@mesyncapp/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 senluchen2015
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,125 @@
+# @mesyncapp/sdk
+
+The client library a frontend-only app uses to store its data in the user's
+personal mesync backend instead of `localStorage`. See
+`../docs/DEVELOPER_GUIDE.md` for the full integration guide (registering an
+app, defining tables, migrations, the consent flow, cross-app data) — this
+README only covers the SDK's own API surface. `../docs/DESIGN.md` covers
+the system this talks to.
+
+This is intentionally tiny: configure once, redirect for consent, then
+read/write a table. Built with tsup to `dist/`, with three entry points:
+`@mesyncapp/sdk` (core client), `@mesyncapp/sdk/elements` (framework-agnostic
+custom elements), and `@mesyncapp/sdk/elements/react` (React wrappers, only
+needed if you use React).
+
+## Usage
+
+**Registering your app** — a manifest, not a separate dashboard step:
+
+```ts
+import { defineManifest } from "@mesyncapp/sdk";
+
+export const manifest = defineManifest({
+  uniqueId: "meals", // your choice — check availability first via GET /api/catalog/unique-id-available
+  name: "Meals",
+  redirectUris: [window.location.origin + "/callback"],
+  tables: [{ name: "entries", columns: [{ name: "title", type: "string", required: true, default: "" }] }],
+});
+```
+
+```ts
+import { mesync } from "@mesyncapp/sdk";
+
+mesync.configure({
+  mesyncUrl: "http://localhost:5173", // the mesync app's origin
+  uniqueId: manifest.uniqueId,
+  redirectUri: window.location.origin + "/callback",
+});
+```
+
+**On your "Connect with mesync" button** — pass `manifest` in alongside your
+scopes, there's no separate registration step:
+
+```tsx
+import { MesyncConnect } from "@mesyncapp/sdk/elements/react";
+
+<MesyncConnect
+  scopes={[
+    { namespace: "meals", table: "entries", permission: "write" }, // your own data
+    { namespace: "move", table: "logs", permission: "read", reason: "To show today's workouts." }, // someone else's, with their consent
+  ]}
+  manifest={manifest}
+/>
+```
+
+The SDK itself never decides anything about registration — `manifest` just
+rides along to mesync's own hosted consent screen, which checks who's
+registered/owns what and shows "Register new app", "Update app schema", or
+today's ordinary consent screen accordingly. The very first connect for a
+brand-new app is also its registration — there's no separate setup step,
+and the developer always types their password on mesync's own real login
+page, never a form your app rendered. See `docs/DEVELOPER_GUIDE.md` for the
+full model (including the headless `useMesyncConnect()` equivalent, and
+what happens on a `uniqueId` collision).
+
+Calling the underlying client functions directly instead of the element:
+
+```ts
+await mesync.login(
+  [{ namespace: "meals", table: "entries", permission: "write" }],
+  { manifest } // omit entirely if you've already registered elsewhere
+);
+```
+
+For direct/scripting registration (e.g. a CI setup script) instead of the
+interactive connect flow, `mesync.registerManifest(manifest, token)` takes
+a bearer token you've already obtained yourself (e.g. your own
+`POST /api/auth/login` call) and does the same create/confirm/update
+upsert `POST /api/apps/manifest` does.
+
+`reason` is optional per scope — a short line shown on the consent screen
+explaining why your app wants that specific permission.
+
+This redirects the browser to the mesync consent screen. The user approves,
+and is redirected back to your `redirectUri` with a code in the query string.
+
+**On your `redirectUri` page**, once on load:
+
+```ts
+await mesync.handleCallback();
+// tokens are now stored; redirect to wherever your app actually starts
+```
+
+**Anywhere after that**, read and write rows:
+
+```ts
+const meals = mesync.table("meals", "entries");
+
+await meals.insert({ title: "Lunch", calories: 500 });
+const { items, total } = await meals.list();
+await meals.update(items[0].id, { calories: 600 });
+await meals.remove(items[0].id);
+```
+
+`mesync.table()` works the same way for a table you were only granted
+`"read"` on — write calls will just 403.
+
+## Notes
+
+- `mesyncUrl` is assumed to serve both the consent UI (`/oauth/authorize`)
+  and the API (`/api/...`) on the same origin — that's how the dev setup
+  (Vite proxying `/api` to the backend) and the likely deployment shape both
+  work. If that ever splits into two origins, `configure()` will need a
+  second URL.
+- Access tokens are refreshed transparently on a 401 using the stored
+  refresh token; if that also fails, calls throw `MesyncAuthError` and the
+  app should call `mesync.login(...)` again.
+- Tokens live in `localStorage` under `mesync_access_token` /
+  `mesync_refresh_token`. The PKCE verifier and OAuth `state` also live in
+  `localStorage` (not `sessionStorage`) — in popup mode the popup navigates
+  to `mesyncUrl` and back, and an auxiliary window only shares its opener's
+  `sessionStorage` while same-origin, so that round trip can lose it.
+  `localStorage` is keyed purely by origin with no such restriction. They're
+  deleted immediately after the callback reads them, so still short-lived
+  in practice.

package/dist/chunk-E3FGRAPR.js

@@ -0,0 +1,136 @@
+import {
+  mesync
+} from "./chunk-YPMJ6DJU.js";
+
+// src/elements/connect-element.ts
+var STYLE = `
+  :host { display: inline-block; font-family: inherit; }
+  button {
+    font: inherit;
+    font-size: 0.95rem;
+    padding: 0.6rem 1.2rem;
+    border-radius: var(--mesync-radius, 8px);
+    border: none;
+    background: var(--mesync-bg, #111827);
+    color: var(--mesync-color, #fff);
+    cursor: pointer;
+  }
+  button:disabled { opacity: 0.6; cursor: default; }
+  ::slotted(*) { cursor: pointer; }
+  .error { color: var(--mesync-error-color, #dc2626); font-size: 0.85rem; margin-top: 0.4rem; }
+`;
+var MesyncConnectElement = class extends HTMLElement {
+  #button;
+  #slot;
+  #fallbackText;
+  #errorEl;
+  #connecting = false;
+  static get observedAttributes() {
+    return ["label", "connected-label"];
+  }
+  constructor() {
+    super();
+    const shadow = this.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = STYLE;
+    this.#button = document.createElement("button");
+    this.#slot = document.createElement("slot");
+    this.#fallbackText = document.createTextNode("");
+    this.#slot.append(this.#fallbackText);
+    this.#button.append(this.#slot);
+    this.#errorEl = document.createElement("div");
+    this.#errorEl.className = "error";
+    this.#errorEl.setAttribute("part", "error");
+    this.#button.setAttribute("part", "button");
+    shadow.append(style, this.#button, this.#errorEl);
+    this.#button.addEventListener("click", () => void this.#connect());
+  }
+  connectedCallback() {
+    this.#render();
+  }
+  attributeChangedCallback() {
+    this.#render();
+  }
+  #scopes() {
+    const raw = this.getAttribute("scopes");
+    if (!raw) throw new Error("<mesync-connect> requires a scopes attribute (JSON string)");
+    return JSON.parse(raw);
+  }
+  #manifest() {
+    const raw = this.getAttribute("manifest");
+    return raw ? JSON.parse(raw) : void 0;
+  }
+  #render() {
+    const loggedIn = mesync.isLoggedIn();
+    this.#button.disabled = this.#connecting || loggedIn;
+    this.#fallbackText.textContent = this.#connecting ? "Connecting\u2026" : loggedIn ? this.getAttribute("connected-label") ?? "Connected" : this.getAttribute("label") ?? "Connect with mesync";
+    this.toggleAttribute("connecting", this.#connecting);
+    this.toggleAttribute("connected", loggedIn);
+  }
+  async #connect() {
+    this.#connecting = true;
+    this.#errorEl.textContent = "";
+    this.#render();
+    const manifest = this.#manifest();
+    const usePopup = this.getAttribute("mode") === "popup";
+    const options = manifest ? { manifest } : void 0;
+    try {
+      if (usePopup) {
+        await mesync.loginPopup(this.#scopes(), options);
+        this.#connecting = false;
+        this.#render();
+        this.dispatchEvent(new CustomEvent("mesync-connected", { bubbles: true, composed: true }));
+      } else {
+        await mesync.login(this.#scopes(), options);
+      }
+    } catch (err) {
+      this.#connecting = false;
+      const message = err instanceof Error ? err.message : "Could not connect to mesync.";
+      this.#errorEl.textContent = message;
+      this.#render();
+      this.dispatchEvent(new CustomEvent("mesync-error", { detail: message, bubbles: true, composed: true }));
+    }
+  }
+};
+if (!customElements.get("mesync-connect")) {
+  customElements.define("mesync-connect", MesyncConnectElement);
+}
+
+// src/elements/callback-element.ts
+var MesyncCallbackElement = class extends HTMLElement {
+  #statusEl;
+  constructor() {
+    super();
+    const shadow = this.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = `:host { display: block; } p { font-family: inherit; }`;
+    this.#statusEl = document.createElement("p");
+    this.#statusEl.setAttribute("part", "status");
+    this.#statusEl.textContent = "Connecting to mesync\u2026";
+    shadow.append(style, this.#statusEl);
+  }
+  connectedCallback() {
+    void this.#run();
+  }
+  async #run() {
+    try {
+      await mesync.handleCallback();
+      this.dispatchEvent(new CustomEvent("mesync-connected", { bubbles: true, composed: true }));
+      const redirectTo = this.getAttribute("redirect-to") ?? "./";
+      if (redirectTo) window.location.href = redirectTo;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Could not connect to mesync.";
+      this.#statusEl.textContent = message;
+      this.dispatchEvent(new CustomEvent("mesync-error", { detail: message, bubbles: true, composed: true }));
+    }
+  }
+};
+if (!customElements.get("mesync-callback")) {
+  customElements.define("mesync-callback", MesyncCallbackElement);
+}
+
+export {
+  MesyncConnectElement,
+  MesyncCallbackElement
+};
+//# sourceMappingURL=chunk-E3FGRAPR.js.map

package/dist/chunk-E3FGRAPR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/elements/connect-element.ts","../src/elements/callback-element.ts"],"sourcesContent":["import { mesync } from \"../client\";\nimport type { MesyncManifest, ScopeRequest } from \"../types\";\n\nconst STYLE = `\n  :host { display: inline-block; font-family: inherit; }\n  button {\n    font: inherit;\n    font-size: 0.95rem;\n    padding: 0.6rem 1.2rem;\n    border-radius: var(--mesync-radius, 8px);\n    border: none;\n    background: var(--mesync-bg, #111827);\n    color: var(--mesync-color, #fff);\n    cursor: pointer;\n  }\n  button:disabled { opacity: 0.6; cursor: default; }\n  ::slotted(*) { cursor: pointer; }\n  .error { color: var(--mesync-error-color, #dc2626); font-size: 0.85rem; margin-top: 0.4rem; }\n`;\n\n/**\n * Prebuilt \"Connect with mesync\" button. Framework-agnostic (plain custom\n * element) so it can drop into React/Vue/Svelte/etc without a framework-\n * specific SDK build. Usage:\n *\n *   <mesync-connect scopes='[{\"namespace\":\"move\",\"table\":\"logs\",\"permission\":\"write\"}]'></mesync-connect>\n *\n * By default (mode=\"redirect\", or omitted) this navigates the whole page to\n * the consent screen, so completion is observed on the redirect_uri page via\n * <mesync-callback> instead of here. Set mode=\"popup\" to instead drive the\n * consent screen in a popup window and get a \"mesync-connected\" event on\n * this element once it completes, with no page navigation.\n *\n * Pass a `manifest` attribute (JSON, same shape as defineManifest()'s\n * argument) to fold app registration into this same button — it's just\n * forwarded along to mesync's own hosted consent screen, which checks\n * whether `manifest.uniqueId` needs registering, needs a schema update, or\n * is already in sync, and shows the right screen there (including, on the\n * very first-ever connect, a real login page hosted on mesync's own origin —\n * never a form rendered by this element or by your app). This element makes\n * no registration decisions itself.\n *\n * Renders `label`/`connected-label` as plain text by default, but any light-DOM\n * children take over instead — e.g. drop in an icon or custom markup:\n *\n *   <mesync-connect scopes='...'><img src=\"/icon.svg\" alt=\"Connect\"></mesync-connect>\n *\n * The host toggles `connecting`/`connected` boolean attributes so custom\n * content can react via CSS (e.g. `mesync-connect[connecting] img { opacity: .5 }`).\n * Styling hooks: `::part(button)`, `::part(error)`, and the CSS custom\n * properties --mesync-bg, --mesync-color, --mesync-radius, --mesync-error-color.\n *\n * Emits \"mesync-error\" if the connection fails (scope resolution before the\n * redirect, a blocked/closed popup, or a rejected popup flow).\n */\nclass MesyncConnectElement extends HTMLElement {\n  #button: HTMLButtonElement;\n  #slot: HTMLSlotElement;\n  #fallbackText: Text;\n  #errorEl: HTMLDivElement;\n  #connecting = false;\n\n  static get observedAttributes(): string[] {\n    return [\"label\", \"connected-label\"];\n  }\n\n  constructor() {\n    super();\n    const shadow = this.attachShadow({ mode: \"open\" });\n    const style = document.createElement(\"style\");\n    style.textContent = STYLE;\n    this.#button = document.createElement(\"button\");\n    this.#slot = document.createElement(\"slot\");\n    this.#fallbackText = document.createTextNode(\"\");\n    // Fallback content (shown only when nothing is slotted in) — lets callers\n    // swap in an icon/custom markup as light-DOM children of <mesync-connect>\n    // while defaulting to plain text when they don't.\n    this.#slot.append(this.#fallbackText);\n    this.#button.append(this.#slot);\n    this.#errorEl = document.createElement(\"div\");\n    this.#errorEl.className = \"error\";\n    this.#errorEl.setAttribute(\"part\", \"error\");\n    this.#button.setAttribute(\"part\", \"button\");\n    shadow.append(style, this.#button, this.#errorEl);\n    this.#button.addEventListener(\"click\", () => void this.#connect());\n  }\n\n  connectedCallback(): void {\n    this.#render();\n  }\n\n  attributeChangedCallback(): void {\n    this.#render();\n  }\n\n  #scopes(): ScopeRequest[] {\n    const raw = this.getAttribute(\"scopes\");\n    if (!raw) throw new Error(\"<mesync-connect> requires a scopes attribute (JSON string)\");\n    return JSON.parse(raw) as ScopeRequest[];\n  }\n\n  #manifest(): MesyncManifest | undefined {\n    const raw = this.getAttribute(\"manifest\");\n    return raw ? (JSON.parse(raw) as MesyncManifest) : undefined;\n  }\n\n  #render(): void {\n    const loggedIn = mesync.isLoggedIn();\n    this.#button.disabled = this.#connecting || loggedIn;\n    this.#fallbackText.textContent = this.#connecting\n      ? \"Connecting…\"\n      : loggedIn\n        ? (this.getAttribute(\"connected-label\") ?? \"Connected\")\n        : (this.getAttribute(\"label\") ?? \"Connect with mesync\");\n    this.toggleAttribute(\"connecting\", this.#connecting);\n    this.toggleAttribute(\"connected\", loggedIn);\n  }\n\n  async #connect(): Promise<void> {\n    this.#connecting = true;\n    this.#errorEl.textContent = \"\";\n    this.#render();\n    const manifest = this.#manifest();\n    const usePopup = this.getAttribute(\"mode\") === \"popup\";\n    const options = manifest ? { manifest } : undefined;\n    try {\n      if (usePopup) {\n        await mesync.loginPopup(this.#scopes(), options);\n        this.#connecting = false;\n        this.#render();\n        this.dispatchEvent(new CustomEvent(\"mesync-connected\", { bubbles: true, composed: true }));\n      } else {\n        await mesync.login(this.#scopes(), options);\n        // Browser navigates away on success; nothing after this line normally runs.\n      }\n    } catch (err) {\n      this.#connecting = false;\n      const message = err instanceof Error ? err.message : \"Could not connect to mesync.\";\n      this.#errorEl.textContent = message;\n      this.#render();\n      this.dispatchEvent(new CustomEvent(\"mesync-error\", { detail: message, bubbles: true, composed: true }));\n    }\n  }\n}\n\nif (!customElements.get(\"mesync-connect\")) {\n  customElements.define(\"mesync-connect\", MesyncConnectElement);\n}\n\nexport { MesyncConnectElement };\n","import { mesync } from \"../client\";\n\n/**\n * Drop-in replacement for the redirect_uri page's callback handler. Calls\n * mesync.handleCallback() on mount, then either redirects (default: back to\n * \"/\") or emits \"mesync-connected\" for the host app to handle itself.\n *\n *   <mesync-callback redirect-to=\"./\"></mesync-callback>\n *\n * Set redirect-to=\"\" (empty) to suppress the redirect and just listen for\n * \"mesync-connected\" / \"mesync-error\" instead.\n */\nclass MesyncCallbackElement extends HTMLElement {\n  #statusEl: HTMLParagraphElement;\n\n  constructor() {\n    super();\n    const shadow = this.attachShadow({ mode: \"open\" });\n    const style = document.createElement(\"style\");\n    style.textContent = `:host { display: block; } p { font-family: inherit; }`;\n    this.#statusEl = document.createElement(\"p\");\n    this.#statusEl.setAttribute(\"part\", \"status\");\n    this.#statusEl.textContent = \"Connecting to mesync…\";\n    shadow.append(style, this.#statusEl);\n  }\n\n  connectedCallback(): void {\n    void this.#run();\n  }\n\n  async #run(): Promise<void> {\n    try {\n      await mesync.handleCallback();\n      this.dispatchEvent(new CustomEvent(\"mesync-connected\", { bubbles: true, composed: true }));\n      const redirectTo = this.getAttribute(\"redirect-to\") ?? \"./\";\n      if (redirectTo) window.location.href = redirectTo;\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Could not connect to mesync.\";\n      this.#statusEl.textContent = message;\n      this.dispatchEvent(new CustomEvent(\"mesync-error\", { detail: message, bubbles: true, composed: true }));\n    }\n  }\n}\n\nif (!customElements.get(\"mesync-callback\")) {\n  customElements.define(\"mesync-callback\", MesyncCallbackElement);\n}\n\nexport { MesyncCallbackElement };\n"],"mappings":";;;;;AAGA,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoDd,IAAM,uBAAN,cAAmC,YAAY;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EAEd,WAAW,qBAA+B;AACxC,WAAO,CAAC,SAAS,iBAAiB;AAAA,EACpC;AAAA,EAEA,cAAc;AACZ,UAAM;AACN,UAAM,SAAS,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AACjD,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,SAAK,UAAU,SAAS,cAAc,QAAQ;AAC9C,SAAK,QAAQ,SAAS,cAAc,MAAM;AAC1C,SAAK,gBAAgB,SAAS,eAAe,EAAE;AAI/C,SAAK,MAAM,OAAO,KAAK,aAAa;AACpC,SAAK,QAAQ,OAAO,KAAK,KAAK;AAC9B,SAAK,WAAW,SAAS,cAAc,KAAK;AAC5C,SAAK,SAAS,YAAY;AAC1B,SAAK,SAAS,aAAa,QAAQ,OAAO;AAC1C,SAAK,QAAQ,aAAa,QAAQ,QAAQ;AAC1C,WAAO,OAAO,OAAO,KAAK,SAAS,KAAK,QAAQ;AAChD,SAAK,QAAQ,iBAAiB,SAAS,MAAM,KAAK,KAAK,SAAS,CAAC;AAAA,EACnE;AAAA,EAEA,oBAA0B;AACxB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,2BAAiC;AAC/B,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,UAA0B;AACxB,UAAM,MAAM,KAAK,aAAa,QAAQ;AACtC,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,4DAA4D;AACtF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB;AAAA,EAEA,YAAwC;AACtC,UAAM,MAAM,KAAK,aAAa,UAAU;AACxC,WAAO,MAAO,KAAK,MAAM,GAAG,IAAuB;AAAA,EACrD;AAAA,EAEA,UAAgB;AACd,UAAM,WAAW,OAAO,WAAW;AACnC,SAAK,QAAQ,WAAW,KAAK,eAAe;AAC5C,SAAK,cAAc,cAAc,KAAK,cAClC,qBACA,WACG,KAAK,aAAa,iBAAiB,KAAK,cACxC,KAAK,aAAa,OAAO,KAAK;AACrC,SAAK,gBAAgB,cAAc,KAAK,WAAW;AACnD,SAAK,gBAAgB,aAAa,QAAQ;AAAA,EAC5C;AAAA,EAEA,MAAM,WAA0B;AAC9B,SAAK,cAAc;AACnB,SAAK,SAAS,cAAc;AAC5B,SAAK,QAAQ;AACb,UAAM,WAAW,KAAK,UAAU;AAChC,UAAM,WAAW,KAAK,aAAa,MAAM,MAAM;AAC/C,UAAM,UAAU,WAAW,EAAE,SAAS,IAAI;AAC1C,QAAI;AACF,UAAI,UAAU;AACZ,cAAM,OAAO,WAAW,KAAK,QAAQ,GAAG,OAAO;AAC/C,aAAK,cAAc;AACnB,aAAK,QAAQ;AACb,aAAK,cAAc,IAAI,YAAY,oBAAoB,EAAE,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC;AAAA,MAC3F,OAAO;AACL,cAAM,OAAO,MAAM,KAAK,QAAQ,GAAG,OAAO;AAAA,MAE5C;AAAA,IACF,SAAS,KAAK;AACZ,WAAK,cAAc;AACnB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAK,SAAS,cAAc;AAC5B,WAAK,QAAQ;AACb,WAAK,cAAc,IAAI,YAAY,gBAAgB,EAAE,QAAQ,SAAS,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC;AAAA,IACxG;AAAA,EACF;AACF;AAEA,IAAI,CAAC,eAAe,IAAI,gBAAgB,GAAG;AACzC,iBAAe,OAAO,kBAAkB,oBAAoB;AAC9D;;;ACvIA,IAAM,wBAAN,cAAoC,YAAY;AAAA,EAC9C;AAAA,EAEA,cAAc;AACZ,UAAM;AACN,UAAM,SAAS,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AACjD,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,SAAK,YAAY,SAAS,cAAc,GAAG;AAC3C,SAAK,UAAU,aAAa,QAAQ,QAAQ;AAC5C,SAAK,UAAU,cAAc;AAC7B,WAAO,OAAO,OAAO,KAAK,SAAS;AAAA,EACrC;AAAA,EAEA,oBAA0B;AACxB,SAAK,KAAK,KAAK;AAAA,EACjB;AAAA,EAEA,MAAM,OAAsB;AAC1B,QAAI;AACF,YAAM,OAAO,eAAe;AAC5B,WAAK,cAAc,IAAI,YAAY,oBAAoB,EAAE,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC;AACzF,YAAM,aAAa,KAAK,aAAa,aAAa,KAAK;AACvD,UAAI,WAAY,QAAO,SAAS,OAAO;AAAA,IACzC,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAK,UAAU,cAAc;AAC7B,WAAK,cAAc,IAAI,YAAY,gBAAgB,EAAE,QAAQ,SAAS,SAAS,MAAM,UAAU,KAAK,CAAC,CAAC;AAAA,IACxG;AAAA,EACF;AACF;AAEA,IAAI,CAAC,eAAe,IAAI,iBAAiB,GAAG;AAC1C,iBAAe,OAAO,mBAAmB,qBAAqB;AAChE;","names":[]}

package/dist/chunk-YPMJ6DJU.js

@@ -0,0 +1,386 @@
+// src/pkce.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomUrlSafeString(byteLength = 32) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}
+async function pkceChallengeFromVerifier(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(digest));
+}
+
+// src/storage.ts
+var ACCESS_TOKEN_KEY = "mesync_access_token";
+var REFRESH_TOKEN_KEY = "mesync_refresh_token";
+var PKCE_VERIFIER_KEY = "mesync_pkce_verifier";
+var OAUTH_STATE_KEY = "mesync_oauth_state";
+var tokenStorage = {
+  getAccessToken: () => localStorage.getItem(ACCESS_TOKEN_KEY),
+  getRefreshToken: () => localStorage.getItem(REFRESH_TOKEN_KEY),
+  setTokens(accessToken, refreshToken) {
+    localStorage.setItem(ACCESS_TOKEN_KEY, accessToken);
+    localStorage.setItem(REFRESH_TOKEN_KEY, refreshToken);
+  },
+  clear() {
+    localStorage.removeItem(ACCESS_TOKEN_KEY);
+    localStorage.removeItem(REFRESH_TOKEN_KEY);
+  }
+};
+var pkceStorage = {
+  save(verifier, state) {
+    localStorage.setItem(PKCE_VERIFIER_KEY, verifier);
+    localStorage.setItem(OAUTH_STATE_KEY, state);
+  },
+  consume() {
+    const verifier = localStorage.getItem(PKCE_VERIFIER_KEY);
+    const state = localStorage.getItem(OAUTH_STATE_KEY);
+    localStorage.removeItem(PKCE_VERIFIER_KEY);
+    localStorage.removeItem(OAUTH_STATE_KEY);
+    if (!verifier || !state) return null;
+    return { verifier, state };
+  }
+};
+
+// src/client.ts
+var MesyncAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MesyncAuthError";
+  }
+};
+var MesyncUniqueIdConflictError = class extends Error {
+  constructor(uniqueId, suggestedUniqueId, message) {
+    super(message);
+    this.uniqueId = uniqueId;
+    this.suggestedUniqueId = suggestedUniqueId;
+    this.name = "MesyncUniqueIdConflictError";
+  }
+  uniqueId;
+  suggestedUniqueId;
+};
+var MesyncManifestDivergedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MesyncManifestDivergedError";
+  }
+};
+var config = null;
+function requireConfig() {
+  if (!config) {
+    throw new Error("mesync.configure(...) must be called before using the SDK");
+  }
+  return config;
+}
+function configure(newConfig) {
+  config = newConfig;
+}
+async function resolveTableDefId(namespace, table2) {
+  const { mesyncUrl } = requireConfig();
+  const resp = await fetch(`${mesyncUrl}/api/catalog/apps/${namespace}/tables`);
+  if (resp.status === 404) {
+    throw new Error(
+      `App '${namespace}' isn't registered in the mesync catalog yet, so '${namespace}.${table2}' can't be resolved. It needs to complete its own connect flow (with its manifest) at least once before other apps can request cross-app access to its tables.`
+    );
+  }
+  if (!resp.ok) {
+    throw new Error(
+      `Could not look up table '${namespace}.${table2}' in the mesync catalog (HTTP ${resp.status})`
+    );
+  }
+  const tables = await resp.json();
+  const match = tables.find((t) => t.name === table2);
+  if (!match) {
+    throw new Error(`Table '${table2}' not found under namespace '${namespace}'`);
+  }
+  return match.table_def_id;
+}
+function isOwnScope(s, uniqueId) {
+  return uniqueId !== void 0 && s.namespace === uniqueId;
+}
+async function buildAuthorizeUrl(scopes, manifest) {
+  const { mesyncUrl, uniqueId, redirectUri } = requireConfig();
+  if (scopes.length === 0) {
+    throw new Error("login() requires at least one scope");
+  }
+  const ownScopes = scopes.filter((s) => isOwnScope(s, manifest?.uniqueId));
+  const crossScopes = scopes.filter((s) => !isOwnScope(s, manifest?.uniqueId));
+  const crossEntries = await Promise.all(
+    crossScopes.map(async (s) => `${await resolveTableDefId(s.namespace, s.table)}:${s.permission}`)
+  );
+  const verifier = randomUrlSafeString();
+  const challenge = await pkceChallengeFromVerifier(verifier);
+  const state = randomUrlSafeString(16);
+  pkceStorage.save(verifier, state);
+  const query = new URLSearchParams({
+    // Wire-protocol param name per OAuth2 convention — its value is the app's uniqueId.
+    client_id: uniqueId,
+    redirect_uri: redirectUri,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state,
+    // The app's own origin, so the platform can link back to it once connected.
+    app_url: window.location.origin
+  });
+  if (crossEntries.length) {
+    query.set("scope", crossEntries.join(","));
+    if (crossScopes.some((s) => s.reason)) {
+      query.set("reasons", crossScopes.map((s) => encodeURIComponent(s.reason ?? "")).join(","));
+    }
+  }
+  if (ownScopes.length) {
+    query.set("own_scope", ownScopes.map((s) => `${s.table}:${s.permission}`).join(","));
+    if (ownScopes.some((s) => s.reason)) {
+      query.set("own_reasons", ownScopes.map((s) => encodeURIComponent(s.reason ?? "")).join(","));
+    }
+  }
+  if (manifest) {
+    query.set(
+      "manifest",
+      JSON.stringify({
+        unique_id: manifest.uniqueId,
+        name: manifest.name,
+        description: manifest.description,
+        redirect_uris: manifest.redirectUris,
+        tables: manifest.tables
+      })
+    );
+  }
+  return `${mesyncUrl}/oauth/authorize?${query.toString()}`;
+}
+async function login(scopes, options = {}) {
+  window.location.href = await buildAuthorizeUrl(scopes, options.manifest);
+}
+function loginPopup(scopes, options = {}) {
+  const popup = window.open("", "mesync-connect", "width=480,height=640,menubar=no,toolbar=no,status=no");
+  if (!popup) {
+    return Promise.reject(
+      new MesyncAuthError("Popup blocked \u2014 allow popups for this site, or use mesync.login() instead.")
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    function cleanup() {
+      window.removeEventListener("message", handleMessage);
+      clearInterval(closePoll);
+    }
+    function handleMessage(e) {
+      if (e.source !== popup || e.origin !== window.location.origin) return;
+      settled = true;
+      cleanup();
+      if (e.data?.type === "mesync-connected") {
+        resolve();
+      } else if (e.data?.type === "mesync-error") {
+        reject(new MesyncAuthError(e.data.message ?? "Could not connect to mesync."));
+      }
+    }
+    window.addEventListener("message", handleMessage);
+    const closePoll = window.setInterval(() => {
+      if (popup.closed && !settled) {
+        settled = true;
+        cleanup();
+        reject(new MesyncAuthError("Connection window was closed before completing."));
+      }
+    }, 500);
+    buildAuthorizeUrl(scopes, options.manifest).then((url) => {
+      popup.location.href = url;
+    }).catch((err) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      popup.close();
+      reject(err instanceof Error ? err : new MesyncAuthError("Could not connect to mesync."));
+    });
+  });
+}
+function isPopup() {
+  return !!window.opener && window.opener !== window;
+}
+function notifyOpenerAndClose(payload) {
+  window.opener.postMessage(payload, window.location.origin);
+  window.close();
+}
+async function exchangeCodeForTokens() {
+  const { mesyncUrl, uniqueId, redirectUri } = requireConfig();
+  const params = new URLSearchParams(window.location.search);
+  const errorParam = params.get("error");
+  if (errorParam) {
+    throw new MesyncAuthError(`mesync authorization was denied: ${errorParam}`);
+  }
+  const code = params.get("code");
+  const returnedState = params.get("state");
+  if (!code || !returnedState) {
+    throw new MesyncAuthError("Missing code/state in callback URL");
+  }
+  const saved = pkceStorage.consume();
+  if (!saved || saved.state !== returnedState) {
+    throw new MesyncAuthError("OAuth state mismatch \u2014 possible CSRF, aborting");
+  }
+  const resp = await fetch(`${mesyncUrl}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: saved.verifier,
+      client_id: uniqueId
+    })
+  });
+  if (!resp.ok) {
+    throw new MesyncAuthError(`Token exchange failed: ${await resp.text()}`);
+  }
+  const tokens = await resp.json();
+  tokenStorage.setTokens(tokens.access_token, tokens.refresh_token);
+}
+var inFlightCallback = null;
+function handleCallback() {
+  const code = new URLSearchParams(window.location.search).get("code");
+  if (code && inFlightCallback?.code === code) {
+    return inFlightCallback.promise;
+  }
+  const promise = (async () => {
+    try {
+      await exchangeCodeForTokens();
+    } catch (err) {
+      if (isPopup()) {
+        const message = err instanceof Error ? err.message : "Could not connect to mesync.";
+        notifyOpenerAndClose({ type: "mesync-error", message });
+        return;
+      }
+      throw err;
+    }
+    if (isPopup()) {
+      notifyOpenerAndClose({ type: "mesync-connected" });
+    }
+  })();
+  if (code) inFlightCallback = { code, promise };
+  return promise;
+}
+var inFlightRefresh = null;
+async function refreshAccessToken() {
+  if (inFlightRefresh) return inFlightRefresh;
+  const { mesyncUrl } = requireConfig();
+  const refreshToken = tokenStorage.getRefreshToken();
+  if (!refreshToken) throw new MesyncAuthError("Not logged in");
+  inFlightRefresh = (async () => {
+    const resp = await fetch(`${mesyncUrl}/api/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ grant_type: "refresh_token", refresh_token: refreshToken })
+    });
+    if (!resp.ok) {
+      tokenStorage.clear();
+      throw new MesyncAuthError("Session expired \u2014 call mesync.login(...) again");
+    }
+    const tokens = await resp.json();
+    tokenStorage.setTokens(tokens.access_token, tokens.refresh_token);
+    return tokens.access_token;
+  })();
+  try {
+    return await inFlightRefresh;
+  } finally {
+    inFlightRefresh = null;
+  }
+}
+async function authedFetch(path, init = {}) {
+  const { mesyncUrl } = requireConfig();
+  let accessToken = tokenStorage.getAccessToken();
+  if (!accessToken) throw new MesyncAuthError("Not logged in \u2014 call mesync.login(...) first");
+  const doFetch = (token) => fetch(`${mesyncUrl}${path}`, {
+    ...init,
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, ...init.headers }
+  });
+  let resp = await doFetch(accessToken);
+  if (resp.status === 401) {
+    accessToken = await refreshAccessToken();
+    resp = await doFetch(accessToken);
+  }
+  return resp;
+}
+async function asJson(resp) {
+  if (!resp.ok) throw new Error(`mesync request failed (${resp.status}): ${await resp.text()}`);
+  if (resp.status === 204) return void 0;
+  return resp.json();
+}
+function table(namespace, name) {
+  const path = `/api/store/${namespace}/${name}`;
+  return {
+    async list(page = 1, pageSize = 20) {
+      return asJson(await authedFetch(`${path}?page=${page}&page_size=${pageSize}`));
+    },
+    async get(rowId) {
+      return asJson(await authedFetch(`${path}/${rowId}`));
+    },
+    async insert(data) {
+      return asJson(await authedFetch(path, { method: "POST", body: JSON.stringify(data) }));
+    },
+    async update(rowId, data) {
+      return asJson(await authedFetch(`${path}/${rowId}`, { method: "PATCH", body: JSON.stringify(data) }));
+    },
+    async remove(rowId) {
+      return asJson(await authedFetch(`${path}/${rowId}`, { method: "DELETE" }));
+    }
+  };
+}
+function isLoggedIn() {
+  return tokenStorage.getAccessToken() !== null;
+}
+function logout() {
+  tokenStorage.clear();
+}
+async function registerManifest(manifest, token, options = {}) {
+  const { mesyncUrl } = requireConfig();
+  const resp = await fetch(`${mesyncUrl}/api/apps/manifest`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({
+      unique_id: manifest.uniqueId,
+      name: manifest.name,
+      description: manifest.description,
+      redirect_uris: manifest.redirectUris,
+      tables: manifest.tables,
+      force: options.force ?? false
+    })
+  });
+  if (resp.status === 409) {
+    const body = await resp.json();
+    const detail = body.detail ?? {};
+    if (detail.error === "diverged") {
+      throw new MesyncManifestDivergedError(detail.message ?? "This manifest doesn't match what's registered.");
+    }
+    throw new MesyncUniqueIdConflictError(
+      manifest.uniqueId,
+      detail.suggested_unique_id ?? null,
+      detail.message ?? `unique_id ${manifest.uniqueId} is already taken`
+    );
+  }
+  if (!resp.ok) {
+    throw new Error(`registerManifest failed: ${resp.status} ${await resp.text()}`);
+  }
+  const result = await resp.json();
+  return { status: result.status, migrationsApplied: result.migrations_applied ?? {} };
+}
+var mesync = {
+  configure,
+  login,
+  loginPopup,
+  handleCallback,
+  table,
+  isLoggedIn,
+  logout,
+  registerManifest
+};
+
+export {
+  MesyncAuthError,
+  MesyncUniqueIdConflictError,
+  MesyncManifestDivergedError,
+  mesync
+};
+//# sourceMappingURL=chunk-YPMJ6DJU.js.map

package/dist/chunk-YPMJ6DJU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["function base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nexport function randomUrlSafeString(byteLength = 32): string {\n  const bytes = new Uint8Array(byteLength);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes);\n}\n\nexport async function pkceChallengeFromVerifier(verifier: string): Promise<string> {\n  const data = new TextEncoder().encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64UrlEncode(new Uint8Array(digest));\n}\n","const ACCESS_TOKEN_KEY = \"mesync_access_token\";\nconst REFRESH_TOKEN_KEY = \"mesync_refresh_token\";\nconst PKCE_VERIFIER_KEY = \"mesync_pkce_verifier\";\nconst OAUTH_STATE_KEY = \"mesync_oauth_state\";\n\nexport const tokenStorage = {\n  getAccessToken: (): string | null => localStorage.getItem(ACCESS_TOKEN_KEY),\n  getRefreshToken: (): string | null => localStorage.getItem(REFRESH_TOKEN_KEY),\n  setTokens(accessToken: string, refreshToken: string): void {\n    localStorage.setItem(ACCESS_TOKEN_KEY, accessToken);\n    localStorage.setItem(REFRESH_TOKEN_KEY, refreshToken);\n  },\n  clear(): void {\n    localStorage.removeItem(ACCESS_TOKEN_KEY);\n    localStorage.removeItem(REFRESH_TOKEN_KEY);\n  },\n};\n\n// Deliberately localStorage, not sessionStorage: in popup mode, the popup\n// navigates to a different origin (mesyncUrl) for consent and back, and an\n// auxiliary window only shares its opener's sessionStorage while it stays\n// same-origin — that round trip can lose it. localStorage is keyed purely by\n// origin with no such browsing-context restriction, so it survives reliably\n// in both the popup and plain-redirect flows. consume() deletes it right\n// after reading, so it's still short-lived in practice.\nexport const pkceStorage = {\n  save(verifier: string, state: string): void {\n    localStorage.setItem(PKCE_VERIFIER_KEY, verifier);\n    localStorage.setItem(OAUTH_STATE_KEY, state);\n  },\n  consume(): { verifier: string; state: string } | null {\n    const verifier = localStorage.getItem(PKCE_VERIFIER_KEY);\n    const state = localStorage.getItem(OAUTH_STATE_KEY);\n    localStorage.removeItem(PKCE_VERIFIER_KEY);\n    localStorage.removeItem(OAUTH_STATE_KEY);\n    if (!verifier || !state) return null;\n    return { verifier, state };\n  },\n};\n","import { pkceChallengeFromVerifier, randomUrlSafeString } from \"./pkce\";\nimport { pkceStorage, tokenStorage } from \"./storage\";\nimport type {\n  CatalogTable,\n  MesyncConfig,\n  MesyncManifest,\n  MesyncManifestResult,\n  Row,\n  RowList,\n  ScopeRequest,\n} from \"./types\";\n\nclass MesyncAuthError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"MesyncAuthError\";\n  }\n}\n\nclass MesyncUniqueIdConflictError extends Error {\n  constructor(\n    public readonly uniqueId: string,\n    public readonly suggestedUniqueId: string | null,\n    message: string\n  ) {\n    super(message);\n    this.name = \"MesyncUniqueIdConflictError\";\n  }\n}\n\nclass MesyncManifestDivergedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"MesyncManifestDivergedError\";\n  }\n}\n\nlet config: MesyncConfig | null = null;\n\nfunction requireConfig(): MesyncConfig {\n  if (!config) {\n    throw new Error(\"mesync.configure(...) must be called before using the SDK\");\n  }\n  return config;\n}\n\nfunction configure(newConfig: MesyncConfig): void {\n  config = newConfig;\n}\n\nasync function resolveTableDefId(namespace: string, table: string): Promise<number> {\n  const { mesyncUrl } = requireConfig();\n  const resp = await fetch(`${mesyncUrl}/api/catalog/apps/${namespace}/tables`);\n  if (resp.status === 404) {\n    throw new Error(\n      `App '${namespace}' isn't registered in the mesync catalog yet, so '${namespace}.${table}' can't be resolved. ` +\n        `It needs to complete its own connect flow (with its manifest) at least once before other apps can request cross-app access to its tables.`\n    );\n  }\n  if (!resp.ok) {\n    throw new Error(\n      `Could not look up table '${namespace}.${table}' in the mesync catalog (HTTP ${resp.status})`\n    );\n  }\n  const tables: CatalogTable[] = await resp.json();\n  const match = tables.find(t => t.name === table);\n  if (!match) {\n    throw new Error(`Table '${table}' not found under namespace '${namespace}'`);\n  }\n  return match.table_def_id;\n}\n\nfunction isOwnScope(s: ScopeRequest, uniqueId: string | undefined): boolean {\n  return uniqueId !== undefined && s.namespace === uniqueId;\n}\n\n/**\n * Builds the mesync consent-screen URL. Scopes on the connecting app's own\n * `manifest.uniqueId` are sent as name-based `own_scope` entries — deferred,\n * server-side resolution, since that table may not exist yet (a brand-new\n * app) or be mid-migration. Every other scope (\"cross\", reading another\n * app's already-existing table) is still resolved here via the catalog, as\n * that table must already exist for a read to make sense.\n *\n * `manifest`, if given, rides along as an extra query param — mesync's own\n * hosted authorize page (not this SDK) decides whether it needs registering,\n * needs a schema update, or is already in sync, and renders the appropriate\n * screen. This SDK never makes that decision itself.\n */\nasync function buildAuthorizeUrl(scopes: ScopeRequest[], manifest?: MesyncManifest): Promise<string> {\n  const { mesyncUrl, uniqueId, redirectUri } = requireConfig();\n  if (scopes.length === 0) {\n    throw new Error(\"login() requires at least one scope\");\n  }\n\n  const ownScopes = scopes.filter(s => isOwnScope(s, manifest?.uniqueId));\n  const crossScopes = scopes.filter(s => !isOwnScope(s, manifest?.uniqueId));\n\n  const crossEntries = await Promise.all(\n    crossScopes.map(async s => `${await resolveTableDefId(s.namespace, s.table)}:${s.permission}`)\n  );\n\n  const verifier = randomUrlSafeString();\n  const challenge = await pkceChallengeFromVerifier(verifier);\n  const state = randomUrlSafeString(16);\n  pkceStorage.save(verifier, state);\n\n  const query = new URLSearchParams({\n    // Wire-protocol param name per OAuth2 convention — its value is the app's uniqueId.\n    client_id: uniqueId,\n    redirect_uri: redirectUri,\n    code_challenge: challenge,\n    code_challenge_method: \"S256\",\n    state,\n    // The app's own origin, so the platform can link back to it once connected.\n    app_url: window.location.origin,\n  });\n  if (crossEntries.length) {\n    query.set(\"scope\", crossEntries.join(\",\"));\n    if (crossScopes.some(s => s.reason)) {\n      query.set(\"reasons\", crossScopes.map(s => encodeURIComponent(s.reason ?? \"\")).join(\",\"));\n    }\n  }\n  if (ownScopes.length) {\n    query.set(\"own_scope\", ownScopes.map(s => `${s.table}:${s.permission}`).join(\",\"));\n    if (ownScopes.some(s => s.reason)) {\n      query.set(\"own_reasons\", ownScopes.map(s => encodeURIComponent(s.reason ?? \"\")).join(\",\"));\n    }\n  }\n  if (manifest) {\n    query.set(\n      \"manifest\",\n      JSON.stringify({\n        unique_id: manifest.uniqueId,\n        name: manifest.name,\n        description: manifest.description,\n        redirect_uris: manifest.redirectUris,\n        tables: manifest.tables,\n      })\n    );\n  }\n  return `${mesyncUrl}/oauth/authorize?${query.toString()}`;\n}\n\ninterface LoginOptions {\n  /** If given, mesync's own hosted authorize page decides whether\n   * `manifest.uniqueId` needs registering, needs a schema update, or is\n   * already in sync, and shows the right screen — nothing about that\n   * decision happens here. */\n  manifest?: MesyncManifest;\n}\n\n/**\n * Redirect the browser to the mesync consent screen requesting the given scopes.\n * Call this from your \"Connect with mesync\" button's onClick handler.\n */\nasync function login(scopes: ScopeRequest[], options: LoginOptions = {}): Promise<void> {\n  window.location.href = await buildAuthorizeUrl(scopes, options.manifest);\n}\n\n/**\n * Same as login(), but drives the consent screen in a popup window instead of\n * navigating the current page away. Resolves once the popup completes (and\n * closes itself) via handleCallback()'s popup-completion handshake; rejects if\n * the popup is blocked, fails, or is closed before completing.\n *\n * Must be called directly from a user gesture (e.g. a click handler) with no\n * `await` ahead of it — the popup is opened synchronously first, then\n * navigated once the URL is built, so browsers don't treat it as blocked.\n */\nfunction loginPopup(scopes: ScopeRequest[], options: LoginOptions = {}): Promise<void> {\n  const popup = window.open(\"\", \"mesync-connect\", \"width=480,height=640,menubar=no,toolbar=no,status=no\");\n  if (!popup) {\n    return Promise.reject(\n      new MesyncAuthError(\"Popup blocked — allow popups for this site, or use mesync.login() instead.\")\n    );\n  }\n\n  return new Promise((resolve, reject) => {\n    let settled = false;\n\n    function cleanup() {\n      window.removeEventListener(\"message\", handleMessage);\n      clearInterval(closePoll);\n    }\n\n    function handleMessage(e: MessageEvent) {\n      if (e.source !== popup || e.origin !== window.location.origin) return;\n      settled = true;\n      cleanup();\n      if (e.data?.type === \"mesync-connected\") {\n        resolve();\n      } else if (e.data?.type === \"mesync-error\") {\n        reject(new MesyncAuthError(e.data.message ?? \"Could not connect to mesync.\"));\n      }\n    }\n\n    window.addEventListener(\"message\", handleMessage);\n    const closePoll = window.setInterval(() => {\n      if (popup.closed && !settled) {\n        settled = true;\n        cleanup();\n        reject(new MesyncAuthError(\"Connection window was closed before completing.\"));\n      }\n    }, 500);\n\n    buildAuthorizeUrl(scopes, options.manifest)\n      .then(url => {\n        popup.location.href = url;\n      })\n      .catch(err => {\n        if (settled) return;\n        settled = true;\n        cleanup();\n        popup.close();\n        reject(err instanceof Error ? err : new MesyncAuthError(\"Could not connect to mesync.\"));\n      });\n  });\n}\n\nfunction isPopup(): boolean {\n  return !!window.opener && window.opener !== window;\n}\n\nfunction notifyOpenerAndClose(payload: { type: \"mesync-connected\" } | { type: \"mesync-error\"; message: string }) {\n  window.opener.postMessage(payload, window.location.origin);\n  window.close();\n}\n\nasync function exchangeCodeForTokens(): Promise<void> {\n  const { mesyncUrl, uniqueId, redirectUri } = requireConfig();\n  const params = new URLSearchParams(window.location.search);\n\n  const errorParam = params.get(\"error\");\n  if (errorParam) {\n    throw new MesyncAuthError(`mesync authorization was denied: ${errorParam}`);\n  }\n\n  const code = params.get(\"code\");\n  const returnedState = params.get(\"state\");\n  if (!code || !returnedState) {\n    throw new MesyncAuthError(\"Missing code/state in callback URL\");\n  }\n\n  const saved = pkceStorage.consume();\n  if (!saved || saved.state !== returnedState) {\n    throw new MesyncAuthError(\"OAuth state mismatch — possible CSRF, aborting\");\n  }\n\n  const resp = await fetch(`${mesyncUrl}/api/oauth/token`, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify({\n      grant_type: \"authorization_code\",\n      code,\n      redirect_uri: redirectUri,\n      code_verifier: saved.verifier,\n      client_id: uniqueId,\n    }),\n  });\n  if (!resp.ok) {\n    throw new MesyncAuthError(`Token exchange failed: ${await resp.text()}`);\n  }\n  const tokens = await resp.json();\n  tokenStorage.setTokens(tokens.access_token, tokens.refresh_token);\n}\n\n// Keyed by the `code` query param so a duplicate handleCallback() call for the\n// same callback (e.g. React 18 StrictMode's dev-only mount/unmount/remount of\n// <mesync-callback>) awaits the original exchange instead of re-consuming the\n// already-spent PKCE verifier/state and failing with a false CSRF error.\nlet inFlightCallback: { code: string; promise: Promise<void> } | null = null;\n\n/**\n * Call this on your redirect_uri page after the user approves (or denies) the\n * consent screen. Exchanges the authorization code for tokens and stores them.\n *\n * If this page is running inside a popup opened by loginPopup(), it instead\n * reports success/failure back to the opener via postMessage and closes\n * itself — the opener's loginPopup() promise settles from that message.\n */\nfunction handleCallback(): Promise<void> {\n  const code = new URLSearchParams(window.location.search).get(\"code\");\n  if (code && inFlightCallback?.code === code) {\n    return inFlightCallback.promise;\n  }\n\n  const promise = (async () => {\n    try {\n      await exchangeCodeForTokens();\n    } catch (err) {\n      if (isPopup()) {\n        const message = err instanceof Error ? err.message : \"Could not connect to mesync.\";\n        notifyOpenerAndClose({ type: \"mesync-error\", message });\n        return;\n      }\n      throw err;\n    }\n    if (isPopup()) {\n      notifyOpenerAndClose({ type: \"mesync-connected\" });\n    }\n  })();\n\n  if (code) inFlightCallback = { code, promise };\n  return promise;\n}\n\n// Refresh tokens rotate on every use — a second concurrent call (e.g. two\n// authedFetch calls 401ing at once) would race to redeem the same refresh\n// token, and the loser would be treated as a stolen/reused token by the\n// server. Dedup concurrent calls into a single in-flight exchange so only\n// one redemption ever happens at a time, mirroring inFlightCallback above.\nlet inFlightRefresh: Promise<string> | null = null;\n\nasync function refreshAccessToken(): Promise<string> {\n  if (inFlightRefresh) return inFlightRefresh;\n\n  const { mesyncUrl } = requireConfig();\n  const refreshToken = tokenStorage.getRefreshToken();\n  if (!refreshToken) throw new MesyncAuthError(\"Not logged in\");\n\n  inFlightRefresh = (async () => {\n    const resp = await fetch(`${mesyncUrl}/api/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ grant_type: \"refresh_token\", refresh_token: refreshToken }),\n    });\n    if (!resp.ok) {\n      tokenStorage.clear();\n      throw new MesyncAuthError(\"Session expired — call mesync.login(...) again\");\n    }\n    const tokens = await resp.json();\n    tokenStorage.setTokens(tokens.access_token, tokens.refresh_token);\n    return tokens.access_token;\n  })();\n\n  try {\n    return await inFlightRefresh;\n  } finally {\n    inFlightRefresh = null;\n  }\n}\n\nasync function authedFetch(path: string, init: RequestInit = {}): Promise<Response> {\n  const { mesyncUrl } = requireConfig();\n  let accessToken = tokenStorage.getAccessToken();\n  if (!accessToken) throw new MesyncAuthError(\"Not logged in — call mesync.login(...) first\");\n\n  const doFetch = (token: string) =>\n    fetch(`${mesyncUrl}${path}`, {\n      ...init,\n      headers: { \"Content-Type\": \"application/json\", Authorization: `Bearer ${token}`, ...init.headers },\n    });\n\n  let resp = await doFetch(accessToken);\n  if (resp.status === 401) {\n    accessToken = await refreshAccessToken();\n    resp = await doFetch(accessToken);\n  }\n  return resp;\n}\n\nasync function asJson<T>(resp: Response): Promise<T> {\n  if (!resp.ok) throw new Error(`mesync request failed (${resp.status}): ${await resp.text()}`);\n  if (resp.status === 204) return undefined as T;\n  return resp.json() as Promise<T>;\n}\n\n/** A handle for reading/writing a single mesync-hosted table. */\nfunction table(namespace: string, name: string) {\n  const path = `/api/store/${namespace}/${name}`;\n  return {\n    async list(page = 1, pageSize = 20): Promise<RowList> {\n      return asJson<RowList>(await authedFetch(`${path}?page=${page}&page_size=${pageSize}`));\n    },\n    async get(rowId: number): Promise<Row> {\n      return asJson<Row>(await authedFetch(`${path}/${rowId}`));\n    },\n    async insert(data: Record<string, unknown>): Promise<Row> {\n      return asJson<Row>(await authedFetch(path, { method: \"POST\", body: JSON.stringify(data) }));\n    },\n    async update(rowId: number, data: Record<string, unknown>): Promise<Row> {\n      return asJson<Row>(await authedFetch(`${path}/${rowId}`, { method: \"PATCH\", body: JSON.stringify(data) }));\n    },\n    async remove(rowId: number): Promise<void> {\n      return asJson<void>(await authedFetch(`${path}/${rowId}`, { method: \"DELETE\" }));\n    },\n  };\n}\n\nfunction isLoggedIn(): boolean {\n  return tokenStorage.getAccessToken() !== null;\n}\n\nfunction logout(): void {\n  tokenStorage.clear();\n}\n\n/**\n * Direct, scriptable registration call — for CI/setup scripts, not the\n * interactive connect flow (that's handled entirely by mesync's own hosted\n * authorize page now; see `login`/`loginPopup`'s `manifest` option). Takes\n * a bearer token the caller already obtained however they like (e.g. their\n * own `POST /api/auth/login` call) — this function does no credential\n * management of its own.\n *\n * Safe to call any number of times: a new `uniqueId` creates the app; the\n * same owner resubmitting diffs tables and applies only safe schema changes\n * (new tables/columns, safe retypes); a `uniqueId` already owned by someone\n * else throws MesyncUniqueIdConflictError; a manifest that shares no tables\n * at all with what's already registered under your own `uniqueId` throws\n * MesyncManifestDivergedError unless `force: true` is passed.\n */\nasync function registerManifest(\n  manifest: MesyncManifest,\n  token: string,\n  options: { force?: boolean } = {}\n): Promise<MesyncManifestResult> {\n  const { mesyncUrl } = requireConfig();\n\n  const resp = await fetch(`${mesyncUrl}/api/apps/manifest`, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\", Authorization: `Bearer ${token}` },\n    body: JSON.stringify({\n      unique_id: manifest.uniqueId,\n      name: manifest.name,\n      description: manifest.description,\n      redirect_uris: manifest.redirectUris,\n      tables: manifest.tables,\n      force: options.force ?? false,\n    }),\n  });\n\n  if (resp.status === 409) {\n    const body = await resp.json();\n    const detail = body.detail ?? {};\n    if (detail.error === \"diverged\") {\n      throw new MesyncManifestDivergedError(detail.message ?? \"This manifest doesn't match what's registered.\");\n    }\n    throw new MesyncUniqueIdConflictError(\n      manifest.uniqueId,\n      detail.suggested_unique_id ?? null,\n      detail.message ?? `unique_id ${manifest.uniqueId} is already taken`\n    );\n  }\n  if (!resp.ok) {\n    throw new Error(`registerManifest failed: ${resp.status} ${await resp.text()}`);\n  }\n\n  const result = await resp.json();\n  return { status: result.status, migrationsApplied: result.migrations_applied ?? {} };\n}\n\nexport const mesync = {\n  configure,\n  login,\n  loginPopup,\n  handleCallback,\n  table,\n  isLoggedIn,\n  logout,\n  registerManifest,\n};\n\nexport { MesyncAuthError, MesyncUniqueIdConflictError, MesyncManifestDivergedError };\nexport type { MesyncConfig, ScopeRequest, Row, RowList };\n"],"mappings":";AAAA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,oBAAoB,aAAa,IAAY;AAC3D,QAAM,QAAQ,IAAI,WAAW,UAAU;AACvC,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,0BAA0B,UAAmC;AACjF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC9C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;;;AChBA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AAEjB,IAAM,eAAe;AAAA,EAC1B,gBAAgB,MAAqB,aAAa,QAAQ,gBAAgB;AAAA,EAC1E,iBAAiB,MAAqB,aAAa,QAAQ,iBAAiB;AAAA,EAC5E,UAAU,aAAqB,cAA4B;AACzD,iBAAa,QAAQ,kBAAkB,WAAW;AAClD,iBAAa,QAAQ,mBAAmB,YAAY;AAAA,EACtD;AAAA,EACA,QAAc;AACZ,iBAAa,WAAW,gBAAgB;AACxC,iBAAa,WAAW,iBAAiB;AAAA,EAC3C;AACF;AASO,IAAM,cAAc;AAAA,EACzB,KAAK,UAAkB,OAAqB;AAC1C,iBAAa,QAAQ,mBAAmB,QAAQ;AAChD,iBAAa,QAAQ,iBAAiB,KAAK;AAAA,EAC7C;AAAA,EACA,UAAsD;AACpD,UAAM,WAAW,aAAa,QAAQ,iBAAiB;AACvD,UAAM,QAAQ,aAAa,QAAQ,eAAe;AAClD,iBAAa,WAAW,iBAAiB;AACzC,iBAAa,WAAW,eAAe;AACvC,QAAI,CAAC,YAAY,CAAC,MAAO,QAAO;AAChC,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACF;;;AC1BA,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC9C,YACkB,UACA,mBAChB,SACA;AACA,UAAM,OAAO;AAJG;AACA;AAIhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAMpB;AAEA,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC9C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAI,SAA8B;AAElC,SAAS,gBAA8B;AACrC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,UAAU,WAA+B;AAChD,WAAS;AACX;AAEA,eAAe,kBAAkB,WAAmBA,QAAgC;AAClF,QAAM,EAAE,UAAU,IAAI,cAAc;AACpC,QAAM,OAAO,MAAM,MAAM,GAAG,SAAS,qBAAqB,SAAS,SAAS;AAC5E,MAAI,KAAK,WAAW,KAAK;AACvB,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,qDAAqD,SAAS,IAAIA,MAAK;AAAA,IAE1F;AAAA,EACF;AACA,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,IAAI;AAAA,MACR,4BAA4B,SAAS,IAAIA,MAAK,iCAAiC,KAAK,MAAM;AAAA,IAC5F;AAAA,EACF;AACA,QAAM,SAAyB,MAAM,KAAK,KAAK;AAC/C,QAAM,QAAQ,OAAO,KAAK,OAAK,EAAE,SAASA,MAAK;AAC/C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,UAAUA,MAAK,gCAAgC,SAAS,GAAG;AAAA,EAC7E;AACA,SAAO,MAAM;AACf;AAEA,SAAS,WAAW,GAAiB,UAAuC;AAC1E,SAAO,aAAa,UAAa,EAAE,cAAc;AACnD;AAeA,eAAe,kBAAkB,QAAwB,UAA4C;AACnG,QAAM,EAAE,WAAW,UAAU,YAAY,IAAI,cAAc;AAC3D,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,QAAM,YAAY,OAAO,OAAO,OAAK,WAAW,GAAG,UAAU,QAAQ,CAAC;AACtE,QAAM,cAAc,OAAO,OAAO,OAAK,CAAC,WAAW,GAAG,UAAU,QAAQ,CAAC;AAEzE,QAAM,eAAe,MAAM,QAAQ;AAAA,IACjC,YAAY,IAAI,OAAM,MAAK,GAAG,MAAM,kBAAkB,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE;AAAA,EAC/F;AAEA,QAAM,WAAW,oBAAoB;AACrC,QAAM,YAAY,MAAM,0BAA0B,QAAQ;AAC1D,QAAM,QAAQ,oBAAoB,EAAE;AACpC,cAAY,KAAK,UAAU,KAAK;AAEhC,QAAM,QAAQ,IAAI,gBAAgB;AAAA;AAAA,IAEhC,WAAW;AAAA,IACX,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,uBAAuB;AAAA,IACvB;AAAA;AAAA,IAEA,SAAS,OAAO,SAAS;AAAA,EAC3B,CAAC;AACD,MAAI,aAAa,QAAQ;AACvB,UAAM,IAAI,SAAS,aAAa,KAAK,GAAG,CAAC;AACzC,QAAI,YAAY,KAAK,OAAK,EAAE,MAAM,GAAG;AACnC,YAAM,IAAI,WAAW,YAAY,IAAI,OAAK,mBAAmB,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,IACzF;AAAA,EACF;AACA,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,aAAa,UAAU,IAAI,OAAK,GAAG,EAAE,KAAK,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,GAAG,CAAC;AACjF,QAAI,UAAU,KAAK,OAAK,EAAE,MAAM,GAAG;AACjC,YAAM,IAAI,eAAe,UAAU,IAAI,OAAK,mBAAmB,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,IAC3F;AAAA,EACF;AACA,MAAI,UAAU;AACZ,UAAM;AAAA,MACJ;AAAA,MACA,KAAK,UAAU;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,MAAM,SAAS;AAAA,QACf,aAAa,SAAS;AAAA,QACtB,eAAe,SAAS;AAAA,QACxB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,GAAG,SAAS,oBAAoB,MAAM,SAAS,CAAC;AACzD;AAcA,eAAe,MAAM,QAAwB,UAAwB,CAAC,GAAkB;AACtF,SAAO,SAAS,OAAO,MAAM,kBAAkB,QAAQ,QAAQ,QAAQ;AACzE;AAYA,SAAS,WAAW,QAAwB,UAAwB,CAAC,GAAkB;AACrF,QAAM,QAAQ,OAAO,KAAK,IAAI,kBAAkB,sDAAsD;AACtG,MAAI,CAAC,OAAO;AACV,WAAO,QAAQ;AAAA,MACb,IAAI,gBAAgB,iFAA4E;AAAA,IAClG;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,UAAU;AAEd,aAAS,UAAU;AACjB,aAAO,oBAAoB,WAAW,aAAa;AACnD,oBAAc,SAAS;AAAA,IACzB;AAEA,aAAS,cAAc,GAAiB;AACtC,UAAI,EAAE,WAAW,SAAS,EAAE,WAAW,OAAO,SAAS,OAAQ;AAC/D,gBAAU;AACV,cAAQ;AACR,UAAI,EAAE,MAAM,SAAS,oBAAoB;AACvC,gBAAQ;AAAA,MACV,WAAW,EAAE,MAAM,SAAS,gBAAgB;AAC1C,eAAO,IAAI,gBAAgB,EAAE,KAAK,WAAW,8BAA8B,CAAC;AAAA,MAC9E;AAAA,IACF;AAEA,WAAO,iBAAiB,WAAW,aAAa;AAChD,UAAM,YAAY,OAAO,YAAY,MAAM;AACzC,UAAI,MAAM,UAAU,CAAC,SAAS;AAC5B,kBAAU;AACV,gBAAQ;AACR,eAAO,IAAI,gBAAgB,iDAAiD,CAAC;AAAA,MAC/E;AAAA,IACF,GAAG,GAAG;AAEN,sBAAkB,QAAQ,QAAQ,QAAQ,EACvC,KAAK,SAAO;AACX,YAAM,SAAS,OAAO;AAAA,IACxB,CAAC,EACA,MAAM,SAAO;AACZ,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,YAAM,MAAM;AACZ,aAAO,eAAe,QAAQ,MAAM,IAAI,gBAAgB,8BAA8B,CAAC;AAAA,IACzF,CAAC;AAAA,EACL,CAAC;AACH;AAEA,SAAS,UAAmB;AAC1B,SAAO,CAAC,CAAC,OAAO,UAAU,OAAO,WAAW;AAC9C;AAEA,SAAS,qBAAqB,SAAmF;AAC/G,SAAO,OAAO,YAAY,SAAS,OAAO,SAAS,MAAM;AACzD,SAAO,MAAM;AACf;AAEA,eAAe,wBAAuC;AACpD,QAAM,EAAE,WAAW,UAAU,YAAY,IAAI,cAAc;AAC3D,QAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AAEzD,QAAM,aAAa,OAAO,IAAI,OAAO;AACrC,MAAI,YAAY;AACd,UAAM,IAAI,gBAAgB,oCAAoC,UAAU,EAAE;AAAA,EAC5E;AAEA,QAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,QAAM,gBAAgB,OAAO,IAAI,OAAO;AACxC,MAAI,CAAC,QAAQ,CAAC,eAAe;AAC3B,UAAM,IAAI,gBAAgB,oCAAoC;AAAA,EAChE;AAEA,QAAM,QAAQ,YAAY,QAAQ;AAClC,MAAI,CAAC,SAAS,MAAM,UAAU,eAAe;AAC3C,UAAM,IAAI,gBAAgB,qDAAgD;AAAA,EAC5E;AAEA,QAAM,OAAO,MAAM,MAAM,GAAG,SAAS,oBAAoB;AAAA,IACvD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,YAAY;AAAA,MACZ;AAAA,MACA,cAAc;AAAA,MACd,eAAe,MAAM;AAAA,MACrB,WAAW;AAAA,IACb,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,IAAI,gBAAgB,0BAA0B,MAAM,KAAK,KAAK,CAAC,EAAE;AAAA,EACzE;AACA,QAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,eAAa,UAAU,OAAO,cAAc,OAAO,aAAa;AAClE;AAMA,IAAI,mBAAoE;AAUxE,SAAS,iBAAgC;AACvC,QAAM,OAAO,IAAI,gBAAgB,OAAO,SAAS,MAAM,EAAE,IAAI,MAAM;AACnE,MAAI,QAAQ,kBAAkB,SAAS,MAAM;AAC3C,WAAO,iBAAiB;AAAA,EAC1B;AAEA,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,YAAM,sBAAsB;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,QAAQ,GAAG;AACb,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,6BAAqB,EAAE,MAAM,gBAAgB,QAAQ,CAAC;AACtD;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,QAAQ,GAAG;AACb,2BAAqB,EAAE,MAAM,mBAAmB,CAAC;AAAA,IACnD;AAAA,EACF,GAAG;AAEH,MAAI,KAAM,oBAAmB,EAAE,MAAM,QAAQ;AAC7C,SAAO;AACT;AAOA,IAAI,kBAA0C;AAE9C,eAAe,qBAAsC;AACnD,MAAI,gBAAiB,QAAO;AAE5B,QAAM,EAAE,UAAU,IAAI,cAAc;AACpC,QAAM,eAAe,aAAa,gBAAgB;AAClD,MAAI,CAAC,aAAc,OAAM,IAAI,gBAAgB,eAAe;AAE5D,qBAAmB,YAAY;AAC7B,UAAM,OAAO,MAAM,MAAM,GAAG,SAAS,oBAAoB;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,YAAY,iBAAiB,eAAe,aAAa,CAAC;AAAA,IACnF,CAAC;AACD,QAAI,CAAC,KAAK,IAAI;AACZ,mBAAa,MAAM;AACnB,YAAM,IAAI,gBAAgB,qDAAgD;AAAA,IAC5E;AACA,UAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,iBAAa,UAAU,OAAO,cAAc,OAAO,aAAa;AAChE,WAAO,OAAO;AAAA,EAChB,GAAG;AAEH,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,sBAAkB;AAAA,EACpB;AACF;AAEA,eAAe,YAAY,MAAc,OAAoB,CAAC,GAAsB;AAClF,QAAM,EAAE,UAAU,IAAI,cAAc;AACpC,MAAI,cAAc,aAAa,eAAe;AAC9C,MAAI,CAAC,YAAa,OAAM,IAAI,gBAAgB,mDAA8C;AAE1F,QAAM,UAAU,CAAC,UACf,MAAM,GAAG,SAAS,GAAG,IAAI,IAAI;AAAA,IAC3B,GAAG;AAAA,IACH,SAAS,EAAE,gBAAgB,oBAAoB,eAAe,UAAU,KAAK,IAAI,GAAG,KAAK,QAAQ;AAAA,EACnG,CAAC;AAEH,MAAI,OAAO,MAAM,QAAQ,WAAW;AACpC,MAAI,KAAK,WAAW,KAAK;AACvB,kBAAc,MAAM,mBAAmB;AACvC,WAAO,MAAM,QAAQ,WAAW;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAe,OAAU,MAA4B;AACnD,MAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,0BAA0B,KAAK,MAAM,MAAM,MAAM,KAAK,KAAK,CAAC,EAAE;AAC5F,MAAI,KAAK,WAAW,IAAK,QAAO;AAChC,SAAO,KAAK,KAAK;AACnB;AAGA,SAAS,MAAM,WAAmB,MAAc;AAC9C,QAAM,OAAO,cAAc,SAAS,IAAI,IAAI;AAC5C,SAAO;AAAA,IACL,MAAM,KAAK,OAAO,GAAG,WAAW,IAAsB;AACpD,aAAO,OAAgB,MAAM,YAAY,GAAG,IAAI,SAAS,IAAI,cAAc,QAAQ,EAAE,CAAC;AAAA,IACxF;AAAA,IACA,MAAM,IAAI,OAA6B;AACrC,aAAO,OAAY,MAAM,YAAY,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;AAAA,IAC1D;AAAA,IACA,MAAM,OAAO,MAA6C;AACxD,aAAO,OAAY,MAAM,YAAY,MAAM,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;AAAA,IAC5F;AAAA,IACA,MAAM,OAAO,OAAe,MAA6C;AACvE,aAAO,OAAY,MAAM,YAAY,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,SAAS,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;AAAA,IAC3G;AAAA,IACA,MAAM,OAAO,OAA8B;AACzC,aAAO,OAAa,MAAM,YAAY,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,SAAS,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,SAAS,aAAsB;AAC7B,SAAO,aAAa,eAAe,MAAM;AAC3C;AAEA,SAAS,SAAe;AACtB,eAAa,MAAM;AACrB;AAiBA,eAAe,iBACb,UACA,OACA,UAA+B,CAAC,GACD;AAC/B,QAAM,EAAE,UAAU,IAAI,cAAc;AAEpC,QAAM,OAAO,MAAM,MAAM,GAAG,SAAS,sBAAsB;AAAA,IACzD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oBAAoB,eAAe,UAAU,KAAK,GAAG;AAAA,IAChF,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW,SAAS;AAAA,MACpB,MAAM,SAAS;AAAA,MACf,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,MACxB,QAAQ,SAAS;AAAA,MACjB,OAAO,QAAQ,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH,CAAC;AAED,MAAI,KAAK,WAAW,KAAK;AACvB,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,QAAI,OAAO,UAAU,YAAY;AAC/B,YAAM,IAAI,4BAA4B,OAAO,WAAW,gDAAgD;AAAA,IAC1G;AACA,UAAM,IAAI;AAAA,MACR,SAAS;AAAA,MACT,OAAO,uBAAuB;AAAA,MAC9B,OAAO,WAAW,aAAa,SAAS,QAAQ;AAAA,IAClD;AAAA,EACF;AACA,MAAI,CAAC,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,4BAA4B,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,SAAO,EAAE,QAAQ,OAAO,QAAQ,mBAAmB,OAAO,sBAAsB,CAAC,EAAE;AACrF;AAEO,IAAM,SAAS;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":["table"]}

package/dist/elements/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Prebuilt "Connect with mesync" button. Framework-agnostic (plain custom
+ * element) so it can drop into React/Vue/Svelte/etc without a framework-
+ * specific SDK build. Usage:
+ *
+ *   <mesync-connect scopes='[{"namespace":"move","table":"logs","permission":"write"}]'></mesync-connect>
+ *
+ * By default (mode="redirect", or omitted) this navigates the whole page to
+ * the consent screen, so completion is observed on the redirect_uri page via
+ * <mesync-callback> instead of here. Set mode="popup" to instead drive the
+ * consent screen in a popup window and get a "mesync-connected" event on
+ * this element once it completes, with no page navigation.
+ *
+ * Pass a `manifest` attribute (JSON, same shape as defineManifest()'s
+ * argument) to fold app registration into this same button — it's just
+ * forwarded along to mesync's own hosted consent screen, which checks
+ * whether `manifest.uniqueId` needs registering, needs a schema update, or
+ * is already in sync, and shows the right screen there (including, on the
+ * very first-ever connect, a real login page hosted on mesync's own origin —
+ * never a form rendered by this element or by your app). This element makes
+ * no registration decisions itself.
+ *
+ * Renders `label`/`connected-label` as plain text by default, but any light-DOM
+ * children take over instead — e.g. drop in an icon or custom markup:
+ *
+ *   <mesync-connect scopes='...'><img src="/icon.svg" alt="Connect"></mesync-connect>
+ *
+ * The host toggles `connecting`/`connected` boolean attributes so custom
+ * content can react via CSS (e.g. `mesync-connect[connecting] img { opacity: .5 }`).
+ * Styling hooks: `::part(button)`, `::part(error)`, and the CSS custom
+ * properties --mesync-bg, --mesync-color, --mesync-radius, --mesync-error-color.
+ *
+ * Emits "mesync-error" if the connection fails (scope resolution before the
+ * redirect, a blocked/closed popup, or a rejected popup flow).
+ */
+declare class MesyncConnectElement extends HTMLElement {
+    #private;
+    static get observedAttributes(): string[];
+    constructor();
+    connectedCallback(): void;
+    attributeChangedCallback(): void;
+}
+
+/**
+ * Drop-in replacement for the redirect_uri page's callback handler. Calls
+ * mesync.handleCallback() on mount, then either redirects (default: back to
+ * "/") or emits "mesync-connected" for the host app to handle itself.
+ *
+ *   <mesync-callback redirect-to="./"></mesync-callback>
+ *
+ * Set redirect-to="" (empty) to suppress the redirect and just listen for
+ * "mesync-connected" / "mesync-error" instead.
+ */
+declare class MesyncCallbackElement extends HTMLElement {
+    #private;
+    constructor();
+    connectedCallback(): void;
+}
+
+export { MesyncCallbackElement, MesyncConnectElement };

package/dist/elements/index.js

@@ -0,0 +1,10 @@
+import {
+  MesyncCallbackElement,
+  MesyncConnectElement
+} from "../chunk-E3FGRAPR.js";
+import "../chunk-YPMJ6DJU.js";
+export {
+  MesyncCallbackElement,
+  MesyncConnectElement
+};
+//# sourceMappingURL=index.js.map

package/dist/elements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/elements/react.d.ts

@@ -0,0 +1,54 @@
+import { ReactElement } from 'react';
+import { S as ScopeRequest, M as MesyncManifest } from '../types-CRSr6Kwh.js';
+
+interface MesyncConnectProps {
+    scopes: ScopeRequest[];
+    label?: string;
+    connectedLabel?: string;
+    /** "redirect" (default) navigates the page to the consent screen; "popup" drives it in a popup window and fires onConnected in place, with no navigation. */
+    mode?: "redirect" | "popup";
+    /** If given, this button also folds in app registration — mesync's own
+     * hosted consent screen checks whether `manifest.uniqueId` needs
+     * registering, needs a schema update, or is already in sync, and shows
+     * the right screen there. Nothing about that decision happens here. */
+    manifest?: MesyncManifest;
+    /** Only fires in mode="popup" — the redirect flow completes on the redirect_uri page instead, via <MesyncCallback>. */
+    onConnected?: () => void;
+    /** Fires if resolving scopes / redirecting to the consent screen fails (or, in popup mode, if the popup is blocked, closed, or fails). */
+    onError?: (message: string) => void;
+}
+/** React wrapper around the framework-agnostic <mesync-connect> custom element. */
+declare function MesyncConnect({ scopes, label, connectedLabel, mode, manifest, onConnected, onError, }: MesyncConnectProps): ReactElement;
+interface MesyncCallbackProps {
+    /** Where to send the browser after a successful connection. Defaults to "./"; pass "" to disable and rely on onConnected instead. */
+    redirectTo?: string;
+    onConnected?: () => void;
+    onError?: (message: string) => void;
+}
+/** React wrapper around the framework-agnostic <mesync-callback> custom element. */
+declare function MesyncCallback({ redirectTo, onConnected, onError }: MesyncCallbackProps): ReactElement;
+interface UseMesyncConnectOptions {
+    /** "redirect" (default) navigates the page away; "popup" drives the consent screen in a popup and resolves in place. */
+    mode?: "redirect" | "popup";
+    /** Same registration-folding behavior as <MesyncConnect>'s `manifest` prop — see there for details. */
+    manifest?: MesyncManifest;
+}
+interface UseMesyncConnectResult {
+    /** Call from any onClick — an icon button, a menu item, whatever markup you want. */
+    connect: () => void;
+    connecting: boolean;
+    /** Message from the last failed attempt, if any. Cleared on the next connect() call. */
+    error: string | null;
+    isLoggedIn: boolean;
+}
+/**
+ * Headless alternative to <MesyncConnect> for when you don't want the
+ * built-in button markup — render an icon, a custom component, anything —
+ * and wire it up yourself:
+ *
+ *   const { connect, connecting, isLoggedIn } = useMesyncConnect(scopes);
+ *   <IconButton icon={<PlugIcon />} disabled={connecting || isLoggedIn} onClick={connect} />
+ */
+declare function useMesyncConnect(scopes: ScopeRequest[], { mode, manifest }?: UseMesyncConnectOptions): UseMesyncConnectResult;
+
+export { MesyncCallback, type MesyncCallbackProps, MesyncConnect, type MesyncConnectProps, type UseMesyncConnectOptions, type UseMesyncConnectResult, useMesyncConnect };

package/dist/elements/react.js

@@ -0,0 +1,72 @@
+import "../chunk-E3FGRAPR.js";
+import {
+  mesync
+} from "../chunk-YPMJ6DJU.js";
+
+// src/elements/react.tsx
+import { createElement, useCallback, useEffect, useRef, useState } from "react";
+function useErrorEvent(ref, onError) {
+  useEffect(() => {
+    const el = ref.current;
+    if (!el || !onError) return;
+    const listener = (e) => onError(e.detail);
+    el.addEventListener("mesync-error", listener);
+    return () => el.removeEventListener("mesync-error", listener);
+  }, [onError]);
+}
+function useConnectedEvent(ref, onConnected) {
+  useEffect(() => {
+    const el = ref.current;
+    if (!el || !onConnected) return;
+    el.addEventListener("mesync-connected", onConnected);
+    return () => el.removeEventListener("mesync-connected", onConnected);
+  }, [onConnected]);
+}
+function MesyncConnect({
+  scopes,
+  label,
+  connectedLabel,
+  mode,
+  manifest,
+  onConnected,
+  onError
+}) {
+  const ref = useRef(null);
+  useConnectedEvent(ref, onConnected);
+  useErrorEvent(ref, onError);
+  return createElement("mesync-connect", {
+    ref,
+    scopes: JSON.stringify(scopes),
+    label,
+    "connected-label": connectedLabel,
+    mode,
+    manifest: manifest ? JSON.stringify(manifest) : void 0
+  });
+}
+function MesyncCallback({ redirectTo, onConnected, onError }) {
+  const ref = useRef(null);
+  useConnectedEvent(ref, onConnected);
+  useErrorEvent(ref, onError);
+  return createElement("mesync-callback", { ref, "redirect-to": redirectTo });
+}
+function useMesyncConnect(scopes, { mode = "redirect", manifest } = {}) {
+  const [connecting, setConnecting] = useState(false);
+  const [error, setError] = useState(null);
+  const [isLoggedIn, setIsLoggedIn] = useState(() => mesync.isLoggedIn());
+  const connect = useCallback(() => {
+    setError(null);
+    setConnecting(true);
+    const options = manifest ? { manifest } : void 0;
+    const promise = mode === "popup" ? mesync.loginPopup(scopes, options) : mesync.login(scopes, options);
+    void promise.then(() => setIsLoggedIn(true)).catch((err) => {
+      setError(err instanceof Error ? err.message : "Could not connect to mesync.");
+    }).finally(() => setConnecting(false));
+  }, [scopes, mode, manifest]);
+  return { connect, connecting, error, isLoggedIn };
+}
+export {
+  MesyncCallback,
+  MesyncConnect,
+  useMesyncConnect
+};
+//# sourceMappingURL=react.js.map

package/dist/elements/react.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/elements/react.tsx"],"sourcesContent":["import { createElement, useCallback, useEffect, useRef, useState, type ReactElement } from \"react\";\nimport \"./connect-element\";\nimport \"./callback-element\";\nimport { mesync } from \"../client\";\nimport type { MesyncManifest, ScopeRequest } from \"../types\";\n\nfunction useErrorEvent(ref: React.RefObject<HTMLElement | null>, onError?: (message: string) => void) {\n  useEffect(() => {\n    const el = ref.current;\n    if (!el || !onError) return;\n    const listener = (e: Event) => onError((e as CustomEvent<string>).detail);\n    el.addEventListener(\"mesync-error\", listener);\n    return () => el.removeEventListener(\"mesync-error\", listener);\n  }, [onError]);\n}\n\nfunction useConnectedEvent(ref: React.RefObject<HTMLElement | null>, onConnected?: () => void) {\n  useEffect(() => {\n    const el = ref.current;\n    if (!el || !onConnected) return;\n    el.addEventListener(\"mesync-connected\", onConnected);\n    return () => el.removeEventListener(\"mesync-connected\", onConnected);\n  }, [onConnected]);\n}\n\nexport interface MesyncConnectProps {\n  scopes: ScopeRequest[];\n  label?: string;\n  connectedLabel?: string;\n  /** \"redirect\" (default) navigates the page to the consent screen; \"popup\" drives it in a popup window and fires onConnected in place, with no navigation. */\n  mode?: \"redirect\" | \"popup\";\n  /** If given, this button also folds in app registration — mesync's own\n   * hosted consent screen checks whether `manifest.uniqueId` needs\n   * registering, needs a schema update, or is already in sync, and shows\n   * the right screen there. Nothing about that decision happens here. */\n  manifest?: MesyncManifest;\n  /** Only fires in mode=\"popup\" — the redirect flow completes on the redirect_uri page instead, via <MesyncCallback>. */\n  onConnected?: () => void;\n  /** Fires if resolving scopes / redirecting to the consent screen fails (or, in popup mode, if the popup is blocked, closed, or fails). */\n  onError?: (message: string) => void;\n}\n\n/** React wrapper around the framework-agnostic <mesync-connect> custom element. */\nexport function MesyncConnect({\n  scopes,\n  label,\n  connectedLabel,\n  mode,\n  manifest,\n  onConnected,\n  onError,\n}: MesyncConnectProps): ReactElement {\n  const ref = useRef<HTMLElement | null>(null);\n  useConnectedEvent(ref, onConnected);\n  useErrorEvent(ref, onError);\n\n  return createElement(\"mesync-connect\", {\n    ref,\n    scopes: JSON.stringify(scopes),\n    label,\n    \"connected-label\": connectedLabel,\n    mode,\n    manifest: manifest ? JSON.stringify(manifest) : undefined,\n  });\n}\n\nexport interface MesyncCallbackProps {\n  /** Where to send the browser after a successful connection. Defaults to \"./\"; pass \"\" to disable and rely on onConnected instead. */\n  redirectTo?: string;\n  onConnected?: () => void;\n  onError?: (message: string) => void;\n}\n\n/** React wrapper around the framework-agnostic <mesync-callback> custom element. */\nexport function MesyncCallback({ redirectTo, onConnected, onError }: MesyncCallbackProps): ReactElement {\n  const ref = useRef<HTMLElement | null>(null);\n  useConnectedEvent(ref, onConnected);\n  useErrorEvent(ref, onError);\n\n  return createElement(\"mesync-callback\", { ref, \"redirect-to\": redirectTo });\n}\n\nexport interface UseMesyncConnectOptions {\n  /** \"redirect\" (default) navigates the page away; \"popup\" drives the consent screen in a popup and resolves in place. */\n  mode?: \"redirect\" | \"popup\";\n  /** Same registration-folding behavior as <MesyncConnect>'s `manifest` prop — see there for details. */\n  manifest?: MesyncManifest;\n}\n\nexport interface UseMesyncConnectResult {\n  /** Call from any onClick — an icon button, a menu item, whatever markup you want. */\n  connect: () => void;\n  connecting: boolean;\n  /** Message from the last failed attempt, if any. Cleared on the next connect() call. */\n  error: string | null;\n  isLoggedIn: boolean;\n}\n\n/**\n * Headless alternative to <MesyncConnect> for when you don't want the\n * built-in button markup — render an icon, a custom component, anything —\n * and wire it up yourself:\n *\n *   const { connect, connecting, isLoggedIn } = useMesyncConnect(scopes);\n *   <IconButton icon={<PlugIcon />} disabled={connecting || isLoggedIn} onClick={connect} />\n */\nexport function useMesyncConnect(\n  scopes: ScopeRequest[],\n  { mode = \"redirect\", manifest }: UseMesyncConnectOptions = {}\n): UseMesyncConnectResult {\n  const [connecting, setConnecting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [isLoggedIn, setIsLoggedIn] = useState(() => mesync.isLoggedIn());\n\n  const connect = useCallback(() => {\n    setError(null);\n    setConnecting(true);\n    const options = manifest ? { manifest } : undefined;\n    const promise = mode === \"popup\" ? mesync.loginPopup(scopes, options) : mesync.login(scopes, options);\n    void promise\n      .then(() => setIsLoggedIn(true))\n      .catch((err: unknown) => {\n        setError(err instanceof Error ? err.message : \"Could not connect to mesync.\");\n      })\n      .finally(() => setConnecting(false));\n    // In \"redirect\" mode the browser navigates away before this ever settles.\n  }, [scopes, mode, manifest]);\n\n  return { connect, connecting, error, isLoggedIn };\n}\n"],"mappings":";;;;;;AAAA,SAAS,eAAe,aAAa,WAAW,QAAQ,gBAAmC;AAM3F,SAAS,cAAc,KAA0C,SAAqC;AACpG,YAAU,MAAM;AACd,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,MAAM,CAAC,QAAS;AACrB,UAAM,WAAW,CAAC,MAAa,QAAS,EAA0B,MAAM;AACxE,OAAG,iBAAiB,gBAAgB,QAAQ;AAC5C,WAAO,MAAM,GAAG,oBAAoB,gBAAgB,QAAQ;AAAA,EAC9D,GAAG,CAAC,OAAO,CAAC;AACd;AAEA,SAAS,kBAAkB,KAA0C,aAA0B;AAC7F,YAAU,MAAM;AACd,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,MAAM,CAAC,YAAa;AACzB,OAAG,iBAAiB,oBAAoB,WAAW;AACnD,WAAO,MAAM,GAAG,oBAAoB,oBAAoB,WAAW;AAAA,EACrE,GAAG,CAAC,WAAW,CAAC;AAClB;AAoBO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAqC;AACnC,QAAM,MAAM,OAA2B,IAAI;AAC3C,oBAAkB,KAAK,WAAW;AAClC,gBAAc,KAAK,OAAO;AAE1B,SAAO,cAAc,kBAAkB;AAAA,IACrC;AAAA,IACA,QAAQ,KAAK,UAAU,MAAM;AAAA,IAC7B;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA,UAAU,WAAW,KAAK,UAAU,QAAQ,IAAI;AAAA,EAClD,CAAC;AACH;AAUO,SAAS,eAAe,EAAE,YAAY,aAAa,QAAQ,GAAsC;AACtG,QAAM,MAAM,OAA2B,IAAI;AAC3C,oBAAkB,KAAK,WAAW;AAClC,gBAAc,KAAK,OAAO;AAE1B,SAAO,cAAc,mBAAmB,EAAE,KAAK,eAAe,WAAW,CAAC;AAC5E;AA0BO,SAAS,iBACd,QACA,EAAE,OAAO,YAAY,SAAS,IAA6B,CAAC,GACpC;AACxB,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,MAAM,OAAO,WAAW,CAAC;AAEtE,QAAM,UAAU,YAAY,MAAM;AAChC,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,UAAM,UAAU,WAAW,EAAE,SAAS,IAAI;AAC1C,UAAM,UAAU,SAAS,UAAU,OAAO,WAAW,QAAQ,OAAO,IAAI,OAAO,MAAM,QAAQ,OAAO;AACpG,SAAK,QACF,KAAK,MAAM,cAAc,IAAI,CAAC,EAC9B,MAAM,CAAC,QAAiB;AACvB,eAAS,eAAe,QAAQ,IAAI,UAAU,8BAA8B;AAAA,IAC9E,CAAC,EACA,QAAQ,MAAM,cAAc,KAAK,CAAC;AAAA,EAEvC,GAAG,CAAC,QAAQ,MAAM,QAAQ,CAAC;AAE3B,SAAO,EAAE,SAAS,YAAY,OAAO,WAAW;AAClD;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,93 @@
+import { a as MesyncConfig, S as ScopeRequest, M as MesyncManifest, R as RowList, b as Row, c as MesyncManifestResult } from './types-CRSr6Kwh.js';
+export { d as MesyncColumnType, e as MesyncManifestColumn, f as MesyncManifestTable } from './types-CRSr6Kwh.js';
+
+declare class MesyncAuthError extends Error {
+    constructor(message: string);
+}
+declare class MesyncUniqueIdConflictError extends Error {
+    readonly uniqueId: string;
+    readonly suggestedUniqueId: string | null;
+    constructor(uniqueId: string, suggestedUniqueId: string | null, message: string);
+}
+declare class MesyncManifestDivergedError extends Error {
+    constructor(message: string);
+}
+declare function configure(newConfig: MesyncConfig): void;
+interface LoginOptions {
+    /** If given, mesync's own hosted authorize page decides whether
+     * `manifest.uniqueId` needs registering, needs a schema update, or is
+     * already in sync, and shows the right screen — nothing about that
+     * decision happens here. */
+    manifest?: MesyncManifest;
+}
+/**
+ * Redirect the browser to the mesync consent screen requesting the given scopes.
+ * Call this from your "Connect with mesync" button's onClick handler.
+ */
+declare function login(scopes: ScopeRequest[], options?: LoginOptions): Promise<void>;
+/**
+ * Same as login(), but drives the consent screen in a popup window instead of
+ * navigating the current page away. Resolves once the popup completes (and
+ * closes itself) via handleCallback()'s popup-completion handshake; rejects if
+ * the popup is blocked, fails, or is closed before completing.
+ *
+ * Must be called directly from a user gesture (e.g. a click handler) with no
+ * `await` ahead of it — the popup is opened synchronously first, then
+ * navigated once the URL is built, so browsers don't treat it as blocked.
+ */
+declare function loginPopup(scopes: ScopeRequest[], options?: LoginOptions): Promise<void>;
+/**
+ * Call this on your redirect_uri page after the user approves (or denies) the
+ * consent screen. Exchanges the authorization code for tokens and stores them.
+ *
+ * If this page is running inside a popup opened by loginPopup(), it instead
+ * reports success/failure back to the opener via postMessage and closes
+ * itself — the opener's loginPopup() promise settles from that message.
+ */
+declare function handleCallback(): Promise<void>;
+/** A handle for reading/writing a single mesync-hosted table. */
+declare function table(namespace: string, name: string): {
+    list(page?: number, pageSize?: number): Promise<RowList>;
+    get(rowId: number): Promise<Row>;
+    insert(data: Record<string, unknown>): Promise<Row>;
+    update(rowId: number, data: Record<string, unknown>): Promise<Row>;
+    remove(rowId: number): Promise<void>;
+};
+declare function isLoggedIn(): boolean;
+declare function logout(): void;
+/**
+ * Direct, scriptable registration call — for CI/setup scripts, not the
+ * interactive connect flow (that's handled entirely by mesync's own hosted
+ * authorize page now; see `login`/`loginPopup`'s `manifest` option). Takes
+ * a bearer token the caller already obtained however they like (e.g. their
+ * own `POST /api/auth/login` call) — this function does no credential
+ * management of its own.
+ *
+ * Safe to call any number of times: a new `uniqueId` creates the app; the
+ * same owner resubmitting diffs tables and applies only safe schema changes
+ * (new tables/columns, safe retypes); a `uniqueId` already owned by someone
+ * else throws MesyncUniqueIdConflictError; a manifest that shares no tables
+ * at all with what's already registered under your own `uniqueId` throws
+ * MesyncManifestDivergedError unless `force: true` is passed.
+ */
+declare function registerManifest(manifest: MesyncManifest, token: string, options?: {
+    force?: boolean;
+}): Promise<MesyncManifestResult>;
+declare const mesync: {
+    configure: typeof configure;
+    login: typeof login;
+    loginPopup: typeof loginPopup;
+    handleCallback: typeof handleCallback;
+    table: typeof table;
+    isLoggedIn: typeof isLoggedIn;
+    logout: typeof logout;
+    registerManifest: typeof registerManifest;
+};
+
+/** Identity function — its only purpose is type inference/checking at the call
+ * site without an explicit `: MesyncManifest` annotation (same trick as Vite's
+ * `defineConfig`). No runtime validation happens here; the server is the
+ * source of truth for that. */
+declare function defineManifest(manifest: MesyncManifest): MesyncManifest;
+
+export { MesyncAuthError, MesyncConfig, MesyncManifest, MesyncManifestDivergedError, MesyncManifestResult, MesyncUniqueIdConflictError, Row, RowList, ScopeRequest, defineManifest, mesync };

package/dist/index.js

@@ -0,0 +1,19 @@
+import {
+  MesyncAuthError,
+  MesyncManifestDivergedError,
+  MesyncUniqueIdConflictError,
+  mesync
+} from "./chunk-YPMJ6DJU.js";
+
+// src/defineManifest.ts
+function defineManifest(manifest) {
+  return manifest;
+}
+export {
+  MesyncAuthError,
+  MesyncManifestDivergedError,
+  MesyncUniqueIdConflictError,
+  defineManifest,
+  mesync
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/defineManifest.ts"],"sourcesContent":["import type { MesyncManifest } from \"./types\";\n\n/** Identity function — its only purpose is type inference/checking at the call\n * site without an explicit `: MesyncManifest` annotation (same trick as Vite's\n * `defineConfig`). No runtime validation happens here; the server is the\n * source of truth for that. */\nexport function defineManifest(manifest: MesyncManifest): MesyncManifest {\n  return manifest;\n}\n"],"mappings":";;;;;;;;AAMO,SAAS,eAAe,UAA0C;AACvE,SAAO;AACT;","names":[]}

package/dist/types-CRSr6Kwh.d.ts

@@ -0,0 +1,64 @@
+type Permission = "read" | "write";
+interface ScopeRequest {
+    namespace: string;
+    table: string;
+    permission: Permission;
+    /** Shown to the user on the consent screen, explaining why this app wants this table/permission. */
+    reason?: string;
+}
+interface MesyncConfig {
+    /** Origin the mesync app is deployed at, e.g. "https://mesync.example.com" (no trailing slash).
+     *  Both the consent screen (`/oauth/authorize`) and the API (`/api/...`) are assumed to live here. */
+    mesyncUrl: string;
+    uniqueId: string;
+    /** Must exactly match one of the redirect_uris registered for this app. */
+    redirectUri: string;
+}
+interface Row {
+    id: number;
+    created_at: string;
+    updated_at: string;
+    [key: string]: unknown;
+}
+interface RowList {
+    items: Row[];
+    total: number;
+    page: number;
+    page_size: number;
+    pages: number;
+}
+type MesyncColumnType = "string" | "number" | "boolean" | "timestamp" | "json";
+/** "required implies default" encoded as a discriminated union — a required
+ * column with no default simply fails to typecheck. */
+type MesyncManifestColumn = {
+    name: string;
+    type: MesyncColumnType;
+    required: true;
+    default: unknown;
+} | {
+    name: string;
+    type: MesyncColumnType;
+    required?: false;
+    default?: unknown;
+};
+interface MesyncManifestTable {
+    name: string;
+    description?: string;
+    columns: MesyncManifestColumn[];
+}
+interface MesyncManifest {
+    /** Developer-chosen, stable, globally unique — the sole public identifier
+     * for this app. Immutable once registered; check availability first with
+     * mesync's `GET /api/catalog/unique-id-available`. */
+    uniqueId: string;
+    name: string;
+    description?: string;
+    redirectUris: string[];
+    tables: MesyncManifestTable[];
+}
+interface MesyncManifestResult {
+    status: "created" | "confirmed" | "updated";
+    migrationsApplied: Record<string, number>;
+}
+
+export type { MesyncManifest as M, RowList as R, ScopeRequest as S, MesyncConfig as a, Row as b, MesyncManifestResult as c, MesyncColumnType as d, MesyncManifestColumn as e, MesyncManifestTable as f };

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@mesyncapp/sdk",
+  "version": "0.1.0",
+  "description": "Client library for storing your app's data in the user's personal mesync backend instead of localStorage.",
+  "license": "MIT",
+  "homepage": "https://github.com/senluchen2015/mesync/tree/main/sdk#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/senluchen2015/mesync.git",
+    "directory": "sdk"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./elements": {
+      "types": "./dist/elements/index.d.ts",
+      "import": "./dist/elements/index.js"
+    },
+    "./elements/react": {
+      "types": "./dist/elements/react.d.ts",
+      "import": "./dist/elements/react.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "bunx --bun tsup",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.0",
+    "react": "^19.2.0",
+    "tsup": "^8.3.5",
+    "typescript": "~5.7.0"
+  }
+}