@mosano-product-framework/sdk 0.2.0 → 0.2.2

package/dist/client/index.js

@@ -1,10 +1,10 @@
-import { MPFGraphQLClient, isSubscription } from '../chunk-GQJ3QQPH.js';
-export { MPFGraphQLClient, buildUrl, createLoggingMiddleware, getOperationKind, isSubscription, joinPath } from '../chunk-GQJ3QQPH.js';
-export { AdminEmptySecretError, AdminEmptyUserIDError, createAdminAuthMiddleware, createTurnstileMiddleware, issueAdminToken } from '../chunk-K2ELAI2X.js';
-import { attachStandardMiddlewares } from '../chunk-LRM6JJ63.js';
-export { MAX_REQUEST_ATTEMPTS, MPFClient, TENANT_HEADER, TENANT_ROLE_HEADER, attachStandardMiddlewares, clearRetryFlag, createAuthMiddleware, createHttpClient, createRetryMiddleware, createTenantMiddleware, disableRetry, executeErrorMiddlewares, executeRequestMiddlewares, executeResponseMiddlewares, getRetryAttempt, isReplayableBody, isRetryDisabled, requestRetry, shouldRetryRequest } from '../chunk-LRM6JJ63.js';
-import { MPFAPIError } from '../chunk-AJWM5MDZ.js';
-export { MPFAPIError, MPFAuthError, MPFError, MPFNetworkError, MPFTimeoutError, MPFValidationError, isMPFAPIError, isMPFAuthError, isMPFError, isMPFNetworkError, isMPFValidationError } from '../chunk-AJWM5MDZ.js';
+import { MPFGraphQLClient, isSubscription } from '../chunk-2WY2XQCV.js';
+export { MPFGraphQLClient, buildUrl, createLoggingMiddleware, getOperationKind, isSubscription, joinPath } from '../chunk-2WY2XQCV.js';
+export { AdminEmptySecretError, AdminEmptyUserIDError, createAdminAuthMiddleware, createTurnstileMiddleware, issueAdminToken } from '../chunk-B3JXAPMM.js';
+import { attachStandardMiddlewares } from '../chunk-3OKR4MSV.js';
+export { MAX_REQUEST_ATTEMPTS, MPFClient, TENANT_HEADER, TENANT_ROLE_HEADER, attachStandardMiddlewares, clearRetryFlag, createAuthMiddleware, createHttpClient, createRetryMiddleware, createTenantMiddleware, disableRetry, executeErrorMiddlewares, executeRequestMiddlewares, executeResponseMiddlewares, getRetryAttempt, isReplayableBody, isRetryDisabled, requestRetry, shouldRetryRequest } from '../chunk-3OKR4MSV.js';
+import { MPFAPIError } from '../chunk-S5DKGPUY.js';
+export { MPFAPIError, MPFAuthError, MPFError, MPFNetworkError, MPFTimeoutError, MPFValidationError, isMPFAPIError, isMPFAuthError, isMPFError, isMPFNetworkError, isMPFValidationError } from '../chunk-S5DKGPUY.js';
 
 // src/client/graphql/ws-client.ts
 async function loadCreateClient() {

package/dist/client/middlewares/admin-auth.d.ts

@@ -3,7 +3,7 @@ import type { Middleware } from '../core/middleware.js';
  * Impersonation payload embedded in an admin token.
  *
  * Mirrors the Go `ActOnBehalfOf` struct
- * (`internal/go-chi-middleware-auth/types.go`), which the Go verifier reads
+ * (`pkg/go-chi-middleware-auth/types.go`), which the Go verifier reads
  * from the `act_on_behalf_of` JWT claim.
  */
 export interface AdminActOnBehalfOf {
@@ -24,7 +24,7 @@ export declare class AdminEmptyUserIDError extends Error {
  * Mints an HS256-signed Admin JWT that impersonates `actOnBehalfOf`.
  *
  * The minted token interoperates byte-for-byte with the Go verifier in
- * `internal/go-chi-middleware-auth/auth.go` (`parseAdmin`):
+ * `pkg/go-chi-middleware-auth/auth.go` (`parseAdmin`):
  *   - Protected header `{ alg: 'HS256' }`.
  *   - Required `exp` claim (`now + ttlSeconds`), which the Go side enforces via
  *     `jwt.WithExpirationRequired()`.

package/dist/identity/index.js

@@ -1,6 +1,6 @@
-export { AuthClientV0, createAdminClient, createAuthClient, isMFARequired, isMFASetupRequired } from '../chunk-XAXFIIRT.js';
-import '../chunk-K2ELAI2X.js';
-import '../chunk-LRM6JJ63.js';
-import '../chunk-AJWM5MDZ.js';
+export { AuthClientV0, createAdminClient, createAuthClient, isMFARequired, isMFASetupRequired } from '../chunk-R5KABORE.js';
+import '../chunk-B3JXAPMM.js';
+import '../chunk-3OKR4MSV.js';
+import '../chunk-S5DKGPUY.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js

@@ -1,15 +1,15 @@
-import { peer_free_exports } from './chunk-GQJ3QQPH.js';
-export { peer_free_exports as client } from './chunk-GQJ3QQPH.js';
-import { auth_exports } from './chunk-GPWGOYCA.js';
-export { auth_exports as auth } from './chunk-GPWGOYCA.js';
-import { identity_exports } from './chunk-XAXFIIRT.js';
-export { identity_exports as identity } from './chunk-XAXFIIRT.js';
-import './chunk-K2ELAI2X.js';
-import { storage_exports } from './chunk-EXPYHNPV.js';
-export { storage_exports as storage } from './chunk-EXPYHNPV.js';
-import './chunk-LRM6JJ63.js';
-import './chunk-7WAV52EO.js';
-import './chunk-AJWM5MDZ.js';
+import { peer_free_exports } from './chunk-2WY2XQCV.js';
+export { peer_free_exports as client } from './chunk-2WY2XQCV.js';
+import { auth_exports } from './chunk-FYUVJL4T.js';
+export { auth_exports as auth } from './chunk-FYUVJL4T.js';
+import { identity_exports } from './chunk-R5KABORE.js';
+export { identity_exports as identity } from './chunk-R5KABORE.js';
+import './chunk-B3JXAPMM.js';
+import { storage_exports } from './chunk-HZWDNBJS.js';
+export { storage_exports as storage } from './chunk-HZWDNBJS.js';
+import './chunk-3OKR4MSV.js';
+import './chunk-NM63E6OB.js';
+import './chunk-S5DKGPUY.js';
 
 // src/index.ts
 var src_default = {

package/dist/react/index.js

@@ -1,5 +1,5 @@
-import { createDefaultStorage, createTenantSelection, SessionManager } from '../chunk-7WAV52EO.js';
-import { tryDecodeAccessToken, listTenants, defaultRoleForTenant, rolesForTenant } from '../chunk-AJWM5MDZ.js';
+import { createDefaultStorage, createTenantSelection, SessionManager } from '../chunk-NM63E6OB.js';
+import { tryDecodeAccessToken, listTenants, defaultRoleForTenant, rolesForTenant } from '../chunk-S5DKGPUY.js';
 import { createContext, useRef, useEffect, useMemo, useContext, useCallback, useSyncExternalStore } from 'react';
 import { jsx } from 'react/jsx-runtime';
 

package/dist/storage/index.js

@@ -1,5 +1,5 @@
-export { StorageClientV0, createStorageClient } from '../chunk-EXPYHNPV.js';
-import '../chunk-LRM6JJ63.js';
-import '../chunk-AJWM5MDZ.js';
+export { StorageClientV0, createStorageClient } from '../chunk-HZWDNBJS.js';
+import '../chunk-3OKR4MSV.js';
+import '../chunk-S5DKGPUY.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosano-product-framework/sdk",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "MPF SDK: typed clients for the MPF services",
   "type": "module",
   "main": "./dist/index.js",

package/dist/chunk-K2ELAI2X.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/client/middlewares/admin-auth.ts","../src/client/middlewares/turnstile.ts"],"names":[],"mappings":";;;AAmBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,kDAAkD,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,kDAAkD,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AA0BA,eAAsB,eAAA,CACpB,MAAA,EACA,aAAA,EACA,UAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,qBAAA,EAAsB;AAAA,EAClC;AACA,EAAA,IAAI,CAAC,cAAc,MAAA,EAAQ;AACzB,IAAA,MAAM,IAAI,qBAAA,EAAsB;AAAA,EAClC;AAEA,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAuD;AAAA,IAC3D,SAAS,aAAA,CAAc,MAAA;AAAA,IACvB,GAAI,cAAc,UAAA,GAAa,EAAE,cAAc,aAAA,CAAc,UAAA,KAAe;AAAC,GAC/E;AAEA,EAAA,OAAO,IAAI,QAAQ,EAAE,gBAAA,EAAkB,UAAU,CAAA,CAC9C,mBAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,YAAY,UAAU,CAAA,CACtB,kBAAkB,UAAA,GAAa,UAAU,CAAA,CACzC,IAAA,CAAK,GAAG,CAAA;AACb;AA+CO,SAAS,0BAA0B,OAAA,EAAiD;AACzF,EAAA,MAAM,cAAA,GACJ,WAAW,OAAA,IAAW,OAAA,CAAQ,UAAU,MAAA,GACpC,MAAM,OAAA,CAAQ,KAAA,GACd,MAAM;AACJ,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,UAAA,KAAe,OAAA,CAAQ,MAAA;AACtD,IAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,aAAA,EAAe,UAAU,CAAA;AAAA,EAC1D,CAAA;AAEN,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,cAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;;;ACnGO,SAAS,0BAA0B,OAAA,EAAiD;AACzF,EAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAe,GAAI,OAAA;AAErC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,WAAA;AAAA,IAEN,MAAM,UAAU,GAAA,EAA8C;AAE5D,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,kBAAkB,CAAA;AAC/C,MAAA,MAAM,WAAA,GAAc,eAAe,IAAA,CAAK,CAAA,IAAA,KAAQ,IAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAC,CAAA;AAE3E,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,OAAO,GAAA;AAAA,MACT;AAEA,MAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,EAAS;AAC7B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAC5C,MAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,KAAK,CAAA;AACtC,MAAA,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA;AAEnB,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-K2ELAI2X.js","sourcesContent":["import { SignJWT } from 'jose';\nimport type { Middleware } from '../core/middleware.js';\nimport { createAuthMiddleware } from './auth.js';\n\n/**\n * Impersonation payload embedded in an admin token.\n *\n * Mirrors the Go `ActOnBehalfOf` struct\n * (`internal/go-chi-middleware-auth/types.go`), which the Go verifier reads\n * from the `act_on_behalf_of` JWT claim.\n */\nexport interface AdminActOnBehalfOf {\n  /** The subject (user) the admin token acts on behalf of. Required. */\n  userId: string;\n  /** Optionally scopes the impersonation to a tenant. */\n  onTenantId?: string;\n}\n\n/** Error thrown when an admin token is minted without a signing secret. */\nexport class AdminEmptySecretError extends Error {\n  constructor() {\n    super('auth: admin JWT signing secret must not be empty');\n    this.name = 'AdminEmptySecretError';\n  }\n}\n\n/** Error thrown when an admin token is minted without a subject user id. */\nexport class AdminEmptyUserIDError extends Error {\n  constructor() {\n    super('auth: act_on_behalf_of.user_id must not be empty');\n    this.name = 'AdminEmptyUserIDError';\n  }\n}\n\n/**\n * Mints an HS256-signed Admin JWT that impersonates `actOnBehalfOf`.\n *\n * The minted token interoperates byte-for-byte with the Go verifier in\n * `internal/go-chi-middleware-auth/auth.go` (`parseAdmin`):\n *   - Protected header `{ alg: 'HS256' }`.\n *   - Required `exp` claim (`now + ttlSeconds`), which the Go side enforces via\n *     `jwt.WithExpirationRequired()`.\n *   - An `iat` claim of `now`.\n *   - An `act_on_behalf_of` object claim with `user_id` (required) and an\n *     optional `on_tenant_id`, matching the Go `ActOnBehalfOf` JSON tags.\n *\n * SECURITY: Minting an admin token requires the shared `ADMIN_JWT_SECRET`.\n * This secret grants the ability to impersonate ANY user, so it MUST ONLY be\n * used server-side or by trusted backend services. NEVER ship the secret to a\n * browser or any untrusted client, and never embed it in frontend bundles.\n *\n * @param secret - The shared HS256 signing secret (`ADMIN_JWT_SECRET`).\n * @param actOnBehalfOf - The principal to impersonate.\n * @param ttlSeconds - Token lifetime in seconds (added to the current time).\n * @returns The signed compact JWT string.\n * @throws {AdminEmptySecretError} when `secret` is empty.\n * @throws {AdminEmptyUserIDError} when `actOnBehalfOf.userId` is empty.\n */\nexport async function issueAdminToken(\n  secret: string,\n  actOnBehalfOf: AdminActOnBehalfOf,\n  ttlSeconds: number\n): Promise<string> {\n  if (!secret) {\n    throw new AdminEmptySecretError();\n  }\n  if (!actOnBehalfOf.userId) {\n    throw new AdminEmptyUserIDError();\n  }\n\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  const key = new TextEncoder().encode(secret);\n\n  const actClaim: { user_id: string; on_tenant_id?: string } = {\n    user_id: actOnBehalfOf.userId,\n    ...(actOnBehalfOf.onTenantId ? { on_tenant_id: actOnBehalfOf.onTenantId } : {}),\n  };\n\n  return new SignJWT({ act_on_behalf_of: actClaim })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt(nowSeconds)\n    .setExpirationTime(nowSeconds + ttlSeconds)\n    .sign(key);\n}\n\n/**\n * Options for the admin auth middleware.\n *\n * Exactly one of `token` (pre-minted) or `config` (mint-per-request) must be\n * provided.\n */\nexport type AdminAuthMiddlewareOptions =\n  | {\n      /** A pre-minted admin JWT to attach as `Authorization: Admin <token>`. */\n      token: string;\n      config?: never;\n    }\n  | {\n      token?: never;\n      /**\n       * Per-request minting config (analogous to Go's `AdminRoundTripper`):\n       * a fresh admin token is minted for every request.\n       */\n      config: {\n        /** The shared HS256 signing secret (`ADMIN_JWT_SECRET`). */\n        secret: string;\n        /** The principal to impersonate. */\n        actOnBehalfOf: AdminActOnBehalfOf;\n        /** Token lifetime in seconds. */\n        ttlSeconds: number;\n      };\n    };\n\n/**\n * Creates an admin authentication middleware that stamps an\n * `Authorization: Admin <token>` header on outgoing requests.\n *\n * Reuses {@link createAuthMiddleware} with `tokenType: 'Admin'`. Two ergonomics\n * are supported:\n *   - `{ token }`: attach a pre-minted admin token.\n *   - `{ config }`: mint a fresh admin token per request (like Go's\n *     `AdminRoundTripper`).\n *\n * SECURITY: When using `config`, the `ADMIN_JWT_SECRET` is held in memory and\n * used to mint tokens. Only construct this middleware server-side / in trusted\n * services. NEVER ship the secret to a browser.\n *\n * @param options - Either a pre-minted `token` or a minting `config`.\n * @returns A middleware instance.\n */\nexport function createAdminAuthMiddleware(options: AdminAuthMiddlewareOptions): Middleware {\n  const getAccessToken =\n    'token' in options && options.token !== undefined\n      ? () => options.token\n      : () => {\n          const { secret, actOnBehalfOf, ttlSeconds } = options.config;\n          return issueAdminToken(secret, actOnBehalfOf, ttlSeconds);\n        };\n\n  return createAuthMiddleware({\n    getAccessToken,\n    tokenType: 'Admin',\n  });\n}\n","import type { Middleware } from '../core/middleware.js';\nimport type { RequestContext } from '../core/types.js';\n\n/**\n * Options for the Turnstile middleware.\n */\nexport interface TurnstileMiddlewareOptions {\n  /**\n   * Async function that mints a fresh Turnstile token.\n   * Called once per protected request. Must return a valid token string.\n   * Should throw if token cannot be obtained.\n   */\n  getToken: () => Promise<string>;\n\n  /**\n   * URL path suffixes that require a Turnstile token.\n   * Matched against the end of the request URL path.\n   * Example: ['/sign-up-email-password', '/sign-in-email-password']\n   */\n  protectedPaths: string[];\n}\n\n/**\n * Creates a Cloudflare Turnstile middleware that attaches `X-Turnstile-Token`\n * headers to requests matching the configured protected paths.\n *\n * The middleware only calls `getToken()` for requests whose URL path ends\n * with one of the `protectedPaths` entries — all other requests pass through\n * untouched with zero overhead.\n *\n * @param options - Configuration options for the turnstile middleware\n * @returns A middleware instance\n *\n * @example\n * ```typescript\n * const turnstileMiddleware = createTurnstileMiddleware({\n *   getToken: async () => {\n *     // Render Turnstile widget and return token\n *     return await turnstile.execute(siteKey);\n *   },\n *   protectedPaths: ['/sign-up-email-password', '/sign-in-email-password'],\n * });\n * ```\n */\nexport function createTurnstileMiddleware(options: TurnstileMiddlewareOptions): Middleware {\n  const { getToken, protectedPaths } = options;\n\n  return {\n    name: 'turnstile',\n\n    async onRequest(ctx: RequestContext): Promise<RequestContext> {\n      // Check if this request URL matches any protected path\n      const url = new URL(ctx.url, 'http://localhost');\n      const isProtected = protectedPaths.some(path => url.pathname.endsWith(path));\n\n      if (!isProtected) {\n        return ctx;\n      }\n\n      const token = await getToken();\n      const headers = new Headers(ctx.init.headers);\n      headers.set('X-Turnstile-Token', token);\n      ctx.init.headers = headers;\n\n      return ctx;\n    },\n  };\n}\n"]}