From 6daa31de0b9a15ab4730bf9d7e4de393f7b41a62 Mon Sep 17 00:00:00 2001
From: Aman <1402357+Zartharas@users.noreply.github.com>
Date: Sun, 23 Aug 2026 21:52:44 -0600
Subject: [PATCH] feat(providers): add web-session contract builder

---
 src/lib/providers/webSessionContract.ts | 58 +++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 src/lib/providers/webSessionContract.ts

diff --git a/src/lib/providers/webSessionContract.ts b/src/lib/providers/webSessionContract.ts
new file mode 100644
index 0000000000..4824e9adc0
--- /dev/null
+++ b/src/lib/providers/webSessionContract.ts
@@ -0,0 +1,58 @@
+import {
+  listExtractionConfigs,
+  type TokenSource,
+} from "../../../open-sse/services/tokenExtractionConfig.ts";
+import { getWebSessionCredentialRequirement } from "../../shared/providers/webSessionCredentials.ts";
+
+export const WEB_SESSION_CONTRACT_VERSION = 1;
+
+export interface WebSessionContractProvider {
+  providerId: string;
+  displayName: string;
+  loginUrl: string;
+  homeUrl: string;
+  tokenSources: TokenSource[];
+  credential: {
+    kind: "cookie" | "token";
+    storageKeys: string[];
+    acceptsFullCookieHeader: boolean;
+  };
+}
+
+export interface WebSessionContract {
+  version: typeof WEB_SESSION_CONTRACT_VERSION;
+  providers: WebSessionContractProvider[];
+}
+
+/**
+ * Publish only the canonical, non-secret metadata needed by external
+ * credential brokers to capture credentials in the same shape OmniRoute
+ * accepts. Provider instructions, polling state, and credential values are
+ * intentionally excluded.
+ */
+export function buildWebSessionContract(): WebSessionContract {
+  const providers = listExtractionConfigs().flatMap<WebSessionContractProvider>((config) => {
+    const requirement = getWebSessionCredentialRequirement(config.providerId);
+    if (!requirement || requirement.kind === "none") return [];
+
+    return [
+      {
+        providerId: config.providerId,
+        displayName: config.displayName,
+        loginUrl: config.loginUrl,
+        homeUrl: config.homeUrl,
+        tokenSources: config.tokenSources.map((source) => ({ ...source })),
+        credential: {
+          kind: requirement.kind,
+          storageKeys: [...requirement.storageKeys],
+          acceptsFullCookieHeader: requirement.acceptsFullCookieHeader,
+        },
+      },
+    ];
+  });
+
+  return {
+    version: WEB_SESSION_CONTRACT_VERSION,
+    providers,
+  };
+}