@ekanos/sdk 0.5.0 → 0.6.0

package/README.md

@@ -1080,6 +1080,10 @@ export const acmeOAuth: PartnerOAuthDeclaration<MyStorage> = {
     tokenUrl: 'https://connect.acme.example/oauth/token',
     scopes: ['payments:read', 'refunds:write'],
     pkce: true,
+    // How the token endpoint wants client authentication. Defaults to
+    // 'client_secret_basic' (HTTP Basic); LinkedIn needs 'client_secret_post'
+    // (client_id and client_secret in the form body).
+    tokenAuthMethod: 'client_secret_basic',
   },
   credentials: {
     clientIdSecretName: 'acme_oauth_client_id',

package/dist/hooks/partner-oauth.js

@@ -25,6 +25,7 @@ export function partnerOAuthErrorParam(integrationSlug) {
 }
 const PARTNER_OAUTH_ERROR_MESSAGES = {
     denied: 'Access was denied at the provider. Try connecting again.',
+    provider_error: 'The provider refused the connection request. Trying again won’t help; contact support if it keeps happening.',
     expired: 'The connection attempt expired. Try connecting again.',
     invalid: 'The connection attempt could not be verified. Try connecting again.',
     unauthorized: 'You need to be signed in as the person who started the connection.',

package/dist/hooks/partner-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"partner-oauth.js","sourceRoot":"","sources":["../../src/hooks/partner-oauth.ts"],"names":[],"mappings":"AAiCA,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAW7C,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACrC,eAAuB,EACvB,OAAO,GAA4B,EAAE;;IAErC,MAAM,IAAI,SAAG,OAAO,CAAC,OAAO,mCAAI,gBAAgB,CAAC;IACjD,OAAO,GAAG,IAAI,IAAI,eAAe,gBAAgB,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CACnC,eAAuB,EACvB,OAAwD;;IAExD,MAAM,IAAI,SAAG,OAAO,CAAC,OAAO,mCAAI,gBAAgB,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,IAAI,IAAI,eAAe,iBAAiB,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,GAAG,eAAe,cAAc;QACtC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,wBAAC,4BAA4B,CAAC,KAAK,CAAC,mCAAI,IAAI,GAAA;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,4BAA4B,GAA2B;IAC3D,MAAM,EAAE,0DAA0D;IAClE,OAAO,EAAE,uDAAuD;IAChE,OAAO,EACL,qEAAqE;IACvE,YAAY,EACV,oEAAoE;IACtE,cAAc,EACZ,+GAA+G;IACjH,eAAe,EACb,0FAA0F;IAC5F,WAAW,EAAE,+DAA+D;IAC5E,eAAe,EACb,sIAAsI;IACxI,cAAc,EACZ,mJAAmJ;IACrJ,mBAAmB,EACjB,mHAAmH;CACtH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,eAAuB,EACvB,OAAO,GAA4B,EAAE;IAErC,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,qBAAqB,CAAC,eAAe,kCAC5C,OAAO,KACV,SAAS,IACT,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,uBAAuB,eAAe,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CACzG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE/C,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,QAAQ,eAAe,gDAAgD,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA+B,CAAC,OAAO,KAAK,SAAS,CAC9D,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The browser half of the hosted partner OAuth transport.\n *\n * A partner's `oauth` declaration names the provider endpoints and the\n * client-credential secrets; the HOST owns the flow — authorize redirect,\n * `state`, callback, code exchange, and the `onTokens` call — behind three\n * generic routes it serves for every partner integration:\n *\n *   GET /api/integrations/[slug]/oauth/connect?accountId=…&returnPath=…\n *   GET /api/integrations/[slug]/oauth/callback    (the provider redirects here)\n *   GET /api/integrations/[slug]/oauth/status?accountId=…\n *\n * These helpers are the only place a partner package should reference those\n * paths, so a route move is one SDK change rather than a hunt through every\n * integration. `OAuthActivationForm`'s `connectPath` default still points at\n * the per-integration `/connect` route first-party packages ship themselves;\n * a partner passes `connectPath: partnerOAuthConnectPath(slug)` explicitly.\n *\n * ```tsx\n * <OAuthActivationForm\n *   {...props}\n *   config={{ slug, displayName: 'Acme', connectPath: partnerOAuthConnectPath(slug), … }}\n *   checkConnection={createPartnerConnectionCheck(slug)}\n *   errorParam={partnerOAuthErrorParam(slug)}\n * />\n * ```\n */\nimport type {\n  ConnectionCheckAction,\n  ConnectionCheckResult,\n  OAuthErrorParam,\n} from './use-oauth-connection-status';\n\nconst DEFAULT_BASE_URL = '/api/integrations';\n\nexport interface PartnerOAuthPathOptions {\n  /**\n   * Overrides the base path. Exists for harnesses and tests that serve the\n   * routes from somewhere other than the host's own origin; production code\n   * should leave it alone.\n   */\n  baseUrl?: string;\n}\n\n/** The hosted connect route the activation form sends the browser to. */\nexport function partnerOAuthConnectPath(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions = {},\n): string {\n  const base = options.baseUrl ?? DEFAULT_BASE_URL;\n  return `${base}/${integrationSlug}/oauth/connect`;\n}\n\n/** The hosted status route `createPartnerConnectionCheck` reads. */\nexport function partnerOAuthStatusUrl(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions & { accountId: string },\n): string {\n  const base = options.baseUrl ?? DEFAULT_BASE_URL;\n  const query = new URLSearchParams({ accountId: options.accountId });\n  return `${base}/${integrationSlug}/oauth/status?${query}`;\n}\n\n/**\n * The error query param the hosted callback appends on failure:\n * `<slug>_oauth_error=<code>`. Codes are the transport's, so the messages\n * live here rather than in every partner package.\n */\nexport function partnerOAuthErrorParam(\n  integrationSlug: string,\n): OAuthErrorParam {\n  return {\n    name: `${integrationSlug}_oauth_error`,\n    toMessage: (value) => PARTNER_OAUTH_ERROR_MESSAGES[value] ?? null,\n  };\n}\n\nconst PARTNER_OAUTH_ERROR_MESSAGES: Record<string, string> = {\n  denied: 'Access was denied at the provider. Try connecting again.',\n  expired: 'The connection attempt expired. Try connecting again.',\n  invalid:\n    'The connection attempt could not be verified. Try connecting again.',\n  unauthorized:\n    'You need to be signed in as the person who started the connection.',\n  not_configured:\n    'This integration is not configured for your workspace yet. Ask an administrator to add its OAuth credentials.',\n  exchange_failed:\n    'The provider rejected the connection. Try again, or contact support if it keeps failing.',\n  save_failed: 'Connected, but the credentials could not be saved. Try again.',\n  wrong_workspace:\n    'You signed in to a different account or workspace than this one is set up for. Switch to that account at the provider and try again.',\n  app_not_set_up:\n    'The provider refused this integration’s app settings, so trying again won’t help. Ask an administrator to check the app’s scopes and credentials.',\n  organization_access:\n    'Connect with personal access — this integration only uses your own account. Try again and choose personal access.',\n};\n\n/**\n * A `ConnectionCheckAction` backed by the hosted status route. The route\n * answers 200 with the standard envelope for both outcomes — `{ success:\n * true, data: { obtainedAt } }` or `{ success: false, error }` — and a non-OK\n * status only when the request itself is unauthorized, so a query error\n * surfaces as an error rather than as a misleading \"not connected\".\n */\nexport function createPartnerConnectionCheck(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions = {},\n): ConnectionCheckAction {\n  return async ({ accountId }) => {\n    const url = partnerOAuthStatusUrl(integrationSlug, {\n      ...options,\n      accountId,\n    });\n\n    const response = await globalThis.fetch(url, {\n      headers: { accept: 'application/json' },\n    });\n\n    if (!response.ok) {\n      throw new Error(\n        `Could not read the '${integrationSlug}' connection status (${response.status} ${response.statusText}).`,\n      );\n    }\n\n    const payload: unknown = await response.json();\n\n    if (!isConnectionCheckResult(payload)) {\n      throw new Error(\n        `The '${integrationSlug}' status route returned an unexpected payload.`,\n      );\n    }\n\n    return payload;\n  };\n}\n\nfunction isConnectionCheckResult(\n  value: unknown,\n): value is ConnectionCheckResult {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { success?: unknown }).success === 'boolean'\n  );\n}\n"]}
+{"version":3,"file":"partner-oauth.js","sourceRoot":"","sources":["../../src/hooks/partner-oauth.ts"],"names":[],"mappings":"AAiCA,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAW7C,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACrC,eAAuB,EACvB,OAAO,GAA4B,EAAE;;IAErC,MAAM,IAAI,SAAG,OAAO,CAAC,OAAO,mCAAI,gBAAgB,CAAC;IACjD,OAAO,GAAG,IAAI,IAAI,eAAe,gBAAgB,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CACnC,eAAuB,EACvB,OAAwD;;IAExD,MAAM,IAAI,SAAG,OAAO,CAAC,OAAO,mCAAI,gBAAgB,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,IAAI,IAAI,eAAe,iBAAiB,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,GAAG,eAAe,cAAc;QACtC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,wBAAC,4BAA4B,CAAC,KAAK,CAAC,mCAAI,IAAI,GAAA;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,4BAA4B,GAA2B;IAC3D,MAAM,EAAE,0DAA0D;IAClE,cAAc,EACZ,8GAA8G;IAChH,OAAO,EAAE,uDAAuD;IAChE,OAAO,EACL,qEAAqE;IACvE,YAAY,EACV,oEAAoE;IACtE,cAAc,EACZ,+GAA+G;IACjH,eAAe,EACb,0FAA0F;IAC5F,WAAW,EAAE,+DAA+D;IAC5E,eAAe,EACb,sIAAsI;IACxI,cAAc,EACZ,mJAAmJ;IACrJ,mBAAmB,EACjB,mHAAmH;CACtH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,eAAuB,EACvB,OAAO,GAA4B,EAAE;IAErC,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,qBAAqB,CAAC,eAAe,kCAC5C,OAAO,KACV,SAAS,IACT,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,uBAAuB,eAAe,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CACzG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE/C,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,QAAQ,eAAe,gDAAgD,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA+B,CAAC,OAAO,KAAK,SAAS,CAC9D,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The browser half of the hosted partner OAuth transport.\n *\n * A partner's `oauth` declaration names the provider endpoints and the\n * client-credential secrets; the HOST owns the flow — authorize redirect,\n * `state`, callback, code exchange, and the `onTokens` call — behind three\n * generic routes it serves for every partner integration:\n *\n *   GET /api/integrations/[slug]/oauth/connect?accountId=…&returnPath=…\n *   GET /api/integrations/[slug]/oauth/callback    (the provider redirects here)\n *   GET /api/integrations/[slug]/oauth/status?accountId=…\n *\n * These helpers are the only place a partner package should reference those\n * paths, so a route move is one SDK change rather than a hunt through every\n * integration. `OAuthActivationForm`'s `connectPath` default still points at\n * the per-integration `/connect` route first-party packages ship themselves;\n * a partner passes `connectPath: partnerOAuthConnectPath(slug)` explicitly.\n *\n * ```tsx\n * <OAuthActivationForm\n *   {...props}\n *   config={{ slug, displayName: 'Acme', connectPath: partnerOAuthConnectPath(slug), … }}\n *   checkConnection={createPartnerConnectionCheck(slug)}\n *   errorParam={partnerOAuthErrorParam(slug)}\n * />\n * ```\n */\nimport type {\n  ConnectionCheckAction,\n  ConnectionCheckResult,\n  OAuthErrorParam,\n} from './use-oauth-connection-status';\n\nconst DEFAULT_BASE_URL = '/api/integrations';\n\nexport interface PartnerOAuthPathOptions {\n  /**\n   * Overrides the base path. Exists for harnesses and tests that serve the\n   * routes from somewhere other than the host's own origin; production code\n   * should leave it alone.\n   */\n  baseUrl?: string;\n}\n\n/** The hosted connect route the activation form sends the browser to. */\nexport function partnerOAuthConnectPath(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions = {},\n): string {\n  const base = options.baseUrl ?? DEFAULT_BASE_URL;\n  return `${base}/${integrationSlug}/oauth/connect`;\n}\n\n/** The hosted status route `createPartnerConnectionCheck` reads. */\nexport function partnerOAuthStatusUrl(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions & { accountId: string },\n): string {\n  const base = options.baseUrl ?? DEFAULT_BASE_URL;\n  const query = new URLSearchParams({ accountId: options.accountId });\n  return `${base}/${integrationSlug}/oauth/status?${query}`;\n}\n\n/**\n * The error query param the hosted callback appends on failure:\n * `<slug>_oauth_error=<code>`. Codes are the transport's, so the messages\n * live here rather than in every partner package.\n */\nexport function partnerOAuthErrorParam(\n  integrationSlug: string,\n): OAuthErrorParam {\n  return {\n    name: `${integrationSlug}_oauth_error`,\n    toMessage: (value) => PARTNER_OAUTH_ERROR_MESSAGES[value] ?? null,\n  };\n}\n\nconst PARTNER_OAUTH_ERROR_MESSAGES: Record<string, string> = {\n  denied: 'Access was denied at the provider. Try connecting again.',\n  provider_error:\n    'The provider refused the connection request. Trying again won’t help; contact support if it keeps happening.',\n  expired: 'The connection attempt expired. Try connecting again.',\n  invalid:\n    'The connection attempt could not be verified. Try connecting again.',\n  unauthorized:\n    'You need to be signed in as the person who started the connection.',\n  not_configured:\n    'This integration is not configured for your workspace yet. Ask an administrator to add its OAuth credentials.',\n  exchange_failed:\n    'The provider rejected the connection. Try again, or contact support if it keeps failing.',\n  save_failed: 'Connected, but the credentials could not be saved. Try again.',\n  wrong_workspace:\n    'You signed in to a different account or workspace than this one is set up for. Switch to that account at the provider and try again.',\n  app_not_set_up:\n    'The provider refused this integration’s app settings, so trying again won’t help. Ask an administrator to check the app’s scopes and credentials.',\n  organization_access:\n    'Connect with personal access — this integration only uses your own account. Try again and choose personal access.',\n};\n\n/**\n * A `ConnectionCheckAction` backed by the hosted status route. The route\n * answers 200 with the standard envelope for both outcomes — `{ success:\n * true, data: { obtainedAt } }` or `{ success: false, error }` — and a non-OK\n * status only when the request itself is unauthorized, so a query error\n * surfaces as an error rather than as a misleading \"not connected\".\n */\nexport function createPartnerConnectionCheck(\n  integrationSlug: string,\n  options: PartnerOAuthPathOptions = {},\n): ConnectionCheckAction {\n  return async ({ accountId }) => {\n    const url = partnerOAuthStatusUrl(integrationSlug, {\n      ...options,\n      accountId,\n    });\n\n    const response = await globalThis.fetch(url, {\n      headers: { accept: 'application/json' },\n    });\n\n    if (!response.ok) {\n      throw new Error(\n        `Could not read the '${integrationSlug}' connection status (${response.status} ${response.statusText}).`,\n      );\n    }\n\n    const payload: unknown = await response.json();\n\n    if (!isConnectionCheckResult(payload)) {\n      throw new Error(\n        `The '${integrationSlug}' status route returned an unexpected payload.`,\n      );\n    }\n\n    return payload;\n  };\n}\n\nfunction isConnectionCheckResult(\n  value: unknown,\n): value is ConnectionCheckResult {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { success?: unknown }).success === 'boolean'\n  );\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekanos/sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The official SDK for building Ekanos integrations.",
   "bugs": {
     "email": "npm@govastly.com"
@@ -65,8 +65,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@ekanos/integration-schema": "0.5.0",
-    "@ekanos/ui": "0.5.0",
+    "@ekanos/integration-schema": "0.6.0",
+    "@ekanos/ui": "0.6.0",
     "@supabase/supabase-js": "2.87.1",
     "server-only": "^0.0.1"
   },
@@ -77,7 +77,7 @@
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.5",
     "eslint": "^10.11.0",
-    "next": "16.3.6",
+    "next": "16.4.0",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-hook-form": "^7.88.0",