@every-app/sdk 0.1.14 → 0.2.0

package/dist/cloudflare/lazyInit.js

@@ -1,65 +0,0 @@
-/**
- * Wraps a factory function in a Proxy to defer initialization until first access.
- * This prevents async operations (Like creating Tanstack DB Collections) from running in Cloudflare Workers' global scope.
- *
- * @param factory - A function that creates and returns the resource.
- *                  Must be a callback to defer execution; passing the value directly
- *                  would evaluate it at module load time, triggering the Cloudflare error.
- * @returns A Proxy that lazily initializes the resource on first property access
- *
- * @example
- * ```ts
- * export const myCollection = lazyInitForWorkers(() =>
- *   createCollection(queryCollectionOptions({
- *     queryKey: ["myData"],
- *     queryFn: async () => fetchData(),
- *     // ... other options
- *   }))
- * );
- * ```
- */
-export function lazyInitForWorkers(factory) {
-    // Closure: This variable is captured by getInstance() and the Proxy traps below.
-    // It remains in memory as long as the returned Proxy is referenced, enabling singleton behavior.
-    let instance = null;
-    function getInstance() {
-        if (!instance) {
-            instance = factory();
-        }
-        return instance;
-    }
-    return new Proxy({}, {
-        get(_, prop) {
-            const inst = getInstance();
-            const value = inst[prop];
-            // Bind methods to the instance to preserve `this` context
-            return typeof value === "function" ? value.bind(inst) : value;
-        },
-        set(_, prop, value) {
-            const inst = getInstance();
-            inst[prop] = value;
-            return true;
-        },
-        deleteProperty(_, prop) {
-            const inst = getInstance();
-            delete inst[prop];
-            return true;
-        },
-        has(_, prop) {
-            const inst = getInstance();
-            return prop in inst;
-        },
-        ownKeys(_) {
-            const inst = getInstance();
-            return Reflect.ownKeys(inst);
-        },
-        getOwnPropertyDescriptor(_, prop) {
-            const inst = getInstance();
-            return Reflect.getOwnPropertyDescriptor(inst, prop);
-        },
-        getPrototypeOf(_) {
-            const inst = getInstance();
-            return Reflect.getPrototypeOf(inst);
-        },
-    });
-}

package/dist/cloudflare/server/gateway.d.ts

@@ -1,29 +0,0 @@
-interface GatewayFetcher {
-    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-}
-interface GatewayEnv {
-    GATEWAY_URL?: string;
-    EVERY_APP_GATEWAY?: GatewayFetcher;
-    GATEWAY_APP_API_TOKEN?: string;
-    APP_TOKEN?: string;
-}
-interface FetchGatewayOptions {
-    env: GatewayEnv;
-    /** The URL, path, or Request to send to the gateway. Typically the full URL
-     *  passed by a provider SDK's custom `fetch` override. */
-    url: string | URL | Request;
-    /** Standard `RequestInit` (method, headers, body, etc.) from the provider SDK. */
-    init?: RequestInit;
-}
-export declare function getGatewayUrl(env: GatewayEnv): string;
-/**
- * Fetch from the gateway proxy, authenticating with the app token.
- *
- * - Strips any existing `Authorization` header (the gateway only accepts
- *   app token auth via `x-every-app-token`).
- * - Requires `GATEWAY_APP_API_TOKEN` (or legacy `APP_TOKEN`) in the env.
- * - Routes via service binding in production, falls back to HTTP in dev.
- */
-export declare function fetchGateway({ env, url, init, }: FetchGatewayOptions): Promise<Response>;
-export {};
-//# sourceMappingURL=gateway.d.ts.map

package/dist/cloudflare/server/gateway.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../src/cloudflare/server/gateway.ts"],"names":[],"mappings":"AAGA,UAAU,cAAc;IACtB,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE;AAED,UAAU,UAAU;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,mBAAmB;IAC3B,GAAG,EAAE,UAAU,CAAC;IAChB;8DAC0D;IAC1D,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;IAC5B,kFAAkF;IAClF,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EACjC,GAAG,EACH,GAAG,EACH,IAAI,GACL,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBzC"}

package/dist/cloudflare/server/gateway.js

@@ -1,69 +0,0 @@
-const SERVICE_BINDING_ORIGIN = "http://localhost";
-const APP_TOKEN_HEADER = "x-every-app-token";
-export function getGatewayUrl(env) {
-    const gatewayUrl = env.GATEWAY_URL?.trim();
-    if (!gatewayUrl) {
-        throw new Error("GATEWAY_URL is required");
-    }
-    return gatewayUrl;
-}
-/**
- * Fetch from the gateway proxy, authenticating with the app token.
- *
- * - Strips any existing `Authorization` header (the gateway only accepts
- *   app token auth via `x-every-app-token`).
- * - Requires `GATEWAY_APP_API_TOKEN` (or legacy `APP_TOKEN`) in the env.
- * - Routes via service binding in production, falls back to HTTP in dev.
- */
-export async function fetchGateway({ env, url, init, }) {
-    const gatewayBaseUrl = getGatewayUrl(env);
-    const resolvedRequest = toRequest(url, init, gatewayBaseUrl);
-    const authenticatedRequest = applyAppTokenAuth(resolvedRequest, env);
-    // Use service binding in production for zero-latency internal routing.
-    // In local dev wrangler still exposes the binding object, but the target
-    // service usually isn't running locally, so we skip it and use HTTP fetch.
-    if (import.meta.env.PROD && env.EVERY_APP_GATEWAY) {
-        const url = new URL(authenticatedRequest.url);
-        const bindingUrl = `${SERVICE_BINDING_ORIGIN}${url.pathname}${url.search}`;
-        const bindingRequest = new Request(bindingUrl, authenticatedRequest);
-        return env.EVERY_APP_GATEWAY.fetch(bindingRequest);
-    }
-    // HTTP fetch – used in local dev, or as a fallback when no binding exists
-    return fetch(authenticatedRequest);
-}
-function applyAppTokenAuth(request, env) {
-    const gatewayOrigin = new URL(getGatewayUrl(env)).origin;
-    const requestOrigin = new URL(request.url).origin;
-    if (requestOrigin !== gatewayOrigin) {
-        throw new Error(`Refusing to send gateway token to non-gateway origin: ${requestOrigin}`);
-    }
-    const appToken = getGatewayAppApiToken(env);
-    if (!appToken) {
-        throw new Error("GATEWAY_APP_API_TOKEN is required. Run `npx everyapp app deploy` to provision one.");
-    }
-    const headers = new Headers(request.headers);
-    headers.delete("authorization");
-    headers.set(APP_TOKEN_HEADER, appToken);
-    return new Request(request, { headers });
-}
-function getGatewayAppApiToken(env) {
-    const configuredToken = env.GATEWAY_APP_API_TOKEN?.trim();
-    if (configuredToken) {
-        return configuredToken;
-    }
-    const legacyToken = env.APP_TOKEN?.trim();
-    return legacyToken || null;
-}
-function toRequest(input, init, baseUrl) {
-    if (input instanceof Request) {
-        return init ? new Request(input, init) : input;
-    }
-    if (input instanceof URL) {
-        return new Request(input.toString(), init);
-    }
-    if (typeof input === "string" && baseUrl && !/^https?:\/\//i.test(input)) {
-        const normalizedPath = input.startsWith("/") ? input : `/${input}`;
-        return new Request(new URL(normalizedPath, baseUrl).toString(), init);
-    }
-    return new Request(input, init);
-}

package/dist/cloudflare/server/index.d.ts

@@ -1,3 +0,0 @@
-export { getLocalD1Url } from "../getLocalD1Url.js";
-export { fetchGateway, getGatewayUrl } from "./gateway.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cloudflare/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/cloudflare/server/index.js

@@ -1,2 +0,0 @@
-export { getLocalD1Url } from "../getLocalD1Url.js";
-export { fetchGateway, getGatewayUrl } from "./gateway.js";

package/dist/core/authenticatedFetch.d.ts

@@ -1,9 +0,0 @@
-/**
- * Gets the current session token from the embedded session manager
- */
-export declare function getSessionToken(): Promise<string>;
-/**
- * Performs a fetch request with the authorization header automatically added
- */
-export declare function authenticatedFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-//# sourceMappingURL=authenticatedFetch.d.ts.map

package/dist/core/authenticatedFetch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticatedFetch.d.ts","sourceRoot":"","sources":["../../src/core/authenticatedFetch.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAmBvD;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/core/authenticatedFetch.js

@@ -1,31 +0,0 @@
-import { BYPASS_GATEWAY_LOCAL_ONLY_TOKEN, isBypassGatewayLocalOnlyClient, } from "../shared/bypassGatewayLocalOnly.js";
-/**
- * Gets the current session token from the embedded session manager
- */
-export async function getSessionToken() {
-    if (isBypassGatewayLocalOnlyClient()) {
-        return BYPASS_GATEWAY_LOCAL_ONLY_TOKEN;
-    }
-    const windowWithSession = window;
-    const sessionManager = windowWithSession.__embeddedSessionManager;
-    if (!sessionManager) {
-        throw new Error("Session manager not available");
-    }
-    const token = await sessionManager.getToken();
-    if (!token) {
-        throw new Error("No token available");
-    }
-    return token;
-}
-/**
- * Performs a fetch request with the authorization header automatically added
- */
-export async function authenticatedFetch(input, init) {
-    const token = await getSessionToken();
-    const headers = new Headers(init?.headers);
-    headers.set("Authorization", `Bearer ${token}`);
-    return fetch(input, {
-        ...init,
-        headers,
-    });
-}

package/dist/core/index.d.ts

@@ -1,4 +0,0 @@
-export { SessionManager, isRunningInIframe, isRunningInReactNativeWebView, detectEnvironment, } from "./sessionManager.js";
-export type { SessionManagerConfig, EmbeddedEnvironment, } from "./sessionManager.js";
-export { authenticatedFetch, getSessionToken } from "./authenticatedFetch.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/core/index.js

@@ -1,2 +0,0 @@
-export { SessionManager, isRunningInIframe, isRunningInReactNativeWebView, detectEnvironment, } from "./sessionManager.js";
-export { authenticatedFetch, getSessionToken } from "./authenticatedFetch.js";

package/dist/core/sessionManager.d.ts

@@ -1,58 +0,0 @@
-export interface SessionManagerConfig {
-    appId: string;
-}
-/**
- * Environment detection types
- */
-export type EmbeddedEnvironment = "iframe" | "react-native-webview" | "standalone";
-/**
- * Detects whether the current window is running inside an iframe.
- * Returns true if in an iframe, false if running as top-level window.
- */
-export declare function isRunningInIframe(): boolean;
-/**
- * Detects whether the current window is running inside a React Native WebView.
- * Returns true if window.ReactNativeWebView is available.
- */
-export declare function isRunningInReactNativeWebView(): boolean;
-/**
- * Detects the current embedded environment.
- * Priority: React Native WebView > iframe > standalone
- */
-export declare function detectEnvironment(): EmbeddedEnvironment;
-export declare class SessionManager {
-    readonly parentOrigin: string;
-    readonly appId: string;
-    readonly isInIframe: boolean;
-    readonly environment: EmbeddedEnvironment;
-    readonly isBypassGatewayLocalOnly: boolean;
-    private token;
-    private refreshPromise;
-    private tokenWaiters;
-    constructor(config: SessionManagerConfig);
-    /**
-     * Check if running in an embedded environment (iframe or React Native WebView)
-     */
-    isEmbedded(): boolean;
-    isTrustedHostMessage(event: MessageEvent): boolean;
-    postToHost(message: object): void;
-    private isTokenExpiringSoon;
-    private postMessageWithResponse;
-    private setupReactNativeTokenListener;
-    private waitForReactNativeTokenPush;
-    requestNewToken(): Promise<string>;
-    getToken(): Promise<string>;
-    getTokenState(): {
-        status: "NO_TOKEN" | "VALID" | "EXPIRED" | "REFRESHING";
-        token: string | null;
-    };
-    /**
-     * Extracts user information from the current JWT token.
-     * Returns null if no valid token is available.
-     */
-    getUser(): {
-        userId: string;
-        email: string;
-    } | null;
-}
-//# sourceMappingURL=sessionManager.d.ts.map

package/dist/core/sessionManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionManager.d.ts","sourceRoot":"","sources":["../../src/core/sessionManager.ts"],"names":[],"mappings":"AAiEA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAOD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,sBAAsB,GACtB,YAAY,CAAC;AAEjB;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAY3C;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,OAAO,CASvD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,mBAAmB,CAWvD;AAED,qBAAa,cAAc;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAE3C,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,YAAY,CAIZ;gBAEI,MAAM,EAAE,oBAAoB;IAyCxC;;OAEG;IACH,UAAU,IAAI,OAAO;IAIrB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IAelD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBjC,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,uBAAuB;IA+C/B,OAAO,CAAC,6BAA6B;IAgErC,OAAO,CAAC,2BAA2B;IAmB7B,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAgElC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAcjC,aAAa,IAAI;QACf,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;QACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;IAgBD;;;OAGG;IACH,OAAO,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CA0BpD"}

package/dist/core/sessionManager.js

@@ -1,357 +0,0 @@
-import { BYPASS_GATEWAY_LOCAL_ONLY_EMAIL, BYPASS_GATEWAY_LOCAL_ONLY_TOKEN, BYPASS_GATEWAY_LOCAL_ONLY_USER_ID, isBypassGatewayLocalOnlyClient, } from "../shared/bypassGatewayLocalOnly.js";
-import { parseMessagePayload } from "../shared/parseMessagePayload.js";
-function isTokenUpdateMessage(data) {
-    if (!data || typeof data !== "object" || Array.isArray(data)) {
-        return false;
-    }
-    return data.type === "SESSION_TOKEN_UPDATE";
-}
-function decodeJwtPayload(token) {
-    try {
-        const parts = token.split(".");
-        if (parts.length !== 3) {
-            return null;
-        }
-        const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
-        return JSON.parse(atob(padded));
-    }
-    catch {
-        return null;
-    }
-}
-function tokenAudienceMatchesApp(payload, appId) {
-    const aud = payload.aud;
-    if (typeof aud === "string") {
-        return aud === appId;
-    }
-    if (Array.isArray(aud)) {
-        return aud.some((value) => value === appId);
-    }
-    return false;
-}
-const MESSAGE_TIMEOUT_MS = 5000;
-const TOKEN_EXPIRY_BUFFER_MS = 10000;
-const DEFAULT_TOKEN_LIFETIME_MS = 60000;
-const REACT_NATIVE_TOKEN_WAIT_TIMEOUT_MS = 10000;
-/**
- * Detects whether the current window is running inside an iframe.
- * Returns true if in an iframe, false if running as top-level window.
- */
-export function isRunningInIframe() {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    try {
-        return window.self !== window.top;
-    }
-    catch {
-        // If we can't access window.top due to cross-origin restrictions,
-        // we're definitely in an iframe
-        return true;
-    }
-}
-/**
- * Detects whether the current window is running inside a React Native WebView.
- * Returns true if window.ReactNativeWebView is available.
- */
-export function isRunningInReactNativeWebView() {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    return (typeof window.ReactNativeWebView?.postMessage === "function" ||
-        window.isReactNativeWebView === true);
-}
-/**
- * Detects the current embedded environment.
- * Priority: React Native WebView > iframe > standalone
- */
-export function detectEnvironment() {
-    const isRNWebView = isRunningInReactNativeWebView();
-    const isIframe = isRunningInIframe();
-    if (isRNWebView) {
-        return "react-native-webview";
-    }
-    if (isIframe) {
-        return "iframe";
-    }
-    return "standalone";
-}
-export class SessionManager {
-    parentOrigin;
-    appId;
-    isInIframe;
-    environment;
-    isBypassGatewayLocalOnly;
-    token = null;
-    refreshPromise = null;
-    tokenWaiters = [];
-    constructor(config) {
-        if (!config.appId) {
-            throw new Error("[SessionManager] appId is required.");
-        }
-        this.isBypassGatewayLocalOnly = isBypassGatewayLocalOnlyClient();
-        const gatewayUrl = import.meta.env.VITE_GATEWAY_URL;
-        if (!this.isBypassGatewayLocalOnly) {
-            if (!gatewayUrl) {
-                throw new Error("[SessionManager] VITE_GATEWAY_URL env var is required.");
-            }
-            try {
-                new URL(gatewayUrl);
-            }
-            catch {
-                throw new Error(`[SessionManager] Invalid gateway URL: ${gatewayUrl}`);
-            }
-        }
-        this.appId = config.appId;
-        this.parentOrigin = this.isBypassGatewayLocalOnly
-            ? window.location.origin
-            : gatewayUrl;
-        this.environment = detectEnvironment();
-        this.isInIframe = isRunningInIframe();
-        if (this.environment === "react-native-webview") {
-            this.setupReactNativeTokenListener();
-        }
-        if (this.isBypassGatewayLocalOnly) {
-            this.token = {
-                token: BYPASS_GATEWAY_LOCAL_ONLY_TOKEN,
-                expiresAt: Date.now() + DEFAULT_TOKEN_LIFETIME_MS,
-            };
-        }
-    }
-    /**
-     * Check if running in an embedded environment (iframe or React Native WebView)
-     */
-    isEmbedded() {
-        return this.environment !== "standalone";
-    }
-    isTrustedHostMessage(event) {
-        if (this.environment === "react-native-webview") {
-            const origin = event
-                .origin;
-            return (origin === "react-native" ||
-                origin === "null" ||
-                origin === "" ||
-                origin == null);
-        }
-        return event.origin === this.parentOrigin;
-    }
-    postToHost(message) {
-        if (this.environment === "react-native-webview") {
-            const postMessage = window.ReactNativeWebView?.postMessage;
-            if (typeof postMessage !== "function") {
-                throw new Error("React Native WebView bridge is unavailable");
-            }
-            postMessage.call(window.ReactNativeWebView, JSON.stringify(message));
-            return;
-        }
-        window.parent.postMessage(message, this.parentOrigin);
-    }
-    isTokenExpiringSoon(bufferMs = TOKEN_EXPIRY_BUFFER_MS) {
-        if (!this.token)
-            return true;
-        return Date.now() >= this.token.expiresAt - bufferMs;
-    }
-    postMessageWithResponse(request, responseType, requestId) {
-        return new Promise((resolve, reject) => {
-            const cleanup = () => {
-                clearTimeout(timeout);
-                window.removeEventListener("message", handler);
-            };
-            const handler = (event) => {
-                // Security: validate message origin based on environment
-                if (!this.isTrustedHostMessage(event))
-                    return;
-                const data = parseMessagePayload(event.data);
-                if (!data)
-                    return;
-                if (data.type === responseType && data.requestId === requestId) {
-                    cleanup();
-                    if (typeof data.error === "string" && data.error) {
-                        reject(new Error(data.error));
-                    }
-                    else {
-                        resolve(data);
-                    }
-                }
-            };
-            const timeout = setTimeout(() => {
-                cleanup();
-                reject(new Error("Token request timeout - parent did not respond"));
-            }, MESSAGE_TIMEOUT_MS);
-            window.addEventListener("message", handler);
-            try {
-                this.postToHost(request);
-            }
-            catch (error) {
-                cleanup();
-                reject(error instanceof Error
-                    ? error
-                    : new Error("Failed to post message to host"));
-            }
-        });
-    }
-    setupReactNativeTokenListener() {
-        window.addEventListener("message", (event) => {
-            if (!this.isTrustedHostMessage(event)) {
-                return;
-            }
-            const data = parseMessagePayload(event.data);
-            if (!data) {
-                return;
-            }
-            if (!isTokenUpdateMessage(data)) {
-                return;
-            }
-            const message = data;
-            if (!message.token || typeof message.token !== "string") {
-                return;
-            }
-            if (typeof message.appId !== "string" || message.appId !== this.appId) {
-                return;
-            }
-            if (message.expiresAt !== undefined &&
-                typeof message.expiresAt !== "string") {
-                return;
-            }
-            const payload = decodeJwtPayload(message.token);
-            if (!payload || !tokenAudienceMatchesApp(payload, this.appId)) {
-                return;
-            }
-            // Native controls token minting and pushes updates into the embedded app.
-            // We only consume pushed tokens in React Native WebView mode.
-            let expiresAt = Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
-            if (message.expiresAt) {
-                const parsed = new Date(message.expiresAt).getTime();
-                if (!Number.isNaN(parsed)) {
-                    expiresAt = parsed;
-                }
-            }
-            this.token = {
-                token: message.token,
-                expiresAt,
-            };
-            if (this.tokenWaiters.length > 0) {
-                const waiters = this.tokenWaiters;
-                this.tokenWaiters = [];
-                for (const waiter of waiters) {
-                    clearTimeout(waiter.timeout);
-                    waiter.resolve(message.token);
-                }
-            }
-        });
-    }
-    waitForReactNativeTokenPush() {
-        if (this.token && !this.isTokenExpiringSoon()) {
-            return Promise.resolve(this.token.token);
-        }
-        return new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                this.tokenWaiters = this.tokenWaiters.filter((w) => w.timeout !== timeout);
-                reject(new Error("Timed out waiting for token from React Native bridge"));
-            }, REACT_NATIVE_TOKEN_WAIT_TIMEOUT_MS);
-            this.tokenWaiters.push({ resolve, reject, timeout });
-        });
-    }
-    async requestNewToken() {
-        if (this.isBypassGatewayLocalOnly) {
-            this.token = {
-                token: BYPASS_GATEWAY_LOCAL_ONLY_TOKEN,
-                expiresAt: Date.now() + DEFAULT_TOKEN_LIFETIME_MS,
-            };
-            return this.token.token;
-        }
-        if (this.refreshPromise) {
-            return this.refreshPromise;
-        }
-        if (this.environment === "react-native-webview") {
-            this.refreshPromise = this.waitForReactNativeTokenPush();
-            try {
-                return await this.refreshPromise;
-            }
-            finally {
-                this.refreshPromise = null;
-            }
-        }
-        this.refreshPromise = (async () => {
-            const requestId = crypto.randomUUID();
-            const response = await this.postMessageWithResponse({
-                type: "SESSION_TOKEN_REQUEST",
-                requestId,
-                appId: this.appId,
-            }, "SESSION_TOKEN_RESPONSE", requestId);
-            if (!response.token) {
-                throw new Error("No token in response");
-            }
-            // Parse expiresAt, falling back to default lifetime if invalid
-            let expiresAt = Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
-            if (response.expiresAt) {
-                const parsed = new Date(response.expiresAt).getTime();
-                if (!Number.isNaN(parsed)) {
-                    expiresAt = parsed;
-                }
-            }
-            this.token = {
-                token: response.token,
-                expiresAt,
-            };
-            return this.token.token;
-        })();
-        try {
-            return await this.refreshPromise;
-        }
-        finally {
-            this.refreshPromise = null;
-        }
-    }
-    async getToken() {
-        if (this.isBypassGatewayLocalOnly) {
-            if (!this.token || this.isTokenExpiringSoon()) {
-                return this.requestNewToken();
-            }
-            return this.token.token;
-        }
-        if (this.isTokenExpiringSoon()) {
-            return this.requestNewToken();
-        }
-        return this.token.token;
-    }
-    getTokenState() {
-        if (this.refreshPromise) {
-            return { status: "REFRESHING", token: null };
-        }
-        if (!this.token) {
-            return { status: "NO_TOKEN", token: null };
-        }
-        if (this.isTokenExpiringSoon(0)) {
-            return { status: "EXPIRED", token: this.token.token };
-        }
-        return { status: "VALID", token: this.token.token };
-    }
-    /**
-     * Extracts user information from the current JWT token.
-     * Returns null if no valid token is available.
-     */
-    getUser() {
-        if (this.isBypassGatewayLocalOnly) {
-            return {
-                userId: BYPASS_GATEWAY_LOCAL_ONLY_USER_ID,
-                email: BYPASS_GATEWAY_LOCAL_ONLY_EMAIL,
-            };
-        }
-        if (!this.token) {
-            return null;
-        }
-        const payload = decodeJwtPayload(this.token.token);
-        if (!payload) {
-            return null;
-        }
-        if (typeof payload.sub !== "string") {
-            return null;
-        }
-        return {
-            userId: payload.sub,
-            email: typeof payload.email === "string" ? payload.email : "",
-        };
-    }
-}

package/dist/shared/bypassGatewayLocalOnly.d.ts

@@ -1,15 +0,0 @@
-export declare const BYPASS_GATEWAY_LOCAL_ONLY_TOKEN = "BYPASS_GATEWAY_LOCAL_ONLY";
-export declare const BYPASS_GATEWAY_LOCAL_ONLY_USER_ID = "demo-local-user";
-export declare const BYPASS_GATEWAY_LOCAL_ONLY_EMAIL = "demo-local-user@local";
-export declare function isBypassGatewayLocalOnlyClient(): boolean;
-export declare function isBypassGatewayLocalOnlyServer(): boolean;
-export declare function createBypassGatewayLocalOnlySessionPayload(audience: string, orgId: string): {
-    orgId: string;
-    sub: string;
-    email: string;
-    iss: string;
-    aud: string;
-    iat: number;
-    exp: number;
-};
-//# sourceMappingURL=bypassGatewayLocalOnly.d.ts.map

package/dist/shared/bypassGatewayLocalOnly.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bypassGatewayLocalOnly.d.ts","sourceRoot":"","sources":["../../src/shared/bypassGatewayLocalOnly.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,8BAA8B,CAAC;AAC3E,eAAO,MAAM,iCAAiC,oBAAoB,CAAC;AACnE,eAAO,MAAM,+BAA+B,0BAA0B,CAAC;AAEvE,wBAAgB,8BAA8B,IAAI,OAAO,CAYxD;AAED,wBAAgB,8BAA8B,IAAI,OAAO,CAsBxD;AAED,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM;;;;;;;;EAkBd"}