@miosa/sdk 1.2.4 → 1.2.6

package/src/resources/org-invites.ts

@@ -1,189 +0,0 @@
-/**
- * Org Invites — email invite flow for org (tenant) membership.
- *
- * Public endpoints (no auth):
- *   GET  /invites/:token
- *
- * Authenticated endpoints (admin/owner role required for create/list/revoke):
- *   POST   /tenants/:id/invites
- *   GET    /tenants/:id/invites
- *   DELETE /tenants/:id/invites/:invite_id
- *   POST   /invites/:token/accept
- */
-
-import type { HttpClient } from "../http.js";
-
-// ── Resource shapes ──────────────────────────────────────────────────────────
-
-export type OrgRole = "owner" | "admin" | "member";
-
-export interface OrgInvite {
-  id: string;
-  tenant_id: string;
-  email: string;
-  role: OrgRole;
-  invited_by: string | null;
-  expires_at: string;
-  accepted_at: string | null;
-  created_at: string;
-}
-
-export interface OrgInviteCreated {
-  invite_id: string;
-  email: string;
-  role: OrgRole;
-  expires_at: string;
-  /**
-   * Full URL for the invite landing page. On white-label tenants this uses
-   * the tenant's custom domain.
-   */
-  invite_url: string;
-}
-
-export interface OrgInvitePreview {
-  email: string;
-  tenant_name: string;
-  role: OrgRole;
-  expires_at: string;
-  expired: boolean;
-  accepted: boolean;
-}
-
-export interface TenantSummary {
-  id: string;
-  name: string;
-  slug: string;
-  owner_user_id: string | null;
-  plan_id: string | null;
-  plan_name: string | null;
-  settings: Record<string, unknown>;
-  inserted_at: string;
-  updated_at: string;
-}
-
-// ── Request payloads ─────────────────────────────────────────────────────────
-
-export interface CreateOrgInviteParams {
-  email: string;
-  role?: OrgRole;
-}
-
-// ── Response shapes ───────────────────────────────────────────────────────────
-
-export interface OrgInviteCreatedResponse {
-  data: OrgInviteCreated;
-}
-
-export interface OrgInviteListResponse {
-  data: OrgInvite[];
-  total: number;
-}
-
-export interface OrgInviteRevokeResponse {
-  invite_id: string;
-  revoked: boolean;
-}
-
-export interface OrgInvitePreviewResponse {
-  data: OrgInvitePreview;
-}
-
-export interface AcceptOrgInviteResponse {
-  accepted: boolean;
-  tenant_id: string;
-  tenant: TenantSummary | null;
-}
-
-// ── Main resource ─────────────────────────────────────────────────────────────
-
-export class OrgInvites {
-  constructor(private readonly http: HttpClient) {}
-
-  /**
-   * Create an org invite and dispatch the invite email.
-   *
-   * The invite URL in the response is host-aware: on white-label tenants it
-   * uses the custom domain so the recipient lands on the branded experience.
-   * Requires `admin` or `owner` role in the tenant.
-   *
-   * `POST /tenants/:id/invites`
-   */
-  async create(
-    tenantId: string,
-    params: CreateOrgInviteParams,
-  ): Promise<OrgInviteCreated> {
-    const res = await this.http.post<OrgInviteCreatedResponse>(
-      `/tenants/${tenantId}/invites`,
-      params,
-    );
-    return res.data;
-  }
-
-  /**
-   * List all pending (non-expired, non-accepted, non-revoked) org invites.
-   *
-   * Requires `admin` or `owner` role.
-   *
-   * `GET /tenants/:id/invites`
-   */
-  async list(tenantId: string): Promise<OrgInvite[]> {
-    const res = await this.http.get<OrgInviteListResponse>(
-      `/tenants/${tenantId}/invites`,
-    );
-    return res.data ?? [];
-  }
-
-  /**
-   * Revoke a pending org invite.
-   *
-   * Returns `409` when the invite was already legitimately accepted.
-   * Requires `admin` or `owner` role.
-   *
-   * `DELETE /tenants/:id/invites/:invite_id`
-   */
-  async revoke(
-    tenantId: string,
-    inviteId: string,
-  ): Promise<OrgInviteRevokeResponse> {
-    return this.http.delete<OrgInviteRevokeResponse>(
-      `/tenants/${tenantId}/invites/${inviteId}`,
-    );
-  }
-
-  /**
-   * Preview an org invite by token (no auth required).
-   *
-   * Returns `null` when the token is unknown or has been revoked.
-   *
-   * `GET /invites/:token`
-   */
-  async preview(token: string): Promise<OrgInvitePreview | null> {
-    try {
-      const res = await this.http.get<OrgInvitePreviewResponse>(
-        `/invites/${token}`,
-      );
-      return res.data ?? null;
-    } catch {
-      return null;
-    }
-  }
-
-  /**
-   * Accept an org invite on behalf of the authenticated user.
-   *
-   * The caller's JWT email must match the invite email (case-insensitive).
-   * On success inserts a `tenant_members` row.
-   *
-   * Error responses:
-   * - `400` — invalid or expired token.
-   * - `422 EMAIL_MISMATCH` — JWT email does not match the invite email.
-   *
-   * `POST /invites/:token/accept`
-   */
-  async accept(token: string): Promise<AcceptOrgInviteResponse> {
-    return this.http.post<AcceptOrgInviteResponse>(
-      `/invites/${token}/accept`,
-      {},
-    );
-  }
-}

package/src/resources/phase1.test.ts

@@ -1,187 +0,0 @@
-import * as crypto from "node:crypto";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { HttpClient } from "../http.js";
-import { Sandbox } from "./sandboxes.js";
-import { Tenant } from "./tenant.js";
-import { verifySignature, Webhooks } from "./webhooks.js";
-
-const mockGet = vi.fn();
-const mockPost = vi.fn();
-const mockPut = vi.fn();
-const mockPatch = vi.fn();
-const mockDelete = vi.fn();
-const mockRequest = vi.fn();
-
-function makeHttp(): HttpClient {
-  return {
-    get: mockGet,
-    post: mockPost,
-    put: mockPut,
-    patch: mockPatch,
-    delete: mockDelete,
-    request: mockRequest,
-  } as unknown as HttpClient;
-}
-
-function sandboxData(overrides: Record<string, unknown> = {}) {
-  return {
-    id: "sbx_123",
-    state: "running",
-    ready: true,
-    template_id: "miosa-sandbox",
-    ...overrides,
-  };
-}
-
-beforeEach(() => {
-  vi.resetAllMocks();
-});
-
-// ── tenant.preview_domain ────────────────────────────────────────────────────
-
-describe("tenant.preview_domain", () => {
-  it("get calls GET /tenant/preview-domain", async () => {
-    mockGet.mockResolvedValue({
-      preview_domain: "preview.acme.com",
-      verified_at: null,
-    });
-    const tenant = new Tenant(makeHttp());
-    const result = await tenant.preview_domain.get();
-    expect(mockGet).toHaveBeenCalledWith("/tenant/preview-domain");
-    expect(result.preview_domain).toBe("preview.acme.com");
-  });
-
-  it("set calls PUT /tenant/preview-domain", async () => {
-    mockPut.mockResolvedValue({ preview_domain: "preview.acme.com" });
-    const tenant = new Tenant(makeHttp());
-    await tenant.preview_domain.set("preview.acme.com");
-    expect(mockPut).toHaveBeenCalledWith("/tenant/preview-domain", {
-      preview_domain: "preview.acme.com",
-    });
-  });
-
-  it("verify calls POST /tenant/preview-domain/verify", async () => {
-    mockPost.mockResolvedValue({
-      verified: true,
-      target: "proxy.miosa.app",
-      records: [],
-    });
-    const tenant = new Tenant(makeHttp());
-    const result = await tenant.preview_domain.verify();
-    expect(mockPost).toHaveBeenCalledWith("/tenant/preview-domain/verify", {});
-    expect(result.verified).toBe(true);
-  });
-
-  it("delete calls DELETE /tenant/preview-domain", async () => {
-    mockDelete.mockResolvedValue(undefined);
-    const tenant = new Tenant(makeHttp());
-    await tenant.preview_domain.delete();
-    expect(mockDelete).toHaveBeenCalledWith("/tenant/preview-domain");
-  });
-});
-
-// ── tenant.branding ──────────────────────────────────────────────────────────
-
-describe("tenant.branding", () => {
-  it("get calls GET /tenant/branding", async () => {
-    mockGet.mockResolvedValue({ product_name: "Acme AI" });
-    const tenant = new Tenant(makeHttp());
-    const result = await tenant.branding.get();
-    expect(result.product_name).toBe("Acme AI");
-  });
-
-  it("set calls PUT /tenant/branding", async () => {
-    const branding = { product_name: "Acme", primary_color: "#ff0000" };
-    mockPut.mockResolvedValue(branding);
-    const tenant = new Tenant(makeHttp());
-    await tenant.branding.set(branding);
-    expect(mockPut).toHaveBeenCalledWith("/tenant/branding", { branding });
-  });
-});
-
-// ── sandbox.update ───────────────────────────────────────────────────────────
-
-describe("sandbox.update", () => {
-  it("calls PATCH /sandboxes/{id} with body", async () => {
-    const updated = sandboxData({ name: "renamed" });
-    mockPatch.mockResolvedValue({ data: updated });
-    const sbx = new Sandbox(makeHttp(), sandboxData());
-    await sbx.update({ name: "renamed", slug: "my-slug" });
-    expect(mockPatch).toHaveBeenCalledWith("/sandboxes/sbx_123", {
-      name: "renamed",
-      slug: "my-slug",
-    });
-  });
-
-  it("only sends defined fields", async () => {
-    mockPatch.mockResolvedValue({ data: sandboxData() });
-    const sbx = new Sandbox(makeHttp(), sandboxData());
-    await sbx.update({ always_on: true });
-    expect(mockPatch).toHaveBeenCalledWith("/sandboxes/sbx_123", {
-      always_on: true,
-    });
-  });
-});
-
-// ── sandbox.previewToken ─────────────────────────────────────────────────────
-
-describe("sandbox.previewToken", () => {
-  it("calls POST /sandboxes/{id}/preview-token", async () => {
-    const tokenResp = {
-      token: "tok_xyz",
-      url: "https://preview.miosa.app?t=tok_xyz",
-      expires_at: "2026-05-26T01:00:00Z",
-      scope: "read",
-    };
-    mockPost.mockResolvedValue(tokenResp);
-    const sbx = new Sandbox(makeHttp(), sandboxData());
-    const result = await sbx.previewToken(3600, "read");
-    expect(mockPost).toHaveBeenCalledWith("/sandboxes/sbx_123/preview-token", {
-      expires_in: 3600,
-      scope: "read",
-    });
-    expect(result.token).toBe("tok_xyz");
-  });
-});
-
-// ── verifySignature ──────────────────────────────────────────────────────────
-
-function makeHeader(payload: Buffer, secret: string, ts?: number): string {
-  const t = ts ?? Math.floor(Date.now() / 1000);
-  const signed = Buffer.concat([Buffer.from(`${t}.`), payload]);
-  const sig = crypto.createHmac("sha256", secret).update(signed).digest("hex");
-  return `t=${t},v1=${sig}`;
-}
-
-describe("verifySignature", () => {
-  it("returns true for a valid signature", () => {
-    const payload = Buffer.from('{"event":"sandbox.created"}');
-    const header = makeHeader(payload, "secret123");
-    expect(verifySignature(payload, header, "secret123")).toBe(true);
-  });
-
-  it("returns false for wrong secret", () => {
-    const payload = Buffer.from('{"event":"sandbox.created"}');
-    const header = makeHeader(payload, "secret123");
-    expect(verifySignature(payload, header, "wrongsecret")).toBe(false);
-  });
-
-  it("throws for old timestamp", () => {
-    const payload = Buffer.from("body");
-    const old = Math.floor(Date.now() / 1000) - 400;
-    const header = makeHeader(payload, "s3cr3t", old);
-    expect(() => verifySignature(payload, header, "s3cr3t")).toThrow("too old");
-  });
-
-  it("returns false for malformed header", () => {
-    expect(verifySignature(Buffer.from("body"), "malformed", "secret")).toBe(
-      false,
-    );
-  });
-
-  it("Webhooks.verifySignature delegates to module function", () => {
-    const payload = Buffer.from("body");
-    const header = makeHeader(payload, "secret");
-    expect(Webhooks.verifySignature(payload, header, "secret")).toBe(true);
-  });
-});

package/src/resources/project-auth.ts

@@ -1,142 +0,0 @@
-/**
- * Project auth — built-in auth for sandboxes and deployments.
- */
-
-import type { HttpClient } from "../http.js";
-
-// ── Resource shapes ──────────────────────────────────────────────────────────
-
-export interface ProjectAuthStatus {
-  enabled?: boolean;
-  state?: string;
-  database_id?: string | null;
-  config?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-// ── Request payloads ─────────────────────────────────────────────────────────
-
-export type ProjectAuthResourceType = "sandbox" | "deployment";
-
-export interface ProjectAuthResourceParams {
-  resourceType?: ProjectAuthResourceType;
-  resource_type?: ProjectAuthResourceType;
-  resourceId?: string;
-  resource_id?: string;
-}
-
-export interface ProjectAuthEnableParams extends ProjectAuthResourceParams {
-  signupEnabled?: boolean;
-  signup_enabled?: boolean;
-  emailConfirmRequired?: boolean;
-  email_confirm_required?: boolean;
-  tokenExpirySec?: number;
-  token_expiry_sec?: number;
-  config?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-export interface ProjectAuthUpdateParams extends ProjectAuthEnableParams {}
-
-export interface ProjectAuthDisableParams extends ProjectAuthResourceParams {
-  [key: string]: unknown;
-}
-
-export interface ProjectAuthStatusParams extends ProjectAuthResourceParams {
-  [key: string]: unknown;
-}
-
-function resourcePayload(params: ProjectAuthResourceParams): {
-  resource_type: ProjectAuthResourceType;
-  resource_id: string;
-} {
-  const resource_type = params.resource_type ?? params.resourceType;
-  const resource_id = params.resource_id ?? params.resourceId;
-
-  if (!resource_type || !resource_id) {
-    throw new Error("project auth requires resourceType/resourceId");
-  }
-
-  return { resource_type, resource_id };
-}
-
-function authConfig(params: ProjectAuthEnableParams): Record<string, unknown> {
-  return stripUndefined({
-    ...(params.config ?? {}),
-    signup_enabled: params.signup_enabled ?? params.signupEnabled,
-    email_confirm_required:
-      params.email_confirm_required ?? params.emailConfirmRequired,
-    token_expiry_sec: params.token_expiry_sec ?? params.tokenExpirySec,
-  });
-}
-
-function requestBody(params: ProjectAuthEnableParams): Record<string, unknown> {
-  return stripUndefined({
-    ...resourcePayload(params),
-    config: authConfig(params),
-  });
-}
-
-export interface ProjectAuthLegacyParams {
-  provider?: string;
-  config?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-function unwrap<T>(payload: unknown): T {
-  if (payload && typeof payload === "object") {
-    const p = payload as Record<string, unknown>;
-    for (const k of ["data", "project_auth", "config", "items"]) {
-      if (k in p) return p[k] as T;
-    }
-  }
-  return payload as T;
-}
-
-function stripUndefined(
-  input: Record<string, unknown>,
-): Record<string, unknown> {
-  return Object.fromEntries(
-    Object.entries(input).filter(([, v]) => v !== undefined),
-  );
-}
-
-// ── Main resource ─────────────────────────────────────────────────────────────
-
-export class ProjectAuth {
-  constructor(private readonly http: HttpClient) {}
-
-  /** Get the current project-auth status and config. */
-  async status(params: ProjectAuthStatusParams): Promise<ProjectAuthStatus> {
-    const data = await this.http.get<unknown>(
-      "/project-auth/status",
-      resourcePayload(params),
-    );
-    return unwrap<ProjectAuthStatus>(data);
-  }
-
-  /** Enable project auth. */
-  async enable(params: ProjectAuthEnableParams): Promise<ProjectAuthStatus> {
-    const body = requestBody(params);
-    const data = await this.http.post<unknown>("/project-auth/enable", body);
-    return unwrap<ProjectAuthStatus>(data);
-  }
-
-  /** Disable project auth. */
-  async disable(params: ProjectAuthDisableParams): Promise<ProjectAuthStatus> {
-    const data = await this.http.post<unknown>(
-      "/project-auth/disable",
-      resourcePayload(params),
-    );
-    return unwrap<ProjectAuthStatus>(data);
-  }
-
-  /** Update project-auth configuration. */
-  async update(params: ProjectAuthUpdateParams): Promise<ProjectAuthStatus> {
-    const body = requestBody(params);
-    const data = await this.http.patch<unknown>("/project-auth/config", body);
-    return unwrap<ProjectAuthStatus>(data);
-  }
-}

package/src/resources/project-integrations.ts

@@ -1,133 +0,0 @@
-/**
- * Project integrations — third-party API key connections injected into VMs.
- */
-
-import type { HttpClient } from "../http.js";
-
-// ── Resource shapes ──────────────────────────────────────────────────────────
-
-export interface ProjectIntegrationData {
-  id?: string;
-  project_id?: string;
-  provider?: string;
-  status?: string;
-  [key: string]: unknown;
-}
-
-export interface ProjectIntegrationCatalogEntry {
-  provider?: string;
-  name?: string;
-  description?: string;
-  schema?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-// ── Request payloads ─────────────────────────────────────────────────────────
-
-export interface ProjectIntegrationListParams {
-  project_id?: string;
-  provider?: string;
-  [key: string]: string | number | boolean | undefined;
-}
-
-export interface ProjectIntegrationCreateParams {
-  project_id?: string;
-  provider?: string;
-  credentials?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-export interface ProjectIntegrationUpdateParams {
-  credentials?: Record<string, unknown>;
-  [key: string]: unknown;
-}
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-function unwrap<T>(payload: unknown): T {
-  if (payload && typeof payload === "object") {
-    const p = payload as Record<string, unknown>;
-    for (const k of ["data", "project_integrations", "catalog", "items"]) {
-      if (k in p) return p[k] as T;
-    }
-  }
-  return payload as T;
-}
-
-function listItems<T>(payload: unknown): T[] {
-  const result = unwrap<T[] | unknown>(payload);
-  if (Array.isArray(result)) return result;
-  return [];
-}
-
-function stripUndefined(
-  input: Record<string, unknown>,
-): Record<string, string | number | boolean | undefined> {
-  return Object.fromEntries(
-    Object.entries(input).filter(([, v]) => v !== undefined),
-  ) as Record<string, string | number | boolean | undefined>;
-}
-
-function stripUndefObj(
-  input: Record<string, unknown>,
-): Record<string, unknown> {
-  return Object.fromEntries(
-    Object.entries(input).filter(([, v]) => v !== undefined),
-  );
-}
-
-// ── Main resource ─────────────────────────────────────────────────────────────
-
-export class ProjectIntegrations {
-  constructor(private readonly http: HttpClient) {}
-
-  /** List project integrations. */
-  async list(
-    params: ProjectIntegrationListParams = {},
-  ): Promise<ProjectIntegrationData[]> {
-    const query = stripUndefined(params as Record<string, unknown>);
-    const data = await this.http.get<unknown>("/project-integrations", query);
-    return listItems<ProjectIntegrationData>(data);
-  }
-
-  /** List supported providers and their schemas. */
-  async catalog(): Promise<ProjectIntegrationCatalogEntry[]> {
-    const data = await this.http.get<unknown>("/project-integrations/catalog");
-    return listItems<ProjectIntegrationCatalogEntry>(data);
-  }
-
-  /** Get a project integration by id. */
-  async get(integrationId: string): Promise<ProjectIntegrationData> {
-    const data = await this.http.get<unknown>(
-      `/project-integrations/${integrationId}`,
-    );
-    return unwrap<ProjectIntegrationData>(data);
-  }
-
-  /** Create a project integration. */
-  async create(
-    params: ProjectIntegrationCreateParams,
-  ): Promise<ProjectIntegrationData> {
-    const body = stripUndefObj(params as Record<string, unknown>);
-    const data = await this.http.post<unknown>("/project-integrations", body);
-    return unwrap<ProjectIntegrationData>(data);
-  }
-
-  /** Update a project integration. */
-  async update(
-    integrationId: string,
-    params: ProjectIntegrationUpdateParams,
-  ): Promise<ProjectIntegrationData> {
-    const body = stripUndefObj(params as Record<string, unknown>);
-    const data = await this.http.patch<unknown>(
-      `/project-integrations/${integrationId}`,
-      body,
-    );
-    return unwrap<ProjectIntegrationData>(data);
-  }
-
-  /** Delete a project integration. */
-  async delete(integrationId: string): Promise<void> {
-    await this.http.delete<unknown>(`/project-integrations/${integrationId}`);
-  }
-}