@palbase/web 4.0.1 → 4.0.2

package/dist/{analytics-facade-DwOtlXPP.d.cts → analytics-facade-CaluA4bW.d.cts}

@@ -1663,7 +1663,13 @@ type AuthChangeEvent = {
     user: AuthUser;
 } | {
     type: 'signedOut';
-    reason: 'userInitiated' | 'sessionExpired';
+    /**
+     * `userInitiated` — pb.auth.signOut(); `sessionExpired` — a refresh
+     * ultimately failed; `accountDeleted` — this device ran deleteAccount();
+     * `sessionInvalid` — a server-side session kill (erased/revoked subject)
+     * was observed on a request and the client tore down reactively.
+     */
+    reason: 'userInitiated' | 'sessionExpired' | 'accountDeleted' | 'sessionInvalid';
 } | {
     type: 'tokenRefreshed';
 };
@@ -1672,6 +1678,7 @@ declare class PalbeAuth {
     private readonly rt;
     private cachedUser;
     private signingOut;
+    private nextSignOutReason;
     private signingIn;
     private signedInState;
     private hydratingUser;
@@ -1690,6 +1697,24 @@ declare class PalbeAuth {
         password: string;
     }): Promise<AuthSuccess>;
     signOut(): Promise<void>;
+    /**
+     * Self-service account erasure ("right to be forgotten"). Calls palauth
+     * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
+     * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
+     * session. On 202 the erasure workflow is durably queued AND every session is
+     * already revoked server-side — so we tear down local state (mirroring
+     * `signOut()`'s clear, minus the pointless `/logout`) and emit
+     * `signedOut{reason:'accountDeleted'}`.
+     *
+     * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
+     * the request throws BEFORE the teardown line, so the local session is left
+     * fully intact — the deletion did not happen and the user is still signed in.
+     */
+    deleteAccount(params?: {
+        password?: string;
+    }): Promise<{
+        erasureId: string;
+    }>;
     getUser(): Promise<AuthUser>;
     refreshUser(): Promise<AuthUser>;
     /**

package/dist/{analytics-facade-Nk6J9Ncm.d.ts → analytics-facade-Cp3d4QI-.d.ts}

@@ -1663,7 +1663,13 @@ type AuthChangeEvent = {
     user: AuthUser;
 } | {
     type: 'signedOut';
-    reason: 'userInitiated' | 'sessionExpired';
+    /**
+     * `userInitiated` — pb.auth.signOut(); `sessionExpired` — a refresh
+     * ultimately failed; `accountDeleted` — this device ran deleteAccount();
+     * `sessionInvalid` — a server-side session kill (erased/revoked subject)
+     * was observed on a request and the client tore down reactively.
+     */
+    reason: 'userInitiated' | 'sessionExpired' | 'accountDeleted' | 'sessionInvalid';
 } | {
     type: 'tokenRefreshed';
 };
@@ -1672,6 +1678,7 @@ declare class PalbeAuth {
     private readonly rt;
     private cachedUser;
     private signingOut;
+    private nextSignOutReason;
     private signingIn;
     private signedInState;
     private hydratingUser;
@@ -1690,6 +1697,24 @@ declare class PalbeAuth {
         password: string;
     }): Promise<AuthSuccess>;
     signOut(): Promise<void>;
+    /**
+     * Self-service account erasure ("right to be forgotten"). Calls palauth
+     * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
+     * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
+     * session. On 202 the erasure workflow is durably queued AND every session is
+     * already revoked server-side — so we tear down local state (mirroring
+     * `signOut()`'s clear, minus the pointless `/logout`) and emit
+     * `signedOut{reason:'accountDeleted'}`.
+     *
+     * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
+     * the request throws BEFORE the teardown line, so the local session is left
+     * fully intact — the deletion did not happen and the user is still signed in.
+     */
+    deleteAccount(params?: {
+        password?: string;
+    }): Promise<{
+        erasureId: string;
+    }>;
     getUser(): Promise<AuthUser>;
     refreshUser(): Promise<AuthUser>;
     /**

package/dist/{chunk-NXEPAEF5.js → chunk-CFDU23TB.js}

@@ -1,6 +1,6 @@
 // src/api-key.ts
-var API_KEY_RE = /^pb_([a-z0-9]+)_[cs][A-Za-z0-9]{20}$/;
-var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+var API_KEY_RE = /^pb_([a-z0-9]{4,24})_[cs][A-Za-z0-9]{20}$/;
+var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;
 function environmentRefFromApiKey(apiKey) {
   const m = API_KEY_RE.exec(apiKey);
   return m ? m[1] ?? "" : "";
@@ -14,4 +14,4 @@ export {
   environmentRefFromApiKey,
   environmentRefFromPublishableApiKey
 };
-//# sourceMappingURL=chunk-NXEPAEF5.js.map
+//# sourceMappingURL=chunk-CFDU23TB.js.map

package/dist/chunk-CFDU23TB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-key.ts"],"sourcesContent":["/**\n * `pb_<environmentRef>_<scope><random>` → environmentRef ('' if malformed).\n * Utility for callers that only have a raw key. App-bound runtime storage and\n * palbe/next cookie naming use the explicit `PalbeConfig.environmentRef` emitted\n * by `palbe-gen`.\n *\n * The key is shape-validated (prefix `pb`, a 4-24 character lowercase ASCII\n * alphanumeric environmentRef, and a `<scope><20-base62-random>` secret segment\n * where scope ∈ {c,s}) before a ref is returned. A structurally-invalid key returns\n * '' so session storage stays\n * UNSCOPED rather than getting bound to a partially-parsed ref — a loose parse\n * (e.g. `pb_victim_cXX`) must not scope persisted sessions to `victim` and\n * hydrate a session belonging to a different, real key. The backend remains the\n * authority that rejects a bad key on the first request; this keeps the client's\n * local session-storage scoping honest. (Audit finding apikey-ref-mismatch.)\n */\nconst API_KEY_RE = /^pb_([a-z0-9]{4,24})_[cs][A-Za-z0-9]{20}$/;\nconst PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;\n\nexport function environmentRefFromApiKey(apiKey: string): string {\n  const m = API_KEY_RE.exec(apiKey);\n  return m ? (m[1] ?? '') : '';\n}\n\n/** Internal app-runtime parser: browser config accepts publishable keys only. */\nexport function environmentRefFromPublishableApiKey(apiKey: string): string {\n  const match = PUBLISHABLE_API_KEY_RE.exec(apiKey);\n  return match ? (match[1] ?? '') : '';\n}\n"],"mappings":";AAgBA,IAAM,aAAa;AACnB,IAAM,yBAAyB;AAExB,SAAS,yBAAyB,QAAwB;AAC/D,QAAM,IAAI,WAAW,KAAK,MAAM;AAChC,SAAO,IAAK,EAAE,CAAC,KAAK,KAAM;AAC5B;AAGO,SAAS,oCAAoC,QAAwB;AAC1E,QAAM,QAAQ,uBAAuB,KAAK,MAAM;AAChD,SAAO,QAAS,MAAM,CAAC,KAAK,KAAM;AACpC;","names":[]}

package/dist/{chunk-TGDS6VMT.js → chunk-TW6YN354.js}

@@ -1,6 +1,6 @@
 import {
   environmentRefFromPublishableApiKey
-} from "./chunk-NXEPAEF5.js";
+} from "./chunk-CFDU23TB.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -20,7 +20,7 @@ var PalbaseError = class extends Error {
   }
 };
 var PALBASE_DEFAULT_HOST = "api.palbase.studio";
-var API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
+var API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;
 function parseEnvironmentRef(apiKey) {
   return API_KEY_RE.exec(apiKey)?.[1] ?? null;
 }
@@ -397,6 +397,11 @@ var PERF_EXCLUDED_PREFIX = "/v1/analytics/";
 function isSelfTraced(path) {
   return path.startsWith(PERF_EXCLUDED_PREFIX);
 }
+function isSessionKilled(status, code) {
+  if (status === 401) return code === "session_revoked";
+  if (status === 403) return code === "subject_fenced" || code === "subject_erased";
+  return false;
+}
 function nowMs() {
   return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
@@ -432,7 +437,7 @@ async function palbeRequest(rt, method, path, spec = {}) {
   let res;
   try {
     res = await attempt();
-    if (res.error?.status === 401 && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
+    if (res.error?.status === 401 && res.error.code !== "session_revoked" && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
       try {
         await rt.tokenManager.refreshSession();
       } catch (refreshErr) {
@@ -452,6 +457,9 @@ async function palbeRequest(rt, method, path, spec = {}) {
     if (!isAbort(e)) record(asPalbaseError(e)?.status ?? 0);
     throw e;
   }
+  if (res.error && isSessionKilled(res.error.status, res.error.code)) {
+    rt.auth.reactiveTeardown();
+  }
   record(res.error?.status ?? 200);
   return unwrap(res);
 }
@@ -1426,7 +1434,8 @@ var PalbeAuth = class {
         if (!this.signedInState) return;
         this.signedInState = false;
         this.cachedUser = null;
-        const reason = this.signingOut ? "userInitiated" : "sessionExpired";
+        const reason = this.nextSignOutReason ?? (this.signingOut ? "userInitiated" : "sessionExpired");
+        this.nextSignOutReason = null;
         this.emitState({ status: "signedOut" });
         this.emitEvent({ type: "signedOut", reason });
       } else if (event === "TOKEN_REFRESHED") {
@@ -1439,6 +1448,10 @@ var PalbeAuth = class {
   rt;
   cachedUser = null;
   signingOut = false;
+  // Explicit signedOut reason pinned for the NEXT session clear (deleteAccount /
+  // reactiveTeardown set it before clearSession; the SIGNED_OUT handler consumes
+  // it exactly once, then resets to null → normal signOut/expiry split resumes).
+  nextSignOutReason = null;
   signingIn = false;
   // suppresses AuthClient's TOKEN_REFRESHED during re-signIn
   signedInState = false;
@@ -1486,6 +1499,45 @@ var PalbeAuth = class {
       this.cachedUser = null;
     }
   }
+  /**
+   * Self-service account erasure ("right to be forgotten"). Calls palauth
+   * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
+   * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
+   * session. On 202 the erasure workflow is durably queued AND every session is
+   * already revoked server-side — so we tear down local state (mirroring
+   * `signOut()`'s clear, minus the pointless `/logout`) and emit
+   * `signedOut{reason:'accountDeleted'}`.
+   *
+   * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
+   * the request throws BEFORE the teardown line, so the local session is left
+   * fully intact — the deletion did not happen and the user is still signed in.
+   */
+  async deleteAccount(params = {}) {
+    const res = await palbeRequest(this.rt, "DELETE", "/auth/user", {
+      body: params.password ? { password: params.password } : {}
+    });
+    this.nextSignOutReason = "accountDeleted";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+    return { erasureId: res.erasure_id };
+  }
+  /**
+   * @internal — invoked by the transport choke point (`request.ts`), not app code.
+   * Reactive teardown when the server reports the session is gone: a 403
+   * `subject_fenced`/`subject_erased` (subject being erased) or a 401
+   * `session_revoked`. Clears local state and emits
+   * `signedOut{reason:'sessionInvalid'}` exactly once (deduped by
+   * `signedInState`). An ordinary 403 authz denial does NOT reach here —
+   * `request.ts` matches only the exact session-kill codes.
+   */
+  reactiveTeardown() {
+    if (!this.signedInState) return;
+    this.nextSignOutReason = "sessionInvalid";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+  }
   async getUser() {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
@@ -8939,7 +8991,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "4.0.1";
+var VERSION = "4.0.2";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9366,4 +9418,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-TGDS6VMT.js.map
+//# sourceMappingURL=chunk-TW6YN354.js.map