@beeuni/sdk 0.1.0

package/dist/node/auth.js

@@ -0,0 +1,387 @@
+import { createScopedBeeuni, forwardBeeuniRequest } from './scoped-client.js';
+import { stripTrailingSlashes } from '../platform/strings.js';
+export class BeeuniAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'BeeuniAuthError';
+    }
+}
+export const BEEUNI_SESSION_SENTINEL = 'beeuni-session';
+const DEFAULT_SCOPES = ['profile', 'email', 'beeuni'];
+const TXN_TTL_S = 10 * 60;
+const DEFAULT_SESSION_TTL_S = 30 * 24 * 3600;
+const EXPIRY_SKEW_S = 30;
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+function b64url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromB64url(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    const s = atob(padded);
+    const out = new Uint8Array(new ArrayBuffer(s.length));
+    for (let i = 0; i < s.length; i += 1)
+        out[i] = s.charCodeAt(i);
+    return out;
+}
+function randomB64url(bytes) {
+    const buf = new Uint8Array(bytes);
+    crypto.getRandomValues(buf);
+    return b64url(buf);
+}
+async function sha256B64url(input) {
+    return b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', enc.encode(input))));
+}
+async function aesKey(secret) {
+    const raw = await crypto.subtle.digest('SHA-256', enc.encode(secret));
+    return crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+async function seal(value, secret) {
+    const iv = new Uint8Array(12);
+    crypto.getRandomValues(iv);
+    const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, await aesKey(secret), enc.encode(JSON.stringify(value)));
+    return `${b64url(iv)}.${b64url(new Uint8Array(ct))}`;
+}
+async function open(token, secret) {
+    const [ivPart, ctPart, extra] = token.split('.');
+    if (!ivPart || !ctPart || extra)
+        return null;
+    try {
+        const pt = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: fromB64url(ivPart) }, await aesKey(secret), fromB64url(ctPart));
+        return JSON.parse(dec.decode(pt));
+    }
+    catch {
+        return null;
+    }
+}
+function readCookie(request, name) {
+    const header = request.headers.get('cookie') ?? '';
+    for (const part of header.split(';')) {
+        const [k, ...v] = part.trim().split('=');
+        if (k === name)
+            return v.join('=') || null;
+    }
+    return null;
+}
+export function safeReturnTo(value) {
+    if (!value)
+        return '/';
+    if (!value.startsWith('/') || value.startsWith('//'))
+        return '/';
+    if (value.includes('\\') || /[\u0000-\u001f\u007f]/.test(value))
+        return '/';
+    try {
+        const base = 'https://return-to.invalid';
+        const resolved = new URL(value, base);
+        if (resolved.origin !== base)
+            return '/';
+        return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+    }
+    catch {
+        return '/';
+    }
+}
+export function createBeeuniAuth(options) {
+    if (!options.cookieSecret || options.cookieSecret.length < 32) {
+        throw new BeeuniAuthError('invalid_options', 'cookieSecret must be at least 32 characters');
+    }
+    let redirect;
+    try {
+        redirect = new URL(options.redirectUri);
+    }
+    catch {
+        throw new BeeuniAuthError('invalid_options', 'redirectUri must be an absolute URL');
+    }
+    if (redirect.protocol !== 'https:' && redirect.protocol !== 'http:') {
+        throw new BeeuniAuthError('invalid_options', 'redirectUri must be http(s)');
+    }
+    if (!options.clientId)
+        throw new BeeuniAuthError('invalid_options', 'clientId is required');
+    if (!options.backendUrl)
+        throw new BeeuniAuthError('invalid_options', 'backendUrl is required');
+    const backendUrl = stripTrailingSlashes(options.backendUrl);
+    const rawBase = options.basePath ?? (redirect.pathname.endsWith('/callback/') ? redirect.pathname.slice(0, -'/callback/'.length) : redirect.pathname.endsWith('/callback') ? redirect.pathname.slice(0, -'/callback'.length) : redirect.pathname);
+    const basePath = stripTrailingSlashes(rawBase) || '/';
+    const secure = redirect.protocol === 'https:';
+    const sessionCookie = secure ? '__Host-beeuni_session' : 'beeuni_session';
+    const txnCookie = secure ? '__Host-beeuni_oauth_txn' : 'beeuni_oauth_txn';
+    const scopes = options.scopes?.length ? options.scopes : DEFAULT_SCOPES;
+    const sessionTtl = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_S;
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    let now = options.now ?? (() => Date.now());
+    const nowS = () => Math.floor(now() / 1000);
+    const sameSite = options.cookieSameSite === 'none' && secure ? 'None' : 'Lax';
+    const cookieLine = (name, value, maxAge) => `${name}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=${sameSite}${secure ? '; Secure' : ''}`;
+    const clearLine = (name) => cookieLine(name, '', 0);
+    const redirectTo = (location, cookies = []) => {
+        const headers = new Headers({ location, 'cache-control': 'no-store' });
+        for (const c of cookies)
+            headers.append('set-cookie', c);
+        return new Response(null, { status: 302, headers });
+    };
+    const jsonResponse = (body, status = 200, cookies = []) => {
+        const headers = new Headers({ 'content-type': 'application/json', 'cache-control': 'no-store' });
+        for (const c of cookies)
+            headers.append('set-cookie', c);
+        return new Response(JSON.stringify(body), { status, headers });
+    };
+    const pathOf = (request) => {
+        const url = new URL(request.url);
+        return `${url.pathname}${url.search}`;
+    };
+    const signInUrl = (returnTo) => returnTo ? `${basePath}/signin?return_to=${encodeURIComponent(safeReturnTo(returnTo))}` : `${basePath}/signin`;
+    const signOutUrl = (returnTo) => returnTo ? `${basePath}/signout?return_to=${encodeURIComponent(safeReturnTo(returnTo))}` : `${basePath}/signout`;
+    const refreshUrl = (returnTo) => `${basePath}/refresh?return_to=${encodeURIComponent(safeReturnTo(returnTo))}`;
+    const clientAuthFields = () => ({
+        client_id: options.clientId,
+        ...(options.clientSecret ? { client_secret: options.clientSecret } : {}),
+    });
+    async function tokenRequest(fields) {
+        let res;
+        try {
+            res = await fetchImpl(`${backendUrl}/oauth/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({ ...fields, ...clientAuthFields() }).toString(),
+            });
+        }
+        catch (err) {
+            return { ok: false, status: 502, error: 'upstream_unreachable', description: err.message };
+        }
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || typeof body.access_token !== 'string' || typeof body.refresh_token !== 'string') {
+            return {
+                ok: false,
+                status: res.status,
+                error: typeof body.error === 'string' ? body.error : 'token_error',
+                description: typeof body.error_description === 'string' ? body.error_description : undefined,
+            };
+        }
+        const expiresIn = typeof body.expires_in === 'number' ? body.expires_in : 3600;
+        return {
+            ok: true,
+            session: {
+                v: 1,
+                at: body.access_token,
+                rt: body.refresh_token,
+                exp: nowS() + expiresIn,
+                scopes: typeof body.scope === 'string' ? body.scope.split(' ').filter(Boolean) : scopes,
+            },
+        };
+    }
+    async function revoke(token) {
+        try {
+            await fetchImpl(`${backendUrl}/oauth/revoke`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({ token, ...clientAuthFields() }).toString(),
+            });
+        }
+        catch {
+        }
+    }
+    async function identity(token) {
+        try {
+            const res = await fetchImpl(`${backendUrl}/accounts/me`, {
+                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+            });
+            if (!res.ok)
+                return null;
+            return (await res.json());
+        }
+        catch {
+            return null;
+        }
+    }
+    const readSession = async (request) => {
+        const raw = readCookie(request, sessionCookie);
+        if (!raw)
+            return null;
+        const payload = await open(raw, options.cookieSecret);
+        return payload && payload.v === 1 && typeof payload.at === 'string' && typeof payload.rt === 'string' ? payload : null;
+    };
+    const isLive = (s) => s.exp - EXPIRY_SKEW_S > nowS();
+    const sessionCookieLine = async (s) => cookieLine(sessionCookie, await seal(s, options.cookieSecret), sessionTtl);
+    const toViewer = (s, id) => ({
+        userId: id.user_id,
+        email: id.email,
+        accounts: id.accounts ?? [],
+        scopes: s.scopes,
+        token: s.at,
+        expiresAt: s.exp * 1000,
+    });
+    async function liveSession(request) {
+        const session = await readSession(request);
+        if (!session)
+            return null;
+        if (isLive(session))
+            return { session, setCookie: null };
+        const refreshed = await tokenRequest({ grant_type: 'refresh_token', refresh_token: session.rt });
+        if (!refreshed.ok)
+            return null;
+        return { session: refreshed.session, setCookie: await sessionCookieLine(refreshed.session) };
+    }
+    async function handleSignIn(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const state = randomB64url(24);
+        const verifier = randomB64url(48);
+        const challenge = await sha256B64url(verifier);
+        const txn = { v: 1, state, verifier, returnTo, exp: nowS() + TXN_TTL_S };
+        const authorize = new URL(`${backendUrl}/oauth/authorize`);
+        authorize.searchParams.set('response_type', 'code');
+        authorize.searchParams.set('client_id', options.clientId);
+        authorize.searchParams.set('redirect_uri', options.redirectUri);
+        authorize.searchParams.set('scope', scopes.join(' '));
+        authorize.searchParams.set('state', state);
+        authorize.searchParams.set('code_challenge', challenge);
+        authorize.searchParams.set('code_challenge_method', 'S256');
+        return redirectTo(authorize.toString(), [cookieLine(txnCookie, await seal(txn, options.cookieSecret), TXN_TTL_S)]);
+    }
+    async function handleCallback(request) {
+        const url = new URL(request.url);
+        const rawTxn = readCookie(request, txnCookie);
+        const txn = rawTxn ? await open(rawTxn, options.cookieSecret) : null;
+        const state = url.searchParams.get('state') ?? '';
+        if (!txn || txn.v !== 1 || txn.exp <= nowS() || !state || state !== txn.state) {
+            return jsonResponse({ error: 'state_mismatch', error_description: 'The sign-in transaction is missing, expired, or does not match this callback.' }, 400, [clearLine(txnCookie)]);
+        }
+        const returnTo = safeReturnTo(txn.returnTo);
+        const oauthError = url.searchParams.get('error');
+        if (oauthError) {
+            const target = new URL(returnTo, 'http://local');
+            target.searchParams.set('beeuni_auth_error', oauthError);
+            return redirectTo(`${target.pathname}${target.search}`, [clearLine(txnCookie)]);
+        }
+        const code = url.searchParams.get('code') ?? '';
+        if (!code)
+            return jsonResponse({ error: 'invalid_callback', error_description: 'Missing code' }, 400, [clearLine(txnCookie)]);
+        const exchanged = await tokenRequest({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: options.redirectUri,
+            code_verifier: txn.verifier,
+        });
+        if (!exchanged.ok) {
+            return jsonResponse({ error: 'token_exchange_failed', upstream_error: exchanged.error, error_description: exchanged.description ?? null }, exchanged.status === 502 ? 502 : 400, [clearLine(txnCookie)]);
+        }
+        return redirectTo(returnTo, [await sessionCookieLine(exchanged.session), clearLine(txnCookie)]);
+    }
+    async function handleRefresh(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const session = await readSession(request);
+        if (!session)
+            return redirectTo(signInUrl(returnTo), [clearLine(sessionCookie)]);
+        if (isLive(session))
+            return redirectTo(returnTo);
+        const refreshed = await tokenRequest({ grant_type: 'refresh_token', refresh_token: session.rt });
+        if (!refreshed.ok)
+            return redirectTo(signInUrl(returnTo), [clearLine(sessionCookie)]);
+        return redirectTo(returnTo, [await sessionCookieLine(refreshed.session)]);
+    }
+    async function handleSignOut(request) {
+        const url = new URL(request.url);
+        const returnTo = safeReturnTo(url.searchParams.get('return_to'));
+        const session = await readSession(request);
+        if (session)
+            await revoke(session.rt);
+        return redirectTo(returnTo, [clearLine(sessionCookie), clearLine(txnCookie)]);
+    }
+    async function handleMe(request) {
+        const live = await liveSession(request);
+        if (!live)
+            return jsonResponse({ error: 'unauthenticated' }, 401, [clearLine(sessionCookie)]);
+        const id = await identity(live.session.at);
+        if (!id)
+            return jsonResponse({ error: 'unauthenticated' }, 401, [clearLine(sessionCookie)]);
+        const viewer = toViewer(live.session, id);
+        return jsonResponse({ user_id: viewer.userId, email: viewer.email, accounts: viewer.accounts, scopes: viewer.scopes, expires_at: new Date(viewer.expiresAt).toISOString() }, 200, live.setCookie ? [live.setCookie] : []);
+    }
+    async function handleProxy(request, rest) {
+        const live = await liveSession(request);
+        if (!live)
+            return jsonResponse({ error: 'unauthenticated', error_description: 'Sign in with Beeuni first.' }, 401);
+        const url = new URL(request.url);
+        const upstream = await forwardBeeuniRequest({
+            request,
+            upstreamUrl: `${backendUrl}/${rest.replace(/^\/+/, '')}${url.search}`,
+            token: live.session.at,
+            fetch: fetchImpl,
+        });
+        if (!live.setCookie)
+            return upstream;
+        const headers = new Headers(upstream.headers);
+        headers.append('set-cookie', live.setCookie);
+        return new Response(upstream.body, { status: upstream.status, headers });
+    }
+    async function handler(request) {
+        const url = new URL(request.url);
+        if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+            return jsonResponse({ error: 'not_found', error_description: `Not under ${basePath}` }, 404);
+        }
+        const sub = url.pathname.slice(basePath.length).replace(/^\/+/, '');
+        const [head, ...tail] = sub.split('/');
+        switch (head) {
+            case 'signin':
+                return handleSignIn(request);
+            case 'callback':
+                return handleCallback(request);
+            case 'refresh':
+                return handleRefresh(request);
+            case 'signout':
+                return handleSignOut(request);
+            case 'me':
+                return handleMe(request);
+            case 'proxy':
+                return handleProxy(request, tail.join('/'));
+            default:
+                return jsonResponse({ error: 'not_found' }, 404);
+        }
+    }
+    async function viewer(request) {
+        const session = await readSession(request);
+        if (!session || !isLive(session))
+            return null;
+        const id = await identity(session.at);
+        return id ? toViewer(session, id) : null;
+    }
+    async function requireViewer(request) {
+        const current = await viewer(request);
+        if (current)
+            return { viewer: current };
+        const returnTo = pathOf(request);
+        const session = await readSession(request);
+        if (session && !isLive(session))
+            return { response: redirectTo(refreshUrl(returnTo)) };
+        return { response: redirectTo(signInUrl(returnTo)) };
+    }
+    async function beeuni(request) {
+        const current = await viewer(request);
+        if (!current)
+            throw new BeeuniAuthError('unauthenticated', 'No signed-in Beeuni viewer on this request');
+        const token = current.token;
+        return createScopedBeeuni({ backendUrl, getToken: async () => token, fetch: fetchImpl });
+    }
+    return {
+        basePath,
+        handler,
+        viewer,
+        requireViewer,
+        beeuni,
+        signInUrl,
+        signOutUrl,
+        clientConfig(origin) {
+            const base = origin ?? (typeof window !== 'undefined' ? window.location.origin : '');
+            return { backendUrl: `${stripTrailingSlashes(base)}${basePath}/proxy`, getToken: async () => BEEUNI_SESSION_SENTINEL };
+        },
+        __setNow(next) {
+            now = next;
+        },
+    };
+}

package/dist/node/scoped-client.d.ts

@@ -0,0 +1,9 @@
+import { type Beeuni } from '../core/client/beeuni.js';
+import type { BeeuniPlatformConfig } from '../core/http/config.js';
+export declare function forwardBeeuniRequest(options: {
+    request: Request;
+    upstreamUrl: string;
+    token: string;
+    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+}): Promise<Response>;
+export declare function createScopedBeeuni(config: BeeuniPlatformConfig): Beeuni;

package/dist/node/scoped-client.js

@@ -0,0 +1,106 @@
+import { createBeeuni } from '../core/client/beeuni.js';
+import { runScoped } from '../platform/config-node.js';
+const MAX_WRAP_DEPTH = 12;
+export async function forwardBeeuniRequest(options) {
+    const { request, upstreamUrl, token } = options;
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    const headers = new Headers(request.headers);
+    headers.delete('host');
+    headers.delete('content-length');
+    headers.delete('cookie');
+    headers.set('authorization', `Bearer ${token}`);
+    headers.set('accept-encoding', 'identity');
+    const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
+    const body = hasBody ? await request.arrayBuffer() : undefined;
+    let upstreamResponse;
+    try {
+        upstreamResponse = await fetchImpl(upstreamUrl, {
+            method: request.method,
+            headers,
+            redirect: 'manual',
+            ...(body ? { body } : {}),
+        });
+    }
+    catch {
+        return Response.json({ error: 'Upstream request failed' }, { status: 502 });
+    }
+    const responseHeaders = new Headers(upstreamResponse.headers);
+    responseHeaders.delete('content-encoding');
+    responseHeaders.delete('content-length');
+    responseHeaders.delete('set-cookie');
+    return new Response(upstreamResponse.body, {
+        status: upstreamResponse.status,
+        headers: responseHeaders,
+    });
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function scopedAsyncGenerator(gen, config) {
+    const scoped = {
+        next: (...args) => runScoped(config, () => gen.next(...args)),
+        return: (value) => runScoped(config, () => gen.return(value)),
+        throw: (error) => runScoped(config, () => gen.throw(error)),
+        [Symbol.asyncIterator]: () => scoped,
+    };
+    return scoped;
+}
+function wrapScoped(value, config, seen, depth = 0) {
+    if (depth > MAX_WRAP_DEPTH)
+        return value;
+    if (typeof value === 'function') {
+        const fn = value;
+        const wrapped = (...args) => {
+            const result = runScoped(config, () => fn(...args));
+            if (result instanceof Promise) {
+                return result.then((resolved) => wrapScoped(resolved, config, new WeakSet(), 0));
+            }
+            return wrapScoped(result, config, new WeakSet(), 0);
+        };
+        return wrapped;
+    }
+    if (Object.prototype.toString.call(value) === '[object AsyncGenerator]') {
+        return scopedAsyncGenerator(value, config);
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            return value;
+        seen.add(value);
+        return value.map((item) => wrapScoped(item, config, seen, depth + 1));
+    }
+    if (isPlainObject(value)) {
+        if (seen.has(value))
+            return value;
+        seen.add(value);
+        const out = {};
+        for (const key of Object.keys(value)) {
+            const desc = Object.getOwnPropertyDescriptor(value, key);
+            if (desc.get) {
+                Object.defineProperty(out, key, {
+                    enumerable: true,
+                    get: () => wrapScoped(desc.get.call(value), config, new WeakSet(), 0),
+                });
+            }
+            else {
+                out[key] = wrapScoped(desc.value, config, seen, depth + 1);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+function scopedRuntimeUnavailable() {
+    throw new Error('beeuni.runtime() is not available on a @beeuni/sdk/server (scoped) client: it resolves the ' +
+        "process-global active runtime, which in a multi-tenant server is another request's sandbox. " +
+        "Reach a specific session's runtime via `const s = beeuni.session(projectId, sessionId); " +
+        'await s.ensureReady(); s.runtime`.');
+}
+export function createScopedBeeuni(config) {
+    const inner = createBeeuni(config, { global: false });
+    const scoped = wrapScoped(inner, config, new WeakSet());
+    scoped.runtime = scopedRuntimeUnavailable;
+    return scoped;
+}

package/dist/node/server.d.ts

@@ -0,0 +1,8 @@
+export { runWithBeeuni, getScopedConfig } from '../platform/config-node.js';
+export { createScopedBeeuni, forwardBeeuniRequest } from './scoped-client.js';
+export { createBeeuniAuth, BeeuniAuthError, BEEUNI_SESSION_SENTINEL, safeReturnTo, type BeeuniAuth, type BeeuniFetch, type BeeuniAuthOptions, type BeeuniViewer, type RequireViewerResult, } from './auth.js';
+export type { HeadlessAuthApi, AuthSession, AuthUser, AuthSessionResult, AuthRequestOptions } from '../core/rest/platform-client/auth.js';
+export type { BeeuniSession, BeeuniSessionOptions, BeeuniSessionStorage } from '../core/auth/session.js';
+export { createBeeuniAppGuard } from './app-guard.js';
+export type { BeeuniAppGuard, BeeuniAppGuardOptions, BeeuniAppGuardResult, BeeuniGuardedViewer, } from './app-guard.js';
+export { readAppViewer, createAppViewerBeeuni, AppViewerUnavailableError, APP_VIEWER_HEADER, APP_VIEWER_TOKEN_HEADER, APP_VIEWER_SECRET_ENV, type BeeuniAppViewer, type ReadAppViewerOptions, } from './app-viewer.js';

package/dist/node/server.js

@@ -0,0 +1,5 @@
+export { runWithBeeuni, getScopedConfig } from '../platform/config-node.js';
+export { createScopedBeeuni, forwardBeeuniRequest } from './scoped-client.js';
+export { createBeeuniAuth, BeeuniAuthError, BEEUNI_SESSION_SENTINEL, safeReturnTo, } from './auth.js';
+export { createBeeuniAppGuard } from './app-guard.js';
+export { readAppViewer, createAppViewerBeeuni, AppViewerUnavailableError, APP_VIEWER_HEADER, APP_VIEWER_TOKEN_HEADER, APP_VIEWER_SECRET_ENV, } from './app-viewer.js';

package/dist/platform/auth-core.d.ts

@@ -0,0 +1,10 @@
+export interface TokenRetryOptions {
+    attempts?: number;
+    baseDelayMs?: number;
+    invalidateBetweenAttempts?: boolean;
+}
+export declare function withTokenRetry(getToken: () => Promise<string | null>, options?: TokenRetryOptions, onInvalidate?: () => void): Promise<string | null>;
+export declare const DEFAULT_FETCH_TIMEOUT_MS = 120000;
+export declare function isStreamingRequest(input: RequestInfo | URL): boolean;
+export declare function withDefaultTimeout(input: RequestInfo | URL, init: RequestInit | undefined, timeoutMs?: number): AbortSignal | undefined;
+export declare function syntheticUnauthenticatedResponse(): Response;

package/dist/platform/auth-core.js

@@ -0,0 +1,44 @@
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function withTokenRetry(getToken, options, onInvalidate) {
+    const attempts = Math.max(1, options?.attempts ?? 1);
+    const baseDelayMs = options?.baseDelayMs ?? 0;
+    const invalidateBetweenAttempts = options?.invalidateBetweenAttempts ?? false;
+    let token = null;
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        if (attempt > 0) {
+            if (invalidateBetweenAttempts)
+                onInvalidate?.();
+            if (baseDelayMs > 0)
+                await delay(baseDelayMs);
+        }
+        token = await getToken();
+        if (token)
+            return token;
+    }
+    return token;
+}
+export const DEFAULT_FETCH_TIMEOUT_MS = 120_000;
+export function isStreamingRequest(input) {
+    const url = input instanceof Request ? input.url : String(input);
+    return url.includes('/global/event');
+}
+export function withDefaultTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    const callerSignal = input instanceof Request ? input.signal : init?.signal;
+    if (isStreamingRequest(input))
+        return callerSignal ?? undefined;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    if (!callerSignal)
+        return timeoutSignal;
+    if (typeof AbortSignal.any === 'function') {
+        return AbortSignal.any([callerSignal, timeoutSignal]);
+    }
+    return callerSignal;
+}
+export function syntheticUnauthenticatedResponse() {
+    return new Response(JSON.stringify({ error: 'Not authenticated' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}

package/dist/platform/config-node.d.ts

@@ -0,0 +1,4 @@
+import { type BeeuniPlatformConfig } from '../core/http/config.js';
+export declare function runScoped<T>(config: BeeuniPlatformConfig, fn: () => T): T;
+export declare function runWithBeeuni<T>(config: BeeuniPlatformConfig, fn: () => Promise<T>): Promise<T>;
+export declare function getScopedConfig(): BeeuniPlatformConfig | undefined;

package/dist/platform/config-node.js

@@ -0,0 +1,13 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { __setConfigResolver } from '../core/http/config.js';
+const als = new AsyncLocalStorage();
+__setConfigResolver(() => als.getStore());
+export function runScoped(config, fn) {
+    return als.run(config, fn);
+}
+export async function runWithBeeuni(config, fn) {
+    return runScoped(config, fn);
+}
+export function getScopedConfig() {
+    return als.getStore();
+}

package/dist/platform/session-id.d.ts

@@ -0,0 +1 @@
+export declare function generateSessionId(): string;

package/dist/platform/session-id.js

@@ -0,0 +1,15 @@
+export function generateSessionId() {
+    const c = typeof crypto !== 'undefined' ? crypto : undefined;
+    if (c?.randomUUID)
+        return c.randomUUID();
+    const b = new Uint8Array(16);
+    if (c?.getRandomValues)
+        c.getRandomValues(b);
+    else
+        for (let i = 0; i < 16; i++)
+            b[i] = Math.floor(Math.random() * 256);
+    b[6] = (b[6] & 0x0f) | 0x40;
+    b[8] = (b[8] & 0x3f) | 0x80;
+    const h = [...b].map((x) => x.toString(16).padStart(2, '0'));
+    return `${h[0]}${h[1]}${h[2]}${h[3]}-${h[4]}${h[5]}-${h[6]}${h[7]}-${h[8]}${h[9]}-${h.slice(10).join('')}`;
+}

package/dist/platform/storage/managed-storage.d.ts

@@ -0,0 +1,25 @@
+import { type StateStorage } from 'zustand/middleware';
+export declare function registerDisposableFamily(prefix: string): void;
+export declare function registerDisposableKey(key: string): void;
+export declare function safeSetItem(key: string, value: string): boolean;
+export declare function safeGetItem(key: string): string | null;
+export declare function safeRemoveItem(key: string): void;
+export declare function safeSessionGetItem(key: string): string | null;
+export declare function safeSessionSetItem(key: string, value: string): boolean;
+export declare function safeSessionRemoveItem(key: string): void;
+export declare class ScopedCache<T> {
+    private readonly family;
+    private readonly maxScopes;
+    constructor(family: string, maxScopes: number);
+    private keyFor;
+    get(scope: string): T | undefined;
+    set(scope: string, value: T): void;
+    remove(scope: string): void;
+    prune(): void;
+}
+export declare function pruneDisposableCaches(caches: ReadonlyArray<ScopedCache<unknown>>): void;
+export declare function pruneAllRegisteredCaches(): void;
+export declare const safeLocalStorage: StateStorage;
+export declare function createSafeJSONStorage<S>(): import("zustand/middleware").PersistStorage<S, unknown> | undefined;
+export declare const safeSessionStorage: StateStorage;
+export declare function createSafeSessionJSONStorage<S>(): import("zustand/middleware").PersistStorage<S, unknown> | undefined;