@fabrika/auth 0.8.2 → 0.9.0-cloudflare.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/auth",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.2",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -12,12 +12,13 @@
 	},
 	"files": [
 		"src",
-		"!src/**/__tests__/**"
+		"!src/**/__tests__/**",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		}
 	},
@@ -27,8 +28,8 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth-core": "0.8.2",
-		"@fabrika/jwks": "0.8.2",
+		"@fabrika/auth-core": "0.9.0-cloudflare.2",
+		"@fabrika/jwks": "0.9.0-cloudflare.2",
 		"jose": "^5.9.0"
 	}
 }

package/src/app-schema.ts

@@ -7,6 +7,7 @@ import {
 	LOCALES,
 	mailTemplateProblems,
 	type MessageKind,
+	terminalIdentifyProblem,
 	WORKLOAD_NAME,
 } from '@fabrika/auth-core'
 import { z } from 'zod'
@@ -230,6 +231,12 @@ const appSchemaShape = z.object({
 		.optional(),
 	members: z.object({ manage: z.string().min(1), list: z.string().min(1) }).optional(),
 	directory: z.literal('labels').optional(),
+	terminal: z.object({
+		identify: z.string().superRefine((value, ctx) => {
+			const problem = terminalIdentifyProblem(value)
+			if (problem !== null) ctx.addIssue({ code: 'custom', message: `the terminal's identification path ${problem}` })
+		}),
+	}).strict().optional(),
 })
 
 /** One message's templates by language, each refused with the same rule the contract build applies. */

package/src/index.ts

@@ -19,8 +19,8 @@ export type { AuthCarrier } from './types'
 // The HTTP transport for the SAME `IamRpc` contract, for a runtime with no Cloudflare service binding
 // (a long-running Bun/Node process). Drops into anywhere a binding goes — `createIam`, `IamClient`,
 // `env.IAM` — because the contract is unchanged and only the transport differs.
-export { DecodedIamMembership, HttpIamMembership, HttpIamRpc, IamTransportError } from './rpc-http'
-export type { IamMembershipMethod } from './rpc-http'
+export { DecodedIamMembership, DecodedIamTerminals, HttpIamMembership, HttpIamRpc, HttpIamTerminals, IamTransportError } from './rpc-http'
+export type { IamMembershipMethod, IamTerminalMethod } from './rpc-http'
 // The membership operations an application requests on its caller's behalf (scopes, members, share links).
 export { createIamMembership, IamMembership } from './membership'
 export type { IamMembershipEnv, MembershipRequestCaller } from './membership'

package/src/rpc-http.ts

@@ -44,9 +44,13 @@
 import type {
 	ApproveDeviceAuthorizationInput,
 	ApproveDeviceAuthorizationResult,
+	AssertIdentityInput,
+	AssertIdentityResult,
 	AssignMemberInput,
 	AssignMemberResult,
 	AuditInput,
+	CancelIdentificationInput,
+	CancelIdentificationResult,
 	CreateScopeInput,
 	CreateScopeResult,
 	DenyDeviceAuthorizationResult,
@@ -54,8 +58,11 @@ import type {
 	FindMemberResult,
 	IamMembershipRpc,
 	IamRpc,
+	IamTerminalRpc,
 	InspectDeviceAuthorizationInput,
 	InspectDeviceAuthorizationResult,
+	InspectIdentificationInput,
+	InspectIdentificationResult,
 	IssueKeyInput,
 	IssueKeyResult,
 	IssueLinkInput,
@@ -82,6 +89,7 @@ import type {
 	RevokeLinkResult,
 	RevokeMemberInput,
 	RevokeMemberResult,
+	TerminalFailure,
 } from '@fabrika/auth-core'
 import {
 	parseApproveDeviceAuthorizationResult,
@@ -469,6 +477,62 @@ export class HttpIamMembership extends DecodedIamMembership {
 	}
 }
 
+/** The identification operations, by name, as a transport carries them. */
+export type IamTerminalMethod = keyof IamTerminalRpc
+
+const inspectIdentificationSuccessSchema = z.object({
+	...okEnvelope,
+	terminal: z.object({ id: z.string().min(1), label: z.string().min(1) }),
+	expiresAt: z.number().finite(),
+})
+const assertIdentitySuccessSchema = z.object({ ...okEnvelope, completionUrl: z.string().url() })
+
+/**
+ * `IamTerminalRpc` over any transport that answers each call with a JSON-shaped body: `HttpIamTerminals`, or a Workers
+ * binding to IAM's application entrypoint (ADR-0067). A body that breaks the contract is `IamTransportError`.
+ */
+export class DecodedIamTerminals implements IamTerminalRpc {
+	readonly #call: (method: IamTerminalMethod, input: unknown) => Promise<unknown>
+
+	constructor(call: (method: IamTerminalMethod, input: unknown) => Promise<unknown>) {
+		this.#call = call
+	}
+
+	async inspectIdentification(input: InspectIdentificationInput): Promise<InspectIdentificationResult> {
+		const body = await this.#call('inspectIdentification', input)
+		return readTerminalFailure(body) ?? decode(inspectIdentificationSuccessSchema, body, 'inspectIdentification')
+	}
+
+	async assertIdentity(input: AssertIdentityInput): Promise<AssertIdentityResult> {
+		const body = await this.#call('assertIdentity', input)
+		return readTerminalFailure(body) ?? decode(assertIdentitySuccessSchema, body, 'assertIdentity')
+	}
+
+	async cancelIdentification(input: CancelIdentificationInput): Promise<CancelIdentificationResult> {
+		const body = await this.#call('cancelIdentification', input)
+		return readTerminalFailure(body) ?? decode(revokedSuccessSchema, body, 'cancelIdentification')
+	}
+}
+
+/**
+ * `IamTerminalRpc` over IAM's membership transport, `POST {origin}/membership/<method>`, with the application's own
+ * membership transport key, which pins the asserting application.
+ */
+export class HttpIamTerminals extends DecodedIamTerminals {
+	constructor(options: HttpIamRpcOptions) {
+		const endpoint = transportEndpoint(options, '/membership/')
+		super((method, input) => callJson(endpoint, method, input))
+	}
+}
+
+const TERMINAL_REASONS = ['missing_token', 'invalid_token', 'not_allowed', 'not_found', 'invalid_principal'] as const
+
+/** An identification refusal off the wire. An unknown reason degrades to `not_allowed`, never to an allow. */
+function readTerminalFailure(body: unknown): TerminalFailure | null {
+	const reason = readFailure(body)
+	return reason === null ? null : { ok: false, reason: oneOf(reason, TERMINAL_REASONS, 'not_allowed') }
+}
+
 /** The five delegation-path failure reasons `issueKey` / `revokeKey` / `listPrincipals` share. */
 const ISSUE_REASONS = ['missing_token', 'invalid_token', 'unknown_principal', 'disabled', 'not_allowed'] as const