@palantir/pack.auth 0.0.1-beta.1

package/build/cjs/index.d.cts

@@ -0,0 +1,189 @@
+import { Flavored, PackAppInternal, Unsubscribe, ModuleConfigTuple } from '@palantir/pack.core';
+
+declare const AuthState: {
+    readonly Authenticated: "authenticated";
+    readonly Authenticating: "authenticating";
+    readonly Error: "error";
+    readonly Initializing: "initializing";
+    readonly Unauthenticated: "unauthenticated";
+};
+type AuthState = typeof AuthState[keyof typeof AuthState];
+interface AuthStateChangeEvent {
+    readonly previousState?: AuthState;
+    readonly state: AuthState;
+    readonly error?: Error;
+}
+type AuthStateCallback = (event: AuthStateChangeEvent) => void;
+
+declare const UserRefBrand: unique symbol;
+type UserId = Flavored<"pack:UserId">;
+/**
+ * Reference to a user from the platform API.
+ * Provides access to user information with caching.
+ */
+interface UserRef {
+    readonly userId: UserId;
+    readonly [UserRefBrand]: typeof UserRefBrand;
+    /**
+     * Get the current user data from the platform API.
+     * Results are cached to avoid excessive API calls.
+     * @param force - Force refresh of cached data
+     */
+    readonly get: (force?: boolean) => Promise<unknown>;
+}
+declare function invalidUserRef(): UserRef;
+declare function isValidUserRef(userRef: UserRef): boolean;
+declare const createUserRef: (app: PackAppInternal, userId: UserId) => UserRef;
+
+/**
+ * Represents the parsed payload from a JWT token (unverified).
+ * The information provided should not be used for security-sensitive
+ * applications unless verified through some other process.
+ */
+interface UnverifiedTokenInfo {
+    readonly expiryInstantUtc?: number;
+    readonly orgId?: string;
+    readonly sessionId?: string;
+    readonly tokenId?: string;
+    readonly userId?: UserId;
+}
+
+/**
+ * Callback function for token change events. A signout may fire a token change with undefined token.
+ */
+type TokenChangeCallback = (token: string | undefined, info: UnverifiedTokenInfo) => void;
+
+/**
+ * AuthModule provides unified authentication services for PACK applications.
+ *
+ * It wraps OSDK OAuth clients and provides a consistent interface for authentication
+ * state management, token access, and auth lifecycle events.
+ */
+interface AuthModule {
+    /**
+     * Get the current user information.
+     * Returns undefined if not authenticated or user data not available.
+     */
+    readonly getCurrentUser: () => UserRef | undefined;
+    /**
+     * Get an access token, automatically refreshing if needed.
+     * Throws if authentication fails or user is not signed in.
+     */
+    readonly getToken: () => Promise<string>;
+    /**
+     * Get the current access token without refresh, returns undefined if expired or unavailable.
+     */
+    readonly getTokenOrUndefined: () => string | undefined;
+    /**
+     * Get user data for a specific user ID.
+     * @param userId - The user ID to fetch data for
+     * @param force - Force refresh of cached data
+     * @returns Promise resolving to user data
+     */
+    readonly getUserData: (userId: string, force?: boolean) => Promise<unknown>;
+    /**
+     * Check if the user is currently authenticated with a valid token.
+     */
+    readonly isAuthenticated: () => boolean;
+    /**
+     * Subscribe to authentication state changes.
+     *
+     * @param callback Function called when auth state changes
+     * @returns Unsubscribe function
+     */
+    readonly onAuthStateChange: (callback: AuthStateCallback) => Unsubscribe;
+    /**
+     * Subscribe to token changes.
+     *
+     * @param callback Function called when token changes
+     * @returns Unsubscribe function
+     */
+    readonly onTokenChange: (callback: TokenChangeCallback) => Unsubscribe;
+    /**
+     * Manually refresh the access token using the refresh token.
+     * Only available for public OAuth clients.
+     */
+    readonly refresh?: () => Promise<void>;
+    /**
+     * Initiate sign-in flow. For public clients, this redirects to OAuth.
+     * For confidential clients, this performs client credentials flow.
+     */
+    readonly signIn: () => Promise<void>;
+    /**
+     * Sign out the current user and clear tokens.
+     */
+    readonly signOut: () => Promise<void>;
+    /**
+     * Validate the current token by checking with the platform API.
+     * Returns true if the token is valid, false otherwise.
+     */
+    readonly validateToken: () => Promise<boolean>;
+    /**
+     * Wait for authentication to complete. Resolves when authenticated,
+     * rejects if authentication fails or times out.
+     */
+    readonly waitForAuth: () => Promise<void>;
+}
+/**
+ * Get the auth module from an PACK app instance.
+ *
+ * @param app - PACK app instance
+ * @returns The auth module
+ */
+declare function getAuthModule(app: PackAppInternal): AuthModule;
+
+/**
+ * Base interface for auth services that wrap different OAuth client implementations
+ */
+interface BaseAuthService {
+    dispose(): void;
+    getCurrentState(): AuthState;
+    getCurrentUserId(): string | undefined;
+    getToken(): Promise<string>;
+    getTokenOrUndefined(): string | undefined;
+    getUserData(userId: string, force?: boolean): Promise<unknown>;
+    isAuthenticated(): boolean;
+    isValidated(): boolean;
+    onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+    onTokenChange(callback: TokenChangeCallback): Unsubscribe;
+    refresh?(): Promise<void>;
+    signIn(): Promise<void>;
+    signOut(): Promise<void>;
+    validateToken(): Promise<boolean>;
+}
+
+/**
+ * Configuration for AuthModule initialization
+ */
+interface AuthModuleConfig {
+    readonly authService: BaseAuthService;
+}
+/**
+ * Creates an auth module configuration tuple.
+ *
+ * @param authService - The auth service to use
+ * @returns Module configuration tuple for the auth module
+ */
+declare function createAuthModuleConfig(authService: BaseAuthService): ModuleConfigTuple<AuthModule>;
+
+declare class AuthModuleImpl implements AuthModule {
+    #private;
+    private readonly app;
+    private signInPromise?;
+    constructor(app: PackAppInternal, authService: BaseAuthService);
+    isAuthenticated(): boolean;
+    getToken(): Promise<string>;
+    getTokenOrUndefined(): string | undefined;
+    signIn(): Promise<void>;
+    signOut(): Promise<void>;
+    refresh(): Promise<void>;
+    onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+    onTokenChange(callback: TokenChangeCallback): Unsubscribe;
+    waitForAuth(): Promise<void>;
+    getCurrentUser(): UserRef | undefined;
+    validateToken(): Promise<boolean>;
+    getUserData(userId: string, force?: boolean): Promise<unknown>;
+    dispose(): void;
+}
+
+export { type AuthModule, type AuthModuleConfig, AuthModuleImpl, AuthState, type AuthStateCallback, type AuthStateChangeEvent, type BaseAuthService, type TokenChangeCallback, type UnverifiedTokenInfo, type UserId, type UserRef, createAuthModuleConfig, createUserRef, getAuthModule, invalidUserRef, isValidUserRef };

package/build/esm/index.js

@@ -0,0 +1,155 @@
+import { assertIsAppInternal } from '@palantir/pack.core';
+
+// src/types/AuthModule.ts
+
+// src/types/AuthState.ts
+var AuthState = {
+  Authenticated: "authenticated",
+  Authenticating: "authenticating",
+  Error: "error",
+  Initializing: "initializing",
+  Unauthenticated: "unauthenticated"
+};
+
+// src/types/UserRef.ts
+var UserRefBrand = Symbol("UserRef");
+var INVALID_USER_ID = "INVALID_USER_REF";
+var INVALID_USER_REF = Object.freeze({
+  userId: INVALID_USER_ID,
+  [UserRefBrand]: UserRefBrand,
+  get: () => Promise.reject(new Error("Invalid user reference"))
+});
+function invalidUserRef() {
+  return INVALID_USER_REF;
+}
+function isValidUserRef(userRef) {
+  return userRef.userId !== INVALID_USER_ID && userRef.userId !== "";
+}
+var createUserRef = (app, userId) => {
+  return new UserRefImpl(app, userId);
+};
+var UserRefImpl = class {
+  userId;
+  #authModule;
+  constructor(app, userId) {
+    this.#authModule = getAuthModule(app);
+    this.userId = userId;
+  }
+  get(force) {
+    return this.#authModule.getUserData(this.userId, force);
+  }
+};
+
+// src/utils/AuthModuleImpl.ts
+var AuthModuleImpl = class {
+  #authService;
+  app;
+  signInPromise;
+  constructor(app, authService) {
+    this.app = app;
+    this.#authService = authService;
+  }
+  // AuthModule interface implementation
+  isAuthenticated() {
+    return this.#authService.isAuthenticated();
+  }
+  async getToken() {
+    return this.#authService.getToken();
+  }
+  getTokenOrUndefined() {
+    return this.#authService.getTokenOrUndefined();
+  }
+  async signIn() {
+    if (this.signInPromise) {
+      return this.signInPromise;
+    }
+    this.signInPromise = (async () => {
+      try {
+        await this.#authService.signIn();
+      } finally {
+        this.signInPromise = void 0;
+      }
+    })();
+    return this.signInPromise;
+  }
+  async signOut() {
+    return this.#authService.signOut();
+  }
+  async refresh() {
+    if (!this.#authService.refresh) {
+      throw new Error("Refresh not supported for this auth client type");
+    }
+    return this.#authService.refresh();
+  }
+  onAuthStateChange(callback) {
+    return this.#authService.onAuthStateChange(callback);
+  }
+  onTokenChange(callback) {
+    return this.#authService.onTokenChange(callback);
+  }
+  async waitForAuth() {
+    if (this.isAuthenticated()) {
+      return Promise.resolve();
+    }
+    return new Promise((resolve, reject) => {
+      const unsubscribe = this.onAuthStateChange((event) => {
+        if (event.state === AuthState.Authenticated) {
+          unsubscribe();
+          resolve();
+        } else if (event.state === AuthState.Error) {
+          unsubscribe();
+          reject(new Error("Authentication failed", {
+            cause: event.error
+          }));
+        }
+      });
+    });
+  }
+  getCurrentUser() {
+    const userId = this.#authService.getCurrentUserId();
+    if (!userId) {
+      return void 0;
+    }
+    return createUserRef(this.app, userId);
+  }
+  async validateToken() {
+    return this.#authService.validateToken();
+  }
+  async getUserData(userId, force) {
+    return this.#authService.getUserData(userId, force);
+  }
+  dispose() {
+    this.#authService.dispose();
+    this.signInPromise = void 0;
+  }
+};
+
+// src/constants/AuthModuleKey.ts
+var AUTH_MODULE_KEY = {
+  appMemberName: "auth",
+  key: Symbol.for("pack.auth"),
+  initModule: (app, config) => {
+    if (!config) {
+      throw new Error("AuthModuleConfig is required to initialize AuthModule");
+    }
+    return new AuthModuleImpl(app, config.authService);
+  }
+};
+
+// src/types/AuthModule.ts
+function getAuthModule(app) {
+  assertIsAppInternal(app);
+  return app.getModule(AUTH_MODULE_KEY);
+}
+
+// src/utils/AuthModuleConfig.ts
+function createAuthModuleConfig(authService) {
+  const config = {
+    authService
+  };
+  return [AUTH_MODULE_KEY, config];
+}
+
+export { AuthModuleImpl, AuthState, createAuthModuleConfig, createUserRef, getAuthModule, invalidUserRef, isValidUserRef };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/build/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/types/AuthState.ts","../../src/types/UserRef.ts","../../src/utils/AuthModuleImpl.ts","../../src/constants/AuthModuleKey.ts","../../src/types/AuthModule.ts","../../src/utils/AuthModuleConfig.ts"],"names":[],"mappings":";;;;;AAgBO,IAAM,SAAA,GAAY;AAAA,EACvB,aAAA,EAAe,eAAA;AAAA,EACf,cAAA,EAAgB,gBAAA;AAAA,EAChB,KAAA,EAAO,OAAA;AAAA,EACP,YAAA,EAAc,cAAA;AAAA,EACd,eAAA,EAAiB;AACnB;;;ACLA,IAAM,YAAA,GAAe,OAAO,SAAS,CAAA;AAOrC,IAAM,eAAA,GAAkB,kBAAA;AACxB,IAAM,gBAAA,GAAmB,OAAO,MAAA,CAAO;AAAA,EACrC,MAAA,EAAQ,eAAA;AAAA,EACR,CAAC,YAAY,GAAG,YAAA;AAAA,EAChB,KAAK,MAAM,OAAA,CAAQ,OAAO,IAAI,KAAA,CAAM,wBAAwB,CAAC;AAC/D,CAAC,CAAA;AACM,SAAS,cAAA,GAAiB;AAC/B,EAAA,OAAO,gBAAA;AACT;AACO,SAAS,eAAe,OAAA,EAAS;AACtC,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,eAAA,IAAmB,OAAA,CAAQ,MAAA,KAAW,EAAA;AAClE;AACO,IAAM,aAAA,GAAgB,CAAC,GAAA,EAAK,MAAA,KAAW;AAC5C,EAAA,OAAO,IAAI,WAAA,CAAY,GAAA,EAAK,MAAM,CAAA;AACpC;AACA,IAAM,cAAN,MAAkB;AAAA,EAChB,MAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,MAAA,EAAQ;AACvB,IAAA,IAAA,CAAK,WAAA,GAAc,cAAc,GAAG,CAAA;AACpC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EACA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,EACxD;AACF,CAAA;;;AC/BO,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAA;AAAA,EACA,GAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA,CAAY,KAAK,WAAA,EAAa;AAC5B,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,WAAA;AAAA,EACtB;AAAA;AAAA,EAGA,eAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,aAAa,eAAA,EAAgB;AAAA,EAC3C;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,IAAA,CAAK,aAAa,QAAA,EAAS;AAAA,EACpC;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,aAAa,mBAAA,EAAoB;AAAA,EAC/C;AAAA,EACA,MAAM,MAAA,GAAS;AACb,IAAA,IAAI,KAAK,aAAA,EAAe;AACtB,MAAA,OAAO,IAAA,CAAK,aAAA;AAAA,IACd;AACA,IAAA,IAAA,CAAK,iBAAiB,YAAY;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,CAAK,aAAa,MAAA,EAAO;AAAA,MACjC,CAAA,SAAE;AACA,QAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AAAA,MACvB;AAAA,IACF,CAAA,GAAG;AACH,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,OAAO,IAAA,CAAK,aAAa,OAAA,EAAQ;AAAA,EACnC;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,CAAa,OAAA,EAAS;AAC9B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IACnE;AACA,IAAA,OAAO,IAAA,CAAK,aAAa,OAAA,EAAQ;AAAA,EACnC;AAAA,EACA,kBAAkB,QAAA,EAAU;AAC1B,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,iBAAA,CAAkB,QAAQ,CAAA;AAAA,EACrD;AAAA,EACA,cAAc,QAAA,EAAU;AACtB,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,aAAA,CAAc,QAAQ,CAAA;AAAA,EACjD;AAAA,EACA,MAAM,WAAA,GAAc;AAElB,IAAA,IAAI,IAAA,CAAK,iBAAgB,EAAG;AAC1B,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,iBAAA,CAAkB,CAAA,KAAA,KAAS;AAClD,QAAA,IAAI,KAAA,CAAM,KAAA,KAAU,SAAA,CAAU,aAAA,EAAe;AAC3C,UAAA,WAAA,EAAY;AACZ,UAAA,OAAA,EAAQ;AAAA,QACV,CAAA,MAAA,IAAW,KAAA,CAAM,KAAA,KAAU,SAAA,CAAU,KAAA,EAAO;AAC1C,UAAA,WAAA,EAAY;AACZ,UAAA,MAAA,CAAO,IAAI,MAAM,uBAAA,EAAyB;AAAA,YACxC,OAAO,KAAA,CAAM;AAAA,WACd,CAAC,CAAA;AAAA,QACJ;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EACA,cAAA,GAAiB;AACf,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,CAAa,gBAAA,EAAiB;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,aAAA,CAAc,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AAAA,EACvC;AAAA,EACA,MAAM,aAAA,GAAgB;AACpB,IAAA,OAAO,IAAA,CAAK,aAAa,aAAA,EAAc;AAAA,EACzC;AAAA,EACA,MAAM,WAAA,CAAY,MAAA,EAAQ,KAAA,EAAO;AAC/B,IAAA,OAAO,IAAA,CAAK,YAAA,CAAa,WAAA,CAAY,MAAA,EAAQ,KAAK,CAAA;AAAA,EACpD;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,aAAa,OAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AAAA,EACvB;AACF;;;ACpFO,IAAM,eAAA,GAAkB;AAAA,EAC7B,aAAA,EAAe,MAAA;AAAA,EACf,GAAA,EAAK,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,EAC3B,UAAA,EAAY,CAAC,GAAA,EAAK,MAAA,KAAW;AAC3B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IACzE;AACA,IAAA,OAAO,IAAI,cAAA,CAAe,GAAA,EAAK,MAAA,CAAO,WAAW,CAAA;AAAA,EACnD;AACF,CAAA;;;ACOO,SAAS,cAAc,GAAA,EAAK;AACjC,EAAA,mBAAA,CAAoB,GAAG,CAAA;AACvB,EAAA,OAAO,GAAA,CAAI,UAAU,eAAe,CAAA;AACtC;;;ACRO,SAAS,uBAAuB,WAAA,EAAa;AAClD,EAAA,MAAM,MAAA,GAAS;AAAA,IACb;AAAA,GACF;AACA,EAAA,OAAO,CAAC,iBAAiB,MAAM,CAAA;AACjC","file":"index.js","sourcesContent":["/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport const AuthState = {\n  Authenticated: \"authenticated\",\n  Authenticating: \"authenticating\",\n  Error: \"error\",\n  Initializing: \"initializing\",\n  Unauthenticated: \"unauthenticated\"\n};","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { getAuthModule } from \"./AuthModule.js\";\nconst UserRefBrand = Symbol(\"UserRef\");\n\n/**\n * Reference to a user from the platform API.\n * Provides access to user information with caching.\n */\n\nconst INVALID_USER_ID = \"INVALID_USER_REF\";\nconst INVALID_USER_REF = Object.freeze({\n  userId: INVALID_USER_ID,\n  [UserRefBrand]: UserRefBrand,\n  get: () => Promise.reject(new Error(\"Invalid user reference\"))\n});\nexport function invalidUserRef() {\n  return INVALID_USER_REF;\n}\nexport function isValidUserRef(userRef) {\n  return userRef.userId !== INVALID_USER_ID && userRef.userId !== \"\";\n}\nexport const createUserRef = (app, userId) => {\n  return new UserRefImpl(app, userId);\n};\nclass UserRefImpl {\n  userId;\n  #authModule;\n  constructor(app, userId) {\n    this.#authModule = getAuthModule(app);\n    this.userId = userId;\n  }\n  get(force) {\n    return this.#authModule.getUserData(this.userId, force);\n  }\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"../types/AuthState.js\";\nimport { createUserRef } from \"../types/UserRef.js\";\nexport class AuthModuleImpl {\n  #authService;\n  app;\n  signInPromise;\n  constructor(app, authService) {\n    this.app = app;\n    this.#authService = authService;\n  }\n\n  // AuthModule interface implementation\n  isAuthenticated() {\n    return this.#authService.isAuthenticated();\n  }\n  async getToken() {\n    return this.#authService.getToken();\n  }\n  getTokenOrUndefined() {\n    return this.#authService.getTokenOrUndefined();\n  }\n  async signIn() {\n    if (this.signInPromise) {\n      return this.signInPromise;\n    }\n    this.signInPromise = (async () => {\n      try {\n        await this.#authService.signIn();\n      } finally {\n        this.signInPromise = undefined;\n      }\n    })();\n    return this.signInPromise;\n  }\n  async signOut() {\n    return this.#authService.signOut();\n  }\n  async refresh() {\n    if (!this.#authService.refresh) {\n      throw new Error(\"Refresh not supported for this auth client type\");\n    }\n    return this.#authService.refresh();\n  }\n  onAuthStateChange(callback) {\n    return this.#authService.onAuthStateChange(callback);\n  }\n  onTokenChange(callback) {\n    return this.#authService.onTokenChange(callback);\n  }\n  async waitForAuth() {\n    // If already authenticated, resolve immediately\n    if (this.isAuthenticated()) {\n      return Promise.resolve();\n    }\n    return new Promise((resolve, reject) => {\n      const unsubscribe = this.onAuthStateChange(event => {\n        if (event.state === AuthState.Authenticated) {\n          unsubscribe();\n          resolve();\n        } else if (event.state === AuthState.Error) {\n          unsubscribe();\n          reject(new Error(\"Authentication failed\", {\n            cause: event.error\n          }));\n        }\n      });\n    });\n  }\n  getCurrentUser() {\n    const userId = this.#authService.getCurrentUserId();\n    if (!userId) {\n      return undefined;\n    }\n    return createUserRef(this.app, userId);\n  }\n  async validateToken() {\n    return this.#authService.validateToken();\n  }\n  async getUserData(userId, force) {\n    return this.#authService.getUserData(userId, force);\n  }\n  dispose() {\n    this.#authService.dispose();\n    this.signInPromise = undefined;\n  }\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthModuleImpl } from \"../utils/AuthModuleImpl.js\";\nexport const AUTH_MODULE_KEY = {\n  appMemberName: \"auth\",\n  key: Symbol.for(\"pack.auth\"),\n  initModule: (app, config) => {\n    if (!config) {\n      throw new Error(\"AuthModuleConfig is required to initialize AuthModule\");\n    }\n    return new AuthModuleImpl(app, config.authService);\n  }\n};","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { assertIsAppInternal } from \"@palantir/pack.core\";\nimport { AUTH_MODULE_KEY } from \"../constants/AuthModuleKey.js\";\n\n/**\n * AuthModule provides unified authentication services for PACK applications.\n *\n * It wraps OSDK OAuth clients and provides a consistent interface for authentication\n * state management, token access, and auth lifecycle events.\n */\n// TODO: functions should be method style\n\n/**\n * Get the auth module from an PACK app instance.\n *\n * @param app - PACK app instance\n * @returns The auth module\n */\nexport function getAuthModule(app) {\n  assertIsAppInternal(app);\n  return app.getModule(AUTH_MODULE_KEY);\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AUTH_MODULE_KEY } from \"../constants/AuthModuleKey.js\";\n\n/**\n * Configuration for AuthModule initialization\n */\n\n/**\n * Creates an auth module configuration tuple.\n *\n * @param authService - The auth service to use\n * @returns Module configuration tuple for the auth module\n */\nexport function createAuthModuleConfig(authService) {\n  const config = {\n    authService\n  };\n  return [AUTH_MODULE_KEY, config];\n}"]}

package/build/types/__tests__/AuthModuleImpl.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/types/__tests__/AuthModuleImpl.test.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"","names":[],"sources":["../../../src/__tests__/AuthModuleImpl.test.ts"],"version":3,"file":"AuthModuleImpl.test.d.ts"}

package/build/types/constants/AuthModuleKey.d.ts

@@ -0,0 +1,4 @@
+import type { ModuleKey } from "@palantir/pack.core";
+import type { AuthModule } from "../types/AuthModule.js";
+import type { AuthModuleConfig } from "../utils/AuthModuleConfig.js";
+export declare const AUTH_MODULE_KEY: ModuleKey<AuthModule, AuthModuleConfig>;

package/build/types/constants/AuthModuleKey.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,iBAAkC;AAChD,cAAc,kBAAkB;AAChC,cAAc,wBAAwB;AAGtC,OAAO,cAAMA,iBAAiB,UAAU,YAAY","names":["AUTH_MODULE_KEY: ModuleKey<AuthModule, AuthModuleConfig>"],"sources":["../../../src/constants/AuthModuleKey.ts"],"version":3,"file":"AuthModuleKey.d.ts"}

package/build/types/index.d.ts

@@ -0,0 +1,11 @@
+export { getAuthModule } from "./types/AuthModule.js";
+export type { AuthModule } from "./types/AuthModule.js";
+export { AuthState } from "./types/AuthState.js";
+export type { AuthStateCallback, AuthStateChangeEvent } from "./types/AuthState.js";
+export type { BaseAuthService } from "./types/BaseAuthService.js";
+export type { TokenChangeCallback } from "./types/TokenChange.js";
+export type { UnverifiedTokenInfo } from "./types/UnverifiedTokenInfo.js";
+export { createUserRef, invalidUserRef, isValidUserRef } from "./types/UserRef.js";
+export type { UserId, UserRef } from "./types/UserRef.js";
+export { type AuthModuleConfig, createAuthModuleConfig } from "./utils/AuthModuleConfig.js";
+export { AuthModuleImpl } from "./utils/AuthModuleImpl.js";

package/build/types/index.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,SAAS,qBAAqB;AAC9B,cAAc,kBAAkB;AAChC,SAAS,iBAAiB;AAC1B,cAAc,mBAAmB,4BAA4B;AAC7D,cAAc,uBAAuB;AACrC,cAAc,2BAA2B;AACzC,cAAc,2BAA2B;AACzC,SAAS,eAAe,gBAAgB,sBAAsB;AAC9D,cAAc,QAAQ,eAAe;AACrC,cAAc,kBAAkB,8BAA8B;AAC9D,SAAS,sBAAsB","names":[],"sources":["../../src/index.ts"],"version":3,"file":"index.d.ts"}

package/build/types/types/AuthModule.d.ts

@@ -0,0 +1,82 @@
+import type { PackAppInternal, Unsubscribe } from "@palantir/pack.core";
+import type { AuthStateCallback } from "./AuthState.js";
+import type { TokenChangeCallback } from "./TokenChange.js";
+import type { UserRef } from "./UserRef.js";
+/**
+* AuthModule provides unified authentication services for PACK applications.
+*
+* It wraps OSDK OAuth clients and provides a consistent interface for authentication
+* state management, token access, and auth lifecycle events.
+*/
+export interface AuthModule {
+	/**
+	* Get the current user information.
+	* Returns undefined if not authenticated or user data not available.
+	*/
+	readonly getCurrentUser: () => UserRef | undefined;
+	/**
+	* Get an access token, automatically refreshing if needed.
+	* Throws if authentication fails or user is not signed in.
+	*/
+	readonly getToken: () => Promise<string>;
+	/**
+	* Get the current access token without refresh, returns undefined if expired or unavailable.
+	*/
+	readonly getTokenOrUndefined: () => string | undefined;
+	/**
+	* Get user data for a specific user ID.
+	* @param userId - The user ID to fetch data for
+	* @param force - Force refresh of cached data
+	* @returns Promise resolving to user data
+	*/
+	readonly getUserData: (userId: string, force?: boolean) => Promise<unknown>;
+	/**
+	* Check if the user is currently authenticated with a valid token.
+	*/
+	readonly isAuthenticated: () => boolean;
+	/**
+	* Subscribe to authentication state changes.
+	*
+	* @param callback Function called when auth state changes
+	* @returns Unsubscribe function
+	*/
+	readonly onAuthStateChange: (callback: AuthStateCallback) => Unsubscribe;
+	/**
+	* Subscribe to token changes.
+	*
+	* @param callback Function called when token changes
+	* @returns Unsubscribe function
+	*/
+	readonly onTokenChange: (callback: TokenChangeCallback) => Unsubscribe;
+	/**
+	* Manually refresh the access token using the refresh token.
+	* Only available for public OAuth clients.
+	*/
+	readonly refresh?: () => Promise<void>;
+	/**
+	* Initiate sign-in flow. For public clients, this redirects to OAuth.
+	* For confidential clients, this performs client credentials flow.
+	*/
+	readonly signIn: () => Promise<void>;
+	/**
+	* Sign out the current user and clear tokens.
+	*/
+	readonly signOut: () => Promise<void>;
+	/**
+	* Validate the current token by checking with the platform API.
+	* Returns true if the token is valid, false otherwise.
+	*/
+	readonly validateToken: () => Promise<boolean>;
+	/**
+	* Wait for authentication to complete. Resolves when authenticated,
+	* rejects if authentication fails or times out.
+	*/
+	readonly waitForAuth: () => Promise<void>;
+}
+/**
+* Get the auth module from an PACK app instance.
+*
+* @param app - PACK app instance
+* @returns The auth module
+*/
+export declare function getAuthModule(app: PackAppInternal): AuthModule;

package/build/types/types/AuthModule.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,iBAAiB,mBAAmB;AAGlD,cAAc,yBAAyB;AACvC,cAAc,2BAA2B;AACzC,cAAc,eAAe;;;;;;;AAS7B,iBAAiB,WAAW;;;;;UAKjB,sBAAsB;;;;;UAMtB,gBAAgB;;;;UAKhB;;;;;;;UAQA,cAAc,gBAAgB,oBAAoB;;;;UAKlD;;;;;;;UAQA,oBAAoB,UAAU,sBAAsB;;;;;;;UAQpD,gBAAgB,UAAU,wBAAwB;;;;;UAMlD,gBAAgB;;;;;UAMhB,cAAc;;;;UAKd,eAAe;;;;;UAMf,qBAAqB;;;;;UAMrB,mBAAmB;;;;;;;;AAS9B,OAAO,iBAAS,cAAc,KAAK,kBAAkB","names":[],"sources":["../../../src/types/AuthModule.ts"],"version":3,"file":"AuthModule.d.ts"}

package/build/types/types/AuthState.d.ts

@@ -0,0 +1,14 @@
+export declare const AuthState: {
+	readonly Authenticated: "authenticated";
+	readonly Authenticating: "authenticating";
+	readonly Error: "error";
+	readonly Initializing: "initializing";
+	readonly Unauthenticated: "unauthenticated";
+};
+export type AuthState = typeof AuthState[keyof typeof AuthState];
+export interface AuthStateChangeEvent {
+	readonly previousState?: AuthState;
+	readonly state: AuthState;
+	readonly error?: Error;
+}
+export type AuthStateCallback = (event: AuthStateChangeEvent) => void;

package/build/types/types/AuthState.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,OAAO,cAAM;UACX,eAAe;UACf,gBAAgB;UAChB,OAAO;UACP,cAAc;UACd,iBAAiB;;AAGnB,YAAY,mBAAmB,uBAAuB;AAEtD,iBAAiB,qBAAqB;UAC3B,gBAAgB;UAChB,OAAO;UACP,QAAQ;;AAGnB,YAAY,qBAAqB,OAAO","names":[],"sources":["../../../src/types/AuthState.ts"],"version":3,"file":"AuthState.d.ts"}

package/build/types/types/BaseAuthService.d.ts

@@ -0,0 +1,22 @@
+import type { Unsubscribe } from "@palantir/pack.core";
+import type { AuthState, AuthStateCallback } from "./AuthState.js";
+import type { TokenChangeCallback } from "./TokenChange.js";
+/**
+* Base interface for auth services that wrap different OAuth client implementations
+*/
+export interface BaseAuthService {
+	dispose(): void;
+	getCurrentState(): AuthState;
+	getCurrentUserId(): string | undefined;
+	getToken(): Promise<string>;
+	getTokenOrUndefined(): string | undefined;
+	getUserData(userId: string, force?: boolean): Promise<unknown>;
+	isAuthenticated(): boolean;
+	isValidated(): boolean;
+	onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+	onTokenChange(callback: TokenChangeCallback): Unsubscribe;
+	refresh?(): Promise<void>;
+	signIn(): Promise<void>;
+	signOut(): Promise<void>;
+	validateToken(): Promise<boolean>;
+}

package/build/types/types/BaseAuthService.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,mBAAmB;AACjC,cAAc,WAAW,yBAAyB;AAClD,cAAc,2BAA2B;;;;AAKzC,iBAAiB,gBAAgB;CAC/B;CACA,mBAAmB;CACnB;CACA,YAAY;CACZ;CACA,YAAY,gBAAgB,kBAAkB;CAC9C;CACA;CACA,kBAAkB,UAAU,oBAAoB;CAChD,cAAc,UAAU,sBAAsB;CAC9C,YAAY;CACZ,UAAU;CACV,WAAW;CACX,iBAAiB","names":[],"sources":["../../../src/types/BaseAuthService.ts"],"version":3,"file":"BaseAuthService.d.ts"}

package/build/types/types/TokenChange.d.ts

@@ -0,0 +1,5 @@
+import type { UnverifiedTokenInfo } from "./UnverifiedTokenInfo.js";
+/**
+* Callback function for token change events. A signout may fire a token change with undefined token.
+*/
+export type TokenChangeCallback = (token: string | undefined, info: UnverifiedTokenInfo) => void;

package/build/types/types/TokenChange.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,2BAA2B;;;;AAKzC,YAAY,uBACV,2BACA,MAAM","names":[],"sources":["../../../src/types/TokenChange.ts"],"version":3,"file":"TokenChange.d.ts"}

package/build/types/types/UnverifiedTokenInfo.d.ts

@@ -0,0 +1,13 @@
+import type { UserId } from "./UserRef.js";
+/**
+* Represents the parsed payload from a JWT token (unverified).
+* The information provided should not be used for security-sensitive
+* applications unless verified through some other process.
+*/
+export interface UnverifiedTokenInfo {
+	readonly expiryInstantUtc?: number;
+	readonly orgId?: string;
+	readonly sessionId?: string;
+	readonly tokenId?: string;
+	readonly userId?: UserId;
+}

package/build/types/types/UnverifiedTokenInfo.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,cAAc;;;;;;AAO5B,iBAAiB,oBAAoB;UAC1B;UACA;UACA;UACA;UACA,SAAS","names":[],"sources":["../../../src/types/UnverifiedTokenInfo.ts"],"version":3,"file":"UnverifiedTokenInfo.d.ts"}

package/build/types/types/UserRef.d.ts

@@ -0,0 +1,21 @@
+import type { Flavored, PackAppInternal } from "@palantir/pack.core";
+declare const UserRefBrand: unique symbol;
+export type UserId = Flavored<"pack:UserId">;
+/**
+* Reference to a user from the platform API.
+* Provides access to user information with caching.
+*/
+export interface UserRef {
+	readonly userId: UserId;
+	readonly [UserRefBrand]: typeof UserRefBrand;
+	/**
+	* Get the current user data from the platform API.
+	* Results are cached to avoid excessive API calls.
+	* @param force - Force refresh of cached data
+	*/
+	readonly get: (force?: boolean) => Promise<unknown>;
+}
+export declare function invalidUserRef(): UserRef;
+export declare function isValidUserRef(userRef: UserRef): boolean;
+export declare const createUserRef: (app: PackAppInternal, userId: UserId) => UserRef;
+export {};

package/build/types/types/UserRef.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,UAAU,uBAAuB;AAI/C,cAAMA;AACN,YAAY,SAAS,SAAS;;;;;AAM9B,iBAAiB,QAAQ;UACd,QAAQ;WACP,sBAAsB;;;;;;UAOvB,MAAM,oBAAoB;;AAYrC,OAAO,iBAAS,kBAAkB;AAIlC,OAAO,iBAAS,eAAe,SAAS;AAIxC,OAAO,cAAM,gBACX,KAAK,iBACL,QAAQ,WACP","names":["UserRefBrand: unique symbol"],"sources":["../../../src/types/UserRef.ts"],"version":3,"file":"UserRef.d.ts"}

package/build/types/utils/AuthModuleConfig.d.ts

@@ -0,0 +1,16 @@
+import type { ModuleConfigTuple } from "@palantir/pack.core";
+import type { AuthModule } from "../types/AuthModule.js";
+import type { BaseAuthService } from "../types/BaseAuthService.js";
+/**
+* Configuration for AuthModule initialization
+*/
+export interface AuthModuleConfig {
+	readonly authService: BaseAuthService;
+}
+/**
+* Creates an auth module configuration tuple.
+*
+* @param authService - The auth service to use
+* @returns Module configuration tuple for the auth module
+*/
+export declare function createAuthModuleConfig(authService: BaseAuthService): ModuleConfigTuple<AuthModule>;

package/build/types/utils/AuthModuleConfig.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,yBAAoC;AAElD,cAAc,kBAAkB;AAChC,cAAc,uBAAuB;;;;AAKrC,iBAAiB,iBAAiB;UACvB,aAAa;;;;;;;;AASxB,OAAO,iBAAS,uBACd,aAAa,kBACZ,kBAAkB","names":[],"sources":["../../../src/utils/AuthModuleConfig.ts"],"version":3,"file":"AuthModuleConfig.d.ts"}

package/build/types/utils/AuthModuleImpl.d.ts

@@ -0,0 +1,25 @@
+import { type PackAppInternal, type Unsubscribe } from "@palantir/pack.core";
+import type { AuthModule } from "../types/AuthModule.js";
+import type { AuthStateCallback } from "../types/AuthState.js";
+import type { BaseAuthService } from "../types/BaseAuthService.js";
+import type { TokenChangeCallback } from "../types/TokenChange.js";
+import type { UserRef } from "../types/UserRef.js";
+export declare class AuthModuleImpl implements AuthModule {
+	#private;
+	private readonly app;
+	private signInPromise?;
+	constructor(app: PackAppInternal, authService: BaseAuthService);
+	isAuthenticated(): boolean;
+	getToken(): Promise<string>;
+	getTokenOrUndefined(): string | undefined;
+	signIn(): Promise<void>;
+	signOut(): Promise<void>;
+	refresh(): Promise<void>;
+	onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+	onTokenChange(callback: TokenChangeCallback): Unsubscribe;
+	waitForAuth(): Promise<void>;
+	getCurrentUser(): UserRef | undefined;
+	validateToken(): Promise<boolean>;
+	getUserData(userId: string, force?: boolean): Promise<unknown>;
+	dispose(): void;
+}

package/build/types/utils/AuthModuleImpl.d.ts.map

@@ -0,0 +1 @@
+{"mappings":"AAgBA,cAAc,sBAAsB,mBAAmB;AACvD,cAAc,kBAAkB;AAChC,cAAc,yBAAyB;AAEvC,cAAc,uBAAuB;AACrC,cAAc,2BAA2B;AACzC,cAAc,eAAe;AAG7B,OAAO,cAAM,0BAA0B,WAAW;;CAEhD,iBAAiB;CACjB,QAAQ;CAER,YAAY,KAAK,iBAAiB,aAAa;CAM/C;CAIA,AAAM,YAAY;CAIlB;CAIA,AAAM,UAAU;CAgBhB,AAAM,WAAW;CAIjB,AAAM,WAAW;CAQjB,kBAAkB,UAAU,oBAAoB;CAIhD,cAAc,UAAU,sBAAsB;CAI9C,AAAM,eAAe;CAmBrB,kBAAkB;CAQlB,AAAM,iBAAiB;CAIvB,AAAM,YAAY,gBAAgB,kBAAkB;CAIpD","names":[],"sources":["../../../src/utils/AuthModuleImpl.ts"],"version":3,"file":"AuthModuleImpl.d.ts"}