@mirrorstack-ai/app-module-client 0.5.1

package/dist/next/module-proxy-routes.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The ONE server hop a browser module client talks through.
+ *
+ * 🔴 WHY THIS EXISTS AT ALL. A custom app keeps its member credential in an
+ * HttpOnly cookie, which is the point of an HttpOnly cookie — script cannot
+ * read it, so the browser cannot call the platform itself. That is the ONLY
+ * thing the browser is missing. This supplies exactly that and forwards
+ * everything else untouched.
+ *
+ * 🔴 WHY IT IS HERE RATHER THAN IN EACH APP. Every app that keeps its
+ * credential in a cookie needs byte-identical code, and two lines of it are
+ * invisible until they bite:
+ *
+ *   - `duplex: "half"` is REQUIRED by undici whenever the body is a stream,
+ *     which it is for any upload. Without it the fetch throws before a byte
+ *     leaves, and the error names neither the upload nor the cause.
+ *   - `content-encoding` / `content-length` MUST be dropped from the response.
+ *     The body has already been decoded by the time it is re-sent, so a copied
+ *     `content-length` describes bytes that no longer exist and the request
+ *     hangs rather than failing.
+ *
+ * An app that writes this by hand gets to discover both. kaohsiung-association
+ * carried a hand-written copy of this file, 98 lines, containing no knowledge
+ * of any module — which is what made it boilerplate rather than app code.
+ *
+ * The alternative shape — a hand-written endpoint per operation — re-declares
+ * each module's contract inside the app: one more place to keep in step every
+ * time a module changes, and the generated client's types and errors are
+ * discarded on the way through. With this mounted the browser uses the real
+ * module client and this file never learns what any call means.
+ *
+ * 🔴 IT FORWARDS, IT DOES NOT DECIDE. Authorization remains the platform's and
+ * the modules' answer on every request. This attaches a credential the member
+ * already holds and grants nothing that credential does not carry.
+ */
+/** Inputs for {@link createModuleProxyRoutes}. */
+export interface ModuleProxyRoutesOptions {
+    /** Absolute HTTP(S) platform API URL, typically `MIRRORSTACK_API_URL`. */
+    readonly apiUrl: string;
+    /** The custom application's slug, typically `MIRRORSTACK_APP_SLUG`. */
+    readonly appSlug: string;
+    /**
+     * Reads the member credential for the current request. Pass the
+     * `readMemberCredential` from {@link createAuthRoutes}, so the proxy and
+     * sign-in cannot disagree about where the session lives.
+     */
+    readonly readMemberCredential: () => Promise<string | null>;
+    /** Fetch implementation for the upstream call. Defaults to `globalThis.fetch`. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+/** A Next.js App Router route module: one handler per forwarded method. */
+export interface ModuleProxyRoutes {
+    GET(request: Request, context: RouteContext): Promise<Response>;
+    POST(request: Request, context: RouteContext): Promise<Response>;
+    PUT(request: Request, context: RouteContext): Promise<Response>;
+    PATCH(request: Request, context: RouteContext): Promise<Response>;
+    DELETE(request: Request, context: RouteContext): Promise<Response>;
+}
+/** The second argument Next hands a catch-all route handler. */
+export interface RouteContext {
+    readonly params: Promise<{
+        path: string[];
+    }>;
+}
+/**
+ * Build the catch-all route handlers for a module proxy.
+ *
+ * Mount at `app/api/mirrorstack/modules/[...path]/route.ts`:
+ *
+ * ```ts
+ * export const runtime = "nodejs";
+ * export const { GET, POST, PUT, PATCH, DELETE } = createModuleProxyRoutes({
+ *   apiUrl: process.env.NEXT_PUBLIC_MIRRORSTACK_API!,
+ *   appSlug: process.env.NEXT_PUBLIC_APP_ID!,
+ *   readMemberCredential: auth.readMemberCredential,
+ * });
+ * ```
+ *
+ * The browser client's `baseUrl` is then that same mount path.
+ */
+export declare function createModuleProxyRoutes(options: ModuleProxyRoutesOptions): ModuleProxyRoutes;

package/dist/next/module-proxy-routes.js

@@ -0,0 +1,77 @@
+import { platformBaseUrl } from "../base-url.js";
+/**
+ * Headers that must NOT be replayed upstream.
+ *
+ * `cookie` above all: the app's session cookie is its own, and forwarding it
+ * hands a second credential to a service that never asked for one. The length
+ * and hop-by-hop headers are re-derived by fetch, and a stale `content-length`
+ * copied onto a re-encoded body is a hung request. `authorization` is dropped
+ * because this hop sets it — a caller-supplied one must never survive.
+ */
+const STRIPPED_REQUEST_HEADERS = new Set([
+    "cookie",
+    "host",
+    "connection",
+    "content-length",
+    "transfer-encoding",
+    "authorization",
+    "accept-encoding",
+]);
+/**
+ * Build the catch-all route handlers for a module proxy.
+ *
+ * Mount at `app/api/mirrorstack/modules/[...path]/route.ts`:
+ *
+ * ```ts
+ * export const runtime = "nodejs";
+ * export const { GET, POST, PUT, PATCH, DELETE } = createModuleProxyRoutes({
+ *   apiUrl: process.env.NEXT_PUBLIC_MIRRORSTACK_API!,
+ *   appSlug: process.env.NEXT_PUBLIC_APP_ID!,
+ *   readMemberCredential: auth.readMemberCredential,
+ * });
+ * ```
+ *
+ * The browser client's `baseUrl` is then that same mount path.
+ */
+export function createModuleProxyRoutes(options) {
+    const doFetch = options.fetch ?? globalThis.fetch;
+    const base = platformBaseUrl({ apiUrl: options.apiUrl, appSlug: options.appSlug });
+    async function forward(request, context) {
+        const credential = await options.readMemberCredential();
+        if (!credential)
+            return new Response(null, { status: 401 });
+        const { path } = await context.params;
+        const target = new URL(`${base}/${path.join("/")}`);
+        target.search = new URL(request.url).search;
+        const headers = new Headers();
+        for (const [name, value] of request.headers) {
+            if (!STRIPPED_REQUEST_HEADERS.has(name.toLowerCase()))
+                headers.set(name, value);
+        }
+        headers.set("authorization", `Bearer ${credential}`);
+        const hasBody = request.method !== "GET" && request.method !== "HEAD";
+        const response = await doFetch(target, {
+            method: request.method,
+            headers,
+            body: hasBody ? request.body : undefined,
+            duplex: "half",
+            redirect: "manual",
+        });
+        // The upstream status and body are returned as they are, so a module's own
+        // "too large" or "wrong type" reaches the caller instead of a generic
+        // failure nobody can act on.
+        const out = new Headers(response.headers);
+        out.delete("content-encoding");
+        out.delete("content-length");
+        out.delete("transfer-encoding");
+        return new Response(response.body, { status: response.status, headers: out });
+    }
+    return {
+        GET: forward,
+        POST: forward,
+        PUT: forward,
+        PATCH: forward,
+        DELETE: forward,
+    };
+}
+//# sourceMappingURL=module-proxy-routes.js.map

package/dist/next/module-proxy-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-proxy-routes.js","sourceRoot":"","sources":["../../src/next/module-proxy-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAoEjD;;;;;;;;GAQG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,eAAe;IACf,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEnF,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,OAAqB;QAC5D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAE5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAE5C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;YACrC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACxC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;SACiB,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,sEAAsE;QACtE,6BAA6B;QAC7B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC/B,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAChC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import { platformBaseUrl } from \"../base-url.js\";\n\n/**\n * The ONE server hop a browser module client talks through.\n *\n * 🔴 WHY THIS EXISTS AT ALL. A custom app keeps its member credential in an\n * HttpOnly cookie, which is the point of an HttpOnly cookie — script cannot\n * read it, so the browser cannot call the platform itself. That is the ONLY\n * thing the browser is missing. This supplies exactly that and forwards\n * everything else untouched.\n *\n * 🔴 WHY IT IS HERE RATHER THAN IN EACH APP. Every app that keeps its\n * credential in a cookie needs byte-identical code, and two lines of it are\n * invisible until they bite:\n *\n *   - `duplex: \"half\"` is REQUIRED by undici whenever the body is a stream,\n *     which it is for any upload. Without it the fetch throws before a byte\n *     leaves, and the error names neither the upload nor the cause.\n *   - `content-encoding` / `content-length` MUST be dropped from the response.\n *     The body has already been decoded by the time it is re-sent, so a copied\n *     `content-length` describes bytes that no longer exist and the request\n *     hangs rather than failing.\n *\n * An app that writes this by hand gets to discover both. kaohsiung-association\n * carried a hand-written copy of this file, 98 lines, containing no knowledge\n * of any module — which is what made it boilerplate rather than app code.\n *\n * The alternative shape — a hand-written endpoint per operation — re-declares\n * each module's contract inside the app: one more place to keep in step every\n * time a module changes, and the generated client's types and errors are\n * discarded on the way through. With this mounted the browser uses the real\n * module client and this file never learns what any call means.\n *\n * 🔴 IT FORWARDS, IT DOES NOT DECIDE. Authorization remains the platform's and\n * the modules' answer on every request. This attaches a credential the member\n * already holds and grants nothing that credential does not carry.\n */\n\n/** Inputs for {@link createModuleProxyRoutes}. */\nexport interface ModuleProxyRoutesOptions {\n  /** Absolute HTTP(S) platform API URL, typically `MIRRORSTACK_API_URL`. */\n  readonly apiUrl: string;\n  /** The custom application's slug, typically `MIRRORSTACK_APP_SLUG`. */\n  readonly appSlug: string;\n  /**\n   * Reads the member credential for the current request. Pass the\n   * `readMemberCredential` from {@link createAuthRoutes}, so the proxy and\n   * sign-in cannot disagree about where the session lives.\n   */\n  readonly readMemberCredential: () => Promise<string | null>;\n  /** Fetch implementation for the upstream call. Defaults to `globalThis.fetch`. */\n  readonly fetch?: typeof globalThis.fetch;\n}\n\n/** A Next.js App Router route module: one handler per forwarded method. */\nexport interface ModuleProxyRoutes {\n  GET(request: Request, context: RouteContext): Promise<Response>;\n  POST(request: Request, context: RouteContext): Promise<Response>;\n  PUT(request: Request, context: RouteContext): Promise<Response>;\n  PATCH(request: Request, context: RouteContext): Promise<Response>;\n  DELETE(request: Request, context: RouteContext): Promise<Response>;\n}\n\n/** The second argument Next hands a catch-all route handler. */\nexport interface RouteContext {\n  readonly params: Promise<{ path: string[] }>;\n}\n\n/**\n * Headers that must NOT be replayed upstream.\n *\n * `cookie` above all: the app's session cookie is its own, and forwarding it\n * hands a second credential to a service that never asked for one. The length\n * and hop-by-hop headers are re-derived by fetch, and a stale `content-length`\n * copied onto a re-encoded body is a hung request. `authorization` is dropped\n * because this hop sets it — a caller-supplied one must never survive.\n */\nconst STRIPPED_REQUEST_HEADERS = new Set([\n  \"cookie\",\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"authorization\",\n  \"accept-encoding\",\n]);\n\n/**\n * Build the catch-all route handlers for a module proxy.\n *\n * Mount at `app/api/mirrorstack/modules/[...path]/route.ts`:\n *\n * ```ts\n * export const runtime = \"nodejs\";\n * export const { GET, POST, PUT, PATCH, DELETE } = createModuleProxyRoutes({\n *   apiUrl: process.env.NEXT_PUBLIC_MIRRORSTACK_API!,\n *   appSlug: process.env.NEXT_PUBLIC_APP_ID!,\n *   readMemberCredential: auth.readMemberCredential,\n * });\n * ```\n *\n * The browser client's `baseUrl` is then that same mount path.\n */\nexport function createModuleProxyRoutes(options: ModuleProxyRoutesOptions): ModuleProxyRoutes {\n  const doFetch = options.fetch ?? globalThis.fetch;\n  const base = platformBaseUrl({ apiUrl: options.apiUrl, appSlug: options.appSlug });\n\n  async function forward(request: Request, context: RouteContext): Promise<Response> {\n    const credential = await options.readMemberCredential();\n    if (!credential) return new Response(null, { status: 401 });\n\n    const { path } = await context.params;\n    const target = new URL(`${base}/${path.join(\"/\")}`);\n    target.search = new URL(request.url).search;\n\n    const headers = new Headers();\n    for (const [name, value] of request.headers) {\n      if (!STRIPPED_REQUEST_HEADERS.has(name.toLowerCase())) headers.set(name, value);\n    }\n    headers.set(\"authorization\", `Bearer ${credential}`);\n\n    const hasBody = request.method !== \"GET\" && request.method !== \"HEAD\";\n    const response = await doFetch(target, {\n      method: request.method,\n      headers,\n      body: hasBody ? request.body : undefined,\n      duplex: \"half\",\n      redirect: \"manual\",\n    } as RequestInit & { duplex: \"half\" });\n\n    // The upstream status and body are returned as they are, so a module's own\n    // \"too large\" or \"wrong type\" reaches the caller instead of a generic\n    // failure nobody can act on.\n    const out = new Headers(response.headers);\n    out.delete(\"content-encoding\");\n    out.delete(\"content-length\");\n    out.delete(\"transfer-encoding\");\n    return new Response(response.body, { status: response.status, headers: out });\n  }\n\n  return {\n    GET: forward,\n    POST: forward,\n    PUT: forward,\n    PATCH: forward,\n    DELETE: forward,\n  };\n}\n"]}

package/dist/plugin.d.ts

@@ -0,0 +1,39 @@
+import type { ScopedTransport } from "./transport.js";
+/** The plugin contract version understood by this package. */
+export declare const MODULE_CLIENT_API_VERSION: 1;
+/** A module HTTP surface that browser and server applications may call. */
+export type ModuleScope = "public" | "platform";
+/** Transports provided to a module plugin while its typed API is created. */
+export interface ModuleClientContext {
+    /** Anonymous or module-defined-auth endpoints. */
+    readonly public: ScopedTransport;
+    /** MirrorStack platform-authenticated endpoints. */
+    readonly platform: ScopedTransport;
+}
+/** A statically composed module client plugin. */
+export interface ModuleClientPlugin<TApi = unknown> {
+    /** Runtime compatibility marker. */
+    readonly apiVersion: typeof MODULE_CLIENT_API_VERSION;
+    /** Canonical 1-16 character catalog slug or UUID used as the dispatch segment. */
+    readonly moduleRef: string;
+    /** Creates the module-specific API from its two allowed transports. */
+    readonly create: (context: ModuleClientContext) => TApi;
+}
+/** Definition accepted by {@link defineModuleClient}. */
+export interface ModuleClientDefinition<TApi> {
+    /** Canonical 1-16 character catalog slug or UUID; never the Go SDK `Config.ID`. */
+    readonly moduleRef: string;
+    /** Creates the public typed surface exposed at `client.modules.<alias>`. */
+    readonly create: (context: ModuleClientContext) => TApi;
+}
+/** @internal */
+export declare function assertModuleRef(moduleRef: string): void;
+/** @internal */
+export declare function assertCatalogSlug(value: string, label: string): void;
+/**
+ * Defines a module plugin while preserving the return type of `create`.
+ *
+ * The explicit definition is the only discovery mechanism: importing a plugin
+ * never mutates a registry or changes another application client.
+ */
+export declare function defineModuleClient<TApi>(definition: ModuleClientDefinition<TApi>): ModuleClientPlugin<TApi>;

package/dist/plugin.js

@@ -0,0 +1,39 @@
+/** The plugin contract version understood by this package. */
+export const MODULE_CLIENT_API_VERSION = 1;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Mirrors the Go module SDK's canonical 1-16 byte catalog slug contract.
+const CATALOG_SLUG_PATTERN = /^[a-z][a-z0-9-]{0,15}$/;
+/** @internal */
+export function assertModuleRef(moduleRef) {
+    if (typeof moduleRef !== "string" ||
+        (!UUID_PATTERN.test(moduleRef) && !CATALOG_SLUG_PATTERN.test(moduleRef))) {
+        throw new TypeError("moduleRef must be a lowercase catalog slug or UUID (not the module SDK Config.ID)");
+    }
+}
+/** @internal */
+export function assertCatalogSlug(value, label) {
+    if (typeof value !== "string" || !CATALOG_SLUG_PATTERN.test(value)) {
+        throw new TypeError(`${label} must be a lowercase catalog slug matching [a-z][a-z0-9-]{0,15}`);
+    }
+}
+/**
+ * Defines a module plugin while preserving the return type of `create`.
+ *
+ * The explicit definition is the only discovery mechanism: importing a plugin
+ * never mutates a registry or changes another application client.
+ */
+export function defineModuleClient(definition) {
+    if (definition === null || typeof definition !== "object") {
+        throw new TypeError("module client definition must be an object");
+    }
+    assertModuleRef(definition.moduleRef);
+    if (typeof definition.create !== "function") {
+        throw new TypeError("module client definition requires a create function");
+    }
+    return Object.freeze({
+        apiVersion: MODULE_CLIENT_API_VERSION,
+        moduleRef: definition.moduleRef,
+        create: definition.create,
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AA+BpD,MAAM,YAAY,GAAG,gEAAgE,CAAC;AACtF,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAEtD,gBAAgB;AAChB,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAwC;IAExC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,yBAAyB;QACrC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ScopedTransport } from \"./transport.js\";\n\n/** The plugin contract version understood by this package. */\nexport const MODULE_CLIENT_API_VERSION = 1 as const;\n\n/** A module HTTP surface that browser and server applications may call. */\nexport type ModuleScope = \"public\" | \"platform\";\n\n/** Transports provided to a module plugin while its typed API is created. */\nexport interface ModuleClientContext {\n  /** Anonymous or module-defined-auth endpoints. */\n  readonly public: ScopedTransport;\n  /** MirrorStack platform-authenticated endpoints. */\n  readonly platform: ScopedTransport;\n}\n\n/** A statically composed module client plugin. */\nexport interface ModuleClientPlugin<TApi = unknown> {\n  /** Runtime compatibility marker. */\n  readonly apiVersion: typeof MODULE_CLIENT_API_VERSION;\n  /** Canonical 1-16 character catalog slug or UUID used as the dispatch segment. */\n  readonly moduleRef: string;\n  /** Creates the module-specific API from its two allowed transports. */\n  readonly create: (context: ModuleClientContext) => TApi;\n}\n\n/** Definition accepted by {@link defineModuleClient}. */\nexport interface ModuleClientDefinition<TApi> {\n  /** Canonical 1-16 character catalog slug or UUID; never the Go SDK `Config.ID`. */\n  readonly moduleRef: string;\n  /** Creates the public typed surface exposed at `client.modules.<alias>`. */\n  readonly create: (context: ModuleClientContext) => TApi;\n}\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\n// Mirrors the Go module SDK's canonical 1-16 byte catalog slug contract.\nconst CATALOG_SLUG_PATTERN = /^[a-z][a-z0-9-]{0,15}$/;\n\n/** @internal */\nexport function assertModuleRef(moduleRef: string): void {\n  if (\n    typeof moduleRef !== \"string\" ||\n    (!UUID_PATTERN.test(moduleRef) && !CATALOG_SLUG_PATTERN.test(moduleRef))\n  ) {\n    throw new TypeError(\n      \"moduleRef must be a lowercase catalog slug or UUID (not the module SDK Config.ID)\",\n    );\n  }\n}\n\n/** @internal */\nexport function assertCatalogSlug(value: string, label: string): void {\n  if (typeof value !== \"string\" || !CATALOG_SLUG_PATTERN.test(value)) {\n    throw new TypeError(`${label} must be a lowercase catalog slug matching [a-z][a-z0-9-]{0,15}`);\n  }\n}\n\n/**\n * Defines a module plugin while preserving the return type of `create`.\n *\n * The explicit definition is the only discovery mechanism: importing a plugin\n * never mutates a registry or changes another application client.\n */\nexport function defineModuleClient<TApi>(\n  definition: ModuleClientDefinition<TApi>,\n): ModuleClientPlugin<TApi> {\n  if (definition === null || typeof definition !== \"object\") {\n    throw new TypeError(\"module client definition must be an object\");\n  }\n  assertModuleRef(definition.moduleRef);\n  if (typeof definition.create !== \"function\") {\n    throw new TypeError(\"module client definition requires a create function\");\n  }\n\n  return Object.freeze({\n    apiVersion: MODULE_CLIENT_API_VERSION,\n    moduleRef: definition.moduleRef,\n    create: definition.create,\n  });\n}\n"]}

package/dist/response.d.ts

@@ -0,0 +1,13 @@
+/** Default maximum body size parsed by module transports (one mebibyte). */
+export declare const DEFAULT_MAX_RESPONSE_BYTES: number;
+/** Raised when a successful parsed response exceeds its configured body limit. */
+export declare class ModuleResponseTooLargeError extends Error {
+    readonly limitBytes: number;
+    constructor(limitBytes: number);
+}
+/** @internal */
+export declare function resolveMaxResponseBytes(value: number | undefined): number;
+/** @internal */
+export declare function cancelResponseBody(response: Response, reason?: unknown): void;
+/** @internal */
+export declare function readResponseText(response: Response, maxResponseBytes: number): Promise<string>;

package/dist/response.js

@@ -0,0 +1,80 @@
+/** Default maximum body size parsed by module transports (one mebibyte). */
+export const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
+/** Raised when a successful parsed response exceeds its configured body limit. */
+export class ModuleResponseTooLargeError extends Error {
+    limitBytes;
+    constructor(limitBytes) {
+        super(`Module response body exceeds the ${limitBytes} byte limit`);
+        this.name = "ModuleResponseTooLargeError";
+        this.limitBytes = limitBytes;
+    }
+}
+/** @internal */
+export function resolveMaxResponseBytes(value) {
+    if (value === undefined)
+        return DEFAULT_MAX_RESPONSE_BYTES;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new TypeError("maxResponseBytes must be a positive safe integer");
+    }
+    return value;
+}
+function cancelStream(stream, reason) {
+    try {
+        // A cloned response is one branch of a tee. Awaiting its cancellation can
+        // wait for the other branch, so cancellation is deliberately best-effort.
+        void stream.cancel(reason).catch(() => undefined);
+    }
+    catch {
+        // Preserve the response-size or caller-visible lifecycle result.
+    }
+}
+/** @internal */
+export function cancelResponseBody(response, reason) {
+    if (response.body !== null)
+        cancelStream(response.body, reason);
+}
+/** @internal */
+export async function readResponseText(response, maxResponseBytes) {
+    const declaredLength = response.headers.get("content-length");
+    if (declaredLength !== null) {
+        const declaredBytes = Number(declaredLength);
+        if (Number.isSafeInteger(declaredBytes)
+            && declaredBytes >= 0
+            && declaredBytes > maxResponseBytes) {
+            const error = new ModuleResponseTooLargeError(maxResponseBytes);
+            cancelResponseBody(response, error);
+            throw error;
+        }
+    }
+    if (response.body === null)
+        return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const parts = [];
+    let receivedBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            receivedBytes += value.byteLength;
+            if (receivedBytes > maxResponseBytes) {
+                const error = new ModuleResponseTooLargeError(maxResponseBytes);
+                try {
+                    void reader.cancel(error).catch(() => undefined);
+                }
+                catch {
+                    // Preserve the deterministic response-size error.
+                }
+                throw error;
+            }
+            parts.push(decoder.decode(value, { stream: true }));
+        }
+        parts.push(decoder.decode());
+        return parts.join("");
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=response.js.map

package/dist/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,kFAAkF;AAClF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,UAAU,CAAS;IAE5B,YAAY,UAAkB;QAC5B,KAAK,CAAC,oCAAoC,UAAU,aAAa,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,gBAAgB;AAChB,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,0BAA0B,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,MAAkC,EAClC,MAAgB;IAEhB,IAAI,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,kBAAkB,CAAC,QAAkB,EAAE,MAAgB;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,gBAAwB;IAExB,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC7C,IACE,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;eAChC,aAAa,IAAI,CAAC;eAClB,aAAa,GAAG,gBAAgB,EACnC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;YAChE,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;YAClC,IAAI,aAAa,GAAG,gBAAgB,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,IAAI,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;gBAChE,IAAI,CAAC;oBACH,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["/** Default maximum body size parsed by module transports (one mebibyte). */\nexport const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;\n\n/** Raised when a successful parsed response exceeds its configured body limit. */\nexport class ModuleResponseTooLargeError extends Error {\n  readonly limitBytes: number;\n\n  constructor(limitBytes: number) {\n    super(`Module response body exceeds the ${limitBytes} byte limit`);\n    this.name = \"ModuleResponseTooLargeError\";\n    this.limitBytes = limitBytes;\n  }\n}\n\n/** @internal */\nexport function resolveMaxResponseBytes(value: number | undefined): number {\n  if (value === undefined) return DEFAULT_MAX_RESPONSE_BYTES;\n  if (!Number.isSafeInteger(value) || value <= 0) {\n    throw new TypeError(\"maxResponseBytes must be a positive safe integer\");\n  }\n  return value;\n}\n\nfunction cancelStream(\n  stream: ReadableStream<Uint8Array>,\n  reason?: unknown,\n): void {\n  try {\n    // A cloned response is one branch of a tee. Awaiting its cancellation can\n    // wait for the other branch, so cancellation is deliberately best-effort.\n    void stream.cancel(reason).catch(() => undefined);\n  } catch {\n    // Preserve the response-size or caller-visible lifecycle result.\n  }\n}\n\n/** @internal */\nexport function cancelResponseBody(response: Response, reason?: unknown): void {\n  if (response.body !== null) cancelStream(response.body, reason);\n}\n\n/** @internal */\nexport async function readResponseText(\n  response: Response,\n  maxResponseBytes: number,\n): Promise<string> {\n  const declaredLength = response.headers.get(\"content-length\");\n  if (declaredLength !== null) {\n    const declaredBytes = Number(declaredLength);\n    if (\n      Number.isSafeInteger(declaredBytes)\n      && declaredBytes >= 0\n      && declaredBytes > maxResponseBytes\n    ) {\n      const error = new ModuleResponseTooLargeError(maxResponseBytes);\n      cancelResponseBody(response, error);\n      throw error;\n    }\n  }\n\n  if (response.body === null) return \"\";\n\n  const reader = response.body.getReader();\n  const decoder = new TextDecoder();\n  const parts: string[] = [];\n  let receivedBytes = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      receivedBytes += value.byteLength;\n      if (receivedBytes > maxResponseBytes) {\n        const error = new ModuleResponseTooLargeError(maxResponseBytes);\n        try {\n          void reader.cancel(error).catch(() => undefined);\n        } catch {\n          // Preserve the deterministic response-size error.\n        }\n        throw error;\n      }\n      parts.push(decoder.decode(value, { stream: true }));\n    }\n    parts.push(decoder.decode());\n    return parts.join(\"\");\n  } finally {\n    reader.releaseLock();\n  }\n}\n"]}

package/dist/server/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Server-side helpers for a custom web app: the platform member-session
+ * control plane (exchange a provider handoff for a credential, revoke it).
+ *
+ * @packageDocumentation
+ */
+export { memberSessions, MemberSessionError, type MemberIdentity, type MemberSession, type MemberSessionsApi, type MemberSessionsOptions, type RevokeOutcome, } from "./member-sessions.js";

package/dist/server/index.js

@@ -0,0 +1,8 @@
+/**
+ * Server-side helpers for a custom web app: the platform member-session
+ * control plane (exchange a provider handoff for a credential, revoke it).
+ *
+ * @packageDocumentation
+ */
+export { memberSessions, MemberSessionError, } from "./member-sessions.js";
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,GAMnB,MAAM,sBAAsB,CAAC","sourcesContent":["/**\n * Server-side helpers for a custom web app: the platform member-session\n * control plane (exchange a provider handoff for a credential, revoke it).\n *\n * @packageDocumentation\n */\n\nexport {\n  memberSessions,\n  MemberSessionError,\n  type MemberIdentity,\n  type MemberSession,\n  type MemberSessionsApi,\n  type MemberSessionsOptions,\n  type RevokeOutcome,\n} from \"./member-sessions.js\";\n"]}

package/dist/server/member-sessions.d.ts

@@ -0,0 +1,80 @@
+/**
+ * App-scoped platform member sessions — the control plane a custom web app
+ * uses to turn an auth provider's one-time handoff into a credential it can
+ * present on every module call, and to revoke it again.
+ *
+ * These routes are dispatch's, not a module's: `POST /dispatch/apps/<app>/member-sessions`
+ * and `DELETE …/current`. Dispatch resolves the app's auth-provider slot,
+ * redeems the code with that provider itself, and issues its own `mss1_`
+ * credential, which every installed module then accepts as
+ * `Authorization: Bearer …`. That is why this lives beside `platformBaseUrl`
+ * and not in any module's client: the exchange is identical for every
+ * provider that can fill the slot, and a module plugin only has module-scoped
+ * transports.
+ */
+/** Inputs for {@link memberSessions}. */
+export interface MemberSessionsOptions {
+    /** Absolute HTTP(S) platform API URL, typically `MIRRORSTACK_API_URL`. */
+    readonly apiUrl: string;
+    /** The custom application's slug, typically `MIRRORSTACK_APP_SLUG`. */
+    readonly appSlug: string;
+    /** Fetch implementation, for SSR and tests. Defaults to `globalThis.fetch`. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+/** The identity the platform returns with a freshly issued member session. */
+export interface MemberIdentity {
+    readonly id: string;
+    readonly email: string | null;
+    readonly displayName: string | null;
+    readonly avatarUrl: string | null;
+    readonly createdAt: string;
+    readonly lastSignInAt: string;
+}
+/** A member session as issued by the platform. */
+export interface MemberSession {
+    /** The `mss1_` credential to present as a bearer on module calls. Server-side only. */
+    readonly credential: string;
+    readonly identity: MemberIdentity;
+    /** RFC 3339 expiry of the credential. */
+    readonly expiresAt: string;
+}
+/**
+ * The outcome of a revoke. `revoked` and `alreadyInvalid` are both a finished
+ * sign-out; `unavailable` means the platform could not say, so the credential
+ * may still be live and a caller must not hide that behind a cleared cookie.
+ */
+export type RevokeOutcome = "revoked" | "alreadyInvalid" | "unavailable";
+/** A non-successful response from the member-session control plane. */
+export declare class MemberSessionError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(status: number, code: string | undefined, message: string);
+}
+/** The member-sessions API a custom app talks to. */
+export interface MemberSessionsApi {
+    /** A fresh one-time handoff state: 32 lowercase hex characters, inside the provider's 16–256 byte window. */
+    newState(): string;
+    /** Redeem a one-time handoff code for a member session. `state` must be the one this app issued for the sign-in. */
+    exchange(code: string, state: string): Promise<MemberSession>;
+    /** Revoke the current member session on the platform. Never throws; see {@link RevokeOutcome}. */
+    revoke(credential: string): Promise<RevokeOutcome>;
+    /** The control-plane URL this instance talks to, for assertions and logs. */
+    readonly url: string;
+}
+/**
+ * Creates the member-sessions API for one custom application.
+ *
+ * ```ts
+ * const sessions = memberSessions({
+ *   apiUrl: process.env.MIRRORSTACK_API_URL!,
+ *   appSlug: process.env.MIRRORSTACK_APP_SLUG!,
+ * });
+ * const state = sessions.newState();           // stored in an HttpOnly cookie, sent on startUrl
+ * const session = await sessions.exchange(code, state);
+ * await sessions.revoke(session.credential);
+ * ```
+ *
+ * Both inputs are validated up front, like {@link platformBaseUrl}, so a
+ * misconfigured environment fails at startup rather than on the first sign-in.
+ */
+export declare function memberSessions(options: MemberSessionsOptions): MemberSessionsApi;

package/dist/server/member-sessions.js

@@ -0,0 +1,162 @@
+import { assertAppSlug } from "../base-url.js";
+import { normalizeBaseUrl } from "../transport.js";
+/** A non-successful response from the member-session control plane. */
+export class MemberSessionError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = "MemberSessionError";
+        this.status = status;
+        this.code = code;
+    }
+}
+const HANDOFF_STATE_BYTES = 16;
+const ENVELOPE_VERSION = 1;
+const MAX_ERROR_BODY_BYTES = 4096;
+function stringField(record, key) {
+    const value = record[key];
+    return typeof value === "string" ? value : undefined;
+}
+function nullableStringField(record, key) {
+    const value = record[key];
+    return typeof value === "string" ? value : null;
+}
+function errorCodeOf(body) {
+    if (body === null || typeof body !== "object")
+        return undefined;
+    const error = body.error;
+    if (error === null || typeof error !== "object")
+        return undefined;
+    return stringField(error, "code");
+}
+async function boundedText(response) {
+    try {
+        const text = await response.text();
+        return text.length > MAX_ERROR_BODY_BYTES ? text.slice(0, MAX_ERROR_BODY_BYTES) : text;
+    }
+    catch {
+        return "";
+    }
+}
+function parseMemberSession(body) {
+    if (body === null || typeof body !== "object") {
+        throw new MemberSessionError(502, "invalid_member_session_response", "member session response is not an object");
+    }
+    const record = body;
+    const credential = stringField(record, "credential");
+    const expiresAt = stringField(record, "expiresAt");
+    const identity = record.identity;
+    if (credential === undefined || credential.length === 0 ||
+        expiresAt === undefined ||
+        identity === null || typeof identity !== "object") {
+        throw new MemberSessionError(502, "invalid_member_session_response", "member session response is missing credential, identity, or expiresAt");
+    }
+    const id = stringField(identity, "id");
+    if (id === undefined || id.length === 0) {
+        throw new MemberSessionError(502, "invalid_member_session_response", "member session identity has no id");
+    }
+    const identityRecord = identity;
+    return {
+        credential,
+        expiresAt,
+        identity: {
+            id,
+            email: nullableStringField(identityRecord, "email"),
+            displayName: nullableStringField(identityRecord, "display_name"),
+            avatarUrl: nullableStringField(identityRecord, "avatar_url"),
+            createdAt: stringField(identityRecord, "created_at") ?? "",
+            lastSignInAt: stringField(identityRecord, "last_sign_in_at") ?? "",
+        },
+    };
+}
+/**
+ * Creates the member-sessions API for one custom application.
+ *
+ * ```ts
+ * const sessions = memberSessions({
+ *   apiUrl: process.env.MIRRORSTACK_API_URL!,
+ *   appSlug: process.env.MIRRORSTACK_APP_SLUG!,
+ * });
+ * const state = sessions.newState();           // stored in an HttpOnly cookie, sent on startUrl
+ * const session = await sessions.exchange(code, state);
+ * await sessions.revoke(session.credential);
+ * ```
+ *
+ * Both inputs are validated up front, like {@link platformBaseUrl}, so a
+ * misconfigured environment fails at startup rather than on the first sign-in.
+ */
+export function memberSessions(options) {
+    if (options === null || typeof options !== "object") {
+        throw new TypeError("memberSessions options must be an object");
+    }
+    const { apiUrl, appSlug } = options;
+    if (typeof apiUrl !== "string" || !/^https?:\/\//u.test(apiUrl)) {
+        throw new TypeError("apiUrl must be an absolute HTTP(S) URL");
+    }
+    const parsed = new URL(apiUrl);
+    if (parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "") {
+        throw new TypeError("apiUrl must not carry credentials, a query, or a fragment");
+    }
+    assertAppSlug(appSlug);
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+        throw new TypeError("a fetch implementation is required");
+    }
+    const url = `${normalizeBaseUrl(apiUrl)}/dispatch/apps/${encodeURIComponent(appSlug)}/member-sessions`;
+    return {
+        url,
+        newState() {
+            const bytes = new Uint8Array(HANDOFF_STATE_BYTES);
+            globalThis.crypto.getRandomValues(bytes);
+            return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+        },
+        async exchange(code, state) {
+            if (typeof code !== "string" || code.length === 0) {
+                throw new TypeError("a handoff code is required");
+            }
+            if (typeof state !== "string" || state.length === 0) {
+                throw new TypeError("the issued handoff state is required");
+            }
+            const response = await fetchImpl(url, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", Accept: "application/json" },
+                body: JSON.stringify({ v: ENVELOPE_VERSION, code, state }),
+                cache: "no-store",
+            });
+            if (!response.ok) {
+                const text = await boundedText(response);
+                let body;
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    body = undefined;
+                }
+                throw new MemberSessionError(response.status, errorCodeOf(body), `member session exchange failed (${response.status})`);
+            }
+            return parseMemberSession(await response.json());
+        },
+        async revoke(credential) {
+            if (typeof credential !== "string" || credential.length === 0) {
+                throw new TypeError("a member session credential is required");
+            }
+            try {
+                const response = await fetchImpl(`${url}/current`, {
+                    method: "DELETE",
+                    headers: { Authorization: `Bearer ${credential}` },
+                    cache: "no-store",
+                });
+                if (response.status === 204)
+                    return "revoked";
+                if (response.status === 401)
+                    return "alreadyInvalid";
+                return "unavailable";
+            }
+            catch {
+                return "unavailable";
+            }
+        },
+    };
+}
+//# sourceMappingURL=member-sessions.js.map