@every-app/sdk 0.1.14 → 0.3.0-rc.1

package/dist/tanstack/_internal/useEveryAppSession.js

@@ -1,47 +0,0 @@
-import { useEffect, useRef, useState } from "react";
-import { SessionManager } from "../../core/sessionManager.js";
-export function shouldBootstrapSession(sessionManager) {
-    // Bootstrapping should happen whenever the app is hosted by a trusted container.
-    // This intentionally keys off embedded environment semantics (iframe OR RN WebView),
-    // not iframe-only detection, so RN can initialize auth from pushed tokens.
-    return sessionManager.isEmbedded() || sessionManager.isBypassGatewayLocalOnly;
-}
-export function useEveryAppSession({ sessionManagerConfig, }) {
-    const sessionManagerRef = useRef(null);
-    const [sessionTokenState, setSessionTokenState] = useState({
-        status: "NO_TOKEN",
-        token: null,
-    });
-    if (!sessionManagerRef.current && typeof document !== "undefined") {
-        sessionManagerRef.current = new SessionManager(sessionManagerConfig);
-    }
-    const sessionManager = sessionManagerRef.current;
-    useEffect(() => {
-        if (!sessionManager)
-            return;
-        // Skip token bootstrap when not embedded (unless in demo mode) - the app will show GatewayRequiredError instead
-        if (!shouldBootstrapSession(sessionManager))
-            return;
-        const interval = setInterval(() => {
-            setSessionTokenState(sessionManager.getTokenState());
-        }, 5000);
-        sessionManager
-            .getToken()
-            .then(() => {
-            setSessionTokenState(sessionManager.getTokenState());
-        })
-            .catch((err) => {
-            console.error("[EmbeddedProvider] Initial token request failed:", err);
-        });
-        return () => {
-            clearInterval(interval);
-        };
-    }, [sessionManager]);
-    useEffect(() => {
-        if (!sessionManager)
-            return;
-        // Make sessionManager globally accessible for middleware
-        window.__embeddedSessionManager = sessionManager;
-    }, [sessionManager]);
-    return { sessionManager, sessionTokenState };
-}

package/dist/tanstack/index.d.ts

@@ -1,4 +0,0 @@
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware.js";
-export { useEveryAppRouter } from "./useEveryAppRouter.js";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tanstack/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tanstack/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/tanstack/index.js

@@ -1,3 +0,0 @@
-export { useSessionTokenClientMiddleware } from "./useSessionTokenClientMiddleware.js";
-export { useEveryAppRouter } from "./useEveryAppRouter.js";
-export { EmbeddedAppProvider, useCurrentUser } from "./EmbeddedAppProvider.js";

package/dist/tanstack/server/authConfig.d.ts

@@ -1,3 +0,0 @@
-import type { AuthConfig } from "./types.js";
-export declare function getAuthConfig(): AuthConfig;
-//# sourceMappingURL=authConfig.d.ts.map

package/dist/tanstack/server/authConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,wBAAgB,aAAa,IAAI,UAAU,CAc1C"}

package/dist/tanstack/server/authConfig.js

@@ -1,13 +0,0 @@
-import { env } from "cloudflare:workers";
-import { isBypassGatewayLocalOnlyServer } from "../../shared/bypassGatewayLocalOnly.js";
-export function getAuthConfig() {
-    const bypassGatewayLocalOnlyEnv = env.BYPASS_GATEWAY_LOCAL_ONLY;
-    const isBypassGatewayLocalOnly = import.meta.env.PROD !== true &&
-        (bypassGatewayLocalOnlyEnv === "true" ||
-            isBypassGatewayLocalOnlyServer() === true);
-    const issuer = env.GATEWAY_URL || (isBypassGatewayLocalOnly ? "local" : "");
-    return {
-        issuer,
-        audience: import.meta.env.VITE_APP_ID,
-    };
-}

package/dist/tanstack/server/authenticateRequest.d.ts

@@ -1,31 +0,0 @@
-import type { AuthConfig } from "./types.js";
-/**
- * JWT payload structure for embedded app session tokens.
- * Contains minimal claims for security - only what's needed for authentication.
- */
-interface SessionTokenPayload {
-    /** User ID (subject claim) */
-    sub: string;
-    /** Gateway URL (issuer claim) */
-    iss: string;
-    /** App ID (audience claim) - scopes token to specific app */
-    aud: string;
-    /** Expiration timestamp */
-    exp: number;
-    /** Issued at timestamp */
-    iat: number;
-    /** User email - used for user provisioning in apps */
-    email?: string;
-    /** Organization ID used for org-bound runtime enforcement */
-    orgId?: string;
-}
-export declare function authenticateRequest(authConfig: AuthConfig, providedRequest?: Request): Promise<SessionTokenPayload | null>;
-/**
- * Extracts the bearer token from an Authorization header.
- *
- * @param authHeader - The Authorization header value (e.g., "Bearer eyJ...")
- * @returns The token string if valid, null otherwise
- */
-export declare function extractBearerToken(authHeader: string | null): string | null;
-export {};
-//# sourceMappingURL=authenticateRequest.d.ts.map

package/dist/tanstack/server/authenticateRequest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/authenticateRequest.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C;;;GAGG;AACH,UAAU,mBAAmB;IAC3B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,UAAU,EACtB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA+FrC;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK3E"}

package/dist/tanstack/server/authenticateRequest.js

@@ -1,154 +0,0 @@
-import { getRequest } from "@tanstack/react-start/server";
-import { createLocalJWKSet, jwtVerify, } from "jose";
-import { env } from "cloudflare:workers";
-import { BYPASS_GATEWAY_LOCAL_ONLY_TOKEN, createBypassGatewayLocalOnlySessionPayload, isBypassGatewayLocalOnlyServer, } from "../../shared/bypassGatewayLocalOnly.js";
-export async function authenticateRequest(authConfig, providedRequest) {
-    const request = providedRequest || getRequest();
-    const authHeader = request.headers.get("authorization");
-    const expectedOrganizationId = getOptionalEnvValue("EVERY_APP_ORG_ID");
-    const appTenancyMode = getAppTenancyMode();
-    const isBypassGatewayLocalOnly = import.meta.env.PROD !== true &&
-        (getOptionalEnvValue("BYPASS_GATEWAY_LOCAL_ONLY") === "true" ||
-            isBypassGatewayLocalOnlyServer() === true);
-    if (!authHeader) {
-        return null;
-    }
-    const token = extractBearerToken(authHeader);
-    if (!token) {
-        return null;
-    }
-    if (isBypassGatewayLocalOnly) {
-        if (token !== BYPASS_GATEWAY_LOCAL_ONLY_TOKEN) {
-            return null;
-        }
-        if (!expectedOrganizationId) {
-            console.error(JSON.stringify({
-                message: "BYPASS_GATEWAY_LOCAL_ONLY requires EVERY_APP_ORG_ID to be set.",
-                audience: authConfig.audience,
-                appTenancyMode,
-            }));
-            return null;
-        }
-        const session = createBypassGatewayLocalOnlySessionPayload(authConfig.audience, expectedOrganizationId);
-        if (!validateOrganizationBinding({
-            session,
-            source: "bypass",
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        })) {
-            return null;
-        }
-        return session;
-    }
-    try {
-        const session = await verifySessionToken(token, authConfig);
-        if (!validateOrganizationBinding({
-            session,
-            source: "session",
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        })) {
-            return null;
-        }
-        return session;
-    }
-    catch (error) {
-        const isProd = import.meta.env.PROD === true;
-        console.error(JSON.stringify({
-            message: "Error verifying session token",
-            error: error instanceof Error ? error.message : String(error),
-            stack: isProd === true
-                ? undefined
-                : error instanceof Error
-                    ? error.stack
-                    : undefined,
-            errorType: error instanceof Error ? error.constructor.name : "Unknown",
-            issuer: authConfig.issuer,
-            audience: authConfig.audience,
-            expectedOrganizationId,
-            appTenancyMode,
-        }));
-        return null;
-    }
-}
-function getAppTenancyMode() {
-    const mode = getOptionalEnvValue("APP_TENANCY_MODE")?.toLowerCase();
-    return mode === "multi" ? "multi" : "single";
-}
-async function verifySessionToken(token, config) {
-    const { issuer, audience } = config;
-    if (!issuer) {
-        throw new Error("Issuer must be provided for token verification");
-    }
-    if (!audience) {
-        throw new Error("Audience must be provided for token verification");
-    }
-    // Fetch JWKS - use service binding in production, direct fetch in development
-    const jwksResponse = import.meta.env.PROD && env.EVERY_APP_GATEWAY
-        ? await env.EVERY_APP_GATEWAY.fetch("http://localhost/api/embedded/jwks")
-        : await fetch(`${env.GATEWAY_URL}/api/embedded/jwks`);
-    if (!jwksResponse.ok) {
-        throw new Error(`Failed to fetch JWKS: ${jwksResponse.status} ${jwksResponse.statusText}`);
-    }
-    const jwks = (await jwksResponse.json());
-    const localJWKS = createLocalJWKSet(jwks);
-    const options = {
-        issuer,
-        audience,
-        algorithms: ["RS256"],
-    };
-    const { payload } = await jwtVerify(token, localJWKS, options);
-    return payload;
-}
-/**
- * Extracts the bearer token from an Authorization header.
- *
- * @param authHeader - The Authorization header value (e.g., "Bearer eyJ...")
- * @returns The token string if valid, null otherwise
- */
-export function extractBearerToken(authHeader) {
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        return null;
-    }
-    return authHeader.substring(7);
-}
-function getOptionalEnvValue(key) {
-    const value = env[key];
-    const trimmed = value?.trim();
-    return trimmed || null;
-}
-function validateOrganizationBinding({ session, source, audience, expectedOrganizationId, appTenancyMode, }) {
-    if (!session.orgId) {
-        console.error(JSON.stringify({
-            message: source === "bypass"
-                ? "Bypass mode requires organization claim"
-                : "Session token is missing orgId. SDK v0.2.0 requires org-bound session tokens. Redeploy the app with EVERY_APP_ORG_ID configured and request a fresh session token.",
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    if (appTenancyMode === "single" && !expectedOrganizationId) {
-        console.error(JSON.stringify({
-            message: "EVERY_APP_ORG_ID is required when APP_TENANCY_MODE=single. Configure EVERY_APP_ORG_ID in worker secrets (for example via `every app deploy`) and retry.",
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    if (appTenancyMode === "single" && session.orgId !== expectedOrganizationId) {
-        console.error(JSON.stringify({
-            message: source === "bypass"
-                ? "Bypass mode organization mismatch"
-                : "Session token organization mismatch",
-            tokenOrgId: session.orgId,
-            expectedOrganizationId,
-            audience,
-            appTenancyMode,
-        }));
-        return false;
-    }
-    return true;
-}

package/dist/tanstack/server/index.d.ts

@@ -1,4 +0,0 @@
-export { authenticateRequest } from "./authenticateRequest.js";
-export type { AuthConfig } from "./types.js";
-export { getAuthConfig } from "./authConfig.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tanstack/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/tanstack/server/index.js

@@ -1,2 +0,0 @@
-export { authenticateRequest } from "./authenticateRequest.js";
-export { getAuthConfig } from "./authConfig.js";

package/dist/tanstack/server/types.d.ts

@@ -1,5 +0,0 @@
-export interface AuthConfig {
-    issuer: string;
-    audience: string;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/tanstack/server/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/tanstack/server/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/tanstack/server/types.js

@@ -1 +0,0 @@
-export {};

package/dist/tanstack/useEveryAppRouter.d.ts

@@ -1,7 +0,0 @@
-import { SessionManager } from "../core/sessionManager.js";
-interface UseEveryAppRouterParams {
-    sessionManager: SessionManager | null;
-}
-export declare function useEveryAppRouter({ sessionManager }: UseEveryAppRouterParams): void;
-export {};
-//# sourceMappingURL=useEveryAppRouter.d.ts.map

package/dist/tanstack/useEveryAppRouter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useEveryAppRouter.d.ts","sourceRoot":"","sources":["../../src/tanstack/useEveryAppRouter.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAI3D,UAAU,uBAAuB;IAC/B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,EAAE,uBAAuB,QAyE5E"}

package/dist/tanstack/useEveryAppRouter.js

@@ -1,66 +0,0 @@
-import { useEffect } from "react";
-import { useRouter } from "@tanstack/react-router";
-import { parseMessagePayload } from "../shared/parseMessagePayload.js";
-export function useEveryAppRouter({ sessionManager }) {
-    const router = useRouter();
-    // Route synchronization effect
-    useEffect(() => {
-        if (!sessionManager)
-            return;
-        // Listen for route sync messages from parent
-        const handleMessage = (event) => {
-            // Validate origin based on environment
-            if (!sessionManager.isTrustedHostMessage(event))
-                return;
-            const data = parseMessagePayload(event.data);
-            if (!data)
-                return;
-            if (data.type === "ROUTE_CHANGE" &&
-                data.direction === "parent-to-child") {
-                const targetRoute = typeof data.route === "string" ? data.route : null;
-                const currentRoute = window.location.pathname;
-                // Only navigate if the route is different from current location
-                if (targetRoute && targetRoute !== currentRoute) {
-                    router.navigate({ to: targetRoute });
-                }
-            }
-        };
-        window.addEventListener("message", handleMessage);
-        // Simplified route change detection with 2 reliable methods
-        let lastReportedPath = window.location.pathname;
-        const handleRouteChange = () => {
-            const currentPath = window.location.pathname;
-            // Only report if the path actually changed
-            if (currentPath === lastReportedPath) {
-                return;
-            }
-            lastReportedPath = currentPath;
-            const message = {
-                type: "ROUTE_CHANGE",
-                route: currentPath,
-                appId: sessionManager.appId,
-                direction: "child-to-parent",
-            };
-            try {
-                sessionManager.postToHost(message);
-            }
-            catch {
-                return;
-            }
-        };
-        // Listen to popstate for browser back/forward
-        window.addEventListener("popstate", handleRouteChange);
-        // Polling to detect route changes (catches router navigation)
-        const pollInterval = setInterval(() => {
-            const currentPath = window.location.pathname;
-            if (currentPath !== lastReportedPath) {
-                handleRouteChange();
-            }
-        }, 100);
-        return () => {
-            window.removeEventListener("message", handleMessage);
-            window.removeEventListener("popstate", handleRouteChange);
-            clearInterval(pollInterval);
-        };
-    }, [sessionManager]);
-}

package/dist/tanstack/useSessionTokenClientMiddleware.d.ts

@@ -1,2 +0,0 @@
-export declare const useSessionTokenClientMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterClient<{}, unknown, undefined, undefined, undefined>;
-//# sourceMappingURL=useSessionTokenClientMiddleware.d.ts.map

package/dist/tanstack/useSessionTokenClientMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useSessionTokenClientMiddleware.d.ts","sourceRoot":"","sources":["../../src/tanstack/useSessionTokenClientMiddleware.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,+BAA+B,6GAmC1C,CAAC"}

package/dist/tanstack/useSessionTokenClientMiddleware.js

@@ -1,29 +0,0 @@
-import { createMiddleware } from "@tanstack/react-start";
-import { BYPASS_GATEWAY_LOCAL_ONLY_TOKEN, isBypassGatewayLocalOnlyClient, } from "../shared/bypassGatewayLocalOnly.js";
-export const useSessionTokenClientMiddleware = createMiddleware({
-    type: "function",
-}).client(async ({ next }) => {
-    if (isBypassGatewayLocalOnlyClient()) {
-        return next({
-            headers: {
-                Authorization: `Bearer ${BYPASS_GATEWAY_LOCAL_ONLY_TOKEN}`,
-            },
-        });
-    }
-    // Get the global sessionManager - this MUST be available for embedded apps
-    const sessionManager = window
-        .__embeddedSessionManager;
-    if (!sessionManager) {
-        throw new Error("[AuthMiddleware] SessionManager not available - embedded provider not initialized");
-    }
-    // INVARIANT: This is just an extra check and should never be the case if the sessionManager exists.
-    if (typeof sessionManager.getToken !== "function") {
-        throw new Error("[AuthMiddleware] SessionManager.getToken is not a function");
-    }
-    const token = await sessionManager.getToken();
-    return next({
-        headers: {
-            Authorization: `Bearer ${token}`,
-        },
-    });
-});