@blinkdotnew/sdk 0.14.0 → 0.14.2

package/dist/index.d.mts

@@ -733,6 +733,7 @@ declare class HttpClient {
 /**
  * Blink Auth Module - Client-side authentication management
  * Handles token storage, user state, and authentication flows
+ * Includes iframe token relay support for seamless preview authentication
  */
 
 type AuthStateChangeCallback = (state: AuthState) => void;
@@ -741,7 +742,18 @@ declare class BlinkAuth {
     private authState;
     private listeners;
     private readonly authUrl;
+    private parentWindowTokens;
+    private isIframe;
+    private tokenRequestSent;
     constructor(config: BlinkClientConfig);
+    /**
+     * Setup listener for tokens from parent window (iframe only)
+     */
+    private setupParentWindowListener;
+    /**
+     * Request tokens from parent window
+     */
+    private requestTokensFromParent;
     /**
      * Initialize authentication from stored tokens or URL fragments
      */

package/dist/index.d.ts

@@ -733,6 +733,7 @@ declare class HttpClient {
 /**
  * Blink Auth Module - Client-side authentication management
  * Handles token storage, user state, and authentication flows
+ * Includes iframe token relay support for seamless preview authentication
  */
 
 type AuthStateChangeCallback = (state: AuthState) => void;
@@ -741,7 +742,18 @@ declare class BlinkAuth {
     private authState;
     private listeners;
     private readonly authUrl;
+    private parentWindowTokens;
+    private isIframe;
+    private tokenRequestSent;
     constructor(config: BlinkClientConfig);
+    /**
+     * Setup listener for tokens from parent window (iframe only)
+     */
+    private setupParentWindowListener;
+    /**
+     * Request tokens from parent window
+     */
+    private requestTokensFromParent;
     /**
      * Initialize authentication from stored tokens or URL fragments
      */

package/dist/index.js

@@ -867,6 +867,9 @@ var BlinkAuth = class {
   authState;
   listeners = /* @__PURE__ */ new Set();
   authUrl = "https://blink.new";
+  parentWindowTokens = null;
+  isIframe = false;
+  tokenRequestSent = false;
   constructor(config) {
     this.config = config;
     this.authState = {
@@ -876,9 +879,80 @@ var BlinkAuth = class {
       isLoading: false
     };
     if (typeof window !== "undefined") {
+      this.isIframe = window.self !== window.top;
+      if (this.isIframe) {
+        console.log("\u{1F5BC}\uFE0F Detected iframe environment, setting up parent window communication");
+        this.setupParentWindowListener();
+      }
       this.initialize();
     }
   }
+  /**
+   * Setup listener for tokens from parent window (iframe only)
+   */
+  setupParentWindowListener() {
+    if (!this.isIframe) return;
+    window.addEventListener("message", (event) => {
+      const trustedOrigins = [
+        "https://blink.new",
+        "http://localhost:3000",
+        "http://localhost:3001",
+        "https://localhost:3000",
+        "https://localhost:3001"
+      ];
+      if (!trustedOrigins.includes(event.origin)) {
+        return;
+      }
+      if (event.data?.type === "BLINK_AUTH_TOKENS") {
+        console.log("\u{1F4E5} Received auth tokens from parent window", {
+          hasTokens: !!event.data.tokens,
+          projectId: event.data.projectId
+        });
+        const { tokens, projectId } = event.data;
+        if (projectId && projectId !== this.config.projectId) {
+          console.log("\u26A0\uFE0F Ignoring tokens for different project:", projectId);
+          return;
+        }
+        if (tokens) {
+          this.parentWindowTokens = tokens;
+          this.setTokens(tokens, false).then(() => {
+            console.log("\u2705 Tokens from parent window applied successfully");
+          }).catch((error) => {
+            console.error("\u274C Failed to apply parent window tokens:", error);
+          });
+        }
+      }
+      if (event.data?.type === "BLINK_AUTH_LOGOUT") {
+        console.log("\u{1F4E4} Received logout command from parent window");
+        this.clearTokens();
+      }
+      if (event.data?.type === "BLINK_AUTH_REFRESH") {
+        console.log("\u{1F504} Received token refresh from parent window");
+        const { tokens } = event.data;
+        if (tokens) {
+          this.parentWindowTokens = tokens;
+          this.setTokens(tokens, false).catch((error) => {
+            console.error("\u274C Failed to apply refreshed tokens:", error);
+          });
+        }
+      }
+    });
+    this.requestTokensFromParent();
+  }
+  /**
+   * Request tokens from parent window
+   */
+  requestTokensFromParent() {
+    if (!this.isIframe || this.tokenRequestSent) return;
+    if (window.parent !== window) {
+      console.log("\u{1F504} Requesting auth tokens from parent window");
+      window.parent.postMessage({
+        type: "BLINK_REQUEST_AUTH_TOKENS",
+        projectId: this.config.projectId
+      }, "*");
+      this.tokenRequestSent = true;
+    }
+  }
   /**
    * Initialize authentication from stored tokens or URL fragments
    */
@@ -886,6 +960,18 @@ var BlinkAuth = class {
     console.log("\u{1F680} Initializing Blink Auth...");
     this.setLoading(true);
     try {
+      if (this.isIframe) {
+        console.log("\u{1F50D} Detected iframe environment, waiting for parent tokens...");
+        for (let i = 0; i < 10; i++) {
+          if (this.parentWindowTokens) {
+            console.log("\u2705 Using tokens from parent window");
+            await this.setTokens(this.parentWindowTokens, false);
+            return;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        console.log("\u23F0 Timeout waiting for parent tokens, continuing with normal flow...");
+      }
       const tokensFromUrl = this.extractTokensFromUrl();
       if (tokensFromUrl) {
         console.log("\u{1F4E5} Found tokens in URL, setting them...");
@@ -917,6 +1003,14 @@ var BlinkAuth = class {
       }
       console.log("\u274C No tokens found");
       if (this.config.authRequired) {
+        if (this.isIframe && !this.tokenRequestSent) {
+          this.requestTokensFromParent();
+          await new Promise((resolve) => setTimeout(resolve, 500));
+          if (this.parentWindowTokens) {
+            await this.setTokens(this.parentWindowTokens, false);
+            return;
+          }
+        }
         console.log("\u{1F504} Auth required, redirecting to auth page...");
         this.redirectToAuth();
       } else {
@@ -930,7 +1024,17 @@ var BlinkAuth = class {
    * Redirect to Blink auth page
    */
   login(nextUrl) {
-    const redirectUrl = nextUrl || (typeof window !== "undefined" ? window.location.href : "");
+    let redirectUrl = nextUrl || (typeof window !== "undefined" ? window.location.href : "");
+    if (redirectUrl && typeof window !== "undefined") {
+      try {
+        const url = new URL(redirectUrl);
+        url.searchParams.delete("redirect_url");
+        url.searchParams.delete("redirect");
+        redirectUrl = url.toString();
+      } catch (e) {
+        console.warn("Failed to parse redirect URL:", e);
+      }
+    }
     const authUrl = new URL("/auth", this.authUrl);
     authUrl.searchParams.set("redirect_url", redirectUrl);
     if (this.config.projectId) {
@@ -945,6 +1049,12 @@ var BlinkAuth = class {
    */
   logout(redirectUrl) {
     this.clearTokens();
+    if (this.isIframe && window.parent !== window) {
+      window.parent.postMessage({
+        type: "BLINK_AUTH_LOGOUT_IFRAME",
+        projectId: this.config.projectId
+      }, "*");
+    }
     if (redirectUrl && typeof window !== "undefined") {
       window.location.href = redirectUrl;
     }
@@ -1163,7 +1273,7 @@ var BlinkAuth = class {
         token_type: data.token_type,
         expires_in: data.expires_in,
         refresh_expires_in: data.refresh_expires_in
-      }, true);
+      }, !this.isIframe);
       return true;
     } catch (error) {
       console.error("Token refresh failed:", error);
@@ -1240,7 +1350,7 @@ var BlinkAuth = class {
         return false;
       }
     } catch (error) {
-      console.log("\u{1F4A5} Error validating tokens:", error);
+      console.log("\uFFFD\uFFFD Error validating tokens:", error);
       return false;
     }
   }
@@ -1254,11 +1364,19 @@ var BlinkAuth = class {
       hasAccessToken: !!tokensWithTimestamp.access_token,
       hasRefreshToken: !!tokensWithTimestamp.refresh_token,
       expiresIn: tokensWithTimestamp.expires_in,
-      issuedAt: tokensWithTimestamp.issued_at
+      issuedAt: tokensWithTimestamp.issued_at,
+      isIframe: this.isIframe
     });
-    if (persist && typeof window !== "undefined") {
-      localStorage.setItem("blink_tokens", JSON.stringify(tokensWithTimestamp));
-      console.log("\u{1F4BE} Tokens persisted to localStorage");
+    if (persist && !this.isIframe && typeof window !== "undefined") {
+      try {
+        localStorage.setItem("blink_tokens", JSON.stringify(tokensWithTimestamp));
+        console.log("\u{1F4BE} Tokens persisted to localStorage");
+      } catch (error) {
+        console.log("\u{1F4A5} Error persisting tokens to localStorage:", error);
+        if (error instanceof DOMException && error.name === "SecurityError") {
+          console.log("\u{1F6AB} localStorage access blocked - running in cross-origin iframe");
+        }
+      }
     }
     let user = null;
     try {
@@ -1300,8 +1418,13 @@ var BlinkAuth = class {
     });
   }
   clearTokens() {
+    this.parentWindowTokens = null;
     if (typeof window !== "undefined") {
-      localStorage.removeItem("blink_tokens");
+      try {
+        localStorage.removeItem("blink_tokens");
+      } catch (error) {
+        console.log("\u{1F4A5} Error clearing tokens from localStorage:", error);
+      }
     }
     this.updateAuthState({
       user: null,
@@ -1312,11 +1435,17 @@ var BlinkAuth = class {
   }
   getStoredTokens() {
     if (typeof window === "undefined") return null;
+    if (this.isIframe && this.parentWindowTokens) {
+      console.log("\u{1F4E6} Using parent window tokens");
+      return this.parentWindowTokens;
+    }
     try {
       const stored = localStorage.getItem("blink_tokens");
       console.log("\u{1F50D} Checking localStorage for tokens:", {
         hasStoredData: !!stored,
-        storedLength: stored?.length || 0
+        storedLength: stored?.length || 0,
+        origin: window.location.origin,
+        isIframe: this.isIframe
       });
       if (stored) {
         const tokens = JSON.parse(stored);
@@ -1330,8 +1459,10 @@ var BlinkAuth = class {
       }
       return null;
     } catch (error) {
-      console.log("\u{1F4A5} Error parsing stored tokens:", error);
-      localStorage.removeItem("blink_tokens");
+      console.log("\u{1F4A5} Error accessing localStorage:", error);
+      if (error instanceof DOMException && error.name === "SecurityError") {
+        console.log("\u{1F6AB} localStorage access blocked - likely due to cross-origin iframe restrictions");
+      }
       return null;
     }
   }

package/dist/index.mjs

@@ -865,6 +865,9 @@ var BlinkAuth = class {
   authState;
   listeners = /* @__PURE__ */ new Set();
   authUrl = "https://blink.new";
+  parentWindowTokens = null;
+  isIframe = false;
+  tokenRequestSent = false;
   constructor(config) {
     this.config = config;
     this.authState = {
@@ -874,9 +877,80 @@ var BlinkAuth = class {
       isLoading: false
     };
     if (typeof window !== "undefined") {
+      this.isIframe = window.self !== window.top;
+      if (this.isIframe) {
+        console.log("\u{1F5BC}\uFE0F Detected iframe environment, setting up parent window communication");
+        this.setupParentWindowListener();
+      }
       this.initialize();
     }
   }
+  /**
+   * Setup listener for tokens from parent window (iframe only)
+   */
+  setupParentWindowListener() {
+    if (!this.isIframe) return;
+    window.addEventListener("message", (event) => {
+      const trustedOrigins = [
+        "https://blink.new",
+        "http://localhost:3000",
+        "http://localhost:3001",
+        "https://localhost:3000",
+        "https://localhost:3001"
+      ];
+      if (!trustedOrigins.includes(event.origin)) {
+        return;
+      }
+      if (event.data?.type === "BLINK_AUTH_TOKENS") {
+        console.log("\u{1F4E5} Received auth tokens from parent window", {
+          hasTokens: !!event.data.tokens,
+          projectId: event.data.projectId
+        });
+        const { tokens, projectId } = event.data;
+        if (projectId && projectId !== this.config.projectId) {
+          console.log("\u26A0\uFE0F Ignoring tokens for different project:", projectId);
+          return;
+        }
+        if (tokens) {
+          this.parentWindowTokens = tokens;
+          this.setTokens(tokens, false).then(() => {
+            console.log("\u2705 Tokens from parent window applied successfully");
+          }).catch((error) => {
+            console.error("\u274C Failed to apply parent window tokens:", error);
+          });
+        }
+      }
+      if (event.data?.type === "BLINK_AUTH_LOGOUT") {
+        console.log("\u{1F4E4} Received logout command from parent window");
+        this.clearTokens();
+      }
+      if (event.data?.type === "BLINK_AUTH_REFRESH") {
+        console.log("\u{1F504} Received token refresh from parent window");
+        const { tokens } = event.data;
+        if (tokens) {
+          this.parentWindowTokens = tokens;
+          this.setTokens(tokens, false).catch((error) => {
+            console.error("\u274C Failed to apply refreshed tokens:", error);
+          });
+        }
+      }
+    });
+    this.requestTokensFromParent();
+  }
+  /**
+   * Request tokens from parent window
+   */
+  requestTokensFromParent() {
+    if (!this.isIframe || this.tokenRequestSent) return;
+    if (window.parent !== window) {
+      console.log("\u{1F504} Requesting auth tokens from parent window");
+      window.parent.postMessage({
+        type: "BLINK_REQUEST_AUTH_TOKENS",
+        projectId: this.config.projectId
+      }, "*");
+      this.tokenRequestSent = true;
+    }
+  }
   /**
    * Initialize authentication from stored tokens or URL fragments
    */
@@ -884,6 +958,18 @@ var BlinkAuth = class {
     console.log("\u{1F680} Initializing Blink Auth...");
     this.setLoading(true);
     try {
+      if (this.isIframe) {
+        console.log("\u{1F50D} Detected iframe environment, waiting for parent tokens...");
+        for (let i = 0; i < 10; i++) {
+          if (this.parentWindowTokens) {
+            console.log("\u2705 Using tokens from parent window");
+            await this.setTokens(this.parentWindowTokens, false);
+            return;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        console.log("\u23F0 Timeout waiting for parent tokens, continuing with normal flow...");
+      }
       const tokensFromUrl = this.extractTokensFromUrl();
       if (tokensFromUrl) {
         console.log("\u{1F4E5} Found tokens in URL, setting them...");
@@ -915,6 +1001,14 @@ var BlinkAuth = class {
       }
       console.log("\u274C No tokens found");
       if (this.config.authRequired) {
+        if (this.isIframe && !this.tokenRequestSent) {
+          this.requestTokensFromParent();
+          await new Promise((resolve) => setTimeout(resolve, 500));
+          if (this.parentWindowTokens) {
+            await this.setTokens(this.parentWindowTokens, false);
+            return;
+          }
+        }
         console.log("\u{1F504} Auth required, redirecting to auth page...");
         this.redirectToAuth();
       } else {
@@ -928,7 +1022,17 @@ var BlinkAuth = class {
    * Redirect to Blink auth page
    */
   login(nextUrl) {
-    const redirectUrl = nextUrl || (typeof window !== "undefined" ? window.location.href : "");
+    let redirectUrl = nextUrl || (typeof window !== "undefined" ? window.location.href : "");
+    if (redirectUrl && typeof window !== "undefined") {
+      try {
+        const url = new URL(redirectUrl);
+        url.searchParams.delete("redirect_url");
+        url.searchParams.delete("redirect");
+        redirectUrl = url.toString();
+      } catch (e) {
+        console.warn("Failed to parse redirect URL:", e);
+      }
+    }
     const authUrl = new URL("/auth", this.authUrl);
     authUrl.searchParams.set("redirect_url", redirectUrl);
     if (this.config.projectId) {
@@ -943,6 +1047,12 @@ var BlinkAuth = class {
    */
   logout(redirectUrl) {
     this.clearTokens();
+    if (this.isIframe && window.parent !== window) {
+      window.parent.postMessage({
+        type: "BLINK_AUTH_LOGOUT_IFRAME",
+        projectId: this.config.projectId
+      }, "*");
+    }
     if (redirectUrl && typeof window !== "undefined") {
       window.location.href = redirectUrl;
     }
@@ -1161,7 +1271,7 @@ var BlinkAuth = class {
         token_type: data.token_type,
         expires_in: data.expires_in,
         refresh_expires_in: data.refresh_expires_in
-      }, true);
+      }, !this.isIframe);
       return true;
     } catch (error) {
       console.error("Token refresh failed:", error);
@@ -1238,7 +1348,7 @@ var BlinkAuth = class {
         return false;
       }
     } catch (error) {
-      console.log("\u{1F4A5} Error validating tokens:", error);
+      console.log("\uFFFD\uFFFD Error validating tokens:", error);
       return false;
     }
   }
@@ -1252,11 +1362,19 @@ var BlinkAuth = class {
       hasAccessToken: !!tokensWithTimestamp.access_token,
       hasRefreshToken: !!tokensWithTimestamp.refresh_token,
       expiresIn: tokensWithTimestamp.expires_in,
-      issuedAt: tokensWithTimestamp.issued_at
+      issuedAt: tokensWithTimestamp.issued_at,
+      isIframe: this.isIframe
     });
-    if (persist && typeof window !== "undefined") {
-      localStorage.setItem("blink_tokens", JSON.stringify(tokensWithTimestamp));
-      console.log("\u{1F4BE} Tokens persisted to localStorage");
+    if (persist && !this.isIframe && typeof window !== "undefined") {
+      try {
+        localStorage.setItem("blink_tokens", JSON.stringify(tokensWithTimestamp));
+        console.log("\u{1F4BE} Tokens persisted to localStorage");
+      } catch (error) {
+        console.log("\u{1F4A5} Error persisting tokens to localStorage:", error);
+        if (error instanceof DOMException && error.name === "SecurityError") {
+          console.log("\u{1F6AB} localStorage access blocked - running in cross-origin iframe");
+        }
+      }
     }
     let user = null;
     try {
@@ -1298,8 +1416,13 @@ var BlinkAuth = class {
     });
   }
   clearTokens() {
+    this.parentWindowTokens = null;
     if (typeof window !== "undefined") {
-      localStorage.removeItem("blink_tokens");
+      try {
+        localStorage.removeItem("blink_tokens");
+      } catch (error) {
+        console.log("\u{1F4A5} Error clearing tokens from localStorage:", error);
+      }
     }
     this.updateAuthState({
       user: null,
@@ -1310,11 +1433,17 @@ var BlinkAuth = class {
   }
   getStoredTokens() {
     if (typeof window === "undefined") return null;
+    if (this.isIframe && this.parentWindowTokens) {
+      console.log("\u{1F4E6} Using parent window tokens");
+      return this.parentWindowTokens;
+    }
     try {
       const stored = localStorage.getItem("blink_tokens");
       console.log("\u{1F50D} Checking localStorage for tokens:", {
         hasStoredData: !!stored,
-        storedLength: stored?.length || 0
+        storedLength: stored?.length || 0,
+        origin: window.location.origin,
+        isIframe: this.isIframe
       });
       if (stored) {
         const tokens = JSON.parse(stored);
@@ -1328,8 +1457,10 @@ var BlinkAuth = class {
       }
       return null;
     } catch (error) {
-      console.log("\u{1F4A5} Error parsing stored tokens:", error);
-      localStorage.removeItem("blink_tokens");
+      console.log("\u{1F4A5} Error accessing localStorage:", error);
+      if (error instanceof DOMException && error.name === "SecurityError") {
+        console.log("\u{1F6AB} localStorage access blocked - likely due to cross-origin iframe restrictions");
+      }
       return null;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blinkdotnew/sdk",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Blink TypeScript SDK for client-side applications - Zero-boilerplate CRUD + auth + AI + analytics + notifications for modern SaaS/AI apps",
   "keywords": [
     "blink",