@nurama/sdk 0.0.0-stage → 1.4.0

package/dist/routes/auth.js

@@ -0,0 +1,454 @@
+/**
+ * Defines authentication-related methods for the NuramaClient.
+ * @param {NuramaClient} client - The NuramaClient instance.
+ * @returns {object} An object containing the authentication methods.
+ */
+export default function createAuthMethods(client) {
+    // Specify return type more accurately if possible, using AuthMethods interface
+    return {
+        /**
+         * Registers a new user.
+         * @param userData - User registration data.
+         * @returns {Promise<object>} Object containing user info and tokens.
+         */
+        async register(userData) {
+            const result = await client._request({
+                endpoint: "/v1/auth/register",
+                method: "POST",
+                body: userData,
+                sendJWT: false,
+            });
+            // Store tokens upon successful registration
+            if (result &&
+                result.tokens &&
+                result.tokens.access &&
+                result.tokens.refresh) {
+                // Accessing the private _setTokens - might need adjustment if visibility changes
+                client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+            }
+            else {
+                console.warn("Register response did not contain expected tokens.");
+            }
+            return result;
+        },
+        /**
+         * Logs in a user.
+         * @param credentials - Login credentials.
+         * @returns {Promise<object>} Object containing user info and tokens (or MFA challenge token).
+         */
+        async login(credentials) {
+            const result /* | MFAChallengeResponse */ = await client._request({
+                endpoint: "/v1/auth/login",
+                method: "POST",
+                body: credentials,
+                sendJWT: false,
+            });
+            // Store tokens upon successful login
+            if (result &&
+                "tokens" in result &&
+                result.tokens &&
+                result.tokens.access &&
+                result.tokens.refresh) {
+                client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+            }
+            else if (result &&
+                "tokens" in result &&
+                result.tokens &&
+                result.tokens.verifyMfa) {
+                // MFA Challenge - store the verifyMfa token for verification
+                client._setTokens(null, null);
+                client._setVerifyMfaToken(result.tokens.verifyMfa.token);
+            }
+            else {
+                console.warn("Login response did not contain expected tokens or MFA challenge.");
+                client._setTokens(null, null);
+            }
+            return result;
+        },
+        /**
+         * Logs out a user.
+         * @param refreshToken - The refresh token to invalidate.
+         * @returns {Promise<void>}
+         */
+        async logout(refreshToken) {
+            // Get the refresh token *before* potentially clearing it
+            const tokenToInvalidate = refreshToken || client._getRefreshToken();
+            if (tokenToInvalidate) {
+                try {
+                    await client._request({
+                        endpoint: "/v1/auth/logout",
+                        method: "POST",
+                        body: { refreshToken: tokenToInvalidate },
+                        sendJWT: false, // Logout might not need JWT, depends on API
+                    });
+                }
+                catch (error) {
+                    // Ignore errors - token may already be invalid/deleted
+                    // The goal is to clear local tokens regardless
+                    console.warn('Logout API call failed, but clearing local tokens:', error);
+                }
+            }
+            // Clear tokens locally regardless of API call success/failure
+            client._setTokens(null, null);
+        },
+        /**
+         * Refreshes user tokens.
+         * @param refreshToken - The refresh token.
+         * @returns {Promise<object>} Object containing new access and refresh tokens.
+         */
+        async refreshTokens(refreshToken) {
+            const tokenToUse = refreshToken || client._getRefreshToken();
+            if (!tokenToUse) {
+                throw new Error("No refresh token provided or found in client storage.");
+            }
+            const result = await client._request({
+                endpoint: "/v1/auth/refresh-tokens",
+                method: "POST",
+                body: { refreshToken: tokenToUse },
+                sendJWT: false, // Refresh endpoint uses the refresh token, not the access token
+                _isInternalRefresh: true, // Mark as internal to prevent recursive refresh loop if called by _request
+            });
+            // Store the *new* tokens
+            if (result && result.access && result.refresh) {
+                client._setTokens(result.access.token, result.refresh.token, result.access.expires, result.refresh.expires);
+            }
+            else {
+                console.warn("Refresh response did not contain expected tokens.");
+                // Clear tokens if refresh failed to return new ones
+                client._setTokens(null, null);
+            }
+            return result;
+        },
+        /**
+         * Forgets a user's password.
+         * @param email - The user's email address.
+         * @returns {Promise<void>}
+         */
+        async forgotPassword(email) {
+            await client._request({
+                // Specify void return type
+                endpoint: "/v1/auth/forgot-password",
+                method: "POST",
+                body: { email },
+                sendJWT: false, // Usually doesn't require JWT
+            });
+        },
+        /**
+         * Resets a user's password.
+         * @param params - Input parameters.
+         * @param params.token - The password reset token.
+         * @param params.password - The new password.
+         * @returns Promise resolving when complete.
+         */
+        async resetPassword({ token, password }) {
+            await client._request({
+                // Specify void return type
+                endpoint: "/v1/auth/reset-password",
+                method: "POST",
+                body: { token, password },
+                sendJWT: false, // Token is the authentication here
+            });
+        },
+        /**
+         * Sends a verification email to the authenticated user.
+         * @returns Promise resolving when complete.
+         */
+        async sendVerificationEmail() {
+            await client._request({
+                // Specify void return type
+                endpoint: "/v1/auth/send-verification-email",
+                method: "POST",
+                sendJWT: true,
+            });
+        },
+        /**
+         * Public, unauthenticated resend of the verification email keyed by
+         * address. For users past the verification grace window who can't log
+         * in or call the authed sendVerificationEmail. Always resolves (the
+         * server returns 204 regardless of whether the email exists).
+         * @param email - The email address to resend the verification link to.
+         */
+        async resendVerification(email) {
+            await client._request({
+                endpoint: "/v1/auth/resend-verification",
+                method: "POST",
+                body: { email },
+                sendJWT: false,
+            });
+        },
+        /**
+         * Verifies a user's email using the provided token.
+         * @param token - The email verification token.
+         * @returns Promise resolving when complete.
+         */
+        async verifyEmail(token) {
+            await client._request({
+                // Specify void return type
+                endpoint: `/v1/auth/verify-email?token=${encodeURIComponent(token)}`,
+                method: "POST",
+                sendJWT: false, // Token is the authentication here
+            });
+        },
+        /**
+         * Enables multi-factor authentication for the authenticated user.
+         * @returns Promise resolving to MFA setup details (secret, OTP URL, backup codes).
+         */
+        async enableMfa() {
+            return client._request({
+                endpoint: "/v1/auth/enable-mfa",
+                method: "POST",
+                sendJWT: true,
+            });
+        },
+        /**
+         * Verifies an MFA token (e.g., TOTP code).
+         * This is used both during initial MFA setup and during login challenges.
+         * @param mfaToken - The MFA token code.
+         * @returns Promise resolving to user/token data upon successful verification.
+         */
+        async verifyMfa(mfaToken) {
+            // Response can be full login data (if completing challenge) or just user data (if setting up)
+            // Check if we have a verifyMfa token from login (for login challenge)
+            const verifyMfaToken = client._getVerifyMfaToken();
+            const requestOptions = {
+                endpoint: "/v1/auth/verify-mfa",
+                method: "POST",
+                body: { mfaToken },
+            };
+            if (verifyMfaToken) {
+                // During MFA login challenge - use the verifyMfa token
+                requestOptions.sendJWT = false;
+                requestOptions.customHeaders = {
+                    'Authorization': `Bearer ${verifyMfaToken}`
+                };
+            }
+            else {
+                // During MFA setup - use regular access token
+                requestOptions.sendJWT = true;
+            }
+            const result = await client._request(requestOptions);
+            // If login challenge was completed, set the new tokens and clear verifyMfa token
+            if (result && result.tokens?.access) {
+                client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+                // Clear the verifyMfa token as it's no longer needed
+                client._setVerifyMfaToken(null);
+            }
+            return result;
+        },
+        /**
+         * Verifies an MFA backup code.
+         * This is used during login when a user has lost access to their authenticator app.
+         * @param backupCode - The backup code (8-character hex string).
+         * @returns Promise resolving to user/token data upon successful verification.
+         */
+        async verifyBackupCode(backupCode) {
+            // Check if we have a verifyMfa token from login (for login challenge)
+            const verifyMfaToken = client._getVerifyMfaToken();
+            const requestOptions = {
+                endpoint: "/v1/auth/verify-backup-code",
+                method: "POST",
+                body: { backupCode },
+            };
+            if (verifyMfaToken) {
+                // During MFA login challenge - use the verifyMfa token
+                requestOptions.sendJWT = false;
+                requestOptions.customHeaders = {
+                    'Authorization': `Bearer ${verifyMfaToken}`
+                };
+            }
+            else {
+                // During MFA setup - use regular access token
+                requestOptions.sendJWT = true;
+            }
+            const result = await client._request(requestOptions);
+            // If login challenge was completed, set the new tokens and clear verifyMfa token
+            if (result && result.tokens?.access) {
+                client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+                // Clear the verifyMfa token as it's no longer needed
+                client._setVerifyMfaToken(null);
+            }
+            return result;
+        },
+        /**
+         * Disables multi-factor authentication for the authenticated user.
+         * Requires a current valid MFA token for confirmation.
+         * @param mfaToken - The current MFA token code.
+         * @returns Promise resolving when complete.
+         */
+        async disableMfa(mfaToken) {
+            await client._request({
+                // Specify void return type
+                endpoint: "/v1/auth/disable-mfa",
+                method: "POST",
+                body: { mfaToken }, // Use interface for body
+                sendJWT: true,
+            });
+        },
+        /**
+         * Changes the authenticated user's password.
+         * Requires current password verification and MFA token if MFA is enabled.
+         * All refresh tokens will be invalidated after password change.
+         * @param currentPassword - The current password for verification.
+         * @param newPassword - The new password.
+         * @param mfaToken - MFA token (required if MFA is enabled).
+         * @returns Promise resolving when complete.
+         */
+        async changePassword(currentPassword, newPassword, mfaToken) {
+            await client._request({
+                endpoint: "/v1/auth/change-password",
+                method: "POST",
+                body: { currentPassword, newPassword, mfaToken },
+                sendJWT: true,
+            });
+            // Clear local tokens since all sessions are invalidated
+            client._setTokens(null, null);
+        },
+        /**
+         * Locks a user account using a lock account token.
+         * This is used when a user receives a password changed notification
+         * for a change they did not initiate, allowing them to immediately
+         * secure their account.
+         * @param token - The lock account token from the password changed email.
+         * @returns Promise resolving when the account is locked.
+         */
+        async lockAccount(token) {
+            await client._request({
+                endpoint: "/v1/auth/lock-account",
+                method: "POST",
+                body: { token },
+                sendJWT: false, // Token is the authentication here
+            });
+            // Clear local tokens since the account is now locked
+            client._setTokens(null, null);
+        },
+        /**
+         * Sets a password for an OAuth-only user account.
+         * This allows OAuth users to add local authentication as a backup.
+         * @param password - The password to set.
+         * @param mfaToken - MFA token (required if MFA is enabled).
+         * @returns Promise resolving when complete.
+         */
+        async setPassword(password, mfaToken) {
+            await client._request({
+                endpoint: "/v1/auth/set-password",
+                method: "POST",
+                body: { password, mfaToken },
+                sendJWT: true,
+            });
+        },
+        /**
+         * Links an OAuth provider to the authenticated user's account.
+         * This allows users to sign in with multiple OAuth providers.
+         * @param provider - The OAuth provider to link (google, apple, microsoft, adobe).
+         * @returns Promise resolving to user data with updated linked providers.
+         */
+        async linkOAuthProvider(provider) {
+            const result = await client._request({
+                endpoint: `/v1/auth/${provider}/link`,
+                method: "POST",
+                sendJWT: true,
+            });
+            return result;
+        },
+        /**
+         * Unlinks an OAuth provider from the authenticated user's account.
+         * User must have at least one authentication method remaining (password or another OAuth provider).
+         * @param provider - The OAuth provider to unlink (google, apple, microsoft, adobe).
+         * @returns Promise resolving when complete.
+         */
+        async unlinkOAuthProvider(provider) {
+            await client._request({
+                endpoint: `/v1/auth/oauth/${provider}/unlink`,
+                method: "DELETE",
+                sendJWT: true,
+            });
+        },
+        /**
+         * Gets all OAuth providers linked to the authenticated user's account.
+         * @returns Promise resolving to array of linked OAuth providers.
+         */
+        async getLinkedOAuthProviders() {
+            return client._request({
+                endpoint: "/v1/auth/oauth/providers",
+                method: "GET",
+                sendJWT: true,
+            });
+        },
+        /**
+         * Exchanges an OAuth authorization code for JWT tokens.
+         * This is called after the OAuth callback redirects the user back to the app with an exchange code.
+         * The exchange code is a short-lived (5 min), single-use token that can be traded for JWT tokens.
+         * @param code - The exchange code received from the OAuth callback.
+         * @returns Promise resolving to user data, tokens, and optional return URL.
+         */
+        /**
+         * Registers a guest account for public chat participation.
+         * Always returns void (204) regardless of outcome for anti-enumeration.
+         * @param data - Guest registration data (email, displayName, optional approved color, publicToken).
+         */
+        async registerGuest(data) {
+            await client._request({
+                endpoint: "/v1/auth/register-guest",
+                method: "POST",
+                body: data,
+                sendJWT: false,
+            });
+        },
+        /**
+         * Verifies a guest account using the token from the verification email.
+         * Stores auth tokens on success and returns user data.
+         * @param token - The guest verification token.
+         * @returns Promise resolving to user data and auth tokens.
+         */
+        async verifyGuest(token) {
+            const result = await client._request({
+                endpoint: `/v1/auth/verify-guest?token=${encodeURIComponent(token)}`,
+                method: "POST",
+                sendJWT: false,
+            });
+            if (result?.tokens?.access && result?.tokens?.refresh) {
+                client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+            }
+            return result;
+        },
+        /**
+         * Upgrades a guest account to a standard account with a password.
+         * Requires the user to be authenticated as a guest.
+         * @param data - Upgrade data (password, optional firstName, lastName, company, userName).
+         * @returns Promise resolving to the upgraded user data.
+         */
+        async upgradeGuest(data) {
+            return client._request({
+                endpoint: "/v1/auth/upgrade-guest",
+                method: "POST",
+                body: data,
+                sendJWT: true,
+            });
+        },
+        async exchangeOAuthCode(code) {
+            const result = await client._request({
+                endpoint: "/v1/auth/oauth/exchange",
+                method: "POST",
+                body: { code },
+                sendJWT: false, // No authentication needed - the code is the proof
+            });
+            // Store tokens upon successful exchange
+            // Check if this is MFA flow or regular auth
+            if (result && result.tokens) {
+                if (result.tokens.access && result.tokens.refresh) {
+                    // Regular auth - store access and refresh tokens
+                    client._setTokens(result.tokens.access.token, result.tokens.refresh.token, result.tokens.access.expires, result.tokens.refresh.expires);
+                }
+                else if (result.tokens.verifyMfa) {
+                    // MFA required - verifyMfa token will be handled by frontend
+                    console.log("[SDK] OAuth login requires MFA verification");
+                }
+                else {
+                    console.warn("OAuth exchange response did not contain expected tokens.");
+                }
+            }
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAyDA;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,MAAoB;IAC5D,+EAA+E;IAC/E,OAAO;QACL;;;;WAIG;QACH,KAAK,CAAC,QAAQ,CAAC,QAA0B;YACvC,MAAM,MAAM,GAA0B,MAAM,MAAM,CAAC,QAAQ,CAAC;gBAC1D,QAAQ,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,4CAA4C;YAC5C,IACE,MAAM;gBACN,MAAM,CAAC,MAAM;gBACb,MAAM,CAAC,MAAM,CAAC,MAAM;gBACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EACrB,CAAC;gBACD,iFAAiF;gBAChF,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,KAAK,CACT,WAA6B;YAE7B,MAAM,MAAM,CAAwB,4BAA4B,GAC9D,MAAM,MAAM,CAAC,QAAQ,CAAC;gBACpB,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACL,qCAAqC;YACrC,IACE,MAAM;gBACN,QAAQ,IAAI,MAAM;gBAClB,MAAM,CAAC,MAAM;gBACb,MAAM,CAAC,MAAM,CAAC,MAAM;gBACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EACrB,CAAC;gBACA,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;YACJ,CAAC;iBAAM,IACL,MAAM;gBACN,QAAQ,IAAI,MAAM;gBAClB,MAAM,CAAC,MAAM;gBACb,MAAM,CAAC,MAAM,CAAC,SAAS,EACvB,CAAC;gBACD,6DAA6D;gBAC5D,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACtC,MAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,kEAAkE,CACnE,CAAC;gBACD,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,MAAM,CAAC,YAAoB;YAC/B,yDAAyD;YACzD,MAAM,iBAAiB,GACrB,YAAY,IAAK,MAAc,CAAC,gBAAgB,EAAE,CAAC;YAErD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC;wBACpB,QAAQ,EAAE,iBAAiB;wBAC3B,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE;wBACzC,OAAO,EAAE,KAAK,EAAE,4CAA4C;qBAC7D,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,uDAAuD;oBACvD,+CAA+C;oBAC/C,OAAO,CAAC,IAAI,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YACD,8DAA8D;YAC7D,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,aAAa,CAAC,YAAqB;YACvC,MAAM,UAAU,GAAG,YAAY,IAAK,MAAc,CAAC,gBAAgB,EAAE,CAAC;YACtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAoB,MAAM,MAAM,CAAC,QAAQ,CAAC;gBACpD,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;gBAClC,OAAO,EAAE,KAAK,EAAE,gEAAgE;gBAChF,kBAAkB,EAAE,IAAI,EAAE,2EAA2E;aACtG,CAAC,CAAC;YACH,yBAAyB;YACzB,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7C,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,KAAK,EACnB,MAAM,CAAC,OAAO,CAAC,KAAK,EACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EACrB,MAAM,CAAC,OAAO,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;gBAClE,oDAAoD;gBACnD,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,2BAA2B;gBAC3B,QAAQ,EAAE,0BAA0B;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE;gBACf,OAAO,EAAE,KAAK,EAAE,8BAA8B;aAC/C,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAqB;YACxD,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,2BAA2B;gBAC3B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACzB,OAAO,EAAE,KAAK,EAAE,mCAAmC;aACpD,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,qBAAqB;YACzB,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,2BAA2B;gBAC3B,QAAQ,EAAE,kCAAkC;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;YACpC,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,8BAA8B;gBACxC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,2BAA2B;gBAC3B,QAAQ,EAAE,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,EAAE,mCAAmC;aACpD,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS;YACb,OAAO,MAAM,CAAC,QAAQ,CAAoB;gBACxC,QAAQ,EAAE,qBAAqB;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC9B,8FAA8F;YAE9F,sEAAsE;YACtE,MAAM,cAAc,GAAI,MAAc,CAAC,kBAAkB,EAAE,CAAC;YAE5D,MAAM,cAAc,GAAQ;gBAC1B,QAAQ,EAAE,qBAAqB;gBAC/B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAA0B;aAC3C,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,uDAAuD;gBACvD,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;gBAC/B,cAAc,CAAC,aAAa,GAAG;oBAC7B,eAAe,EAAE,UAAU,cAAc,EAAE;iBAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAoB,cAAc,CAAC,CAAC;YAExE,iFAAiF;YACjF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;gBACF,qDAAqD;gBACpD,MAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,gBAAgB,CAAC,UAAkB;YACvC,sEAAsE;YACtE,MAAM,cAAc,GAAI,MAAc,CAAC,kBAAkB,EAAE,CAAC;YAE5D,MAAM,cAAc,GAAQ;gBAC1B,QAAQ,EAAE,6BAA6B;gBACvC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,UAAU,EAAiC;aACpD,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,uDAAuD;gBACvD,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;gBAC/B,cAAc,CAAC,aAAa,GAAG;oBAC7B,eAAe,EAAE,UAAU,cAAc,EAAE;iBAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,8CAA8C;gBAC9C,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAoB,cAAc,CAAC,CAAC;YAExE,iFAAiF;YACjF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;gBACF,qDAAqD;gBACpD,MAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,UAAU,CAAC,QAAgB;YAC/B,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,2BAA2B;gBAC3B,QAAQ,EAAE,sBAAsB;gBAChC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAA2B,EAAE,yBAAyB;gBACtE,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,WAAmB,EAAE,QAAiB;YAClF,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,0BAA0B;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAA+B;gBAC7E,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,wDAAwD;YACvD,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,uBAAuB;gBACjC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAA+B;gBAC5C,OAAO,EAAE,KAAK,EAAE,mCAAmC;aACpD,CAAC,CAAC;YAEH,qDAAqD;YACpD,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,QAAiB;YACnD,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,uBAAuB;gBACjC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAC5B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,iBAAiB,CAAC,QAAuB;YAC7C,MAAM,MAAM,GAA0B,MAAM,MAAM,CAAC,QAAQ,CAAC;gBAC1D,QAAQ,EAAE,YAAY,QAAQ,OAAO;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,mBAAmB,CAAC,QAAuB;YAC/C,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,kBAAkB,QAAQ,SAAS;gBAC7C,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,uBAAuB;YAC3B,OAAO,MAAM,CAAC,QAAQ,CAAuB;gBAC3C,QAAQ,EAAE,0BAA0B;gBACpC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED;;;;;;WAMG;QACH;;;;WAIG;QACH,KAAK,CAAC,aAAa,CAAC,IAAiF;YACnG,MAAM,MAAM,CAAC,QAAQ,CAAO;gBAC1B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,MAAM,GAA0B,MAAM,MAAM,CAAC,QAAQ,CAAC;gBAC1D,QAAQ,EAAE,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrD,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,YAAY,CAAC,IAAsG;YACvH,OAAO,MAAM,CAAC,QAAQ,CAAiB;gBACrC,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;YAClC,MAAM,MAAM,GAA0B,MAAM,MAAM,CAAC,QAAQ,CAAC;gBAC1D,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,IAAI,EAAiC;gBAC7C,OAAO,EAAE,KAAK,EAAE,mDAAmD;aACpE,CAAC,CAAC;YAEH,wCAAwC;YACxC,4CAA4C;YAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAClD,iDAAiD;oBAChD,MAAc,CAAC,UAAU,CACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC9B,CAAC;gBACJ,CAAC;qBAAM,IAAK,MAAM,CAAC,MAAc,CAAC,SAAS,EAAE,CAAC;oBAC5C,6DAA6D;oBAC7D,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;KAEF,CAAC;AACJ,CAAC"}

package/dist/routes/blogPosts.d.ts

@@ -0,0 +1,17 @@
+import NuramaClient from '../NuramaClient.js';
+import type { BlogPostListParams, BlogPostListResponse } from '@nurama/types';
+/**
+ * Read-only blog feed (Nurama News on the /news page) sourced via the
+ * backend's Ghost Content API proxy. Auth: any signed-in user. No
+ * workspace coupling — the feed is platform-level, identical for every
+ * user.
+ *
+ * The proxy normalises Ghost's payload and sanitises post HTML
+ * server-side, so the returned `bodyHtml` is safe to render via the
+ * FE's controlled HTML primitive inside a modal.
+ */
+export default function createBlogPostsMethods(client: NuramaClient): {
+    /** List the most recent Nurama News posts. */
+    listBlogPosts(params?: BlogPostListParams): Promise<BlogPostListResponse>;
+};
+//# sourceMappingURL=blogPosts.d.ts.map

package/dist/routes/blogPosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blogPosts.d.ts","sourceRoot":"","sources":["../../src/routes/blogPosts.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,sBAAsB,CAAC,MAAM,EAAE,YAAY;IAE/D,8CAA8C;2BAClB,kBAAkB,GAAQ,OAAO,CAAC,oBAAoB,CAAC;EAYtF"}

package/dist/routes/blogPosts.js

@@ -0,0 +1,29 @@
+/**
+ * Read-only blog feed (Nurama News on the /news page) sourced via the
+ * backend's Ghost Content API proxy. Auth: any signed-in user. No
+ * workspace coupling — the feed is platform-level, identical for every
+ * user.
+ *
+ * The proxy normalises Ghost's payload and sanitises post HTML
+ * server-side, so the returned `bodyHtml` is safe to render via the
+ * FE's controlled HTML primitive inside a modal.
+ */
+export default function createBlogPostsMethods(client) {
+    return {
+        /** List the most recent Nurama News posts. */
+        async listBlogPosts(params = {}) {
+            const search = new URLSearchParams();
+            if (params.limit != null)
+                search.set('limit', String(params.limit));
+            if (params.page != null)
+                search.set('page', String(params.page));
+            const query = search.toString();
+            return client._request({
+                endpoint: `/v1/blog-posts${query ? `?${query}` : ''}`,
+                method: 'GET',
+                sendJWT: true,
+            });
+        },
+    };
+}
+//# sourceMappingURL=blogPosts.js.map

package/dist/routes/blogPosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blogPosts.js","sourceRoot":"","sources":["../../src/routes/blogPosts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,sBAAsB,CAAC,MAAoB;IACjE,OAAO;QACL,8CAA8C;QAC9C,KAAK,CAAC,aAAa,CAAC,SAA6B,EAAE;YACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,QAAQ,CAAC;gBACrB,QAAQ,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}