@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/cli/commands/update.js

@@ -0,0 +1,37 @@
+import chalk from "chalk";
+import { execSync } from "child_process";
+import fs from "fs/promises";
+import path from "path";
+
+export async function updateProject(_options) {
+  console.log(chalk.blue("🔄 Updating ShipAPI project..."));
+
+  // Check if we're in a ShipAPI project
+  const packageJsonPath = path.join(process.cwd(), "package.json");
+  let packageJson;
+
+  try {
+    const packageJsonContent = await fs.readFile(packageJsonPath, "utf-8");
+    packageJson = JSON.parse(packageJsonContent);
+  } catch (_error) {
+    throw new Error("Not in a valid Node.js project directory");
+  }
+
+  if (!packageJson.dependencies || !packageJson.dependencies["@sixthsummit/ship-api"]) {
+    throw new Error("This is not a ShipAPI project (@sixthsummit/ship-api dependency not found)");
+  }
+
+  // Update ship-api package
+  console.log(chalk.yellow("📦 Updating @sixthsummit/ship-api package..."));
+  try {
+    execSync("npm update @sixthsummit/ship-api", { stdio: "inherit" });
+  } catch (_error) {
+    console.log(chalk.red("Failed to update @sixthsummit/ship-api package"));
+    throw _error;
+  }
+
+  console.log(chalk.green("✅ Project updated successfully!"));
+  console.log(chalk.cyan("\nNext steps:"));
+  console.log(chalk.cyan("  npm run build"));
+  console.log(chalk.cyan("  npm run test"));
+}

package/cli/ship-api.js

@@ -0,0 +1,285 @@
+#!/usr/bin/env node
+
+import { registerApplicationCommands } from "@sixthsummit/ship-cli";
+import { Command } from "commander";
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { addLibrary, addModule, listLibraries, listModules } from "./commands/add.js";
+import { createProject } from "./commands/create.js";
+import { devCommand } from "./commands/dev.js";
+import { doctorCommand } from "./commands/doctor.js";
+import { generateCommand } from "./commands/generate.js";
+import { updateProject } from "./commands/update.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const packageJson = JSON.parse(readFileSync(join(__dirname, "../package.json"), "utf8"));
+const version = packageJson.version;
+
+const program = new Command();
+
+program
+  .name("ship-api")
+  .description(
+    "ShipAPI Framework CLI - Build TypeScript backends on Hono + Drizzle + BullMQ + OpenTelemetry",
+  )
+  .version(version);
+
+registerApplicationCommands(program, { includeCreate: false });
+
+program
+  .command("create <project-name>")
+  .description("Create a new ShipAPI project")
+  .option("-t, --template <template>", "Project template to use", "default")
+  .option("-d, --database <database>", "Database type (postgres, mysql, sqlite)", "postgres")
+  .option("--current-dir", "Install in current directory instead of creating new directory")
+  .option("--skip-install", "Skip npm install after project creation")
+  .option("--skip-git", "Skip git initialization")
+  .action(async (projectName, _options) => {
+    try {
+      await createProject(projectName, _options);
+    } catch (error) {
+      console.error("Error creating project:", error.message);
+      process.exit(1);
+    }
+  });
+
+program
+  .command("add <name>")
+  .description("Add a module or library to your ShipAPI project")
+  .option("-f, --force", "Overwrite existing module/library")
+  .option("-l, --lib", "Add as library instead of module")
+  .action(async (name, options) => {
+    try {
+      if (options.lib) {
+        await addLibrary(name, options);
+      } else {
+        await addModule(name, options);
+      }
+    } catch (error) {
+      console.error("Error:", error.message);
+      process.exit(1);
+    }
+  });
+
+program
+  .command("modules")
+  .description("List available modules")
+  .action(async () => {
+    try {
+      await listModules();
+    } catch (error) {
+      console.error("Error listing modules:", error.message);
+      process.exit(1);
+    }
+  });
+
+program
+  .command("libraries")
+  .description("List available libraries")
+  .action(async () => {
+    try {
+      await listLibraries();
+    } catch (error) {
+      console.error("Error listing libraries:", error.message);
+      process.exit(1);
+    }
+  });
+
+program
+  .command("update")
+  .description("Update an existing ShipAPI project to the latest framework version")
+  .option("-f, --force", "Force update even if there are conflicts")
+  .action(async (_options) => {
+    try {
+      await updateProject(_options);
+    } catch (error) {
+      console.error("Error updating project:", error.message);
+      process.exit(1);
+    }
+  });
+
+// `ship-api g <type> [name]` (alias `generate`) — framework component
+// generators per plan §C. Subcommands land incrementally: `doctor`
+// first (no template dependencies), then module / resource / service /
+// schema / middleware / job / test in subsequent commits.
+const generate = program
+  .command("generate")
+  .alias("g")
+  .description("Generate framework components and run health checks");
+
+generate
+  .command("doctor")
+  .description("Run a project health check (env vars, migrations, audit findings)")
+  .action(async () => {
+    try {
+      await doctorCommand();
+    } catch (error) {
+      console.error("ship-api g doctor failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("module <name>")
+  .description(
+    "Scaffold a new v4 module (schema + service + routes + validation + permissions + index barrel)",
+  )
+  .option("-f, --force", "Overwrite an existing non-empty target directory", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("module", name, { force: options.force });
+    } catch (error) {
+      console.error("ship-api g module failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("resource <name>")
+  .description(
+    "Scaffold a CRUD module customized to a field spec (`--fields title:string,body:text,published:boolean?`)",
+  )
+  .requiredOption(
+    "--fields <spec>",
+    'Comma-separated field list ("name:type[?]"). Types: string, text, integer, bigint, boolean, timestamp, uuid, json',
+  )
+  .option("-f, --force", "Overwrite an existing non-empty target directory", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("resource", name, {
+        fields: options.fields,
+        force: options.force,
+      });
+    } catch (error) {
+      console.error("ship-api g resource failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("middleware <name>")
+  .description("Scaffold a Hono middleware skeleton at src/middleware/<name>.ts")
+  .option("-f, --force", "Overwrite an existing file", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("middleware", name, { force: options.force });
+    } catch (error) {
+      console.error("ship-api g middleware failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("service <name>")
+  .description(
+    "Scaffold a DrizzleEntityService extension in an existing module's services/ directory",
+  )
+  .requiredOption("-m, --module <module>", "Target module name (e.g. accounts)")
+  .option("-f, --force", "Overwrite an existing file", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("service", name, {
+        module: options.module,
+        force: options.force,
+      });
+    } catch (error) {
+      console.error("ship-api g service failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("schema <name>")
+  .description("Scaffold an additional Drizzle pgTable file in a module's schemas/ directory")
+  .requiredOption("-m, --module <module>", "Target module name")
+  .option("-f, --force", "Overwrite an existing file", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("schema", name, {
+        module: options.module,
+        force: options.force,
+      });
+    } catch (error) {
+      console.error("ship-api g schema failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+generate
+  .command("job <name>")
+  .description("Scaffold a BullMQ job stub in a module's jobs/ directory")
+  .requiredOption("-m, --module <module>", "Target module name")
+  .option("-f, --force", "Overwrite an existing file", false)
+  .action(async (name, options) => {
+    try {
+      await generateCommand("job", name, {
+        module: options.module,
+        force: options.force,
+      });
+    } catch (error) {
+      console.error("ship-api g job failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+// `ship-api migrate-orm <path> [--write]` — codemod CLI for v3 → v4
+// ORM migration. Default mode is analyze: lists detected TypeORM
+// decorators and classifies each as auto / partial / manual /
+// unknown. With `--write`, emits a Drizzle pgTable schema next to
+// each entity (e.g., `Account.ts` → `Account.drizzle.ts`) with
+// `// TODO[ship-api migrate-orm]:` markers for items requiring
+// manual review.
+//
+// Loaded lazily: migrate-orm.js imports the `typescript` compiler
+// API, which is an optional peer (the project being migrated has it
+// as a devDependency; a fresh `npx ... create` environment does not).
+// A static import here would crash every CLI command when typescript
+// isn't resolvable.
+program
+  .command("migrate-orm")
+  .description("Analyze TypeORM entities and (with --write) emit Drizzle schemas alongside them")
+  .argument("[path]", "Path to a .ts file or directory tree to analyze / transform", ".")
+  .option("--write", "Emit Drizzle pgTable schemas next to each entity (.ts → .drizzle.ts)", false)
+  .action(async (target, options) => {
+    try {
+      let migrateOrmCommand;
+      try {
+        ({ migrateOrmCommand } = await import("./commands/migrate-orm.js"));
+      } catch (error) {
+        if (error.code === "ERR_MODULE_NOT_FOUND" && /['"]typescript['"]/.test(error.message)) {
+          console.error(
+            "ship-api migrate-orm needs the `typescript` package to parse your TypeORM entities.\n" +
+              "Run it from the project being migrated (which has typescript as a devDependency),\n" +
+              "or install it first: npm install -D typescript",
+          );
+          process.exit(1);
+        }
+        throw error;
+      }
+      await migrateOrmCommand({ path: target, write: options.write });
+    } catch (error) {
+      console.error("ship-api migrate-orm failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+program
+  .command("dev")
+  .description(
+    "Run the local stack: docker compose up dependencies, tsx watch the app, wait for /livez",
+  )
+  .option("--bare", "Skip Docker Compose (use already-running services)")
+  .option("--reset", "docker compose down -v before starting (drops volumes)")
+  .option("-p, --port <port>", "Port to poll for /livez (default: $PORT or 3000)")
+  .action(async (options) => {
+    try {
+      await devCommand(options);
+    } catch (error) {
+      console.error("ship-api dev failed:", error.message);
+      process.exit(1);
+    }
+  });
+
+program.parse();

package/lib/app/auth/AuthProvider.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `AuthProvider` — pluggable authentication contract.
+ *
+ * Foundation interface that lets v4.x ship Better-Auth, Clerk, WorkOS, Auth.js,
+ * Auth0, WebAuthn/passkeys, and edge-runtime JWKS adapters without breaking the
+ * public API. Firebase is the v4.0 default adapter (see `./adapters/firebase`).
+ *
+ * The shape is intentionally narrow: providers verify a credential and resolve
+ * an Account. They do *not* know about HTTP — `requireAuth(...)` middleware is
+ * the bridge between Hono `Context` and this interface.
+ */
+/**
+ * Claims extracted from a verified credential. Provider-specific fields go in
+ * `metadata` so the `Account` resolver can use them without leaking provider
+ * types into the framework.
+ */
+export interface AuthClaims {
+    /** Stable subject identifier from the IdP (e.g., Firebase UID, OIDC `sub`). */
+    subject: string;
+    /** Optional email if the IdP provides it. */
+    email?: string;
+    /** Optional verified-email flag if the IdP exposes it. */
+    emailVerified?: boolean;
+    /** Optional display name. */
+    name?: string;
+    /** Optional issued-at / expires-at if the IdP exposes them (epoch seconds). */
+    issuedAt?: number;
+    expiresAt?: number;
+    /** Provider-specific extra fields. The Account resolver may consume these. */
+    metadata?: Record<string, unknown>;
+}
+export type AuthVerifyResult = {
+    ok: true;
+    claims: AuthClaims;
+} | {
+    ok: false;
+    reason: AuthFailureReason;
+    message?: string;
+};
+export type AuthFailureReason = "missing-token" | "invalid-token" | "expired-token" | "revoked-token" | "issuer-mismatch" | "provider-error";
+/**
+ * Minimal Account interface that the framework requires from any provider's
+ * resolved account. Concrete `Account` entities (in `modules/accounts/`)
+ * implement this and add their own fields.
+ *
+ * Kept structural-only here so `AuthProvider` can be defined without depending
+ * on the `accounts` module.
+ */
+export interface AuthenticatedAccount {
+    id: string;
+    hasPermission?(slug: string): boolean | Promise<boolean>;
+}
+/**
+ * The bridge between a verified credential and a domain Account. Implementations
+ * typically look up the Account by `claims.subject`; the optional `onUnknown`
+ * field controls whether unknown subjects auto-create an Account.
+ */
+export interface AccountResolver<TAccount extends AuthenticatedAccount = AuthenticatedAccount> {
+    resolve(claims: AuthClaims): Promise<TAccount | null>;
+}
+export interface AuthProviderContext {
+    /** Raw credential from the request (e.g., `Authorization: Bearer <token>`). */
+    rawCredential?: string;
+    /** Request headers — providers may read additional fields (e.g., `X-Provider`). */
+    headers: Readonly<Record<string, string | undefined>>;
+}
+export interface AuthProvider<TAccount extends AuthenticatedAccount = AuthenticatedAccount> {
+    /** Stable name for logging / multi-provider routing. e.g. "firebase", "clerk". */
+    readonly name: string;
+    /** Verify a credential and return claims. Pure: must not perform DB lookups. */
+    verify(ctx: AuthProviderContext): Promise<AuthVerifyResult>;
+    /**
+     * Resolve a verified credential to a domain Account. Separate from `verify`
+     * so providers can be combined (verify with one, resolve via shared user store).
+     */
+    resolve(claims: AuthClaims): Promise<TAccount | null>;
+    /**
+     * Behavior when no credential is present on the request.
+     *  - "reject" (default): respond 401 immediately
+     *  - "next": continue without an authenticated user (opt-in via `requireAuth({ optional: true })`)
+     */
+    onMissingToken?: "reject" | "next";
+    /**
+     * Behavior when a credential verifies but no Account is found.
+     *  - "reject" (default): respond 403
+     *  - "create": delegate to a hook (provider-specific) to create the Account on first sight
+     *  - "next": continue with `claims` only and no Account
+     */
+    onUnknownAccount?: "reject" | "create" | "next";
+}
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/app/auth/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../src/app/auth/AuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,eAAe,GACf,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,gBAAgB,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAC3F,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,YAAY,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IACxF,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,gFAAgF;IAChF,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE5D;;;OAGG;IACH,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEtD;;;;OAIG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;CACjD"}

package/lib/app/auth/AuthProvider.js

@@ -0,0 +1,13 @@
+/**
+ * `AuthProvider` — pluggable authentication contract.
+ *
+ * Foundation interface that lets v4.x ship Better-Auth, Clerk, WorkOS, Auth.js,
+ * Auth0, WebAuthn/passkeys, and edge-runtime JWKS adapters without breaking the
+ * public API. Firebase is the v4.0 default adapter (see `./adapters/firebase`).
+ *
+ * The shape is intentionally narrow: providers verify a credential and resolve
+ * an Account. They do *not* know about HTTP — `requireAuth(...)` middleware is
+ * the bridge between Hono `Context` and this interface.
+ */
+export {};
+//# sourceMappingURL=AuthProvider.js.map

package/lib/app/auth/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../../../src/app/auth/AuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/lib/app/auth/adapters/firebase.d.ts

@@ -0,0 +1,79 @@
+import admin from "firebase-admin";
+import type { AuthClaims, AuthenticatedAccount, AuthProvider, AuthProviderContext, AuthVerifyResult } from "../AuthProvider.js";
+/**
+ * Firebase `AuthProvider` adapter — the v4.0 default.
+ *
+ * Wraps `firebase-admin`'s `verifyIdToken` and a consumer-supplied account-lookup
+ * callback. Lives at the framework level so it has no opinion about persistence
+ * (TypeORM v3, Drizzle v4) — the consumer wires the lookup. This keeps the
+ * adapter testable in isolation and lets the same code work across the v3 → v4
+ * transition.
+ *
+ * Ports today's `JwtAuthMiddleware` token-verification behavior into the v4
+ * `AuthProvider` interface without changing semantics:
+ *   - Reads `Authorization: Bearer <id-token>` (and `X-Forwarded-Authorization`).
+ *   - Calls `admin.auth().verifyIdToken(token)` with `checkRevoked` opt-in.
+ *   - Maps verification errors to `AuthFailureReason` codes so the framework
+ *     can surface them consistently in `requireAuth`'s 401 responses.
+ *   - Looks up the domain `Account` via the supplied `findAccount` callback.
+ */
+export interface FirebaseAuthClaimsExtras {
+    /** Firebase project ID the token was issued for. */
+    audience?: string;
+    /** Token issuer (`https://securetoken.google.com/<project-id>`). */
+    issuer?: string;
+    /** Identity provider used to sign the user in (e.g., `password`, `google.com`). */
+    signInProvider?: string;
+    /** Whether Firebase considers the email verified at token issue time. */
+    firebaseEmailVerified?: boolean;
+}
+export interface FirebaseAuthProviderOptions<TAccount extends AuthenticatedAccount = AuthenticatedAccount> {
+    /**
+     * Look up the domain Account from a verified Firebase UID. Returns `null` if
+     * no Account is registered. Consumers supply this — the framework does not
+     * assume an ORM. Hooked into TypeORM in v3 transition; Drizzle in v4.
+     */
+    findAccount: (firebaseUid: string, claims: AuthClaims) => Promise<TAccount | null>;
+    /**
+     * If `true`, calls `verifyIdToken(token, true)` to also reject revoked tokens.
+     * Costs one extra Firestore RTT per request on cold paths. Default `false`.
+     */
+    checkRevoked?: boolean;
+    /**
+     * Behavior when no credential is on the request. Default `"reject"` — the v3
+     * silent fall-through becomes opt-in via `requireAuth({ optional: true })`.
+     */
+    onMissingToken?: "reject" | "next";
+    /**
+     * Behavior when a token verifies but no Account is registered for that UID.
+     * Default `"reject"` (403). Use `"next"` for endpoints that should serve
+     * unauthenticated traffic with degraded data.
+     */
+    onUnknownAccount?: "reject" | "create" | "next";
+    /**
+     * Optional override for token extraction. Default reads
+     * `X-Forwarded-Authorization` then `Authorization`, both `Bearer <token>`.
+     */
+    extractToken?: (ctx: AuthProviderContext) => string | undefined;
+    /**
+     * Optional Firebase Admin app override (for multi-project scenarios or tests).
+     * Falls back to the default `admin` app when not provided.
+     */
+    firebaseApp?: admin.app.App;
+}
+export declare class FirebaseAuthProvider<TAccount extends AuthenticatedAccount = AuthenticatedAccount> implements AuthProvider<TAccount> {
+    readonly name = "firebase";
+    readonly onMissingToken: "reject" | "next";
+    readonly onUnknownAccount: "reject" | "create" | "next";
+    private readonly opts;
+    private readonly extractToken;
+    constructor(opts: FirebaseAuthProviderOptions<TAccount>);
+    verify(ctx: AuthProviderContext): Promise<AuthVerifyResult>;
+    resolve(claims: AuthClaims): Promise<TAccount | null>;
+}
+/**
+ * Convenience factory matching the documented `firebaseAuth({ ... })` API in
+ * the plan's §F.
+ */
+export declare function firebaseAuth<TAccount extends AuthenticatedAccount = AuthenticatedAccount>(opts: FirebaseAuthProviderOptions<TAccount>): FirebaseAuthProvider<TAccount>;
+//# sourceMappingURL=firebase.d.ts.map

package/lib/app/auth/adapters/firebase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/adapters/firebase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,gBAAgB,CAAC;AACnC,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EAEpB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,wBAAwB;IACvC,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,2BAA2B,CAC1C,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D;;;;OAIG;IACH,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEnF;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEnC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEhD;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,MAAM,GAAG,SAAS,CAAC;IAEhE;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;CAC7B;AA6FD,qBAAa,oBAAoB,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,CAC5F,YAAW,YAAY,CAAC,QAAQ,CAAC;IAEjC,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAExD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmD;gBAEpE,IAAI,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAOjD,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiB3D,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAG5D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,EACvF,IAAI,EAAE,2BAA2B,CAAC,QAAQ,CAAC,GAC1C,oBAAoB,CAAC,QAAQ,CAAC,CAEhC"}

package/lib/app/auth/adapters/firebase.js

@@ -0,0 +1,122 @@
+import admin from "firebase-admin";
+const BEARER_PREFIX = /^Bearer\s+/i;
+function defaultExtractToken(ctx) {
+    const direct = ctx.rawCredential?.replace(BEARER_PREFIX, "").trim();
+    if (direct)
+        return direct;
+    // `X-Forwarded-Authorization` — used when behind a Cloud Run / Cloudflare /
+    // GCP IAP proxy that has consumed the original `Authorization` header.
+    const forwarded = ctx.headers["x-forwarded-authorization"]?.replace(BEARER_PREFIX, "").trim();
+    if (forwarded)
+        return forwarded;
+    const auth = ctx.headers["authorization"]?.replace(BEARER_PREFIX, "").trim();
+    if (auth)
+        return auth;
+    return undefined;
+}
+function classifyFirebaseError(err) {
+    const e = err;
+    const code = e?.code ?? "";
+    const message = e?.message ?? "Token verification failed";
+    if (code.includes("id-token-expired"))
+        return { reason: "expired-token", message };
+    if (code.includes("id-token-revoked"))
+        return { reason: "revoked-token", message };
+    if (code.includes("argument-error"))
+        return { reason: "invalid-token", message };
+    if (code.includes("invalid-id-token"))
+        return { reason: "invalid-token", message };
+    if (code.includes("audience-mismatch") || code.includes("issuer-mismatch")) {
+        return { reason: "issuer-mismatch", message };
+    }
+    return { reason: "provider-error", message };
+}
+function decodedTokenToClaims(decoded) {
+    const claims = {
+        subject: decoded.uid,
+        email: decoded.email,
+        emailVerified: decoded.email_verified,
+        name: decoded.name,
+        issuedAt: decoded.iat,
+        expiresAt: decoded.exp,
+    };
+    const extras = {
+        audience: decoded.aud,
+        issuer: decoded.iss,
+        signInProvider: decoded.firebase?.sign_in_provider,
+        firebaseEmailVerified: decoded.email_verified,
+    };
+    // Pass the full decoded token through `metadata` for advanced consumers
+    // (custom claims, sign-in provider, tenant). Stable enough that v4.x
+    // adapters can consume it without provider-specific imports.
+    claims.metadata = {
+        firebase: extras,
+        customClaims: extractCustomClaims(decoded),
+    };
+    return claims;
+}
+function extractCustomClaims(decoded) {
+    // Firebase puts custom claims at the top level of the decoded token alongside
+    // standard JWT fields. Strip the standard fields out so consumers see only
+    // the actual custom claims.
+    const standard = new Set([
+        "uid",
+        "email",
+        "email_verified",
+        "name",
+        "picture",
+        "iss",
+        "aud",
+        "auth_time",
+        "user_id",
+        "sub",
+        "iat",
+        "exp",
+        "firebase",
+    ]);
+    const custom = {};
+    for (const [key, value] of Object.entries(decoded)) {
+        if (!standard.has(key))
+            custom[key] = value;
+    }
+    return custom;
+}
+export class FirebaseAuthProvider {
+    name = "firebase";
+    onMissingToken;
+    onUnknownAccount;
+    opts;
+    extractToken;
+    constructor(opts) {
+        this.opts = opts;
+        this.onMissingToken = opts.onMissingToken ?? "reject";
+        this.onUnknownAccount = opts.onUnknownAccount ?? "reject";
+        this.extractToken = opts.extractToken ?? defaultExtractToken;
+    }
+    async verify(ctx) {
+        const token = this.extractToken(ctx);
+        if (!token) {
+            return { ok: false, reason: "missing-token", message: "No bearer token on request" };
+        }
+        const auth = this.opts.firebaseApp ? this.opts.firebaseApp.auth() : admin.auth();
+        try {
+            const decoded = await auth.verifyIdToken(token, this.opts.checkRevoked === true);
+            return { ok: true, claims: decodedTokenToClaims(decoded) };
+        }
+        catch (err) {
+            const { reason, message } = classifyFirebaseError(err);
+            return { ok: false, reason, message };
+        }
+    }
+    async resolve(claims) {
+        return this.opts.findAccount(claims.subject, claims);
+    }
+}
+/**
+ * Convenience factory matching the documented `firebaseAuth({ ... })` API in
+ * the plan's §F.
+ */
+export function firebaseAuth(opts) {
+    return new FirebaseAuthProvider(opts);
+}
+//# sourceMappingURL=firebase.js.map

package/lib/app/auth/adapters/firebase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase.js","sourceRoot":"","sources":["../../../../src/app/auth/adapters/firebase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,gBAAgB,CAAC;AAiFnC,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,SAAS,mBAAmB,CAAC,GAAwB;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,2BAA2B,CAAC;IAE1D,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACnF,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAkC;IAC9D,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,cAAc;QACrC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,SAAS,EAAE,OAAO,CAAC,GAAG;KACvB,CAAC;IAEF,MAAM,MAAM,GAA6B;QACvC,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB;QAClD,qBAAqB,EAAE,OAAO,CAAC,cAAc;KAC9C,CAAC;IAEF,wEAAwE;IACxE,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,CAAC,QAAQ,GAAG;QAChB,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;KAC3C,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAkC;IAC7D,8EAA8E;IAC9E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,gBAAgB;QAChB,MAAM;QACN,SAAS;QACT,KAAK;QACL,KAAK;QACL,WAAW;QACX,SAAS;QACT,KAAK;QACL,KAAK;QACL,KAAK;QACL,UAAU;KACX,CAAC,CAAC;IACH,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,oBAAoB;IAGtB,IAAI,GAAG,UAAU,CAAC;IAClB,cAAc,CAAoB;IAClC,gBAAgB,CAA+B;IAEvC,IAAI,CAAwC;IAC5C,YAAY,CAAmD;IAEhF,YAAY,IAA2C;QACrD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC;QACtD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAwB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;YACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA2C;IAE3C,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}