@palbase/web 4.0.1 → 5.0.0

package/dist/{chunk-TGDS6VMT.js → chunk-XTQXFZUP.js}

@@ -1,379 +1,21 @@
+import {
+  BackendError,
+  HttpClient,
+  PalbaseError,
+  TokenManager,
+  asPalbaseError,
+  fromEnvelope,
+  fromPalbaseError,
+  isBackendError,
+  unwrap
+} from "./chunk-BNAGRUIQ.js";
 import {
   environmentRefFromPublishableApiKey
-} from "./chunk-NXEPAEF5.js";
+} from "./chunk-CFDU23TB.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
 
-// ../core/dist/index.js
-var CACHE_TTL_MS = 5 * 60 * 1e3;
-var PalbaseError = class extends Error {
-  code;
-  status;
-  details;
-  constructor(code, message, status, details) {
-    super(message);
-    this.name = "PalbaseError";
-    this.code = code;
-    this.status = status;
-    this.details = details;
-  }
-};
-var PALBASE_DEFAULT_HOST = "api.palbase.studio";
-var API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
-function parseEnvironmentRef(apiKey) {
-  return API_KEY_RE.exec(apiKey)?.[1] ?? null;
-}
-var MAX_RETRIES = 3;
-var INITIAL_BACKOFF_MS = 200;
-var MAX_RETRY_DELAY_MS = 1e4;
-var HttpClient = class _HttpClient {
-  apiKey;
-  options;
-  tokenManager = null;
-  /**
-   * Admin JWT used for platform admin endpoints (/admin/*).
-   * When set, takes precedence over tokenManager access token in the
-   * Authorization header.
-   */
-  adminToken = null;
-  interceptors = [];
-  constructor(apiKey, options) {
-    this.apiKey = apiKey;
-    this.options = options;
-  }
-  /** Set (or clear) the admin JWT used on admin endpoints. */
-  setAdminToken(token) {
-    this.adminToken = token;
-  }
-  /**
-   * Create a scoped HttpClient that adds the given extra headers to every
-   * request. The returned client shares the admin token and token manager
-   * with the parent at runtime — later changes on the parent propagate to
-   * the scope and vice versa.
-   *
-   * Typical use: adding an Environment-routing header for an admin call.
-   */
-  withHeaders(extra) {
-    const mergedHeaders = { ...this.options?.headers ?? {}, ...extra };
-    const scoped = new _HttpClient(this.apiKey, {
-      ...this.options,
-      headers: mergedHeaders
-    });
-    scoped.tokenManager = this.tokenManager;
-    Object.defineProperty(scoped, "adminToken", {
-      get: () => this.adminToken,
-      set: (v) => {
-        this.adminToken = v;
-      },
-      configurable: true
-    });
-    return scoped;
-  }
-  /** Add a request interceptor. Runs before every request. */
-  addInterceptor(interceptor) {
-    this.interceptors.push(interceptor);
-  }
-  async request(method, path, options) {
-    if (this.tokenManager?.isExpired() && this.tokenManager.getRefreshToken() && this.tokenManager.refreshFunction) {
-      try {
-        await this.tokenManager.refreshSession();
-      } catch (e) {
-        const status = e instanceof PalbaseError ? e.status : 0;
-        if (status === 400 || status === 401 || status === 403) {
-          this.tokenManager.clearSession();
-        } else {
-          throw e;
-        }
-      }
-    }
-    return this.executeWithRetry(method, path, options, 0);
-  }
-  getBaseUrl() {
-    if (this.options?.url) {
-      return this.options.url;
-    }
-    if (this.apiKey && parseEnvironmentRef(this.apiKey) === null) {
-      throw new PalbaseError(
-        "invalid_api_key",
-        'Invalid API key format. Expected pb_{environment_ref}_c{20_base62_chars}. For dev/staging pass `url: "https://api.dev.palbase.studio"` via options.',
-        0
-      );
-    }
-    return `https://${PALBASE_DEFAULT_HOST}`;
-  }
-  buildHeaders(options) {
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    const effectiveKey = this.apiKey;
-    if (effectiveKey) {
-      headers["apikey"] = effectiveKey;
-    }
-    const token = this.tokenManager?.getAccessToken();
-    if (token) {
-      headers["Authorization"] = `Bearer ${token}`;
-    }
-    if (this.adminToken) {
-      headers["Authorization"] = `Bearer ${this.adminToken}`;
-    }
-    if (this.options?.headers) {
-      Object.assign(headers, this.options.headers);
-    }
-    if (options?.headers) {
-      Object.assign(headers, options.headers);
-    }
-    return headers;
-  }
-  async executeWithRetry(method, path, options, attempt) {
-    const url = `${this.getBaseUrl()}${path}`;
-    const headers = this.buildHeaders(options);
-    for (const interceptor of this.interceptors) {
-      await interceptor({ headers, method, path });
-    }
-    const fetchOptions = {
-      method,
-      headers,
-      signal: options?.signal
-    };
-    if (options?.body !== void 0) {
-      fetchOptions.body = JSON.stringify(options.body);
-    }
-    let response;
-    try {
-      response = await fetch(url, fetchOptions);
-    } catch (error) {
-      if (attempt < MAX_RETRIES - 1) {
-        const backoff = INITIAL_BACKOFF_MS * 2 ** attempt;
-        await this.delay(backoff);
-        return this.executeWithRetry(method, path, options, attempt + 1);
-      }
-      throw new PalbaseError(
-        "network_error",
-        error instanceof Error ? error.message : "Network request failed",
-        0
-      );
-    }
-    if (response.status === 429) {
-      if (attempt < MAX_RETRIES - 1) {
-        const retryAfter = response.headers.get("Retry-After");
-        const parsed = retryAfter ? Number.parseInt(retryAfter, 10) : Number.NaN;
-        const delayMs = Number.isNaN(parsed) ? INITIAL_BACKOFF_MS * 2 ** attempt : Math.min(parsed * 1e3, MAX_RETRY_DELAY_MS);
-        await this.delay(delayMs);
-        return this.executeWithRetry(method, path, options, attempt + 1);
-      }
-    }
-    let data = null;
-    let errorBody;
-    const contentType = response.headers.get("Content-Type");
-    if (method !== "HEAD" && contentType?.includes("json")) {
-      const body = await response.json();
-      if (response.ok) {
-        data = body;
-      } else {
-        errorBody = body;
-      }
-    }
-    if (!response.ok) {
-      return {
-        data: null,
-        error: new PalbaseError(
-          errorBody?.error ?? "unknown_error",
-          errorBody?.error_description ?? response.statusText,
-          response.status,
-          errorBody
-        ),
-        status: response.status
-      };
-    }
-    const contentRange = response.headers.get("Content-Range");
-    let count;
-    if (contentRange) {
-      const slash = contentRange.lastIndexOf("/");
-      if (slash >= 0) {
-        const totalPart = contentRange.slice(slash + 1);
-        if (totalPart !== "*") {
-          const parsed = Number.parseInt(totalPart, 10);
-          if (!Number.isNaN(parsed)) {
-            count = parsed;
-          }
-        }
-      }
-    }
-    return {
-      data,
-      error: null,
-      status: response.status,
-      ...count !== void 0 ? { count } : {}
-    };
-  }
-  delay(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-};
-var TokenManager = class {
-  session = null;
-  listeners = /* @__PURE__ */ new Set();
-  refreshPromise = null;
-  refreshing = false;
-  refreshFunction = null;
-  setSession(session) {
-    this.session = session;
-    this.notify("SESSION_SET", session);
-  }
-  getAccessToken() {
-    return this.session?.accessToken ?? null;
-  }
-  getRefreshToken() {
-    return this.session?.refreshToken ?? null;
-  }
-  clearSession() {
-    this.session = null;
-    this.notify("SESSION_CLEARED", null);
-  }
-  isExpired() {
-    if (!this.session) return true;
-    return Date.now() >= this.session.expiresAt;
-  }
-  async refreshSession() {
-    if (!this.session?.refreshToken || !this.refreshFunction) {
-      return;
-    }
-    if (this.refreshPromise) {
-      return this.refreshPromise;
-    }
-    if (this.refreshing) {
-      return;
-    }
-    this.refreshing = true;
-    this.refreshPromise = this.executeRefresh(this.session.refreshToken);
-    try {
-      await this.refreshPromise;
-    } finally {
-      this.refreshPromise = null;
-      this.refreshing = false;
-    }
-  }
-  onAuthStateChange(callback) {
-    this.listeners.add(callback);
-    return () => {
-      this.listeners.delete(callback);
-    };
-  }
-  async executeRefresh(refreshToken) {
-    if (!this.refreshFunction) return;
-    const newSession = await this.refreshFunction(refreshToken);
-    this.setSession(newSession);
-  }
-  notify(event, session) {
-    for (const listener of this.listeners) {
-      listener(event, session);
-    }
-  }
-};
-
-// src/errors.ts
-var BackendError = class _BackendError extends Error {
-  kind;
-  code;
-  status;
-  requestId;
-  fields;
-  retryAfter;
-  data;
-  constructor(kind, params) {
-    super(params.message);
-    this.name = "BackendError";
-    this.kind = kind;
-    this.code = params.code;
-    this.status = params.status ?? 0;
-    this.requestId = params.requestId;
-    this.fields = params.fields;
-    this.retryAfter = params.retryAfter;
-    this.data = params.data;
-  }
-  static notConfigured() {
-    return new _BackendError("notConfigured", {
-      code: "not_configured",
-      message: "Palbe is not configured. Run 'palbase web link' in your project and make sure palbe.gen.ts is imported once at app startup."
-    });
-  }
-};
-function isFieldErrorArray(value) {
-  return Array.isArray(value) && value.length > 0 && value.every(
-    (v) => typeof v === "object" && v !== null && typeof v.field === "string" && typeof v.message === "string"
-  );
-}
-function pickField(value, key) {
-  if (typeof value === "object" && value !== null) {
-    return value[key];
-  }
-  return void 0;
-}
-function pickNumber(value, key) {
-  const n = pickField(value, key);
-  return typeof n === "number" ? n : void 0;
-}
-function pickString(value, key) {
-  const s = pickField(value, key);
-  return typeof s === "string" ? s : void 0;
-}
-function fromPalbaseError(err) {
-  const base = {
-    code: err.code,
-    message: err.message,
-    status: err.status,
-    requestId: pickString(err.details, "request_id"),
-    data: pickField(err.details, "data")
-  };
-  if (err.code === "network_error") return new BackendError("network", base);
-  if (err.status === 401) return new BackendError("unauthorized", base);
-  if (err.status === 429)
-    return new BackendError("rateLimited", {
-      ...base,
-      retryAfter: pickNumber(err.details, "retry_after")
-    });
-  const nested = pickField(err.details, "details");
-  if (err.status === 400 && isFieldErrorArray(nested))
-    return new BackendError("validation", { ...base, fields: nested });
-  return new BackendError("server", base);
-}
-function fromEnvelope(status, body) {
-  const code = pickString(body, "error") ?? "http_error";
-  const message = pickString(body, "error_description") ?? `HTTP ${status}`;
-  const requestId = pickString(body, "request_id");
-  const details = pickField(body, "details");
-  const params = {
-    code,
-    message,
-    status,
-    requestId,
-    data: pickField(body, "data")
-  };
-  if (status === 401) return new BackendError("unauthorized", params);
-  if (status === 429)
-    return new BackendError("rateLimited", {
-      ...params,
-      // Real 429 wire body has TOP-LEVEL retry_after; nested details is a fallback.
-      retryAfter: pickNumber(body, "retry_after") ?? pickNumber(details, "retry_after")
-    });
-  if (status === 400 && isFieldErrorArray(details))
-    return new BackendError("validation", { ...params, fields: details });
-  return new BackendError("server", params);
-}
-function isBackendError(e) {
-  return e instanceof BackendError || typeof e === "object" && e !== null && e.name === "BackendError" && typeof e.kind === "string";
-}
-function asPalbaseError(e) {
-  if (e instanceof PalbaseError) return e;
-  if (e instanceof Error && e.name === "PalbaseError") return e;
-  return null;
-}
-function unwrap(res) {
-  if (res.error) throw fromPalbaseError(res.error);
-  return res.data;
-}
-
 // src/perf/url-redactor.ts
 var ID_SEGMENT = /^(?:\d+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
 var EMAIL_SEGMENT = /(?:@|%40)/i;
@@ -397,6 +39,11 @@ var PERF_EXCLUDED_PREFIX = "/v1/analytics/";
 function isSelfTraced(path) {
   return path.startsWith(PERF_EXCLUDED_PREFIX);
 }
+function isSessionKilled(status, code) {
+  if (status === 401) return code === "session_revoked";
+  if (status === 403) return code === "subject_fenced" || code === "subject_erased";
+  return false;
+}
 function nowMs() {
   return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
@@ -432,7 +79,7 @@ async function palbeRequest(rt, method, path, spec = {}) {
   let res;
   try {
     res = await attempt();
-    if (res.error?.status === 401 && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
+    if (res.error?.status === 401 && res.error.code !== "session_revoked" && rt.tokenManager.getRefreshToken() && rt.tokenManager.refreshFunction) {
       try {
         await rt.tokenManager.refreshSession();
       } catch (refreshErr) {
@@ -452,6 +99,9 @@ async function palbeRequest(rt, method, path, spec = {}) {
     if (!isAbort(e)) record(asPalbaseError(e)?.status ?? 0);
     throw e;
   }
+  if (res.error && isSessionKilled(res.error.status, res.error.code)) {
+    rt.auth.reactiveTeardown();
+  }
   record(res.error?.status ?? 200);
   return unwrap(res);
 }
@@ -1426,7 +1076,8 @@ var PalbeAuth = class {
         if (!this.signedInState) return;
         this.signedInState = false;
         this.cachedUser = null;
-        const reason = this.signingOut ? "userInitiated" : "sessionExpired";
+        const reason = this.nextSignOutReason ?? (this.signingOut ? "userInitiated" : "sessionExpired");
+        this.nextSignOutReason = null;
         this.emitState({ status: "signedOut" });
         this.emitEvent({ type: "signedOut", reason });
       } else if (event === "TOKEN_REFRESHED") {
@@ -1439,6 +1090,10 @@ var PalbeAuth = class {
   rt;
   cachedUser = null;
   signingOut = false;
+  // Explicit signedOut reason pinned for the NEXT session clear (deleteAccount /
+  // reactiveTeardown set it before clearSession; the SIGNED_OUT handler consumes
+  // it exactly once, then resets to null → normal signOut/expiry split resumes).
+  nextSignOutReason = null;
   signingIn = false;
   // suppresses AuthClient's TOKEN_REFRESHED during re-signIn
   signedInState = false;
@@ -1486,6 +1141,45 @@ var PalbeAuth = class {
       this.cachedUser = null;
     }
   }
+  /**
+   * Self-service account erasure ("right to be forgotten"). Calls palauth
+   * `DELETE /auth/user` (session-authed + fresh re-auth): password users pass
+   * `{ password }`; passwordless/OAuth users rely on a freshly stepped-up
+   * session. On 202 the erasure workflow is durably queued AND every session is
+   * already revoked server-side — so we tear down local state (mirroring
+   * `signOut()`'s clear, minus the pointless `/logout`) and emit
+   * `signedOut{reason:'accountDeleted'}`.
+   *
+   * On 401 `reauth_required` / 503 `not_configured` (or `erasure_unavailable`)
+   * the request throws BEFORE the teardown line, so the local session is left
+   * fully intact — the deletion did not happen and the user is still signed in.
+   */
+  async deleteAccount(params = {}) {
+    const res = await palbeRequest(this.rt, "DELETE", "/auth/user", {
+      body: params.password ? { password: params.password } : {}
+    });
+    this.nextSignOutReason = "accountDeleted";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+    return { erasureId: res.erasure_id };
+  }
+  /**
+   * @internal — invoked by the transport choke point (`request.ts`), not app code.
+   * Reactive teardown when the server reports the session is gone: a 403
+   * `subject_fenced`/`subject_erased` (subject being erased) or a 401
+   * `session_revoked`. Clears local state and emits
+   * `signedOut{reason:'sessionInvalid'}` exactly once (deduped by
+   * `signedInState`). An ordinary 403 authz denial does NOT reach here —
+   * `request.ts` matches only the exact session-kill codes.
+   */
+  reactiveTeardown() {
+    if (!this.signedInState) return;
+    this.nextSignOutReason = "sessionInvalid";
+    this.rt.tokenManager.clearSession();
+    this.rt.storage.clear();
+    this.cachedUser = null;
+  }
   async getUser() {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
@@ -8939,7 +8633,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "4.0.1";
+var VERSION = "5.0.0";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9343,8 +9037,6 @@ function __reset() {
 }
 
 export {
-  BackendError,
-  isBackendError,
   PalbeAnalytics,
   asWireAuthResult,
   PalbeAuth,
@@ -9366,4 +9058,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-TGDS6VMT.js.map
+//# sourceMappingURL=chunk-XTQXFZUP.js.map