@rackbops/ac-plugin-contract 2.0.0-alpha.46 → 2.0.0-alpha.47

package/AUTHORING.md

@@ -1078,8 +1078,9 @@ host-side reader at all -- validates, but nothing consumes it. **`provides`/`con
 guide's worked example: a slot (`issues@1`, `artifacts@1`, `auth@1`, `notify@1`) is a
 named/versioned TypeScript interface one plugin **provides** and others **consume** -- the host
 refuses to activate a consumer whose slot has no provider, and says why (`resolveSlots`,
-`packages/host/src/plugins/slots.ts`, re-exported from `plugins/index.ts`). `ac-auth-cf-access`
-(`auth@1`) and `ac-notify-discord` (`notify@1`) are the reference *providers*; see their own
+`packages/host/src/plugins/slots.ts`, re-exported from `plugins/index.ts`). `ac-auth-cf-access` and
+`ac-auth-usr` (`auth@1`, alternatives: a slot has one provider) and `ac-notify-discord` (`notify@1`) are
+the reference *providers*; see their own
 `src/server.ts` for `host.slots.provide(slot, version, impl)`, and `design.md` §4 for the slot
 contract itself. The consumer half is `host.slots.resolve<T>(slot, version)` (#97): the provider
 bound for a slot, or `null` when none is. It throws unless the plugin's own manifest lists the exact

package/dist/slots.d.ts

@@ -175,6 +175,10 @@ export interface Identity {
      *  person. The host admits a machine identity on `GET`/`HEAD /api/readyz` only and refuses it on every other gated
      *  route; any other value is treated as a non-person too (#552). */
     kind?: "user" | "machine";
+    /** The roles the identity holds in THIS app, with the app's role prefix stripped (a usr token's
+     *  `"ac:admin"` is `"admin"`; roles for other apps are not listed). Absent when the provider does not
+     *  model roles (Cloudflare Access does not); an empty array is an identity that holds none (#102). */
+    roles?: string[];
 }
 /** `auth@1`: resolve the identity for a request, or null in open mode. */
 export interface AuthProvider {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/ac-plugin-contract",
-  "version": "2.0.0-alpha.46",
+  "version": "2.0.0-alpha.47",
   "private": false,
   "type": "module",
   "description": "The artifact-console plugin ABI for out-of-repo plugin authors: HostApi, the acPlugin manifest contribution points, the generated manifest JSON Schema, and the @ac/host ambient browser declaration.",
@@ -35,9 +35,9 @@
   },
   "devDependencies": {
     "@ac/contract": "0.0.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "^7.0.0",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   },
   "scripts": {
     "build": "node build.mjs",