Gate wasp-auth-only codegen behind the provider and expose the active provider identity

[FranjoMindek]

Description

Stack 5/7. The negative space: under an external provider, Wasp's own auth surface disappears instead of lying around.

• isWaspAuthUsed gating: auth forms, per-method client modules, lucia/password/jwt server modules, their sdk package.json exports and npm deps are generated only under waspAuth(). Importing them under an external provider is a compile error, not a runtime surprise.
• JWT_SECRET is required only under wasp auth; instead, the manifest's declared env vars are rendered into the generated zod env schemas, so a missing CLERK_SECRET_KEY fails at boot with the adapter's own doc string as the error message.
• New wasp/auth/provider identity module: authProviderId and capabilities as narrowable literals.
• userSignupFields from the manifest feeds JIT provisioning through validateAndGetUserFields (a purely additive extension of 4/7's resolveExternalSubject).

One caveat, stated openly: the external-provider branch gets its end-to-end golden proof in 7/7, where the snapshot test lands together with the packaged Clerk fixture in its final form (landing it here would mean rewriting a 167-file golden dir one PR later).

Type of change

• 🔧 Just code/docs improvement
• 🐞 Bug fix
• 🚀 New/improved feature
• 💥 Breaking change

Checklist

• I tested my change in a Wasp app to verify that it works as intended.

• 🧪 Tests and apps:

  • I added unit tests for my change.
  • (if you fixed a bug) I added a regression test for the bug I fixed.
  • (if you added/updated a feature) I added/updated e2e tests in examples/kitchen-sink/e2e-tests.
  • (if you added/updated a feature) I updated the starter templates in waspc/data/Cli/templates, as needed.
  • (if you added/updated a feature) I updated the example apps in examples/, as needed.
    • (if you updated examples/tutorials) I updated the tutorial in the docs (and vice versa).

• 📜 Documentation:

  • (if you added/updated a feature) I added/updated the documentation in web/docs/.

• 🆕 Changelog: (if change is more than just code/docs improvement)

  • I updated waspc/ChangeLog.md with a user-friendly description of the change.
  • (if you did a breaking change) I added a step to the current migration guide in web/docs/migration-guides/.
  • I bumped the version in waspc/waspc.cabal to reflect the changes I introduced.

[cloudflare-workers-and-pages]

Deploying wasp-docs-on-main with    Cloudflare Pages

Latest commit:	8a8b213
Status:	✅  Deploy successful!
Preview URL:	https://209d4a61.wasp-docs-on-main.pages.dev
Branch Preview URL:	https://franjo-auth2-5-capability-ga.wasp-docs-on-main.pages.dev

View logs

[pkg-pr-new]

Open in StackBlitz

@wasp.sh/spec

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/spec@4728

@wasp.sh/wasp-cli

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli@4728

@wasp.sh/wasp-cli-darwin-arm64-unknown

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-darwin-arm64-unknown@4728

@wasp.sh/wasp-cli-darwin-x64-unknown

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-darwin-x64-unknown@4728

@wasp.sh/wasp-cli-linux-arm64-glibc

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-arm64-glibc@4728

@wasp.sh/wasp-cli-linux-x64-glibc

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-x64-glibc@4728

@wasp.sh/wasp-cli-linux-x64-musl

npx https://pkg.pr.new/wasp-lang/wasp/@wasp.sh/wasp-cli-linux-x64-musl@4728

commit: 8760f0c

[FranjoMindek]

The session-revocation boot assert now checks via canRevokeSessions() — with revokeSession optional on the contract (see #4725), this check is structural and can actually fail, closing the declared-but-not-implemented gap.

[FranjoMindek]

Let's rewrite this so it kinda collects errors instead.
E.g. it will check for each optional property we have and check if it implements if it declared, then at end just dump all errors we collected.

[FranjoMindek]

Boot assert updated for the mixin contract: the issue-sessions claim is checked via canManageSessions() against the full issueSession/revokeSession/revokeAllSessions set, and the error message names it.

[FranjoMindek]

Review fix applied: assertProviderMatchesManifest now collects every mismatch (id, each declared capability vs the adapter's actual methods) and throws once with the full list.

[FranjoMindek]

Dropped the authProviderUserSignupFields Register key (same reasoning as the authProvider one on the previous PR). Its virtual module is now declared as plain UserSignupFields from wasp/auth/providers/types.

[github-actions]

This pull request is now stale.
That means that it hasn't seen any activity for a while, and needs to be updated or addressed before it can be merged.

Next steps if the PR is still relevant, and you are able to devote time to it:

• If you received any questions or feedback, please address them.
• Merge the latest main into your branch to ensure that you are up to date.
• If you are still working on the changes, please leave a comment telling us so.
• Otherwise, just leave a comment explaining why the PR is still relevant.

If no action is taken, this PR will be automatically closed in 7 days.