@buildspacestudio/sdk 0.3.0 → 0.4.0

package/README.md

@@ -69,6 +69,75 @@ const signUpUrl = buildspace.auth.getSignUpUrl({
 });
 ```
 
+### Next.js adapter (`@buildspacestudio/sdk/next`)
+
+Skip the hand-rolled auth routes — the adapter standardizes the `bs_session` cookie and ships route-handler factories for the whole flow. Works with any framework using web-standard `Request`/`Response` handlers.
+
+```ts
+// app/api/auth/callback/route.ts
+import { createAuthCallback } from "@buildspacestudio/sdk/next";
+import { buildspace } from "@/lib/buildspace";
+
+export const GET = createAuthCallback(buildspace, {
+  redirectTo: "/dashboard",
+  onSignIn: async ({ user }) => {
+    // first-class place for signup side effects (upsert user, welcome email)
+  },
+});
+
+// app/api/auth/logout/route.ts
+import { createLogoutRoute } from "@buildspacestudio/sdk/next";
+export const POST = createLogoutRoute(buildspace);
+
+// app/api/auth/session/route.ts
+import { createSessionRoute } from "@buildspacestudio/sdk/next";
+export const GET = createSessionRoute(buildspace);
+```
+
+Read the session anywhere on the server:
+
+```ts
+import { cookies } from "next/headers";
+import { getSession, requireSession } from "@buildspacestudio/sdk/next";
+
+const session = await getSession(buildspace, await cookies()); // null when signed out
+const { user, token } = await requireSession(buildspace, request); // throws 401 BuildspaceError
+```
+
+Protect routes in middleware with a fast cookie-presence check:
+
+```ts
+// middleware.ts
+import { createSessionCookieGuard } from "@buildspacestudio/sdk/next";
+
+export const middleware = createSessionCookieGuard({ redirectTo: "/" });
+export const config = { matcher: ["/dashboard/:path*"] };
+```
+
+### React bindings (`@buildspacestudio/sdk/react`)
+
+```tsx
+"use client";
+import { createClient } from "@buildspacestudio/sdk/client";
+import { BuildspaceProvider, useAuth, useTrack } from "@buildspacestudio/sdk/react";
+
+const client = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_PUBLISHABLE_KEY!);
+
+// Wrap your app (pass the server-resolved user for a flash-free first paint)
+<BuildspaceProvider client={client} initialUser={initialUser}>
+  {children}
+</BuildspaceProvider>;
+
+// Anywhere below the provider:
+function UserMenu() {
+  const { user, signIn, signOut } = useAuth();
+  const track = useTrack(); // fire-and-forget analytics, never throws
+  // ...
+}
+```
+
+`react >= 19` is an optional peer dependency — only needed if you import `/react`.
+
 ---
 
 ## Events
@@ -154,6 +223,63 @@ const { key, url } = await buildspace.storage.upload(file, {
 
 ---
 
+## Billing
+
+Stripe-backed subscriptions on the creator's connected account: Checkout, the customer portal, and entitlement checks.
+
+### Server
+
+```ts
+// Is billing configured for this app environment?
+const status = await buildspace.billing.getStatus();
+// status.enabled, status.status ("disabled" | "setup_required" | "active" | "paused"),
+// status.testMode — render a "Test mode" banner when true
+
+// Catalog
+const { products } = await buildspace.billing.listProducts();
+const { prices } = await buildspace.billing.listPrices();
+
+// Send a user to Stripe Checkout
+const { url } = await buildspace.billing.createCheckout({
+  userId,                 // or appUserId for your own auth system
+  priceId: price.id,      // or lookupKey
+  successUrl: "https://yourapp.com/billing?status=success",
+  cancelUrl: "https://yourapp.com/billing",
+});
+
+// Stripe-hosted customer portal (manage/cancel subscription)
+const portal = await buildspace.billing.createPortalSession({
+  userId,
+  returnUrl: "https://yourapp.com/billing",
+});
+
+// Subscription + entitlement state
+const { subscription } = await buildspace.billing.getSubscription({ userId });
+const { active } = await buildspace.billing.getEntitlements({ userId });
+if (active) {
+  // gate paid features here
+}
+```
+
+### Client
+
+```ts
+// List prices, then send the signed-in user to Checkout or the portal
+const { prices } = await buildspace.billing.listPrices();
+
+await buildspace.billing.redirectToCheckout({
+  priceId,
+  successUrl: `${location.origin}/billing?status=success`,
+  cancelUrl: `${location.origin}/billing`,
+});
+
+await buildspace.billing.manageSubscription({
+  returnUrl: `${location.origin}/billing`,
+});
+```
+
+---
+
 ## Notifications
 
 Send transactional emails. **Server only.**

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/client.ts","../../src/errors.ts","../../src/auth/server.ts"],"names":["forwardedHost","forwardedProto"],"mappings":";;;AA0CO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AACF;;;ACpFO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA;AAAA,EAEhC,IAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY;AAAA,IACV,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAKG;AACD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;;;ACDA,IAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,SAAS,CAAC,CAAA;AAC3E,IAAM,iBAAA,GAAoB,oBAAA;AAC1B,IAAM,kBAAA,GAAqB,qBAAA;AAE3B,SAAS,uBAAuB,KAAA,EAAqC;AACnE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CACG,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA;AAExB;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,IAAI,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAK,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,OAAO,cAAc,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,GAAI,IAAA;AACvD;AAEA,SAAS,cAAc,QAAA,EAA2B;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,IAAA,GAAO,GAAG,CAAA,EAAG;AAC5F,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IACZ,MAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,KAAA,CAAM,CAAC,KAAK,EAAA,IAClD,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA;AAEtC;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,MAAM,UAAA,GAAa,SAAS,WAAA,EAAY;AAExC,EAAA,OACE,cAAA,CAAe,GAAA,CAAI,UAAU,CAAA,IAC7B,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,IAC5B,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,IAC/B,cAAc,UAAU,CAAA;AAE5B;AAEA,SAAS,mBAAmB,OAAA,EAAiC;AAC3D,EAAA,MAAM,YAAY,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAMA,iBAAgB,SAAA,CAAU,KAAA,CAAM,iBAAiB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AACpE,IAAA,MAAMC,kBAAiB,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AAEtE,IAAA,IAAID,kBAAiBC,eAAAA,EAAgB;AACnC,MAAA,OAAO,CAAA,EAAGA,eAAc,CAAA,GAAA,EAAMD,cAAa,CAAA,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA;AACpF,EAAA,MAAM,iBAAiB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAEtF,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO,CAAA,EAAG,cAAc,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,SAAiC,GAAA,EAAkB;AACpF,EAAA,IAAI,EAAE,mBAAmB,OAAA,CAAA,EAAU;AACjC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,eAAA,GAAkB,mBAAmB,OAAO,CAAA;AAClD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,eAAe,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAG,IAAA,EAAK;AACrD,EAAA,IAAI,cAAc,CAAC,kBAAA,CAAmB,SAAA,CAAU,UAAU,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAO,GAAG,GAAA,CAAI,QAAQ,KAAK,UAAU,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AACrC;AAuBO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAW,YAAA,EAAmD;AAClE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAqB;AAAA,QAC/C,OAAA,EAAS,MAAA;AAAA,QACT,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,KAAoB,KAAA,CAAM,WAAW,GAAA,IAAO,KAAA,CAAM,WAAW,GAAA,CAAA,EAAM;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,cAAA,CACE,SACA,IAAA,EACwB;AACxB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,GAAA,GAAM,IAAI,IAAI,OAAO,CAAA;AAAA,IACvB,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AACjC,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,EAAM,WAAA,IAAe,yBAAA,CAA0B,SAAS,GAAG,CAAA;AAE/E,IAAA,OAAO,IAAA,CAAK,UAAU,OAAA,CAAuB;AAAA,MAC3C,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,gBAAA;AAAA,MACN,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,YAAA,EAAc;AAAA;AAChB,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,YAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,UAAU,OAAA,CAAc;AAAA,MACjC,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,kBAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,KAC5C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,YAAA,EAAsC;AAClD,IAAA,MAAM,KAAA,GAAQ,YAAA,IAAgB,IAAA,CAAK,SAAA,CAAU,eAAA,EAAgB;AAE7D,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,MAChC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IACE,EACE,KAAA,YAAiB,eAAA,IACjB,KAAA,CAAM,OAAA,KAAY,MAAA,KACjB,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA,CAAA,CAAA,EAE5C;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,UAAU,YAAA,EAAa;AAAA,IAC9B;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { HttpTransport } from \"../http\";\n\n/** Options for generating a sign-in URL. */\nexport interface SignInUrlOptions {\n  /** App slug to scope the login to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after authentication completes. */\n  redirectUri: string;\n}\n\n/** Options for generating a sign-up URL. */\nexport interface SignUpUrlOptions {\n  /** App slug to scope the registration to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after registration completes. */\n  redirectUri: string;\n}\n\n/**\n * Client-side authentication methods for generating login URLs.\n *\n * Access via `buildspace.auth` on the client SDK, or `buildspace.authClient`\n * on the server SDK when you need to generate URLs from server-side code.\n *\n * @example\n * ```ts\n * import { createClient } from \"@buildspacestudio/sdk/client\";\n *\n * const buildspace = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_KEY!);\n *\n * const signInUrl = buildspace.auth.getSignInUrl({\n *   redirectUri: \"https://yourapp.com/auth/callback\",\n * });\n *\n * // Use in a link or redirect\n * window.location.href = signInUrl;\n * ```\n */\nexport class AuthClientNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-in page.\n   *\n   * After the user authenticates, they are redirected back to `redirectUri`\n   * with a `?code=` parameter that can be exchanged for tokens via\n   * `buildspace.auth.handleCallback()` on the server.\n   *\n   * @param opts - Sign-in URL options.\n   * @returns The full sign-in URL as a string.\n   */\n  getSignInUrl(opts: SignInUrlOptions): string {\n    const url = new URL(\"/sign-in\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-up page.\n   *\n   * Works identically to {@link getSignInUrl} but directs the user to the\n   * registration flow instead.\n   *\n   * @param opts - Sign-up URL options.\n   * @returns The full sign-up URL as a string.\n   */\n  getSignUpUrl(opts: SignUpUrlOptions): string {\n    const url = new URL(\"/sign-up\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n}\n","/** Services available in the Buildspace platform. */\nexport type BuildspaceService = \"auth\" | \"events\" | \"notifications\" | \"storage\";\n\n/**\n * Error thrown by all Buildspace SDK methods on failure.\n *\n * @example\n * ```ts\n * try {\n *   await buildspace.auth.getSession(token);\n * } catch (err) {\n *   if (err instanceof BuildspaceError) {\n *     console.error(err.service, err.code, err.status, err.message);\n *   }\n * }\n * ```\n */\nexport class BuildspaceError extends Error {\n  /** Machine-readable error code, e.g. `\"auth/invalid-token\"`. */\n  readonly code: string;\n  /** Which service produced the error. */\n  readonly service: BuildspaceService;\n  /** HTTP status code from the API. */\n  readonly status: number;\n\n  constructor({\n    code,\n    message,\n    service,\n    status,\n  }: {\n    code: string;\n    message: string;\n    service: BuildspaceService;\n    status: number;\n  }) {\n    super(message);\n    this.name = \"BuildspaceError\";\n    this.code = code;\n    this.service = service;\n    this.status = status;\n  }\n}\n","import { BuildspaceError } from \"../errors\";\nimport type { HttpTransport } from \"../http\";\n\n/** A Buildspace user returned from auth endpoints. */\nexport interface AuthUser {\n  /** The user's email address. */\n  email: string;\n  /** Unique user identifier. */\n  id: string;\n  /** The user's display name, or `null` if not set. */\n  name: string | null;\n}\n\n/**\n * An active session for an authenticated user.\n *\n * Returned by {@link AuthServerNamespace.getSession}.\n */\nexport interface AuthSession {\n  /** The app this session belongs to, or `null` for platform-level sessions. */\n  appId: string | null;\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\n/**\n * Token response returned after a successful OAuth callback exchange.\n *\n * Returned by {@link AuthServerNamespace.handleCallback}.\n */\nexport interface TokenResponse {\n  /** The access token to use for authenticated requests. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Always `\"bearer\"`. */\n  token_type: \"bearer\";\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\nconst LOOPBACK_HOSTS = new Set([\"127.0.0.1\", \"localhost\", \"::1\", \"0.0.0.0\"]);\nconst FORWARDED_HOST_RE = /host=\"?([^;\"]+)\"?/i;\nconst FORWARDED_PROTO_RE = /proto=\"?([^;\"]+)\"?/i;\n\nfunction getFirstForwardedValue(value: string | null): string | null {\n  if (!value) {\n    return null;\n  }\n\n  return (\n    value\n      .split(\",\")\n      .map((part) => part.trim())\n      .find(Boolean) ?? null\n  );\n}\n\nfunction stripPort(host: string): string {\n  if (host.startsWith(\"[\") && host.includes(\"]\")) {\n    return host.slice(1, host.indexOf(\"]\"));\n  }\n\n  const colonIndex = host.indexOf(\":\");\n  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\").map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {\n    return false;\n  }\n\n  return (\n    parts[0] === 10 ||\n    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||\n    (parts[0] === 192 && parts[1] === 168)\n  );\n}\n\nfunction isInternalHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n\n  return (\n    LOOPBACK_HOSTS.has(normalized) ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\") ||\n    isPrivateIpv4(normalized)\n  );\n}\n\nfunction getForwardedOrigin(request: Request): string | null {\n  const forwarded = getFirstForwardedValue(request.headers.get(\"forwarded\"));\n  if (forwarded) {\n    const forwardedHost = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();\n    const forwardedProto = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();\n\n    if (forwardedHost && forwardedProto) {\n      return `${forwardedProto}://${forwardedHost}`;\n    }\n  }\n\n  const forwardedHost = getFirstForwardedValue(request.headers.get(\"x-forwarded-host\"));\n  const forwardedProto = getFirstForwardedValue(request.headers.get(\"x-forwarded-proto\"));\n\n  if (forwardedHost && forwardedProto) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return null;\n}\n\nfunction resolveDefaultRedirectUri(request: Request | URL | string, url: URL): string {\n  if (!(request instanceof Request)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  const forwardedOrigin = getForwardedOrigin(request);\n  if (forwardedOrigin) {\n    return `${forwardedOrigin}${url.pathname}`;\n  }\n\n  const hostHeader = request.headers.get(\"host\")?.trim();\n  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {\n    return `${url.protocol}//${hostHeader}${url.pathname}`;\n  }\n\n  if (!isInternalHostname(url.hostname)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  return `${url.origin}${url.pathname}`;\n}\n\n/**\n * Server-side authentication methods.\n *\n * Access via `buildspace.auth` on the server SDK.\n *\n * @example\n * ```ts\n * import Buildspace from \"@buildspacestudio/sdk\";\n *\n * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);\n *\n * // Handle OAuth callback\n * const tokens = await buildspace.auth.handleCallback(request);\n *\n * // Verify a session\n * const session = await buildspace.auth.getSession(sessionToken);\n *\n * // Sign out\n * await buildspace.auth.signOut(sessionToken);\n * ```\n */\nexport class AuthServerNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Retrieve the session associated with a token.\n   *\n   * Returns the {@link AuthSession} if valid, or `null` if the token is\n   * expired, revoked, or invalid (401/404).\n   *\n   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).\n   */\n  async getSession(sessionToken: string): Promise<AuthSession | null> {\n    try {\n      return await this.transport.request<AuthSession>({\n        service: \"auth\",\n        path: \"/v1/auth/session\",\n        headers: { \"X-Session-Token\": sessionToken },\n      });\n    } catch (error) {\n      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange an OAuth authorization code for tokens.\n   *\n   * Extracts the `code` query parameter from the callback URL and exchanges\n   * it with the Buildspace API for an access token and user info.\n   *\n   * @param request - The incoming callback request. Accepts a `Request` object,\n   *   a `URL`, or a raw URL string containing the `?code=` parameter.\n   * @param opts - Optional settings.\n   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.\n   *   Defaults to the origin + pathname of the callback URL.\n   * @returns The token response containing `access_token`, `expires_in`, and `user`.\n   *\n   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).\n   *\n   * @example\n   * ```ts\n   * // Next.js Route Handler\n   * export async function GET(request: Request) {\n   *   const { access_token, user } = await buildspace.auth.handleCallback(request);\n   *   // Store access_token as a session cookie\n   * }\n   * ```\n   */\n  handleCallback(\n    request: Request | URL | string,\n    opts?: { redirectUri?: string }\n  ): Promise<TokenResponse> {\n    let url: URL;\n    if (typeof request === \"string\") {\n      url = new URL(request);\n    } else if (request instanceof URL) {\n      url = request;\n    } else {\n      url = new URL(request.url);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new BuildspaceError({\n        service: \"auth\",\n        status: 400,\n        code: \"auth/missing-code\",\n        message: \"No auth code found in callback URL. Expected ?code= parameter.\",\n      });\n    }\n\n    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);\n\n    return this.transport.request<TokenResponse>({\n      service: \"auth\",\n      path: \"/v1/auth/token\",\n      method: \"POST\",\n      body: {\n        code,\n        redirect_uri: redirectUri,\n      },\n    });\n  }\n\n  /**\n   * Revoke a specific session token.\n   *\n   * @param sessionToken - The token to revoke.\n   * @throws {BuildspaceError} If the revocation fails.\n   */\n  async revokeSession(sessionToken: string): Promise<void> {\n    await this.transport.request<void>({\n      service: \"auth\",\n      path: \"/v1/auth/session\",\n      method: \"DELETE\",\n      headers: { \"X-Session-Token\": sessionToken },\n    });\n  }\n\n  /**\n   * Sign the user out by revoking the session and clearing the SDK's stored token.\n   *\n   * If the session is already expired or not found, the error is silently\n   * ignored and the local session is still cleared.\n   *\n   * @param sessionToken - Token to revoke. If omitted, uses the token\n   *   previously set via `buildspace.setSession()`.\n   */\n  async signOut(sessionToken?: string): Promise<void> {\n    const token = sessionToken ?? this.transport.getSessionToken();\n\n    try {\n      if (token) {\n        await this.revokeSession(token);\n      }\n    } catch (error) {\n      if (\n        !(\n          error instanceof BuildspaceError &&\n          error.service === \"auth\" &&\n          (error.status === 401 || error.status === 404)\n        )\n      ) {\n        throw error;\n      }\n    } finally {\n      this.transport.clearSession();\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../../src/auth/client.ts","../../src/errors.ts","../../src/auth/server.ts"],"names":["forwardedHost","forwardedProto"],"mappings":";;;AA0CO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AACF;;;ACpFO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA;AAAA,EAEhC,IAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY;AAAA,IACV,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAKG;AACD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;;;ACDA,IAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,SAAS,CAAC,CAAA;AAC3E,IAAM,iBAAA,GAAoB,oBAAA;AAC1B,IAAM,kBAAA,GAAqB,qBAAA;AAE3B,SAAS,uBAAuB,KAAA,EAAqC;AACnE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CACG,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA;AAExB;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,IAAI,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAK,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,OAAO,cAAc,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,GAAI,IAAA;AACvD;AAEA,SAAS,cAAc,QAAA,EAA2B;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,IAAA,GAAO,GAAG,CAAA,EAAG;AAC5F,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IACZ,MAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,KAAA,CAAM,CAAC,KAAK,EAAA,IAClD,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA;AAEtC;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,MAAM,UAAA,GAAa,SAAS,WAAA,EAAY;AAExC,EAAA,OACE,cAAA,CAAe,GAAA,CAAI,UAAU,CAAA,IAC7B,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,IAC5B,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,IAC/B,cAAc,UAAU,CAAA;AAE5B;AAEA,SAAS,mBAAmB,OAAA,EAAiC;AAC3D,EAAA,MAAM,YAAY,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAMA,iBAAgB,SAAA,CAAU,KAAA,CAAM,iBAAiB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AACpE,IAAA,MAAMC,kBAAiB,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AAEtE,IAAA,IAAID,kBAAiBC,eAAAA,EAAgB;AACnC,MAAA,OAAO,CAAA,EAAGA,eAAc,CAAA,GAAA,EAAMD,cAAa,CAAA,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA;AACpF,EAAA,MAAM,iBAAiB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAEtF,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO,CAAA,EAAG,cAAc,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,SAAiC,GAAA,EAAkB;AACpF,EAAA,IAAI,EAAE,mBAAmB,OAAA,CAAA,EAAU;AACjC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,eAAA,GAAkB,mBAAmB,OAAO,CAAA;AAClD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,eAAe,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAG,IAAA,EAAK;AACrD,EAAA,IAAI,cAAc,CAAC,kBAAA,CAAmB,SAAA,CAAU,UAAU,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAO,GAAG,GAAA,CAAI,QAAQ,KAAK,UAAU,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AACrC;AAuBO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAW,YAAA,EAAmD;AAClE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAqB;AAAA,QAC/C,OAAA,EAAS,MAAA;AAAA,QACT,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,KAAoB,KAAA,CAAM,WAAW,GAAA,IAAO,KAAA,CAAM,WAAW,GAAA,CAAA,EAAM;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,cAAA,CACE,SACA,IAAA,EACwB;AACxB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,GAAA,GAAM,IAAI,IAAI,OAAO,CAAA;AAAA,IACvB,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AACjC,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,EAAM,WAAA,IAAe,yBAAA,CAA0B,SAAS,GAAG,CAAA;AAE/E,IAAA,OAAO,IAAA,CAAK,UAAU,OAAA,CAAuB;AAAA,MAC3C,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,gBAAA;AAAA,MACN,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,YAAA,EAAc;AAAA;AAChB,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,YAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,UAAU,OAAA,CAAc;AAAA,MACjC,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,kBAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,KAC5C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,YAAA,EAAsC;AAClD,IAAA,MAAM,KAAA,GAAQ,YAAA,IAAgB,IAAA,CAAK,SAAA,CAAU,eAAA,EAAgB;AAE7D,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,MAChC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IACE,EACE,KAAA,YAAiB,eAAA,IACjB,KAAA,CAAM,OAAA,KAAY,MAAA,KACjB,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA,CAAA,CAAA,EAE5C;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,UAAU,YAAA,EAAa;AAAA,IAC9B;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { HttpTransport } from \"../http\";\n\n/** Options for generating a sign-in URL. */\nexport interface SignInUrlOptions {\n  /** App slug to scope the login to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after authentication completes. */\n  redirectUri: string;\n}\n\n/** Options for generating a sign-up URL. */\nexport interface SignUpUrlOptions {\n  /** App slug to scope the registration to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after registration completes. */\n  redirectUri: string;\n}\n\n/**\n * Client-side authentication methods for generating login URLs.\n *\n * Access via `buildspace.auth` on the client SDK, or `buildspace.authClient`\n * on the server SDK when you need to generate URLs from server-side code.\n *\n * @example\n * ```ts\n * import { createClient } from \"@buildspacestudio/sdk/client\";\n *\n * const buildspace = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_KEY!);\n *\n * const signInUrl = buildspace.auth.getSignInUrl({\n *   redirectUri: \"https://yourapp.com/auth/callback\",\n * });\n *\n * // Use in a link or redirect\n * window.location.href = signInUrl;\n * ```\n */\nexport class AuthClientNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-in page.\n   *\n   * After the user authenticates, they are redirected back to `redirectUri`\n   * with a `?code=` parameter that can be exchanged for tokens via\n   * `buildspace.auth.handleCallback()` on the server.\n   *\n   * @param opts - Sign-in URL options.\n   * @returns The full sign-in URL as a string.\n   */\n  getSignInUrl(opts: SignInUrlOptions): string {\n    const url = new URL(\"/sign-in\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-up page.\n   *\n   * Works identically to {@link getSignInUrl} but directs the user to the\n   * registration flow instead.\n   *\n   * @param opts - Sign-up URL options.\n   * @returns The full sign-up URL as a string.\n   */\n  getSignUpUrl(opts: SignUpUrlOptions): string {\n    const url = new URL(\"/sign-up\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n}\n","/** Services available in the Buildspace platform. */\nexport type BuildspaceService = \"auth\" | \"billing\" | \"events\" | \"notifications\" | \"storage\";\n\n/**\n * Error thrown by all Buildspace SDK methods on failure.\n *\n * @example\n * ```ts\n * try {\n *   await buildspace.auth.getSession(token);\n * } catch (err) {\n *   if (err instanceof BuildspaceError) {\n *     console.error(err.service, err.code, err.status, err.message);\n *   }\n * }\n * ```\n */\nexport class BuildspaceError extends Error {\n  /** Machine-readable error code, e.g. `\"auth/invalid-token\"`. */\n  readonly code: string;\n  /** Which service produced the error. */\n  readonly service: BuildspaceService;\n  /** HTTP status code from the API. */\n  readonly status: number;\n\n  constructor({\n    code,\n    message,\n    service,\n    status,\n  }: {\n    code: string;\n    message: string;\n    service: BuildspaceService;\n    status: number;\n  }) {\n    super(message);\n    this.name = \"BuildspaceError\";\n    this.code = code;\n    this.service = service;\n    this.status = status;\n  }\n}\n","import { BuildspaceError } from \"../errors\";\nimport type { HttpTransport } from \"../http\";\n\n/** A Buildspace user returned from auth endpoints. */\nexport interface AuthUser {\n  /** The user's email address. */\n  email: string;\n  /** Unique user identifier. */\n  id: string;\n  /** The user's display name, or `null` if not set. */\n  name: string | null;\n}\n\n/**\n * An active session for an authenticated user.\n *\n * Returned by {@link AuthServerNamespace.getSession}.\n */\nexport interface AuthSession {\n  /** The app this session belongs to, or `null` for platform-level sessions. */\n  appId: string | null;\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\n/**\n * Token response returned after a successful OAuth callback exchange.\n *\n * Returned by {@link AuthServerNamespace.handleCallback}.\n */\nexport interface TokenResponse {\n  /** The access token to use for authenticated requests. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Always `\"bearer\"`. */\n  token_type: \"bearer\";\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\nconst LOOPBACK_HOSTS = new Set([\"127.0.0.1\", \"localhost\", \"::1\", \"0.0.0.0\"]);\nconst FORWARDED_HOST_RE = /host=\"?([^;\"]+)\"?/i;\nconst FORWARDED_PROTO_RE = /proto=\"?([^;\"]+)\"?/i;\n\nfunction getFirstForwardedValue(value: string | null): string | null {\n  if (!value) {\n    return null;\n  }\n\n  return (\n    value\n      .split(\",\")\n      .map((part) => part.trim())\n      .find(Boolean) ?? null\n  );\n}\n\nfunction stripPort(host: string): string {\n  if (host.startsWith(\"[\") && host.includes(\"]\")) {\n    return host.slice(1, host.indexOf(\"]\"));\n  }\n\n  const colonIndex = host.indexOf(\":\");\n  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\").map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {\n    return false;\n  }\n\n  return (\n    parts[0] === 10 ||\n    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||\n    (parts[0] === 192 && parts[1] === 168)\n  );\n}\n\nfunction isInternalHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n\n  return (\n    LOOPBACK_HOSTS.has(normalized) ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\") ||\n    isPrivateIpv4(normalized)\n  );\n}\n\nfunction getForwardedOrigin(request: Request): string | null {\n  const forwarded = getFirstForwardedValue(request.headers.get(\"forwarded\"));\n  if (forwarded) {\n    const forwardedHost = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();\n    const forwardedProto = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();\n\n    if (forwardedHost && forwardedProto) {\n      return `${forwardedProto}://${forwardedHost}`;\n    }\n  }\n\n  const forwardedHost = getFirstForwardedValue(request.headers.get(\"x-forwarded-host\"));\n  const forwardedProto = getFirstForwardedValue(request.headers.get(\"x-forwarded-proto\"));\n\n  if (forwardedHost && forwardedProto) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return null;\n}\n\nfunction resolveDefaultRedirectUri(request: Request | URL | string, url: URL): string {\n  if (!(request instanceof Request)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  const forwardedOrigin = getForwardedOrigin(request);\n  if (forwardedOrigin) {\n    return `${forwardedOrigin}${url.pathname}`;\n  }\n\n  const hostHeader = request.headers.get(\"host\")?.trim();\n  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {\n    return `${url.protocol}//${hostHeader}${url.pathname}`;\n  }\n\n  if (!isInternalHostname(url.hostname)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  return `${url.origin}${url.pathname}`;\n}\n\n/**\n * Server-side authentication methods.\n *\n * Access via `buildspace.auth` on the server SDK.\n *\n * @example\n * ```ts\n * import Buildspace from \"@buildspacestudio/sdk\";\n *\n * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);\n *\n * // Handle OAuth callback\n * const tokens = await buildspace.auth.handleCallback(request);\n *\n * // Verify a session\n * const session = await buildspace.auth.getSession(sessionToken);\n *\n * // Sign out\n * await buildspace.auth.signOut(sessionToken);\n * ```\n */\nexport class AuthServerNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Retrieve the session associated with a token.\n   *\n   * Returns the {@link AuthSession} if valid, or `null` if the token is\n   * expired, revoked, or invalid (401/404).\n   *\n   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).\n   */\n  async getSession(sessionToken: string): Promise<AuthSession | null> {\n    try {\n      return await this.transport.request<AuthSession>({\n        service: \"auth\",\n        path: \"/v1/auth/session\",\n        headers: { \"X-Session-Token\": sessionToken },\n      });\n    } catch (error) {\n      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange an OAuth authorization code for tokens.\n   *\n   * Extracts the `code` query parameter from the callback URL and exchanges\n   * it with the Buildspace API for an access token and user info.\n   *\n   * @param request - The incoming callback request. Accepts a `Request` object,\n   *   a `URL`, or a raw URL string containing the `?code=` parameter.\n   * @param opts - Optional settings.\n   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.\n   *   Defaults to the origin + pathname of the callback URL.\n   * @returns The token response containing `access_token`, `expires_in`, and `user`.\n   *\n   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).\n   *\n   * @example\n   * ```ts\n   * // Next.js Route Handler\n   * export async function GET(request: Request) {\n   *   const { access_token, user } = await buildspace.auth.handleCallback(request);\n   *   // Store access_token as a session cookie\n   * }\n   * ```\n   */\n  handleCallback(\n    request: Request | URL | string,\n    opts?: { redirectUri?: string }\n  ): Promise<TokenResponse> {\n    let url: URL;\n    if (typeof request === \"string\") {\n      url = new URL(request);\n    } else if (request instanceof URL) {\n      url = request;\n    } else {\n      url = new URL(request.url);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new BuildspaceError({\n        service: \"auth\",\n        status: 400,\n        code: \"auth/missing-code\",\n        message: \"No auth code found in callback URL. Expected ?code= parameter.\",\n      });\n    }\n\n    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);\n\n    return this.transport.request<TokenResponse>({\n      service: \"auth\",\n      path: \"/v1/auth/token\",\n      method: \"POST\",\n      body: {\n        code,\n        redirect_uri: redirectUri,\n      },\n    });\n  }\n\n  /**\n   * Revoke a specific session token.\n   *\n   * @param sessionToken - The token to revoke.\n   * @throws {BuildspaceError} If the revocation fails.\n   */\n  async revokeSession(sessionToken: string): Promise<void> {\n    await this.transport.request<void>({\n      service: \"auth\",\n      path: \"/v1/auth/session\",\n      method: \"DELETE\",\n      headers: { \"X-Session-Token\": sessionToken },\n    });\n  }\n\n  /**\n   * Sign the user out by revoking the session and clearing the SDK's stored token.\n   *\n   * If the session is already expired or not found, the error is silently\n   * ignored and the local session is still cleared.\n   *\n   * @param sessionToken - Token to revoke. If omitted, uses the token\n   *   previously set via `buildspace.setSession()`.\n   */\n  async signOut(sessionToken?: string): Promise<void> {\n    const token = sessionToken ?? this.transport.getSessionToken();\n\n    try {\n      if (token) {\n        await this.revokeSession(token);\n      }\n    } catch (error) {\n      if (\n        !(\n          error instanceof BuildspaceError &&\n          error.service === \"auth\" &&\n          (error.status === 401 || error.status === 404)\n        )\n      ) {\n        throw error;\n      }\n    } finally {\n      this.transport.clearSession();\n    }\n  }\n}\n"]}

package/dist/auth/index.d.cts

@@ -1,118 +1,3 @@
-export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-DqWXAwCr.cjs';
-import { H as HttpTransport } from '../http-U-zzKmFF.cjs';
-
-/** A Buildspace user returned from auth endpoints. */
-interface AuthUser {
-    /** The user's email address. */
-    email: string;
-    /** Unique user identifier. */
-    id: string;
-    /** The user's display name, or `null` if not set. */
-    name: string | null;
-}
-/**
- * An active session for an authenticated user.
- *
- * Returned by {@link AuthServerNamespace.getSession}.
- */
-interface AuthSession {
-    /** The app this session belongs to, or `null` for platform-level sessions. */
-    appId: string | null;
-    /** The authenticated user. */
-    user: AuthUser;
-}
-/**
- * Token response returned after a successful OAuth callback exchange.
- *
- * Returned by {@link AuthServerNamespace.handleCallback}.
- */
-interface TokenResponse {
-    /** The access token to use for authenticated requests. */
-    access_token: string;
-    /** Token lifetime in seconds. */
-    expires_in: number;
-    /** Always `"bearer"`. */
-    token_type: "bearer";
-    /** The authenticated user. */
-    user: AuthUser;
-}
-/**
- * Server-side authentication methods.
- *
- * Access via `buildspace.auth` on the server SDK.
- *
- * @example
- * ```ts
- * import Buildspace from "@buildspacestudio/sdk";
- *
- * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);
- *
- * // Handle OAuth callback
- * const tokens = await buildspace.auth.handleCallback(request);
- *
- * // Verify a session
- * const session = await buildspace.auth.getSession(sessionToken);
- *
- * // Sign out
- * await buildspace.auth.signOut(sessionToken);
- * ```
- */
-declare class AuthServerNamespace {
-    private readonly transport;
-    constructor(transport: HttpTransport);
-    /**
-     * Retrieve the session associated with a token.
-     *
-     * Returns the {@link AuthSession} if valid, or `null` if the token is
-     * expired, revoked, or invalid (401/404).
-     *
-     * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).
-     */
-    getSession(sessionToken: string): Promise<AuthSession | null>;
-    /**
-     * Exchange an OAuth authorization code for tokens.
-     *
-     * Extracts the `code` query parameter from the callback URL and exchanges
-     * it with the Buildspace API for an access token and user info.
-     *
-     * @param request - The incoming callback request. Accepts a `Request` object,
-     *   a `URL`, or a raw URL string containing the `?code=` parameter.
-     * @param opts - Optional settings.
-     * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.
-     *   Defaults to the origin + pathname of the callback URL.
-     * @returns The token response containing `access_token`, `expires_in`, and `user`.
-     *
-     * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).
-     *
-     * @example
-     * ```ts
-     * // Next.js Route Handler
-     * export async function GET(request: Request) {
-     *   const { access_token, user } = await buildspace.auth.handleCallback(request);
-     *   // Store access_token as a session cookie
-     * }
-     * ```
-     */
-    handleCallback(request: Request | URL | string, opts?: {
-        redirectUri?: string;
-    }): Promise<TokenResponse>;
-    /**
-     * Revoke a specific session token.
-     *
-     * @param sessionToken - The token to revoke.
-     * @throws {BuildspaceError} If the revocation fails.
-     */
-    revokeSession(sessionToken: string): Promise<void>;
-    /**
-     * Sign the user out by revoking the session and clearing the SDK's stored token.
-     *
-     * If the session is already expired or not found, the error is silently
-     * ignored and the local session is still cleared.
-     *
-     * @param sessionToken - Token to revoke. If omitted, uses the token
-     *   previously set via `buildspace.setSession()`.
-     */
-    signOut(sessionToken?: string): Promise<void>;
-}
-
-export { AuthServerNamespace, type AuthSession, type AuthUser, type TokenResponse };
+export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-D7bqvGJv.cjs';
+export { A as AuthServerNamespace, a as AuthSession, b as AuthUser, T as TokenResponse } from '../server-CoPDzSUP.cjs';
+import '../http-D2gXpNpr.cjs';

package/dist/auth/index.d.ts

@@ -1,118 +1,3 @@
-export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-BH7LbrKM.js';
-import { H as HttpTransport } from '../http-U-zzKmFF.js';
-
-/** A Buildspace user returned from auth endpoints. */
-interface AuthUser {
-    /** The user's email address. */
-    email: string;
-    /** Unique user identifier. */
-    id: string;
-    /** The user's display name, or `null` if not set. */
-    name: string | null;
-}
-/**
- * An active session for an authenticated user.
- *
- * Returned by {@link AuthServerNamespace.getSession}.
- */
-interface AuthSession {
-    /** The app this session belongs to, or `null` for platform-level sessions. */
-    appId: string | null;
-    /** The authenticated user. */
-    user: AuthUser;
-}
-/**
- * Token response returned after a successful OAuth callback exchange.
- *
- * Returned by {@link AuthServerNamespace.handleCallback}.
- */
-interface TokenResponse {
-    /** The access token to use for authenticated requests. */
-    access_token: string;
-    /** Token lifetime in seconds. */
-    expires_in: number;
-    /** Always `"bearer"`. */
-    token_type: "bearer";
-    /** The authenticated user. */
-    user: AuthUser;
-}
-/**
- * Server-side authentication methods.
- *
- * Access via `buildspace.auth` on the server SDK.
- *
- * @example
- * ```ts
- * import Buildspace from "@buildspacestudio/sdk";
- *
- * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);
- *
- * // Handle OAuth callback
- * const tokens = await buildspace.auth.handleCallback(request);
- *
- * // Verify a session
- * const session = await buildspace.auth.getSession(sessionToken);
- *
- * // Sign out
- * await buildspace.auth.signOut(sessionToken);
- * ```
- */
-declare class AuthServerNamespace {
-    private readonly transport;
-    constructor(transport: HttpTransport);
-    /**
-     * Retrieve the session associated with a token.
-     *
-     * Returns the {@link AuthSession} if valid, or `null` if the token is
-     * expired, revoked, or invalid (401/404).
-     *
-     * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).
-     */
-    getSession(sessionToken: string): Promise<AuthSession | null>;
-    /**
-     * Exchange an OAuth authorization code for tokens.
-     *
-     * Extracts the `code` query parameter from the callback URL and exchanges
-     * it with the Buildspace API for an access token and user info.
-     *
-     * @param request - The incoming callback request. Accepts a `Request` object,
-     *   a `URL`, or a raw URL string containing the `?code=` parameter.
-     * @param opts - Optional settings.
-     * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.
-     *   Defaults to the origin + pathname of the callback URL.
-     * @returns The token response containing `access_token`, `expires_in`, and `user`.
-     *
-     * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).
-     *
-     * @example
-     * ```ts
-     * // Next.js Route Handler
-     * export async function GET(request: Request) {
-     *   const { access_token, user } = await buildspace.auth.handleCallback(request);
-     *   // Store access_token as a session cookie
-     * }
-     * ```
-     */
-    handleCallback(request: Request | URL | string, opts?: {
-        redirectUri?: string;
-    }): Promise<TokenResponse>;
-    /**
-     * Revoke a specific session token.
-     *
-     * @param sessionToken - The token to revoke.
-     * @throws {BuildspaceError} If the revocation fails.
-     */
-    revokeSession(sessionToken: string): Promise<void>;
-    /**
-     * Sign the user out by revoking the session and clearing the SDK's stored token.
-     *
-     * If the session is already expired or not found, the error is silently
-     * ignored and the local session is still cleared.
-     *
-     * @param sessionToken - Token to revoke. If omitted, uses the token
-     *   previously set via `buildspace.setSession()`.
-     */
-    signOut(sessionToken?: string): Promise<void>;
-}
-
-export { AuthServerNamespace, type AuthSession, type AuthUser, type TokenResponse };
+export { A as AuthClientNamespace, S as SignInUrlOptions, a as SignUpUrlOptions } from '../client-ByNR5EZz.js';
+export { A as AuthServerNamespace, a as AuthSession, b as AuthUser, T as TokenResponse } from '../server-Suq3tZZC.js';
+import '../http-D2gXpNpr.js';

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/client.ts","../../src/errors.ts","../../src/auth/server.ts"],"names":["forwardedHost","forwardedProto"],"mappings":";AA0CO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AACF;;;ACpFO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA;AAAA,EAEhC,IAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY;AAAA,IACV,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAKG;AACD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;;;ACDA,IAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,SAAS,CAAC,CAAA;AAC3E,IAAM,iBAAA,GAAoB,oBAAA;AAC1B,IAAM,kBAAA,GAAqB,qBAAA;AAE3B,SAAS,uBAAuB,KAAA,EAAqC;AACnE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CACG,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA;AAExB;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,IAAI,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAK,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,OAAO,cAAc,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,GAAI,IAAA;AACvD;AAEA,SAAS,cAAc,QAAA,EAA2B;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,IAAA,GAAO,GAAG,CAAA,EAAG;AAC5F,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IACZ,MAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,KAAA,CAAM,CAAC,KAAK,EAAA,IAClD,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA;AAEtC;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,MAAM,UAAA,GAAa,SAAS,WAAA,EAAY;AAExC,EAAA,OACE,cAAA,CAAe,GAAA,CAAI,UAAU,CAAA,IAC7B,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,IAC5B,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,IAC/B,cAAc,UAAU,CAAA;AAE5B;AAEA,SAAS,mBAAmB,OAAA,EAAiC;AAC3D,EAAA,MAAM,YAAY,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAMA,iBAAgB,SAAA,CAAU,KAAA,CAAM,iBAAiB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AACpE,IAAA,MAAMC,kBAAiB,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AAEtE,IAAA,IAAID,kBAAiBC,eAAAA,EAAgB;AACnC,MAAA,OAAO,CAAA,EAAGA,eAAc,CAAA,GAAA,EAAMD,cAAa,CAAA,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA;AACpF,EAAA,MAAM,iBAAiB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAEtF,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO,CAAA,EAAG,cAAc,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,SAAiC,GAAA,EAAkB;AACpF,EAAA,IAAI,EAAE,mBAAmB,OAAA,CAAA,EAAU;AACjC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,eAAA,GAAkB,mBAAmB,OAAO,CAAA;AAClD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,eAAe,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAG,IAAA,EAAK;AACrD,EAAA,IAAI,cAAc,CAAC,kBAAA,CAAmB,SAAA,CAAU,UAAU,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAO,GAAG,GAAA,CAAI,QAAQ,KAAK,UAAU,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AACrC;AAuBO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAW,YAAA,EAAmD;AAClE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAqB;AAAA,QAC/C,OAAA,EAAS,MAAA;AAAA,QACT,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,KAAoB,KAAA,CAAM,WAAW,GAAA,IAAO,KAAA,CAAM,WAAW,GAAA,CAAA,EAAM;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,cAAA,CACE,SACA,IAAA,EACwB;AACxB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,GAAA,GAAM,IAAI,IAAI,OAAO,CAAA;AAAA,IACvB,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AACjC,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,EAAM,WAAA,IAAe,yBAAA,CAA0B,SAAS,GAAG,CAAA;AAE/E,IAAA,OAAO,IAAA,CAAK,UAAU,OAAA,CAAuB;AAAA,MAC3C,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,gBAAA;AAAA,MACN,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,YAAA,EAAc;AAAA;AAChB,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,YAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,UAAU,OAAA,CAAc;AAAA,MACjC,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,kBAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,KAC5C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,YAAA,EAAsC;AAClD,IAAA,MAAM,KAAA,GAAQ,YAAA,IAAgB,IAAA,CAAK,SAAA,CAAU,eAAA,EAAgB;AAE7D,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,MAChC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IACE,EACE,KAAA,YAAiB,eAAA,IACjB,KAAA,CAAM,OAAA,KAAY,MAAA,KACjB,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA,CAAA,CAAA,EAE5C;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,UAAU,YAAA,EAAa;AAAA,IAC9B;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { HttpTransport } from \"../http\";\n\n/** Options for generating a sign-in URL. */\nexport interface SignInUrlOptions {\n  /** App slug to scope the login to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after authentication completes. */\n  redirectUri: string;\n}\n\n/** Options for generating a sign-up URL. */\nexport interface SignUpUrlOptions {\n  /** App slug to scope the registration to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after registration completes. */\n  redirectUri: string;\n}\n\n/**\n * Client-side authentication methods for generating login URLs.\n *\n * Access via `buildspace.auth` on the client SDK, or `buildspace.authClient`\n * on the server SDK when you need to generate URLs from server-side code.\n *\n * @example\n * ```ts\n * import { createClient } from \"@buildspacestudio/sdk/client\";\n *\n * const buildspace = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_KEY!);\n *\n * const signInUrl = buildspace.auth.getSignInUrl({\n *   redirectUri: \"https://yourapp.com/auth/callback\",\n * });\n *\n * // Use in a link or redirect\n * window.location.href = signInUrl;\n * ```\n */\nexport class AuthClientNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-in page.\n   *\n   * After the user authenticates, they are redirected back to `redirectUri`\n   * with a `?code=` parameter that can be exchanged for tokens via\n   * `buildspace.auth.handleCallback()` on the server.\n   *\n   * @param opts - Sign-in URL options.\n   * @returns The full sign-in URL as a string.\n   */\n  getSignInUrl(opts: SignInUrlOptions): string {\n    const url = new URL(\"/sign-in\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-up page.\n   *\n   * Works identically to {@link getSignInUrl} but directs the user to the\n   * registration flow instead.\n   *\n   * @param opts - Sign-up URL options.\n   * @returns The full sign-up URL as a string.\n   */\n  getSignUpUrl(opts: SignUpUrlOptions): string {\n    const url = new URL(\"/sign-up\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n}\n","/** Services available in the Buildspace platform. */\nexport type BuildspaceService = \"auth\" | \"events\" | \"notifications\" | \"storage\";\n\n/**\n * Error thrown by all Buildspace SDK methods on failure.\n *\n * @example\n * ```ts\n * try {\n *   await buildspace.auth.getSession(token);\n * } catch (err) {\n *   if (err instanceof BuildspaceError) {\n *     console.error(err.service, err.code, err.status, err.message);\n *   }\n * }\n * ```\n */\nexport class BuildspaceError extends Error {\n  /** Machine-readable error code, e.g. `\"auth/invalid-token\"`. */\n  readonly code: string;\n  /** Which service produced the error. */\n  readonly service: BuildspaceService;\n  /** HTTP status code from the API. */\n  readonly status: number;\n\n  constructor({\n    code,\n    message,\n    service,\n    status,\n  }: {\n    code: string;\n    message: string;\n    service: BuildspaceService;\n    status: number;\n  }) {\n    super(message);\n    this.name = \"BuildspaceError\";\n    this.code = code;\n    this.service = service;\n    this.status = status;\n  }\n}\n","import { BuildspaceError } from \"../errors\";\nimport type { HttpTransport } from \"../http\";\n\n/** A Buildspace user returned from auth endpoints. */\nexport interface AuthUser {\n  /** The user's email address. */\n  email: string;\n  /** Unique user identifier. */\n  id: string;\n  /** The user's display name, or `null` if not set. */\n  name: string | null;\n}\n\n/**\n * An active session for an authenticated user.\n *\n * Returned by {@link AuthServerNamespace.getSession}.\n */\nexport interface AuthSession {\n  /** The app this session belongs to, or `null` for platform-level sessions. */\n  appId: string | null;\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\n/**\n * Token response returned after a successful OAuth callback exchange.\n *\n * Returned by {@link AuthServerNamespace.handleCallback}.\n */\nexport interface TokenResponse {\n  /** The access token to use for authenticated requests. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Always `\"bearer\"`. */\n  token_type: \"bearer\";\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\nconst LOOPBACK_HOSTS = new Set([\"127.0.0.1\", \"localhost\", \"::1\", \"0.0.0.0\"]);\nconst FORWARDED_HOST_RE = /host=\"?([^;\"]+)\"?/i;\nconst FORWARDED_PROTO_RE = /proto=\"?([^;\"]+)\"?/i;\n\nfunction getFirstForwardedValue(value: string | null): string | null {\n  if (!value) {\n    return null;\n  }\n\n  return (\n    value\n      .split(\",\")\n      .map((part) => part.trim())\n      .find(Boolean) ?? null\n  );\n}\n\nfunction stripPort(host: string): string {\n  if (host.startsWith(\"[\") && host.includes(\"]\")) {\n    return host.slice(1, host.indexOf(\"]\"));\n  }\n\n  const colonIndex = host.indexOf(\":\");\n  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\").map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {\n    return false;\n  }\n\n  return (\n    parts[0] === 10 ||\n    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||\n    (parts[0] === 192 && parts[1] === 168)\n  );\n}\n\nfunction isInternalHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n\n  return (\n    LOOPBACK_HOSTS.has(normalized) ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\") ||\n    isPrivateIpv4(normalized)\n  );\n}\n\nfunction getForwardedOrigin(request: Request): string | null {\n  const forwarded = getFirstForwardedValue(request.headers.get(\"forwarded\"));\n  if (forwarded) {\n    const forwardedHost = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();\n    const forwardedProto = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();\n\n    if (forwardedHost && forwardedProto) {\n      return `${forwardedProto}://${forwardedHost}`;\n    }\n  }\n\n  const forwardedHost = getFirstForwardedValue(request.headers.get(\"x-forwarded-host\"));\n  const forwardedProto = getFirstForwardedValue(request.headers.get(\"x-forwarded-proto\"));\n\n  if (forwardedHost && forwardedProto) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return null;\n}\n\nfunction resolveDefaultRedirectUri(request: Request | URL | string, url: URL): string {\n  if (!(request instanceof Request)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  const forwardedOrigin = getForwardedOrigin(request);\n  if (forwardedOrigin) {\n    return `${forwardedOrigin}${url.pathname}`;\n  }\n\n  const hostHeader = request.headers.get(\"host\")?.trim();\n  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {\n    return `${url.protocol}//${hostHeader}${url.pathname}`;\n  }\n\n  if (!isInternalHostname(url.hostname)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  return `${url.origin}${url.pathname}`;\n}\n\n/**\n * Server-side authentication methods.\n *\n * Access via `buildspace.auth` on the server SDK.\n *\n * @example\n * ```ts\n * import Buildspace from \"@buildspacestudio/sdk\";\n *\n * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);\n *\n * // Handle OAuth callback\n * const tokens = await buildspace.auth.handleCallback(request);\n *\n * // Verify a session\n * const session = await buildspace.auth.getSession(sessionToken);\n *\n * // Sign out\n * await buildspace.auth.signOut(sessionToken);\n * ```\n */\nexport class AuthServerNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Retrieve the session associated with a token.\n   *\n   * Returns the {@link AuthSession} if valid, or `null` if the token is\n   * expired, revoked, or invalid (401/404).\n   *\n   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).\n   */\n  async getSession(sessionToken: string): Promise<AuthSession | null> {\n    try {\n      return await this.transport.request<AuthSession>({\n        service: \"auth\",\n        path: \"/v1/auth/session\",\n        headers: { \"X-Session-Token\": sessionToken },\n      });\n    } catch (error) {\n      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange an OAuth authorization code for tokens.\n   *\n   * Extracts the `code` query parameter from the callback URL and exchanges\n   * it with the Buildspace API for an access token and user info.\n   *\n   * @param request - The incoming callback request. Accepts a `Request` object,\n   *   a `URL`, or a raw URL string containing the `?code=` parameter.\n   * @param opts - Optional settings.\n   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.\n   *   Defaults to the origin + pathname of the callback URL.\n   * @returns The token response containing `access_token`, `expires_in`, and `user`.\n   *\n   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).\n   *\n   * @example\n   * ```ts\n   * // Next.js Route Handler\n   * export async function GET(request: Request) {\n   *   const { access_token, user } = await buildspace.auth.handleCallback(request);\n   *   // Store access_token as a session cookie\n   * }\n   * ```\n   */\n  handleCallback(\n    request: Request | URL | string,\n    opts?: { redirectUri?: string }\n  ): Promise<TokenResponse> {\n    let url: URL;\n    if (typeof request === \"string\") {\n      url = new URL(request);\n    } else if (request instanceof URL) {\n      url = request;\n    } else {\n      url = new URL(request.url);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new BuildspaceError({\n        service: \"auth\",\n        status: 400,\n        code: \"auth/missing-code\",\n        message: \"No auth code found in callback URL. Expected ?code= parameter.\",\n      });\n    }\n\n    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);\n\n    return this.transport.request<TokenResponse>({\n      service: \"auth\",\n      path: \"/v1/auth/token\",\n      method: \"POST\",\n      body: {\n        code,\n        redirect_uri: redirectUri,\n      },\n    });\n  }\n\n  /**\n   * Revoke a specific session token.\n   *\n   * @param sessionToken - The token to revoke.\n   * @throws {BuildspaceError} If the revocation fails.\n   */\n  async revokeSession(sessionToken: string): Promise<void> {\n    await this.transport.request<void>({\n      service: \"auth\",\n      path: \"/v1/auth/session\",\n      method: \"DELETE\",\n      headers: { \"X-Session-Token\": sessionToken },\n    });\n  }\n\n  /**\n   * Sign the user out by revoking the session and clearing the SDK's stored token.\n   *\n   * If the session is already expired or not found, the error is silently\n   * ignored and the local session is still cleared.\n   *\n   * @param sessionToken - Token to revoke. If omitted, uses the token\n   *   previously set via `buildspace.setSession()`.\n   */\n  async signOut(sessionToken?: string): Promise<void> {\n    const token = sessionToken ?? this.transport.getSessionToken();\n\n    try {\n      if (token) {\n        await this.revokeSession(token);\n      }\n    } catch (error) {\n      if (\n        !(\n          error instanceof BuildspaceError &&\n          error.service === \"auth\" &&\n          (error.status === 401 || error.status === 404)\n        )\n      ) {\n        throw error;\n      }\n    } finally {\n      this.transport.clearSession();\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../../src/auth/client.ts","../../src/errors.ts","../../src/auth/server.ts"],"names":["forwardedHost","forwardedProto"],"mappings":";AA0CO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,aAAa,IAAA,EAAgC;AAC3C,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,UAAU,QAAQ,CAAA;AAEvD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,IAAA,CAAK,WAAW,CAAA;AACrD,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,IAAA,CAAK,UAAU,GAAG,CAAA;AAEpD,IAAA,IAAI,KAAK,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AACF;;;ACpFO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA;AAAA,EAEhC,IAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EAET,WAAA,CAAY;AAAA,IACV,IAAA;AAAA,IACA,OAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF,EAKG;AACD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;;;ACDA,IAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,SAAS,CAAC,CAAA;AAC3E,IAAM,iBAAA,GAAoB,oBAAA;AAC1B,IAAM,kBAAA,GAAqB,qBAAA;AAE3B,SAAS,uBAAuB,KAAA,EAAqC;AACnE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CACG,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,CAAA,CACzB,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA;AAExB;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,IAAI,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,OAAO,KAAK,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AACnC,EAAA,OAAO,cAAc,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,GAAI,IAAA;AACvD;AAEA,SAAS,cAAc,QAAA,EAA2B;AAChD,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,IAAI,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,CAAC,CAAA;AAC5D,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,IAAA,GAAO,GAAG,CAAA,EAAG;AAC5F,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,KAAA,CAAM,CAAC,CAAA,KAAM,EAAA,IACZ,MAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,KAAA,CAAM,CAAC,KAAK,EAAA,IAClD,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA,IAAO,KAAA,CAAM,CAAC,CAAA,KAAM,GAAA;AAEtC;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,MAAM,UAAA,GAAa,SAAS,WAAA,EAAY;AAExC,EAAA,OACE,cAAA,CAAe,GAAA,CAAI,UAAU,CAAA,IAC7B,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,IAC5B,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,IAC/B,cAAc,UAAU,CAAA;AAE5B;AAEA,SAAS,mBAAmB,OAAA,EAAiC;AAC3D,EAAA,MAAM,YAAY,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAMA,iBAAgB,SAAA,CAAU,KAAA,CAAM,iBAAiB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AACpE,IAAA,MAAMC,kBAAiB,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,GAAG,IAAA,EAAK;AAEtE,IAAA,IAAID,kBAAiBC,eAAAA,EAAgB;AACnC,MAAA,OAAO,CAAA,EAAGA,eAAc,CAAA,GAAA,EAAMD,cAAa,CAAA,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA;AACpF,EAAA,MAAM,iBAAiB,sBAAA,CAAuB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAEtF,EAAA,IAAI,iBAAiB,cAAA,EAAgB;AACnC,IAAA,OAAO,CAAA,EAAG,cAAc,CAAA,GAAA,EAAM,aAAa,CAAA,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,SAAiC,GAAA,EAAkB;AACpF,EAAA,IAAI,EAAE,mBAAmB,OAAA,CAAA,EAAU;AACjC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,eAAA,GAAkB,mBAAmB,OAAO,CAAA;AAClD,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAA,EAAG,eAAe,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAG,IAAA,EAAK;AACrD,EAAA,IAAI,cAAc,CAAC,kBAAA,CAAmB,SAAA,CAAU,UAAU,CAAC,CAAA,EAAG;AAC5D,IAAA,OAAO,GAAG,GAAA,CAAI,QAAQ,KAAK,UAAU,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACrC,IAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,EACrC;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AACrC;AAuBO,IAAM,sBAAN,MAA0B;AAAA,EACd,SAAA;AAAA,EAEjB,YAAY,SAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,WAAW,YAAA,EAAmD;AAClE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAqB;AAAA,QAC/C,OAAA,EAAS,MAAA;AAAA,QACT,IAAA,EAAM,kBAAA;AAAA,QACN,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,OAC5C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,KAAoB,KAAA,CAAM,WAAW,GAAA,IAAO,KAAA,CAAM,WAAW,GAAA,CAAA,EAAM;AACtF,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,cAAA,CACE,SACA,IAAA,EACwB;AACxB,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,GAAA,GAAM,IAAI,IAAI,OAAO,CAAA;AAAA,IACvB,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AACjC,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,GAAA;AAAA,QACR,IAAA,EAAM,mBAAA;AAAA,QACN,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,EAAM,WAAA,IAAe,yBAAA,CAA0B,SAAS,GAAG,CAAA;AAE/E,IAAA,OAAO,IAAA,CAAK,UAAU,OAAA,CAAuB;AAAA,MAC3C,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,gBAAA;AAAA,MACN,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,YAAA,EAAc;AAAA;AAChB,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAc,YAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,UAAU,OAAA,CAAc;AAAA,MACjC,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,kBAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,EAAE,iBAAA,EAAmB,YAAA;AAAa,KAC5C,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,YAAA,EAAsC;AAClD,IAAA,MAAM,KAAA,GAAQ,YAAA,IAAgB,IAAA,CAAK,SAAA,CAAU,eAAA,EAAgB;AAE7D,IAAA,IAAI;AACF,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,MAChC;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IACE,EACE,KAAA,YAAiB,eAAA,IACjB,KAAA,CAAM,OAAA,KAAY,MAAA,KACjB,KAAA,CAAM,MAAA,KAAW,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,GAAA,CAAA,CAAA,EAE5C;AACA,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,UAAU,YAAA,EAAa;AAAA,IAC9B;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { HttpTransport } from \"../http\";\n\n/** Options for generating a sign-in URL. */\nexport interface SignInUrlOptions {\n  /** App slug to scope the login to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after authentication completes. */\n  redirectUri: string;\n}\n\n/** Options for generating a sign-up URL. */\nexport interface SignUpUrlOptions {\n  /** App slug to scope the registration to a specific creator app. */\n  appSlug?: string;\n  /** Environment to authenticate against. */\n  env?: \"dev\" | \"prod\";\n  /** URL to redirect the user to after registration completes. */\n  redirectUri: string;\n}\n\n/**\n * Client-side authentication methods for generating login URLs.\n *\n * Access via `buildspace.auth` on the client SDK, or `buildspace.authClient`\n * on the server SDK when you need to generate URLs from server-side code.\n *\n * @example\n * ```ts\n * import { createClient } from \"@buildspacestudio/sdk/client\";\n *\n * const buildspace = createClient(process.env.NEXT_PUBLIC_BUILDSPACE_KEY!);\n *\n * const signInUrl = buildspace.auth.getSignInUrl({\n *   redirectUri: \"https://yourapp.com/auth/callback\",\n * });\n *\n * // Use in a link or redirect\n * window.location.href = signInUrl;\n * ```\n */\nexport class AuthClientNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-in page.\n   *\n   * After the user authenticates, they are redirected back to `redirectUri`\n   * with a `?code=` parameter that can be exchanged for tokens via\n   * `buildspace.auth.handleCallback()` on the server.\n   *\n   * @param opts - Sign-in URL options.\n   * @returns The full sign-in URL as a string.\n   */\n  getSignInUrl(opts: SignInUrlOptions): string {\n    const url = new URL(\"/sign-in\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n\n  /**\n   * Build a URL that redirects the user to the Buildspace sign-up page.\n   *\n   * Works identically to {@link getSignInUrl} but directs the user to the\n   * registration flow instead.\n   *\n   * @param opts - Sign-up URL options.\n   * @returns The full sign-up URL as a string.\n   */\n  getSignUpUrl(opts: SignUpUrlOptions): string {\n    const url = new URL(\"/sign-up\", this.transport.loginUrl);\n\n    if (opts.appSlug) {\n      url.searchParams.set(\"app\", opts.appSlug);\n    }\n\n    url.searchParams.set(\"redirect_uri\", opts.redirectUri);\n    url.searchParams.set(\"client_id\", this.transport.key);\n\n    if (opts.env) {\n      url.searchParams.set(\"env\", opts.env);\n    }\n\n    return url.toString();\n  }\n}\n","/** Services available in the Buildspace platform. */\nexport type BuildspaceService = \"auth\" | \"billing\" | \"events\" | \"notifications\" | \"storage\";\n\n/**\n * Error thrown by all Buildspace SDK methods on failure.\n *\n * @example\n * ```ts\n * try {\n *   await buildspace.auth.getSession(token);\n * } catch (err) {\n *   if (err instanceof BuildspaceError) {\n *     console.error(err.service, err.code, err.status, err.message);\n *   }\n * }\n * ```\n */\nexport class BuildspaceError extends Error {\n  /** Machine-readable error code, e.g. `\"auth/invalid-token\"`. */\n  readonly code: string;\n  /** Which service produced the error. */\n  readonly service: BuildspaceService;\n  /** HTTP status code from the API. */\n  readonly status: number;\n\n  constructor({\n    code,\n    message,\n    service,\n    status,\n  }: {\n    code: string;\n    message: string;\n    service: BuildspaceService;\n    status: number;\n  }) {\n    super(message);\n    this.name = \"BuildspaceError\";\n    this.code = code;\n    this.service = service;\n    this.status = status;\n  }\n}\n","import { BuildspaceError } from \"../errors\";\nimport type { HttpTransport } from \"../http\";\n\n/** A Buildspace user returned from auth endpoints. */\nexport interface AuthUser {\n  /** The user's email address. */\n  email: string;\n  /** Unique user identifier. */\n  id: string;\n  /** The user's display name, or `null` if not set. */\n  name: string | null;\n}\n\n/**\n * An active session for an authenticated user.\n *\n * Returned by {@link AuthServerNamespace.getSession}.\n */\nexport interface AuthSession {\n  /** The app this session belongs to, or `null` for platform-level sessions. */\n  appId: string | null;\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\n/**\n * Token response returned after a successful OAuth callback exchange.\n *\n * Returned by {@link AuthServerNamespace.handleCallback}.\n */\nexport interface TokenResponse {\n  /** The access token to use for authenticated requests. */\n  access_token: string;\n  /** Token lifetime in seconds. */\n  expires_in: number;\n  /** Always `\"bearer\"`. */\n  token_type: \"bearer\";\n  /** The authenticated user. */\n  user: AuthUser;\n}\n\nconst LOOPBACK_HOSTS = new Set([\"127.0.0.1\", \"localhost\", \"::1\", \"0.0.0.0\"]);\nconst FORWARDED_HOST_RE = /host=\"?([^;\"]+)\"?/i;\nconst FORWARDED_PROTO_RE = /proto=\"?([^;\"]+)\"?/i;\n\nfunction getFirstForwardedValue(value: string | null): string | null {\n  if (!value) {\n    return null;\n  }\n\n  return (\n    value\n      .split(\",\")\n      .map((part) => part.trim())\n      .find(Boolean) ?? null\n  );\n}\n\nfunction stripPort(host: string): string {\n  if (host.startsWith(\"[\") && host.includes(\"]\")) {\n    return host.slice(1, host.indexOf(\"]\"));\n  }\n\n  const colonIndex = host.indexOf(\":\");\n  return colonIndex >= 0 ? host.slice(0, colonIndex) : host;\n}\n\nfunction isPrivateIpv4(hostname: string): boolean {\n  const parts = hostname.split(\".\").map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => Number.isNaN(part) || part < 0 || part > 255)) {\n    return false;\n  }\n\n  return (\n    parts[0] === 10 ||\n    (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||\n    (parts[0] === 192 && parts[1] === 168)\n  );\n}\n\nfunction isInternalHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n\n  return (\n    LOOPBACK_HOSTS.has(normalized) ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\") ||\n    isPrivateIpv4(normalized)\n  );\n}\n\nfunction getForwardedOrigin(request: Request): string | null {\n  const forwarded = getFirstForwardedValue(request.headers.get(\"forwarded\"));\n  if (forwarded) {\n    const forwardedHost = forwarded.match(FORWARDED_HOST_RE)?.[1]?.trim();\n    const forwardedProto = forwarded.match(FORWARDED_PROTO_RE)?.[1]?.trim();\n\n    if (forwardedHost && forwardedProto) {\n      return `${forwardedProto}://${forwardedHost}`;\n    }\n  }\n\n  const forwardedHost = getFirstForwardedValue(request.headers.get(\"x-forwarded-host\"));\n  const forwardedProto = getFirstForwardedValue(request.headers.get(\"x-forwarded-proto\"));\n\n  if (forwardedHost && forwardedProto) {\n    return `${forwardedProto}://${forwardedHost}`;\n  }\n\n  return null;\n}\n\nfunction resolveDefaultRedirectUri(request: Request | URL | string, url: URL): string {\n  if (!(request instanceof Request)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  const forwardedOrigin = getForwardedOrigin(request);\n  if (forwardedOrigin) {\n    return `${forwardedOrigin}${url.pathname}`;\n  }\n\n  const hostHeader = request.headers.get(\"host\")?.trim();\n  if (hostHeader && !isInternalHostname(stripPort(hostHeader))) {\n    return `${url.protocol}//${hostHeader}${url.pathname}`;\n  }\n\n  if (!isInternalHostname(url.hostname)) {\n    return `${url.origin}${url.pathname}`;\n  }\n\n  return `${url.origin}${url.pathname}`;\n}\n\n/**\n * Server-side authentication methods.\n *\n * Access via `buildspace.auth` on the server SDK.\n *\n * @example\n * ```ts\n * import Buildspace from \"@buildspacestudio/sdk\";\n *\n * const buildspace = new Buildspace(process.env.BUILDSPACE_SECRET_KEY!);\n *\n * // Handle OAuth callback\n * const tokens = await buildspace.auth.handleCallback(request);\n *\n * // Verify a session\n * const session = await buildspace.auth.getSession(sessionToken);\n *\n * // Sign out\n * await buildspace.auth.signOut(sessionToken);\n * ```\n */\nexport class AuthServerNamespace {\n  private readonly transport: HttpTransport;\n\n  constructor(transport: HttpTransport) {\n    this.transport = transport;\n  }\n\n  /**\n   * Retrieve the session associated with a token.\n   *\n   * Returns the {@link AuthSession} if valid, or `null` if the token is\n   * expired, revoked, or invalid (401/404).\n   *\n   * @throws {BuildspaceError} On unexpected server errors (5xx, network issues).\n   */\n  async getSession(sessionToken: string): Promise<AuthSession | null> {\n    try {\n      return await this.transport.request<AuthSession>({\n        service: \"auth\",\n        path: \"/v1/auth/session\",\n        headers: { \"X-Session-Token\": sessionToken },\n      });\n    } catch (error) {\n      if (error instanceof BuildspaceError && (error.status === 401 || error.status === 404)) {\n        return null;\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Exchange an OAuth authorization code for tokens.\n   *\n   * Extracts the `code` query parameter from the callback URL and exchanges\n   * it with the Buildspace API for an access token and user info.\n   *\n   * @param request - The incoming callback request. Accepts a `Request` object,\n   *   a `URL`, or a raw URL string containing the `?code=` parameter.\n   * @param opts - Optional settings.\n   * @param opts.redirectUri - Override the redirect URI sent to the token endpoint.\n   *   Defaults to the origin + pathname of the callback URL.\n   * @returns The token response containing `access_token`, `expires_in`, and `user`.\n   *\n   * @throws {BuildspaceError} If the code exchange fails (invalid code, expired, etc.).\n   *\n   * @example\n   * ```ts\n   * // Next.js Route Handler\n   * export async function GET(request: Request) {\n   *   const { access_token, user } = await buildspace.auth.handleCallback(request);\n   *   // Store access_token as a session cookie\n   * }\n   * ```\n   */\n  handleCallback(\n    request: Request | URL | string,\n    opts?: { redirectUri?: string }\n  ): Promise<TokenResponse> {\n    let url: URL;\n    if (typeof request === \"string\") {\n      url = new URL(request);\n    } else if (request instanceof URL) {\n      url = request;\n    } else {\n      url = new URL(request.url);\n    }\n\n    const code = url.searchParams.get(\"code\");\n    if (!code) {\n      throw new BuildspaceError({\n        service: \"auth\",\n        status: 400,\n        code: \"auth/missing-code\",\n        message: \"No auth code found in callback URL. Expected ?code= parameter.\",\n      });\n    }\n\n    const redirectUri = opts?.redirectUri ?? resolveDefaultRedirectUri(request, url);\n\n    return this.transport.request<TokenResponse>({\n      service: \"auth\",\n      path: \"/v1/auth/token\",\n      method: \"POST\",\n      body: {\n        code,\n        redirect_uri: redirectUri,\n      },\n    });\n  }\n\n  /**\n   * Revoke a specific session token.\n   *\n   * @param sessionToken - The token to revoke.\n   * @throws {BuildspaceError} If the revocation fails.\n   */\n  async revokeSession(sessionToken: string): Promise<void> {\n    await this.transport.request<void>({\n      service: \"auth\",\n      path: \"/v1/auth/session\",\n      method: \"DELETE\",\n      headers: { \"X-Session-Token\": sessionToken },\n    });\n  }\n\n  /**\n   * Sign the user out by revoking the session and clearing the SDK's stored token.\n   *\n   * If the session is already expired or not found, the error is silently\n   * ignored and the local session is still cleared.\n   *\n   * @param sessionToken - Token to revoke. If omitted, uses the token\n   *   previously set via `buildspace.setSession()`.\n   */\n  async signOut(sessionToken?: string): Promise<void> {\n    const token = sessionToken ?? this.transport.getSessionToken();\n\n    try {\n      if (token) {\n        await this.revokeSession(token);\n      }\n    } catch (error) {\n      if (\n        !(\n          error instanceof BuildspaceError &&\n          error.service === \"auth\" &&\n          (error.status === 401 || error.status === 404)\n        )\n      ) {\n        throw error;\n      }\n    } finally {\n      this.transport.clearSession();\n    }\n  }\n}\n"]}