@gjermundgaraba/clankercreds-api 0.4.0 → 0.5.0

package/dist/admin.d.ts

@@ -157,7 +157,8 @@ export declare const Admin: readonly [Action.Action<"listCredentials", Schema.$R
 }>, readonly never[], true, typeof CurrentPrincipal>, Action.Action<"putCredential", Schema.Struct<{
     readonly name: Schema.String;
     readonly kind: Schema.Literals<readonly ["gh", "claude", "token"]>;
-    readonly value: Schema.String;
+    /** Surrounding whitespace, such as a pasted line ending, is not part of a secret: a value carrying any is refused, never altered. */
+    readonly value: Schema.Trimmed;
     readonly host: Schema.optionalKey<Schema.String>;
     /** Any date string JavaScript parses; a typo is refused, so alerting never loses it. Left out, it does not expire. */
     readonly expiresAt: Schema.optionalKey<Schema.DateFromString>;
@@ -288,7 +289,8 @@ export declare const AdminHttp: ActionHttp.Binding<readonly [Action.Action<"list
 }>, readonly never[], true, typeof CurrentPrincipal>, Action.Action<"putCredential", Schema.Struct<{
     readonly name: Schema.String;
     readonly kind: Schema.Literals<readonly ["gh", "claude", "token"]>;
-    readonly value: Schema.String;
+    /** Surrounding whitespace, such as a pasted line ending, is not part of a secret: a value carrying any is refused, never altered. */
+    readonly value: Schema.Trimmed;
     readonly host: Schema.optionalKey<Schema.String>;
     /** Any date string JavaScript parses; a typo is refused, so alerting never loses it. Left out, it does not expire. */
     readonly expiresAt: Schema.optionalKey<Schema.DateFromString>;

package/dist/admin.js

@@ -122,7 +122,8 @@ export const Admin = [
         input: Schema.Struct({
             name: Name,
             kind: SecretKind,
-            value: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16_384)),
+            /** Surrounding whitespace, such as a pasted line ending, is not part of a secret: a value carrying any is refused, never altered. */
+            value: Schema.Trimmed.check(Schema.isMinLength(1), Schema.isMaxLength(16_384)),
             host: Schema.optionalKey(Host),
             /** Any date string JavaScript parses; a typo is refused, so alerting never loses it. Left out, it does not expire. */
             expiresAt: Schema.optionalKey(Schema.DateFromString),

package/dist/credentials.d.ts

@@ -42,13 +42,14 @@ export declare const PiCredential: Schema.Struct<{
 }>;
 /**
  * A credential no machine places: an API key, or a Grok or Cursor login's access token, for
- * a service such as clankerusage that knows which provider each name is for. A machine
- * whose config names one refuses the sync.
+ * a service such as clankerusage. `kind` is the credential's own, and any string, so a kind
+ * newer than the caller's contract still decodes. The client skips one a config names.
  */
 export declare const TokenCredential: Schema.Struct<{
     readonly credential: Schema.String;
     readonly expiresAt: Schema.NullOr<Schema.String>;
     readonly type: Schema.Literal<"token">;
+    readonly kind: Schema.String;
     readonly token: Schema.String;
 }>;
 /**
@@ -91,6 +92,7 @@ export declare const TypedCredential: Schema.Union<readonly [Schema.Struct<{
     readonly credential: Schema.String;
     readonly expiresAt: Schema.NullOr<Schema.String>;
     readonly type: Schema.Literal<"token">;
+    readonly kind: Schema.String;
     readonly token: Schema.String;
 }>]>;
 export type TypedCredential = typeof TypedCredential.Type;
@@ -134,6 +136,7 @@ export declare const Delivery: Schema.Struct<{
         readonly credential: Schema.String;
         readonly expiresAt: Schema.NullOr<Schema.String>;
         readonly type: Schema.Literal<"token">;
+        readonly kind: Schema.String;
         readonly token: Schema.String;
     }>]>, Schema.Struct<{
         readonly type: Schema.String;

package/dist/credentials.js

@@ -43,12 +43,13 @@ export const PiCredential = Schema.Struct({
 });
 /**
  * A credential no machine places: an API key, or a Grok or Cursor login's access token, for
- * a service such as clankerusage that knows which provider each name is for. A machine
- * whose config names one refuses the sync.
+ * a service such as clankerusage. `kind` is the credential's own, and any string, so a kind
+ * newer than the caller's contract still decodes. The client skips one a config names.
  */
 export const TokenCredential = Schema.Struct({
     type: Schema.Literal("token"),
     ...fromCredential,
+    kind: Schema.String,
     token: Schema.String,
 });
 /**

package/dist/machine.d.ts

@@ -5,10 +5,13 @@ import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
 import { ProviderUnavailable } from "@gjermundgaraba/clankerauth-sdk/errors";
 import { CurrentPrincipal } from "@gjermundgaraba/clankerauth-sdk/session";
 import { claimsOf, ClientId, CredentialKind, keyIdOf, Name, NeedsSignIn, NotFound, UpstreamUnavailable } from "./shared.ts";
-/** A credential the calling key may read, without its value. */
+/**
+ * A credential the calling key may read, without its value. `kind` is any string, so a kind
+ * newer than the caller's contract does not fail the whole list.
+ */
 export declare const Grant: Schema.Struct<{
     readonly name: Schema.String;
-    readonly kind: Schema.Literals<readonly ["gh", "claude", "token", "chatgpt", "grok", "cursor"]>;
+    readonly kind: Schema.String;
 }>;
 /**
  * What a machine key can do: read the credentials it is granted, by name, and nothing else.
@@ -46,6 +49,7 @@ export declare const Machine: readonly [Action.Action<"sync", Schema.Struct<{
         readonly credential: Schema.String;
         readonly expiresAt: Schema.NullOr<Schema.String>;
         readonly type: Schema.Literal<"token">;
+        readonly kind: Schema.String;
         readonly token: Schema.String;
     }>]>, Schema.Struct<{
         readonly type: Schema.String;
@@ -60,7 +64,7 @@ export declare const Machine: readonly [Action.Action<"sync", Schema.Struct<{
 }>, readonly (typeof NotFound | typeof NeedsSignIn | typeof UpstreamUnavailable)[], false, typeof CurrentPrincipal>, Action.Action<"listGrants", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{
     readonly credentials: Schema.$Array<Schema.Struct<{
         readonly name: Schema.String;
-        readonly kind: Schema.Literals<readonly ["gh", "claude", "token", "chatgpt", "grok", "cursor"]>;
+        readonly kind: Schema.String;
     }>>;
 }>, readonly never[], true, typeof CurrentPrincipal>];
 declare const CodexRefreshRejected_base: Schema.Class<CodexRefreshRejected, Schema.TaggedStruct<"CodexRefreshRejected", {
@@ -146,6 +150,7 @@ export declare const MachineHttp: ActionHttp.Binding<readonly [Action.Action<"sy
         readonly credential: Schema.String;
         readonly expiresAt: Schema.NullOr<Schema.String>;
         readonly type: Schema.Literal<"token">;
+        readonly kind: Schema.String;
         readonly token: Schema.String;
     }>]>, Schema.Struct<{
         readonly type: Schema.String;
@@ -160,7 +165,7 @@ export declare const MachineHttp: ActionHttp.Binding<readonly [Action.Action<"sy
 }>, readonly (typeof NotFound | typeof NeedsSignIn | typeof UpstreamUnavailable)[], false, typeof CurrentPrincipal>, Action.Action<"listGrants", Schema.$Record<Schema.String, Schema.Never>, Schema.Struct<{
     readonly credentials: Schema.$Array<Schema.Struct<{
         readonly name: Schema.String;
-        readonly kind: Schema.Literals<readonly ["gh", "claude", "token", "chatgpt", "grok", "cursor"]>;
+        readonly kind: Schema.String;
     }>>;
 }>, readonly never[], true, typeof CurrentPrincipal>, Action.Action<"codexRefresh", Schema.StructWithRest<Schema.Struct<{
     readonly grant_type: Schema.Literal<"refresh_token">;

package/dist/machine.js

@@ -6,8 +6,11 @@ import { ProviderUnavailable } from "@gjermundgaraba/clankerauth-sdk/errors";
 import { CurrentPrincipal } from "@gjermundgaraba/clankerauth-sdk/session";
 import { CodexLogin, Delivery } from "./credentials.js";
 import { apiPath, claimsOf, ClientId, CredentialKind, keyIdOf, Name, NeedsSignIn, NotFound, UpstreamUnavailable, } from "./shared.js";
-/** A credential the calling key may read, without its value. */
-export const Grant = Schema.Struct({ name: Name, kind: CredentialKind });
+/**
+ * A credential the calling key may read, without its value. `kind` is any string, so a kind
+ * newer than the caller's contract does not fail the whole list.
+ */
+export const Grant = Schema.Struct({ name: Name, kind: Schema.String });
 /**
  * What a machine key can do: read the credentials it is granted, by name, and nothing else.
  * The caller names what it wants; the grants on the server decide whether it may. A machine

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankercreds-api",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The clankercreds wire contract: the machine and admin actions and the typed credentials they deliver, for a typed client of either API.",
   "license": "MIT",
   "repository": {