@coinlist-co/react 0.5.0 → 0.6.0

package/dist/server/index.d.cts

@@ -1,8 +1,27 @@
-import { A as AuthorizationCode, C as CodeVerifier, n as OAuthSession, O as OAuthAccessToken, b as Offer, P as PaginationParams, c as PaginatedResponse, d as OfferId, e as OfferDetail, f as Participation, g as ParticipationsPaginationParams, h as ParticipationId, i as CreateParticipationParams, j as OfferOptionId, R as Requirement, k as RequirementStatusInfo, a as Config, o as ClientSecret } from '../requirement-BEO42QOr.cjs';
+import { A as AuthorizationCode, C as CodeVerifier, n as OAuthSession, O as OAuthAccessToken, b as Offer, P as PaginationParams, c as PaginatedResponse, d as OfferId, e as OfferDetail, f as Participation, g as ParticipationsPaginationParams, h as ParticipationId, i as CreateParticipationParams, j as OfferOptionId, R as Requirement, k as RequirementStatusInfo, a as Config, o as ClientSecret } from '../requirement-Dk6nYN1c.cjs';
 
 interface SessionStore {
     getSession(): Promise<OAuthSession | null>;
-    setSession(session: OAuthSession | null): Promise<void>;
+    /**
+     * Persists or clears the OAuth session.
+     *
+     * **Omit this method to create a read-only store.** When absent, the SDK
+     * skips token refresh entirely — no network call is made and no refresh
+     * token is consumed. This is the correct approach for contexts that can read
+     * the session but cannot write it back, such as Next.js Server Components.
+     *
+     * ⚠️ Do **not** implement this as a no-op (`async () => {}`). If the method
+     * is present, the SDK assumes writes succeed: it will fire a token refresh
+     * network call, consume the refresh token, then invoke `setSession` — which
+     * would silently discard the new session and leave the browser holding an
+     * invalidated refresh token. Simply **omit** `setSession` to prevent any
+     * refresh from being attempted.
+     *
+     * {@link CoinListServer.completeOAuth} and {@link CoinListServer.logout}
+     * always require a writable store and throw
+     * {@link WritableSessionStoreRequiredError} if `setSession` is absent.
+     */
+    setSession?(session: OAuthSession | null): Promise<void>;
 }
 interface ServerConfig extends Config {
     readonly clientSecret: ClientSecret;
@@ -15,19 +34,56 @@ interface ServerConfig extends Config {
      */
     readonly strict?: boolean;
 }
+/**
+ * Server-side CoinList SDK client.
+ *
+ * Operates in one of two modes depending on whether {@link SessionStore}
+ * includes a `setSession` implementation:
+ *
+ * - **Writable store** (`setSession` provided) — full functionality: token
+ *   refresh, {@link completeOAuth}, and {@link logout} all work normally.
+ *
+ * - **Read-only store** (no `setSession`) — token refresh is skipped entirely,
+ *   meaning no network call is made and no refresh token is consumed.
+ *   {@link completeOAuth} and {@link logout} throw
+ *   {@link WritableSessionStoreRequiredError}. {@link accessToken} may return
+ *   an expired token (see its docs). Use this mode in execution contexts that
+ *   can read the session but cannot write it back, such as Next.js Server
+ *   Components.
+ */
 interface CoinListServer {
+    /**
+     * Exchanges an authorization code for an OAuth session and persists it via
+     * {@link SessionStore.setSession}.
+     *
+     * Throws {@link WritableSessionStoreRequiredError} if the session store does
+     * not provide `setSession`.
+     */
     completeOAuth(code: AuthorizationCode, codeVerifier: CodeVerifier): Promise<OAuthSession>;
     /**
-     * Responsible for:
-     * 1. Returning a securely stored access token from Cookies
-     * 2. Renewing the session if it's expired (or about to expire)
+     * Returns a valid access token for the current session, refreshing it if
+     * it is expired or near expiry.
+     *
+     * **Writable store**: if the token is expired, the SDK exchanges the refresh
+     * token for a new session, persists it, and returns the fresh access token.
+     * Returns `null` if there is no session or the refresh fails.
+     *
+     * **Read-only store** (no `setSession`): refresh is skipped entirely. The
+     * stored token is returned as-is, even if it is expired — a non-null return
+     * value does **not** guarantee the token is accepted by the API. Before
+     * making API calls, check `token.expiresAt > new Date()`. Use a writable
+     * store (e.g. in a Route Handler) when you need the SDK to renew the session
+     * automatically.
      *
-     * @returns a valid access token or null if the user is not authentication.
-     * On error rejects the Promise and throws.
+     * @returns the access token, or `null` if there is no session or the session
+     * could not be refreshed.
      */
     accessToken(): Promise<OAuthAccessToken | null>;
     /**
      * Revokes the current token via POST /oauth/revoke and clears the session.
+     *
+     * Throws {@link WritableSessionStoreRequiredError} if the session store does
+     * not provide `setSession`.
      */
     logout(): Promise<void>;
     /**
@@ -87,4 +143,8 @@ interface CoinListServer {
 }
 declare function createCoinListServer(config: ServerConfig): CoinListServer;
 
-export { type CoinListServer, type ServerConfig, type SessionStore, createCoinListServer };
+declare class WritableSessionStoreRequiredError extends Error {
+    constructor(message?: string);
+}
+
+export { type CoinListServer, type ServerConfig, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer };

package/dist/server/index.d.ts

@@ -1,8 +1,27 @@
-import { A as AuthorizationCode, C as CodeVerifier, n as OAuthSession, O as OAuthAccessToken, b as Offer, P as PaginationParams, c as PaginatedResponse, d as OfferId, e as OfferDetail, f as Participation, g as ParticipationsPaginationParams, h as ParticipationId, i as CreateParticipationParams, j as OfferOptionId, R as Requirement, k as RequirementStatusInfo, a as Config, o as ClientSecret } from '../requirement-BEO42QOr.js';
+import { A as AuthorizationCode, C as CodeVerifier, n as OAuthSession, O as OAuthAccessToken, b as Offer, P as PaginationParams, c as PaginatedResponse, d as OfferId, e as OfferDetail, f as Participation, g as ParticipationsPaginationParams, h as ParticipationId, i as CreateParticipationParams, j as OfferOptionId, R as Requirement, k as RequirementStatusInfo, a as Config, o as ClientSecret } from '../requirement-Dk6nYN1c.js';
 
 interface SessionStore {
     getSession(): Promise<OAuthSession | null>;
-    setSession(session: OAuthSession | null): Promise<void>;
+    /**
+     * Persists or clears the OAuth session.
+     *
+     * **Omit this method to create a read-only store.** When absent, the SDK
+     * skips token refresh entirely — no network call is made and no refresh
+     * token is consumed. This is the correct approach for contexts that can read
+     * the session but cannot write it back, such as Next.js Server Components.
+     *
+     * ⚠️ Do **not** implement this as a no-op (`async () => {}`). If the method
+     * is present, the SDK assumes writes succeed: it will fire a token refresh
+     * network call, consume the refresh token, then invoke `setSession` — which
+     * would silently discard the new session and leave the browser holding an
+     * invalidated refresh token. Simply **omit** `setSession` to prevent any
+     * refresh from being attempted.
+     *
+     * {@link CoinListServer.completeOAuth} and {@link CoinListServer.logout}
+     * always require a writable store and throw
+     * {@link WritableSessionStoreRequiredError} if `setSession` is absent.
+     */
+    setSession?(session: OAuthSession | null): Promise<void>;
 }
 interface ServerConfig extends Config {
     readonly clientSecret: ClientSecret;
@@ -15,19 +34,56 @@ interface ServerConfig extends Config {
      */
     readonly strict?: boolean;
 }
+/**
+ * Server-side CoinList SDK client.
+ *
+ * Operates in one of two modes depending on whether {@link SessionStore}
+ * includes a `setSession` implementation:
+ *
+ * - **Writable store** (`setSession` provided) — full functionality: token
+ *   refresh, {@link completeOAuth}, and {@link logout} all work normally.
+ *
+ * - **Read-only store** (no `setSession`) — token refresh is skipped entirely,
+ *   meaning no network call is made and no refresh token is consumed.
+ *   {@link completeOAuth} and {@link logout} throw
+ *   {@link WritableSessionStoreRequiredError}. {@link accessToken} may return
+ *   an expired token (see its docs). Use this mode in execution contexts that
+ *   can read the session but cannot write it back, such as Next.js Server
+ *   Components.
+ */
 interface CoinListServer {
+    /**
+     * Exchanges an authorization code for an OAuth session and persists it via
+     * {@link SessionStore.setSession}.
+     *
+     * Throws {@link WritableSessionStoreRequiredError} if the session store does
+     * not provide `setSession`.
+     */
     completeOAuth(code: AuthorizationCode, codeVerifier: CodeVerifier): Promise<OAuthSession>;
     /**
-     * Responsible for:
-     * 1. Returning a securely stored access token from Cookies
-     * 2. Renewing the session if it's expired (or about to expire)
+     * Returns a valid access token for the current session, refreshing it if
+     * it is expired or near expiry.
+     *
+     * **Writable store**: if the token is expired, the SDK exchanges the refresh
+     * token for a new session, persists it, and returns the fresh access token.
+     * Returns `null` if there is no session or the refresh fails.
+     *
+     * **Read-only store** (no `setSession`): refresh is skipped entirely. The
+     * stored token is returned as-is, even if it is expired — a non-null return
+     * value does **not** guarantee the token is accepted by the API. Before
+     * making API calls, check `token.expiresAt > new Date()`. Use a writable
+     * store (e.g. in a Route Handler) when you need the SDK to renew the session
+     * automatically.
      *
-     * @returns a valid access token or null if the user is not authentication.
-     * On error rejects the Promise and throws.
+     * @returns the access token, or `null` if there is no session or the session
+     * could not be refreshed.
      */
     accessToken(): Promise<OAuthAccessToken | null>;
     /**
      * Revokes the current token via POST /oauth/revoke and clears the session.
+     *
+     * Throws {@link WritableSessionStoreRequiredError} if the session store does
+     * not provide `setSession`.
      */
     logout(): Promise<void>;
     /**
@@ -87,4 +143,8 @@ interface CoinListServer {
 }
 declare function createCoinListServer(config: ServerConfig): CoinListServer;
 
-export { type CoinListServer, type ServerConfig, type SessionStore, createCoinListServer };
+declare class WritableSessionStoreRequiredError extends Error {
+    constructor(message?: string);
+}
+
+export { type CoinListServer, type ServerConfig, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer };

package/dist/server/index.js

@@ -12,13 +12,13 @@ import {
   fetchParticipations,
   fetchParticipationsPage,
   fetchRequirementStatuses
-} from "../chunk-N3WBC2VS.js";
+} from "../chunk-5C4TEVM7.js";
 import {
   OAuthSession
 } from "../chunk-5E3P7AMH.js";
 import {
   NotAuthenticatedError
-} from "../chunk-V6WO67RO.js";
+} from "../chunk-7SB2GKEU.js";
 
 // src/server/api/api.server.ts
 var Api = class {
@@ -30,6 +30,14 @@ var Api = class {
   }
 };
 
+// src/server/errors.ts
+var WritableSessionStoreRequiredError = class extends Error {
+  constructor(message = "This operation requires a writable SessionStore. Provide a `setSession` implementation in your SessionStore to persist or clear OAuth sessions.") {
+    super(message);
+    this.name = "WritableSessionStoreRequiredError";
+  }
+};
+
 // src/server/coinlist.server.ts
 var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
 var CoinListServerImpl = class {
@@ -43,10 +51,19 @@ var CoinListServerImpl = class {
         baseUrl: this.baseUrl,
         xApiVersion: API_VERSION
       },
-      (_refresh) => this.accessToken()
+      // When refresh=true the renewal middleware has received a 401 and wants a
+      // fresh token. A read-only store cannot persist a new session, so return
+      // null immediately — this tells the middleware to skip the retry rather
+      // than re-sending with the same expired token and wasting a round-trip.
+      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.accessToken()
     );
   }
   async completeOAuth(code, codeVerifier) {
+    const sessionStore = this._config.sessionStore;
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      throw new WritableSessionStoreRequiredError();
+    }
     const sessionDto = await this.api.send({
       method: "POST",
       url: `/oauth/token`,
@@ -60,11 +77,12 @@ var CoinListServerImpl = class {
       }
     });
     const session = OAuthSession.fromDto(sessionDto);
-    this._config.sessionStore.setSession(session);
+    await setSession(session);
     return session;
   }
   async accessToken() {
-    const session = await this._config.sessionStore.getSession();
+    const sessionStore = this._config.sessionStore;
+    const session = await sessionStore.getSession();
     if (session == null) return null;
     const now = Date.now();
     const expiresAt = session.accessToken.expiresAt.getTime();
@@ -72,9 +90,16 @@ var CoinListServerImpl = class {
     if (expiresAt > now + bufferMs) {
       return session.accessToken;
     }
-    const refreshToken = session?.refreshToken;
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      return session.accessToken;
+    } else {
+      return this.refreshSession(session.refreshToken, setSession);
+    }
+  }
+  async refreshSession(refreshToken, setSession) {
     if (!refreshToken) {
-      await this._config.sessionStore.setSession(null);
+      await setSession(null);
       return null;
     }
     try {
@@ -89,15 +114,20 @@ var CoinListServerImpl = class {
         }
       });
       const newSession = OAuthSession.fromDto(sessionDto);
-      await this._config.sessionStore.setSession(newSession);
+      await setSession(newSession);
       return newSession.accessToken;
     } catch {
-      await this._config.sessionStore.setSession(null);
+      await setSession(null);
       return null;
     }
   }
   async logout() {
-    const session = await this._config.sessionStore.getSession();
+    const sessionStore = this._config.sessionStore;
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      throw new WritableSessionStoreRequiredError();
+    }
+    const session = await sessionStore.getSession();
     if (session != null) {
       const tokenToRevoke = session.accessToken.value;
       try {
@@ -119,7 +149,7 @@ var CoinListServerImpl = class {
           throw err;
         }
       }
-      await this._config.sessionStore.setSession(null);
+      await setSession(null);
     }
   }
   async ensureAuthenticated() {
@@ -169,6 +199,7 @@ function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
 export {
+  WritableSessionStoreRequiredError,
   createCoinListServer
 };
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/api/api.server.ts","../../src/server/coinlist.server.ts"],"sourcesContent":["import { AuthenticatedApiClient } from '@/shared/api/authenticated-api-client';\nimport type { HttpClientConfig, HttpRequest } from '@/shared/api/http';\nimport type { OAuthAccessToken } from '@/shared/types/oauth-session';\n\nexport class Api {\n  private readonly client: AuthenticatedApiClient;\n\n  constructor(\n    config: HttpClientConfig,\n    fetchAccessToken: (refresh: boolean) => Promise<OAuthAccessToken | null>\n  ) {\n    this.client = new AuthenticatedApiClient(config, fetchAccessToken);\n  }\n\n  async send<TResponse>(request: HttpRequest): Promise<TResponse> {\n    return this.client.send<TResponse>(request);\n  }\n}\n","import { Api } from '@/server/api/api.server';\nimport {\n  API_VERSION,\n  PUBLIC_API_BASE_URL,\n} from '@/shared/api/frontline/config';\nimport * as offersApi from '@/shared/api/frontline/offers';\nimport * as participationsApi from '@/shared/api/frontline/participations';\nimport * as requirementsApi from '@/shared/api/frontline/requirements';\nimport { HttpError } from '@/shared/api/http';\nimport type {\n  PaginatedResponse,\n  PaginationParams,\n} from '@/shared/api/pagination';\nimport type { Config } from '@/shared/types/config';\nimport type { OAuthSessionDto } from '@/shared/types/dto/oauth-session';\nimport { NotAuthenticatedError } from '@/shared/types/errors';\nimport type {\n  AuthorizationCode,\n  ClientSecret,\n  CodeVerifier,\n} from '@/shared/types/oauth';\nimport {\n  type OAuthAccessToken,\n  OAuthSession,\n} from '@/shared/types/oauth-session';\nimport type { Offer, OfferId } from '@/shared/types/offer';\nimport type { OfferDetail, OfferOptionId } from '@/shared/types/offer-detail';\nimport type {\n  CreateParticipationParams,\n  Participation,\n  ParticipationId,\n  ParticipationsPaginationParams,\n} from '@/shared/types/participation';\nimport type {\n  Requirement,\n  RequirementStatusInfo,\n} from '@/shared/types/requirement';\n\n/** Buffer in seconds before expiry to consider token expired for refresh. */\nconst ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;\n\nexport interface SessionStore {\n  getSession(): Promise<OAuthSession | null>;\n  setSession(session: OAuthSession | null): Promise<void>;\n}\n\nexport interface ServerConfig extends Config {\n  readonly clientSecret: ClientSecret;\n  readonly sessionStore: SessionStore;\n  /** Buffer in seconds before expiry to consider token expired for refresh. */\n  readonly accessTokenExpiryBufferSeconds?: number;\n  /**\n   * Whether SDK will throw an exception in cases it can be silent.\n   * For example, if token revokation on logout fails.\n   */\n  readonly strict?: boolean;\n}\n\nexport interface CoinListServer {\n  completeOAuth(\n    code: AuthorizationCode,\n    codeVerifier: CodeVerifier\n  ): Promise<OAuthSession>;\n\n  /**\n   * Responsible for:\n   * 1. Returning a securely stored access token from Cookies\n   * 2. Renewing the session if it's expired (or about to expire)\n   *\n   * @returns a valid access token or null if the user is not authentication.\n   * On error rejects the Promise and throws.\n   */\n  accessToken(): Promise<OAuthAccessToken | null>;\n\n  /**\n   * Revokes the current token via POST /oauth/revoke and clears the session.\n   */\n  logout(): Promise<void>;\n\n  /**\n   * Fetches all offers by iterating through every paginated response.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOffers(): Promise<Offer[]>;\n\n  /**\n   * Fetches a single page of offers.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOffersPage(params: PaginationParams): Promise<PaginatedResponse<Offer>>;\n\n  /**\n   * Fetches details for a given offer by its id.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOfferDetails(id: OfferId): Promise<OfferDetail>;\n\n  /**\n   * Fetches all participations by iterating through every paginated response.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipations(offerId?: OfferId): Promise<Participation[]>;\n\n  /**\n   * Fetches a single page of participations, optionally filtered by offer.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipationsPage(\n    params: ParticipationsPaginationParams\n  ): Promise<PaginatedResponse<Participation>>;\n\n  /**\n   * Fetches a participation by id.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipation(id: ParticipationId): Promise<Participation>;\n\n  /**\n   * Creates a participation.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  createParticipation(\n    params: CreateParticipationParams\n  ): Promise<Participation>;\n\n  /**\n   * Fetches the requirements for all options of a given offer, grouped by option ID.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOfferRequirements(\n    offerId: OfferId\n  ): Promise<Record<OfferOptionId, Requirement[]>>;\n\n  /**\n   * Fetches the user's requirement statuses for a given offer.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchRequirementStatuses(offerId: OfferId): Promise<RequirementStatusInfo[]>;\n}\n\nclass CoinListServerImpl implements CoinListServer {\n  private readonly api: Api;\n  private readonly baseUrl: string;\n\n  private readonly accessTokenExpiryBufferSeconds: number;\n  private readonly strict: boolean;\n\n  constructor(private readonly _config: ServerConfig) {\n    this.baseUrl = _config.baseUrl ?? PUBLIC_API_BASE_URL;\n    this.accessTokenExpiryBufferSeconds =\n      _config.accessTokenExpiryBufferSeconds ??\n      ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS;\n    this.strict = _config.strict ?? false;\n    this.api = new Api(\n      {\n        baseUrl: this.baseUrl,\n        xApiVersion: API_VERSION,\n      },\n      (_refresh) => this.accessToken()\n    );\n  }\n\n  async completeOAuth(\n    code: AuthorizationCode,\n    codeVerifier: CodeVerifier\n  ): Promise<OAuthSession> {\n    const sessionDto = await this.api.send<OAuthSessionDto>({\n      method: 'POST',\n      url: `/oauth/token`,\n      body: {\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: this._config.redirectUri,\n        client_id: this._config.clientId,\n        client_secret: this._config.clientSecret,\n        code_verifier: codeVerifier,\n      },\n    });\n    const session = OAuthSession.fromDto(sessionDto);\n    this._config.sessionStore.setSession(session);\n    return session;\n  }\n\n  async accessToken(): Promise<OAuthAccessToken | null> {\n    const session = await this._config.sessionStore.getSession();\n    if (session == null) return null;\n\n    const now = Date.now();\n    const expiresAt = session.accessToken.expiresAt.getTime();\n    const bufferMs = this.accessTokenExpiryBufferSeconds * 1000;\n    if (expiresAt > now + bufferMs) {\n      return session.accessToken;\n    }\n\n    const refreshToken = session?.refreshToken;\n    if (!refreshToken) {\n      await this._config.sessionStore.setSession(null);\n      return null;\n    }\n\n    try {\n      const sessionDto = await this.api.send<OAuthSessionDto>({\n        method: 'POST',\n        url: `/oauth/token`,\n        body: {\n          grant_type: 'refresh_token',\n          refresh_token: refreshToken,\n          client_id: this._config.clientId,\n          client_secret: this._config.clientSecret,\n        },\n      });\n      const newSession = OAuthSession.fromDto(sessionDto);\n      await this._config.sessionStore.setSession(newSession);\n      return newSession.accessToken;\n    } catch {\n      await this._config.sessionStore.setSession(null);\n      return null;\n    }\n  }\n\n  async logout(): Promise<void> {\n    const session = await this._config.sessionStore.getSession();\n    if (session != null) {\n      const tokenToRevoke = session.accessToken.value;\n      try {\n        await this.api.send({\n          method: 'POST',\n          url: `/oauth/revoke`,\n          body: {\n            token: tokenToRevoke,\n            client_id: this._config.clientId,\n            client_secret: this._config.clientSecret,\n          },\n        });\n      } catch (err) {\n        if (err instanceof HttpError) {\n          if (this.strict) {\n            throw err;\n          }\n        } else {\n          throw err;\n        }\n      }\n      await this._config.sessionStore.setSession(null);\n    }\n  }\n\n  private async ensureAuthenticated(): Promise<void> {\n    const token = await this.accessToken();\n    if (token === null) {\n      throw new NotAuthenticatedError();\n    }\n  }\n\n  async fetchOffers(): Promise<Offer[]> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOffers(this.api);\n  }\n\n  async fetchOffersPage(\n    params: PaginationParams\n  ): Promise<PaginatedResponse<Offer>> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOffersPage(this.api, params);\n  }\n\n  async fetchOfferDetails(id: OfferId): Promise<OfferDetail> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOfferDetails(this.api, id);\n  }\n\n  async fetchParticipations(offerId?: OfferId): Promise<Participation[]> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipations(this.api, offerId);\n  }\n\n  async fetchParticipationsPage(\n    params: ParticipationsPaginationParams\n  ): Promise<PaginatedResponse<Participation>> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipationsPage(this.api, params);\n  }\n\n  async fetchParticipation(id: ParticipationId): Promise<Participation> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipation(this.api, id);\n  }\n\n  async createParticipation(\n    params: CreateParticipationParams\n  ): Promise<Participation> {\n    await this.ensureAuthenticated();\n    return participationsApi.createParticipation(this.api, params);\n  }\n\n  async fetchOfferRequirements(\n    offerId: OfferId\n  ): Promise<Record<OfferOptionId, Requirement[]>> {\n    await this.ensureAuthenticated();\n    return requirementsApi.fetchOfferRequirements(this.api, offerId);\n  }\n\n  async fetchRequirementStatuses(\n    offerId: OfferId\n  ): Promise<RequirementStatusInfo[]> {\n    await this.ensureAuthenticated();\n    return requirementsApi.fetchRequirementStatuses(this.api, offerId);\n  }\n}\n\nexport function createCoinListServer(config: ServerConfig): CoinListServer {\n  return new CoinListServerImpl(config);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIO,IAAM,MAAN,MAAU;AAAA,EAGf,YACE,QACA,kBACA;AACA,SAAK,SAAS,IAAI,uBAAuB,QAAQ,gBAAgB;AAAA,EACnE;AAAA,EAEA,MAAM,KAAgB,SAA0C;AAC9D,WAAO,KAAK,OAAO,KAAgB,OAAO;AAAA,EAC5C;AACF;;;ACsBA,IAAM,qCAAqC;AA8G3C,IAAM,qBAAN,MAAmD;AAAA,EAOjD,YAA6B,SAAuB;AAAvB;AAC3B,SAAK,UAAU,QAAQ,WAAW;AAClC,SAAK,iCACH,QAAQ,kCACR;AACF,SAAK,SAAS,QAAQ,UAAU;AAChC,SAAK,MAAM,IAAI;AAAA,MACb;AAAA,QACE,SAAS,KAAK;AAAA,QACd,aAAa;AAAA,MACf;AAAA,MACA,CAAC,aAAa,KAAK,YAAY;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,MACA,cACuB;AACvB,UAAM,aAAa,MAAM,KAAK,IAAI,KAAsB;AAAA,MACtD,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,QACJ,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,KAAK,QAAQ;AAAA,QAC3B,WAAW,KAAK,QAAQ;AAAA,QACxB,eAAe,KAAK,QAAQ;AAAA,QAC5B,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AACD,UAAM,UAAU,aAAa,QAAQ,UAAU;AAC/C,SAAK,QAAQ,aAAa,WAAW,OAAO;AAC5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAgD;AACpD,UAAM,UAAU,MAAM,KAAK,QAAQ,aAAa,WAAW;AAC3D,QAAI,WAAW,KAAM,QAAO;AAE5B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,QAAQ,YAAY,UAAU,QAAQ;AACxD,UAAM,WAAW,KAAK,iCAAiC;AACvD,QAAI,YAAY,MAAM,UAAU;AAC9B,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,eAAe,SAAS;AAC9B,QAAI,CAAC,cAAc;AACjB,YAAM,KAAK,QAAQ,aAAa,WAAW,IAAI;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,IAAI,KAAsB;AAAA,QACtD,QAAQ;AAAA,QACR,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,YAAY;AAAA,UACZ,eAAe;AAAA,UACf,WAAW,KAAK,QAAQ;AAAA,UACxB,eAAe,KAAK,QAAQ;AAAA,QAC9B;AAAA,MACF,CAAC;AACD,YAAM,aAAa,aAAa,QAAQ,UAAU;AAClD,YAAM,KAAK,QAAQ,aAAa,WAAW,UAAU;AACrD,aAAO,WAAW;AAAA,IACpB,QAAQ;AACN,YAAM,KAAK,QAAQ,aAAa,WAAW,IAAI;AAC/C,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,UAAU,MAAM,KAAK,QAAQ,aAAa,WAAW;AAC3D,QAAI,WAAW,MAAM;AACnB,YAAM,gBAAgB,QAAQ,YAAY;AAC1C,UAAI;AACF,cAAM,KAAK,IAAI,KAAK;AAAA,UAClB,QAAQ;AAAA,UACR,KAAK;AAAA,UACL,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,WAAW,KAAK,QAAQ;AAAA,YACxB,eAAe,KAAK,QAAQ;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,WAAW;AAC5B,cAAI,KAAK,QAAQ;AACf,kBAAM;AAAA,UACR;AAAA,QACF,OAAO;AACL,gBAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM,KAAK,QAAQ,aAAa,WAAW,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAc,sBAAqC;AACjD,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI,sBAAsB;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,MAAM,cAAgC;AACpC,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,YAAY,KAAK,GAAG;AAAA,EACvC;AAAA,EAEA,MAAM,gBACJ,QACmC;AACnC,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,gBAAgB,KAAK,KAAK,MAAM;AAAA,EACnD;AAAA,EAEA,MAAM,kBAAkB,IAAmC;AACzD,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,kBAAkB,KAAK,KAAK,EAAE;AAAA,EACjD;AAAA,EAEA,MAAM,oBAAoB,SAA6C;AACrE,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,oBAAoB,KAAK,KAAK,OAAO;AAAA,EAChE;AAAA,EAEA,MAAM,wBACJ,QAC2C;AAC3C,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,wBAAwB,KAAK,KAAK,MAAM;AAAA,EACnE;AAAA,EAEA,MAAM,mBAAmB,IAA6C;AACpE,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,mBAAmB,KAAK,KAAK,EAAE;AAAA,EAC1D;AAAA,EAEA,MAAM,oBACJ,QACwB;AACxB,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,oBAAoB,KAAK,KAAK,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,uBACJ,SAC+C;AAC/C,UAAM,KAAK,oBAAoB;AAC/B,WAAuB,uBAAuB,KAAK,KAAK,OAAO;AAAA,EACjE;AAAA,EAEA,MAAM,yBACJ,SACkC;AAClC,UAAM,KAAK,oBAAoB;AAC/B,WAAuB,yBAAyB,KAAK,KAAK,OAAO;AAAA,EACnE;AACF;AAEO,SAAS,qBAAqB,QAAsC;AACzE,SAAO,IAAI,mBAAmB,MAAM;AACtC;","names":[]}
+{"version":3,"sources":["../../src/server/api/api.server.ts","../../src/server/errors.ts","../../src/server/coinlist.server.ts"],"sourcesContent":["import { AuthenticatedApiClient } from '@/shared/api/authenticated-api-client';\nimport type { HttpClientConfig, HttpRequest } from '@/shared/api/http';\nimport type { OAuthAccessToken } from '@/shared/types/oauth-session';\n\nexport class Api {\n  private readonly client: AuthenticatedApiClient;\n\n  constructor(\n    config: HttpClientConfig,\n    fetchAccessToken: (refresh: boolean) => Promise<OAuthAccessToken | null>\n  ) {\n    this.client = new AuthenticatedApiClient(config, fetchAccessToken);\n  }\n\n  async send<TResponse>(request: HttpRequest): Promise<TResponse> {\n    return this.client.send<TResponse>(request);\n  }\n}\n","export class WritableSessionStoreRequiredError extends Error {\n  constructor(\n    message = 'This operation requires a writable SessionStore. Provide a `setSession` implementation in your SessionStore to persist or clear OAuth sessions.'\n  ) {\n    super(message);\n    this.name = 'WritableSessionStoreRequiredError';\n  }\n}\n","import { Api } from '@/server/api/api.server';\nimport { WritableSessionStoreRequiredError } from '@/server/errors';\nimport {\n  API_VERSION,\n  PUBLIC_API_BASE_URL,\n} from '@/shared/api/frontline/config';\nimport * as offersApi from '@/shared/api/frontline/offers';\nimport * as participationsApi from '@/shared/api/frontline/participations';\nimport * as requirementsApi from '@/shared/api/frontline/requirements';\nimport { HttpError } from '@/shared/api/http';\nimport type {\n  PaginatedResponse,\n  PaginationParams,\n} from '@/shared/api/pagination';\nimport type { Config } from '@/shared/types/config';\nimport type { OAuthSessionDto } from '@/shared/types/dto/oauth-session';\nimport { NotAuthenticatedError } from '@/shared/types/errors';\nimport type {\n  AuthorizationCode,\n  ClientSecret,\n  CodeVerifier,\n} from '@/shared/types/oauth';\nimport {\n  type OAuthAccessToken,\n  type OAuthRefreshToken,\n  OAuthSession,\n} from '@/shared/types/oauth-session';\nimport type { Offer, OfferId } from '@/shared/types/offer';\nimport type { OfferDetail, OfferOptionId } from '@/shared/types/offer-detail';\nimport type {\n  CreateParticipationParams,\n  Participation,\n  ParticipationId,\n  ParticipationsPaginationParams,\n} from '@/shared/types/participation';\nimport type {\n  Requirement,\n  RequirementStatusInfo,\n} from '@/shared/types/requirement';\n\n/** Buffer in seconds before expiry to consider token expired for refresh. */\nconst ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;\n\nexport interface SessionStore {\n  getSession(): Promise<OAuthSession | null>;\n  /**\n   * Persists or clears the OAuth session.\n   *\n   * **Omit this method to create a read-only store.** When absent, the SDK\n   * skips token refresh entirely — no network call is made and no refresh\n   * token is consumed. This is the correct approach for contexts that can read\n   * the session but cannot write it back, such as Next.js Server Components.\n   *\n   * ⚠️ Do **not** implement this as a no-op (`async () => {}`). If the method\n   * is present, the SDK assumes writes succeed: it will fire a token refresh\n   * network call, consume the refresh token, then invoke `setSession` — which\n   * would silently discard the new session and leave the browser holding an\n   * invalidated refresh token. Simply **omit** `setSession` to prevent any\n   * refresh from being attempted.\n   *\n   * {@link CoinListServer.completeOAuth} and {@link CoinListServer.logout}\n   * always require a writable store and throw\n   * {@link WritableSessionStoreRequiredError} if `setSession` is absent.\n   */\n  setSession?(session: OAuthSession | null): Promise<void>;\n}\n\nexport interface ServerConfig extends Config {\n  readonly clientSecret: ClientSecret;\n  readonly sessionStore: SessionStore;\n  /** Buffer in seconds before expiry to consider token expired for refresh. */\n  readonly accessTokenExpiryBufferSeconds?: number;\n  /**\n   * Whether SDK will throw an exception in cases it can be silent.\n   * For example, if token revokation on logout fails.\n   */\n  readonly strict?: boolean;\n}\n\n/**\n * Server-side CoinList SDK client.\n *\n * Operates in one of two modes depending on whether {@link SessionStore}\n * includes a `setSession` implementation:\n *\n * - **Writable store** (`setSession` provided) — full functionality: token\n *   refresh, {@link completeOAuth}, and {@link logout} all work normally.\n *\n * - **Read-only store** (no `setSession`) — token refresh is skipped entirely,\n *   meaning no network call is made and no refresh token is consumed.\n *   {@link completeOAuth} and {@link logout} throw\n *   {@link WritableSessionStoreRequiredError}. {@link accessToken} may return\n *   an expired token (see its docs). Use this mode in execution contexts that\n *   can read the session but cannot write it back, such as Next.js Server\n *   Components.\n */\nexport interface CoinListServer {\n  /**\n   * Exchanges an authorization code for an OAuth session and persists it via\n   * {@link SessionStore.setSession}.\n   *\n   * Throws {@link WritableSessionStoreRequiredError} if the session store does\n   * not provide `setSession`.\n   */\n  completeOAuth(\n    code: AuthorizationCode,\n    codeVerifier: CodeVerifier\n  ): Promise<OAuthSession>;\n\n  /**\n   * Returns a valid access token for the current session, refreshing it if\n   * it is expired or near expiry.\n   *\n   * **Writable store**: if the token is expired, the SDK exchanges the refresh\n   * token for a new session, persists it, and returns the fresh access token.\n   * Returns `null` if there is no session or the refresh fails.\n   *\n   * **Read-only store** (no `setSession`): refresh is skipped entirely. The\n   * stored token is returned as-is, even if it is expired — a non-null return\n   * value does **not** guarantee the token is accepted by the API. Before\n   * making API calls, check `token.expiresAt > new Date()`. Use a writable\n   * store (e.g. in a Route Handler) when you need the SDK to renew the session\n   * automatically.\n   *\n   * @returns the access token, or `null` if there is no session or the session\n   * could not be refreshed.\n   */\n  accessToken(): Promise<OAuthAccessToken | null>;\n\n  /**\n   * Revokes the current token via POST /oauth/revoke and clears the session.\n   *\n   * Throws {@link WritableSessionStoreRequiredError} if the session store does\n   * not provide `setSession`.\n   */\n  logout(): Promise<void>;\n\n  /**\n   * Fetches all offers by iterating through every paginated response.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOffers(): Promise<Offer[]>;\n\n  /**\n   * Fetches a single page of offers.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOffersPage(params: PaginationParams): Promise<PaginatedResponse<Offer>>;\n\n  /**\n   * Fetches details for a given offer by its id.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOfferDetails(id: OfferId): Promise<OfferDetail>;\n\n  /**\n   * Fetches all participations by iterating through every paginated response.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipations(offerId?: OfferId): Promise<Participation[]>;\n\n  /**\n   * Fetches a single page of participations, optionally filtered by offer.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipationsPage(\n    params: ParticipationsPaginationParams\n  ): Promise<PaginatedResponse<Participation>>;\n\n  /**\n   * Fetches a participation by id.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchParticipation(id: ParticipationId): Promise<Participation>;\n\n  /**\n   * Creates a participation.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  createParticipation(\n    params: CreateParticipationParams\n  ): Promise<Participation>;\n\n  /**\n   * Fetches the requirements for all options of a given offer, grouped by option ID.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchOfferRequirements(\n    offerId: OfferId\n  ): Promise<Record<OfferOptionId, Requirement[]>>;\n\n  /**\n   * Fetches the user's requirement statuses for a given offer.\n   *\n   * Throws {@link NotAuthenticatedError} if the user is not authenticated.\n   */\n  fetchRequirementStatuses(offerId: OfferId): Promise<RequirementStatusInfo[]>;\n}\n\nclass CoinListServerImpl implements CoinListServer {\n  private readonly api: Api;\n  private readonly baseUrl: string;\n\n  private readonly accessTokenExpiryBufferSeconds: number;\n  private readonly strict: boolean;\n\n  constructor(private readonly _config: ServerConfig) {\n    this.baseUrl = _config.baseUrl ?? PUBLIC_API_BASE_URL;\n    this.accessTokenExpiryBufferSeconds =\n      _config.accessTokenExpiryBufferSeconds ??\n      ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS;\n    this.strict = _config.strict ?? false;\n    this.api = new Api(\n      {\n        baseUrl: this.baseUrl,\n        xApiVersion: API_VERSION,\n      },\n      // When refresh=true the renewal middleware has received a 401 and wants a\n      // fresh token. A read-only store cannot persist a new session, so return\n      // null immediately — this tells the middleware to skip the retry rather\n      // than re-sending with the same expired token and wasting a round-trip.\n      (refresh) =>\n        refresh && !this._config.sessionStore.setSession\n          ? Promise.resolve(null)\n          : this.accessToken()\n    );\n  }\n\n  async completeOAuth(\n    code: AuthorizationCode,\n    codeVerifier: CodeVerifier\n  ): Promise<OAuthSession> {\n    const sessionStore = this._config.sessionStore;\n    const setSession = sessionStore.setSession?.bind(sessionStore);\n    if (!setSession) {\n      throw new WritableSessionStoreRequiredError();\n    }\n    const sessionDto = await this.api.send<OAuthSessionDto>({\n      method: 'POST',\n      url: `/oauth/token`,\n      body: {\n        grant_type: 'authorization_code',\n        code,\n        redirect_uri: this._config.redirectUri,\n        client_id: this._config.clientId,\n        client_secret: this._config.clientSecret,\n        code_verifier: codeVerifier,\n      },\n    });\n    const session = OAuthSession.fromDto(sessionDto);\n    await setSession(session);\n    return session;\n  }\n\n  async accessToken(): Promise<OAuthAccessToken | null> {\n    const sessionStore = this._config.sessionStore;\n    const session = await sessionStore.getSession();\n    if (session == null) return null;\n\n    const now = Date.now();\n    const expiresAt = session.accessToken.expiresAt.getTime();\n    const bufferMs = this.accessTokenExpiryBufferSeconds * 1000;\n    if (expiresAt > now + bufferMs) {\n      // Valid access token, return it regardless\n      return session.accessToken;\n    }\n\n    const setSession = sessionStore.setSession?.bind(sessionStore);\n    if (!setSession) {\n      // No write session capabilities => can't refresh!\n      // Return the access token as-is\n      return session.accessToken;\n    } else {\n      return this.refreshSession(session.refreshToken, setSession);\n    }\n  }\n\n  private async refreshSession(\n    refreshToken: OAuthRefreshToken | undefined,\n    setSession: (session: OAuthSession | null) => Promise<void>\n  ): Promise<OAuthAccessToken | null> {\n    if (!refreshToken) {\n      await setSession(null);\n      return null;\n    }\n\n    try {\n      const sessionDto = await this.api.send<OAuthSessionDto>({\n        method: 'POST',\n        url: `/oauth/token`,\n        body: {\n          grant_type: 'refresh_token',\n          refresh_token: refreshToken,\n          client_id: this._config.clientId,\n          client_secret: this._config.clientSecret,\n        },\n      });\n      const newSession = OAuthSession.fromDto(sessionDto);\n      await setSession(newSession);\n      return newSession.accessToken;\n    } catch {\n      await setSession(null);\n      return null;\n    }\n  }\n\n  async logout(): Promise<void> {\n    const sessionStore = this._config.sessionStore;\n    const setSession = sessionStore.setSession?.bind(sessionStore);\n    if (!setSession) {\n      throw new WritableSessionStoreRequiredError();\n    }\n    const session = await sessionStore.getSession();\n    if (session != null) {\n      const tokenToRevoke = session.accessToken.value;\n      try {\n        await this.api.send({\n          method: 'POST',\n          url: `/oauth/revoke`,\n          body: {\n            token: tokenToRevoke,\n            client_id: this._config.clientId,\n            client_secret: this._config.clientSecret,\n          },\n        });\n      } catch (err) {\n        if (err instanceof HttpError) {\n          if (this.strict) {\n            throw err;\n          }\n        } else {\n          throw err;\n        }\n      }\n      // invalidate the session\n      await setSession(null);\n    }\n  }\n\n  private async ensureAuthenticated(): Promise<void> {\n    const token = await this.accessToken();\n    if (token === null) {\n      throw new NotAuthenticatedError();\n    }\n  }\n\n  async fetchOffers(): Promise<Offer[]> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOffers(this.api);\n  }\n\n  async fetchOffersPage(\n    params: PaginationParams\n  ): Promise<PaginatedResponse<Offer>> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOffersPage(this.api, params);\n  }\n\n  async fetchOfferDetails(id: OfferId): Promise<OfferDetail> {\n    await this.ensureAuthenticated();\n    return offersApi.fetchOfferDetails(this.api, id);\n  }\n\n  async fetchParticipations(offerId?: OfferId): Promise<Participation[]> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipations(this.api, offerId);\n  }\n\n  async fetchParticipationsPage(\n    params: ParticipationsPaginationParams\n  ): Promise<PaginatedResponse<Participation>> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipationsPage(this.api, params);\n  }\n\n  async fetchParticipation(id: ParticipationId): Promise<Participation> {\n    await this.ensureAuthenticated();\n    return participationsApi.fetchParticipation(this.api, id);\n  }\n\n  async createParticipation(\n    params: CreateParticipationParams\n  ): Promise<Participation> {\n    await this.ensureAuthenticated();\n    return participationsApi.createParticipation(this.api, params);\n  }\n\n  async fetchOfferRequirements(\n    offerId: OfferId\n  ): Promise<Record<OfferOptionId, Requirement[]>> {\n    await this.ensureAuthenticated();\n    return requirementsApi.fetchOfferRequirements(this.api, offerId);\n  }\n\n  async fetchRequirementStatuses(\n    offerId: OfferId\n  ): Promise<RequirementStatusInfo[]> {\n    await this.ensureAuthenticated();\n    return requirementsApi.fetchRequirementStatuses(this.api, offerId);\n  }\n}\n\nexport function createCoinListServer(config: ServerConfig): CoinListServer {\n  return new CoinListServerImpl(config);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIO,IAAM,MAAN,MAAU;AAAA,EAGf,YACE,QACA,kBACA;AACA,SAAK,SAAS,IAAI,uBAAuB,QAAQ,gBAAgB;AAAA,EACnE;AAAA,EAEA,MAAM,KAAgB,SAA0C;AAC9D,WAAO,KAAK,OAAO,KAAgB,OAAO;AAAA,EAC5C;AACF;;;ACjBO,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAC3D,YACE,UAAU,mJACV;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACkCA,IAAM,qCAAqC;AAsK3C,IAAM,qBAAN,MAAmD;AAAA,EAOjD,YAA6B,SAAuB;AAAvB;AAC3B,SAAK,UAAU,QAAQ,WAAW;AAClC,SAAK,iCACH,QAAQ,kCACR;AACF,SAAK,SAAS,QAAQ,UAAU;AAChC,SAAK,MAAM,IAAI;AAAA,MACb;AAAA,QACE,SAAS,KAAK;AAAA,QACd,aAAa;AAAA,MACf;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,YACC,WAAW,CAAC,KAAK,QAAQ,aAAa,aAClC,QAAQ,QAAQ,IAAI,IACpB,KAAK,YAAY;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,MACA,cACuB;AACvB,UAAM,eAAe,KAAK,QAAQ;AAClC,UAAM,aAAa,aAAa,YAAY,KAAK,YAAY;AAC7D,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,kCAAkC;AAAA,IAC9C;AACA,UAAM,aAAa,MAAM,KAAK,IAAI,KAAsB;AAAA,MACtD,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,MAAM;AAAA,QACJ,YAAY;AAAA,QACZ;AAAA,QACA,cAAc,KAAK,QAAQ;AAAA,QAC3B,WAAW,KAAK,QAAQ;AAAA,QACxB,eAAe,KAAK,QAAQ;AAAA,QAC5B,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AACD,UAAM,UAAU,aAAa,QAAQ,UAAU;AAC/C,UAAM,WAAW,OAAO;AACxB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAgD;AACpD,UAAM,eAAe,KAAK,QAAQ;AAClC,UAAM,UAAU,MAAM,aAAa,WAAW;AAC9C,QAAI,WAAW,KAAM,QAAO;AAE5B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,QAAQ,YAAY,UAAU,QAAQ;AACxD,UAAM,WAAW,KAAK,iCAAiC;AACvD,QAAI,YAAY,MAAM,UAAU;AAE9B,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,aAAa,aAAa,YAAY,KAAK,YAAY;AAC7D,QAAI,CAAC,YAAY;AAGf,aAAO,QAAQ;AAAA,IACjB,OAAO;AACL,aAAO,KAAK,eAAe,QAAQ,cAAc,UAAU;AAAA,IAC7D;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,cACA,YACkC;AAClC,QAAI,CAAC,cAAc;AACjB,YAAM,WAAW,IAAI;AACrB,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,aAAa,MAAM,KAAK,IAAI,KAAsB;AAAA,QACtD,QAAQ;AAAA,QACR,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,YAAY;AAAA,UACZ,eAAe;AAAA,UACf,WAAW,KAAK,QAAQ;AAAA,UACxB,eAAe,KAAK,QAAQ;AAAA,QAC9B;AAAA,MACF,CAAC;AACD,YAAM,aAAa,aAAa,QAAQ,UAAU;AAClD,YAAM,WAAW,UAAU;AAC3B,aAAO,WAAW;AAAA,IACpB,QAAQ;AACN,YAAM,WAAW,IAAI;AACrB,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,eAAe,KAAK,QAAQ;AAClC,UAAM,aAAa,aAAa,YAAY,KAAK,YAAY;AAC7D,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,kCAAkC;AAAA,IAC9C;AACA,UAAM,UAAU,MAAM,aAAa,WAAW;AAC9C,QAAI,WAAW,MAAM;AACnB,YAAM,gBAAgB,QAAQ,YAAY;AAC1C,UAAI;AACF,cAAM,KAAK,IAAI,KAAK;AAAA,UAClB,QAAQ;AAAA,UACR,KAAK;AAAA,UACL,MAAM;AAAA,YACJ,OAAO;AAAA,YACP,WAAW,KAAK,QAAQ;AAAA,YACxB,eAAe,KAAK,QAAQ;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,WAAW;AAC5B,cAAI,KAAK,QAAQ;AACf,kBAAM;AAAA,UACR;AAAA,QACF,OAAO;AACL,gBAAM;AAAA,QACR;AAAA,MACF;AAEA,YAAM,WAAW,IAAI;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,sBAAqC;AACjD,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI,sBAAsB;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,MAAM,cAAgC;AACpC,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,YAAY,KAAK,GAAG;AAAA,EACvC;AAAA,EAEA,MAAM,gBACJ,QACmC;AACnC,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,gBAAgB,KAAK,KAAK,MAAM;AAAA,EACnD;AAAA,EAEA,MAAM,kBAAkB,IAAmC;AACzD,UAAM,KAAK,oBAAoB;AAC/B,WAAiB,kBAAkB,KAAK,KAAK,EAAE;AAAA,EACjD;AAAA,EAEA,MAAM,oBAAoB,SAA6C;AACrE,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,oBAAoB,KAAK,KAAK,OAAO;AAAA,EAChE;AAAA,EAEA,MAAM,wBACJ,QAC2C;AAC3C,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,wBAAwB,KAAK,KAAK,MAAM;AAAA,EACnE;AAAA,EAEA,MAAM,mBAAmB,IAA6C;AACpE,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,mBAAmB,KAAK,KAAK,EAAE;AAAA,EAC1D;AAAA,EAEA,MAAM,oBACJ,QACwB;AACxB,UAAM,KAAK,oBAAoB;AAC/B,WAAyB,oBAAoB,KAAK,KAAK,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,uBACJ,SAC+C;AAC/C,UAAM,KAAK,oBAAoB;AAC/B,WAAuB,uBAAuB,KAAK,KAAK,OAAO;AAAA,EACjE;AAAA,EAEA,MAAM,yBACJ,SACkC;AAClC,UAAM,KAAK,oBAAoB;AAC/B,WAAuB,yBAAyB,KAAK,KAAK,OAAO;AAAA,EACnE;AACF;AAEO,SAAS,qBAAqB,QAAsC;AACzE,SAAO,IAAI,mBAAmB,MAAM;AACtC;","names":[]}

package/dist/shared/index.cjs

@@ -45,6 +45,7 @@ __export(shared_exports, {
   OfferOptionId: () => OfferOptionId,
   OfferOptionSlug: () => OfferOptionSlug,
   OfferSlug: () => OfferSlug,
+  PKCEState: () => PKCEState,
   PaginatedResponse: () => PaginatedResponse,
   PaginationParams: () => PaginationParams,
   Participation: () => Participation,
@@ -59,7 +60,8 @@ __export(shared_exports, {
   UserEmail: () => UserEmail,
   UserId: () => UserId,
   WalletAddress: () => WalletAddress,
-  fetchAllPages: () => fetchAllPages
+  fetchAllPages: () => fetchAllPages,
+  generatePKCEParams: () => generatePKCEParams
 });
 module.exports = __toCommonJS(shared_exports);
 
@@ -102,6 +104,68 @@ var PaginationParams = {
   }
 };
 
+// src/shared/types/oauth.ts
+var AuthorizationCode = (value) => value;
+var CodeVerifier = (value) => value;
+var CodeChallenge = (value) => value;
+var PKCEState = (value) => value;
+var RedirectUri = (value) => value;
+var ClientId = (value) => value;
+var ClientSecret = (value) => value;
+
+// src/shared/utils.ts
+async function sha256(data) {
+  const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  const buffer = bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+  return crypto.subtle.digest("SHA-256", buffer);
+}
+function arrayBufferToBase64Url(buffer, padding = true) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  let base64 = btoa(binary);
+  base64 = base64.replace(/\+/g, "-").replace(/\//g, "_");
+  if (!padding) {
+    base64 = base64.replace(/=+$/, "");
+  }
+  return base64;
+}
+function generateSecureRandomBase64Url(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  const buffer = bytes.buffer;
+  return arrayBufferToBase64Url(buffer, false);
+}
+function notBlankStringOrNull(value) {
+  if (value?.trim()) {
+    return value;
+  } else {
+    return null;
+  }
+}
+
+// src/shared/pkce.ts
+async function generatePKCEParams(config) {
+  const state = generateSecureRandomBase64Url(32);
+  const codeVerifier = generateSecureRandomBase64Url(32);
+  const codeChallengeRaw = await sha256(codeVerifier);
+  const codeChallenge = arrayBufferToBase64Url(codeChallengeRaw, false);
+  return {
+    clientId: config.clientId,
+    responseType: "code",
+    redirectUri: config.redirectUri,
+    codeChallenge: CodeChallenge(codeChallenge),
+    codeChallengeMethod: "S256",
+    state: PKCEState(state),
+    codeVerifier: CodeVerifier(codeVerifier)
+  };
+}
+
 // src/shared/types/asset.ts
 var AssetId = (value) => value;
 var AssetCode = (value) => value;
@@ -128,14 +192,6 @@ var NotAuthenticatedError = class extends Error {
   }
 };
 
-// src/shared/types/oauth.ts
-var AuthorizationCode = (value) => value;
-var CodeVerifier = (value) => value;
-var CodeChallenge = (value) => value;
-var RedirectUri = (value) => value;
-var ClientId = (value) => value;
-var ClientSecret = (value) => value;
-
 // src/shared/types/oauth-session.ts
 var OAuthRefreshToken = (value) => value;
 var OAuthSession = {
@@ -151,15 +207,6 @@ var OAuthSession = {
   }
 };
 
-// src/shared/utils.ts
-function notBlankStringOrNull(value) {
-  if (value?.trim()) {
-    return value;
-  } else {
-    return null;
-  }
-}
-
 // src/shared/types/offer.ts
 var OfferId = (value) => value;
 var OfferSlug = (value) => value;
@@ -356,6 +403,7 @@ var User = {
   OfferOptionId,
   OfferOptionSlug,
   OfferSlug,
+  PKCEState,
   PaginatedResponse,
   PaginationParams,
   Participation,
@@ -370,6 +418,7 @@ var User = {
   UserEmail,
   UserId,
   WalletAddress,
-  fetchAllPages
+  fetchAllPages,
+  generatePKCEParams
 });
 //# sourceMappingURL=index.cjs.map