@buildspacestudio/sdk 0.2.2 → 0.3.0

package/dist/auth/index.cjs

@@ -0,0 +1,259 @@
+'use strict';
+
+// src/auth/client.ts
+var AuthClientNamespace = class {
+  transport;
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /**
+   * Build a URL that redirects the user to the Buildspace sign-in page.
+   *
+   * After the user authenticates, they are redirected back to `redirectUri`
+   * with a `?code=` parameter that can be exchanged for tokens via
+   * `buildspace.auth.handleCallback()` on the server.
+   *
+   * @param opts - Sign-in URL options.
+   * @returns The full sign-in URL as a string.
+   */
+  getSignInUrl(opts) {
+    const url = new URL("/sign-in", this.transport.loginUrl);
+    if (opts.appSlug) {
+      url.searchParams.set("app", opts.appSlug);
+    }
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    url.searchParams.set("client_id", this.transport.key);
+    if (opts.env) {
+      url.searchParams.set("env", opts.env);
+    }
+    return url.toString();
+  }
+  /**
+   * Build a URL that redirects the user to the Buildspace sign-up page.
+   *
+   * Works identically to {@link getSignInUrl} but directs the user to the
+   * registration flow instead.
+   *
+   * @param opts - Sign-up URL options.
+   * @returns The full sign-up URL as a string.
+   */
+  getSignUpUrl(opts) {
+    const url = new URL("/sign-up", this.transport.loginUrl);
+    if (opts.appSlug) {
+      url.searchParams.set("app", opts.appSlug);
+    }
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    url.searchParams.set("client_id", this.transport.key);
+    if (opts.env) {
+      url.searchParams.set("env", opts.env);
+    }
+    return url.toString();
+  }
+};
+
+// src/errors.ts
+var BuildspaceError = class extends Error {
+  /** Machine-readable error code, e.g. `"auth/invalid-token"`. */
+  code;
+  /** Which service produced the error. */
+  service;
+  /** HTTP status code from the API. */
+  status;
+  constructor({
+    code,
+    message,
+    service,
+    status
+  }) {
+    super(message);
+    this.name = "BuildspaceError";
+    this.code = code;
+    this.service = service;
+    this.status = status;
+  }
+};
+
+// src/auth/server.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0.0.0.0"]);
+var FORWARDED_HOST_RE = /host="?([^;"]+)"?/i;
+var FORWARDED_PROTO_RE = /proto="?([^;"]+)"?/i;
+function getFirstForwardedValue(value) {
+  if (!value) {
+    return null;
+  }
+  return value.split(",").map((part) => part.trim()).find(Boolean) ?? null;
+}
+function stripPort(host) {
+  if (host.startsWith("[") && host.includes("]")) {
+    return host.slice(1, host.indexOf("]"));
+  }
+  const colonIndex = host.indexOf(":");
+  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;
+}
+function isPrivateIpv4(hostname) {
+  const parts = hostname.split(".").map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {
+    return false;
+  }
+  return parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168;
+}
+function isInternalHostname(hostname) {
+  const normalized = hostname.toLowerCase();
+  return LOOPBACK_HOSTS.has(normalized) || normalized.endsWith(".local") || normalized.endsWith(".internal") || isPrivateIpv4(normalized);
+}
+function getForwardedOrigin(request) {
+  const forwarded = getFirstForwardedValue(request.headers.get("forwarded"));
+  if (forwarded) {
+    const forwardedHost2 = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();
+    const forwardedProto2 = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();
+    if (forwardedHost2 && forwardedProto2) {
+      return `${forwardedProto2}://${forwardedHost2}`;
+    }
+  }
+  const forwardedHost = getFirstForwardedValue(request.headers.get("x-forwarded-host"));
+  const forwardedProto = getFirstForwardedValue(request.headers.get("x-forwarded-proto"));
+  if (forwardedHost && forwardedProto) {
+    return `${forwardedProto}://${forwardedHost}`;
+  }
+  return null;
+}
+function resolveDefaultRedirectUri(request, url) {
+  if (!(request instanceof Request)) {
+    return `${url.origin}${url.pathname}`;
+  }
+  const forwardedOrigin = getForwardedOrigin(request);
+  if (forwardedOrigin) {
+    return `${forwardedOrigin}${url.pathname}`;
+  }
+  const hostHeader = request.headers.get("host")?.trim();
+  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {
+    return `${url.protocol}//${hostHeader}${url.pathname}`;
+  }
+  if (!isInternalHostname(url.hostname)) {
+    return `${url.origin}${url.pathname}`;
+  }
+  return `${url.origin}${url.pathname}`;
+}
+var AuthServerNamespace = class {
+  transport;
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /**
+   * Retrieve the session associated with a token.
+   *
+   * Returns the {@link AuthSession} if valid, or `null` if the token is
+   * expired, revoked, or invalid (401/404).
+   *
+   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).
+   */
+  async getSession(sessionToken) {
+    try {
+      return await this.transport.request({
+        service: "auth",
+        path: "/v1/auth/session",
+        headers: { "X-Session-Token": sessionToken }
+      });
+    } catch (error) {
+      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {
+        return null;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Exchange an OAuth authorization code for tokens.
+   *
+   * Extracts the `code` query parameter from the callback URL and exchanges
+   * it with the Buildspace API for an access token and user info.
+   *
+   * @param request - The incoming callback request. Accepts a `Request` object,
+   *   a `URL`, or a raw URL string containing the `?code=` parameter.
+   * @param opts - Optional settings.
+   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.
+   *   Defaults to the origin + pathname of the callback URL.
+   * @returns The token response containing `access_token`, `expires_in`, and `user`.
+   *
+   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).
+   *
+   * @example
+   * ```ts
+   * // Next.js Route Handler
+   * export async function GET(request: Request) {
+   *   const { access_token, user } = await buildspace.auth.handleCallback(request);
+   *   // Store access_token as a session cookie
+   * }
+   * ```
+   */
+  handleCallback(request, opts) {
+    let url;
+    if (typeof request === "string") {
+      url = new URL(request);
+    } else if (request instanceof URL) {
+      url = request;
+    } else {
+      url = new URL(request.url);
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      throw new BuildspaceError({
+        service: "auth",
+        status: 400,
+        code: "auth/missing-code",
+        message: "No auth code found in callback URL. Expected ?code= parameter."
+      });
+    }
+    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);
+    return this.transport.request({
+      service: "auth",
+      path: "/v1/auth/token",
+      method: "POST",
+      body: {
+        code,
+        redirect_uri: redirectUri
+      }
+    });
+  }
+  /**
+   * Revoke a specific session token.
+   *
+   * @param sessionToken - The token to revoke.
+   * @throws {BuildspaceError} If the revocation fails.
+   */
+  async revokeSession(sessionToken) {
+    await this.transport.request({
+      service: "auth",
+      path: "/v1/auth/session",
+      method: "DELETE",
+      headers: { "X-Session-Token": sessionToken }
+    });
+  }
+  /**
+   * Sign the user out by revoking the session and clearing the SDK's stored token.
+   *
+   * If the session is already expired or not found, the error is silently
+   * ignored and the local session is still cleared.
+   *
+   * @param sessionToken - Token to revoke. If omitted, uses the token
+   *   previously set via `buildspace.setSession()`.
+   */
+  async signOut(sessionToken) {
+    const token = sessionToken ?? this.transport.getSessionToken();
+    try {
+      if (token) {
+        await this.revokeSession(token);
+      }
+    } catch (error) {
+      if (!(error instanceof BuildspaceError && error.service === "auth" && (error.status === 401 || error.status === 404))) {
+        throw error;
+      }
+    } finally {
+      this.transport.clearSession();
+    }
+  }
+};
+
+exports.AuthClientNamespace = AuthClientNamespace;
+exports.AuthServerNamespace = AuthServerNamespace;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/client.ts","../../src/errors.ts","../../src/auth/server.ts"],"names":["forwardedHost","forwardedProto"],"mappings":";;;AA0CO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AACF;;;ACpFO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA;AAAA,EAEhC,IAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY;AAAA,IACV,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAKG;AACD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;;;ACDA,IAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,SAAS,CAAC,CAAA;AAC3E,IAAM,iBAAA,GAAoB,oBAAA;AAC1B,IAAM,kBAAA,GAAqB,qBAAA;AAE3B,SAAS,uBAAuB,KAAA,EAAqC;AACnE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CACG,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA;AAExB;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,IAAI,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAK,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,OAAO,cAAc,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,GAAI,IAAA;AACvD;AAEA,SAAS,cAAc,QAAA,EAA2B;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,IAAA,GAAO,GAAG,CAAA,EAAG;AAC5F,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IACZ,MAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,KAAA,CAAM,CAAC,KAAK,EAAA,IAClD,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA;AAEtC;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,MAAM,UAAA,GAAa,SAAS,WAAA,EAAY;AAExC,EAAA,OACE,cAAA,CAAe,GAAA,CAAI,UAAU,CAAA,IAC7B,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,IAC5B,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,IAC/B,cAAc,UAAU,CAAA;AAE5B;AAEA,SAAS,mBAAmB,OAAA,EAAiC;AAC3D,EAAA,MAAM,YAAY,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAMA,iBAAgB,SAAA,CAAU,KAAA,CAAM,iBAAiB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AACpE,IAAA,MAAMC,kBAAiB,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AAEtE,IAAA,IAAID,kBAAiBC,eAAAA,EAAgB;AACnC,MAAA,OAAO,CAAA,EAAGA,eAAc,CAAA,GAAA,EAAMD,cAAa,CAAA,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA;AACpF,EAAA,MAAM,iBAAiB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAEtF,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO,CAAA,EAAG,cAAc,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,SAAiC,GAAA,EAAkB;AACpF,EAAA,IAAI,EAAE,mBAAmB,OAAA,CAAA,EAAU;AACjC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,eAAA,GAAkB,mBAAmB,OAAO,CAAA;AAClD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,eAAe,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAG,IAAA,EAAK;AACrD,EAAA,IAAI,cAAc,CAAC,kBAAA,CAAmB,SAAA,CAAU,UAAU,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAO,GAAG,GAAA,CAAI,QAAQ,KAAK,UAAU,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AACrC;AAuBO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAW,YAAA,EAAmD;AAClE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAqB;AAAA,QAC/C,OAAA,EAAS,MAAA;AAAA,QACT,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,KAAoB,KAAA,CAAM,WAAW,GAAA,IAAO,KAAA,CAAM,WAAW,GAAA,CAAA,EAAM;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,cAAA,CACE,SACA,IAAA,EACwB;AACxB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,GAAA,GAAM,IAAI,IAAI,OAAO,CAAA;AAAA,IACvB,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AACjC,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,EAAM,WAAA,IAAe,yBAAA,CAA0B,SAAS,GAAG,CAAA;AAE/E,IAAA,OAAO,IAAA,CAAK,UAAU,OAAA,CAAuB;AAAA,MAC3C,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,gBAAA;AAAA,MACN,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,YAAA,EAAc;AAAA;AAChB,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,YAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,UAAU,OAAA,CAAc;AAAA,MACjC,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,kBAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,KAC5C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,YAAA,EAAsC;AAClD,IAAA,MAAM,KAAA,GAAQ,YAAA,IAAgB,IAAA,CAAK,SAAA,CAAU,eAAA,EAAgB;AAE7D,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,MAChC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IACE,EACE,KAAA,YAAiB,eAAA,IACjB,KAAA,CAAM,OAAA,KAAY,MAAA,KACjB,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA,CAAA,CAAA,EAE5C;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,UAAU,YAAA,EAAa;AAAA,IAC9B;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { HttpTransport } from \"../http\";\n\n/** Options for generating a sign-in URL. */\nexport interface SignInUrlOptions {\n  /** App slug to scope the login to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after authentication completes. */\n  redirectUri: string;\n}\n\n/** Options for generating a sign-up URL. */\nexport interface SignUpUrlOptions {\n  /** App slug to scope the registration to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after registration completes. */\n  redirectUri: string;\n}\n\n/**\n * Client-side authentication methods for generating login URLs.\n *\n * Access via `buildspace.auth` on the client SDK, or `buildspace.authClient`\n * on the server SDK when you need to generate URLs from server-side code.\n *\n * @example\n * ```ts\n * import { createClient } from \"@buildspacestudio/sdk/client\";\n *\n * const buildspace = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_KEY!);\n *\n * const signInUrl = buildspace.auth.getSignInUrl({\n *   redirectUri: \"https://yourapp.com/auth/callback\",\n * });\n *\n * // Use in a link or redirect\n * window.location.href = signInUrl;\n * ```\n */\nexport class AuthClientNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-in page.\n   *\n   * After the user authenticates, they are redirected back to `redirectUri`\n   * with a `?code=` parameter that can be exchanged for tokens via\n   * `buildspace.auth.handleCallback()` on the server.\n   *\n   * @param opts - Sign-in URL options.\n   * @returns The full sign-in URL as a string.\n   */\n  getSignInUrl(opts: SignInUrlOptions): string {\n    const url = new URL(\"/sign-in\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-up page.\n   *\n   * Works identically to {@link getSignInUrl} but directs the user to the\n   * registration flow instead.\n   *\n   * @param opts - Sign-up URL options.\n   * @returns The full sign-up URL as a string.\n   */\n  getSignUpUrl(opts: SignUpUrlOptions): string {\n    const url = new URL(\"/sign-up\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n}\n","/** Services available in the Buildspace platform. */\nexport type BuildspaceService = \"auth\" | \"events\" | \"notifications\" | \"storage\";\n\n/**\n * Error thrown by all Buildspace SDK methods on failure.\n *\n * @example\n * ```ts\n * try {\n *   await buildspace.auth.getSession(token);\n * } catch (err) {\n *   if (err instanceof BuildspaceError) {\n *     console.error(err.service, err.code, err.status, err.message);\n *   }\n * }\n * ```\n */\nexport class BuildspaceError extends Error {\n  /** Machine-readable error code, e.g. `\"auth/invalid-token\"`. */\n  readonly code: string;\n  /** Which service produced the error. */\n  readonly service: BuildspaceService;\n  /** HTTP status code from the API. */\n  readonly status: number;\n\n  constructor({\n    code,\n    message,\n    service,\n    status,\n  }: {\n    code: string;\n    message: string;\n    service: BuildspaceService;\n    status: number;\n  }) {\n    super(message);\n    this.name = \"BuildspaceError\";\n    this.code = code;\n    this.service = service;\n    this.status = status;\n  }\n}\n","import { BuildspaceError } from \"../errors\";\nimport type { HttpTransport } from \"../http\";\n\n/** A Buildspace user returned from auth endpoints. */\nexport interface AuthUser {\n  /** The user's email address. */\n  email: string;\n  /** Unique user identifier. */\n  id: string;\n  /** The user's display name, or `null` if not set. */\n  name: string | null;\n}\n\n/**\n * An active session for an authenticated user.\n *\n * Returned by {@link AuthServerNamespace.getSession}.\n */\nexport interface AuthSession {\n  /** The app this session belongs to, or `null` for platform-level sessions. */\n  appId: string | null;\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\n/**\n * Token response returned after a successful OAuth callback exchange.\n *\n * Returned by {@link AuthServerNamespace.handleCallback}.\n */\nexport interface TokenResponse {\n  /** The access token to use for authenticated requests. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Always `\"bearer\"`. */\n  token_type: \"bearer\";\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\nconst LOOPBACK_HOSTS = new Set([\"127.0.0.1\", \"localhost\", \"::1\", \"0.0.0.0\"]);\nconst FORWARDED_HOST_RE = /host=\"?([^;\"]+)\"?/i;\nconst FORWARDED_PROTO_RE = /proto=\"?([^;\"]+)\"?/i;\n\nfunction getFirstForwardedValue(value: string | null): string | null {\n  if (!value) {\n    return null;\n  }\n\n  return (\n    value\n      .split(\",\")\n      .map((part) => part.trim())\n      .find(Boolean) ?? null\n  );\n}\n\nfunction stripPort(host: string): string {\n  if (host.startsWith(\"[\") && host.includes(\"]\")) {\n    return host.slice(1, host.indexOf(\"]\"));\n  }\n\n  const colonIndex = host.indexOf(\":\");\n  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\").map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {\n    return false;\n  }\n\n  return (\n    parts[0] === 10 ||\n    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||\n    (parts[0] === 192 && parts[1] === 168)\n  );\n}\n\nfunction isInternalHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n\n  return (\n    LOOPBACK_HOSTS.has(normalized) ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\") ||\n    isPrivateIpv4(normalized)\n  );\n}\n\nfunction getForwardedOrigin(request: Request): string | null {\n  const forwarded = getFirstForwardedValue(request.headers.get(\"forwarded\"));\n  if (forwarded) {\n    const forwardedHost = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();\n    const forwardedProto = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();\n\n    if (forwardedHost && forwardedProto) {\n      return `${forwardedProto}://${forwardedHost}`;\n    }\n  }\n\n  const forwardedHost = getFirstForwardedValue(request.headers.get(\"x-forwarded-host\"));\n  const forwardedProto = getFirstForwardedValue(request.headers.get(\"x-forwarded-proto\"));\n\n  if (forwardedHost && forwardedProto) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return null;\n}\n\nfunction resolveDefaultRedirectUri(request: Request | URL | string, url: URL): string {\n  if (!(request instanceof Request)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  const forwardedOrigin = getForwardedOrigin(request);\n  if (forwardedOrigin) {\n    return `${forwardedOrigin}${url.pathname}`;\n  }\n\n  const hostHeader = request.headers.get(\"host\")?.trim();\n  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {\n    return `${url.protocol}//${hostHeader}${url.pathname}`;\n  }\n\n  if (!isInternalHostname(url.hostname)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  return `${url.origin}${url.pathname}`;\n}\n\n/**\n * Server-side authentication methods.\n *\n * Access via `buildspace.auth` on the server SDK.\n *\n * @example\n * ```ts\n * import Buildspace from \"@buildspacestudio/sdk\";\n *\n * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);\n *\n * // Handle OAuth callback\n * const tokens = await buildspace.auth.handleCallback(request);\n *\n * // Verify a session\n * const session = await buildspace.auth.getSession(sessionToken);\n *\n * // Sign out\n * await buildspace.auth.signOut(sessionToken);\n * ```\n */\nexport class AuthServerNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Retrieve the session associated with a token.\n   *\n   * Returns the {@link AuthSession} if valid, or `null` if the token is\n   * expired, revoked, or invalid (401/404).\n   *\n   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).\n   */\n  async getSession(sessionToken: string): Promise<AuthSession | null> {\n    try {\n      return await this.transport.request<AuthSession>({\n        service: \"auth\",\n        path: \"/v1/auth/session\",\n        headers: { \"X-Session-Token\": sessionToken },\n      });\n    } catch (error) {\n      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange an OAuth authorization code for tokens.\n   *\n   * Extracts the `code` query parameter from the callback URL and exchanges\n   * it with the Buildspace API for an access token and user info.\n   *\n   * @param request - The incoming callback request. Accepts a `Request` object,\n   *   a `URL`, or a raw URL string containing the `?code=` parameter.\n   * @param opts - Optional settings.\n   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.\n   *   Defaults to the origin + pathname of the callback URL.\n   * @returns The token response containing `access_token`, `expires_in`, and `user`.\n   *\n   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).\n   *\n   * @example\n   * ```ts\n   * // Next.js Route Handler\n   * export async function GET(request: Request) {\n   *   const { access_token, user } = await buildspace.auth.handleCallback(request);\n   *   // Store access_token as a session cookie\n   * }\n   * ```\n   */\n  handleCallback(\n    request: Request | URL | string,\n    opts?: { redirectUri?: string }\n  ): Promise<TokenResponse> {\n    let url: URL;\n    if (typeof request === \"string\") {\n      url = new URL(request);\n    } else if (request instanceof URL) {\n      url = request;\n    } else {\n      url = new URL(request.url);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new BuildspaceError({\n        service: \"auth\",\n        status: 400,\n        code: \"auth/missing-code\",\n        message: \"No auth code found in callback URL. Expected ?code= parameter.\",\n      });\n    }\n\n    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);\n\n    return this.transport.request<TokenResponse>({\n      service: \"auth\",\n      path: \"/v1/auth/token\",\n      method: \"POST\",\n      body: {\n        code,\n        redirect_uri: redirectUri,\n      },\n    });\n  }\n\n  /**\n   * Revoke a specific session token.\n   *\n   * @param sessionToken - The token to revoke.\n   * @throws {BuildspaceError} If the revocation fails.\n   */\n  async revokeSession(sessionToken: string): Promise<void> {\n    await this.transport.request<void>({\n      service: \"auth\",\n      path: \"/v1/auth/session\",\n      method: \"DELETE\",\n      headers: { \"X-Session-Token\": sessionToken },\n    });\n  }\n\n  /**\n   * Sign the user out by revoking the session and clearing the SDK's stored token.\n   *\n   * If the session is already expired or not found, the error is silently\n   * ignored and the local session is still cleared.\n   *\n   * @param sessionToken - Token to revoke. If omitted, uses the token\n   *   previously set via `buildspace.setSession()`.\n   */\n  async signOut(sessionToken?: string): Promise<void> {\n    const token = sessionToken ?? this.transport.getSessionToken();\n\n    try {\n      if (token) {\n        await this.revokeSession(token);\n      }\n    } catch (error) {\n      if (\n        !(\n          error instanceof BuildspaceError &&\n          error.service === \"auth\" &&\n          (error.status === 401 || error.status === 404)\n        )\n      ) {\n        throw error;\n      }\n    } finally {\n      this.transport.clearSession();\n    }\n  }\n}\n"]}

package/dist/auth/{server.d.ts → index.d.cts}

@@ -1,6 +1,8 @@
-import type { HttpTransport } from "../http";
+export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-DqWXAwCr.cjs';
+import { H as HttpTransport } from '../http-U-zzKmFF.cjs';
+
 /** A Buildspace user returned from auth endpoints. */
-export interface AuthUser {
+interface AuthUser {
     /** The user's email address. */
     email: string;
     /** Unique user identifier. */
@@ -13,7 +15,7 @@ export interface AuthUser {
  *
  * Returned by {@link AuthServerNamespace.getSession}.
  */
-export interface AuthSession {
+interface AuthSession {
     /** The app this session belongs to, or `null` for platform-level sessions. */
     appId: string | null;
     /** The authenticated user. */
@@ -24,7 +26,7 @@ export interface AuthSession {
  *
  * Returned by {@link AuthServerNamespace.handleCallback}.
  */
-export interface TokenResponse {
+interface TokenResponse {
     /** The access token to use for authenticated requests. */
     access_token: string;
     /** Token lifetime in seconds. */
@@ -55,7 +57,7 @@ export interface TokenResponse {
  * await buildspace.auth.signOut(sessionToken);
  * ```
  */
-export declare class AuthServerNamespace {
+declare class AuthServerNamespace {
     private readonly transport;
     constructor(transport: HttpTransport);
     /**
@@ -112,4 +114,5 @@ export declare class AuthServerNamespace {
      */
     signOut(sessionToken?: string): Promise<void>;
 }
-//# sourceMappingURL=server.d.ts.map
+
+export { AuthServerNamespace, type AuthSession, type AuthUser, type TokenResponse };

package/dist/auth/index.d.ts

@@ -1,5 +1,118 @@
-export type { SignInUrlOptions, SignUpUrlOptions } from "./client";
-export { AuthClientNamespace } from "./client";
-export type { AuthSession, AuthUser, TokenResponse } from "./server";
-export { AuthServerNamespace } from "./server";
-//# sourceMappingURL=index.d.ts.map
+export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-BH7LbrKM.js';
+import { H as HttpTransport } from '../http-U-zzKmFF.js';
+
+/** A Buildspace user returned from auth endpoints. */
+interface AuthUser {
+    /** The user's email address. */
+    email: string;
+    /** Unique user identifier. */
+    id: string;
+    /** The user's display name, or `null` if not set. */
+    name: string | null;
+}
+/**
+ * An active session for an authenticated user.
+ *
+ * Returned by {@link AuthServerNamespace.getSession}.
+ */
+interface AuthSession {
+    /** The app this session belongs to, or `null` for platform-level sessions. */
+    appId: string | null;
+    /** The authenticated user. */
+    user: AuthUser;
+}
+/**
+ * Token response returned after a successful OAuth callback exchange.
+ *
+ * Returned by {@link AuthServerNamespace.handleCallback}.
+ */
+interface TokenResponse {
+    /** The access token to use for authenticated requests. */
+    access_token: string;
+    /** Token lifetime in seconds. */
+    expires_in: number;
+    /** Always `"bearer"`. */
+    token_type: "bearer";
+    /** The authenticated user. */
+    user: AuthUser;
+}
+/**
+ * Server-side authentication methods.
+ *
+ * Access via `buildspace.auth` on the server SDK.
+ *
+ * @example
+ * ```ts
+ * import Buildspace from "@buildspacestudio/sdk";
+ *
+ * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);
+ *
+ * // Handle OAuth callback
+ * const tokens = await buildspace.auth.handleCallback(request);
+ *
+ * // Verify a session
+ * const session = await buildspace.auth.getSession(sessionToken);
+ *
+ * // Sign out
+ * await buildspace.auth.signOut(sessionToken);
+ * ```
+ */
+declare class AuthServerNamespace {
+    private readonly transport;
+    constructor(transport: HttpTransport);
+    /**
+     * Retrieve the session associated with a token.
+     *
+     * Returns the {@link AuthSession} if valid, or `null` if the token is
+     * expired, revoked, or invalid (401/404).
+     *
+     * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).
+     */
+    getSession(sessionToken: string): Promise<AuthSession | null>;
+    /**
+     * Exchange an OAuth authorization code for tokens.
+     *
+     * Extracts the `code` query parameter from the callback URL and exchanges
+     * it with the Buildspace API for an access token and user info.
+     *
+     * @param request - The incoming callback request. Accepts a `Request` object,
+     *   a `URL`, or a raw URL string containing the `?code=` parameter.
+     * @param opts - Optional settings.
+     * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.
+     *   Defaults to the origin + pathname of the callback URL.
+     * @returns The token response containing `access_token`, `expires_in`, and `user`.
+     *
+     * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).
+     *
+     * @example
+     * ```ts
+     * // Next.js Route Handler
+     * export async function GET(request: Request) {
+     *   const { access_token, user } = await buildspace.auth.handleCallback(request);
+     *   // Store access_token as a session cookie
+     * }
+     * ```
+     */
+    handleCallback(request: Request | URL | string, opts?: {
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * Revoke a specific session token.
+     *
+     * @param sessionToken - The token to revoke.
+     * @throws {BuildspaceError} If the revocation fails.
+     */
+    revokeSession(sessionToken: string): Promise<void>;
+    /**
+     * Sign the user out by revoking the session and clearing the SDK's stored token.
+     *
+     * If the session is already expired or not found, the error is silently
+     * ignored and the local session is still cleared.
+     *
+     * @param sessionToken - Token to revoke. If omitted, uses the token
+     *   previously set via `buildspace.setSession()`.
+     */
+    signOut(sessionToken?: string): Promise<void>;
+}
+
+export { AuthServerNamespace, type AuthSession, type AuthUser, type TokenResponse };