flowstate-auth-ui Package Skill

Package: @epicdm/flowstate-auth-ui Repository: epic-flowstate-community Path: packages/flowstate-auth-ui Version: 1.0.7

Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.

Primary Package Workflow

FlowState Auth UI

Use this skill for packages/flowstate-auth-ui, the shared HTML-template package for FlowState auth pages.

Package Identity

• This is a TypeScript template package that returns HTML strings.
• It is not a React package.
• It does not own routes. Auth-server and CLI code call these functions and send the returned HTML.
• Import from @epicdm/flowstate-auth-ui; avoid deep imports unless intentionally working inside this package.

Public Exports

• authorizePage(params): renders the FlowState OAuth authorization page with email and verification-code steps.
• callbackSuccessPage(): renders the CLI OAuth callback success page.
• callbackErrorPage(message): renders the CLI OAuth callback error page.
• pageShell(options): branded HTML shell with inline CSS, SVGs, theme toggle, and footer.
• escapeHtml(str): escapes user-facing strings.
• BRAND_CSS and SVG constants.

Workflow: Authorize Page

1. Start in src/pages.ts.
2. Preserve escaping for clientName.
3. Preserve JSON embedding for OAuth params rather than string-concatenating raw query values.
4. Coordinate endpoint changes with auth-server because the browser script posts to /auth/send-code and /auth/authorize.
5. Verify auth-server route tests after changing form fields, endpoint names, or OAuth params.

Workflow: CLI Callback Pages

1. callbackSuccessPage() is for successful CLI loopback OAuth completion.
2. callbackErrorPage(message) is for failure display and must escape message.
3. Coordinate copy or structure changes with CLI cloud OAuth callback tests.

HTML Safety

• pageShell() escapes only title.
• body, extraCss, and extraJs are raw insertion points. Use them only for trusted, package-authored HTML/CSS/JS.
• Do not pass request-controlled strings into raw shell fields without escaping.
• Keep auth error messages useful without echoing secrets, tokens, codes, or raw URLs.

Verification

yarn nx typecheck @epicdm/flowstate-auth-ui
yarn nx build @epicdm/flowstate-auth-ui

For downstream integration:

yarn workspace @epicdm/flowstate-auth-server test -- oauth.routes.test.ts
yarn workspace @epicdm/flowstate-cli test -- callback-server

Package Skill Inventory

Skill Inventory: @epicdm/flowstate-auth-ui

Package path: packages/flowstate-auth-ui.

Skillset

Composition Notes

• Use this package skill together with auth-server route skills when changing /auth/authorize, /auth/send-code, or POST /auth/authorize.
• Use this package skill together with CLI cloud auth skills when changing loopback callback pages.
• Do not create one-symbol skills for every SVG/template helper.

Publication Readiness

Status: drafted, pending verification.

Before Dojo publication, rebuild package Dojo artifacts from this reviewed skill.

Review Gate

Package Skill Review: @epicdm/flowstate-auth-ui

Package path: packages/flowstate-auth-ui.

Review Result

Status: drafted, source-backed, verified, pending publication.

The skillset is intentionally one compact skill because this package exposes one cohesive HTML-template workflow.

Checks

• Source review: completed from package metadata, root exports, pages, shell/styles/brand modules, downstream auth-server and CLI integration notes, and generated artifact drift.
• Skill inventory: completed.
• Skill files: completed.
• Verification: completed.
• Generated Dojo replacement: pending.
• Cloud Dojo publication: pending.

Verification Commands

Commands run:

yarn nx build @epicdm/flowstate-auth-ui
yarn nx typecheck @epicdm/flowstate-auth-ui

Downstream integration check run:

yarn workspace @epicdm/flowstate-cli test src/cli-commands/cloud/oauth/callback-server.test.ts --runInBand

Results:

• Skill file ASCII scan passed.
• Nx typecheck passed; Nx Cloud reported the existing unconnected-workspace 401.
• Nx build passed; Nx Cloud reported the existing unconnected-workspace 401.
• CLI callback integration test passed: 1 suite, 8 tests.
• Auth-server OAuth route test was not run in this package-skill pass because no auth-server route behavior changed.

Publication Gate

Do not publish existing .flowstate/dojo artifacts until they are rebuilt from reviewed package skills.

Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/flowstate-auth-ui/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.