@casfa/client 0.0.1

package/dist/index.js

@@ -0,0 +1,994 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/api/index.ts
+var api_exports = {};
+__export(api_exports, {
+  approveAuthRequest: () => approveAuthRequest,
+  commitDepot: () => commitDepot,
+  createAuthRequest: () => createAuthRequest,
+  createDepot: () => createDepot,
+  createTicket: () => createTicket,
+  createToken: () => createToken,
+  delegateToken: () => delegateToken,
+  deleteDepot: () => deleteDepot,
+  exchangeCode: () => exchangeCode,
+  fetchServiceInfo: () => fetchServiceInfo,
+  getAuthRequest: () => getAuthRequest,
+  getDepot: () => getDepot,
+  getMe: () => getMe,
+  getNode: () => getNode,
+  getNodeMetadata: () => getNodeMetadata,
+  getOAuthConfig: () => getOAuthConfig,
+  getTicket: () => getTicket,
+  getToken: () => getToken,
+  healthCheck: () => healthCheck,
+  listDepots: () => listDepots,
+  listTickets: () => listTickets,
+  listTokens: () => listTokens,
+  login: () => login,
+  pollAuthRequest: () => pollAuthRequest,
+  prepareNodes: () => prepareNodes,
+  putNode: () => putNode,
+  refresh: () => refresh,
+  rejectAuthRequest: () => rejectAuthRequest,
+  revokeToken: () => revokeToken,
+  submitTicket: () => submitTicket,
+  tokenResponseToStoredUserToken: () => tokenResponseToStoredUserToken,
+  updateDepot: () => updateDepot
+});
+
+// src/utils/http.ts
+var statusToErrorCode = (status) => {
+  switch (status) {
+    case 401:
+      return "UNAUTHORIZED";
+    case 403:
+      return "FORBIDDEN";
+    case 404:
+      return "NOT_FOUND";
+    case 409:
+      return "CONFLICT";
+    case 400:
+    case 422:
+      return "VALIDATION_ERROR";
+    case 429:
+      return "RATE_LIMITED";
+    default:
+      return "UNKNOWN";
+  }
+};
+var createErrorFromResponse = async (response) => {
+  const code = statusToErrorCode(response.status);
+  let message = response.statusText;
+  let details;
+  try {
+    const body = await response.json();
+    if (typeof body.message === "string") {
+      message = body.message;
+    }
+    if (typeof body.error === "string") {
+      message = body.error;
+    }
+    details = body;
+  } catch {
+  }
+  return { code, message, status: response.status, details };
+};
+var createNetworkError = (err) => ({
+  code: "NETWORK_ERROR",
+  message: err instanceof Error ? err.message : "Network request failed",
+  details: err
+});
+var fetchApi = async (url, options = {}) => {
+  const { method = "GET", headers = {}, body, responseType = "json" } = options;
+  const requestHeaders = { ...headers };
+  if (body !== void 0 && !requestHeaders["Content-Type"]) {
+    requestHeaders["Content-Type"] = "application/json";
+  }
+  try {
+    const response = await fetch(url, {
+      method,
+      headers: requestHeaders,
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    if (!response.ok) {
+      const error = await createErrorFromResponse(response);
+      return { ok: false, error };
+    }
+    let data;
+    switch (responseType) {
+      case "json":
+        data = await response.json();
+        break;
+      case "blob":
+        data = await response.blob();
+        break;
+      case "text":
+        data = await response.text();
+        break;
+      case "none":
+        data = void 0;
+        break;
+    }
+    return { ok: true, data, status: response.status };
+  } catch (err) {
+    return { ok: false, error: createNetworkError(err) };
+  }
+};
+var fetchWithAuth = async (url, authHeader, options = {}) => {
+  const headers = { ...options.headers };
+  if (authHeader) {
+    headers.Authorization = authHeader;
+  }
+  return fetchApi(url, { ...options, headers });
+};
+
+// src/api/depots.ts
+var createDepot = async (baseUrl, realm, accessTokenBase64, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+var listDepots = async (baseUrl, realm, accessTokenBase64, params) => {
+  const query = new URLSearchParams();
+  if (params?.limit) query.set("limit", String(params.limit));
+  if (params?.cursor) query.set("cursor", params.cursor);
+  const queryString = query.toString();
+  const url = `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots${queryString ? `?${queryString}` : ""}`;
+  return fetchWithAuth(url, `Bearer ${accessTokenBase64}`);
+};
+var getDepot = async (baseUrl, realm, accessTokenBase64, depotId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots/${encodeURIComponent(depotId)}`,
+    `Bearer ${accessTokenBase64}`
+  );
+};
+var updateDepot = async (baseUrl, realm, accessTokenBase64, depotId, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots/${encodeURIComponent(depotId)}`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "PATCH",
+      body: params
+    }
+  );
+};
+var deleteDepot = async (baseUrl, realm, accessTokenBase64, depotId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots/${encodeURIComponent(depotId)}`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "DELETE",
+      responseType: "none"
+    }
+  );
+};
+var commitDepot = async (baseUrl, realm, accessTokenBase64, depotId, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/depots/${encodeURIComponent(depotId)}/commit`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+
+// src/api/info.ts
+var fetchServiceInfo = async (baseUrl) => {
+  return fetchApi(`${baseUrl}/api/info`);
+};
+var healthCheck = async (baseUrl) => {
+  return fetchApi(`${baseUrl}/api/health`);
+};
+
+// src/api/nodes.ts
+var getNode = async (baseUrl, realm, accessTokenBase64, nodeKey, indexPath) => {
+  const url = `${baseUrl}/api/realm/${encodeURIComponent(realm)}/nodes/${encodeURIComponent(nodeKey)}`;
+  try {
+    const response = await fetch(url, {
+      headers: {
+        Authorization: `Bearer ${accessTokenBase64}`,
+        "X-CAS-Index-Path": indexPath
+      }
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: response.statusText }));
+      return {
+        ok: false,
+        error: {
+          code: String(response.status),
+          message: error.message ?? response.statusText,
+          status: response.status
+        }
+      };
+    }
+    const data = new Uint8Array(await response.arrayBuffer());
+    return { ok: true, data, status: response.status };
+  } catch (err) {
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : "Network error"
+      }
+    };
+  }
+};
+var getNodeMetadata = async (baseUrl, realm, accessTokenBase64, nodeKey, indexPath) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/nodes/${encodeURIComponent(nodeKey)}/metadata`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      headers: {
+        "X-CAS-Index-Path": indexPath
+      }
+    }
+  );
+};
+var prepareNodes = async (baseUrl, realm, accessTokenBase64, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/nodes/prepare`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+var putNode = async (baseUrl, realm, accessTokenBase64, nodeKey, content) => {
+  const url = `${baseUrl}/api/realm/${encodeURIComponent(realm)}/nodes/${encodeURIComponent(nodeKey)}`;
+  try {
+    const response = await fetch(url, {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${accessTokenBase64}`,
+        "Content-Type": "application/octet-stream"
+      },
+      body: content
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: response.statusText }));
+      return {
+        ok: false,
+        error: {
+          code: String(response.status),
+          message: error.message ?? response.statusText,
+          status: response.status
+        }
+      };
+    }
+    const data = await response.json();
+    return { ok: true, data, status: response.status };
+  } catch (err) {
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : "Network error"
+      }
+    };
+  }
+};
+
+// src/api/oauth.ts
+var getOAuthConfig = async (baseUrl) => {
+  return fetchApi(`${baseUrl}/api/oauth/config`);
+};
+var exchangeCode = async (baseUrl, params) => {
+  return fetchApi(`${baseUrl}/api/oauth/token`, {
+    method: "POST",
+    body: params
+  });
+};
+var login = async (baseUrl, params) => {
+  return fetchApi(`${baseUrl}/api/oauth/login`, {
+    method: "POST",
+    body: params
+  });
+};
+var refresh = async (baseUrl, params) => {
+  return fetchApi(`${baseUrl}/api/oauth/refresh`, {
+    method: "POST",
+    body: params
+  });
+};
+var getMe = async (baseUrl, userAccessToken) => {
+  return fetchWithAuth(`${baseUrl}/api/oauth/me`, `Bearer ${userAccessToken}`);
+};
+var tokenResponseToStoredUserToken = (response, userId) => ({
+  accessToken: response.accessToken,
+  refreshToken: response.refreshToken,
+  userId,
+  expiresAt: Date.now() + response.expiresIn * 1e3
+});
+
+// src/api/requests.ts
+var createAuthRequest = async (baseUrl, params) => {
+  return fetchApi(`${baseUrl}/api/tokens/requests`, {
+    method: "POST",
+    body: params
+  });
+};
+var pollAuthRequest = async (baseUrl, requestId) => {
+  return fetchApi(
+    `${baseUrl}/api/tokens/requests/${encodeURIComponent(requestId)}/poll`
+  );
+};
+var getAuthRequest = async (baseUrl, userAccessToken, requestId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/requests/${encodeURIComponent(requestId)}`,
+    `Bearer ${userAccessToken}`
+  );
+};
+var approveAuthRequest = async (baseUrl, userAccessToken, requestId, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/requests/${encodeURIComponent(requestId)}/approve`,
+    `Bearer ${userAccessToken}`,
+    {
+      method: "POST",
+      body: params ?? {}
+    }
+  );
+};
+var rejectAuthRequest = async (baseUrl, userAccessToken, requestId, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/requests/${encodeURIComponent(requestId)}/reject`,
+    `Bearer ${userAccessToken}`,
+    {
+      method: "POST",
+      body: params ?? {}
+    }
+  );
+};
+
+// src/api/tickets.ts
+var createTicket = async (baseUrl, realm, accessTokenBase64, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/tickets`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+var listTickets = async (baseUrl, realm, accessTokenBase64, params) => {
+  const query = new URLSearchParams();
+  if (params?.limit) query.set("limit", String(params.limit));
+  if (params?.cursor) query.set("cursor", params.cursor);
+  if (params?.status) query.set("status", params.status);
+  const queryString = query.toString();
+  const url = `${baseUrl}/api/realm/${encodeURIComponent(realm)}/tickets${queryString ? `?${queryString}` : ""}`;
+  return fetchWithAuth(url, `Bearer ${accessTokenBase64}`);
+};
+var getTicket = async (baseUrl, realm, accessTokenBase64, ticketId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/tickets/${encodeURIComponent(ticketId)}`,
+    `Bearer ${accessTokenBase64}`
+  );
+};
+var submitTicket = async (baseUrl, realm, accessTokenBase64, ticketId, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/realm/${encodeURIComponent(realm)}/tickets/${encodeURIComponent(ticketId)}/submit`,
+    `Bearer ${accessTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+
+// src/api/tokens.ts
+var createToken = async (baseUrl, userAccessToken, params) => {
+  return fetchWithAuth(`${baseUrl}/api/tokens`, `Bearer ${userAccessToken}`, {
+    method: "POST",
+    body: params
+  });
+};
+var listTokens = async (baseUrl, userAccessToken, params) => {
+  const query = new URLSearchParams();
+  if (params?.limit) query.set("limit", String(params.limit));
+  if (params?.cursor) query.set("cursor", params.cursor);
+  if (params?.type) query.set("type", params.type);
+  const queryString = query.toString();
+  const url = `${baseUrl}/api/tokens${queryString ? `?${queryString}` : ""}`;
+  return fetchWithAuth(url, `Bearer ${userAccessToken}`);
+};
+var getToken = async (baseUrl, userAccessToken, tokenId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/${encodeURIComponent(tokenId)}`,
+    `Bearer ${userAccessToken}`
+  );
+};
+var revokeToken = async (baseUrl, userAccessToken, tokenId) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/${encodeURIComponent(tokenId)}/revoke`,
+    `Bearer ${userAccessToken}`,
+    { method: "POST" }
+  );
+};
+var delegateToken = async (baseUrl, delegateTokenBase64, params) => {
+  return fetchWithAuth(
+    `${baseUrl}/api/tokens/delegate`,
+    `Bearer ${delegateTokenBase64}`,
+    {
+      method: "POST",
+      body: params
+    }
+  );
+};
+
+// src/store/token-checks.ts
+var DEFAULT_EXPIRY_BUFFER_MS = 6e4;
+var isTokenValid = (token, bufferMs = DEFAULT_EXPIRY_BUFFER_MS) => {
+  if (!token) return false;
+  return Date.now() + bufferMs < token.expiresAt;
+};
+var isTokenExpiringSoon = (token, windowMs = 5 * 6e4) => {
+  if (!token) return false;
+  return Date.now() + windowMs >= token.expiresAt;
+};
+var isUserTokenValid = (userToken, bufferMs) => {
+  return isTokenValid(userToken, bufferMs);
+};
+var isDelegateTokenValid = (delegateToken3, bufferMs) => {
+  return isTokenValid(delegateToken3, bufferMs);
+};
+var isAccessTokenValid = (accessToken, bufferMs) => {
+  return isTokenValid(accessToken, bufferMs);
+};
+var getMaxIssuerId = (state) => {
+  if (state.user && isUserTokenValid(state.user)) {
+    return state.user.userId;
+  }
+  if (state.delegate && isDelegateTokenValid(state.delegate)) {
+    return state.delegate.tokenId;
+  }
+  return null;
+};
+var isAccessTokenFromMaxIssuer = (state) => {
+  const accessToken = state.access;
+  if (!accessToken || !isAccessTokenValid(accessToken)) {
+    return false;
+  }
+  const maxIssuerId = getMaxIssuerId(state);
+  if (!maxIssuerId) {
+    return true;
+  }
+  return accessToken.issuerId === maxIssuerId;
+};
+var isDelegateTokenFromCurrentUser = (state) => {
+  const delegateToken3 = state.delegate;
+  const userToken = state.user;
+  if (!delegateToken3 || !isDelegateTokenValid(delegateToken3)) {
+    return false;
+  }
+  if (!userToken || !isUserTokenValid(userToken)) {
+    return true;
+  }
+  return delegateToken3.issuerId === userToken.userId;
+};
+var shouldReissueAccessToken = (state) => {
+  if (!isAccessTokenValid(state.access)) {
+    return true;
+  }
+  if (!isAccessTokenFromMaxIssuer(state)) {
+    return true;
+  }
+  return false;
+};
+var shouldReissueDelegateToken = (state) => {
+  if (!isDelegateTokenValid(state.delegate)) {
+    return true;
+  }
+  if (state.user && !isDelegateTokenFromCurrentUser(state)) {
+    return true;
+  }
+  return false;
+};
+
+// src/store/jwt-refresh.ts
+var callRefreshApi = async (baseUrl, refreshToken) => {
+  try {
+    const response = await fetch(`${baseUrl}/api/oauth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken })
+    });
+    if (!response.ok) {
+      return null;
+    }
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var createRefreshManager = (config) => {
+  const { store, baseUrl, onAuthRequired } = config;
+  let refreshPromise = null;
+  let refreshTimer = null;
+  const doRefresh = async () => {
+    const state = store.getState();
+    const userToken = state.user;
+    if (!userToken?.refreshToken) {
+      onAuthRequired?.();
+      return null;
+    }
+    const result = await callRefreshApi(baseUrl, userToken.refreshToken);
+    if (!result) {
+      store.setUser(null);
+      onAuthRequired?.();
+      return null;
+    }
+    const newUserToken = {
+      accessToken: result.accessToken,
+      refreshToken: result.refreshToken ?? userToken.refreshToken,
+      userId: userToken.userId,
+      expiresAt: Date.now() + result.expiresIn * 1e3
+    };
+    store.setUser(newUserToken);
+    return newUserToken;
+  };
+  const ensureValidUserToken = async () => {
+    const state = store.getState();
+    const userToken = state.user;
+    if (isUserTokenValid(userToken)) {
+      return userToken;
+    }
+    if (!userToken) {
+      return null;
+    }
+    if (!refreshPromise) {
+      refreshPromise = doRefresh().finally(() => {
+        refreshPromise = null;
+      });
+    }
+    return refreshPromise;
+  };
+  const scheduleProactiveRefresh = () => {
+    cancelScheduledRefresh();
+    const state = store.getState();
+    const userToken = state.user;
+    if (!userToken) return;
+    const refreshTime = userToken.expiresAt - Date.now() - 5 * 6e4;
+    if (refreshTime <= 0) {
+      ensureValidUserToken();
+      return;
+    }
+    refreshTimer = setTimeout(() => {
+      ensureValidUserToken().then((newToken) => {
+        if (newToken) {
+          scheduleProactiveRefresh();
+        }
+      });
+    }, refreshTime);
+  };
+  const cancelScheduledRefresh = () => {
+    if (refreshTimer) {
+      clearTimeout(refreshTimer);
+      refreshTimer = null;
+    }
+  };
+  return {
+    ensureValidUserToken,
+    scheduleProactiveRefresh,
+    cancelScheduledRefresh
+  };
+};
+
+// src/store/token-selector.ts
+var issueTokenWithUserJwt = async (baseUrl, userAccessToken, request) => {
+  try {
+    const response = await fetch(`${baseUrl}/api/tokens`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${userAccessToken}`
+      },
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      console.error("[TokenSelector] Failed to issue token with User JWT:", response.status);
+      return null;
+    }
+    return await response.json();
+  } catch (err) {
+    console.error("[TokenSelector] Error issuing token with User JWT:", err);
+    return null;
+  }
+};
+var delegateToken2 = async (baseUrl, delegateTokenBase64, request) => {
+  try {
+    const response = await fetch(`${baseUrl}/api/tokens/delegate`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${delegateTokenBase64}`
+      },
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      console.error("[TokenSelector] Failed to delegate token:", response.status);
+      return null;
+    }
+    return await response.json();
+  } catch (err) {
+    console.error("[TokenSelector] Error delegating token:", err);
+    return null;
+  }
+};
+var createTokenSelector = (config) => {
+  const { store, baseUrl, realm, serverInfo, defaultTokenTtl } = config;
+  const getTokenTtl = (type) => {
+    if (defaultTokenTtl) return defaultTokenTtl;
+    if (serverInfo?.limits) {
+      if (type === "delegate" && serverInfo.limits.maxDelegateTokenTtl) {
+        return serverInfo.limits.maxDelegateTokenTtl;
+      }
+      if (type === "access" && serverInfo.limits.maxAccessTokenTtl) {
+        return serverInfo.limits.maxAccessTokenTtl;
+      }
+    }
+    return type === "access" ? 3600 : 30 * 24 * 3600;
+  };
+  const ensureAccessToken = async () => {
+    const state = store.getState();
+    if (!shouldReissueAccessToken(state)) {
+      return state.access;
+    }
+    const userToken = state.user;
+    const delegateToken_ = state.delegate;
+    if (isUserTokenValid(userToken)) {
+      const result = await issueTokenWithUserJwt(baseUrl, userToken.accessToken, {
+        realm,
+        name: "auto-issued-access",
+        type: "access",
+        expiresIn: getTokenTtl("access"),
+        canUpload: true,
+        canManageDepot: true
+      });
+      if (result) {
+        const newToken = {
+          tokenId: result.tokenId,
+          tokenBase64: result.tokenBase64,
+          type: "access",
+          issuerId: result.issuerId,
+          expiresAt: result.expiresAt,
+          canUpload: result.canUpload,
+          canManageDepot: result.canManageDepot
+        };
+        store.setAccess(newToken);
+        return newToken;
+      }
+    }
+    if (isDelegateTokenValid(delegateToken_)) {
+      const result = await delegateToken2(baseUrl, delegateToken_.tokenBase64, {
+        name: "auto-issued-access",
+        type: "access",
+        expiresIn: getTokenTtl("access"),
+        canUpload: delegateToken_.canUpload,
+        canManageDepot: delegateToken_.canManageDepot
+      });
+      if (result) {
+        const newToken = {
+          tokenId: result.tokenId,
+          tokenBase64: result.tokenBase64,
+          type: "access",
+          issuerId: result.issuerId,
+          expiresAt: result.expiresAt,
+          canUpload: result.canUpload,
+          canManageDepot: result.canManageDepot
+        };
+        store.setAccess(newToken);
+        return newToken;
+      }
+    }
+    return null;
+  };
+  const ensureDelegateToken = async () => {
+    const state = store.getState();
+    if (isDelegateTokenValid(state.delegate)) {
+      return state.delegate;
+    }
+    const userToken = state.user;
+    if (!isUserTokenValid(userToken)) {
+      return null;
+    }
+    const result = await issueTokenWithUserJwt(baseUrl, userToken.accessToken, {
+      realm,
+      name: "auto-issued-delegate",
+      type: "delegate",
+      expiresIn: getTokenTtl("delegate"),
+      canUpload: true,
+      canManageDepot: true
+    });
+    if (result) {
+      const newToken = {
+        tokenId: result.tokenId,
+        tokenBase64: result.tokenBase64,
+        type: "delegate",
+        issuerId: result.issuerId,
+        expiresAt: result.expiresAt,
+        canUpload: result.canUpload,
+        canManageDepot: result.canManageDepot
+      };
+      store.setDelegate(newToken);
+      return newToken;
+    }
+    return null;
+  };
+  return {
+    ensureAccessToken,
+    ensureDelegateToken
+  };
+};
+
+// src/types/tokens.ts
+var emptyTokenState = () => ({
+  user: null,
+  delegate: null,
+  access: null
+});
+
+// src/store/token-store.ts
+var createTokenStore = (config = {}) => {
+  const { storage, onTokenChange } = config;
+  let state = emptyTokenState();
+  const notifyAndPersist = () => {
+    onTokenChange?.(state);
+    storage?.save(state).catch((err) => {
+      console.error("[TokenStore] Failed to persist state:", err);
+    });
+  };
+  return {
+    getState: () => ({ ...state }),
+    setUser: (token) => {
+      state = { ...state, user: token };
+      notifyAndPersist();
+    },
+    setDelegate: (token) => {
+      state = { ...state, delegate: token };
+      notifyAndPersist();
+    },
+    setAccess: (token) => {
+      state = { ...state, access: token };
+      notifyAndPersist();
+    },
+    clear: () => {
+      state = emptyTokenState();
+      notifyAndPersist();
+      storage?.clear().catch((err) => {
+        console.error("[TokenStore] Failed to clear storage:", err);
+      });
+    },
+    initialize: async () => {
+      if (!storage) return;
+      try {
+        const loaded = await storage.load();
+        if (loaded) {
+          state = loaded;
+        }
+      } catch (err) {
+        console.error("[TokenStore] Failed to load from storage:", err);
+      }
+    }
+  };
+};
+
+// src/client/helpers.ts
+var ERRORS = {
+  USER_REQUIRED: { code: "UNAUTHORIZED", message: "User login required" },
+  DELEGATE_REQUIRED: { code: "FORBIDDEN", message: "Delegate token required" },
+  ACCESS_REQUIRED: { code: "FORBIDDEN", message: "Access token required" }
+};
+var withToken = (getToken2, error) => {
+  return (fn) => getToken2().then(
+    (token) => token ? fn(token) : Promise.resolve({ ok: false, error })
+  );
+};
+var withUserToken = (getToken2) => withToken(getToken2, ERRORS.USER_REQUIRED);
+var withDelegateToken = (getToken2) => withToken(getToken2, ERRORS.DELEGATE_REQUIRED);
+var withAccessToken = (getToken2) => withToken(getToken2, ERRORS.ACCESS_REQUIRED);
+
+// src/client/depots.ts
+var createDepotMethods = ({ baseUrl, realm, tokenSelector }) => {
+  const requireAccess = withAccessToken(() => tokenSelector.ensureAccessToken());
+  return {
+    create: (params) => requireAccess((t) => createDepot(baseUrl, realm, t.tokenBase64, params)),
+    list: (params) => requireAccess((t) => listDepots(baseUrl, realm, t.tokenBase64, params)),
+    get: (depotId) => requireAccess((t) => getDepot(baseUrl, realm, t.tokenBase64, depotId)),
+    update: (depotId, params) => requireAccess((t) => updateDepot(baseUrl, realm, t.tokenBase64, depotId, params)),
+    delete: (depotId) => requireAccess((t) => deleteDepot(baseUrl, realm, t.tokenBase64, depotId)),
+    commit: (depotId, params) => requireAccess((t) => commitDepot(baseUrl, realm, t.tokenBase64, depotId, params))
+  };
+};
+
+// src/client/nodes.ts
+var createNodeMethods = ({ baseUrl, realm, tokenSelector }) => {
+  const requireAccess = withAccessToken(() => tokenSelector.ensureAccessToken());
+  return {
+    get: (nodeKey, indexPath) => requireAccess((t) => getNode(baseUrl, realm, t.tokenBase64, nodeKey, indexPath)),
+    getMetadata: (nodeKey, indexPath) => requireAccess((t) => getNodeMetadata(baseUrl, realm, t.tokenBase64, nodeKey, indexPath)),
+    prepare: (params) => requireAccess((t) => prepareNodes(baseUrl, realm, t.tokenBase64, params)),
+    put: (nodeKey, content) => requireAccess((t) => putNode(baseUrl, realm, t.tokenBase64, nodeKey, content))
+  };
+};
+
+// src/client/oauth.ts
+var createOAuthMethods = ({
+  baseUrl,
+  store,
+  refreshManager
+}) => ({
+  getConfig: () => getOAuthConfig(baseUrl),
+  login: async (email, password) => {
+    const result = await login(baseUrl, { email, password });
+    if (!result.ok) return result;
+    const meResult = await getMe(baseUrl, result.data.accessToken);
+    if (!meResult.ok) return meResult;
+    store.setUser(tokenResponseToStoredUserToken(result.data, meResult.data.userId));
+    refreshManager.scheduleProactiveRefresh();
+    return meResult;
+  },
+  exchangeCode: async (code, redirectUri, codeVerifier) => {
+    const result = await exchangeCode(baseUrl, {
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier
+    });
+    if (!result.ok) return result;
+    const meResult = await getMe(baseUrl, result.data.accessToken);
+    if (!meResult.ok) return meResult;
+    store.setUser(tokenResponseToStoredUserToken(result.data, meResult.data.userId));
+    refreshManager.scheduleProactiveRefresh();
+    return meResult;
+  },
+  getMe: async () => {
+    const user = await refreshManager.ensureValidUserToken();
+    if (!user) {
+      return { ok: false, error: ERRORS.USER_REQUIRED };
+    }
+    return getMe(baseUrl, user.accessToken);
+  }
+});
+
+// src/client/tickets.ts
+var createTicketMethods = ({
+  baseUrl,
+  realm,
+  tokenSelector
+}) => {
+  const requireAccess = withAccessToken(() => tokenSelector.ensureAccessToken());
+  return {
+    create: (params) => requireAccess((access) => createTicket(baseUrl, realm, access.tokenBase64, params)),
+    list: (params) => requireAccess((access) => listTickets(baseUrl, realm, access.tokenBase64, params)),
+    get: (ticketId) => requireAccess((access) => getTicket(baseUrl, realm, access.tokenBase64, ticketId)),
+    submit: (ticketId, params) => requireAccess(
+      (access) => submitTicket(baseUrl, realm, access.tokenBase64, ticketId, params)
+    )
+  };
+};
+
+// src/client/tokens.ts
+var createTokenMethods = ({
+  baseUrl,
+  realm,
+  store,
+  refreshManager,
+  tokenSelector
+}) => {
+  const requireUser = withUserToken(() => refreshManager.ensureValidUserToken());
+  const requireDelegate = withDelegateToken(() => tokenSelector.ensureDelegateToken());
+  return {
+    create: (params) => requireUser(async (user) => {
+      const result = await createToken(baseUrl, user.accessToken, params);
+      if (!result.ok) return result;
+      const newToken = toStoredToken(result.data);
+      if (params.realm === realm) {
+        if (params.type === "delegate") {
+          store.setDelegate(newToken);
+        } else {
+          store.setAccess(newToken);
+        }
+      }
+      return { ok: true, data: newToken, status: result.status };
+    }),
+    list: (params) => requireUser((user) => listTokens(baseUrl, user.accessToken, params)),
+    revoke: (tokenId) => requireUser(async (user) => {
+      const result = await revokeToken(baseUrl, user.accessToken, tokenId);
+      if (!result.ok) return { ok: false, error: result.error };
+      const state = store.getState();
+      if (state.delegate?.tokenId === tokenId) store.setDelegate(null);
+      if (state.access?.tokenId === tokenId) store.setAccess(null);
+      return { ok: true, data: void 0, status: result.status };
+    }),
+    delegate: (params) => requireDelegate(async (delegate) => {
+      const result = await delegateToken(baseUrl, delegate.tokenBase64, params);
+      if (!result.ok) return result;
+      return { ok: true, data: toStoredToken(result.data), status: result.status };
+    })
+  };
+};
+var toStoredToken = (response) => ({
+  tokenId: response.tokenId,
+  tokenBase64: response.tokenBase64,
+  type: response.type ?? "delegate",
+  issuerId: response.issuerId ?? "",
+  expiresAt: response.expiresAt,
+  canUpload: response.canUpload ?? false,
+  canManageDepot: response.canManageDepot ?? false
+});
+
+// src/client/index.ts
+var createClient = async (config) => {
+  const { baseUrl, realm, tokenStorage, onTokenChange, onAuthRequired, defaultTokenTtl } = config;
+  const store = createTokenStore({
+    storage: tokenStorage,
+    onTokenChange,
+    onAuthRequired
+  });
+  await store.initialize();
+  const refreshManager = createRefreshManager({
+    store,
+    baseUrl,
+    onAuthRequired
+  });
+  let serverInfo = null;
+  const infoResult = await fetchServiceInfo(baseUrl);
+  if (infoResult.ok) {
+    serverInfo = infoResult.data;
+  }
+  const tokenSelector = createTokenSelector({
+    store,
+    baseUrl,
+    realm,
+    serverInfo,
+    defaultTokenTtl
+  });
+  const deps = { baseUrl, realm, store, refreshManager, tokenSelector };
+  return {
+    getState: () => store.getState(),
+    getServerInfo: () => serverInfo,
+    setDelegateToken: (token) => store.setDelegate(token),
+    setAccessToken: (token) => store.setAccess(token),
+    logout: () => {
+      refreshManager.cancelScheduledRefresh();
+      store.clear();
+    },
+    oauth: createOAuthMethods(deps),
+    tokens: createTokenMethods(deps),
+    tickets: createTicketMethods(deps),
+    depots: createDepotMethods(deps),
+    nodes: createNodeMethods(deps)
+  };
+};
+export {
+  DEFAULT_EXPIRY_BUFFER_MS,
+  api_exports as api,
+  createClient,
+  createRefreshManager,
+  createTokenSelector,
+  createTokenStore,
+  emptyTokenState,
+  getMaxIssuerId,
+  isAccessTokenFromMaxIssuer,
+  isAccessTokenValid,
+  isDelegateTokenFromCurrentUser,
+  isDelegateTokenValid,
+  isTokenExpiringSoon,
+  isTokenValid,
+  isUserTokenValid,
+  shouldReissueAccessToken,
+  shouldReissueDelegateToken
+};
+//# sourceMappingURL=index.js.map