@dreadkn1ght123/auth-types 0.2.0

package/README.md

@@ -0,0 +1,24 @@
+# @dreadkn1ght123/auth-types
+
+Shared, runtime-free VVP authentication contracts. The package defines VVP
+claims, actors, roles, validated configuration, route and transaction outcomes,
+typed diagnostic stages/reasons, allowlisted safe error fields, the safe logger,
+and pluggable server-side session-store contracts.
+
+Requires Node.js 20 or newer. Tokens belong only in `ServerSession`; expose a
+`PublicSession` to browser code. `AuthConfigInput.clientSecret` is mandatory:
+the SDK supports confidential server-side OIDC clients only.
+
+The default OIDC scopes include `openid`, `profile`, `email`, and
+`vvp-identity`; custom scope lists must include both `openid` and
+`vvp-identity`.
+
+Diagnostic types deliberately cannot carry arbitrary response bodies, headers,
+URLs, tokens, claims, or provider descriptions. Treat `SafeAuthErrorFields` and
+`SafeLogFields` as an allowlist, not as a place to cast untrusted objects.
+
+Version `0.2.0` is the compatible minor line for all auth packages. Keep
+`@dreadkn1ght123/auth-types`, `@dreadkn1ght123/auth-core`,
+`@dreadkn1ght123/auth-express`, and `@dreadkn1ght123/auth-react` on the same
+minor line; see the workspace
+[`UPGRADE.md`](../../UPGRADE.md).

package/dist/index.d.ts

@@ -0,0 +1,249 @@
+export declare const ACTOR_TYPES: readonly ["employee", "contractor", "external_customer", "external_vendor", "service"];
+export type KnownActorType = (typeof ACTOR_TYPES)[number];
+/** Providers may introduce actor types independently of an SDK release. */
+export type ActorType = string;
+export declare const VVP_REALM_ROLES: readonly ["platform_admin", "employee", "external_customer", "external_vendor"];
+export type VvpRealmRole = (typeof VVP_REALM_ROLES)[number];
+export type Role = string;
+export interface RealmAccess {
+    roles?: readonly string[];
+}
+export interface ClientAccess {
+    roles: readonly string[];
+}
+export interface VvpClaims {
+    sub: string;
+    vvp_actor_id?: string;
+    actor_type?: ActorType;
+    organization_id?: string;
+    employee_id?: string;
+    department_id?: string;
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    realm_access?: RealmAccess;
+    resource_access?: Readonly<Record<string, ClientAccess>>;
+    [claim: string]: unknown;
+}
+export interface Actor {
+    /** IdP-internal identifier; never use this as a business foreign key. */
+    sub: string;
+    /** Immutable business identifier when assigned. */
+    vvpActorId?: string;
+    actorType?: ActorType;
+    organizationId?: string;
+    employeeId?: string;
+    departmentId?: string;
+    email?: string;
+    emailVerified?: boolean;
+    username?: string;
+    name?: string;
+    givenName?: string;
+    familyName?: string;
+    realmRoles: readonly Role[];
+    clientRoles: Readonly<Record<string, readonly Role[]>>;
+}
+export type RuntimeEnvironment = "development" | "test" | "production";
+export type AuthStage = "configuration" | "discovery" | "authorization" | "transaction" | "callback" | "token_exchange" | "id_token_validation" | "access_token_validation" | "claims" | "session" | "token_refresh" | "logout";
+export type CallbackAuthStage = "transaction_validation" | "authorization_response_validation" | "token_exchange" | "id_token_validation" | "access_token_validation" | "actor_claims_mapping" | "session_persistence" | "callback_redirect";
+/**
+ * Stable, non-sensitive failure classification. These values are suitable for
+ * metrics and user-facing error selection; provider error text is not.
+ */
+export type AuthFailureReason = "config_invalid" | "provider_unavailable" | "provider_metadata_invalid" | "provider_rejected" | "invalid_request" | "transaction_not_found" | "transaction_expired" | "transaction_state_mismatch" | "transaction_already_consumed" | "transaction_consume_ambiguous" | "authorization_code_invalid" | "nonce_mismatch" | "token_endpoint_rejected" | "token_missing" | "token_malformed" | "token_expired" | "token_not_active" | "token_signature_invalid" | "token_issuer_invalid" | "token_audience_invalid" | "token_authorized_party_invalid" | "token_claims_invalid" | "subject_mismatch" | "claims_invalid" | "session_not_found" | "session_persistence_failed" | "store_unsafe" | "return_to_invalid" | "post_logout_redirect_invalid" | "local_session_deleted" | "provider_logout_redirect_created" | "provider_logout_rejected" | "unknown";
+export type CallbackFailureReason = "transaction_cookie_missing" | "transaction_cookie_malformed" | "state_missing" | "transaction_not_found" | "transaction_expired" | "state_mismatch" | "transaction_already_consumed" | "authorization_denied" | "invalid_client" | "token_endpoint_rejected" | "pkce_validation_failed" | "nonce_mismatch" | "id_token_missing" | "id_token_invalid" | "access_token_missing" | "access_token_not_jwt" | "access_token_signature_invalid" | "issuer_mismatch" | "audience_mismatch" | "authorized_party_mismatch" | "required_claim_missing" | "token_expired" | "token_subject_mismatch" | "claims_invalid" | "session_store_failed" | "provider_unavailable" | "callback_failed_unknown";
+export type AuthDiagnosticStage = AuthStage | CallbackAuthStage;
+export type AuthDiagnosticReason = AuthFailureReason | CallbackFailureReason;
+/** Strict allowlist of diagnostic values that may cross a logging boundary. */
+export interface SafeAuthErrorDetails {
+    library?: "openid-client" | "oauth4webapi" | "jose";
+    libraryCode?: string;
+    httpStatus?: number;
+    claim?: "aud" | "azp" | "exp" | "iat" | "iss" | "nbf" | "nonce" | "sub";
+    causeName?: string;
+    causeCode?: string;
+    providerError?: "access_denied" | "invalid_client" | "invalid_grant" | "interaction_required" | "login_required" | "server_error" | "temporarily_unavailable";
+    providerStatus?: number;
+    failedClaim?: "aud" | "azp" | "exp" | "iat" | "iss" | "nbf" | "nonce" | "sub";
+    claimFailureReason?: "check_failed" | "missing" | "invalid";
+}
+export interface SafeAuthErrorFields extends SafeAuthErrorDetails {
+    authErrorCode?: AuthErrorCode;
+    stage?: AuthDiagnosticStage;
+    reason?: AuthDiagnosticReason;
+    correlationId?: string;
+}
+export interface AuthDiagnostic {
+    authErrorCode: AuthErrorCode;
+    /** @deprecated Use authErrorCode. */
+    code?: AuthErrorCode;
+    stage: AuthDiagnosticStage;
+    reason: AuthDiagnosticReason;
+    correlationId?: string;
+    details?: Readonly<SafeAuthErrorDetails>;
+}
+export interface AuthRouteSettingsInput {
+    /** Root under which relative route names are resolved. Defaults to /auth. */
+    basePath?: string;
+    startPath?: string;
+    loginPath?: string;
+    callbackPath?: string;
+    logoutPath?: string;
+    signedOutPath?: string;
+    errorPath?: string;
+    sessionPath?: string;
+    /** Must contain callbackPath. Defaults to basePath. */
+    cookiePath?: string;
+}
+export interface AuthRouteSettings {
+    basePath: string;
+    startPath: string;
+    loginPath: string;
+    callbackPath: string;
+    logoutPath: string;
+    signedOutPath: string;
+    errorPath: string;
+    sessionPath: string;
+    cookiePath: string;
+}
+export type AuthRoutesInput = AuthRouteSettingsInput;
+export type AuthRoutes = AuthRouteSettings;
+/** Shape accepted by adapters which expose `routes` next to `config`. */
+export interface AuthRoutesOption {
+    routes?: AuthRouteSettingsInput;
+}
+export type ClientAuthenticationMethod = "client_secret_basic";
+export type AuthUiLocale = "ru" | "en";
+/**
+ * Text is rendered as plain text by adapters. Implementations must escape it
+ * and must never interpret these values as HTML.
+ */
+export interface AuthUiConfigInput {
+    locale?: AuthUiLocale;
+    productName?: string;
+    /** Absolute local path only; remote and data URLs are not accepted. */
+    logoUrl?: string;
+    supportText?: string;
+}
+export interface AuthUiConfig {
+    locale: AuthUiLocale;
+    productName: string;
+    logoUrl?: string;
+    supportText: string;
+}
+export interface AuthConfigInput {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /**
+     * Public application origin. Optional for source compatibility, but required
+     * at runtime in production.
+     */
+    publicOrigin?: string;
+    /** Defaults to publicOrigin + routes.callbackPath. */
+    redirectUri?: string;
+    /** Defaults to publicOrigin + routes.signedOutPath. */
+    postLogoutRedirectUri?: string;
+    scopes?: readonly string[];
+    environment?: RuntimeEnvironment;
+    sessionTtlSeconds?: number;
+    allowedReturnToOrigins?: readonly string[];
+    /** Accepted access-token audiences. Omit to rely on authorized-party policy. */
+    accessTokenAudiences?: readonly string[];
+    /** Accepted Keycloak azp values. Defaults to clientId. */
+    accessTokenAuthorizedParties?: readonly string[];
+    routes?: AuthRouteSettingsInput;
+    ui?: AuthUiConfigInput;
+    clientAuthenticationMethod?: ClientAuthenticationMethod;
+}
+export interface AuthConfig {
+    issuer: URL;
+    clientId: string;
+    /** Required for confidential server-side clients. Never expose to a browser. */
+    clientSecret: string;
+    publicOrigin?: URL;
+    redirectUri: URL;
+    postLogoutRedirectUri?: URL;
+    scopes: readonly string[];
+    environment: RuntimeEnvironment;
+    sessionTtlSeconds: number;
+    allowedReturnToOrigins: readonly string[];
+    accessTokenAudiences: readonly string[];
+    accessTokenAuthorizedParties: readonly string[];
+    routes: AuthRouteSettings;
+    ui: AuthUiConfig;
+    clientAuthenticationMethod: ClientAuthenticationMethod;
+}
+export type AuthErrorCode = "CONFIG_INVALID" | "CLAIMS_INVALID" | "OIDC_DISCOVERY_FAILED" | "AUTHORIZATION_FAILED" | "ACCESS_TOKEN_INVALID" | "TOKEN_REFRESH_FAILED" | "SESSION_NOT_FOUND" | "SESSION_STORE_UNSAFE" | "RETURN_TO_INVALID" | "TRANSACTION_INVALID" | "SESSION_PERSISTENCE_FAILED" | "LOGOUT_FAILED";
+export type TransactionConsumeOutcome<T> = {
+    status: "ok";
+    transaction: T;
+} | {
+    status: "not_found";
+} | {
+    status: "expired";
+} | {
+    status: "state_mismatch";
+} | {
+    status: "already_consumed";
+} | {
+    status: "ambiguous";
+};
+export type ConsumeTransactionResult<T> = TransactionConsumeOutcome<T>;
+/** Atomic stores must return one explicit outcome and never return secrets on failure. */
+export interface AtomicTransactionStore<T> {
+    readonly capabilities?: AuthStoreCapabilities;
+    set(transaction: T, ttlSeconds: number): Promise<void>;
+    consume(id: string, expectedState: string): Promise<TransactionConsumeOutcome<T>>;
+}
+/** Values passed to loggers must be operational metadata, never token/secret data. */
+export type SafeLogValue = string | number | boolean | null | undefined | readonly string[] | readonly number[] | readonly boolean[];
+export type SafeLogFields = Readonly<Record<string, SafeLogValue>>;
+export interface AuthLogger {
+    debug(message: string, fields?: SafeLogFields): void;
+    info(message: string, fields?: SafeLogFields): void;
+    warn(message: string, fields?: SafeLogFields): void;
+    error(message: string, fields?: SafeLogFields): void;
+}
+export interface ServerTokens {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresAt?: number;
+    tokenType?: string;
+    scope?: string;
+}
+/** Internal server record. Never serialize this object to a browser response. */
+export interface ServerSession {
+    id: string;
+    actor: Actor;
+    tokens: ServerTokens;
+    createdAt: number;
+    updatedAt: number;
+}
+/** Token-free projection safe to expose to application frontends. */
+export interface PublicSession {
+    actor: Actor;
+    expiresAt?: number;
+}
+export interface SessionStore {
+    /**
+     * Required in production. This attests that records survive restarts and
+     * are shared by every instance that can receive the same cookie.
+     */
+    readonly capabilities?: AuthStoreCapabilities;
+    get(id: string): Promise<ServerSession | null>;
+    set(session: ServerSession, ttlSeconds: number): Promise<void>;
+    delete(id: string): Promise<void>;
+    touch?(id: string, ttlSeconds: number): Promise<void>;
+}
+export interface AuthStoreCapabilities {
+    readonly persistence: "memory" | "persistent";
+    readonly shared: boolean;
+    /** Required for production authorization-transaction stores. */
+    readonly atomicConsume?: boolean;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,wFAMd,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,eAAO,MAAM,eAAe,iFAKlB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5D,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC;AAE1B,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,KAAK;IACpB,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC;IAC5B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;AAEvE,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,WAAW,GACX,eAAe,GACf,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,QAAQ,GACR,SAAS,GACT,eAAe,GACf,QAAQ,CAAC;AAEb,MAAM,MAAM,iBAAiB,GACzB,wBAAwB,GACxB,mCAAmC,GACnC,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,mBAAmB,CAAC;AAExB;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,sBAAsB,GACtB,2BAA2B,GAC3B,mBAAmB,GACnB,iBAAiB,GACjB,uBAAuB,GACvB,qBAAqB,GACrB,4BAA4B,GAC5B,8BAA8B,GAC9B,+BAA+B,GAC/B,4BAA4B,GAC5B,gBAAgB,GAChB,yBAAyB,GACzB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,yBAAyB,GACzB,sBAAsB,GACtB,wBAAwB,GACxB,gCAAgC,GAChC,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,4BAA4B,GAC5B,cAAc,GACd,mBAAmB,GACnB,8BAA8B,GAC9B,uBAAuB,GACvB,kCAAkC,GAClC,0BAA0B,GAC1B,SAAS,CAAC;AACd,MAAM,MAAM,qBAAqB,GAC7B,4BAA4B,GAC5B,8BAA8B,GAC9B,eAAe,GACf,uBAAuB,GACvB,qBAAqB,GACrB,gBAAgB,GAChB,8BAA8B,GAC9B,sBAAsB,GACtB,gBAAgB,GAChB,yBAAyB,GACzB,wBAAwB,GACxB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,sBAAsB,GACtB,sBAAsB,GACtB,gCAAgC,GAChC,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,GAC3B,wBAAwB,GACxB,eAAe,GACf,wBAAwB,GACxB,gBAAgB,GAChB,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAChE,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,eAAe,GAAG,cAAc,GAAG,MAAM,CAAC;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,eAAe,GAAG,gBAAgB,GAAG,eAAe,GAClE,sBAAsB,GAAG,gBAAgB,GAAG,cAAc,GAC1D,yBAAyB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9E,kBAAkB,CAAC,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,qCAAqC;IACrC,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,MAAM,eAAe,GAAG,sBAAsB,CAAC;AACrD,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC3C,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0DAA0D;IAC1D,4BAA4B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,EAAE,CAAC,EAAE,iBAAiB,CAAC;IACvB,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;CACzD;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,GAAG,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,WAAW,EAAE,GAAG,CAAC;IACjB,qBAAqB,CAAC,EAAE,GAAG,CAAC;IAC5B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,kBAAkB,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,4BAA4B,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,EAAE,EAAE,YAAY,CAAC;IACjB,0BAA0B,EAAE,0BAA0B,CAAC;CACxD;AAED,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,GACnB,sBAAsB,GACtB,mBAAmB,GACnB,qBAAqB,GACrB,4BAA4B,GAC5B,eAAe,CAAC;AAEpB,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,CAAC,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC5B;IAAE,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAC5B,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,CAAC;AAEvE,0FAA0F;AAC1F,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;CACnF;AAED,sFAAsF;AACtF,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,GACT,SAAS,MAAM,EAAE,GACjB,SAAS,MAAM,EAAE,GACjB,SAAS,OAAO,EAAE,CAAC;AACvB,MAAM,MAAM,aAAa,GAAG,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAC7B,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACpD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/C,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+export const ACTOR_TYPES = [
+    "employee",
+    "contractor",
+    "external_customer",
+    "external_vendor",
+    "service",
+];
+export const VVP_REALM_ROLES = [
+    "platform_admin",
+    "employee",
+    "external_customer",
+    "external_vendor",
+];
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,iBAAiB;IACjB,SAAS;CACD,CAAC;AAMX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,gBAAgB;IAChB,UAAU;IACV,mBAAmB;IACnB,iBAAiB;CACT,CAAC"}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@dreadkn1ght123/auth-types",
+  "version": "0.2.0",
+  "description": "Shared VVP authentication contracts and types",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b --pretty false",
+    "test": "vitest run"
+  }
+}