@apteva/web-sdk 0.8.0 → 0.10.0

package/dist/session-persistence.js

@@ -0,0 +1,149 @@
+export class PersistenceError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+// Storage events exclude the writing document. Keep sibling clients synchronized
+// even when BroadcastChannel is unavailable; messages contain only a scope key.
+const documentObservers = new Set();
+function browserEnvironment() {
+    // Accessing localStorage itself can throw (privacy settings or sandboxed frames).
+    const storage = globalThis.localStorage;
+    const locks = globalThis.navigator?.locks;
+    if (!storage || !locks?.request || !globalThis.addEventListener)
+        throw new Error("Browser storage and Web Locks are required");
+    const listeners = new Map();
+    const dispatch = (key) => {
+        if (key === null)
+            for (const group of listeners.values())
+                for (const fn of group)
+                    fn();
+        else if (typeof key === "string")
+            for (const fn of listeners.get(key) ?? [])
+                fn();
+    };
+    documentObservers.add(dispatch);
+    let channel;
+    try {
+        channel = new BroadcastChannel("apteva-auth-session:v1");
+    }
+    catch { /* Storage events still synchronize tabs. */ }
+    if (channel)
+        channel.onmessage = event => { if (event.data?.type === "changed")
+            dispatch(event.data.key); };
+    const changed = (event) => { if (event.storageArea === storage)
+        dispatch(event.key); };
+    const focus = () => dispatch(null);
+    globalThis.addEventListener("storage", changed);
+    globalThis.addEventListener("pageshow", focus);
+    globalThis.addEventListener("focus", focus);
+    return {
+        storage, locks,
+        subscribe(key, fn) { const group = listeners.get(key) ?? new Set(); group.add(fn); listeners.set(key, group); return () => group.delete(fn); },
+        publish(key) {
+            for (const fn of documentObservers)
+                if (fn !== dispatch)
+                    queueMicrotask(() => fn(key));
+            try {
+                channel?.postMessage({ type: "changed", key });
+            }
+            catch { /* Storage events remain available. */ }
+        },
+        close() { documentObservers.delete(dispatch); channel?.close(); globalThis.removeEventListener("storage", changed); globalThis.removeEventListener("pageshow", focus); globalThis.removeEventListener("focus", focus); },
+    };
+}
+export class SessionPersistence {
+    changed;
+    unavailable;
+    key;
+    scope;
+    environment;
+    detach;
+    constructor(baseURL, projectId, options, changed, unavailable, environment) {
+        this.changed = changed;
+        this.unavailable = unavailable;
+        const server = new URL(baseURL || "/", globalThis.location?.href || "http://localhost");
+        if (!/^https?:$/.test(server.protocol) || server.username || server.password || server.search || server.hash)
+            throw new Error("Invalid Auth server URL");
+        this.scope = JSON.stringify([server.href.replace(/\/+$/, ""), projectId, options.installId ?? null,
+            options.organizationSlug?.trim().toLowerCase() || null, options.clientId, options.profile || null]);
+        this.key = "apteva.auth.v1:" + encodeURIComponent(this.scope);
+        try {
+            this.environment = environment ?? browserEnvironment();
+            if (!this.environment.locks?.request)
+                throw new Error("Web Locks required");
+            const probe = this.key + ":probe:" + crypto.randomUUID();
+            this.environment.storage.setItem(probe, "1");
+            this.environment.storage.removeItem(probe);
+            this.detach = this.environment.subscribe(this.key, changed);
+        }
+        catch {
+            this.disable();
+        }
+    }
+    get enabled() { return Boolean(this.environment); }
+    disable() { this.detach?.(); this.environment?.close(); this.environment = undefined; this.unavailable(); }
+    dispose() { this.detach?.(); this.environment?.close(); this.environment = undefined; }
+    async exclusive(fn) {
+        const environment = this.environment;
+        if (!environment)
+            throw new PersistenceError("persistence_unavailable", "Persistent sessions are unavailable");
+        let entered = false;
+        try {
+            return await environment.locks.request(this.key, { mode: "exclusive" }, async () => { entered = true; return fn(); });
+        }
+        catch (error) {
+            if (!entered) {
+                this.disable();
+                throw new PersistenceError("persistence_unavailable", "Session lock unavailable");
+            }
+            throw error;
+        }
+    }
+    read() {
+        let raw;
+        try {
+            if (!this.environment)
+                throw new Error();
+            raw = this.environment.storage.getItem(this.key);
+        }
+        catch {
+            this.disable();
+            throw new PersistenceError("persistence_unavailable", "Session storage unavailable");
+        }
+        if (raw === null)
+            return undefined;
+        try {
+            if (raw.length > 20000)
+                throw new Error();
+            const record = JSON.parse(raw);
+            if (record.version !== 1 || record.scope !== this.scope || !/^[a-f0-9-]{36}$/.test(record.generation) || !/^[a-f0-9-]{36}$/.test(record.revision) ||
+                !["active", "refreshing", "logged-out"].includes(record.state) ||
+                (record.state === "logged-out" ? record.refreshToken !== undefined : typeof record.refreshToken !== "string" || record.refreshToken.length < 1 || record.refreshToken.length > 16384))
+                throw new Error();
+            return record;
+        }
+        catch {
+            throw new PersistenceError("invalid_storage", "Saved session is invalid; login required");
+        }
+    }
+    write(record) {
+        try {
+            if (!this.environment)
+                throw new Error();
+            this.environment.storage.setItem(this.key, JSON.stringify(record));
+            // Storage events do not reach sibling clients in the same document.
+            this.environment.publish(this.key);
+        }
+        catch {
+            this.disable();
+            throw new PersistenceError("persistence_unavailable", "Session could not be saved");
+        }
+    }
+    record(state, generation = crypto.randomUUID(), refreshToken) {
+        return { version: 1, scope: this.scope, generation, revision: crypto.randomUUID(), state, ...(refreshToken ? { refreshToken } : {}) };
+    }
+}
+//# sourceMappingURL=session-persistence.js.map

package/dist/session-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-persistence.js","sourceRoot":"","sources":["../src/session-persistence.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB;IAArB,YAAqB,IAAyE,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA7G,SAAI,GAAJ,IAAI,CAAqE;IAAqC,CAAC;CACrI;AAED,iFAAiF;AACjF,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;AAElE,SAAS,kBAAkB;IACzB,kFAAkF;IAClF,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/H,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE;gBAAE,KAAK,MAAM,EAAE,IAAI,KAAK;oBAAE,EAAE,EAAE,CAAC;aAClF,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;gBAAE,EAAE,EAAE,CAAC;IACpF,CAAC,CAAC;IACF,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,OAAqC,CAAC;IAC1C,IAAI,CAAC;QAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;IACxH,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO;QAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,UAAU,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,GAAG;YACT,KAAK,MAAM,EAAE,IAAI,iBAAiB;gBAAE,IAAI,EAAE,KAAK,QAAQ;oBAAE,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC;gBAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QACD,KAAK,KAAK,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;KACzN,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IAMV;IAAsC;IALhD,GAAG,CAAS;IACZ,KAAK,CAAS;IACf,WAAW,CAA0B;IACrC,MAAM,CAAc;IAC5B,YAAY,OAAe,EAAE,SAAiB,EAAE,OAA8F,EAC3H,OAAmB,EAAmB,WAAuB,EAAE,WAAoC;QAAnG,YAAO,GAAP,OAAO,CAAY;QAAmB,gBAAW,GAAX,WAAW,CAAY;QAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,kBAAkB,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YAChG,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,GAAG,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,kBAAkB,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACzD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAc,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,KAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjH,OAAO,KAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7F,KAAK,CAAC,SAAS,CAAI,EAAoB;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,CAAC;QAC/G,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,IAAI,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC9H,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;YAAC,CAAC;YACpH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI;QACF,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QACnG,MAAM,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,EAAE,6BAA6B,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAChD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC/I,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9D,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3M,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QAAC,CAAC;IACxG,CAAC;IACD,KAAK,CAAC,MAAqB;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,oEAAoE;YACpE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,MAAM,CAAC,KAA6B,EAAE,aAAqB,MAAM,CAAC,UAAU,EAAE,EAAE,YAAqB;QACnG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxI,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apteva/web-sdk",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Browser SDK for apteva-server. Handles session cookies, API keys, and opaque application-user access tokens; wraps app HTTP, MCP, agents, chat, telemetry, and authenticated SSE. Framework-agnostic.",
   "license": "MIT",
   "author": "Apteva",
@@ -47,10 +47,13 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "test": "bun test",
+    "test:persistence:browser": "bun scripts/test-persistence-browser.ts",
+    "test:mixed-apps": "bun scripts/test-mixed-apps.ts",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "bun run typecheck && bun test && bun run build"
   },
   "devDependencies": {
+    "@playwright/test": "^1.63.0",
     "@types/bun": "^1.1.0",
     "typescript": "^5.4.0"
   }