@cboxdk/id-js 0.17.0 → 0.19.0

package/README.md

@@ -196,6 +196,29 @@ if (organization(user)?.role === 'owner') showBilling();
 Matching is exact — `invoices:*` does not grant `invoices:delete`. An `org_role` this SDK
 version does not recognise reads as `null`, never as a tier it would have to guess.
 
+### Feature flags
+
+Request the `feature_flags` scope (and give the app that scope on its Scopes tab) and the
+tokens and UserInfo carry the keys of every flag that is on for the person, in the
+organization they signed in to:
+
+```ts
+import { CboxIdClient, FEATURE_FLAGS_SCOPE, hasFeature } from '@cboxdk/id-js';
+
+const client = new CboxIdClient({ ...config, scopes: ['openid', 'profile', 'email', FEATURE_FLAGS_SCOPE] });
+
+user.featureFlags;                 // ['acme-beta', 'new-dashboard'] | null
+if (hasFeature(user, 'new-dashboard')) showNewDashboard();
+hasFeature(accessTokenPayload, 'billing.v2'); // works on a verified claim set too
+```
+
+`null` means the claim is absent — the scope was not requested — and `[]` means nothing is
+on. Either way `hasFeature()` is `false`: a missing scope turns every feature off, never on.
+A token carries the flags as they were when it was issued; the next refresh picks up a
+change. To ask without a token in hand (a job, a webhook handler), use
+`env.featureFlags.evaluate({ user_id, organization_id })` from the
+[Management API](#management-api).
+
 ### Support sessions
 
 A staff member can act as one of your users for a limited time (at most an hour, no refresh
@@ -266,7 +289,10 @@ const frontend = new CboxIdFrontend({
 })
 
 const config = await frontend.config()
-// → endpoints, social buttons, and the customer's theme
+// → endpoints, social buttons, which methods are on, and the customer's theme
+
+// The buttons one organization's hosted page shows (by id or slug):
+const acme = await frontend.config({ organization: 'acme' })
 
 const { user } = await frontend.session(accessToken)
 // → { id, email, name } or null
@@ -355,6 +381,22 @@ if (result.status === 'mfa_required' || result.status === 'otp_required') {
 }
 ```
 
+`mfa_required` also lists the `factors` the person can answer with — `'totp'`, `'sms'`,
+`'recovery_code'` (kinds only, never the number; absent from instances older than
+laravel-id 1.24). For a texted code, send it when the person asks, then submit it as
+`'sms'`:
+
+```ts
+if (result.status === 'mfa_required' && result.factors?.includes('sms')) {
+  // On "Text me a code" — never on page load: each send spends one of the token's five attempts.
+  const sent = await frontend.sendSmsCode(result.mfaToken)
+  if (sent.status === 'sent') showCodeField(`We texted ${sent.to}`) // '+45 ******78'
+  if (sent.status === 'rate_limited') showRetry(sent.retryAfter)
+  // later:
+  const done = await frontend.submitSecondFactor(result.mfaToken, code, 'sms')
+}
+```
+
 ### Passkeys
 
 ```ts
@@ -506,6 +548,26 @@ const ok = await verifyWebhook({
 });
 ```
 
+### Standard Webhooks
+
+An endpoint registered with `signature_scheme: 'standard_webhooks'` (or switched with
+`env.webhooks.signatureScheme.change(id, { signature_scheme: 'standard_webhooks' })`) is
+signed the [Standard Webhooks](https://www.standardwebhooks.com/) way: `webhook-id`,
+`webhook-timestamp` and `webhook-signature`. Verify it with `verifyStandardWebhook`:
+
+```ts
+import { verifyStandardWebhook } from '@cboxdk/id-js';
+
+const ok = await verifyStandardWebhook({
+  payload: rawBody,            // the exact bytes received
+  headers: request.headers,    // a Headers object or a plain record
+  secret: process.env.CBOX_ID_WEBHOOK_SECRET!, // whsec_…, or the endpoint's old 64-hex secret
+});
+```
+
+It accepts any valid `v1` signature among several (sent while a secret rotates), uses the same
+5-minute freshness window, and never throws.
+
 ## Token Vault
 
 Broker downstream credentials (API keys for OpenAI, GitHub, …) through the instance's
@@ -526,6 +588,33 @@ const lease = await agent.lease(secret.id, 'call openai');
 
 A lease with no live grant is refused — the vault is deny-by-default.
 
+### Pipes: a person's own GitHub, Google, Slack… token
+
+When a person has connected their account at a provider, lease a fresh access token for it
+with a `vault.lease` token. Cbox ID refreshes it first when it is about to expire:
+
+```ts
+import { PipeNotConnectedError, PipeReauthorizationRequiredError, PipeTemporarilyUnavailableError } from '@cboxdk/id-js';
+
+const vault = client.vault(await client.machineToken({ scopes: ['vault.lease'] }));
+
+try {
+  const { accessToken } = await vault.leasePipeToken('github', { userId, purpose: 'list-repos' });
+  // call https://api.github.com/user/repos with it, then drop it
+} catch (e) {
+  if (e instanceof PipeNotConnectedError || e instanceof PipeReauthorizationRequiredError) {
+    return redirect(e.connectUrlWith({ clientId, returnTo: 'https://app.acme.com/settings' }));
+  }
+  if (e instanceof PipeTemporarilyUnavailableError) return retryLater(e.retryAfter);
+  throw e; // PipeLeaseDeniedError: the app is not granted this pipe
+}
+```
+
+With a token issued for the person (they signed in to your app), leave `userId` out. To
+send somebody to connect before any lease, `client.pipeConnectUrl('github', returnTo)` is
+the hosted connect page, preselected to your app; they come back with
+`?provider=github&status=connected` (or `cancelled`, `failed`).
+
 ## Roles & permissions (federated RBAC)
 
 Declare your app's authorization **roles** and **permissions** in code, then push them
@@ -600,6 +689,228 @@ the manifest to `{issuer}/api/v1/apps/manifest`. It is a server-side operation
 your `clientSecret` off the browser. The wire format matches the PHP SDK
 (`cboxdk/laravel-id-client`), so any SDK can publish the same catalog.
 
+## Management API
+
+`@cboxdk/id-js/management` is a typed client for Cbox ID's management planes. It is
+generated from the OpenAPI documents the server publishes, so every method, path, scope and
+type matches the server you generated it from. Use it from server code only: every client
+holds a management credential.
+
+| Client | Plane | Credential | `baseUrl` |
+| --- | --- | --- | --- |
+| `EnvironmentClient` | One environment's tenancy: organizations, users, apps, roles, SSO, audit logs… | `cbid_env_…` key, or a delegated access token | The environment's own host, or the platform root with `environment` |
+| `WorkspaceClient` | The workspace above its environments: projects, environments, team, keys | `cbid_ws_…` key, or a person's root token | `https://api.cboxid.com` (default) |
+| `PlatformClient` | The deployment itself, for operators | Delegated operator token only | `https://api.cboxid.com` (default) |
+| `AccountClient` | A person's own account | Delegated token only | The environment's own host |
+
+Method names are the server's action names: `apps.secrets.rotate` is
+`env.apps.secrets.rotate(...)`, and `sso.connections.require_sso` is
+`env.sso.connections.requireSso(...)`. Path parameters come first, in path order, then the body
+(or the query, for a read), then per-call options. Every call resolves to
+`{ data, meta, body, status, replayed, idempotencyKey, requestId, headers }`.
+
+### Create an app and rotate its secret
+
+```ts
+import { EnvironmentClient, CboxIdApiError, ApprovalDeniedError } from '@cboxdk/id-js/management';
+
+const env = new EnvironmentClient({
+  baseUrl: 'https://acme.cboxid.com',
+  apiKey: process.env.CBOX_ID_ENV_KEY!, // cbid_env_…
+  onApprovalRequired: (approval, { action }) => {
+    console.log(`Approve ${action} on your device. Code: ${approval.binding_code}`);
+  },
+});
+
+const { data: app } = await env.apps.create({
+  name: 'Billing',
+  type: 'web',
+  redirect_uris: ['https://billing.acme.com/callback'],
+});
+// app.client_secret is in this response and in no other. Store it now.
+
+try {
+  const { data: secret } = await env.apps.secrets.rotate(app.id, { grace_seconds: 3600 });
+  // secret.client_secret: the new secret, shown once.
+} catch (e) {
+  if (e instanceof ApprovalDeniedError) console.log('Rotation was declined.');
+  else if (e instanceof CboxIdApiError && e.isValidationError) console.log(e.errors);
+  else throw e;
+}
+```
+
+When a key's policy holds an action for a person's approval, the server answers
+`202 approval_required`. By default the client calls `onApprovalRequired` (show the
+`binding_code` so the person can match it on their device), polls the approval, and repeats the
+request with `Cbox-Approval: <id>` and the same `Idempotency-Key` once it is approved.
+`ApprovalDeniedError` and `ApprovalExpiredError` are thrown when it is denied or expires. If you
+do not want to wait in the same call, pass `{ approval: 'return' }`:
+
+```ts
+const outcome = await env.apps.secrets.rotate(app.id, { grace_seconds: 0 }, { approval: 'return' });
+if (outcome.pending) {
+  console.log(`Code: ${outcome.approval.binding_code}`);
+  const { data } = await outcome.resume(); // polls, then repeats the request
+}
+```
+
+### Bootstrap an environment from a workspace key
+
+```ts
+import { WorkspaceClient, EnvironmentClient } from '@cboxdk/id-js/management';
+
+const workspace = new WorkspaceClient({ apiKey: process.env.CBOX_ID_WS_KEY! }); // cbid_ws_…
+
+const { data: created } = await workspace.environments.create({
+  name: 'Staging',
+  type: 'sandbox',
+  initial_key: { name: 'bootstrap', scopes: ['apps:write', 'organizations:write'] },
+});
+
+// The first management key, returned once. On an idempotent replay it is null.
+const env = new EnvironmentClient({ baseUrl: created!.issuer!, apiKey: created!.initial_key!.token! });
+await env.organizations.create({ name: 'Acme', slug: 'acme' });
+```
+
+### Idempotency, retries and errors
+
+- Every `POST`, `PUT`, `PATCH` and `DELETE` sends an `Idempotency-Key`, a fresh UUID unless you
+  pass `{ idempotencyKey }`. Network failures, `5xx`, `429` and `409 idempotency_in_progress` are
+  retried with the **same** key (`retry: { maxRetries, baseDelayMs, maxDelayMs }`; default 3
+  retries). `Retry-After` is respected; one longer than `maxDelayMs` is thrown instead of waited
+  out. `replayed` is `true` when the server returned the first request's stored answer
+  (`Idempotent-Replayed`). A secret in a replayed answer is `null`.
+- A failed call throws `CboxIdApiError` with `status`, `error` (the stable code), `message`,
+  `errors` (field-keyed, on `validation_failed`), `requestId` (the envelope's `request_id`,
+  else the `X-Request-Id` header; quote it when reporting a problem) and `retryAfter`. A call that never
+  got an answer throws `ManagementNetworkError`, which carries the `idempotencyKey` so you can
+  repeat the request safely.
+- The client never logs. Secrets in responses are returned as they arrive, and request bodies
+  are never put in an error.
+
+### One token for every environment
+
+A person's access token issued at the platform root reaches the workspace, account and
+operator planes there, and any environment of their workspace when the request names it with
+`Cbox-Environment`. Pass `environment` (an id or slug) and the root host as `baseUrl`:
+
+```ts
+const staging = new EnvironmentClient({
+  baseUrl: 'https://api.cboxid.com',
+  accessToken: () => tokens.current(), // the person's root token
+  environment: 'acme-staging',         // sent as Cbox-Environment on every request
+});
+await staging.organizations.portalLinks.create(orgId, { intents: ['sso', 'dsync'] });
+```
+
+What the token may do there is bounded by the person's role and the token's scopes. A
+`cbid_env_…` key is bound to its own environment's host, so `environment` is refused with one.
+
+### Lists
+
+Every paged list also has an `…All` variant that iterates every item, fetching pages as you
+reach them. It follows `meta.next_cursor` on the environment plane and `meta.next_page` on the
+workspace plane:
+
+```ts
+for await (const org of env.organizations.listAll({ status: 'active' })) {
+  console.log(org.id, org.name);
+}
+```
+
+### Fine-grained authorization
+
+`env.fga.*` writes relationship tuples and asks checks. Every write answers with a
+`consistency_token`; pass it to a check that must see the write:
+
+```ts
+import { fgaTuple } from '@cboxdk/id-js/management';
+
+const { data: written } = await env.fga.tuples.write({
+  tuples: [{ resource_type: 'document', resource_id: 'leave', relation: 'viewer', subject: { type: 'user', id: 'alice' } }],
+});
+
+const { data } = await env.fga.check({
+  resource_type: 'document', resource_id: 'leave', relation: 'viewer',
+  subject_type: 'user', subject_id: 'alice',
+  consistency_token: written.consistency_token,
+});
+
+// Up to 100 at once, in the tuple notation, answered in order:
+await env.fga.checkBatch({ checks: ['document:leave#viewer@user:alice', 'document:readme#editor@user:alice'] });
+```
+
+`env.fga.tuples.delete()`, `env.fga.resources.list()` (which documents can alice view),
+`env.fga.subjects.list()` (who can view this one), and `env.fga.schema.get()` /
+`.update()` / `.validate()` complete it. `fgaTuple()` writes the notation from the same
+object `tuples.write` takes.
+
+### Audit Logs
+
+Your app records what its users did, per organization (your customer), and Cbox ID keeps
+each organization's events in a tamper-evident hash chain. `AuditLogger` buffers events and
+sends them in batches of up to 100, each batch under its own `Idempotency-Key`. It sends a
+batch when it is full, every `flushIntervalMs` (default 5 s), and on `flush()` / `close()`. A
+batch that fails stays queued with the same key, so sending it again never records an event
+twice:
+
+```ts
+import { AuditLogger, exportAuditLogs, verifyAuditLogChain } from '@cboxdk/id-js/management';
+
+const audit = new AuditLogger(env, { onError: (e) => console.error('audit flush failed', e) });
+
+audit.record({
+  organization_id: org.id,
+  action: 'invoice.voided',
+  actor: { id: user.id, type: 'user', name: user.name },
+  targets: [{ id: invoice.id, type: 'invoice' }],
+  context: { location: request.ip, user_agent: request.headers['user-agent'] },
+  metadata: { reason: 'duplicate' },
+}); // occurred_at defaults to now
+
+await audit.close(); // on shutdown: stop the timer and send what is left
+```
+
+Read events with `env.auditLogs.events.listAll({ organization_id, actions, range_start })`.
+To get a CSV, `exportAuditLogs(env, filters)` starts an export and polls it until it is ready.
+Its `url` is signed and short-lived. To check the chain yourself instead of trusting the
+server's `env.auditLogs.verify()`, call `verifyAuditLogChain(env, { organization_id })` or
+`verifyAuditChain(events)`. They recompute `sha256(prev_hash + canonical JSON)` exactly as
+the server does: keys sorted at every depth, and slashes and Unicode unescaped. They report
+`{ valid, reason, broken_at_sequence, … }`. Keep floats out of metadata you want to verify:
+`1.0` and `1` arrive as the same JavaScript number.
+
+### Delegated tokens and DPoP
+
+Pass `accessToken` (a string, or a function that is called before every request so it can
+refresh) instead of `apiKey`. For a DPoP-bound token, pass a signer built from the key pair the
+token was bound to:
+
+```ts
+import { AccountClient, createDPoPSigner } from '@cboxdk/id-js/management';
+
+const me = new AccountClient({
+  baseUrl: 'https://acme.cboxid.com',
+  accessToken: () => tokens.current(),
+  dpop: await createDPoPSigner(keyPair), // ES256, WebCrypto
+});
+await me.sessions.revokeOthers();
+```
+
+### Types, metadata and regenerating
+
+Schema and operation types are exported per plane as namespaces (`EnvironmentApi.App`,
+`WorkspaceApi.EnvironmentsCreateBody`). The operation tables (`environmentOperations`, …) list
+each action's method, path, scope, danger and whether it can be held for approval, which is
+useful for showing a confirmation before a `critical` action. `env.request(method, path, input)`
+calls a route that is not generated.
+
+The specs are vendored in `openapi/`. `npm run generate` (Node 22.6 or later) regenerates
+`src/management/generated/` from them, and
+`npm run generate -- --fetch environment=https://acme.cboxid.com` (or `workspace=`, `platform=`,
+`account=`, `all=`) refreshes a vendored spec from a running server first. The test suite fails
+when the generated code and the vendored specs disagree.
+
 ## Security & scope
 
 Login is hardened by default — PKCE, `state`, nonce, and full `id_token` verification
@@ -607,8 +918,9 @@ Login is hardened by default — PKCE, `state`, nonce, and full `id_token` verif
 freshness window. Keep `clientSecret` and webhook secrets server-side.
 
 This is a **client**. It authenticates users and calls a Cbox ID instance's standard
-endpoints; it does not configure SSO, run SCIM, or manage organizations — those are
-platform capabilities of [`cboxdk/laravel-id`](https://github.com/cboxdk/laravel-id).
+endpoints. The management planes (organizations, apps, SSO, keys…) are reached through
+[`@cboxdk/id-js/management`](#management-api), which only calls the instance's published API;
+the capabilities themselves live in [`cboxdk/laravel-id`](https://github.com/cboxdk/laravel-id).
 
 Report vulnerabilities via this repo's GitHub **Private Vulnerability Reporting**.
 

package/dist/{chunk-WYTGLCMF.js → chunk-2E25IPBA.js}

@@ -1,4 +1,5 @@
-import { ConfigurationError, assertSecureIssuer, AuthenticationError, oauthError } from './chunk-ASOQN47M.js';
+import { assertSecureIssuer } from './chunk-QQW63PGU.js';
+import { ConfigurationError, AuthenticationError, oauthError } from './chunk-SEUD4TE4.js';
 
 // src/api-keys.ts
 var MAX_API_KEY_CACHE_TTL_MS = 6e4;
@@ -150,5 +151,5 @@ async function digest(key) {
 }
 
 export { ApiKeyVerifier, MAX_API_KEY_CACHE_TTL_MS };
-//# sourceMappingURL=chunk-WYTGLCMF.js.map
-//# sourceMappingURL=chunk-WYTGLCMF.js.map
+//# sourceMappingURL=chunk-2E25IPBA.js.map
+//# sourceMappingURL=chunk-2E25IPBA.js.map

package/dist/chunk-2E25IPBA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-keys.ts"],"names":[],"mappings":";;;;AAoEO,IAAM,wBAAA,GAA2B;AAGxC,IAAM,iBAAA,GAAoB,GAAA;AAE1B,IAAM,kBAAA,uBAA8C,GAAA,CAAsB;AAAA,EACxE,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAqBM,IAAM,iBAAN,MAAqB;AAAA,EAM1B,YAA6B,MAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAG3B,IAAA,IAAI,OAAQ,UAAA,CAAsC,QAAA,KAAa,WAAA,EAAa;AAC1E,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,OAAO,MAAA,IAAU,CAAC,OAAO,QAAA,IAAY,CAAC,OAAO,YAAA,EAAc;AAC9D,MAAA,MAAM,IAAI,mBAAmB,6DAA6D,CAAA;AAAA,IAC5F;AACA,IAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAEhC,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,CAAA;AACxC,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,UAAU,KAAK,UAAA,GAAa,CAAA,IAAK,aAAa,wBAAA,EAA0B;AAC3F,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,oCAAoC,wBAAwB,CAAA,4DAAA;AAAA,OAC9D;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,WAAW,CAAA,EAAG,MAAA,CAAO,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,sBAAA,CAAA;AACnD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAAA,EACpB;AAAA,EAvB6B,MAAA;AAAA,EALZ,QAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAqD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoClF,MAAM,aAAa,GAAA,EAA0C;AAC3D,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAChD,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,UAAA,GAAa,IAAI,MAAM,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA;AAC3D,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACnC,MAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,GAAQ,IAAA,CAAK,KAAI,EAAG;AACjC,QAAA,OAAO,GAAA,CAAI,MAAA;AAAA,MACb;AACA,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,QAAQ,CAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAEjD,IAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,MAAA,CAAO,MAAA,EAAQ;AACtC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,MAAM,CAAA;AAAA,IAChC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,GAAA,EAA+B;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU;AAAA,QACpC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA;AAAA,UACnF,MAAA,EAAQ,kBAAA;AAAA,UACR,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,KAAK,CAAA;AAAA,QACjC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,6BAA6B,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,EACzC;AAAA,EAEQ,MAAM,IAAA,EAAmC;AAC/C,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AAC7C,MAAA,MAAM,IAAI,oBAAoB,iEAAiE,CAAA;AAAA,IACjG;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA;AAGf,IAAA,IAAI,MAAA,CAAO,QAAQ,CAAA,KAAM,IAAA,EAAM;AAC7B,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,OAAO,WAAW,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,OAAO,YAAY,CAAA;AACrC,IAAA,MAAM,WAAA,GAAc,OAAO,aAAa,CAAA;AAExC,IAAA,IACE,CAAC,QAAA,CAAS,KAAK,CAAA,IACf,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,QAAQ,CAAA,IAClB,CAAC,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,IACzB,SAAA,KAAc,IAAA,IAAQ,SAAA,KAAc,MAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EACvE;AACA,MAAA,MAAM,IAAI,oBAAoB,6EAA6E,CAAA;AAAA,IAC7G;AAMA,IAAA,IAAI,QAAA,KAAa,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,yCAAA,EAA4C,QAAQ,CAAA,gBAAA,EAAmB,IAAA,CAAK,OAAO,QAAQ,CAAA,eAAA;AAAA,OAC7F;AAAA,IACF;AAGA,IAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnC,MAAA,IAAI,OAAO,KAAA,CAAM,MAAM,KAAK,MAAA,IAAU,IAAA,CAAK,KAAI,EAAG;AAChD,QAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,MACzB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,OAAO,UAAU,CAAA;AAE9B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,GAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAA,EAAU,OAAO,IAAA,KAAS,QAAA,IAAY,mBAAmB,GAAA,CAAI,IAAI,IAAK,IAAA,GAA4B,IAAA;AAAA,MAClG,aAAa,WAAA,CAAY,MAAA,CAAO,CAAC,KAAA,KAA2B,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,MAC3E,SAAA,EAAW,QAAA;AAAA,MACX,UAAA,EAAY,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,GAAY;AAAA,KAC1D;AAAA,EACF;AAAA,EAEQ,QAAA,CAAS,UAAkB,MAAA,EAA4B;AAC7D,IAAA,MAAM,MAAA,GAAS,OAAO,UAAA,KAAe,IAAA,GAAO,OAAO,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACnG,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,CAAI,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,YAAY,MAAM,CAAA;AAE3D,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,IAAA,IAAQ,iBAAA,EAAmB;AACxC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,IAAA,EAAK;AACtC,MAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,QAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,MAChC;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,QAAA,EAAU,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5C;AACF;AAEA,SAAS,SAAS,KAAA,EAAiC;AACjD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA;AAChD;AAGA,eAAe,OAAO,GAAA,EAA8B;AAClD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA;AACjF,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,WAAW,KAAK,CAAA,EAAG,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAChG","file":"chunk-2E25IPBA.js","sourcesContent":["import type { OrganizationRole } from './claims.js';\nimport { AuthenticationError, ConfigurationError, oauthError } from './errors.js';\nimport { assertSecureIssuer } from './issuer.js';\n\n/**\n * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active\n * member of `org`.\n *\n * The field names are the endpoint's own, so the claim helpers read it like a token —\n * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type\n * alias rather than an interface for that reason: only an alias is assignable to the\n * helpers' record type.)\n */\nexport type ActiveApiKey = {\n  active: true;\n  /** The key's id — log this, never the key. */\n  key_id: string;\n  /** The person who holds the key (their subject id). */\n  sub: string;\n  /** The organization the key acts in. */\n  org: string;\n  /** The holder's membership tier in `org`; null for a tier this SDK does not know. */\n  org_role: OrganizationRole | null;\n  /**\n   * What the key may do, already re-capped by Cbox ID: the key's own list intersected\n   * with what the holder holds for your app right now. A demoted holder's key loses the\n   * permission on the next verification, not at the next reissue.\n   */\n  permissions: string[];\n  /** Your app's client id — always, or the answer is refused. */\n  client_id: string;\n  /** ISO 8601 UTC expiry, or null for a key that does not expire. */\n  expires_at: string | null;\n};\n\n/**\n * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who\n * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and\n * neither does this.\n */\nexport interface InactiveApiKey {\n  active: false;\n}\n\n/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */\nexport type ApiKeyVerification = ActiveApiKey | InactiveApiKey;\n\n/** Configuration for an {@link ApiKeyVerifier}. */\nexport interface ApiKeyVerifierConfig {\n  /** Base URL (issuer) of the Cbox ID instance. */\n  issuer: string;\n  /** Your app's OAuth client id — the app the keys were issued for. */\n  clientId: string;\n  /** Your app's client secret. Verification is a confidential-client call. */\n  clientSecret: string;\n  /** Timeout (ms) for the verification request. Defaults to `10000`. */\n  timeoutMs?: number;\n  /**\n   * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs\n   * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:\n   * while an answer is cached, a revoked key keeps working, and a demoted holder keeps\n   * the permissions they lost. Never cached past the key's `expires_at`. Refusals are\n   * never cached, so a key issued a moment ago works on its first request.\n   */\n  cacheTtlMs?: number;\n}\n\n/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */\nexport const MAX_API_KEY_CACHE_TTL_MS = 60_000;\n\n/** Enough for a busy API's working set; oldest entries go first beyond it. */\nconst MAX_CACHE_ENTRIES = 1_000;\n\nconst ORGANIZATION_ROLES: ReadonlySet<string> = new Set<OrganizationRole>([\n  'owner',\n  'admin',\n  'developer',\n  'member',\n  'viewer',\n]);\n\n/**\n * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,\n * authenticated with your app's own client credentials.\n *\n * SERVER-SIDE ONLY. It holds your client secret, so it lives in the\n * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a\n * browser bundle pulls in — and it refuses to be constructed in a browser at all.\n *\n * ```ts\n * import { ApiKeyVerifier } from '@cboxdk/id-js/server';\n * import { hasPermission } from '@cboxdk/id-js';\n *\n * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });\n *\n * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');\n * if (!answer.active) return unauthorized();\n * if (!hasPermission(answer, 'invoices:create')) return forbidden();\n * ```\n */\nexport class ApiKeyVerifier {\n  private readonly endpoint: string;\n  private readonly timeoutMs: number;\n  private readonly cacheTtlMs: number;\n  private readonly cache = new Map<string, { answer: ActiveApiKey; until: number }>();\n\n  constructor(private readonly config: ApiKeyVerifierConfig) {\n    // A heuristic, and enough of one: a page has a `document`, and no server runtime\n    // this SDK supports (Node, Deno, Bun, edge workers) defines one.\n    if (typeof (globalThis as { document?: unknown }).document !== 'undefined') {\n      throw new ConfigurationError(\n        'API key verification uses your client secret and must run on your server, never in a browser.',\n      );\n    }\n    if (!config.issuer || !config.clientId || !config.clientSecret) {\n      throw new ConfigurationError('Verifying API keys needs issuer, clientId and clientSecret.');\n    }\n    assertSecureIssuer(config.issuer);\n\n    const cacheTtlMs = config.cacheTtlMs ?? 0;\n    if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0 || cacheTtlMs > MAX_API_KEY_CACHE_TTL_MS) {\n      throw new ConfigurationError(\n        `cacheTtlMs must be between 0 and ${MAX_API_KEY_CACHE_TTL_MS}: a cached answer keeps a revoked key working for that long.`,\n      );\n    }\n\n    this.endpoint = `${config.issuer.replace(/\\/$/, '')}/oauth/api-keys/verify`;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.cacheTtlMs = cacheTtlMs;\n  }\n\n  /**\n   * Ask Cbox ID whether `key` is good for this app, and what it may do.\n   *\n   * Resolves `{ active: false }` for every kind of bad key, without a request for an empty\n   * one. Throws `AuthenticationError` when the call itself fails (wrong client\n   * credentials, an unreachable instance) or when the answer cannot be trusted — one that\n   * names another app's `client_id`, or does not have the promised shape. Both mean \"do\n   * not let this request in\"; the difference is that a throw is something to look at.\n   */\n  async verifyApiKey(key: string): Promise<ApiKeyVerification> {\n    if (typeof key !== 'string' || key.trim() === '') {\n      return { active: false };\n    }\n\n    const cacheKey = this.cacheTtlMs > 0 ? await digest(key) : null;\n    if (cacheKey !== null) {\n      const hit = this.cache.get(cacheKey);\n      if (hit && hit.until > Date.now()) {\n        return hit.answer;\n      }\n      this.cache.delete(cacheKey);\n    }\n\n    const answer = this.parse(await this.request(key));\n\n    if (cacheKey !== null && answer.active) {\n      this.remember(cacheKey, answer);\n    }\n\n    return answer;\n  }\n\n  private async request(key: string): Promise<unknown> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await fetch(this.endpoint, {\n        method: 'POST',\n        headers: {\n          authorization: `Basic ${btoa(`${this.config.clientId}:${this.config.clientSecret}`)}`,\n          accept: 'application/json',\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({ key }),\n        signal: controller.signal,\n      });\n    } catch (error) {\n      throw new AuthenticationError(`API key verification request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      throw await oauthError(response, 'API key verification failed');\n    }\n\n    return response.json().catch(() => null);\n  }\n\n  private parse(body: unknown): ApiKeyVerification {\n    if (typeof body !== 'object' || body === null) {\n      throw new AuthenticationError('API key verification returned a body that is not a JSON object.');\n    }\n\n    const record = body as Record<string, unknown>;\n\n    // Only a literal `true` lets anybody in.\n    if (record['active'] !== true) {\n      return { active: false };\n    }\n\n    const keyId = record['key_id'];\n    const sub = record['sub'];\n    const org = record['org'];\n    const clientId = record['client_id'];\n    const expiresAt = record['expires_at'];\n    const permissions = record['permissions'];\n\n    if (\n      !nonEmpty(keyId) ||\n      !nonEmpty(sub) ||\n      !nonEmpty(org) ||\n      !nonEmpty(clientId) ||\n      !Array.isArray(permissions) ||\n      (expiresAt !== null && expiresAt !== undefined && typeof expiresAt !== 'string')\n    ) {\n      throw new AuthenticationError('API key verification returned an active answer without the promised fields.');\n    }\n\n    // THE BINDING, CHECKED AGAIN HERE. Cbox ID only ever finds a key bound to the calling\n    // client, so this cannot fire against a correct instance — which is exactly when a\n    // check that it holds is worth having: a proxy, a misrouted base URL, or a shared\n    // secret between two apps would otherwise let one app's customers into another's API.\n    if (clientId !== this.config.clientId) {\n      throw new AuthenticationError(\n        `API key verification answered for client ${clientId}, not this app (${this.config.clientId}); refusing it.`,\n      );\n    }\n\n    // Past its expiry by our clock is expired, whatever the instance thought a moment ago.\n    if (typeof expiresAt === 'string') {\n      const expiry = Date.parse(expiresAt);\n      if (Number.isNaN(expiry) || expiry <= Date.now()) {\n        return { active: false };\n      }\n    }\n\n    const role = record['org_role'];\n\n    return {\n      active: true,\n      key_id: keyId,\n      sub,\n      org,\n      org_role: typeof role === 'string' && ORGANIZATION_ROLES.has(role) ? (role as OrganizationRole) : null,\n      permissions: permissions.filter((value): value is string => nonEmpty(value)),\n      client_id: clientId,\n      expires_at: typeof expiresAt === 'string' ? expiresAt : null,\n    };\n  }\n\n  private remember(cacheKey: string, answer: ActiveApiKey): void {\n    const expiry = answer.expires_at === null ? Number.POSITIVE_INFINITY : Date.parse(answer.expires_at);\n    const until = Math.min(Date.now() + this.cacheTtlMs, expiry);\n\n    if (this.cache.size >= MAX_CACHE_ENTRIES) {\n      const oldest = this.cache.keys().next();\n      if (!oldest.done) {\n        this.cache.delete(oldest.value);\n      }\n    }\n\n    this.cache.set(cacheKey, { answer, until });\n  }\n}\n\nfunction nonEmpty(value: unknown): value is string {\n  return typeof value === 'string' && value !== '';\n}\n\n/** The cache is keyed by a hash, so live keys are not sitting in memory as plaintext. */\nasync function digest(key: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(key));\n  return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n"]}

package/dist/chunk-QQW63PGU.js

@@ -0,0 +1,25 @@
+import { ConfigurationError } from './chunk-SEUD4TE4.js';
+
+// src/issuer.ts
+function assertSecureIssuer(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new ConfigurationError("Cbox ID config `issuer` is not a valid URL.");
+  }
+  if (url.protocol === "https:") {
+    return;
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "http:" && loopback) {
+    return;
+  }
+  throw new ConfigurationError(
+    `Cbox ID config \`issuer\` must be https (got ${url.protocol}//${url.hostname}).`
+  );
+}
+
+export { assertSecureIssuer };
+//# sourceMappingURL=chunk-QQW63PGU.js.map
+//# sourceMappingURL=chunk-QQW63PGU.js.map

package/dist/chunk-QQW63PGU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/issuer.ts"],"names":[],"mappings":";;;AAaO,SAAS,mBAAmB,MAAA,EAAsB;AACvD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,MAAM,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,mBAAmB,6CAA6C,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,QAAA,KAAa,KAAA;AAE9H,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,QAAA,EAAU;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,kBAAA;AAAA,IACR,CAAA,6CAAA,EAAgD,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,EAAA;AAAA,GAC/E;AACF","file":"chunk-QQW63PGU.js","sourcesContent":["import { ConfigurationError } from './errors.js';\n\n/**\n * An issuer must be HTTPS.\n *\n * Everything this SDK does with it carries a credential: the authorization code, the PKCE\n * verifier, the client secret, the refresh token. Over `http://` a network attacker reads\n * all of them — and, worse, replaces the discovery document and JWKS, at which point a\n * forged id_token verifies cleanly and the whole verification chain proves nothing.\n *\n * Loopback is allowed because a native app's own callback listener is loopback by\n * definition (RFC 8252) and a dev instance runs there.\n */\nexport function assertSecureIssuer(issuer: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(issuer);\n  } catch {\n    throw new ConfigurationError('Cbox ID config `issuer` is not a valid URL.');\n  }\n\n  if (url.protocol === 'https:') {\n    return;\n  }\n\n  const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]' || url.hostname === '::1';\n\n  if (url.protocol === 'http:' && loopback) {\n    return;\n  }\n\n  throw new ConfigurationError(\n    `Cbox ID config \\`issuer\\` must be https (got ${url.protocol}//${url.hostname}).`,\n  );\n}\n"]}

package/dist/{chunk-ASOQN47M.js → chunk-SEUD4TE4.js}

@@ -56,26 +56,6 @@ var FrontendApiError = class extends CboxIdError {
   retryAfter;
 };
 
-// src/issuer.ts
-function assertSecureIssuer(issuer) {
-  let url;
-  try {
-    url = new URL(issuer);
-  } catch {
-    throw new ConfigurationError("Cbox ID config `issuer` is not a valid URL.");
-  }
-  if (url.protocol === "https:") {
-    return;
-  }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
-  if (url.protocol === "http:" && loopback) {
-    return;
-  }
-  throw new ConfigurationError(
-    `Cbox ID config \`issuer\` must be https (got ${url.protocol}//${url.hostname}).`
-  );
-}
-
-export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError, assertSecureIssuer, oauthError };
-//# sourceMappingURL=chunk-ASOQN47M.js.map
-//# sourceMappingURL=chunk-ASOQN47M.js.map
+export { AuthenticationError, CboxIdError, ConfigurationError, FrontendApiError, InvalidStateError, oauthError };
+//# sourceMappingURL=chunk-SEUD4TE4.js.map
+//# sourceMappingURL=chunk-SEUD4TE4.js.map

package/dist/chunk-SEUD4TE4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"names":[],"mappings":";AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC;AAM9C,IAAM,iBAAA,GAAN,cAAgC,WAAA,CAAY;AAAC;AAa7C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,WAAA,CACE,OAAA,EAES,KAAA,EAEA,gBAAA,EAEA,QAUA,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAhBJ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAEA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAUA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EAjBW,KAAA;AAAA,EAEA,gBAAA;AAAA,EAEA,MAAA;AAAA,EAUA,UAAA;AAAA;AAAA,EAMX,IAAI,aAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,MAAA,KAAW,GAAA;AAAA,EACzB;AACF;AAUA,eAAsB,UAAA,CAAW,UAAoB,QAAA,EAAgD;AACnG,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAEjD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,WAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAEvC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,gBAAA,EAAiB,GAAI,MAAA;AACvD,MAAA,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,KAAA,CAAA;AAC3C,MAAA,WAAA,GAAc,OAAO,gBAAA,KAAqB,QAAA,GAAW,gBAAA,GAAmB,KAAA,CAAA;AAAA,IAC1E;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAOA,EAAA,MAAM,MAAA,GAAS,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAM9C,EAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa,gBAAA,KAAqB,IAAA,IAAQ,OAAA,CAAQ,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAChF,MAAA,CAAO,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAC9B,MAAA;AAEJ,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AACzG;AAiBO,IAAM,gBAAA,GAAN,cAA+B,WAAA,CAAY;AAAA,EAChD,WAAA,CACE,OAAA,EACS,IAAA,EACA,MAAA,EACA,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJJ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EALW,IAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAIb","file":"chunk-SEUD4TE4.js","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n *\n * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.\n * It used to be discarded at every back-channel boundary, leaving a single message string\n * for outcomes that need opposite responses: `invalid_grant` on a refresh means the\n * session is over and the person has to sign in again, while `temporarily_unavailable`\n * means try the same token in a moment. A caller reduced to matching on prose either\n * retries what can never succeed, or signs out somebody who did not need to be.\n */\nexport class AuthenticationError extends CboxIdError {\n  constructor(\n    message: string,\n    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */\n    readonly error?: string,\n    /** The server's `error_description`, verbatim. Not end-user copy. */\n    readonly errorDescription?: string,\n    /** HTTP status, for the cases where the body says nothing useful. */\n    readonly status?: number,\n    /**\n     * Seconds to wait, off the `Retry-After` header — set only on a 429.\n     *\n     * The distinction it carries is the one a caller most needs and could least infer:\n     * a 429 is the ONLY back-channel failure where the same request will succeed\n     * unchanged if you simply wait. Every other one needs a different request, or a new\n     * sign-in. Without this the SDK reported \"token refresh failed\" and a caller with a\n     * retry loop hammered a limiter that was already telling it exactly how long to stop.\n     */\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n\n  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */\n  get isRateLimited(): boolean {\n    return this.status === 429;\n  }\n}\n\n/**\n * Read an OAuth error out of a failed token-endpoint response.\n *\n * Best-effort by design: a 502 from a proxy is HTML, a captive portal is worse, and the\n * caller still needs an error rather than a parse exception. What it must never do is\n * invent a code — an absent or unparseable `error` stays undefined, so\n * `e.error === 'invalid_grant'` is true only because the server said so.\n */\nexport async function oauthError(response: Response, fallback: string): Promise<AuthenticationError> {\n  const body = await response.text().catch(() => '');\n\n  let code: string | undefined;\n  let description: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(body);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const { error, error_description: errorDescription } = parsed as Record<string, unknown>;\n      code = typeof error === 'string' ? error : undefined;\n      description = typeof errorDescription === 'string' ? errorDescription : undefined;\n    }\n  } catch {\n    // Not JSON. The status and the truncated body below are all there is to report.\n  }\n\n  // THE BODY IS NEVER ECHOED. These calls carry `client_secret`, `code_verifier` and\n  // refresh tokens in their REQUEST, and a debug proxy, a captive portal or an upstream\n  // error page that reflects what it received puts those straight into a thrown message\n  // — which production apps log. Only the server's own OAuth error code travels, and\n  // failing that, the status alone.\n  const detail = code ?? `HTTP ${response.status}`;\n\n  // `Retry-After` is seconds here — Laravel's throttler writes the integer form. The\n  // HTTP-date form is legal too and is deliberately NOT parsed: guessing at a clock\n  // skew is worse than saying nothing, and `status === 429` still tells the caller to\n  // back off.\n  const retryAfterHeader = response.headers.get('retry-after');\n  const retryAfter = retryAfterHeader !== null && /^\\d+$/.test(retryAfterHeader.trim())\n    ? Number(retryAfterHeader.trim())\n    : undefined;\n\n  return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);\n}\n\n/**\n * The Frontend API refused, or could not be reached.\n *\n * Carries a `code` because the four ways this goes wrong need four different responses\n * from the caller, and telling them apart from a message string is the kind of thing\n * that works until somebody rewords the message:\n *\n *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a\n *    configuration problem the developer fixes once in the console.\n *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.\n *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.\n *  - `malformed` — a 200 whose body is not the document we expect, which means something\n *    between the page and us is rewriting responses (a proxy, an extension, a captive\n *    portal). Worth distinguishing, because retrying it never helps.\n */\nexport class FrontendApiError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed',\n    readonly status?: number,\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n}\n"]}