE;IAC3E,OAAO,IAAI;EACZ;EACA,OAAO,KAAK;AACb;AAEA,SAASE,YAAYA,CAACJ,MAA+B,EAAEK,OAAqB,EAAW;EACtF,MAAMX,KAAK,GAAGM,MAAM,CAACK,OAAO,CAACC,KAAK,CAAC;EACnC,IAAIX,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,EAAE;IACzB,OAAOA,KAAK,CAACa,QAAQ,CAACF,OAAO,CAACG,MAAM,CAAC;EACtC;EACA,OAAOd,KAAK,KAAKW,OAAO,CAACG,MAAM;AAChC;;AAEA;AACO,SAASC,kBAAkBA,CACjCT,MAA+B,EAC/BU,OAA0B,EAC1BC,GAAW,GAAGC,IAAI,CAACD,GAAG,CAAC,CAAC,EACX;EACb;EACA,MAAME,MAAM,GAAGpB,aAAa,CAACO,MAAM,CAACa,MAAM,CAAC;EAC3C,IACCH,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IACxCF,MAAM,CAACG,IAAI,CAACC,KAAK,IAAIP,OAAO,CAACI,qBAAqB,CAACP,QAAQ,CAACU,KAAK,CAAC,CAAC,EAClE;IACD,OAAO;MAAE3B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA,MAAMQ,KAAK,GAAG1B,aAAa,CAACO,MAAM,CAACmB,KAAK,CAAC;EACzC,IACCT,OAAO,CAACU,gBAAgB,EAAEL,MAAM,IAChCI,KAAK,CAACH,IAAI,CAACK,IAAI,IAAIX,OAAO,CAACU,gBAAgB,CAAEb,QAAQ,CAACc,IAAI,CAAC,CAAC,EAC3D;IACD,OAAO;MAAE/B,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,MAAM;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EACzF;;EAEA;EACA,IAAID,OAAO,CAACY,oBAAoB,EAAEN,IAAI,CAACX,OAAO,IAAID,YAAY,CAACJ,MAAM,EAAEK,OAAO,CAAC,CAAC,EAAE;IACjF,OAAO;MAAEf,IAAI,EAAE,SAAS;MAAEC,MAAM,EAAE,OAAO;MAAEC,YAAY,EAAE,UAAU;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC1F;;EAEA;EACA;EACA,IAAID,OAAO,CAACI,qBAAqB,CAACC,MAAM,GAAG,CAAC,IAAIhB,eAAe,CAACC,MAAM,CAAC,EAAE;IACxE,OAAO;MAAEV,IAAI,EAAE,MAAM;MAAEC,MAAM,EAAE,SAAS;MAAEC,YAAY,EAAE,YAAY;MAAE0B,aAAa,EAAEP;IAAI,CAAC;EAC3F;;EAEA;EACA,OAAO;IAAErB,IAAI,EAAE,MAAM;IAAEC,MAAM,EAAE,SAAS;IAAEC,YAAY,EAAE,UAAU;IAAE0B,aAAa,EAAEP;EAAI,CAAC;AACzF","ignoreList":[]}

package/lib/commonjs/app-auth.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "createAppAuthClient", {
+  enumerable: true,
+  get: function () {
+    return _authClient.createAppAuthClient;
+  }
+});
+var _authClient = require("./oidc/authClient.js");
+//# sourceMappingURL=app-auth.js.map

package/lib/commonjs/app-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_authClient","require"],"sourceRoot":"../../src","sources":["app-auth.ts"],"mappings":";;;;;;;;;;;AAKA,IAAAA,WAAA,GAAAC,OAAA","ignoreList":[]}

package/lib/commonjs/config/types.js

@@ -0,0 +1,50 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.DEVICE_PLATFORMS = void 0;
+/**
+ * Public type contracts for @chipmobilesdk/rn-auth. Shapes follow
+ * specs/003-mobile-entra-auth/data-model.md.
+ */
+
+/** The providers this package has copy for out of the box. */
+
+/**
+ * A provider id. Open on purpose: routing is `domain_hint` and nothing else, so
+ * adding an IdP the tenant federates — Microsoft account, an email one-time
+ * code — is a change to an app's config, not a release of this package
+ * (AUTH-14). `KnownProviderId` keeps the three familiar ones in autocomplete.
+ */
+
+const DEVICE_PLATFORMS = exports.DEVICE_PLATFORMS = ['ios', 'android'];
+
+/** Provider Setup Configuration — non-secret public values only (FR-016/FR-017). */
+
+/** One configured protected resource for delegated token requests (FR-007). */
+
+/** App-specific mapping from tenant indicators to access tiers (FR-019/FR-020). */
+
+/** App-supplied, public-only setup input (FR-015/FR-016/FR-017). */
+
+/** Advanced/testing options. `platform` overrides the detected device platform. */
+
+/** Customer User / app-visible profile (FR-006). */
+
+/** Access Tier — local interpretation of tenant indicators (FR-010). */
+
+/** Access Token Request result (FR-007). */
+
+/** Single active app-visible authenticated state (FR-005/FR-022). */
+
+/** Result of a premium-only gate check (US3). */
+
+/**
+ * What `signOutGlobal` did beyond the device (added in 0.2.2). Local state is
+ * cleared either way; `failed` means the tenant session may still be alive, so
+ * the next interactive sign-in can complete without a password prompt.
+ */
+
+/** The auth controller returned by `createAuth` (single active account). */
+//# sourceMappingURL=types.js.map

package/lib/commonjs/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DEVICE_PLATFORMS","exports"],"sourceRoot":"../../../src","sources":["config/types.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;;AAQA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAIO,MAAMA,gBAA2C,GAAAC,OAAA,CAAAD,gBAAA,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;;AAE7E;;AAoBA;;AAYA;;AAUA;;AAmBA;;AAiBA;;AAoBA;;AAUA;;AASA;;AASA;;AAMA;AACA;AACA;AACA;AACA;;AAOA","ignoreList":[]}

package/lib/commonjs/config/validateConfig.js

@@ -0,0 +1,114 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.validateConfig = validateConfig;
+var _types = require("./types.js");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+
+function hasScheme(url) {
+  return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url);
+}
+
+/** https, or http on a development machine. */
+function isSecureAuthority(url) {
+  if (/^https:/i.test(url)) {
+    return true;
+  }
+  return /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i.test(url);
+}
+function validateConfig(config) {
+  // Section A — tenant/client settings
+  if (!config.authority || !config.authority.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "authority"');
+  }
+  if (!hasScheme(config.authority)) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"authority" must be an absolute URL');
+  }
+  // Tokens travel over this. A tenant reachable over plaintext http is a
+  // configuration mistake, not a deployment choice — except on a dev machine.
+  if (!isSecureAuthority(config.authority)) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"authority" must use https (http is accepted only for localhost)');
+  }
+  if (!config.clientId || !config.clientId.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "clientId"');
+  }
+  if (!config.redirectUrl || !config.redirectUrl.trim()) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "redirectUrl"');
+  }
+  if (!hasScheme(config.redirectUrl)) {
+    throw new _errors.AuthConfigError('auth.error.redirectMismatch', '"redirectUrl" must include a scheme matching the native redirect configuration');
+  }
+  if (!Array.isArray(config.scopes) || config.scopes.length === 0) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'At least one OIDC scope is required');
+  }
+  if (!config.scopes.includes('offline_access')) {
+    throw new _errors.AuthConfigError('auth.error.configuration', '"offline_access" scope is required for session restore and silent refresh');
+  }
+
+  // Sections B/C — providers
+  if (!Array.isArray(config.providers) || config.providers.length === 0) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'At least one provider must be configured');
+  }
+  const providerIds = new Set();
+  for (const provider of config.providers) {
+    if (providerIds.has(provider.id)) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Duplicate provider "${provider.id}"`);
+    }
+    providerIds.add(provider.id);
+    if (!provider.domainHint || !provider.domainHint.trim()) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a domainHint`);
+    }
+    if (!Array.isArray(provider.platforms) || provider.platforms.length === 0) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" must declare at least one platform`);
+    }
+    for (const platform of provider.platforms) {
+      if (!_types.DEVICE_PLATFORMS.includes(platform)) {
+        // A typo here hides the provider on every device rather than failing.
+        throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" declares unknown platform "${String(platform)}"`);
+      }
+    }
+    if (typeof provider.labelKey !== 'string' || !provider.labelKey.trim()) {
+      throw new _errors.AuthConfigError('auth.error.configuration', `Provider "${provider.id}" is missing a labelKey`);
+    }
+  }
+
+  // Section D — resources
+  if (config.resources) {
+    const resourceKeys = new Set();
+    for (const resource of config.resources) {
+      if (!resource.key || !resource.key.trim()) {
+        throw new _errors.AuthConfigError('auth.error.configuration', 'A resource is missing "key"');
+      }
+      if (resourceKeys.has(resource.key)) {
+        throw new _errors.AuthConfigError('auth.error.configuration', `Duplicate resource "${resource.key}"`);
+      }
+      resourceKeys.add(resource.key);
+      if (!Array.isArray(resource.scopes) || resource.scopes.length === 0) {
+        throw new _errors.AuthConfigError('auth.error.configuration', `Resource "${resource.key}" must declare at least one scope`);
+      }
+    }
+  }
+
+  // Section E — access-tier mapping
+  const mapping = config.accessTierMapping;
+  if (!mapping) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'Missing "accessTierMapping"');
+  }
+  const hasPremiumIndicator = (mapping.premiumGroupObjectIds?.length ?? 0) > 0 || (mapping.premiumRoleNames?.length ?? 0) > 0 || (mapping.premiumClaimMatchers?.length ?? 0) > 0;
+  if (!hasPremiumIndicator) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'accessTierMapping must define at least one premium group object id, role name, or claim matcher');
+  }
+
+  // Section F — injected ports
+  if (!config.secureStore) {
+    throw new _errors.AuthConfigError('auth.error.configuration', 'A secureStore is required (FR-021)');
+  }
+}
+//# sourceMappingURL=validateConfig.js.map

package/lib/commonjs/config/validateConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_types","require","_errors","hasScheme","url","test","isSecureAuthority","validateConfig","config","authority","trim","AuthConfigError","clientId","redirectUrl","Array","isArray","scopes","length","includes","providers","providerIds","Set","provider","has","id","add","domainHint","platforms","platform","DEVICE_PLATFORMS","String","labelKey","resources","resourceKeys","resource","key","mapping","accessTierMapping","hasPremiumIndicator","premiumGroupObjectIds","premiumRoleNames","premiumClaimMatchers","secureStore"],"sourceRoot":"../../../src","sources":["config/validateConfig.ts"],"mappings":";;;;;;AAMA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAPA;AACA;AACA;AACA;AACA;;AAKA,SAASE,SAASA,CAACC,GAAW,EAAW;EACxC,OAAO,2BAA2B,CAACC,IAAI,CAACD,GAAG,CAAC;AAC7C;;AAEA;AACA,SAASE,iBAAiBA,CAACF,GAAW,EAAW;EAChD,IAAI,UAAU,CAACC,IAAI,CAACD,GAAG,CAAC,EAAE;IACzB,OAAO,IAAI;EACZ;EACA,OAAO,0DAA0D,CAACC,IAAI,CAACD,GAAG,CAAC;AAC5E;AAEO,SAASG,cAAcA,CAACC,MAAkB,EAAQ;EACxD;EACA,IAAI,CAACA,MAAM,CAACC,SAAS,IAAI,CAACD,MAAM,CAACC,SAAS,CAACC,IAAI,CAAC,CAAC,EAAE;IAClD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;EAC7E;EACA,IAAI,CAACR,SAAS,CAACK,MAAM,CAACC,SAAS,CAAC,EAAE;IACjC,MAAM,IAAIE,uBAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA;EACA;EACA,IAAI,CAACL,iBAAiB,CAACE,MAAM,CAACC,SAAS,CAAC,EAAE;IACzC,MAAM,IAAIE,uBAAe,CACxB,0BAA0B,EAC1B,kEACD,CAAC;EACF;EACA,IAAI,CAACH,MAAM,CAACI,QAAQ,IAAI,CAACJ,MAAM,CAACI,QAAQ,CAACF,IAAI,CAAC,CAAC,EAAE;IAChD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,oBAAoB,CAAC;EAC5E;EACA,IAAI,CAACH,MAAM,CAACK,WAAW,IAAI,CAACL,MAAM,CAACK,WAAW,CAACH,IAAI,CAAC,CAAC,EAAE;IACtD,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;EAC/E;EACA,IAAI,CAACR,SAAS,CAACK,MAAM,CAACK,WAAW,CAAC,EAAE;IACnC,MAAM,IAAIF,uBAAe,CACxB,6BAA6B,EAC7B,gFACD,CAAC;EACF;EACA,IAAI,CAACG,KAAK,CAACC,OAAO,CAACP,MAAM,CAACQ,MAAM,CAAC,IAAIR,MAAM,CAACQ,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;IAChE,MAAM,IAAIN,uBAAe,CAAC,0BAA0B,EAAE,qCAAqC,CAAC;EAC7F;EACA,IAAI,CAACH,MAAM,CAACQ,MAAM,CAACE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;IAC9C,MAAM,IAAIP,uBAAe,CACxB,0BAA0B,EAC1B,2EACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACG,KAAK,CAACC,OAAO,CAACP,MAAM,CAACW,SAAS,CAAC,IAAIX,MAAM,CAACW,SAAS,CAACF,MAAM,KAAK,CAAC,EAAE;IACtE,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,0CACD,CAAC;EACF;EACA,MAAMS,WAAW,GAAG,IAAIC,GAAG,CAAS,CAAC;EACrC,KAAK,MAAMC,QAAQ,IAAId,MAAM,CAACW,SAAS,EAAE;IACxC,IAAIC,WAAW,CAACG,GAAG,CAACD,QAAQ,CAACE,EAAE,CAAC,EAAE;MACjC,MAAM,IAAIb,uBAAe,CAAC,0BAA0B,EAAE,uBAAuBW,QAAQ,CAACE,EAAE,GAAG,CAAC;IAC7F;IACAJ,WAAW,CAACK,GAAG,CAACH,QAAQ,CAACE,EAAE,CAAC;IAC5B,IAAI,CAACF,QAAQ,CAACI,UAAU,IAAI,CAACJ,QAAQ,CAACI,UAAU,CAAChB,IAAI,CAAC,CAAC,EAAE;MACxD,MAAM,IAAIC,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,2BACzB,CAAC;IACF;IACA,IAAI,CAACV,KAAK,CAACC,OAAO,CAACO,QAAQ,CAACK,SAAS,CAAC,IAAIL,QAAQ,CAACK,SAAS,CAACV,MAAM,KAAK,CAAC,EAAE;MAC1E,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,sCACzB,CAAC;IACF;IACA,KAAK,MAAMI,QAAQ,IAAIN,QAAQ,CAACK,SAAS,EAAE;MAC1C,IAAI,CAACE,uBAAgB,CAACX,QAAQ,CAACU,QAAQ,CAAC,EAAE;QACzC;QACA,MAAM,IAAIjB,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,gCAAgCM,MAAM,CAACF,QAAQ,CAAC,GACzE,CAAC;MACF;IACD;IACA,IAAI,OAAON,QAAQ,CAACS,QAAQ,KAAK,QAAQ,IAAI,CAACT,QAAQ,CAACS,QAAQ,CAACrB,IAAI,CAAC,CAAC,EAAE;MACvE,MAAM,IAAIC,uBAAe,CACxB,0BAA0B,EAC1B,aAAaW,QAAQ,CAACE,EAAE,yBACzB,CAAC;IACF;EACD;;EAEA;EACA,IAAIhB,MAAM,CAACwB,SAAS,EAAE;IACrB,MAAMC,YAAY,GAAG,IAAIZ,GAAG,CAAS,CAAC;IACtC,KAAK,MAAMa,QAAQ,IAAI1B,MAAM,CAACwB,SAAS,EAAE;MACxC,IAAI,CAACE,QAAQ,CAACC,GAAG,IAAI,CAACD,QAAQ,CAACC,GAAG,CAACzB,IAAI,CAAC,CAAC,EAAE;QAC1C,MAAM,IAAIC,uBAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;MACrF;MACA,IAAIsB,YAAY,CAACV,GAAG,CAACW,QAAQ,CAACC,GAAG,CAAC,EAAE;QACnC,MAAM,IAAIxB,uBAAe,CACxB,0BAA0B,EAC1B,uBAAuBuB,QAAQ,CAACC,GAAG,GACpC,CAAC;MACF;MACAF,YAAY,CAACR,GAAG,CAACS,QAAQ,CAACC,GAAG,CAAC;MAC9B,IAAI,CAACrB,KAAK,CAACC,OAAO,CAACmB,QAAQ,CAAClB,MAAM,CAAC,IAAIkB,QAAQ,CAAClB,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;QACpE,MAAM,IAAIN,uBAAe,CACxB,0BAA0B,EAC1B,aAAauB,QAAQ,CAACC,GAAG,mCAC1B,CAAC;MACF;IACD;EACD;;EAEA;EACA,MAAMC,OAAO,GAAG5B,MAAM,CAAC6B,iBAAiB;EACxC,IAAI,CAACD,OAAO,EAAE;IACb,MAAM,IAAIzB,uBAAe,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;EACrF;EACA,MAAM2B,mBAAmB,GACxB,CAACF,OAAO,CAACG,qBAAqB,EAAEtB,MAAM,IAAI,CAAC,IAAI,CAAC,IAChD,CAACmB,OAAO,CAACI,gBAAgB,EAAEvB,MAAM,IAAI,CAAC,IAAI,CAAC,IAC3C,CAACmB,OAAO,CAACK,oBAAoB,EAAExB,MAAM,IAAI,CAAC,IAAI,CAAC;EAChD,IAAI,CAACqB,mBAAmB,EAAE;IACzB,MAAM,IAAI3B,uBAAe,CACxB,0BAA0B,EAC1B,iGACD,CAAC;EACF;;EAEA;EACA,IAAI,CAACH,MAAM,CAACkC,WAAW,EAAE;IACxB,MAAM,IAAI/B,uBAAe,CAAC,0BAA0B,EAAE,oCAAoC,CAAC;EAC5F;AACD","ignoreList":[]}