@nevermined-io/ui-widgets-server 0.4.6 → 0.5.1

package/dist/create-init-token.js

@@ -4,20 +4,19 @@ const WIDGET_AUDIENCE = 'nvm:widgets';
 const DEFAULT_EXPIRES_IN = '5m';
 export async function createInitToken(options) {
     const { email, orgId, secretKey, expiresIn = DEFAULT_EXPIRES_IN } = options;
-    if (!secretKey?.trim())
-        throw new Error('secretKey is required');
-    if (!orgId?.trim())
-        throw new Error('orgId is required');
+    if (!secretKey?.trim()) throw new Error('secretKey is required');
+    if (!orgId?.trim()) throw new Error('orgId is required');
     const normalizedEmail = normalizeEmail(email);
     const secret = new TextEncoder().encode(secretKey);
     // `sub` is set to the email so the API's existence check on the claim
     // continues to pass without a parallel API change. The downstream
     // identity resolution uses the explicit `email` claim, not `sub`.
-    return new SignJWT({ orgId, email: normalizedEmail })
-        .setProtectedHeader({ alg: 'HS256' })
-        .setSubject(normalizedEmail)
-        .setAudience(WIDGET_AUDIENCE)
-        .setIssuedAt()
-        .setExpirationTime(expiresIn)
-        .sign(secret);
+    return new SignJWT({
+        orgId,
+        email: normalizedEmail
+    }).setProtectedHeader({
+        alg: 'HS256'
+    }).setSubject(normalizedEmail).setAudience(WIDGET_AUDIENCE).setIssuedAt().setExpirationTime(expiresIn).sign(secret);
 }
+
+//# sourceMappingURL=create-init-token.js.map

package/dist/create-init-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/create-init-token.ts"],"sourcesContent":["import { SignJWT } from 'jose'\nimport { normalizeEmail } from './normalize-email.js'\nimport type { CreateInitTokenOptions } from './types.js'\n\nconst WIDGET_AUDIENCE = 'nvm:widgets'\nconst DEFAULT_EXPIRES_IN = '5m'\n\nexport async function createInitToken(options: CreateInitTokenOptions): Promise<string> {\n  const { email, orgId, secretKey, expiresIn = DEFAULT_EXPIRES_IN } = options\n\n  if (!secretKey?.trim()) throw new Error('secretKey is required')\n  if (!orgId?.trim()) throw new Error('orgId is required')\n\n  const normalizedEmail = normalizeEmail(email)\n\n  const secret = new TextEncoder().encode(secretKey)\n\n  // `sub` is set to the email so the API's existence check on the claim\n  // continues to pass without a parallel API change. The downstream\n  // identity resolution uses the explicit `email` claim, not `sub`.\n  return new SignJWT({ orgId, email: normalizedEmail })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setSubject(normalizedEmail)\n    .setAudience(WIDGET_AUDIENCE)\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n"],"names":["SignJWT","normalizeEmail","WIDGET_AUDIENCE","DEFAULT_EXPIRES_IN","createInitToken","options","email","orgId","secretKey","expiresIn","trim","Error","normalizedEmail","secret","TextEncoder","encode","setProtectedHeader","alg","setSubject","setAudience","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAC9B,SAASC,cAAc,QAAQ,uBAAsB;AAGrD,MAAMC,kBAAkB;AACxB,MAAMC,qBAAqB;AAE3B,OAAO,eAAeC,gBAAgBC,OAA+B;IACnE,MAAM,EAAEC,KAAK,EAAEC,KAAK,EAAEC,SAAS,EAAEC,YAAYN,kBAAkB,EAAE,GAAGE;IAEpE,IAAI,CAACG,WAAWE,QAAQ,MAAM,IAAIC,MAAM;IACxC,IAAI,CAACJ,OAAOG,QAAQ,MAAM,IAAIC,MAAM;IAEpC,MAAMC,kBAAkBX,eAAeK;IAEvC,MAAMO,SAAS,IAAIC,cAAcC,MAAM,CAACP;IAExC,sEAAsE;IACtE,kEAAkE;IAClE,kEAAkE;IAClE,OAAO,IAAIR,QAAQ;QAAEO;QAAOD,OAAOM;IAAgB,GAChDI,kBAAkB,CAAC;QAAEC,KAAK;IAAQ,GAClCC,UAAU,CAACN,iBACXO,WAAW,CAACjB,iBACZkB,WAAW,GACXC,iBAAiB,CAACZ,WAClBa,IAAI,CAACT;AACV"}

package/dist/index.js

@@ -1 +1,3 @@
 export { createInitToken } from './create-init-token.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { createInitToken } from './create-init-token.js'\nexport type { CreateInitTokenOptions, InitTokenPayload } from './types.js'\n"],"names":["createInitToken"],"mappings":"AAAA,SAASA,eAAe,QAAQ,yBAAwB"}

package/dist/normalize-email.js

@@ -16,10 +16,8 @@ const EMAIL_MAX_LENGTH = 254;
  *
  * Throws with caller-friendly messages — the SDK is the first boundary that
  * knows the value is supposed to be an email.
- */
-export function normalizeEmail(email) {
-    if (!email?.trim())
-        throw new Error('email is required');
+ */ export function normalizeEmail(email) {
+    if (!email?.trim()) throw new Error('email is required');
     const normalized = email.trim().toLowerCase();
     if (normalized.length > EMAIL_MAX_LENGTH) {
         throw new Error(`email is too long (max ${EMAIL_MAX_LENGTH} chars per RFC 5321)`);
@@ -29,3 +27,5 @@ export function normalizeEmail(email) {
     }
     return normalized;
 }
+
+//# sourceMappingURL=normalize-email.js.map

package/dist/normalize-email.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/normalize-email.ts"],"sourcesContent":["// Matches the regex behind <input type=\"email\"> and what RFC 5322 implementations\n// accept in practice. Intentionally permissive — strict RFC validation belongs in\n// the integrator's auth layer, not here.\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n// RFC 5321 caps email addresses at 254 chars. Enforcing here prevents a broken\n// upstream integrator from ballooning the JWT and the server-side decode path.\nconst EMAIL_MAX_LENGTH = 254\n\n/**\n * Validates and normalizes an email to a canonical form: trimmed and lowercased,\n * capped at 254 chars (RFC 5321), and matched against a permissive format regex.\n *\n * Normalization is implicit so `Alice@Example.COM` and `alice@example.com` map\n * to the same Nevermined identity downstream (#1520 — \"one email = one user,\n * one wallet, one widget profile\"). Callers should not rely on the original\n * case being preserved.\n *\n * Throws with caller-friendly messages — the SDK is the first boundary that\n * knows the value is supposed to be an email.\n */\nexport function normalizeEmail(email: string | undefined): string {\n  if (!email?.trim()) throw new Error('email is required')\n\n  const normalized = email.trim().toLowerCase()\n\n  if (normalized.length > EMAIL_MAX_LENGTH) {\n    throw new Error(`email is too long (max ${EMAIL_MAX_LENGTH} chars per RFC 5321)`)\n  }\n  if (!EMAIL_RE.test(normalized)) {\n    throw new Error('email must be a valid email address')\n  }\n\n  return normalized\n}\n"],"names":["EMAIL_RE","EMAIL_MAX_LENGTH","normalizeEmail","email","trim","Error","normalized","toLowerCase","length","test"],"mappings":"AAAA,kFAAkF;AAClF,kFAAkF;AAClF,yCAAyC;AACzC,MAAMA,WAAW;AACjB,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAMC,mBAAmB;AAEzB;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,eAAeC,KAAyB;IACtD,IAAI,CAACA,OAAOC,QAAQ,MAAM,IAAIC,MAAM;IAEpC,MAAMC,aAAaH,MAAMC,IAAI,GAAGG,WAAW;IAE3C,IAAID,WAAWE,MAAM,GAAGP,kBAAkB;QACxC,MAAM,IAAII,MAAM,CAAC,uBAAuB,EAAEJ,iBAAiB,oBAAoB,CAAC;IAClF;IACA,IAAI,CAACD,SAASS,IAAI,CAACH,aAAa;QAC9B,MAAM,IAAID,MAAM;IAClB;IAEA,OAAOC;AACT"}

package/dist/types.js

@@ -1 +1,3 @@
-export {};
+export { };
+
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export interface CreateInitTokenOptions {\n  /**\n   * The end user's email — the canonical Nevermined identity (#1520). The\n   * widget session API uses this to resolve or provision the Privy user.\n   *\n   * Validated and normalized at the SDK boundary: trimmed, lowercased, capped\n   * at 254 chars (RFC 5321), and matched against a basic format regex. The\n   * normalized value is what ends up in the JWT — callers should not rely on\n   * case being preserved.\n   */\n  email: string\n  orgId: string\n  secretKey: string\n  expiresIn?: string // default '5m'\n}\n\nexport interface InitTokenPayload {\n  /**\n   * Mirrors `email` so the widget session API's non-empty existence check on\n   * `sub` passes without a parallel API change. Do NOT read `sub` for identity\n   * downstream — read `email` instead. This claim will be dropped once the\n   * API stops reading `sub` (follow-up to #1520).\n   *\n   * @deprecated Read `email` instead. Kept temporarily for API compatibility.\n   */\n  sub: string\n  email: string\n  orgId: string\n  aud: string // 'nvm:widgets'\n  iat: number\n  exp: number\n}\n"],"names":[],"mappings":"AAgBA,WAeC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nevermined-io/ui-widgets-server",
-  "version": "0.4.6",
+  "version": "0.5.1",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -19,5 +19,25 @@
   ],
   "dependencies": {
     "jose": "4.15.9"
+  },
+  "nx": {
+    "targets": {
+      "build": {
+        "executor": "nx:run-commands",
+        "outputs": [
+          "{projectRoot}/dist"
+        ],
+        "cache": true,
+        "inputs": [
+          "production",
+          "^production",
+          "{workspaceRoot}/.swcrc.lib.json"
+        ],
+        "options": {
+          "cwd": "packages/ui-widgets-server",
+          "command": "pnpm exec swc src -d dist --strip-leading-paths --config-file ../../.swcrc.lib.json"
+        }
+      }
+    }
   }
 }