@qmuse/cloud-client 0.0.1-dev.0 → 0.0.1-dev.2

package/README.md

@@ -6,54 +6,60 @@ its control plane while large file bytes use a platform-specific Storage data
 plane inside this package.
 
 The package intentionally does not expose AppBase clients, Functions, Storage,
-TablesDB, endpoint, project ID, database ID, bucket ID, or permissions to
-business modules. A QMuse host adapter supplies narrow execution, Session and
-file transport capabilities.
+TablesDB, endpoint, project ID, database ID, bucket ID, permissions, or a
+platform-injection API to business modules. Platform implementations are fixed
+by the `/web` and `/miniapp` package entry points.
+
+The host initializes one client for the current JavaScript runtime before
+mounting the application. Web and mini-program hosts may load the public
+connection config differently while business modules always read the same
+singleton:
 
 ```ts
-import { createQmuseCloudClient } from '@qmuse/cloud-client';
+import { getQMuseClient } from '@qmuse/cloud-client';
+import { initQMuseCloudClient } from '@qmuse/cloud-client/web';
 
-export const cloudClient = createQmuseCloudClient({
-  execute: input => runtime.executeCloudFunction(input),
+await initQMuseCloudClient({
+  config: () => hostRuntime.appwrite,
 });
 
-const result = await cloudClient.request<{ data: Order }>({
+const result = await getQMuseClient().request<{ data: Order }>({
   method: 'GET',
   path: '/api/orders/order_1',
 });
 ```
 
-Each generated application owns its own users, credentials, sessions, roles,
-and policies. It does not reuse the QMuse platform login. AppBase Auth is only
-an internal shadow transport identity used for Function runtime headers and
-Storage permissions.
+`initQMuseCloudClient` accepts a config object or a sync/async config loader. Calls
+with the same normalized `endpoint`, `projectId`, and `functionId` are
+idempotent and concurrent calls share the same initialization. Reinitializing
+with different connection config is rejected.
+
+Each generated application owns its own AppBase users, Sessions, roles and
+policies. The AppBase Session is the only application login state. It supplies
+Function runtime identity headers and Storage permissions; there is no second
+application access/refresh-token layer.
 
-The host supplies an application credential store and the two narrow AppBase
-Account operations needed to establish/remove that shadow Session:
+The selected package entry point supplies the AppBase Account capability. Login receives a
+short-lived custom-token secret from the Function and exchanges it immediately;
+the secret is never returned from `login`, persisted, logged or put in business
+state.
 
 ```ts
-export const cloudClient = createQmuseCloudClient({
-  execute: input => runtime.executeCloudFunction(input),
-  auth: {
-    credentialStore: secureCredentialStore,
-    shadowSession: {
-      createSession: input => account.createSession(input),
-      deleteCurrentSession: () => account.deleteSession({ sessionId: 'current' }),
-    },
-  },
-});
+import { getQMuseClient } from '@qmuse/cloud-client';
 
-await cloudClient.auth.login({ email, password });
+const cloudClient = getQMuseClient();
+await cloudClient.auth.login({ username, password });
 const currentUser = await cloudClient.auth.getCurrentUser();
 await cloudClient.auth.logout();
+// Or revoke every AppBase Session for this user:
+await cloudClient.auth.logoutAll();
 ```
 
-`login/register/refresh` receive a one-time shadow Custom Token from Hono and
-exchange it internally. The token secret is never persisted in the application
-credential store. Refresh is single-flight, rotates application credentials,
-and replaces the current shadow Session. Hosts must back `credentialStore` with
-their platform's secure storage policy; this package does not default refresh
-tokens to `localStorage`.
+`register` creates the user without changing the current Session. `login`
+exchanges the custom token internally. Session refresh is single-flight and is
+performed before business requests when expiry is within five minutes. Web
+hosts use AppBase's secure cookie; mini-program hosts persist AppBase fallback
+Session headers in storage scoped by endpoint and project ID.
 
 Business file operations use a logical resource, never a bucket ID:
 
@@ -80,42 +86,47 @@ the backend must also expire abandoned intents. Preview/download access is
 authorized by the Function and may return a short-lived File Token URL or an
 authenticated URL that the Web transport converts to a disposable Blob URL.
 
-Platform transports are separate package entry points:
+Initialization is available only from platform-specific entry points:
 
 ```ts
-import { createWebFileTransport } from '@qmuse/cloud-client/web';
-import { createMiniappFileTransport } from '@qmuse/cloud-client/miniapp';
+// Web build
+import { initQMuseCloudClient } from '@qmuse/cloud-client/web';
+
+await initQMuseCloudClient({
+  config: () => window.__MUSE__.appwrite,
+});
+
+// Taro mini-program build
+import { initQMuseCloudClient } from '@qmuse/cloud-client/miniapp';
+
+await initQMuseCloudClient({
+  config: () => getMuseRuntime().appwrite,
+});
 ```
 
-They migrate the proven file mechanics from the legacy `@qmuse/appwrite`
-implementation: Web `File`/`Blob`, Taro-style local paths, 5 MiB chunks,
+The Web entry owns the Appwrite Web SDK and secure-cookie Session. The miniapp
+entry owns Taro request, upload, storage, file-system and project-isolated
+`X-Fallback-Cookies` Session handling. Both entries include the proven file
+mechanics from the legacy `@qmuse/appwrite` implementation: Web `File`/`Blob`, Taro-style local paths, 5 MiB chunks,
 `Content-Range`, `X-Appwrite-ID` continuation, progress, fallback Session
 headers and mini-program temporary-file cleanup. They do not migrate TablesDB
 CRUD or the legacy anonymous `Role.any()` update/delete permissions.
 
-For Web hosts, bind an initialized `Functions` instance without exposing it to
-business modules:
+For Web hosts, initialization therefore stays small:
 
 ```ts
-import { createAppBaseWebCloudClient } from '@qmuse/cloud-client';
+import { initQMuseCloudClient } from '@qmuse/cloud-client/web';
 
-export const cloudClient = createAppBaseWebCloudClient(functions, {
-  refreshSession,
+export const cloudClient = await initQMuseCloudClient({
+  config: () => window.__MUSE__.appwrite,
 });
 ```
 
-The legacy portable adapter remains available during migration:
-
-```ts
-import { createPortableCloudClient } from '@qmuse/cloud-client';
-
-export const cloudClient = createPortableCloudClient(appwrite);
-```
+`functionId` is the public physical Function ID assigned by the AppBase project.
+It is fixed during initialization and is not supplied by business requests.
 
-New applications should bind Function, Session and file capabilities directly
-at their host bootstrap and should not depend on `@qmuse/appwrite` or
-`@qmuse/appwrite-runtime-sdk`. The portable adapter only translates this
-package's `path` field to the legacy `xpath` field for staged migration.
+New applications should select one platform entry at build time and should not
+depend on `@qmuse/appwrite` or `@qmuse/appwrite-runtime-sdk`.
 
 Only `/api` paths and an allowlist of business headers are accepted. The client
 uses synchronous Function execution, reads `responseStatusCode`, `responseBody`,

package/dist/adapters.d.ts

@@ -1,15 +1,50 @@
-import type { CloudAuthOptions, CloudExecution, CloudExecutionInput, CloudFileTransport, QmuseCloudClient } from './types.js';
+import type { CloudAccountCapability, CloudAuthOptions, CloudExecution, CloudExecutionInput, CloudFileTransport, QmuseCloudClient } from './types.js';
+export type AppBaseExecutionInput = Omit<CloudExecutionInput, 'functionId'> & {
+    functionId: string;
+};
 export interface AppBaseFunctionsCapability {
-    createExecution(input: CloudExecutionInput): Promise<CloudExecution>;
+    createExecution(input: AppBaseExecutionInput): Promise<CloudExecution>;
 }
-export interface PortableExecutionInput extends Omit<CloudExecutionInput, 'path'> {
+export interface AppBaseFunctionsSdkCapability {
+    createExecution(...args: never[]): Promise<CloudExecution>;
+}
+export declare function createAppBaseFunctionsCapability(functions: AppBaseFunctionsSdkCapability): AppBaseFunctionsCapability;
+export interface AppBaseAccountSdkCapability {
+    createSession(input: {
+        userId: string;
+        secret: string;
+    }): Promise<{
+        expire: string;
+    }>;
+    get(): Promise<{
+        $id: string;
+        email?: string;
+        labels?: string[];
+    }>;
+    getSession(input: {
+        sessionId: 'current';
+    }): Promise<{
+        expire: string;
+    }>;
+    updateSession(input: {
+        sessionId: 'current';
+    }): Promise<{
+        expire: string;
+    }>;
+    deleteSession(input: {
+        sessionId: 'current';
+    }): Promise<unknown>;
+    deleteSessions(): Promise<unknown>;
+}
+export declare function createAppBaseAccountCapability(account: AppBaseAccountSdkCapability): CloudAccountCapability;
+export interface PortableExecutionInput extends Omit<AppBaseExecutionInput, 'path'> {
     xpath: string;
 }
 export interface PortableAppwriteCapability {
     executeFunction(input: PortableExecutionInput): Promise<CloudExecution>;
 }
 export interface HostAdapterOptions<FileSource = never> {
-    refreshSession?(): Promise<void>;
+    functionId?: string;
     auth?: CloudAuthOptions;
     fileTransport?: CloudFileTransport<FileSource>;
 }

package/dist/adapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAYpB,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC/E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,kBAAkB,CAAC,UAAU,GAAG,KAAK;IACpD,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,aAAa,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;CAChD;AAsBD,wBAAgB,2BAA2B,CAAC,UAAU,GAAG,KAAK,EAC5D,SAAS,EAAE,0BAA0B,EACrC,OAAO,GAAE,kBAAkB,CAAC,UAAU,CAAM,GAC3C,gBAAgB,CAAC,UAAU,CAAC,CAY9B;AAED,wBAAgB,yBAAyB,CAAC,UAAU,GAAG,KAAK,EAC1D,QAAQ,EAAE,0BAA0B,EACpC,OAAO,GAAE,kBAAkB,CAAC,UAAU,CAAM,GAC3C,gBAAgB,CAAC,UAAU,CAAC,CAe9B"}
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,GAAG;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,6BAA6B;IAC5C,eAAe,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5D;AAED,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,6BAA6B,GACvC,0BAA0B,CAU5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,GAAG,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACnE,UAAU,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,aAAa,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,aAAa,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,2BAA2B,GAAG,sBAAsB,CAY3G;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,kBAAkB,CAAC,UAAU,GAAG,KAAK;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,aAAa,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;CAChD;AAYD,wBAAgB,2BAA2B,CAAC,UAAU,GAAG,KAAK,EAC5D,SAAS,EAAE,0BAA0B,EACrC,OAAO,GAAE,kBAAkB,CAAC,UAAU,CAAM,GAC3C,gBAAgB,CAAC,UAAU,CAAC,CAS9B;AAED,wBAAgB,yBAAyB,CAAC,UAAU,GAAG,KAAK,EAC1D,QAAQ,EAAE,0BAA0B,EACpC,OAAO,GAAE,kBAAkB,CAAC,UAAU,CAAM,GAC3C,gBAAgB,CAAC,UAAU,CAAC,CAY9B"}

package/dist/adapters.js

@@ -1,28 +1,41 @@
 import { createQmuseCloudClient } from './client.js';
-function isTransportUnauthorized(error) {
-    if (!error || typeof error !== 'object')
-        return false;
-    const value = error;
-    return [value.code, value.status, value.statusCode, value.response?.status, value.response?.statusCode]
-        .some(code => Number(code) === 401);
-}
-async function withTransportRetry(operation, refreshSession) {
-    try {
-        return await operation();
+import { toCloudAuthUser } from './auth.js';
+export function createAppBaseFunctionsCapability(functions) {
+    if (!functions || typeof functions.createExecution !== 'function') {
+        throw new TypeError('An AppBase Functions SDK capability is required');
     }
-    catch (error) {
-        if (!refreshSession || !isTransportUnauthorized(error))
-            throw error;
-        await refreshSession();
-        return operation();
+    return {
+        createExecution(input) {
+            const { path, ...sdkInput } = input;
+            return functions.createExecution({ ...sdkInput, xpath: path });
+        },
+    };
+}
+export function createAppBaseAccountCapability(account) {
+    if (!account || typeof account.createSession !== 'function' || typeof account.get !== 'function') {
+        throw new TypeError('An AppBase Account SDK capability is required');
     }
+    return {
+        createSession: input => account.createSession(input),
+        getCurrentUser: async () => toCloudAuthUser(await account.get()),
+        getCurrentSession: () => account.getSession({ sessionId: 'current' }),
+        refreshCurrentSession: () => account.updateSession({ sessionId: 'current' }),
+        deleteCurrentSession: async () => { await account.deleteSession({ sessionId: 'current' }); },
+        deleteAllSessions: async () => { await account.deleteSessions(); },
+    };
+}
+function executionInput(input, functionId) {
+    return {
+        ...input,
+        functionId: functionId?.trim() || input.functionId,
+    };
 }
 export function createAppBaseWebCloudClient(functions, options = {}) {
     if (!functions || typeof functions.createExecution !== 'function') {
         throw new TypeError('An AppBase Functions capability is required');
     }
     return createQmuseCloudClient({
-        execute: input => withTransportRetry(() => functions.createExecution(input), options.refreshSession),
+        execute: input => functions.createExecution(executionInput(input, options.functionId)),
         ...(options.auth ? { auth: options.auth } : {}),
         ...(options.fileTransport ? { fileTransport: options.fileTransport } : {}),
     });
@@ -33,8 +46,8 @@ export function createPortableCloudClient(appwrite, options = {}) {
     }
     return createQmuseCloudClient({
         execute: input => {
-            const { path, ...portableInput } = input;
-            return withTransportRetry(() => appwrite.executeFunction({ ...portableInput, xpath: path }), options.refreshSession);
+            const { path, ...portableInput } = executionInput(input, options.functionId);
+            return appwrite.executeFunction({ ...portableInput, xpath: path });
         },
         ...(options.auth ? { auth: options.auth } : {}),
         ...(options.fileTransport ? { fileTransport: options.fileTransport } : {}),

package/dist/adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAqCrD,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAA2B,CAAC;IAC1C,OAAO,CAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAE;SACtG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAA2B,EAC3B,cAAoC;IAEpC,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,cAAc,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAqC,EACrC,UAA0C,EAAE;IAE5C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAClC,GAAG,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,EACtC,OAAO,CAAC,cAAc,CACvB;QACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAoC,EACpC,UAA0C,EAAE;IAE5C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;YACzC,OAAO,kBAAkB,CACvB,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACjE,OAAO,CAAC,cAAc,CACvB,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AASrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAc5C,MAAM,UAAU,gCAAgC,CAC9C,SAAwC;IAExC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,eAAe,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;YACpC,OAAO,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAW,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,8BAA8B,CAAC,OAAoC;IACjF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACpD,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;QAChE,iBAAiB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACrE,qBAAqB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC5E,oBAAoB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,iBAAiB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAgBD,SAAS,cAAc,CACrB,KAA0B,EAC1B,UAA8B;IAE9B,OAAO;QACL,GAAG,KAAK;QACR,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,UAAU;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAqC,EACrC,UAA0C,EAAE;IAE5C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAoC,EACpC,UAA0C,EAAE;IAE5C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7E,OAAO,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}

package/dist/auth.d.ts

@@ -1,8 +1,13 @@
-import type { CloudAuthOptions, CloudRequest, CloudResponse, QmuseCloudAuth } from './types.js';
-type AuthRequest = <T>(request: CloudRequest, accessToken?: string) => Promise<CloudResponse<T>>;
+import type { CloudAuthOptions, CloudAuthUser, CloudRequest, CloudResponse, QmuseCloudAuth } from './types.js';
+type AuthRequest = <T>(request: CloudRequest) => Promise<CloudResponse<T>>;
 export type CloudAuthRuntime = QmuseCloudAuth & {
-    accessToken(): Promise<string | undefined>;
+    prepareRequest(): Promise<void>;
 };
+export declare function toCloudAuthUser(value: {
+    $id: string;
+    email?: string;
+    labels?: string[];
+}): CloudAuthUser;
 export declare function createUnavailableCloudAuth(): CloudAuthRuntime;
 export declare function createCloudAuth(options: CloudAuthOptions, request: AuthRequest): CloudAuthRuntime;
 export {};

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,gBAAgB,EAKhB,YAAY,EACZ,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,KAAK,WAAW,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAAE,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,CAAC;AAqC/F,wBAAgB,0BAA0B,IAAI,gBAAgB,CAa7D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,GAAG,gBAAgB,CA4GjG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EAIb,YAAY,EACZ,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,KAAK,WAAW,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,CAAC;AAoBF,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,aAAa,CAOhB;AAuCD,wBAAgB,0BAA0B,IAAI,gBAAgB,CAc7D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAuHjG"}

package/dist/auth.js

@@ -1,30 +1,55 @@
 import { QmuseCloudError } from './errors.js';
-function validCredentials(value) {
+const DEFAULT_REFRESH_BEFORE_MS = 5 * 60 * 1000;
+function validUser(value) {
     if (!value || typeof value !== 'object')
         return false;
     const item = value;
-    return typeof item.accessToken === 'string' && item.accessToken.length > 0 &&
-        typeof item.refreshToken === 'string' && item.refreshToken.length > 0 &&
-        typeof item.accessTokenExpiresAt === 'string' && item.accessTokenExpiresAt.length > 0 &&
-        !!item.user && typeof item.user === 'object' && typeof item.user.id === 'string' && item.user.id.length > 0;
+    return typeof item.id === 'string' && item.id.length > 0 &&
+        typeof item.username === 'string' && item.username.length > 0 &&
+        (item.role === 'user' || item.role === 'admin');
 }
-function validSessionResult(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    const item = value;
-    const shadow = item.shadowSession;
-    return validCredentials(item.credentials) && !!shadow && typeof shadow === 'object' &&
-        typeof shadow.userId === 'string' && shadow.userId === item.credentials.user.id &&
-        typeof shadow.secret === 'string' && shadow.secret.length > 0 &&
-        typeof shadow.expire === 'string' && shadow.expire.length > 0;
+export function toCloudAuthUser(value) {
+    const id = value?.$id?.trim();
+    const username = /^([a-z0-9_]{3,32})@qmuse[.]cn$/.exec(value?.email?.trim().toLowerCase() ?? '')?.[1];
+    if (!id || !username) {
+        throw new QmuseCloudError('AppBase returned an invalid current user', 'AUTH_USER_INVALID');
+    }
+    return { id, username, role: value.labels?.includes('admin') ? 'admin' : 'user' };
 }
-function sessionResult(response) {
+function userResult(response) {
+    const user = response.data?.data;
+    if (!validUser(user)) {
+        throw new QmuseCloudError('Cloud API returned an invalid user', 'AUTH_USER_INVALID');
+    }
+    return user;
+}
+function loginResult(response) {
     const value = response.data?.data;
-    if (!validSessionResult(value)) {
+    if (!value || typeof value !== 'object' || !validUser(value.user)) {
+        throw new QmuseCloudError('Cloud API returned an invalid authentication response', 'AUTH_RESPONSE_INVALID');
+    }
+    const token = value.sessionToken;
+    if (!token || typeof token !== 'object' || token.userId !== value.user.id ||
+        typeof token.secret !== 'string' || token.secret.length === 0 ||
+        typeof token.expire !== 'string' || token.expire.length === 0) {
         throw new QmuseCloudError('Cloud API returned an invalid authentication response', 'AUTH_RESPONSE_INVALID');
     }
     return value;
 }
+function expiration(value) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        throw new QmuseCloudError('AppBase returned an invalid Session expiry', 'AUTH_SESSION_INVALID');
+    }
+    return parsed;
+}
+function isMissingSession(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const value = error;
+    return [value.code, value.status, value.statusCode]
+        .some(code => Number(code) === 401 || Number(code) === 404);
+}
 export function createUnavailableCloudAuth() {
     const unavailable = async () => {
         throw new QmuseCloudError('Cloud Auth is not configured', 'AUTH_UNAVAILABLE');
@@ -32,74 +57,85 @@ export function createUnavailableCloudAuth() {
     return {
         register: unavailable,
         login: unavailable,
-        refresh: unavailable,
-        restore: async () => null,
+        refreshSession: unavailable,
+        restoreSession: async () => null,
         logout: async () => undefined,
+        logoutAll: async () => undefined,
         getCurrentUser: async () => null,
-        accessToken: async () => undefined,
+        prepareRequest: async () => undefined,
     };
 }
 export function createCloudAuth(options, request) {
-    if (!options || typeof options.credentialStore?.load !== 'function' ||
-        typeof options.credentialStore.save !== 'function' || typeof options.credentialStore.clear !== 'function') {
-        throw new TypeError('Cloud Auth requires a credential store');
+    const account = options?.account;
+    if (!account || typeof account.createSession !== 'function' ||
+        typeof account.getCurrentUser !== 'function' || typeof account.getCurrentSession !== 'function' ||
+        typeof account.refreshCurrentSession !== 'function' || typeof account.deleteCurrentSession !== 'function' ||
+        typeof account.deleteAllSessions !== 'function') {
+        throw new TypeError('Cloud Auth requires an AppBase Account capability');
     }
-    if (typeof options.shadowSession?.createSession !== 'function' ||
-        typeof options.shadowSession.deleteCurrentSession !== 'function') {
-        throw new TypeError('Cloud Auth requires a shadow Session capability');
+    const refreshBeforeMs = options.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;
+    if (!Number.isFinite(refreshBeforeMs) || refreshBeforeMs < 0) {
+        throw new TypeError('refreshBeforeMs must be a non-negative finite number');
     }
-    let loaded = false;
-    let credentials = null;
+    const now = options.now ?? Date.now;
+    let initialized = false;
+    let user = null;
+    let expiresAt = 0;
     let refreshFlight = null;
-    const load = async () => {
-        if (loaded)
-            return credentials;
-        const stored = await options.credentialStore.load();
-        credentials = validCredentials(stored) ? stored : null;
-        loaded = true;
-        if (stored && !credentials)
-            await options.credentialStore.clear();
-        return credentials;
+    let restoreFlight = null;
+    const clear = () => {
+        initialized = true;
+        user = null;
+        expiresAt = 0;
     };
-    const clear = async () => {
-        credentials = null;
-        loaded = true;
-        await options.credentialStore.clear();
+    const readCurrent = async () => {
+        const [currentUser, currentSession] = await Promise.all([
+            account.getCurrentUser(),
+            account.getCurrentSession(),
+        ]);
+        if (!validUser(currentUser)) {
+            throw new QmuseCloudError('AppBase returned an invalid current user', 'AUTH_USER_INVALID');
+        }
+        expiresAt = expiration(currentSession.expire);
+        user = currentUser;
+        initialized = true;
+        return currentUser;
     };
-    const establish = async (result) => {
-        await options.shadowSession.createSession({
-            userId: result.shadowSession.userId,
-            secret: result.shadowSession.secret,
-        });
+    const restoreSession = async () => {
+        if (restoreFlight)
+            return restoreFlight;
+        restoreFlight = (async () => {
+            try {
+                return await readCurrent();
+            }
+            catch (error) {
+                if (!isMissingSession(error))
+                    throw error;
+                clear();
+                return null;
+            }
+        })();
         try {
-            await options.credentialStore.save(result.credentials);
-            credentials = result.credentials;
-            loaded = true;
-            return result.credentials.user;
+            return await restoreFlight;
         }
-        catch (error) {
-            await options.shadowSession.deleteCurrentSession().catch(() => undefined);
-            throw error;
+        finally {
+            restoreFlight = null;
         }
     };
-    const authenticate = async (path, body) => {
-        await options.shadowSession.deleteCurrentSession().catch(() => undefined);
-        return establish(sessionResult(await request({ method: 'POST', path, body })));
-    };
-    const refresh = async () => {
+    const refreshSession = async () => {
         if (refreshFlight)
             return refreshFlight;
         refreshFlight = (async () => {
-            const current = await load();
-            if (!current)
-                throw new QmuseCloudError('No application session is available', 'AUTH_SESSION_MISSING');
-            await options.shadowSession.deleteCurrentSession().catch(() => undefined);
-            const response = await request({
-                method: 'POST',
-                path: '/api/auth/refresh',
-                body: { refreshToken: current.refreshToken },
-            });
-            return establish(sessionResult(response));
+            const session = await account.refreshCurrentSession();
+            expiresAt = expiration(session.expire);
+            const currentUser = await account.getCurrentUser();
+            if (!validUser(currentUser)) {
+                clear();
+                throw new QmuseCloudError('AppBase returned an invalid current user', 'AUTH_USER_INVALID');
+            }
+            user = currentUser;
+            initialized = true;
+            return currentUser;
         })();
         try {
             return await refreshFlight;
@@ -109,48 +145,65 @@ export function createCloudAuth(options, request) {
         }
     };
     return {
-        register: input => authenticate('/api/auth/register', input),
-        login: input => authenticate('/api/auth/login', input),
-        refresh,
-        async restore() {
-            if (!await load())
-                return null;
+        async register(input) {
+            return userResult(await request({ method: 'POST', path: '/api/auth/register', body: input }));
+        },
+        async login(input) {
+            const result = loginResult(await request({ method: 'POST', path: '/api/auth/login', body: input }));
             try {
-                return await refresh();
+                await account.deleteCurrentSession().catch(error => {
+                    if (!isMissingSession(error))
+                        throw error;
+                });
+                const session = await account.createSession({
+                    userId: result.sessionToken.userId,
+                    secret: result.sessionToken.secret,
+                });
+                expiresAt = expiration(session.expire);
+                const currentUser = await account.getCurrentUser();
+                if (!validUser(currentUser)) {
+                    throw new QmuseCloudError('AppBase returned an invalid current user', 'AUTH_USER_INVALID');
+                }
+                user = currentUser;
+                initialized = true;
+                return currentUser;
             }
-            catch (error) {
-                await clear();
-                await options.shadowSession.deleteCurrentSession().catch(() => undefined);
-                throw error;
+            catch {
+                clear();
+                throw new QmuseCloudError('Could not establish the AppBase Session', 'AUTH_SESSION_EXCHANGE_FAILED');
+            }
+            finally {
+                result.sessionToken.secret = '';
             }
         },
+        refreshSession,
+        restoreSession,
         async logout() {
-            const current = await load();
             try {
-                if (current) {
-                    await request({ method: 'POST', path: '/api/auth/logout' }, current.accessToken);
-                }
+                await account.deleteCurrentSession();
             }
             finally {
-                await options.shadowSession.deleteCurrentSession().catch(() => undefined);
-                await clear();
+                clear();
             }
         },
-        async getCurrentUser() {
-            const current = await load();
-            if (!current)
-                return null;
-            const response = await request({ method: 'GET', path: '/api/auth/me' }, current.accessToken);
-            const user = response.data?.data;
-            if (!user || typeof user !== 'object' || typeof user.id !== 'string') {
-                throw new QmuseCloudError('Cloud API returned an invalid current user', 'AUTH_USER_INVALID');
+        async logoutAll() {
+            try {
+                await account.deleteAllSessions();
             }
-            credentials = { ...current, user };
-            await options.credentialStore.save(credentials);
+            finally {
+                clear();
+            }
+        },
+        async getCurrentUser() {
+            if (!initialized)
+                return restoreSession();
             return user;
         },
-        async accessToken() {
-            return (await load())?.accessToken;
+        async prepareRequest() {
+            if (!initialized)
+                await restoreSession();
+            if (user && expiresAt - now() <= refreshBeforeMs)
+                await refreshSession();
         },
     };
 }