@dontcode2/backend 0.1.1 → 0.2.1

package/dist/chunk-CAYYXFFZ.js

@@ -0,0 +1,568 @@
+// src/cookies.ts
+var DEFAULT_SESSION_COOKIE_NAME = "dc_access_token";
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
+function serialize(name, value, options, maxAge) {
+  const sameSite = options.sameSite ?? "lax";
+  const secure = sameSite === "none" ? true : options.secure ?? true;
+  const httpOnly = options.httpOnly ?? true;
+  const path = options.path ?? "/";
+  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${path}`, `Max-Age=${maxAge}`];
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+  if (httpOnly) parts.push("HttpOnly");
+  if (secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function serializeSessionCookie(token, options = {}) {
+  const name = options.name ?? DEFAULT_SESSION_COOKIE_NAME;
+  const maxAge = options.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
+  return serialize(name, token, options, maxAge);
+}
+function clearSessionCookie(options = {}) {
+  const name = options.name ?? DEFAULT_SESSION_COOKIE_NAME;
+  return serialize(name, "", options, 0);
+}
+function readSessionToken(cookieHeader, name = DEFAULT_SESSION_COOKIE_NAME) {
+  if (!cookieHeader) return null;
+  for (const pair of cookieHeader.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() !== name) continue;
+    const raw = pair.slice(eq + 1).trim();
+    if (!raw) return null;
+    try {
+      return decodeURIComponent(raw);
+    } catch {
+      return raw;
+    }
+  }
+  return null;
+}
+
+// src/errors.ts
+var DontCodeError = class extends Error {
+  constructor(status, body) {
+    const message = typeof body?.error === "string" && body.error.length > 0 ? body.error : `DontCode request failed with status ${status}`;
+    super(message);
+    this.name = "DontCodeError";
+    this.status = status;
+    this.code = typeof body?.code === "string" ? body.code : void 0;
+    this.body = body ?? {};
+  }
+  /** True when the request was rejected by the per-key rate limiter. */
+  get rateLimited() {
+    return this.status === 429;
+  }
+};
+function isDontCodeError(err) {
+  if (err instanceof DontCodeError) return true;
+  return typeof err === "object" && err !== null && err.name === "DontCodeError";
+}
+
+// src/session.ts
+var DEFAULT_TTL_MS = 6e4;
+var DEFAULT_VERIFY_TIMEOUT_MS = 5e3;
+var InMemorySessionCache = class {
+  constructor() {
+    this.store = /* @__PURE__ */ new Map();
+  }
+  get(token) {
+    const hit = this.store.get(token);
+    if (!hit) return void 0;
+    if (Date.now() >= hit.expiresAtMs) {
+      this.store.delete(token);
+      return void 0;
+    }
+    return hit.value;
+  }
+  set(token, value, ttlMs) {
+    this.store.set(token, { value, expiresAtMs: Date.now() + ttlMs });
+  }
+  delete(token) {
+    this.store.delete(token);
+  }
+};
+function base64UrlDecode(segment) {
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.length % 4 === 0 ? base64 : base64 + "=".repeat(4 - base64.length % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  }
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeAccessToken(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    if (!payload || typeof payload.sub !== "string") return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isSessionExpired(input, opts = {}) {
+  const decoded = typeof input === "string" ? decodeAccessToken(input) : input;
+  if (!decoded || typeof decoded.exp !== "number") return false;
+  const nowSeconds = Date.now() / 1e3;
+  return nowSeconds >= decoded.exp - (opts.skewSeconds ?? 0);
+}
+function userFromClaims(decoded) {
+  return {
+    id: decoded.sub,
+    email: typeof decoded.email === "string" ? decoded.email : "",
+    role: decoded.role,
+    claims: decoded.claims
+  };
+}
+var SessionVerifier = class {
+  constructor(auth, options = {}) {
+    this.auth = auth;
+    this.cache = options.cache ?? new InMemorySessionCache();
+    this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    this.verifyTimeoutMs = options.verifyTimeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS;
+  }
+  async getSession({ accessToken, mode = "optimistic" }) {
+    const decoded = decodeAccessToken(accessToken);
+    if (!decoded) return { status: "anonymous", user: null, verified: false };
+    if (isSessionExpired(decoded)) {
+      return { status: "expired", user: null, verified: false, expiresAt: decoded.exp };
+    }
+    const optimistic = {
+      status: "active",
+      user: userFromClaims(decoded),
+      verified: false,
+      expiresAt: decoded.exp
+    };
+    if (mode === "optimistic") return optimistic;
+    const cached = this.cache.get(accessToken);
+    if (cached) return cached;
+    try {
+      const { user } = await this.auth.me({
+        accessToken,
+        timeoutMs: this.verifyTimeoutMs
+      });
+      const result = user ? { status: "active", user, verified: true, expiresAt: decoded.exp } : { status: "anonymous", user: null, verified: true };
+      this.cache.set(accessToken, result, this.ttlMs);
+      return result;
+    } catch (err) {
+      if (isDontCodeError(err) && err.status === 401) {
+        return { status: "anonymous", user: null, verified: true };
+      }
+      return { ...optimistic, status: "unavailable" };
+    }
+  }
+};
+
+// src/auth.ts
+var AUTH_BASE = "/api/v1/auth";
+var MfaApi = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Complete an MFA login. Pass the `challenge_token` from `login`, plus
+   *  either the authenticator `code` or a `recoveryCode`. */
+  challenge(input) {
+    return this.transport.json(`${AUTH_BASE}/mfa/challenge`, {
+      challenge_token: input.challengeToken,
+      code: input.code,
+      recovery_code: input.recoveryCode
+    });
+  }
+  /** Begin enrollment. Render the returned `otpauth_url` as a QR code.
+   *  Enrollment stays pending until `enrollConfirm`. */
+  enroll(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/enroll`,
+      {},
+      { accessToken: input.accessToken }
+    );
+  }
+  /** Confirm enrollment with the first authenticator code. The returned
+   *  `recovery_codes` are shown once and never again. */
+  enrollConfirm(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/enroll/confirm`,
+      { code: input.code },
+      { accessToken: input.accessToken }
+    );
+  }
+  /** Turn MFA off. Proves possession of the second factor via `code` or
+   *  `recoveryCode`. */
+  disable(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/disable`,
+      { code: input.code, recovery_code: input.recoveryCode },
+      { accessToken: input.accessToken }
+    );
+  }
+};
+var AuthApi = class {
+  constructor(transport, sessionOptions) {
+    this.transport = transport;
+    this.mfa = new MfaApi(transport);
+    this.sessions = new SessionVerifier(this, sessionOptions);
+  }
+  /** Create an account. If the project requires email verification the
+   *  response has `verification_required: true` and NO tokens; collect a
+   *  code and call `verifyEmail`, then `login`. */
+  signup(input) {
+    return this.transport.json(`${AUTH_BASE}/signup`, {
+      email: input.email,
+      password: input.password,
+      name: input.name,
+      role: input.role
+    });
+  }
+  /** Authenticate. Branch on `mfa_required`: when true you hold only a
+   *  challenge (finish via `mfa.challenge`); otherwise `tokens` is your
+   *  session. A 403 `EmailNotVerified` means the email step isn't done. */
+  login(input) {
+    return this.transport.json(`${AUTH_BASE}/login`, {
+      email: input.email,
+      password: input.password
+    });
+  }
+  /** Validate the current credential (API key or device token) and report the
+   *  project, the caller's role, and which capabilities that role grants.
+   *  Backs the MCP "is my session still good" check. */
+  info() {
+    return this.transport.get("/api/v1/info");
+  }
+  /** Resolve the signed-in user from their access token, or `{ user: null }`.
+   *  This is a network round-trip; for a per-navigation guard prefer
+   *  `getSession`, which can answer offline and caches verified results. */
+  me(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/me`,
+      {},
+      { accessToken: input.accessToken, timeoutMs: input.timeoutMs }
+    );
+  }
+  /**
+   * Resolve an access token into a session for a route guard, the one call
+   * that replaces "hit `me` on every navigation". Two modes:
+   *
+   *   - `'optimistic'` (default): decode the token locally and trust its
+   *     claims. Zero network, zero stall. The right default for gating page
+   *     loads. It does NOT verify the signature and will not notice a
+   *     server-side revocation until the token's own `exp`.
+   *   - `'verified'`: confirm against the gateway's `me`, cached for a short
+   *     TTL with a hard timeout. Use it before sensitive actions. On a
+   *     timeout/outage it returns `status: 'unavailable'` with the optimistic
+   *     user, so you choose whether to fail open rather than the SDK guessing.
+   *
+   * See the BYOC docs ("Sessions") for the full reasoning and best practices.
+   */
+  getSession(input) {
+    return this.sessions.getSession(input);
+  }
+  /** Read the access token from a `Cookie` request header and resolve it, in
+   *  one call. `name` defaults to `dc_access_token`. Returns the anonymous
+   *  session when no cookie is present. */
+  sessionFromCookies(cookieHeader, options = {}) {
+    const token = readSessionToken(cookieHeader, options.cookieName);
+    if (!token) return Promise.resolve({ status: "anonymous", user: null, verified: false });
+    return this.sessions.getSession({ accessToken: token, mode: options.mode });
+  }
+  /** Decode an access token's claims locally without a network call or any
+   *  signature check. Convenience re-export of `decodeAccessToken`. */
+  decodeToken(token) {
+    return decodeAccessToken(token);
+  }
+  /** Confirm the 6-digit code emailed at signup. */
+  verifyEmail(input) {
+    return this.transport.json(`${AUTH_BASE}/verify-email`, {
+      code: input.code,
+      email: input.email
+    });
+  }
+  forgotPassword(input) {
+    return this.transport.json(`${AUTH_BASE}/forgot-password`, {
+      email: input.email
+    });
+  }
+  resetPassword(input) {
+    return this.transport.json(`${AUTH_BASE}/reset-password`, {
+      code: input.code,
+      password: input.password,
+      email: input.email
+    });
+  }
+};
+
+// src/db.ts
+var DB_PATH = "/api/v1/db";
+var MIGRATE_PATH = "/api/v1/db/migrate";
+var TableQuery = class {
+  constructor(transport, tableName) {
+    this.transport = transport;
+    this.tableName = tableName;
+  }
+  async run(operation, options) {
+    const res = await this.transport.json(DB_PATH, {
+      operation,
+      tableName: this.tableName,
+      options
+    });
+    return res.data;
+  }
+  /** Rows matching the query (max 1000 per call). */
+  find(options = {}) {
+    return this.run("find", options);
+  }
+  /** Alias of `find`. */
+  findMany(options = {}) {
+    return this.run("findMany", options);
+  }
+  /** The first matching row, or `null`. */
+  findFirst(options = {}) {
+    return this.run("findFirst", options);
+  }
+  /** Alias of `findFirst`. */
+  findOne(options = {}) {
+    return this.run("findOne", options);
+  }
+  /** Insert one row. Returns `{ id }`. Unique/FK conflicts throw a 409
+   *  DontCodeError, the supported idempotency signal. */
+  insert(data) {
+    return this.run("insert", { data });
+  }
+  /** Update rows matching `where`. Returns `{ count }`. */
+  update(input) {
+    return this.run("update", { where: input.where, data: input.data });
+  }
+  /** Delete rows matching `where`. Returns `{ count }`. */
+  delete(input) {
+    return this.run("delete", { where: input.where });
+  }
+  /** Count matching rows. */
+  count(options = {}) {
+    return this.run("count", options);
+  }
+};
+function createDb(transport) {
+  const table = (tableName) => new TableQuery(transport, tableName);
+  const migrate = (input) => transport.json(MIGRATE_PATH, { sql: input.sql });
+  return new Proxy(table, {
+    get(target, prop, receiver) {
+      if (prop === "migrate") return migrate;
+      if (typeof prop !== "string" || prop === "then" || prop in target) {
+        return Reflect.get(target, prop, receiver);
+      }
+      return new TableQuery(transport, prop);
+    },
+    apply(_target, _thisArg, args) {
+      return table(args[0]);
+    }
+  });
+}
+
+// src/storage.ts
+var STORAGE_PATH = "/api/v1/storage";
+var DEFAULT_CONTENT_TYPE = "application/octet-stream";
+function toBlob(body, contentType) {
+  if (body instanceof Blob) return body;
+  if (typeof body === "string") return new Blob([body], { type: contentType });
+  if (body instanceof ArrayBuffer) return new Blob([body], { type: contentType });
+  if (ArrayBuffer.isView(body)) {
+    return new Blob([body], { type: contentType });
+  }
+  throw new TypeError("upload expects a Blob, ArrayBuffer, typed array, or string");
+}
+function fileName(path) {
+  return path.split("/").filter(Boolean).pop() ?? path;
+}
+var BucketClient = class {
+  constructor(transport, bucket) {
+    this.transport = transport;
+    this.bucket = bucket;
+  }
+  op(operation, params = {}) {
+    return this.transport.json(STORAGE_PATH, { operation, bucket: this.bucket, ...params });
+  }
+  /** List objects under `prefix`. */
+  list(prefix) {
+    return this.op("list", { prefix });
+  }
+  /** Delete one or more objects. Returns `{ deleted }`. */
+  remove(paths) {
+    return this.op("remove", { paths });
+  }
+  /** Move/rename an object within the bucket. */
+  move(from, to) {
+    return this.op("move", { from, to });
+  }
+  createFolder(path) {
+    return this.op("createFolder", { path });
+  }
+  /** Download an object inline (≤ 8 MB). Use `getTemporaryUrl` for larger files. */
+  download(path) {
+    return this.op("download", { path });
+  }
+  /** A short-lived signed URL (default 300s, max 7 days). */
+  getTemporaryUrl(path, expiresIn) {
+    return this.op("getTemporaryUrl", { path, expiresIn });
+  }
+  /** A presigned PUT URL for direct, large uploads (≤ no inline limit). */
+  presignUpload(path, contentType) {
+    return this.op("presignUpload", { path, contentType });
+  }
+  /** Upload bytes directly (≤ 100 MB). For larger files, `presignUpload`
+   *  then PUT to the returned URL yourself. */
+  upload(path, body, contentType = DEFAULT_CONTENT_TYPE) {
+    const form = new FormData();
+    form.append("file", toBlob(body, contentType), fileName(path));
+    form.append("bucket", this.bucket);
+    form.append("path", path);
+    form.append("contentType", contentType);
+    return this.transport.multipart(STORAGE_PATH, form);
+  }
+};
+var PublicBucketClient = class extends BucketClient {
+  constructor(transport) {
+    super(transport, "public");
+  }
+  /** The permanent public URL for an object. */
+  getUrl(path) {
+    return this.op("getUrl", { path });
+  }
+};
+function createStorage(transport) {
+  return {
+    public: new PublicBucketClient(transport),
+    private: new BucketClient(transport, "private")
+  };
+}
+
+// src/http.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var Transport = class {
+  constructor(config) {
+    this.config = config;
+  }
+  headers(opts) {
+    const headers = {};
+    if (this.config.apiKey) headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    if (opts?.accessToken) headers["X-Access-Token"] = opts.accessToken;
+    return headers;
+  }
+  url(path) {
+    return `${this.config.baseUrl}${path}`;
+  }
+  timeout(opts) {
+    const value = opts?.timeoutMs ?? this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return value > 0 ? value : 0;
+  }
+  /**
+   * One fetch, with a timeout that turns "hung socket" into a fast, typed
+   * failure. A timeout surfaces as `DontCodeError` with status 408 / code
+   * `Timeout`; any other transport failure (DNS, refused, offline) as status
+   * 0 / code `NetworkError`. Both are distinct from a real `401`, so an auth
+   * guard can tell "backend is down" apart from "user is signed out".
+   */
+  async send(path, init, opts) {
+    const timeoutMs = this.timeout(opts);
+    const controller = timeoutMs > 0 ? new AbortController() : void 0;
+    const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+    try {
+      return await fetch(this.url(path), { ...init, signal: controller?.signal });
+    } catch (err) {
+      if (controller?.signal.aborted) {
+        throw new DontCodeError(408, {
+          error: `Request to ${path} timed out after ${timeoutMs}ms`,
+          code: "Timeout"
+        });
+      }
+      throw new DontCodeError(0, {
+        error: err instanceof Error ? err.message : "Network request failed",
+        code: "NetworkError"
+      });
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+  /** GET and parse the JSON response. */
+  async get(path, opts) {
+    const res = await this.send(path, { method: "GET", headers: this.headers(opts) }, opts);
+    return this.parse(res);
+  }
+  /** POST a JSON body and parse the JSON response. */
+  async json(path, body, opts) {
+    const res = await this.send(
+      path,
+      {
+        method: "POST",
+        headers: { ...this.headers(opts), "Content-Type": "application/json" },
+        body: JSON.stringify(body ?? {})
+      },
+      opts
+    );
+    return this.parse(res);
+  }
+  /** PUT a multipart form (file uploads). The runtime sets the boundary. */
+  async multipart(path, form, opts) {
+    const res = await this.send(path, { method: "PUT", headers: this.headers(opts), body: form }, opts);
+    return this.parse(res);
+  }
+  async parse(res) {
+    const raw = await res.text();
+    let data = null;
+    if (raw) {
+      try {
+        data = JSON.parse(raw);
+      } catch {
+        data = { error: raw };
+      }
+    }
+    if (!res.ok) {
+      const body = data && typeof data === "object" ? data : { error: res.statusText || "Request failed" };
+      throw new DontCodeError(res.status, body);
+    }
+    return data;
+  }
+};
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://backend.dontcode.co";
+function fromEnv(name) {
+  if (typeof process === "undefined" || !process.env) return void 0;
+  return process.env[name];
+}
+function dontcode(options = {}) {
+  const apiKey = options.apiKey ?? fromEnv("DONTCODE_API_KEY");
+  const baseUrl = (options.baseUrl ?? fromEnv("DONTCODE_API_URL") ?? DEFAULT_BASE_URL).replace(
+    /\/+$/,
+    ""
+  );
+  const transport = new Transport({ apiKey, baseUrl, timeoutMs: options.timeoutMs });
+  return {
+    auth: new AuthApi(transport, options.session),
+    db: createDb(transport),
+    storage: createStorage(transport)
+  };
+}
+
+export {
+  DEFAULT_SESSION_COOKIE_NAME,
+  serializeSessionCookie,
+  clearSessionCookie,
+  readSessionToken,
+  DontCodeError,
+  isDontCodeError,
+  InMemorySessionCache,
+  decodeAccessToken,
+  isSessionExpired,
+  MfaApi,
+  AuthApi,
+  TableQuery,
+  Transport,
+  BucketClient,
+  PublicBucketClient,
+  createStorage,
+  dontcode
+};
+//# sourceMappingURL=chunk-CAYYXFFZ.js.map