@shipstatic/types 1.1.0 → 2.1.0

package/dist/index.d.ts

@@ -405,7 +405,7 @@ export declare class ShipError extends Error {
      *
      * **Telemetry pattern — `details: { internal: '<tag>' }`.** When the
      * server creates an auth error with an `internal` key in `details`
-     * (e.g. `{ internal: 'jwt_missing_subject' }`), `toResponse()` strips the
+     * (e.g. `{ internal: 'session_invalid' }`), `toResponse()` strips the
      * entire `details` object before serialization. This keeps the wire
      * response a clean "Authentication failed" while preserving granular
      * server-side telemetry (which strategy/check failed) for logs and tests.
@@ -552,13 +552,33 @@ export declare const DEPLOY_TOKEN: {
     readonly TOTAL_LENGTH: 70;
 };
 export declare const AuthMethod: {
-    readonly JWT: "jwt";
+    readonly SESSION: "session";
     readonly API_KEY: "apiKey";
     readonly TOKEN: "token";
+    readonly OAUTH: "oauth";
     readonly WEBHOOK: "webhook";
     readonly SYSTEM: "system";
 };
 export type AuthMethodType = typeof AuthMethod[keyof typeof AuthMethod];
+/**
+ * OAuth scope vocabulary for delegated third-party access tokens.
+ * Single source of truth used by the authorization server (advertised in
+ * `scopes_supported`), the API's scope-enforcement middleware, and consent UI
+ * copy. The standard `offline_access` scope (refresh tokens) is not platform
+ * vocabulary and is deliberately absent — the middleware never checks it.
+ *
+ * Deliberately absent by design: any `tokens:*` scope, `account:write`, or
+ * admin scope — a delegated app must never mint credentials, delete the
+ * account, or act as admin.
+ */
+export declare const OAuthScope: {
+    readonly ACCOUNT_READ: "account:read";
+    readonly DEPLOYMENTS_READ: "deployments:read";
+    readonly DEPLOYMENTS_WRITE: "deployments:write";
+    readonly DOMAINS_READ: "domains:read";
+    readonly DOMAINS_WRITE: "domains:write";
+};
+export type OAuthScopeType = typeof OAuthScope[keyof typeof OAuthScope];
 export declare const DEPLOYMENT_CONFIG_FILENAME = "ship.json";
 /** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */
 export declare const SPA_DEFAULT_CONFIG: {

package/dist/index.js

@@ -130,7 +130,7 @@ export class ShipError extends Error {
     toResponse() {
         // Strip authentication details when they carry an `internal` telemetry
         // tag (see `ShipError.authentication` JSDoc) — these are server-side
-        // diagnostics like 'jwt_missing_subject' that must not leak to clients.
+        // diagnostics like 'session_invalid' that must not leak to clients.
         const authDetails = this.details;
         const details = this.type === ErrorType.Authentication && authDetails?.internal
             ? undefined
@@ -255,7 +255,7 @@ export class ShipError extends Error {
      *
      * **Telemetry pattern — `details: { internal: '<tag>' }`.** When the
      * server creates an auth error with an `internal` key in `details`
-     * (e.g. `{ internal: 'jwt_missing_subject' }`), `toResponse()` strips the
+     * (e.g. `{ internal: 'session_invalid' }`), `toResponse()` strips the
      * entire `details` object before serialization. This keeps the wire
      * response a clean "Authentication failed" while preserving granular
      * server-side telemetry (which strategy/check failed) for logs and tests.
@@ -445,12 +445,31 @@ export const DEPLOY_TOKEN = {
 };
 // Authentication Method Constants
 export const AuthMethod = {
-    JWT: 'jwt',
+    SESSION: 'session',
     API_KEY: 'apiKey',
     TOKEN: 'token',
+    OAUTH: 'oauth',
     WEBHOOK: 'webhook',
     SYSTEM: 'system'
 };
+/**
+ * OAuth scope vocabulary for delegated third-party access tokens.
+ * Single source of truth used by the authorization server (advertised in
+ * `scopes_supported`), the API's scope-enforcement middleware, and consent UI
+ * copy. The standard `offline_access` scope (refresh tokens) is not platform
+ * vocabulary and is deliberately absent — the middleware never checks it.
+ *
+ * Deliberately absent by design: any `tokens:*` scope, `account:write`, or
+ * admin scope — a delegated app must never mint credentials, delete the
+ * account, or act as admin.
+ */
+export const OAuthScope = {
+    ACCOUNT_READ: 'account:read',
+    DEPLOYMENTS_READ: 'deployments:read',
+    DEPLOYMENTS_WRITE: 'deployments:write',
+    DOMAINS_READ: 'domains:read',
+    DOMAINS_WRITE: 'domains:write',
+};
 // Deployment Configuration
 export const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';
 /** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "1.1.0",
+  "version": "2.1.0",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -445,7 +445,7 @@ export class ShipError extends Error {
   toResponse(): ErrorResponse {
     // Strip authentication details when they carry an `internal` telemetry
     // tag (see `ShipError.authentication` JSDoc) — these are server-side
-    // diagnostics like 'jwt_missing_subject' that must not leak to clients.
+    // diagnostics like 'session_invalid' that must not leak to clients.
     const authDetails = this.details as { internal?: unknown } | undefined;
     const details = this.type === ErrorType.Authentication && authDetails?.internal
       ? undefined
@@ -585,7 +585,7 @@ export class ShipError extends Error {
    *
    * **Telemetry pattern — `details: { internal: '<tag>' }`.** When the
    * server creates an auth error with an `internal` key in `details`
-   * (e.g. `{ internal: 'jwt_missing_subject' }`), `toResponse()` strips the
+   * (e.g. `{ internal: 'session_invalid' }`), `toResponse()` strips the
    * entire `details` object before serialization. This keeps the wire
    * response a clean "Authentication failed" while preserving granular
    * server-side telemetry (which strategy/check failed) for logs and tests.
@@ -837,15 +837,37 @@ export const DEPLOY_TOKEN = {
 
 // Authentication Method Constants
 export const AuthMethod = {
-  JWT: 'jwt',
+  SESSION: 'session',
   API_KEY: 'apiKey',
   TOKEN: 'token',
+  OAUTH: 'oauth',
   WEBHOOK: 'webhook',
   SYSTEM: 'system'
 } as const;
 
 export type AuthMethodType = typeof AuthMethod[keyof typeof AuthMethod];
 
+/**
+ * OAuth scope vocabulary for delegated third-party access tokens.
+ * Single source of truth used by the authorization server (advertised in
+ * `scopes_supported`), the API's scope-enforcement middleware, and consent UI
+ * copy. The standard `offline_access` scope (refresh tokens) is not platform
+ * vocabulary and is deliberately absent — the middleware never checks it.
+ *
+ * Deliberately absent by design: any `tokens:*` scope, `account:write`, or
+ * admin scope — a delegated app must never mint credentials, delete the
+ * account, or act as admin.
+ */
+export const OAuthScope = {
+  ACCOUNT_READ: 'account:read',
+  DEPLOYMENTS_READ: 'deployments:read',
+  DEPLOYMENTS_WRITE: 'deployments:write',
+  DOMAINS_READ: 'domains:read',
+  DOMAINS_WRITE: 'domains:write',
+} as const;
+
+export type OAuthScopeType = typeof OAuthScope[keyof typeof OAuthScope];
+
 // Deployment Configuration
 export const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';