@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.1

package/dist/testing.js

@@ -1,3 +1,119 @@
 export { brandIdentity as createTestIdentity } from './core/identity.js';
 // Enumerating wording (CWE-204) each host asserts its copy never matches; shared so the two suites can't drift.
 export const ENUMERATION_ORACLE = /\bexists?\b|already (?:registered|in use|have|exists)|wrong password|no account|not found|is registered|different (?:sign-in method|credential)/i;
+export function fakeWebSessionUser(overrides = {}) {
+    return {
+        id: 'user-1',
+        email: 'user-1@example.com',
+        name: 'Test User',
+        emailVerified: true,
+        signInProvider: 'google.com',
+        ...overrides
+    };
+}
+const FAKE_CSRF_TOKEN = 'fake-csrf-token';
+const DAY_MS = 24 * 60 * 60 * 1000;
+function jsonResponse(status, body) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' }
+    });
+}
+function errorResponse(status, code) {
+    return jsonResponse(status, { code, message: code });
+}
+function sessionBody(user, now) {
+    return {
+        user: {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            email_verified: user.emailVerified,
+            sign_in_provider: user.signInProvider
+        },
+        csrf_token: FAKE_CSRF_TOKEN,
+        expires_at: new Date(now() + DAY_MS).toISOString(),
+        absolute_expires_at: new Date(now() + 7 * DAY_MS).toISOString()
+    };
+}
+function routesFor(signInUser, now) {
+    const revoke = (endpoint) => {
+        endpoint.state = { kind: 'dead', code: 'session_revoked' };
+    };
+    return new Map([
+        [
+            'POST /api/auth/session',
+            (endpoint, headers) => {
+                if (!headers.get('authorization')?.startsWith('Bearer ')) {
+                    return errorResponse(401, 'no_session');
+                }
+                endpoint.state = { kind: 'live', user: signInUser };
+                return jsonResponse(200, { success: true, expiresIn: DAY_MS / 1000 });
+            }
+        ],
+        [
+            'DELETE /api/auth/session',
+            (endpoint) => {
+                revoke(endpoint);
+                return jsonResponse(200, { success: true });
+            }
+        ],
+        [
+            'GET /api/auth/session',
+            ({ state }) => state.kind === 'live'
+                ? jsonResponse(200, sessionBody(state.user, now))
+                : errorResponse(401, state.kind === 'dead' ? state.code : 'no_session')
+        ],
+        [
+            'POST /api/auth/sessions/revoke-all',
+            (endpoint, headers) => {
+                if (!headers.get('authorization')?.startsWith('Bearer ')) {
+                    return errorResponse(401, 'no_session');
+                }
+                if (endpoint.state.kind === 'dead') {
+                    return errorResponse(401, endpoint.state.code);
+                }
+                if (headers.get('x-csrf-token') !== FAKE_CSRF_TOKEN) {
+                    return errorResponse(403, 'csrf_invalid');
+                }
+                revoke(endpoint);
+                return jsonResponse(200, { revoked: 1 });
+            }
+        ]
+    ]);
+}
+/**
+ * A `fetch` serving ingest's session routes under `/api/auth`. POST with a
+ * bearer proof signs `signInUser` in; DELETE and revoke-all leave the cookie
+ * revoked, as the real endpoint does.
+ */
+export function createFakeWebSessionEndpoint({ state, signInUser = fakeWebSessionUser(), now = Date.now }) {
+    const requests = [];
+    const routes = routesFor(signInUser, now);
+    const endpoint = {
+        state,
+        requests,
+        fetch: async (input, init = {}) => {
+            const method = (init.method ?? 'GET').toUpperCase();
+            const { pathname } = new URL(input instanceof Request ? input.url : String(input));
+            const headers = new Headers(init.headers);
+            requests.push({
+                method,
+                path: pathname,
+                credentials: init.credentials,
+                cache: init.cache,
+                headers: Object.fromEntries(headers)
+            });
+            const current = endpoint.state;
+            if (current.kind === 'network_error') {
+                throw new TypeError('Failed to fetch');
+            }
+            if (current.kind === 'unavailable') {
+                return errorResponse(current.status, 'unavailable');
+            }
+            const route = routes.get(`${method} ${pathname}`);
+            return route ? route(endpoint, headers) : errorResponse(404, 'not_found');
+        }
+    };
+    return endpoint;
+}

package/dist/web/crossTabRefresh.d.ts

@@ -1,4 +1,5 @@
-import type { CrossTabRefreshPort } from '../core/session.js';
+import type { AccountCredential, CrossTabRefreshPort } from '../core/session.js';
+import type { VisibilityPort } from '../core/webSessionIdentity.js';
 /**
  * Web Locks + BroadcastChannel implementation of the cross-tab refresh port.
  * The coordination key names both the lock and the channel. Resolves to
@@ -15,4 +16,5 @@ import type { CrossTabRefreshPort } from '../core/session.js';
  * can do to siblings (hand them a token), not what it can reach. Hosts that
  * load third-party script into the realm accept that when they opt in.
  */
-export declare function createWebCrossTabRefreshPort(): CrossTabRefreshPort | undefined;
+export declare function createWebCrossTabRefreshPort<Message = AccountCredential>(): CrossTabRefreshPort<Message> | undefined;
+export declare function createWebVisibilityPort(): VisibilityPort | undefined;

package/dist/web/crossTabRefresh.js

@@ -119,3 +119,16 @@ export function createWebCrossTabRefreshPort() {
         }
     };
 }
+export function createWebVisibilityPort() {
+    if (typeof document === 'undefined')
+        return undefined;
+    const isVisible = () => document.visibilityState === 'visible';
+    return {
+        isVisible,
+        onChange: (listener) => {
+            const handler = () => listener(isVisible());
+            document.addEventListener('visibilitychange', handler);
+            return () => document.removeEventListener('visibilitychange', handler);
+        }
+    };
+}

package/dist/workspaceLink.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The workspace deep-link contract: the one query parameter, `workspace`,
+ * that every surface — the cloud app, comfy.org, and the billing SDK's entry
+ * URL — reads and writes to say which workspace a link is for.
+ *
+ * It is the URL parameter only, never the token API field. `POST
+ * /api/auth/token` still takes `{ workspace_id }` in its request body; that
+ * name does not change here and this module does not touch it.
+ *
+ * A destination applies the link before it loads workspace-scoped content:
+ * it mints a token for the named id and lets the server decide membership,
+ * the same way any other mint does. A payment or billing destination fails
+ * closed on a link it cannot honor and never acts on a workspace other than
+ * the one named — silently falling back to the caller's own active workspace
+ * would bill or expose the wrong one. A navigation destination may fall back
+ * to its own active workspace when the link is absent or invalid, but must
+ * show which workspace it landed on rather than switch silently. The
+ * parameter is carried through the sign-in redirect like any other query
+ * parameter on the path being returned to.
+ */
+export declare const WORKSPACE_LINK_PARAM = "workspace";
+export type WorkspaceLinkRead = {
+    readonly status: 'absent';
+} | {
+    readonly status: 'ok';
+    readonly workspaceId: string;
+} | {
+    readonly status: 'invalid';
+};
+export declare function isWorkspaceId(value: string): boolean;
+/**
+ * Reads the link out of a URL, a `URLSearchParams`, or a string (a full URL
+ * or the path-and-query form a router hands over). A missing parameter is
+ * `absent`; a present-but-empty value is `invalid`, the same as any other
+ * value outside the shared charset — an empty `workspace=` is a producer
+ * bug, not "no link," and a payment destination has to fail closed on it
+ * rather than treat it as though the link were never there. A repeated
+ * parameter is also `invalid` rather than picking one, so a caller cannot be
+ * pointed at two different workspaces by ambiguity.
+ */
+export declare function readWorkspaceLink(source: URL | URLSearchParams | string): WorkspaceLinkRead;
+/** Returns a new `URL` carrying the link; never mutates `url`. Throws `RangeError` on an id outside the shared charset. */
+export declare function withWorkspaceLink(url: URL, workspaceId: string): URL;
+/** Returns a new `URL` with the link removed; never mutates `url`. */
+export declare function withoutWorkspaceLink(url: URL): URL;

package/dist/workspaceLink.js

@@ -0,0 +1,78 @@
+/**
+ * The workspace deep-link contract: the one query parameter, `workspace`,
+ * that every surface — the cloud app, comfy.org, and the billing SDK's entry
+ * URL — reads and writes to say which workspace a link is for.
+ *
+ * It is the URL parameter only, never the token API field. `POST
+ * /api/auth/token` still takes `{ workspace_id }` in its request body; that
+ * name does not change here and this module does not touch it.
+ *
+ * A destination applies the link before it loads workspace-scoped content:
+ * it mints a token for the named id and lets the server decide membership,
+ * the same way any other mint does. A payment or billing destination fails
+ * closed on a link it cannot honor and never acts on a workspace other than
+ * the one named — silently falling back to the caller's own active workspace
+ * would bill or expose the wrong one. A navigation destination may fall back
+ * to its own active workspace when the link is absent or invalid, but must
+ * show which workspace it landed on rather than switch silently. The
+ * parameter is carried through the sign-in redirect like any other query
+ * parameter on the path being returned to.
+ */
+export const WORKSPACE_LINK_PARAM = 'workspace';
+/** Same charset as `@comfyorg/billing-contract`'s identifiers: no path separator, query delimiter, or percent escape survives it. */
+const WORKSPACE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+export function isWorkspaceId(value) {
+    return WORKSPACE_ID.test(value);
+}
+/** Reserved by RFC 2606; only used to parse a path+query string that carries no origin of its own. */
+const PARSE_BASE = 'https://workspace-link.invalid/';
+function searchParamsOf(source) {
+    if (source instanceof URLSearchParams)
+        return source;
+    if (source instanceof URL)
+        return source.searchParams;
+    try {
+        return new URL(source, PARSE_BASE).searchParams;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Reads the link out of a URL, a `URLSearchParams`, or a string (a full URL
+ * or the path-and-query form a router hands over). A missing parameter is
+ * `absent`; a present-but-empty value is `invalid`, the same as any other
+ * value outside the shared charset — an empty `workspace=` is a producer
+ * bug, not "no link," and a payment destination has to fail closed on it
+ * rather than treat it as though the link were never there. A repeated
+ * parameter is also `invalid` rather than picking one, so a caller cannot be
+ * pointed at two different workspaces by ambiguity.
+ */
+export function readWorkspaceLink(source) {
+    const params = searchParamsOf(source);
+    if (!params)
+        return { status: 'absent' };
+    const values = params.getAll(WORKSPACE_LINK_PARAM);
+    if (values.length === 0)
+        return { status: 'absent' };
+    if (values.length > 1)
+        return { status: 'invalid' };
+    const [value] = values;
+    if (!isWorkspaceId(value))
+        return { status: 'invalid' };
+    return { status: 'ok', workspaceId: value };
+}
+/** Returns a new `URL` carrying the link; never mutates `url`. Throws `RangeError` on an id outside the shared charset. */
+export function withWorkspaceLink(url, workspaceId) {
+    if (!isWorkspaceId(workspaceId))
+        throw new RangeError(`not a workspace id: ${workspaceId}`);
+    const next = new URL(url.href);
+    next.searchParams.set(WORKSPACE_LINK_PARAM, workspaceId);
+    return next;
+}
+/** Returns a new `URL` with the link removed; never mutates `url`. */
+export function withoutWorkspaceLink(url) {
+    const next = new URL(url.href);
+    next.searchParams.delete(WORKSPACE_LINK_PARAM);
+    return next;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comfyorg/account-core",
-  "version": "1.0.0-alpha.0",
+  "version": "1.0.0-alpha.1",
   "description": "Shared account layer: a framework-free session core that exchanges a signed-in identity for the workspace-scoped Cloud JWT with valid-on-read freshness, plus the package-owned Firebase identity entry. It has no view layer and no Vue dependency; the composables and unstyled components ship from @comfyorg/account-ui",
   "keywords": [],
   "homepage": "https://comfy.org",
@@ -29,6 +29,26 @@
       "types": "./dist/core/session.d.ts",
       "import": "./dist/core/session.js"
     },
+    "./webSession": {
+      "types": "./dist/core/webSession.d.ts",
+      "import": "./dist/core/webSession.js"
+    },
+    "./webSessionFlag": {
+      "types": "./dist/core/webSessionFlag.d.ts",
+      "import": "./dist/core/webSessionFlag.js"
+    },
+    "./requestAuth": {
+      "types": "./dist/core/requestAuth.d.ts",
+      "import": "./dist/core/requestAuth.js"
+    },
+    "./sessionTokenMint": {
+      "types": "./dist/core/sessionTokenMint.d.ts",
+      "import": "./dist/core/sessionTokenMint.js"
+    },
+    "./webSessionIdentity": {
+      "types": "./dist/core/webSessionIdentity.d.ts",
+      "import": "./dist/core/webSessionIdentity.js"
+    },
     "./billing": {
       "types": "./dist/core/billing/index.d.ts",
       "import": "./dist/core/billing/index.js"
@@ -73,6 +93,10 @@
       "types": "./dist/redirect.d.ts",
       "import": "./dist/redirect.js"
     },
+    "./workspaceLink": {
+      "types": "./dist/workspaceLink.d.ts",
+      "import": "./dist/workspaceLink.js"
+    },
     "./telemetry": {
       "types": "./dist/telemetry.d.ts",
       "import": "./dist/telemetry.js"
@@ -87,15 +111,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@comfyorg/ingest-types": "^1.0.0"
+    "@comfyorg/ingest-types": "^1.1.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.5",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^5.0.2",
     "firebase": "^11.6.0",
-    "happy-dom": "20.9.0",
+    "happy-dom": "20.14.5",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.2",
     "zod": "^3.23.8"
   },
   "peerDependencies": {
@@ -109,6 +133,6 @@
     "lint": "oxlint src --type-aware && eslint src",
     "smoke:pack": "tsx scripts/smokePack.ts",
     "test": "vitest run",
-    "typecheck": "tsc --noEmit && tsc -p scripts/tsconfig.json"
+    "typecheck": "tsx ../../scripts/vue-tsc-native.ts --noEmit && tsx ../../scripts/vue-tsc-native.ts -p scripts/tsconfig.json"
   }
 }