diene_auth_engine 1.0.2

Logto auth flows, per-resource tokens, claims-first per-backend onboarding, deferred login, and Doc B landscape selection for Flutter applications.

Changelog

All notable changes to this package are documented here. Releases are managed from conventional commits by the repository release workflow.

1.0.2 - 2026-07-27

🐛 Bug Fixes 🐛

• auth-engine: anchor .pubignore config/ so lib/src/config ships (3bff69d)
• dart-lib: preserve nested C0 result files (#126) (602610f)

1.0.1 - 2026-07-27

🐛 Bug Fixes 🐛

• dart-lib: make the released changelog formatter-clean at generation (#121) (59a812b)
• auth-engine: take the dart-lib changelog fix before release (6331ea2), closes #121

1.0.0 - 2026-07-27

📜 Documentation 📜

• auth-engine: package docs, usage skill, and parity notes (24d1ec9)
• auth-engine: runnable package example (988209e)

✨ Features ✨

• shared: add agnostic standards payload (2d65acb)
• probes: add nix root suite (27e4184)
• dart-lib: add pure-Dart publishable library template package (47a4837)
• probes: add shared authoring helpers (f20d53f)
• auth-engine: bind C0 conformance to the frozen identity fixture (a1e2240)
• materialize atomi/nix sample (yes_basic_yes_llm) as chain root (24105ef)
• materialize workspace spine baseline (f74cf31)
• shared-wo-docker: remove Docker axis (b125b74)
• shared-wo-docker-helm: remove Helm axis (e01fe36)
• auth-engine: transplant onto dart-lib as a Flutter package (267d8a4)
• dart-lib: wire Dart CI, release, and OIDC publish machinery (770b8ec)

🐛 Bug Fixes 🐛

• probes: attribute actionlint smoke overlap (bfb0271)
• nix: check precommit from repository root (c6046ac)
• nix: enforce root formatter probes (3b4188a)
• probes: isolate cross-template mutations (f8169d0)
• auth-engine: repair coverage collection and ledger partition (49356c3)
• auth-engine: restore deadcode entrypoint, give pana Flutter SDK (07ab458)
• dart-lib: use credentialed pub.dev publishing (#107) (796d025)

🧪 Tests 🧪

• dart-lib: add TEMPLATE-ONLY CyanPrint probe matrix (6a1f748)
• auth-engine: close the meta coverage ledger at 100% (1e1c79c)
• auth-engine: cover the last reachable unit ledger lines (751b80e)
• auth-engine: cover the LogtoAuthProvider token seams (a1fb2b2)
• auth-engine: cover the residual unit ledger gaps (080802d)
• auth-engine: cover the three zero-coverage platform adapters (106749c)
• dart-lib: fix dead-code and credential-policy mutation sabotages (f1737e9)
• dart-lib: fix deadcode-whole-package sabotage target (226e3d2)
• dart-lib: fix probe baselines for gitlint hook and pana (1519f9a)
• auth-engine: record the ClipboardCarrierReader constructor (387f5da)
• dart-lib: restore workspace deps for skills-freshness sandbox (9a2e5bf)

Release highlights

• Add the Logto sign-in surface: the AuthProvider seam with its only v1 implementation LogtoAuthProvider, and SessionController owning the token lifecycle — interactive signIn (with deferred-login extraParams), rotating refresh with reuse detection, the silent onAppOpen re-mint, and signOut.
• Enforce the C0 §12 token lifetimes rather than trusting them: access tokens at most 10 minutes, refresh tokens at most 14 days rotating, re-mint on open (TokenLifetimes). A provider handing back a longer-lived token is rejected.
• Add per-resource tokens: ResourceKey as the full (platform, landscape, service, resourceName) identity whose audience is the per-landscape LPSM JWT aud, plus the IAuth retrieval seam and AuthCoordinator with a per-key cache, expiry-aware refresh, single-flight refresh-race handling, and the eager fetchAllTokens batch.
• Add the claims-first onboarding phase machine, keyed per backend: RegisteredBackend / BackendRegistry declare the client tree, and MultiBackendOnboarding runs one independent OnboardingMachine per backend from a single deduplicated registry-union acquisition. There is deliberately no singleton onboarded flag.
• Inspect the exact C0 §8 registration claim (<platform>_<service> with the JSON string "true") as the gating truth everywhere (Claims); use GET /User/Me only for the absent-claim create-time race (404 → POST /User, tolerating 409) and treat a later 401/404 as an ordinary error via markStaleClaim().
• Add the deferred-login mobile client (C0 §7): AppHandoffCarrier parsing for the canonical atomi-app-handoff:v1:<nonce> text, the Android Install Referrer field, and the iOS clipboard; DeferredLoginClient marking the carrier processed before redeem; HttpAppHandoffApi against POST {mount}/redeem; and the single no-oracle appHandoffExpired failure.
• Add returnTo deeplink continuation (ReturnTo): capture, login-redirect construction, and post-login resolution preserving path and query exactly, rejecting absolute, protocol-relative, and back-slash open-redirect inputs.
• Add the sign-up-only Doc B landscape selector (C0 §10): LandscapeSelectorDoc recursively rejects any address/issuer/URL leak at any depth, LandscapeSelectorClient pings each listed region and picks the fastest healthy one, and HttpLandscapeSelectorSource enforces the baked endpoint-suffix allowlist before fetching.
• Add C0 §13 home-claim resolution (HomeClaimResolver): the authoritative JWT home_landscape claim decides the home, the Doc B selector runs only when it is absent, the local HomeClaimStore is a non-authoritative mirror, and the post-OnboardSync claim is confirmed from a force-fresh claim-bearing token — failing closed rather than mirroring a local selection.
• Add SignInCoordinator tying the full flow together: resolve → login → re-read the issued claim → per-backend onboarding → confirm the written home claim → resume the exact returnTo route.
• Export the engine-owned authEngine config block schema next to the code that reads it (AuthEngineConfig, AppHandoffConstants); the config lib composes and validates it and never owns it.
• Ship the dependency-light test_helper.dart sub-library: fake IdP/token seams, per-backend onboarding-phase fakes, deferred-login carrier/redeem stubs, Doc B and home-claim fakes, AuthFixtures builders, and plain-throw AuthExpect assertions with no test-framework dependency.
• Depend on the Flutter SDK — the one deliberate deviation from the pure-Dart siblings, recorded with its two dev_dependencies consequences and the cross-family parity deltas in doc/diene_auth_engine.md.