@beeuni/sdk 0.1.0

package/dist/internal/idb-sync-cache.d.ts

@@ -0,0 +1 @@
+export * from '../browser/cache/idb-sync-cache.js';

package/dist/internal/idb-sync-cache.js

@@ -0,0 +1 @@
+export * from '../browser/cache/idb-sync-cache.js';

package/dist/internal/managed-storage.d.ts

@@ -0,0 +1 @@
+export * from '../platform/storage/managed-storage.js';

package/dist/internal/managed-storage.js

@@ -0,0 +1 @@
+export * from '../platform/storage/managed-storage.js';

package/dist/internal/opencode-pending-store.d.ts

@@ -0,0 +1 @@
+export * from '../browser/stores/opencode-pending-store.js';

package/dist/internal/opencode-pending-store.js

@@ -0,0 +1 @@
+export * from '../browser/stores/opencode-pending-store.js';

package/dist/internal/sandbox-connection-store.d.ts

@@ -0,0 +1 @@
+export * from '../browser/stores/sandbox-connection-store.js';

package/dist/internal/sandbox-connection-store.js

@@ -0,0 +1 @@
+export * from '../browser/stores/sandbox-connection-store.js';

package/dist/internal/server-store.d.ts

@@ -0,0 +1 @@
+export * from '../browser/stores/server-store.js';

package/dist/internal/server-store.js

@@ -0,0 +1 @@
+export * from '../browser/stores/server-store.js';

package/dist/internal/sync-store.d.ts

@@ -0,0 +1 @@
+export * from '../browser/stores/sync-store.js';

package/dist/internal/sync-store.js

@@ -0,0 +1 @@
+export * from '../browser/stores/sync-store.js';

package/dist/node/app-guard.d.ts

@@ -0,0 +1,36 @@
+import type { BeeuniAuth } from './auth.js';
+export interface BeeuniGuardedViewer {
+    userId: string;
+    email: string | null;
+    name?: string | null;
+    picture?: string | null;
+    groupIds: string[];
+    groups?: string[];
+    role?: string | null;
+    accountId: string;
+    source: 'app-gate' | 'beeuni-sign-in';
+    token: string | null;
+}
+export type BeeuniAppGuardResult = {
+    viewer: BeeuniGuardedViewer;
+    response?: undefined;
+} | {
+    viewer?: undefined;
+    response: Response;
+};
+export interface BeeuniAppGuardOptions {
+    secret?: string;
+    backendUrl?: string;
+    auth?: Pick<BeeuniAuth, 'viewer' | 'signInUrl'> | null;
+    accountId?: string;
+    groupCacheTtlMs?: number;
+    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+    now?: () => number;
+}
+export interface BeeuniAppGuard {
+    viewer(request: Request): Promise<BeeuniGuardedViewer | null>;
+    requireViewer(request: Request): Promise<BeeuniAppGuardResult>;
+    requireGroup(request: Request, groupIds: string[]): Promise<BeeuniAppGuardResult>;
+    identityConfigured(): boolean;
+}
+export declare function createBeeuniAppGuard(options?: BeeuniAppGuardOptions): BeeuniAppGuard;

package/dist/node/app-guard.js

@@ -0,0 +1,118 @@
+import { stripTrailingSlashes } from '../platform/strings.js';
+import { readAppViewer } from './app-viewer.js';
+function env(name) {
+    try {
+        return typeof process !== 'undefined' ? process.env?.[name] || undefined : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createBeeuniAppGuard(options = {}) {
+    const resolveSecret = () => options.secret ?? env('BEEUNI_APP_VIEWER_SECRET');
+    const ttl = options.groupCacheTtlMs ?? 60_000;
+    const now = options.now ?? (() => Date.now());
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    const cache = new Map();
+    async function fetchGroups(accountId, userId, token) {
+        const none = { groupIds: [], groups: [] };
+        const key = `${accountId}:${userId}`;
+        const hit = cache.get(key);
+        if (hit && now() - hit.at < ttl)
+            return hit;
+        if (!options.backendUrl)
+            return none;
+        try {
+            const base = stripTrailingSlashes(options.backendUrl);
+            const res = await fetchImpl(`${base}/accounts/${encodeURIComponent(accountId)}/iam/members/${encodeURIComponent(userId)}/groups`, { headers: { accept: 'application/json', authorization: `Bearer ${token}` } });
+            if (!res.ok)
+                return none;
+            const body = (await res.json());
+            const rows = body.groups ?? [];
+            const found = {
+                groupIds: rows.map((g) => g.group_id ?? g.groupId).filter((id) => typeof id === 'string'),
+                groups: rows.map((g) => g.name).filter((name) => typeof name === 'string'),
+            };
+            cache.set(key, { ...found, at: now() });
+            return found;
+        }
+        catch {
+            return none;
+        }
+    }
+    async function viewer(request) {
+        const secret = resolveSecret();
+        const gated = await readAppViewer(request, secret ? { secret } : undefined);
+        if (gated) {
+            return {
+                userId: gated.userId,
+                email: gated.email,
+                name: gated.name ?? null,
+                picture: gated.picture ?? null,
+                groupIds: gated.groupIds ?? [],
+                groups: gated.groups ?? [],
+                role: gated.role ?? null,
+                accountId: gated.accountId,
+                source: 'app-gate',
+                token: gated.token,
+            };
+        }
+        if (!options.auth)
+            return null;
+        const signedIn = await options.auth.viewer(request).catch(() => null);
+        if (!signedIn)
+            return null;
+        const appAccountId = options.accountId ?? env('BEEUNI_APP_ACCOUNT_ID');
+        const accounts = signedIn.accounts ?? [];
+        const inAppAccount = Boolean(appAccountId) && accounts.some((a) => a.account_id === appAccountId);
+        const accountId = inAppAccount ? appAccountId : (accounts[0]?.account_id ?? '');
+        const membership = accountId && (inAppAccount || !appAccountId)
+            ? await fetchGroups(accountId, signedIn.userId, signedIn.token)
+            : { groupIds: [], groups: [] };
+        return {
+            userId: signedIn.userId,
+            email: signedIn.email ?? null,
+            groupIds: membership.groupIds,
+            groups: inAppAccount ? membership.groups : [],
+            accountId,
+            source: 'beeuni-sign-in',
+            token: signedIn.token,
+        };
+    }
+    function identityConfigured() {
+        return Boolean(resolveSecret()) || Boolean(options.auth);
+    }
+    function refuse() {
+        return Response.json({ error: 'not_found' }, { status: 404 });
+    }
+    return {
+        viewer,
+        identityConfigured,
+        async requireViewer(request) {
+            const found = await viewer(request);
+            if (found)
+                return { viewer: found };
+            const signIn = options.auth?.signInUrl?.(new URL(request.url).pathname);
+            return {
+                response: signIn
+                    ? Response.redirect(new URL(signIn, request.url).toString(), 302)
+                    : refuse(),
+            };
+        },
+        async requireGroup(request, groupIds) {
+            const found = await viewer(request);
+            if (!found) {
+                const signIn = options.auth?.signInUrl?.(new URL(request.url).pathname);
+                return {
+                    response: signIn
+                        ? Response.redirect(new URL(signIn, request.url).toString(), 302)
+                        : refuse(),
+                };
+            }
+            if (groupIds.length === 0)
+                return { response: refuse() };
+            const allowed = groupIds.some((group) => found.groupIds.includes(group) || (found.groups ?? []).includes(group));
+            return allowed ? { viewer: found } : { response: refuse() };
+        },
+    };
+}

package/dist/node/app-viewer.d.ts

@@ -0,0 +1,30 @@
+import type { Beeuni } from '../core/client/beeuni.js';
+export declare const APP_VIEWER_HEADER = "x-beeuni-app-viewer";
+export declare const APP_VIEWER_TOKEN_HEADER = "x-beeuni-app-viewer-token";
+export declare const APP_VIEWER_SECRET_ENV = "BEEUNI_APP_VIEWER_SECRET";
+export interface BeeuniAppViewer {
+    userId: string;
+    email: string | null;
+    name?: string | null;
+    picture?: string | null;
+    groupIds: string[];
+    groups?: string[];
+    role?: string | null;
+    projectId?: string | null;
+    accountId: string;
+    appId: string;
+    accessMode: string;
+    token: string | null;
+    expiresAt: Date;
+}
+export interface ReadAppViewerOptions {
+    secret?: string;
+}
+export declare function readAppViewer(request: Request, options?: ReadAppViewerOptions): Promise<BeeuniAppViewer | null>;
+export declare class AppViewerUnavailableError extends Error {
+    readonly code: 'no_viewer' | 'identity_only';
+    constructor(code: 'no_viewer' | 'identity_only', message: string);
+}
+export declare function createAppViewerBeeuni(request: Request, options: {
+    backendUrl: string;
+} & ReadAppViewerOptions): Promise<Beeuni>;

package/dist/node/app-viewer.js

@@ -0,0 +1,113 @@
+import { createScopedBeeuni } from './scoped-client.js';
+export const APP_VIEWER_HEADER = 'x-beeuni-app-viewer';
+export const APP_VIEWER_TOKEN_HEADER = 'x-beeuni-app-viewer-token';
+export const APP_VIEWER_SECRET_ENV = 'BEEUNI_APP_VIEWER_SECRET';
+function envSecret() {
+    const env = globalThis.process?.env;
+    return env?.[APP_VIEWER_SECRET_ENV];
+}
+function fromB64url(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    const bin = atob(padded);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i += 1)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function b64url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function equal(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+export async function readAppViewer(request, options = {}) {
+    const secret = options.secret ?? envSecret();
+    if (!secret)
+        return null;
+    const raw = request.headers.get(APP_VIEWER_HEADER);
+    if (!raw)
+        return null;
+    const [payloadB64, sig, extra] = raw.split('.');
+    if (!payloadB64 || !sig || extra)
+        return null;
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const message = new TextEncoder().encode(`beeuni-app-viewer:v1\0${payloadB64}`);
+    const expected = b64url(new Uint8Array(await crypto.subtle.sign('HMAC', key, message)));
+    if (!equal(sig, expected))
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(fromB64url(payloadB64)));
+    }
+    catch {
+        return null;
+    }
+    if (payload.v !== 1 || typeof payload.userId !== 'string' || !payload.userId)
+        return null;
+    if (typeof payload.exp !== 'number' || payload.exp * 1000 <= Date.now())
+        return null;
+    if (payload.groupIds !== undefined) {
+        if (!Array.isArray(payload.groupIds))
+            return null;
+        if (payload.groupIds.some((id) => typeof id !== 'string'))
+            return null;
+    }
+    if (payload.email !== undefined && payload.email !== null && typeof payload.email !== 'string') {
+        return null;
+    }
+    if (payload.groups !== undefined) {
+        if (!Array.isArray(payload.groups))
+            return null;
+        if (payload.groups.some((name) => typeof name !== 'string'))
+            return null;
+    }
+    for (const field of [payload.name, payload.picture, payload.role, payload.projectId]) {
+        if (field !== undefined && field !== null && typeof field !== 'string')
+            return null;
+    }
+    return {
+        userId: payload.userId,
+        email: payload.email ?? null,
+        name: payload.name ?? null,
+        picture: payload.picture ?? null,
+        groupIds: payload.groupIds ?? [],
+        groups: payload.groups ?? [],
+        role: payload.role ?? null,
+        projectId: payload.projectId ?? null,
+        accountId: payload.accountId,
+        appId: payload.appId,
+        accessMode: payload.accessMode,
+        token: request.headers.get(APP_VIEWER_TOKEN_HEADER),
+        expiresAt: new Date(payload.exp * 1000),
+    };
+}
+export class AppViewerUnavailableError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AppViewerUnavailableError';
+    }
+}
+export async function createAppViewerBeeuni(request, options) {
+    const viewer = await readAppViewer(request, options);
+    if (!viewer) {
+        throw new AppViewerUnavailableError('no_viewer', 'No verified Beeuni viewer on this request');
+    }
+    if (!viewer.token) {
+        throw new AppViewerUnavailableError('identity_only', "This App carries viewer identity but no API token — set its access policy to viewer_token_scope: 'api' to act as the viewer.");
+    }
+    const token = viewer.token;
+    return createScopedBeeuni({
+        backendUrl: options.backendUrl,
+        getToken: async () => token,
+    });
+}

package/dist/node/auth.d.ts

@@ -0,0 +1,52 @@
+import type { Beeuni } from '../core/client/beeuni.js';
+import type { AccountIdentity } from '../core/rest/projects-client/accounts.js';
+export type BeeuniFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export interface BeeuniAuthOptions {
+    backendUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    cookieSecret: string;
+    scopes?: string[];
+    basePath?: string;
+    sessionTtlSeconds?: number;
+    fetch?: BeeuniFetch;
+    now?: () => number;
+    cookieSameSite?: 'lax' | 'none';
+}
+export interface BeeuniViewer {
+    userId: string;
+    email: string;
+    accounts: AccountIdentity['accounts'];
+    scopes: string[];
+    token: string;
+    expiresAt: number;
+}
+export type RequireViewerResult = {
+    viewer: BeeuniViewer;
+    response?: undefined;
+} | {
+    viewer?: undefined;
+    response: Response;
+};
+export interface BeeuniAuth {
+    readonly basePath: string;
+    handler(request: Request): Promise<Response>;
+    viewer(request: Request): Promise<BeeuniViewer | null>;
+    requireViewer(request: Request): Promise<RequireViewerResult>;
+    beeuni(request: Request): Promise<Beeuni>;
+    signInUrl(returnTo?: string): string;
+    signOutUrl(returnTo?: string): string;
+    clientConfig(origin?: string): {
+        backendUrl: string;
+        getToken: () => Promise<string>;
+    };
+    __setNow(now: () => number): void;
+}
+export declare class BeeuniAuthError extends Error {
+    readonly code: 'invalid_options' | 'unauthenticated' | 'state_mismatch' | 'token_exchange_failed' | 'refresh_failed';
+    constructor(code: 'invalid_options' | 'unauthenticated' | 'state_mismatch' | 'token_exchange_failed' | 'refresh_failed', message: string);
+}
+export declare const BEEUNI_SESSION_SENTINEL = "beeuni-session";
+export declare function safeReturnTo(value: string | null | undefined): string;
+export declare function createBeeuniAuth(options: BeeuniAuthOptions): BeeuniAuth;