@authyon/server 0.2.0-beta.0 → 0.2.0-beta.11

package/dist/browser.cjs

@@ -0,0 +1,21 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/browser.ts
+var browser_exports = {};
+module.exports = __toCommonJS(browser_exports);
+throw new Error(
+  "@authyon/server cannot run in a browser. Use @authyon/auth in frontend code and keep client secrets on the server."
+);

package/dist/browser.d.cts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/browser.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/browser.js

@@ -0,0 +1,4 @@
+// src/browser.ts
+throw new Error(
+  "@authyon/server cannot run in a browser. Use @authyon/auth in frontend code and keep client secrets on the server."
+);

package/dist/chunk-56H66KLG.js

@@ -0,0 +1,323 @@
+// ../../internal/core/errors/authyonError.ts
+var ErrorCodes = {
+  Unknown: "unknown",
+  NetworkError: "request.network_error",
+  Timeout: "request.timeout",
+  SessionMalformed: "session.malformed",
+  NotAuthenticated: "auth.not_authenticated",
+  InvalidToken: "auth.invalid_token",
+  MissingToken: "auth.missing_token",
+  EmailTaken: "user.email_taken",
+  PasswordWeak: "user.password_weak",
+  PasswordPwned: "user.password_pwned",
+  RateLimited: "rate_limited"
+};
+var AuthyonError = class extends Error {
+  constructor(status, body, options = {}) {
+    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    this.name = "AuthyonError";
+    this.status = status;
+    this.code = body.code ?? "unknown";
+    this.title = body.title ?? "Error";
+    this.detail = body.detail;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
+    this.cause = options.cause;
+  }
+  is(code) {
+    return this.code === code;
+  }
+  isAny(...codes) {
+    return codes.includes(this.code);
+  }
+  hasPrefix(prefix) {
+    return this.code.startsWith(prefix);
+  }
+  isStatus(...statuses) {
+    return statuses.includes(this.status);
+  }
+  /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
+  interpret() {
+    const category = classifyError(this.status, this.code);
+    return {
+      category,
+      action: actionFor(category),
+      retryable: isRetryable(category),
+      ...this.retryAfter !== void 0 ? { retryAfter: this.retryAfter } : {},
+      ...this.requestId !== void 0 ? { requestId: this.requestId } : {}
+    };
+  }
+  get category() {
+    return this.interpret().category;
+  }
+  get retryable() {
+    return this.interpret().retryable;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      status: this.status,
+      code: this.code,
+      title: this.title,
+      detail: this.detail,
+      requestId: this.requestId,
+      retryAfter: this.retryAfter,
+      ...this.interpret()
+    };
+  }
+};
+function classifyError(status, code) {
+  if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.Timeout || status === 408) return "timeout";
+  if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
+  if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
+  if (code === ErrorCodes.PasswordWeak || code === ErrorCodes.PasswordPwned) return "validation";
+  if (code === ErrorCodes.SessionMalformed) return "server";
+  if (code.startsWith("auth.") || status === 401) return "authentication";
+  if (status === 403) return "authorization";
+  if (status === 404) return "not_found";
+  if (status === 400 || status === 422) return "validation";
+  if (status >= 500) return "server";
+  return "unknown";
+}
+function actionFor(category) {
+  switch (category) {
+    case "network":
+    case "timeout":
+    case "rate_limit":
+    case "server":
+      return "retry";
+    case "authentication":
+      return "reauthenticate";
+    case "authorization":
+      return "request_access";
+    case "validation":
+      return "fix_input";
+    case "not_found":
+      return "not_found";
+    case "conflict":
+      return "resolve_conflict";
+    case "unknown":
+      return "contact_support";
+  }
+}
+function isRetryable(category) {
+  return category === "network" || category === "timeout" || category === "rate_limit" || category === "server";
+}
+
+// ../../internal/core/http/httpAdapter.ts
+var FetchHttpAdapter = class {
+  constructor(fetchImpl = fetch.bind(globalThis)) {
+    this.fetchImpl = fetchImpl;
+  }
+  request(request) {
+    return this.fetchImpl(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      signal: request.signal,
+      redirect: "error"
+    });
+  }
+};
+var LoggingHttpAdapter = class {
+  constructor(adapter, options) {
+    this.adapter = adapter;
+    this.options = options;
+  }
+  async request(request) {
+    const startedAt = Date.now();
+    const eventBase = {
+      method: request.method,
+      url: sanitizeUrl(request.url)
+    };
+    this.log({ type: "request", ...eventBase, timestamp: startedAt });
+    try {
+      const response = await this.adapter.request(request);
+      this.log({
+        type: "response",
+        ...eventBase,
+        status: response.status,
+        durationMs: Date.now() - startedAt,
+        requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+        timestamp: Date.now()
+      });
+      return response;
+    } catch (error) {
+      this.log({
+        type: "error",
+        ...eventBase,
+        errorName: error instanceof Error ? error.name : "UnknownError",
+        durationMs: Date.now() - startedAt,
+        timestamp: Date.now()
+      });
+      throw error;
+    }
+  }
+  log(event) {
+    if (!this.options.enabled) return;
+    const logger = this.options.logger ?? defaultHttpLogger;
+    try {
+      logger(event);
+    } catch {
+    }
+  }
+};
+function defaultHttpLogger(event) {
+  console.debug("[Authyon HTTP]", event);
+}
+function sanitizeUrl(value) {
+  const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
+  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
+  const queryKeys = /* @__PURE__ */ new Set();
+  url.searchParams.forEach((_value, key) => queryKeys.add(key));
+  url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
+  return url.toString();
+}
+
+// ../../internal/core/config/defaults.ts
+var DEFAULT_BASE_URL = "https://api.authyon.com";
+var DEFAULT_EXPIRY_SKEW_MS = 3e4;
+
+// ../../internal/core/http/transport.ts
+var DEFAULT_TIMEOUT_MS = 15e3;
+var SharedTransportError = class extends Error {
+  constructor(code, cause) {
+    super(code === "request.timeout" ? "Request timed out" : "Network request failed");
+    this.name = "SharedTransportError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+function createSharedTransport(options) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp ?? false);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+    throw new Error("Authyon: `timeoutMs` must be a non-negative finite number");
+  }
+  if (options.httpAdapter && options.fetch) {
+    throw new Error("Authyon: use either `httpAdapter` or `fetch`, not both");
+  }
+  const baseAdapter = options.httpAdapter ?? new FetchHttpAdapter(options.fetch);
+  const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
+  return {
+    baseUrl,
+    async request(path, init) {
+      const controller = new AbortController();
+      const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+      try {
+        return await httpAdapter.request({
+          url: `${baseUrl}${path}`,
+          method: init.method ?? "GET",
+          headers: normalizeHeaders(init.headers),
+          body: init.body,
+          signal: controller.signal
+        });
+      } catch (cause) {
+        throw new SharedTransportError(
+          controller.signal.aborted ? ErrorCodes.Timeout : ErrorCodes.NetworkError,
+          cause
+        );
+      } finally {
+        if (timeout !== void 0) clearTimeout(timeout);
+      }
+    }
+  };
+}
+function normalizeHeaders(headers) {
+  const normalized = {};
+  new Headers(headers).forEach((value, key) => {
+    normalized[key] = value;
+  });
+  return normalized;
+}
+function responseMetadata(response) {
+  const retryAfterHeader = response.headers.get("retry-after");
+  const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
+  return {
+    requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+    retryAfter: Number.isFinite(retryAfter) ? retryAfter : void 0
+  };
+}
+function normalizeBaseUrl(value, allowInsecureHttp) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Authyon: `baseUrl` must be an absolute URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
+    throw new Error(
+      "Authyon: `baseUrl` must use HTTPS (HTTP is allowed only for loopback or with `allowInsecureHttp`)"
+    );
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error(
+      "Authyon: `baseUrl` cannot contain credentials, query parameters, or fragments"
+    );
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+// ../../internal/core/http/query.ts
+function appendQuery(path, params) {
+  if (!params) return path;
+  const query = new URLSearchParams();
+  for (const [key, value2] of Object.entries(params)) {
+    if (value2 !== void 0) query.set(key, String(value2));
+  }
+  const value = query.toString();
+  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+}
+
+// ../../internal/core/http/jsonHttpClient.ts
+var JsonHttpClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async send(path, options = {}) {
+    const headers = { ...options.headers };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    try {
+      return await this.transport.request(appendQuery(path, options.query), {
+        method: options.method ?? "GET",
+        headers,
+        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      if (!(cause instanceof SharedTransportError)) throw cause;
+      throw new AuthyonError(0, { code: cause.code, title: cause.message }, { cause: cause.cause });
+    }
+  }
+  async parse(response) {
+    if (!response.ok) {
+      let body = {};
+      try {
+        body = await response.json();
+      } catch {
+      }
+      throw new AuthyonError(response.status, body, responseMetadata(response));
+    }
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async request(path, options = {}) {
+    return this.parse(await this.send(path, options));
+  }
+};
+
+export {
+  ErrorCodes,
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  DEFAULT_EXPIRY_SKEW_MS,
+  FetchHttpAdapter,
+  LoggingHttpAdapter,
+  createSharedTransport,
+  JsonHttpClient
+};

package/dist/chunk-77J4NURK.js

@@ -0,0 +1,13 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+
+export {
+  __privateGet,
+  __privateAdd,
+  __privateSet
+};