@dbx-tools/auth 0.9.40 → 0.9.43

package/index.ts

@@ -3,11 +3,11 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export const PACKAGE_VERSION = "0.9.40";
+export const PACKAGE_VERSION = "0.9.43";
 export * as client from "./src/client.ts";
 export * as config from "./src/config.ts";
 export * as profile from "./src/profile.ts";
 export type { AccessToken, TokenOptions, AuthClient, DatabricksAuthDependencies } from "./src/client.ts";
-export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
+export { AuthOptionsSchema, DatabricksAuthOptionsSchema, AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
 export type { AuthOptions, DatabricksAuthOptions } from "./src/config.ts";
 export type { ListProfilesOptions } from "./src/profile.ts";

package/lib/index.d.ts

@@ -1,9 +1,9 @@
 export declare const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export declare const PACKAGE_VERSION = "0.9.40";
+export declare const PACKAGE_VERSION = "0.9.43";
 export * as client from "./src/client.ts";
 export * as config from "./src/config.ts";
 export * as profile from "./src/profile.ts";
 export type { AccessToken, TokenOptions, AuthClient, DatabricksAuthDependencies } from "./src/client.ts";
-export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
+export { AuthOptionsSchema, DatabricksAuthOptionsSchema, AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.ts";
 export type { AuthOptions, DatabricksAuthOptions } from "./src/config.ts";
 export type { ListProfilesOptions } from "./src/profile.ts";

package/lib/index.js

@@ -2,9 +2,9 @@
 // Regenerated from the exporting modules in ./src.
 // Hand edits are overwritten on the next watch; this file is read-only.
 export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export const PACKAGE_VERSION = "0.9.40";
+export const PACKAGE_VERSION = "0.9.43";
 export * as client from "./src/client.js";
 export * as config from "./src/config.js";
 export * as profile from "./src/profile.js";
-export { AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxNQUFNLE1BQU0saUJBQWlCLENBQUM7QUFDMUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBRTVDLE9BQU8sRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsbUJBQW1CLEVBQUUsMkJBQTJCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIEdFTkVSQVRFRCBieSBwcm9qZW4gd2F0Y2ggLSBETyBOT1QgRURJVC5cbi8vIFJlZ2VuZXJhdGVkIGZyb20gdGhlIGV4cG9ydGluZyBtb2R1bGVzIGluIC4vc3JjLlxuLy8gSGFuZCBlZGl0cyBhcmUgb3ZlcndyaXR0ZW4gb24gdGhlIG5leHQgd2F0Y2g7IHRoaXMgZmlsZSBpcyByZWFkLW9ubHkuXG5cbmV4cG9ydCBjb25zdCBQQUNLQUdFX0lERU5USUZJRVIgPSBcIkBkYngtdG9vbHMvYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjQwXCI7XG5leHBvcnQgKiBhcyBjbGllbnQgZnJvbSBcIi4vc3JjL2NsaWVudC50c1wiO1xuZXhwb3J0ICogYXMgY29uZmlnIGZyb20gXCIuL3NyYy9jb25maWcudHNcIjtcbmV4cG9ydCAqIGFzIHByb2ZpbGUgZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgQWNjZXNzVG9rZW4sIFRva2VuT3B0aW9ucywgQXV0aENsaWVudCwgRGF0YWJyaWNrc0F1dGhEZXBlbmRlbmNpZXMgfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgeyBBVVRIX0RFRkFVTFRTLCBERUZBVUxUX0NMSUVOVF9JRCwgREVGQVVMVF9DT05GSUdfRklMRSwgREVGQVVMVF9BQ0NFU1NfVE9LRU5fSEVBREVSLCBXT1JLU1BBQ0VfSURfSEVBREVSIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoT3B0aW9ucywgRGF0YWJyaWNrc0F1dGhPcHRpb25zIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBMaXN0UHJvZmlsZXNPcHRpb25zIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbiJdfQ==
+export { AuthOptionsSchema, DatabricksAuthOptionsSchema, AUTH_DEFAULTS, DEFAULT_CLIENT_ID, DEFAULT_CONFIG_FILE, DEFAULT_ACCESS_TOKEN_HEADER, WORKSPACE_ID_HEADER } from "./src/config.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxNQUFNLE1BQU0saUJBQWlCLENBQUM7QUFDMUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBRTVDLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSwyQkFBMkIsRUFBRSxhQUFhLEVBQUUsaUJBQWlCLEVBQUUsbUJBQW1CLEVBQUUsMkJBQTJCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIEdFTkVSQVRFRCBieSBwcm9qZW4gd2F0Y2ggLSBETyBOT1QgRURJVC5cbi8vIFJlZ2VuZXJhdGVkIGZyb20gdGhlIGV4cG9ydGluZyBtb2R1bGVzIGluIC4vc3JjLlxuLy8gSGFuZCBlZGl0cyBhcmUgb3ZlcndyaXR0ZW4gb24gdGhlIG5leHQgd2F0Y2g7IHRoaXMgZmlsZSBpcyByZWFkLW9ubHkuXG5cbmV4cG9ydCBjb25zdCBQQUNLQUdFX0lERU5USUZJRVIgPSBcIkBkYngtdG9vbHMvYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjQzXCI7XG5leHBvcnQgKiBhcyBjbGllbnQgZnJvbSBcIi4vc3JjL2NsaWVudC50c1wiO1xuZXhwb3J0ICogYXMgY29uZmlnIGZyb20gXCIuL3NyYy9jb25maWcudHNcIjtcbmV4cG9ydCAqIGFzIHByb2ZpbGUgZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbmV4cG9ydCB0eXBlIHsgQWNjZXNzVG9rZW4sIFRva2VuT3B0aW9ucywgQXV0aENsaWVudCwgRGF0YWJyaWNrc0F1dGhEZXBlbmRlbmNpZXMgfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgeyBBdXRoT3B0aW9uc1NjaGVtYSwgRGF0YWJyaWNrc0F1dGhPcHRpb25zU2NoZW1hLCBBVVRIX0RFRkFVTFRTLCBERUZBVUxUX0NMSUVOVF9JRCwgREVGQVVMVF9DT05GSUdfRklMRSwgREVGQVVMVF9BQ0NFU1NfVE9LRU5fSEVBREVSLCBXT1JLU1BBQ0VfSURfSEVBREVSIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoT3B0aW9ucywgRGF0YWJyaWNrc0F1dGhPcHRpb25zIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy50c1wiO1xuZXhwb3J0IHR5cGUgeyBMaXN0UHJvZmlsZXNPcHRpb25zIH0gZnJvbSBcIi4vc3JjL3Byb2ZpbGUudHNcIjtcbiJdfQ==

package/lib/src/config.d.ts

@@ -1,31 +1,54 @@
-import type { AuthType, TargetKind } from "@dbx-tools/shared-auth/config";
+import { z } from "zod";
+export declare const AuthOptionsSchema: z.ZodObject<{
+    refreshBufferMs: z.ZodDefault<z.ZodCoercedNumber<number>>;
+    lockTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<number>>;
+    loginTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<number>>;
+}, z.core.$strict>;
 /** Token lifecycle timing configuration in milliseconds. */
-export interface AuthOptions {
-    refreshBufferMs?: number;
-    lockTimeoutMs?: number;
-    loginTimeoutMs?: number;
+export interface AuthOptions extends z.input<typeof AuthOptionsSchema> {
 }
-/** Default token refresh, lock, and interactive login timing values. */
-export declare const AUTH_DEFAULTS: Required<AuthOptions>;
+export declare const DatabricksAuthOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    host: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    configFile: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodOptional<z.ZodString>;
+    groupId: z.ZodOptional<z.ZodString>;
+    authType: z.ZodOptional<z.ZodEnum<{
+        "databricks-cli": "databricks-cli";
+        "oauth-m2m": "oauth-m2m";
+        pat: "pat";
+        app_obo: "app_obo";
+        app_sp: "app_sp";
+    }>>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    target: z.ZodOptional<z.ZodEnum<{
+        workspace: "workspace";
+        account: "account";
+        unified: "unified";
+    }>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        refreshBufferMs: z.ZodOptional<z.ZodDefault<z.ZodCoercedNumber<number>>>;
+        lockTimeoutMs: z.ZodOptional<z.ZodDefault<z.ZodCoercedNumber<number>>>;
+        loginTimeoutMs: z.ZodOptional<z.ZodDefault<z.ZodCoercedNumber<number>>>;
+    }, z.core.$strict>>;
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    accessTokenHeader: z.ZodOptional<z.ZodString>;
+    preferUserToMachine: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
 /** Databricks profile and credential-source options. */
-export interface DatabricksAuthOptions {
-    profile?: string;
-    host?: string;
-    accountId?: string;
-    workspaceId?: string;
-    configFile?: string;
-    clientId?: string;
-    clientSecret?: string;
-    accessToken?: string;
-    groupId?: string;
-    authType?: AuthType;
-    scopes?: string[];
-    target?: TargetKind;
+export interface DatabricksAuthOptions extends Omit<z.input<typeof DatabricksAuthOptionsSchema>, "auth"> {
     auth?: AuthOptions;
-    requestHeaders?: Record<string, string>;
-    accessTokenHeader?: string;
-    preferUserToMachine?: boolean;
 }
+/** Default token refresh, lock, and interactive login timing values. */
+export declare const AUTH_DEFAULTS: Readonly<{
+    refreshBufferMs: number;
+    lockTimeoutMs: number;
+    loginTimeoutMs: number;
+}>;
 /** OAuth client used by Databricks CLI-compatible user authentication. */
 export declare const DEFAULT_CLIENT_ID = "databricks-cli";
 /** Default Databricks profile configuration path. */

package/lib/src/config.js

@@ -1,9 +1,47 @@
+import { authTypeSchema, targetKindSchema } from "@dbx-tools/shared-auth/config-schema";
+import { options } from "@dbx-tools/shared-core";
+import { z } from "zod";
+const text = (description) => z.string().trim().min(1).optional().describe(description);
+const safeInteger = (description) => z.coerce.number().int().safe().describe(description);
+export const AuthOptionsSchema = z
+    .object({
+    refreshBufferMs: safeInteger("Token refresh buffer in milliseconds.").default(300_000),
+    lockTimeoutMs: safeInteger("Credential lock timeout in milliseconds.").nonnegative().default(0),
+    loginTimeoutMs: safeInteger("Browser login timeout in milliseconds.")
+        .nonnegative()
+        .default(900_000),
+})
+    .strict()
+    .describe("Token lifecycle timing configuration.");
+export const DatabricksAuthOptionsSchema = z
+    .object({
+    profile: options.DatabricksOptionsSchema.shape.profile,
+    host: options.DatabricksOptionsSchema.shape.host,
+    accountId: options.DatabricksOptionsSchema.shape.accountId,
+    workspaceId: options.DatabricksOptionsSchema.shape.workspaceId,
+    configFile: options.DatabricksOptionsSchema.shape.configFile,
+    clientId: options.DatabricksOptionsSchema.shape.clientId,
+    clientSecret: options.DatabricksOptionsSchema.shape.clientSecret,
+    accessToken: options.DatabricksOptionsSchema.shape.accessToken,
+    groupId: options.DatabricksOptionsSchema.shape.groupId,
+    authType: authTypeSchema.optional().describe("Databricks authentication type."),
+    scopes: z.array(z.string().trim().min(1)).optional().describe("OAuth scopes."),
+    target: targetKindSchema.optional().describe("OAuth target."),
+    auth: AuthOptionsSchema.partial().optional().describe("Token lifecycle overrides."),
+    requestHeaders: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe("Additional authentication request headers."),
+    accessTokenHeader: text("Request header carrying a bearer access token."),
+    preferUserToMachine: z
+        .boolean()
+        .optional()
+        .describe("Prefer a matching user profile over selected machine credentials."),
+})
+    .strict()
+    .describe("Databricks profile and credential-source options.");
 /** Default token refresh, lock, and interactive login timing values. */
-export const AUTH_DEFAULTS = {
-    refreshBufferMs: 300_000,
-    lockTimeoutMs: 0,
-    loginTimeoutMs: 900_000,
-};
+export const AUTH_DEFAULTS = Object.freeze(AuthOptionsSchema.parse({}));
 /** OAuth client used by Databricks CLI-compatible user authentication. */
 export const DEFAULT_CLIENT_ID = "databricks-cli";
 /** Default Databricks profile configuration path. */
@@ -12,4 +50,4 @@ export const DEFAULT_CONFIG_FILE = "~/.databrickscfg";
 export const DEFAULT_ACCESS_TOKEN_HEADER = "authorization";
 /** Request header carrying the resolved Databricks workspace ID. */
 export const WORKSPACE_ID_HEADER = "x-databricks-workspace-id";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFTQSx3RUFBd0U7QUFDeEUsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUEwQjtJQUNsRCxlQUFlLEVBQUUsT0FBTztJQUN4QixhQUFhLEVBQUUsQ0FBQztJQUNoQixjQUFjLEVBQUUsT0FBTztDQUN4QixDQUFDO0FBc0JGLDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxnQkFBZ0IsQ0FBQztBQUNsRCxxREFBcUQ7QUFDckQsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsa0JBQWtCLENBQUM7QUFDdEQscURBQXFEO0FBQ3JELE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLGVBQWUsQ0FBQztBQUMzRCxvRUFBb0U7QUFDcEUsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsMkJBQTJCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7IEF1dGhUeXBlLCBUYXJnZXRLaW5kIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWF1dGgvY29uZmlnXCI7XG5cbi8qKiBUb2tlbiBsaWZlY3ljbGUgdGltaW5nIGNvbmZpZ3VyYXRpb24gaW4gbWlsbGlzZWNvbmRzLiAqL1xuZXhwb3J0IGludGVyZmFjZSBBdXRoT3B0aW9ucyB7XG4gIHJlZnJlc2hCdWZmZXJNcz86IG51bWJlcjtcbiAgbG9ja1RpbWVvdXRNcz86IG51bWJlcjtcbiAgbG9naW5UaW1lb3V0TXM/OiBudW1iZXI7XG59XG5cbi8qKiBEZWZhdWx0IHRva2VuIHJlZnJlc2gsIGxvY2ssIGFuZCBpbnRlcmFjdGl2ZSBsb2dpbiB0aW1pbmcgdmFsdWVzLiAqL1xuZXhwb3J0IGNvbnN0IEFVVEhfREVGQVVMVFM6IFJlcXVpcmVkPEF1dGhPcHRpb25zPiA9IHtcbiAgcmVmcmVzaEJ1ZmZlck1zOiAzMDBfMDAwLFxuICBsb2NrVGltZW91dE1zOiAwLFxuICBsb2dpblRpbWVvdXRNczogOTAwXzAwMCxcbn07XG5cbi8qKiBEYXRhYnJpY2tzIHByb2ZpbGUgYW5kIGNyZWRlbnRpYWwtc291cmNlIG9wdGlvbnMuICovXG5leHBvcnQgaW50ZXJmYWNlIERhdGFicmlja3NBdXRoT3B0aW9ucyB7XG4gIHByb2ZpbGU/OiBzdHJpbmc7XG4gIGhvc3Q/OiBzdHJpbmc7XG4gIGFjY291bnRJZD86IHN0cmluZztcbiAgd29ya3NwYWNlSWQ/OiBzdHJpbmc7XG4gIGNvbmZpZ0ZpbGU/OiBzdHJpbmc7XG4gIGNsaWVudElkPzogc3RyaW5nO1xuICBjbGllbnRTZWNyZXQ/OiBzdHJpbmc7XG4gIGFjY2Vzc1Rva2VuPzogc3RyaW5nO1xuICBncm91cElkPzogc3RyaW5nO1xuICBhdXRoVHlwZT86IEF1dGhUeXBlO1xuICBzY29wZXM/OiBzdHJpbmdbXTtcbiAgdGFyZ2V0PzogVGFyZ2V0S2luZDtcbiAgYXV0aD86IEF1dGhPcHRpb25zO1xuICByZXF1ZXN0SGVhZGVycz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gIGFjY2Vzc1Rva2VuSGVhZGVyPzogc3RyaW5nO1xuICBwcmVmZXJVc2VyVG9NYWNoaW5lPzogYm9vbGVhbjtcbn1cblxuLyoqIE9BdXRoIGNsaWVudCB1c2VkIGJ5IERhdGFicmlja3MgQ0xJLWNvbXBhdGlibGUgdXNlciBhdXRoZW50aWNhdGlvbi4gKi9cbmV4cG9ydCBjb25zdCBERUZBVUxUX0NMSUVOVF9JRCA9IFwiZGF0YWJyaWNrcy1jbGlcIjtcbi8qKiBEZWZhdWx0IERhdGFicmlja3MgcHJvZmlsZSBjb25maWd1cmF0aW9uIHBhdGguICovXG5leHBvcnQgY29uc3QgREVGQVVMVF9DT05GSUdfRklMRSA9IFwifi8uZGF0YWJyaWNrc2NmZ1wiO1xuLyoqIFJlcXVlc3QgaGVhZGVyIGNhcnJ5aW5nIGEgYmVhcmVyIGFjY2VzcyB0b2tlbi4gKi9cbmV4cG9ydCBjb25zdCBERUZBVUxUX0FDQ0VTU19UT0tFTl9IRUFERVIgPSBcImF1dGhvcml6YXRpb25cIjtcbi8qKiBSZXF1ZXN0IGhlYWRlciBjYXJyeWluZyB0aGUgcmVzb2x2ZWQgRGF0YWJyaWNrcyB3b3Jrc3BhY2UgSUQuICovXG5leHBvcnQgY29uc3QgV09SS1NQQUNFX0lEX0hFQURFUiA9IFwieC1kYXRhYnJpY2tzLXdvcmtzcGFjZS1pZFwiO1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sc0NBQXNDLENBQUM7QUFDeEYsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ2pELE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxLQUFLLENBQUM7QUFFeEIsTUFBTSxJQUFJLEdBQUcsQ0FBQyxXQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUNoRyxNQUFNLFdBQVcsR0FBRyxDQUFDLFdBQW1CLEVBQUUsRUFBRSxDQUMxQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUUvRCxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxDQUFDO0tBQy9CLE1BQU0sQ0FBQztJQUNOLGVBQWUsRUFBRSxXQUFXLENBQUMsdUNBQXVDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO0lBQ3RGLGFBQWEsRUFBRSxXQUFXLENBQUMsMENBQTBDLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQy9GLGNBQWMsRUFBRSxXQUFXLENBQUMsd0NBQXdDLENBQUM7U0FDbEUsV0FBVyxFQUFFO1NBQ2IsT0FBTyxDQUFDLE9BQU8sQ0FBQztDQUNwQixDQUFDO0tBQ0QsTUFBTSxFQUFFO0tBQ1IsUUFBUSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7QUFLckQsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQztLQUN6QyxNQUFNLENBQUM7SUFDTixPQUFPLEVBQUUsT0FBTyxDQUFDLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxPQUFPO0lBQ3RELElBQUksRUFBRSxPQUFPLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLElBQUk7SUFDaEQsU0FBUyxFQUFFLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsU0FBUztJQUMxRCxXQUFXLEVBQUUsT0FBTyxDQUFDLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxXQUFXO0lBQzlELFVBQVUsRUFBRSxPQUFPLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLFVBQVU7SUFDNUQsUUFBUSxFQUFFLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsUUFBUTtJQUN4RCxZQUFZLEVBQUUsT0FBTyxDQUFDLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxZQUFZO0lBQ2hFLFdBQVcsRUFBRSxPQUFPLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLFdBQVc7SUFDOUQsT0FBTyxFQUFFLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsT0FBTztJQUN0RCxRQUFRLEVBQUUsY0FBYyxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxpQ0FBaUMsQ0FBQztJQUMvRSxNQUFNLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQztJQUM5RSxNQUFNLEVBQUUsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQztJQUM3RCxJQUFJLEVBQUUsaUJBQWlCLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxDQUFDLDRCQUE0QixDQUFDO0lBQ25GLGNBQWMsRUFBRSxDQUFDO1NBQ2QsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7U0FDOUIsUUFBUSxFQUFFO1NBQ1YsUUFBUSxDQUFDLDRDQUE0QyxDQUFDO0lBQ3pELGlCQUFpQixFQUFFLElBQUksQ0FBQyxnREFBZ0QsQ0FBQztJQUN6RSxtQkFBbUIsRUFBRSxDQUFDO1NBQ25CLE9BQU8sRUFBRTtTQUNULFFBQVEsRUFBRTtTQUNWLFFBQVEsQ0FBQyxtRUFBbUUsQ0FBQztDQUNqRixDQUFDO0tBQ0QsTUFBTSxFQUFFO0tBQ1IsUUFBUSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7QUFVakUsd0VBQXdFO0FBQ3hFLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBRXhFLDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxnQkFBZ0IsQ0FBQztBQUNsRCxxREFBcUQ7QUFDckQsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsa0JBQWtCLENBQUM7QUFDdEQscURBQXFEO0FBQ3JELE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLGVBQWUsQ0FBQztBQUMzRCxvRUFBb0U7QUFDcEUsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsMkJBQTJCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBhdXRoVHlwZVNjaGVtYSwgdGFyZ2V0S2luZFNjaGVtYSB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1hdXRoL2NvbmZpZy1zY2hlbWFcIjtcbmltcG9ydCB7IG9wdGlvbnMgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHsgeiB9IGZyb20gXCJ6b2RcIjtcblxuY29uc3QgdGV4dCA9IChkZXNjcmlwdGlvbjogc3RyaW5nKSA9PiB6LnN0cmluZygpLnRyaW0oKS5taW4oMSkub3B0aW9uYWwoKS5kZXNjcmliZShkZXNjcmlwdGlvbik7XG5jb25zdCBzYWZlSW50ZWdlciA9IChkZXNjcmlwdGlvbjogc3RyaW5nKSA9PlxuICB6LmNvZXJjZS5udW1iZXI8bnVtYmVyPigpLmludCgpLnNhZmUoKS5kZXNjcmliZShkZXNjcmlwdGlvbik7XG5cbmV4cG9ydCBjb25zdCBBdXRoT3B0aW9uc1NjaGVtYSA9IHpcbiAgLm9iamVjdCh7XG4gICAgcmVmcmVzaEJ1ZmZlck1zOiBzYWZlSW50ZWdlcihcIlRva2VuIHJlZnJlc2ggYnVmZmVyIGluIG1pbGxpc2Vjb25kcy5cIikuZGVmYXVsdCgzMDBfMDAwKSxcbiAgICBsb2NrVGltZW91dE1zOiBzYWZlSW50ZWdlcihcIkNyZWRlbnRpYWwgbG9jayB0aW1lb3V0IGluIG1pbGxpc2Vjb25kcy5cIikubm9ubmVnYXRpdmUoKS5kZWZhdWx0KDApLFxuICAgIGxvZ2luVGltZW91dE1zOiBzYWZlSW50ZWdlcihcIkJyb3dzZXIgbG9naW4gdGltZW91dCBpbiBtaWxsaXNlY29uZHMuXCIpXG4gICAgICAubm9ubmVnYXRpdmUoKVxuICAgICAgLmRlZmF1bHQoOTAwXzAwMCksXG4gIH0pXG4gIC5zdHJpY3QoKVxuICAuZGVzY3JpYmUoXCJUb2tlbiBsaWZlY3ljbGUgdGltaW5nIGNvbmZpZ3VyYXRpb24uXCIpO1xuXG4vKiogVG9rZW4gbGlmZWN5Y2xlIHRpbWluZyBjb25maWd1cmF0aW9uIGluIG1pbGxpc2Vjb25kcy4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXV0aE9wdGlvbnMgZXh0ZW5kcyB6LmlucHV0PHR5cGVvZiBBdXRoT3B0aW9uc1NjaGVtYT4ge31cblxuZXhwb3J0IGNvbnN0IERhdGFicmlja3NBdXRoT3B0aW9uc1NjaGVtYSA9IHpcbiAgLm9iamVjdCh7XG4gICAgcHJvZmlsZTogb3B0aW9ucy5EYXRhYnJpY2tzT3B0aW9uc1NjaGVtYS5zaGFwZS5wcm9maWxlLFxuICAgIGhvc3Q6IG9wdGlvbnMuRGF0YWJyaWNrc09wdGlvbnNTY2hlbWEuc2hhcGUuaG9zdCxcbiAgICBhY2NvdW50SWQ6IG9wdGlvbnMuRGF0YWJyaWNrc09wdGlvbnNTY2hlbWEuc2hhcGUuYWNjb3VudElkLFxuICAgIHdvcmtzcGFjZUlkOiBvcHRpb25zLkRhdGFicmlja3NPcHRpb25zU2NoZW1hLnNoYXBlLndvcmtzcGFjZUlkLFxuICAgIGNvbmZpZ0ZpbGU6IG9wdGlvbnMuRGF0YWJyaWNrc09wdGlvbnNTY2hlbWEuc2hhcGUuY29uZmlnRmlsZSxcbiAgICBjbGllbnRJZDogb3B0aW9ucy5EYXRhYnJpY2tzT3B0aW9uc1NjaGVtYS5zaGFwZS5jbGllbnRJZCxcbiAgICBjbGllbnRTZWNyZXQ6IG9wdGlvbnMuRGF0YWJyaWNrc09wdGlvbnNTY2hlbWEuc2hhcGUuY2xpZW50U2VjcmV0LFxuICAgIGFjY2Vzc1Rva2VuOiBvcHRpb25zLkRhdGFicmlja3NPcHRpb25zU2NoZW1hLnNoYXBlLmFjY2Vzc1Rva2VuLFxuICAgIGdyb3VwSWQ6IG9wdGlvbnMuRGF0YWJyaWNrc09wdGlvbnNTY2hlbWEuc2hhcGUuZ3JvdXBJZCxcbiAgICBhdXRoVHlwZTogYXV0aFR5cGVTY2hlbWEub3B0aW9uYWwoKS5kZXNjcmliZShcIkRhdGFicmlja3MgYXV0aGVudGljYXRpb24gdHlwZS5cIiksXG4gICAgc2NvcGVzOiB6LmFycmF5KHouc3RyaW5nKCkudHJpbSgpLm1pbigxKSkub3B0aW9uYWwoKS5kZXNjcmliZShcIk9BdXRoIHNjb3Blcy5cIiksXG4gICAgdGFyZ2V0OiB0YXJnZXRLaW5kU2NoZW1hLm9wdGlvbmFsKCkuZGVzY3JpYmUoXCJPQXV0aCB0YXJnZXQuXCIpLFxuICAgIGF1dGg6IEF1dGhPcHRpb25zU2NoZW1hLnBhcnRpYWwoKS5vcHRpb25hbCgpLmRlc2NyaWJlKFwiVG9rZW4gbGlmZWN5Y2xlIG92ZXJyaWRlcy5cIiksXG4gICAgcmVxdWVzdEhlYWRlcnM6IHpcbiAgICAgIC5yZWNvcmQoei5zdHJpbmcoKSwgei5zdHJpbmcoKSlcbiAgICAgIC5vcHRpb25hbCgpXG4gICAgICAuZGVzY3JpYmUoXCJBZGRpdGlvbmFsIGF1dGhlbnRpY2F0aW9uIHJlcXVlc3QgaGVhZGVycy5cIiksXG4gICAgYWNjZXNzVG9rZW5IZWFkZXI6IHRleHQoXCJSZXF1ZXN0IGhlYWRlciBjYXJyeWluZyBhIGJlYXJlciBhY2Nlc3MgdG9rZW4uXCIpLFxuICAgIHByZWZlclVzZXJUb01hY2hpbmU6IHpcbiAgICAgIC5ib29sZWFuKClcbiAgICAgIC5vcHRpb25hbCgpXG4gICAgICAuZGVzY3JpYmUoXCJQcmVmZXIgYSBtYXRjaGluZyB1c2VyIHByb2ZpbGUgb3ZlciBzZWxlY3RlZCBtYWNoaW5lIGNyZWRlbnRpYWxzLlwiKSxcbiAgfSlcbiAgLnN0cmljdCgpXG4gIC5kZXNjcmliZShcIkRhdGFicmlja3MgcHJvZmlsZSBhbmQgY3JlZGVudGlhbC1zb3VyY2Ugb3B0aW9ucy5cIik7XG5cbi8qKiBEYXRhYnJpY2tzIHByb2ZpbGUgYW5kIGNyZWRlbnRpYWwtc291cmNlIG9wdGlvbnMuICovXG5leHBvcnQgaW50ZXJmYWNlIERhdGFicmlja3NBdXRoT3B0aW9ucyBleHRlbmRzIE9taXQ8XG4gIHouaW5wdXQ8dHlwZW9mIERhdGFicmlja3NBdXRoT3B0aW9uc1NjaGVtYT4sXG4gIFwiYXV0aFwiXG4+IHtcbiAgYXV0aD86IEF1dGhPcHRpb25zO1xufVxuXG4vKiogRGVmYXVsdCB0b2tlbiByZWZyZXNoLCBsb2NrLCBhbmQgaW50ZXJhY3RpdmUgbG9naW4gdGltaW5nIHZhbHVlcy4gKi9cbmV4cG9ydCBjb25zdCBBVVRIX0RFRkFVTFRTID0gT2JqZWN0LmZyZWV6ZShBdXRoT3B0aW9uc1NjaGVtYS5wYXJzZSh7fSkpO1xuXG4vKiogT0F1dGggY2xpZW50IHVzZWQgYnkgRGF0YWJyaWNrcyBDTEktY29tcGF0aWJsZSB1c2VyIGF1dGhlbnRpY2F0aW9uLiAqL1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfQ0xJRU5UX0lEID0gXCJkYXRhYnJpY2tzLWNsaVwiO1xuLyoqIERlZmF1bHQgRGF0YWJyaWNrcyBwcm9maWxlIGNvbmZpZ3VyYXRpb24gcGF0aC4gKi9cbmV4cG9ydCBjb25zdCBERUZBVUxUX0NPTkZJR19GSUxFID0gXCJ+Ly5kYXRhYnJpY2tzY2ZnXCI7XG4vKiogUmVxdWVzdCBoZWFkZXIgY2FycnlpbmcgYSBiZWFyZXIgYWNjZXNzIHRva2VuLiAqL1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfQUNDRVNTX1RPS0VOX0hFQURFUiA9IFwiYXV0aG9yaXphdGlvblwiO1xuLyoqIFJlcXVlc3QgaGVhZGVyIGNhcnJ5aW5nIHRoZSByZXNvbHZlZCBEYXRhYnJpY2tzIHdvcmtzcGFjZSBJRC4gKi9cbmV4cG9ydCBjb25zdCBXT1JLU1BBQ0VfSURfSEVBREVSID0gXCJ4LWRhdGFicmlja3Mtd29ya3NwYWNlLWlkXCI7XG4iXX0=

package/package.json

@@ -24,11 +24,12 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@dbx-tools/core": "^0.9.40",
-    "@dbx-tools/shared-auth": "^0.9.40",
-    "@dbx-tools/shared-core": "^0.9.40",
+    "@dbx-tools/core": "^0.9.43",
+    "@dbx-tools/shared-auth": "^0.9.43",
+    "@dbx-tools/shared-core": "^0.9.43",
     "ini": "^6.0.0",
-    "oauth4webapi": "^3.8.8"
+    "oauth4webapi": "^3.8.8",
+    "zod": "4.3.6"
   },
   "main": "./lib/index.js",
   "license": "Apache-2.0",
@@ -56,7 +57,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.40",
+  "version": "0.9.43",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [

package/src/config.ts

@@ -1,39 +1,64 @@
-import type { AuthType, TargetKind } from "@dbx-tools/shared-auth/config";
+import { authTypeSchema, targetKindSchema } from "@dbx-tools/shared-auth/config-schema";
+import { options } from "@dbx-tools/shared-core";
+import { z } from "zod";
+
+const text = (description: string) => z.string().trim().min(1).optional().describe(description);
+const safeInteger = (description: string) =>
+  z.coerce.number<number>().int().safe().describe(description);
+
+export const AuthOptionsSchema = z
+  .object({
+    refreshBufferMs: safeInteger("Token refresh buffer in milliseconds.").default(300_000),
+    lockTimeoutMs: safeInteger("Credential lock timeout in milliseconds.").nonnegative().default(0),
+    loginTimeoutMs: safeInteger("Browser login timeout in milliseconds.")
+      .nonnegative()
+      .default(900_000),
+  })
+  .strict()
+  .describe("Token lifecycle timing configuration.");
 
 /** Token lifecycle timing configuration in milliseconds. */
-export interface AuthOptions {
-  refreshBufferMs?: number;
-  lockTimeoutMs?: number;
-  loginTimeoutMs?: number;
-}
+export interface AuthOptions extends z.input<typeof AuthOptionsSchema> {}
 
-/** Default token refresh, lock, and interactive login timing values. */
-export const AUTH_DEFAULTS: Required<AuthOptions> = {
-  refreshBufferMs: 300_000,
-  lockTimeoutMs: 0,
-  loginTimeoutMs: 900_000,
-};
+export const DatabricksAuthOptionsSchema = z
+  .object({
+    profile: options.DatabricksOptionsSchema.shape.profile,
+    host: options.DatabricksOptionsSchema.shape.host,
+    accountId: options.DatabricksOptionsSchema.shape.accountId,
+    workspaceId: options.DatabricksOptionsSchema.shape.workspaceId,
+    configFile: options.DatabricksOptionsSchema.shape.configFile,
+    clientId: options.DatabricksOptionsSchema.shape.clientId,
+    clientSecret: options.DatabricksOptionsSchema.shape.clientSecret,
+    accessToken: options.DatabricksOptionsSchema.shape.accessToken,
+    groupId: options.DatabricksOptionsSchema.shape.groupId,
+    authType: authTypeSchema.optional().describe("Databricks authentication type."),
+    scopes: z.array(z.string().trim().min(1)).optional().describe("OAuth scopes."),
+    target: targetKindSchema.optional().describe("OAuth target."),
+    auth: AuthOptionsSchema.partial().optional().describe("Token lifecycle overrides."),
+    requestHeaders: z
+      .record(z.string(), z.string())
+      .optional()
+      .describe("Additional authentication request headers."),
+    accessTokenHeader: text("Request header carrying a bearer access token."),
+    preferUserToMachine: z
+      .boolean()
+      .optional()
+      .describe("Prefer a matching user profile over selected machine credentials."),
+  })
+  .strict()
+  .describe("Databricks profile and credential-source options.");
 
 /** Databricks profile and credential-source options. */
-export interface DatabricksAuthOptions {
-  profile?: string;
-  host?: string;
-  accountId?: string;
-  workspaceId?: string;
-  configFile?: string;
-  clientId?: string;
-  clientSecret?: string;
-  accessToken?: string;
-  groupId?: string;
-  authType?: AuthType;
-  scopes?: string[];
-  target?: TargetKind;
+export interface DatabricksAuthOptions extends Omit<
+  z.input<typeof DatabricksAuthOptionsSchema>,
+  "auth"
+> {
   auth?: AuthOptions;
-  requestHeaders?: Record<string, string>;
-  accessTokenHeader?: string;
-  preferUserToMachine?: boolean;
 }
 
+/** Default token refresh, lock, and interactive login timing values. */
+export const AUTH_DEFAULTS = Object.freeze(AuthOptionsSchema.parse({}));
+
 /** OAuth client used by Databricks CLI-compatible user authentication. */
 export const DEFAULT_CLIENT_ID = "databricks-cli";
 /** Default Databricks profile configuration path. */