@ledewire/browser 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,6 +1,6 @@
-var d = Object.defineProperty;
-var g = (s, e, t) => e in s ? d(s, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : s[e] = t;
-var n = (s, e, t) => g(s, typeof e != "symbol" ? e + "" : e, t);
+var f = Object.defineProperty;
+var k = (s, e, t) => e in s ? f(s, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : s[e] = t;
+var n = (s, e, t) => k(s, typeof e != "symbol" ? e + "" : e, t);
 function w(s) {
   return atob(s);
 }
@@ -28,33 +28,33 @@ class l extends c {
     super(e, 401, t), this.name = "AuthError";
   }
 }
-class k extends c {
+class y extends c {
   constructor(e, t) {
     super(e, 403, t), this.name = "ForbiddenError";
   }
 }
-class f extends c {
+class T extends c {
   constructor(e, t) {
     super(e, 404, t), this.name = "NotFoundError";
   }
 }
-class B extends c {
+class M extends c {
   constructor(e, t, r) {
     super(e, t, r), this.name = "PurchaseError";
   }
 }
-const T = "https://api.ledewire.com";
-class y {
+const d = "https://api.ledewire.com";
+class m {
   constructor(e = {}) {
     n(this, "baseUrl");
     n(this, "getAccessToken");
     n(this, "onUnauthorized");
-    this.baseUrl = (e.baseUrl ?? T).replace(/\/$/, ""), this.getAccessToken = e.getAccessToken ?? (() => null), this.onUnauthorized = e.onUnauthorized ?? (() => null);
+    this.baseUrl = (e.baseUrl ?? d).replace(/\/$/, ""), this.getAccessToken = e.getAccessToken ?? (() => null), this.onUnauthorized = e.onUnauthorized ?? (() => null);
   }
   /**
    * GET request with optional query parameters.
    * @param path - API path (e.g. `/v1/wallet/balance`)
-   * @param params - Query string parameters
+   * @param params - Query string parameters. `undefined` values are omitted; numbers are coerced to strings.
    */
   async get(e, t) {
     return this.request("GET", this.buildUrl(e, t));
@@ -63,9 +63,10 @@ class y {
    * POST request.
    * @param path - API path
    * @param body - Request body (JSON-serialized)
+   * @param params - Optional query string parameters. `undefined` values are omitted; numbers are coerced to strings.
    */
-  async post(e, t) {
-    return this.request("POST", this.buildUrl(e), t);
+  async post(e, t, r) {
+    return this.request("POST", this.buildUrl(e, r), t);
   }
   /**
    * PUT request.
@@ -95,7 +96,13 @@ class y {
   // ---------------------------------------------------------------------------
   buildUrl(e, t) {
     const r = `${this.baseUrl}${e}`;
-    return !t || Object.keys(t).length === 0 ? r : `${r}?${new URLSearchParams(t).toString()}`;
+    if (!t) return r;
+    const o = Object.entries(t).filter(
+      (i) => i[1] !== void 0
+    );
+    if (o.length === 0) return r;
+    const h = new URLSearchParams(o.map(([i, a]) => [i, String(a)]));
+    return `${r}?${h.toString()}`;
   }
   async request(e, t, r, o = !1) {
     const h = await this.getAccessToken(), i = {
@@ -127,15 +134,15 @@ class y {
       case 401:
         throw new l(r, o);
       case 403:
-        throw new k(r, o);
+        throw new y(r, o);
       case 404:
-        throw new f(r, o);
+        throw new T(r, o);
       default:
         throw new c(r, e.status, o);
     }
   }
 }
-const m = 6e4;
+const A = 6e4;
 class E {
   constructor(e) {
     n(this, "storage");
@@ -151,7 +158,7 @@ class E {
    */
   async getAccessToken() {
     const e = await this.storage.getTokens();
-    return e ? e.expiresAt - Date.now() < m ? (await this.performRefresh(e.refreshToken))?.accessToken ?? null : e.accessToken : null;
+    return e ? e.expiresAt - Date.now() < A ? (await this.performRefresh(e.refreshToken))?.accessToken ?? null : e.accessToken : null;
   }
   /**
    * Called by `HttpClient` when a 401 is received.
@@ -183,7 +190,7 @@ class E {
     }), this.refreshPromise);
   }
 }
-class A {
+class U {
   constructor() {
     n(this, "tokens", null);
   }
@@ -200,7 +207,23 @@ class A {
 function p(s) {
   return new Date(s).getTime();
 }
-class S {
+function v(s) {
+  return async (e) => {
+    const t = await fetch(`${s}/v1/auth/token/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: e })
+    });
+    if (!t.ok) throw new Error("Token refresh failed");
+    const r = await t.json();
+    return {
+      accessToken: r.access_token,
+      refreshToken: r.refresh_token,
+      expiresAt: p(r.expires_at)
+    };
+  };
+}
+class x {
   /** @internal */
   constructor(e, t) {
     this.http = e, this.tokenManager = t;
@@ -238,6 +261,29 @@ class S {
     const t = await this.http.post("/v1/auth/login/google", e);
     return await this.storeTokens(t), t;
   }
+  /**
+   * Log in using a buyer API key and secret.
+   * Returns a buyer-scoped JWT, stored automatically after successful authentication.
+   *
+   * Primarily useful when building buyer-facing dashboards where the user
+   * has created a named API key and wishes to authenticate with it programmatically,
+   * or for agent workflows running inside a browser context.
+   *
+   * @param body - The buyer API key and secret.
+   * @returns The authentication token response.
+   *
+   * @example
+   * ```ts
+   * await lw.auth.loginWithBuyerApiKey({
+   *   key: 'bktst_abc123',
+   *   secret: 'deadbeef...',
+   * })
+   * ```
+   */
+  async loginWithBuyerApiKey(e) {
+    const t = await this.http.post("/v1/auth/login/buyer-api-key", e);
+    return await this.storeTokens(t), t;
+  }
   /**
    * Request a password reset code to be sent to the buyer's email address.
    *
@@ -284,7 +330,7 @@ class S {
     });
   }
 }
-class v {
+class b {
   /** @internal */
   constructor(e) {
     this.http = e;
@@ -307,7 +353,7 @@ class v {
     return this.http.get("/v1/config/public");
   }
 }
-class x {
+class S {
   constructor(e) {
     this.http = e;
   }
@@ -329,11 +375,13 @@ class x {
    * ```
    */
   async getWithAccess(e) {
-    const t = await this.http.get(`/v1/content/${e}/with-access`);
+    const t = await this.http.get(
+      `/v1/content/${encodeURIComponent(e)}/with-access`
+    );
     return u(t);
   }
 }
-class b {
+class P {
   constructor(e) {
     this.http = e;
   }
@@ -361,10 +409,10 @@ class b {
    * @returns The purchase record.
    */
   async get(e) {
-    return this.http.get(`/v1/purchases/${e}`);
+    return this.http.get(`/v1/purchases/${encodeURIComponent(e)}`);
   }
 }
-class U {
+class R {
   /** @internal */
   constructor(e) {
     this.http = e;
@@ -420,16 +468,16 @@ class U {
    * ```
    */
   async get(e) {
-    const t = await this.http.get(`/v1/seller/content/${e}`);
+    const t = await this.http.get(`/v1/seller/content/${encodeURIComponent(e)}`);
     return u(t);
   }
 }
-class P {
+class C {
   /** @internal */
   constructor(e, t) {
     /** Seller content: list, search, and get by API key. */
     n(this, "content");
-    this.http = e, this.tokenManager = t, this.content = new U(e);
+    this.http = e, this.tokenManager = t, this.content = new R(e);
   }
   /**
    * Log in using an API key to obtain a seller token.
@@ -496,10 +544,12 @@ class N {
    * @returns The current payment status.
    */
   async getPaymentStatus(e) {
-    return this.http.get(`/v1/wallet/payment-status/${e}`);
+    return this.http.get(
+      `/v1/wallet/payment-status/${encodeURIComponent(e)}`
+    );
   }
 }
-class _ {
+class F {
   constructor(e) {
     this.http = e;
   }
@@ -515,35 +565,84 @@ class _ {
    * @returns The checkout state, including what action is required next.
    */
   async state(e) {
-    return this.http.get(`/v1/checkout/state/${e}`);
+    return this.http.get(
+      `/v1/checkout/state/${encodeURIComponent(e)}`
+    );
   }
 }
-function q(s) {
-  const e = s.baseUrl ?? "https://api.ledewire.com", t = s.storage ?? new A(), r = new E({
+class _ {
+  /** @internal */
+  constructor(e) {
+    this.http = e;
+  }
+  /**
+   * Returns all buyer API keys for the authenticated user.
+   * The `secret` is never included in list responses.
+   *
+   * @returns Array of API key records.
+   */
+  async list() {
+    return this.http.get("/v1/user/api-keys");
+  }
+  /**
+   * Creates a new buyer API key.
+   *
+   * The `secret` in the response is shown exactly once and cannot be retrieved
+   * again. Store it immediately in a secrets manager before discarding the
+   * response object.
+   *
+   * @param body - Name and optional spend ceiling for the new key.
+   * @returns The new key's public identifier and one-time secret.
+   *
+   * @example
+   * ```ts
+   * const { key, secret } = await client.user.apiKeys.create({
+   *   name: 'production-agent',
+   *   spending_limit_cents: 5000, // $50 cap
+   * })
+   * // ⚠️ Store secret NOW — it is shown once only
+   * process.env.LEDEWIRE_BUYER_SECRET = secret
+   * ```
+   */
+  async create(e) {
+    return this.http.post("/v1/user/api-keys", e);
+  }
+  /**
+   * Revokes (permanently deletes) a buyer API key by ID.
+   *
+   * Any agent currently using this key will receive `401` on its next
+   * token refresh. Revocation takes effect immediately.
+   *
+   * @param id - UUID of the API key to revoke.
+   */
+  async revoke(e) {
+    return this.http.delete(`/v1/user/api-keys/${encodeURIComponent(e)}`);
+  }
+}
+class $ {
+  /** @internal */
+  constructor(e) {
+    /**
+     * Buyer API key management: create, list, and revoke named API keys.
+     * Keys are used by autonomous agents to authenticate without a username/password.
+     */
+    n(this, "apiKeys");
+    this.apiKeys = new _(e);
+  }
+}
+function j(s) {
+  const e = s.baseUrl ?? d, t = s.storage ?? new U(), r = new E({
     storage: t,
-    refreshFn: async (h) => {
-      const i = await fetch(`${e}/v1/auth/token/refresh`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refresh_token: h })
-      });
-      if (!i.ok) throw new Error("Token refresh failed");
-      const a = await i.json();
-      return {
-        accessToken: a.access_token,
-        refreshToken: a.refresh_token,
-        expiresAt: p(a.expires_at)
-      };
-    },
+    refreshFn: v(e),
     ...s.onAuthExpired !== void 0 && { onAuthExpired: s.onAuthExpired }
-  }), o = new y({
+  }), o = new m({
     baseUrl: e,
     getAccessToken: () => r.getAccessToken(),
     onUnauthorized: () => r.handleUnauthorized()
   });
-  return new R(o, r, s);
+  return new B(o, r, s);
 }
-class R {
+class B {
   /** @internal */
   constructor(e, t, r) {
     /** Platform-level public configuration (no auth required) */
@@ -560,59 +659,47 @@ class R {
     n(this, "content");
     /** Seller operations: API key login, content list/search/get */
     n(this, "seller");
-    this._http = e, this._tokenManager = t, this._config = r, this.config = new v(e), this.auth = new S(e, t), this.checkout = new _(e), this.wallet = new N(e), this.purchases = new b(e), this.content = new x(e), this.seller = new P(e, t);
+    /** Authenticated buyer account: API key management */
+    n(this, "user");
+    this._http = e, this._tokenManager = t, this._config = r, this.config = new b(e), this.auth = new x(e, t), this.checkout = new F(e), this.wallet = new N(e), this.purchases = new P(e), this.content = new S(e), this.seller = new C(e, t), this.user = new $(e);
   }
 }
-const F = "lw:tokens";
-function L(s = F) {
+const I = "lw:tokens";
+function g(s, e = I) {
   return {
     getTokens() {
-      const e = localStorage.getItem(s);
-      if (!e) return null;
+      const t = s.getItem(e);
+      if (!t) return null;
       try {
-        return JSON.parse(e);
+        return JSON.parse(t);
       } catch {
         return null;
       }
     },
-    setTokens(e) {
-      localStorage.setItem(s, JSON.stringify(e));
+    setTokens(t) {
+      s.setItem(e, JSON.stringify(t));
     },
     clearTokens() {
-      localStorage.removeItem(s);
+      s.removeItem(e);
     }
   };
 }
-const O = "lw:tokens";
-function M(s = O) {
-  return {
-    getTokens() {
-      const e = sessionStorage.getItem(s);
-      if (!e) return null;
-      try {
-        return JSON.parse(e);
-      } catch {
-        return null;
-      }
-    },
-    setTokens(e) {
-      sessionStorage.setItem(s, JSON.stringify(e));
-    },
-    clearTokens() {
-      sessionStorage.removeItem(s);
-    }
-  };
+function z(s) {
+  return g(localStorage, s);
+}
+function L(s) {
+  return g(sessionStorage, s);
 }
 export {
   l as AuthError,
-  k as ForbiddenError,
+  y as ForbiddenError,
   c as LedewireError,
-  A as MemoryTokenStorage,
-  f as NotFoundError,
-  B as PurchaseError,
-  q as init,
-  L as localStorageAdapter,
+  U as MemoryTokenStorage,
+  T as NotFoundError,
+  M as PurchaseError,
+  j as init,
+  z as localStorageAdapter,
   p as parseExpiresAt,
-  M as sessionStorageAdapter
+  L as sessionStorageAdapter
 };
 //# sourceMappingURL=index.js.map