@deepkey/sdk 1.0.0 → 1.2.0

package/dist/server.js

@@ -1,42 +1,78 @@
 import {
   AuthError,
   DEEPKEY_API_URL,
+  request,
   resolveBaseUrl
-} from "./chunk-IFNRLMVX.js";
+} from "./chunk-J4IK2N4V.js";
 
 // src/server.ts
 var createServerClient = (secretKey, options = {}) => {
-  const baseUrl = resolveBaseUrl(options.__internalBaseUrl);
-  const fetchImpl = options.fetch ?? fetch;
+  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch };
+  const connection = (id) => `/auth/v1/connections/${encodeURIComponent(id)}`;
   return {
     auth: {
       async getUser(jwt) {
-        try {
-          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {
-            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey }
-          });
-          let payload = null;
-          try {
-            payload = await response.json();
-          } catch {
-            payload = null;
-          }
-          if (!response.ok) {
-            const errorBody = payload?.error;
-            return {
-              data: { user: null },
-              error: new AuthError(
-                errorBody?.message ?? `Request failed with status ${response.status}`,
-                response.status,
-                errorBody?.code
-              )
-            };
-          }
-          return { data: { user: payload }, error: null };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : "Network request failed";
-          return { data: { user: null }, error: new AuthError(message, 0, "network_error") };
-        }
+        const { data, error } = await request({ ...base, method: "GET", path: "/auth/v1/user", accessToken: jwt });
+        return { data: { user: data }, error };
+      }
+    },
+    connections: {
+      async list({ userId }) {
+        const { data, error } = await request({
+          ...base,
+          method: "GET",
+          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`
+        });
+        return { data: { connections: data?.connections ?? [] }, error };
+      },
+      async issueAccessToken(connectionId) {
+        return request({
+          ...base,
+          method: "POST",
+          path: `${connection(connectionId)}/token`,
+          body: {}
+        });
+      },
+      async revoke(connectionId) {
+        const { error } = await request({ ...base, method: "DELETE", path: connection(connectionId) });
+        return { error };
+      }
+    },
+    apiKeys: {
+      async create({ userId, name }) {
+        const { data, error } = await request({
+          ...base,
+          method: "POST",
+          path: "/auth/v1/api-keys",
+          body: { user_id: userId, name }
+        });
+        return { data: { apiKey: data?.api_key ?? null, key: data?.key ?? null }, error };
+      },
+      async list({ userId }) {
+        const { data, error } = await request({
+          ...base,
+          method: "GET",
+          path: `/auth/v1/api-keys?user_id=${encodeURIComponent(userId)}`
+        });
+        return { data: { apiKeys: data?.api_keys ?? [] }, error };
+      },
+      async revoke(apiKeyId) {
+        const { error } = await request({
+          ...base,
+          method: "DELETE",
+          path: `/auth/v1/api-keys/${encodeURIComponent(apiKeyId)}`
+        });
+        return { error };
+      },
+      // The key travels in the request body so it never reaches a URL or an access log.
+      async verify(apiKey) {
+        const { data, error } = await request({
+          ...base,
+          method: "POST",
+          path: "/auth/v1/api-keys/verify",
+          body: { api_key: apiKey }
+        });
+        return { data: { user: data?.user ?? null, apiKey: data?.api_key ?? null }, error };
       }
     }
   };

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { AuthError, type ServerClientOptions, type User } from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<{ data: { user: User | null }; error: AuthError | null }>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const baseUrl = resolveBaseUrl(options.__internalBaseUrl)\n  const fetchImpl = options.fetch ?? fetch\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        try {\n          const response = await fetchImpl(`${baseUrl}/auth/v1/user`, {\n            headers: { Authorization: `Bearer ${jwt}`, apikey: secretKey },\n          })\n\n          let payload: unknown = null\n          try {\n            payload = await response.json()\n          } catch {\n            payload = null\n          }\n\n          if (!response.ok) {\n            const errorBody = (payload as { error?: { code?: string; message?: string } } | null)?.error\n            return {\n              data: { user: null },\n              error: new AuthError(\n                errorBody?.message ?? `Request failed with status ${response.status}`,\n                response.status,\n                errorBody?.code,\n              ),\n            }\n          }\n\n          return { data: { user: payload as User }, error: null }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : 'Network request failed'\n          return { data: { user: null }, error: new AuthError(message, 0, 'network_error') }\n        }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport { AuthError, type ServerClientOptions, type User } from './types'\n"],"mappings":";;;;;;;AAcO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,YAAY,QAAQ,SAAS;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,YAAI;AACF,gBAAM,WAAW,MAAM,UAAU,GAAG,OAAO,iBAAiB;AAAA,YAC1D,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,QAAQ,UAAU;AAAA,UAC/D,CAAC;AAED,cAAI,UAAmB;AACvB,cAAI;AACF,sBAAU,MAAM,SAAS,KAAK;AAAA,UAChC,QAAQ;AACN,sBAAU;AAAA,UACZ;AAEA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,YAAa,SAAoE;AACvF,mBAAO;AAAA,cACL,MAAM,EAAE,MAAM,KAAK;AAAA,cACnB,OAAO,IAAI;AAAA,gBACT,WAAW,WAAW,8BAA8B,SAAS,MAAM;AAAA,gBACnE,SAAS;AAAA,gBACT,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACF;AAEA,iBAAO,EAAE,MAAM,EAAE,MAAM,QAAgB,GAAG,OAAO,KAAK;AAAA,QACxD,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU,SAAS,GAAG,eAAe,EAAE;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { resolveBaseUrl } from './constants'\nimport { request } from './fetch'\nimport type {\n  AuthError,\n  AuthResponse,\n  ProviderAccessToken,\n  ProviderConnection,\n  ServerClientOptions,\n  User,\n  UserApiKey,\n} from './types'\n\nexport interface ServerAuthClient {\n  auth: {\n    // Mirrors `supabase.auth.getUser(jwt)` server-side: validates the access token\n    // against the auth service and returns the user.\n    getUser(jwt: string): Promise<AuthResponse<{ user: User | null }>>\n  }\n  // Provider connections a user granted through the browser SDK. The secret key acts\n  // for the whole project; provider access tokens are issued only here, never to browsers.\n  connections: {\n    list(params: { userId: string }): Promise<AuthResponse<{ connections: ProviderConnection[] }>>\n    issueAccessToken(connectionId: string): Promise<AuthResponse<ProviderAccessToken | null>>\n    revoke(connectionId: string): Promise<{ error: AuthError | null }>\n  }\n  // Long-lived keys your application issues to its own users. Every call uses the secret\n  // key; `verify` is the API-key counterpart of `auth.getUser(jwt)` and returns the same user.\n  apiKeys: {\n    // `key` is the plaintext. It is returned here once and cannot be read again.\n    create(params: {\n      userId: string\n      name?: string\n    }): Promise<AuthResponse<{ apiKey: UserApiKey | null; key: string | null }>>\n    list(params: { userId: string }): Promise<AuthResponse<{ apiKeys: UserApiKey[] }>>\n    revoke(apiKeyId: string): Promise<{ error: AuthError | null }>\n    verify(apiKey: string): Promise<AuthResponse<{ user: User | null; apiKey: UserApiKey | null }>>\n  }\n}\n\n// Runs anywhere with global fetch (Bun, Node >= 18). `secretKey` is the project's\n// bt_secret_... key. Requests target the hosted DeepKey API; the internal\n// override is reserved for DeepKey's console and tests.\nexport const createServerClient = (secretKey: string, options: ServerClientOptions = {}): ServerAuthClient => {\n  const base = { apikey: secretKey, baseUrl: resolveBaseUrl(options.__internalBaseUrl), fetchImpl: options.fetch }\n  const connection = (id: string) => `/auth/v1/connections/${encodeURIComponent(id)}`\n\n  return {\n    auth: {\n      async getUser(jwt: string) {\n        const { data, error } = await request<User>({ ...base, method: 'GET', path: '/auth/v1/user', accessToken: jwt })\n        return { data: { user: data }, error }\n      },\n    },\n    connections: {\n      async list({ userId }) {\n        const { data, error } = await request<{ connections: ProviderConnection[] }>({\n          ...base,\n          method: 'GET',\n          path: `/auth/v1/connections?user_id=${encodeURIComponent(userId)}`,\n        })\n        return { data: { connections: data?.connections ?? [] }, error }\n      },\n      async issueAccessToken(connectionId) {\n        return request<ProviderAccessToken>({\n          ...base,\n          method: 'POST',\n          path: `${connection(connectionId)}/token`,\n          body: {},\n        })\n      },\n      async revoke(connectionId) {\n        const { error } = await request({ ...base, method: 'DELETE', path: connection(connectionId) })\n        return { error }\n      },\n    },\n    apiKeys: {\n      async create({ userId, name }) {\n        const { data, error } = await request<{ api_key: UserApiKey; key: string }>({\n          ...base,\n          method: 'POST',\n          path: '/auth/v1/api-keys',\n          body: { user_id: userId, name },\n        })\n        return { data: { apiKey: data?.api_key ?? null, key: data?.key ?? null }, error }\n      },\n      async list({ userId }) {\n        const { data, error } = await request<{ api_keys: UserApiKey[] }>({\n          ...base,\n          method: 'GET',\n          path: `/auth/v1/api-keys?user_id=${encodeURIComponent(userId)}`,\n        })\n        return { data: { apiKeys: data?.api_keys ?? [] }, error }\n      },\n      async revoke(apiKeyId) {\n        const { error } = await request({\n          ...base,\n          method: 'DELETE',\n          path: `/auth/v1/api-keys/${encodeURIComponent(apiKeyId)}`,\n        })\n        return { error }\n      },\n      // The key travels in the request body so it never reaches a URL or an access log.\n      async verify(apiKey) {\n        const { data, error } = await request<{ user: User; api_key: UserApiKey }>({\n          ...base,\n          method: 'POST',\n          path: '/auth/v1/api-keys/verify',\n          body: { api_key: apiKey },\n        })\n        return { data: { user: data?.user ?? null, apiKey: data?.api_key ?? null }, error }\n      },\n    },\n  }\n}\n\nexport { DEEPKEY_API_URL } from './constants'\nexport {\n  AuthError,\n  type AuthResponse,\n  type ProviderAccessToken,\n  type ProviderConnection,\n  type ServerClientOptions,\n  type User,\n  type UserApiKey,\n} from './types'\n"],"mappings":";;;;;;;;AA0CO,IAAM,qBAAqB,CAAC,WAAmB,UAA+B,CAAC,MAAwB;AAC5G,QAAM,OAAO,EAAE,QAAQ,WAAW,SAAS,eAAe,QAAQ,iBAAiB,GAAG,WAAW,QAAQ,MAAM;AAC/G,QAAM,aAAa,CAAC,OAAe,wBAAwB,mBAAmB,EAAE,CAAC;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM,QAAQ,KAAa;AACzB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAc,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,iBAAiB,aAAa,IAAI,CAAC;AAC/G,eAAO,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,MAAM;AAAA,MACvC;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,MAAM,KAAK,EAAE,OAAO,GAAG;AACrB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAA+C;AAAA,UAC3E,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,gCAAgC,mBAAmB,MAAM,CAAC;AAAA,QAClE,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,aAAa,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM;AAAA,MACjE;AAAA,MACA,MAAM,iBAAiB,cAAc;AACnC,eAAO,QAA6B;AAAA,UAClC,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,GAAG,WAAW,YAAY,CAAC;AAAA,UACjC,MAAM,CAAC;AAAA,QACT,CAAC;AAAA,MACH;AAAA,MACA,MAAM,OAAO,cAAc;AACzB,cAAM,EAAE,MAAM,IAAI,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,UAAU,MAAM,WAAW,YAAY,EAAE,CAAC;AAC7F,eAAO,EAAE,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,MAAM,OAAO,EAAE,QAAQ,KAAK,GAAG;AAC7B,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAA8C;AAAA,UAC1E,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,MAAM,EAAE,SAAS,QAAQ,KAAK;AAAA,QAChC,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,WAAW,MAAM,KAAK,MAAM,OAAO,KAAK,GAAG,MAAM;AAAA,MAClF;AAAA,MACA,MAAM,KAAK,EAAE,OAAO,GAAG;AACrB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAoC;AAAA,UAChE,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,6BAA6B,mBAAmB,MAAM,CAAC;AAAA,QAC/D,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,SAAS,MAAM,YAAY,CAAC,EAAE,GAAG,MAAM;AAAA,MAC1D;AAAA,MACA,MAAM,OAAO,UAAU;AACrB,cAAM,EAAE,MAAM,IAAI,MAAM,QAAQ;AAAA,UAC9B,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM,qBAAqB,mBAAmB,QAAQ,CAAC;AAAA,QACzD,CAAC;AACD,eAAO,EAAE,MAAM;AAAA,MACjB;AAAA;AAAA,MAEA,MAAM,OAAO,QAAQ;AACnB,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAA6C;AAAA,UACzE,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,MAAM,EAAE,SAAS,OAAO;AAAA,QAC1B,CAAC;AACD,eAAO,EAAE,MAAM,EAAE,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG,MAAM;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepkey/sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "DeepKey authentication SDK for the browser and server — a supabase-js compatible auth surface",
   "homepage": "https://deepkey.dev/sdk",
   "keywords": [
@@ -31,6 +31,12 @@
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm build"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -39,10 +45,5 @@
     "tsup": "^8.5.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
-  },
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
   }
-}
+}

package/dist/chunk-IFNRLMVX.js

@@ -1,23 +0,0 @@
-// src/constants.ts
-var DEEPKEY_API_URL = "https://deepkey.dev/api";
-var resolveBaseUrl = (url) => {
-  const candidate = typeof url === "string" ? url.trim() : "";
-  return (candidate || DEEPKEY_API_URL).replace(/\/+$/, "");
-};
-
-// src/types.ts
-var AuthError = class extends Error {
-  constructor(message, status, code) {
-    super(message);
-    this.name = "AuthError";
-    this.status = status;
-    this.code = code;
-  }
-};
-
-export {
-  DEEPKEY_API_URL,
-  resolveBaseUrl,
-  AuthError
-};
-//# sourceMappingURL=chunk-IFNRLMVX.js.map

package/dist/chunk-IFNRLMVX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/constants.ts","../src/types.ts"],"sourcesContent":["// The hosted DeepKey API. Every client talks to this origin; only DeepKey's own\n// console and test suites replace it through the internal override.\nexport const DEEPKEY_API_URL = 'https://deepkey.dev/api'\n\n// Resolves the base URL used for every request. An absent or blank internal\n// override keeps the hosted API; a provided value has any trailing slash removed\n// so path joins stay predictable.\nexport const resolveBaseUrl = (url?: string | null): string => {\n  const candidate = typeof url === 'string' ? url.trim() : ''\n  return (candidate || DEEPKEY_API_URL).replace(/\\/+$/, '')\n}\n","export interface UserIdentity {\n  identity_id: string\n  id: string\n  user_id: string\n  provider: string\n  identity_data: Record<string, unknown>\n  last_sign_in_at: string | null\n  created_at: string\n  updated_at: string\n}\n\nexport interface User {\n  id: string\n  aud: string\n  role: string\n  email: string | null\n  email_confirmed_at: string | null\n  app_metadata: { provider?: string | null; providers?: string[]; [key: string]: unknown }\n  user_metadata: {\n    name?: string\n    full_name?: string\n    avatar_url?: string\n    picture?: string\n    email?: string\n    [key: string]: unknown\n  }\n  identities?: UserIdentity[]\n  created_at: string\n  updated_at?: string\n  last_sign_in_at?: string | null\n}\n\nexport interface Session {\n  access_token: string\n  refresh_token: string\n  token_type: 'bearer'\n  expires_in: number\n  expires_at: number\n  user: User\n}\n\nexport class AuthError extends Error {\n  status?: number\n  code?: string\n\n  constructor(message: string, status?: number, code?: string) {\n    super(message)\n    this.name = 'AuthError'\n    this.status = status\n    this.code = code\n  }\n}\n\nexport type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED'\n\nexport interface Subscription {\n  id: string\n  unsubscribe: () => void\n}\n\nexport interface StorageAdapter {\n  getItem(key: string): string | null\n  setItem(key: string, value: string): void\n  removeItem(key: string): void\n}\n\nexport interface AuthClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  storageKey?: string\n  autoRefreshToken?: boolean\n  detectSessionInUrl?: boolean\n  persistSession?: boolean\n  storage?: StorageAdapter\n  fetch?: typeof fetch\n}\n\nexport interface ServerClientOptions {\n  /**\n   * @internal Replaces the hosted DeepKey API origin. Used only by DeepKey's own\n   * console and test suites; not supported for consumers and stripped from the\n   * published type declarations.\n   */\n  __internalBaseUrl?: string\n  fetch?: typeof fetch\n}\n\nexport interface SignInWithOtpCredentials {\n  email: string\n  options?: {\n    emailRedirectTo?: string\n    shouldCreateUser?: boolean\n    data?: Record<string, unknown>\n  }\n}\n\nexport interface VerifyOtpParams {\n  email: string\n  token: string\n  type: 'email' | 'magiclink'\n}\n\nexport interface SignInWithOAuthCredentials {\n  provider: string\n  options?: {\n    redirectTo?: string\n    scopes?: string\n    queryParams?: Record<string, string>\n    skipBrowserRedirect?: boolean\n  }\n}\n\nexport interface AuthResponse<T> {\n  data: T\n  error: AuthError | null\n}\n"],"mappings":";AAEO,IAAM,kBAAkB;AAKxB,IAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,YAAY,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACzD,UAAQ,aAAa,iBAAiB,QAAQ,QAAQ,EAAE;AAC1D;;;AC+BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAInC,YAAY,SAAiB,QAAiB,MAAe;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}