@raisindb/client 0.4.0 → 0.4.2

package/dist/index.mjs

@@ -2688,6 +2688,13 @@ var Branches = class {
    * Each root's parent path must already exist on the target branch. With
    * `deleteMissing`, target nodes under the roots that are absent from the
    * copied source set are pruned (one-way sync).
+   *
+   * `sourceRevision` pins the read to a point in time. A promotion of a large
+   * set is not instantaneous, so without it the copy reads each node when its
+   * turn comes and a writer working in parallel lands partly inside the result
+   * — a torn snapshot. Pass the revision captured when the operation was
+   * decided (see `getHead`) to copy exactly that state. The target branch is
+   * always resolved at its head: the pin says WHAT to copy, never where.
    */
   async copyNodes(sourceBranch, targetBranch, opts) {
     return this.sendRequest(
@@ -2697,7 +2704,8 @@ var Branches = class {
         workspace: opts.workspace,
         roots: opts.roots,
         recursive: opts.recursive ?? true,
-        delete_missing: opts.deleteMissing ?? false
+        delete_missing: opts.deleteMissing ?? false,
+        source_revision: opts.sourceRevision ?? null
       },
       "branch_copy_nodes" /* BranchCopyNodes */
     );
@@ -5698,6 +5706,101 @@ var McpClient = class {
   }
 };
 
+// src/identity-auth.ts
+var IdentityAuthApi = class {
+  constructor(repository, transport) {
+    this.repository = repository;
+    this.transport = transport;
+  }
+  get base() {
+    return `/auth/${encodeURIComponent(this.repository)}`;
+  }
+  /**
+   * Ask RaisinDB to email a sign-in link.
+   *
+   * The reply is an acknowledgement, never a token — the token only exists in
+   * the email. It also resolves for an address that has no account, because a
+   * response that differed would turn this endpoint into an account-existence
+   * oracle.
+   */
+  async sendMagicLink(email, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/magic-link`,
+      body: { email, redirect_url: options?.redirectUrl },
+      skipAuth: true
+    });
+  }
+  /**
+   * Exchange a magic-link token for a session.
+   *
+   * Most applications never call this: following the emailed link hits
+   * RaisinDB directly, which verifies and 302s to the redirect URL with the
+   * tokens in the URL **fragment** (so they stay out of server logs and out
+   * of the Referer header) — see {@link readTokensFromFragment}. Call this
+   * only when handling the token yourself, and note it is single-use.
+   */
+  async verifyMagicLink(token) {
+    return this.transport({
+      method: "GET",
+      path: `${this.base}/magic-link/verify?token=${encodeURIComponent(token)}`,
+      skipAuth: true
+    });
+  }
+  /** Sign in with email and password, where the repository enables it. */
+  async login(email, password, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/login`,
+      body: { email, password, remember_me: options?.rememberMe ?? false },
+      skipAuth: true
+    });
+  }
+  /** Create an account with email and password. */
+  async register(email, password, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/register`,
+      body: { email, password, display_name: options?.displayName },
+      skipAuth: true
+    });
+  }
+  /** Trade a refresh token for a fresh pair. */
+  async refresh(refreshToken) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/refresh`,
+      body: { refresh_token: refreshToken },
+      skipAuth: true
+    });
+  }
+  /**
+   * Which sign-in methods to render.
+   *
+   * Ask rather than hard-code: magic link and password are per-repository
+   * configuration, and a button for a disabled method is a dead end.
+   */
+  async providers() {
+    return this.transport({
+      method: "GET",
+      path: `${this.base}/providers`,
+      skipAuth: true
+    });
+  }
+  /** Who the current token belongs to in this repository. */
+  async me() {
+    return this.transport({ method: "GET", path: `${this.base}/me` });
+  }
+};
+function readTokensFromFragment(hashOrUrl) {
+  const hash = hashOrUrl.includes("#") ? hashOrUrl.slice(hashOrUrl.indexOf("#") + 1) : hashOrUrl;
+  if (!hash) return null;
+  const params = new URLSearchParams(hash);
+  const accessToken = params.get("access_token");
+  if (!accessToken) return null;
+  return { accessToken, refreshToken: params.get("refresh_token") };
+}
+
 // src/http-client.ts
 var RaisinHttpClient = class extends EventEmitter {
   constructor(baseUrl, options = {}) {
@@ -6096,6 +6199,65 @@ var RaisinHttpClient = class extends EventEmitter {
     return this.authManager;
   }
   // ============================================================================
+  // Identity Authentication
+  // ============================================================================
+  /**
+   * Identity authentication (magic link, password, providers) for one
+   * repository.
+   *
+   * Identities are per repository — their home nodes and roles live there — so
+   * the repository is required rather than inferred from client state, which
+   * would silently sign somebody into whichever one happened to be current.
+   *
+   * ```ts
+   * const auth = client.auth('studio');
+   * await auth.sendMagicLink('a@example.com', {
+   *   redirectUrl: 'https://app.example.com/account/callback',
+   * });
+   * // …on the callback route:
+   * const tokens = readTokensFromFragment(window.location.hash);
+   * if (tokens) client.setIdentityTokens(tokens.accessToken, tokens.refreshToken);
+   * ```
+   */
+  auth(repository) {
+    return new IdentityAuthApi(repository, async (options) => {
+      const response = await this.request({
+        method: options.method,
+        path: options.path,
+        body: options.body,
+        skipAuth: options.skipAuth
+      });
+      return response.data;
+    });
+  }
+  /**
+   * Adopt an identity's tokens for every subsequent call on this client.
+   *
+   * Takes the loose form so it serves both callers: the whole result of a
+   * sign-in, and the pair recovered from a redirect fragment (which carries no
+   * identity object and may carry no refresh token).
+   */
+  setIdentityTokens(accessTokenOrResult, refreshToken) {
+    if (typeof accessTokenOrResult === "string") {
+      this.authManager.storage.setAccessToken(accessTokenOrResult);
+      if (refreshToken) this.authManager.storage.setRefreshToken(refreshToken);
+      return;
+    }
+    const result = accessTokenOrResult;
+    this.authManager.setTokens({
+      access_token: result.access_token,
+      refresh_token: result.refresh_token,
+      // The server reports an absolute expiry; AuthManager schedules from a
+      // duration. Deriving it here keeps the refresh timer honest instead of
+      // leaving it unset, which reads as "never expires".
+      expires_in: Math.max(0, result.expires_at - Math.floor(Date.now() / 1e3))
+    });
+  }
+  /** Forget the current identity's tokens. */
+  clearIdentityTokens() {
+    this.authManager.clear();
+  }
+  // ============================================================================
   // Upload Methods
   // ============================================================================
   /**
@@ -8932,6 +9094,7 @@ export {
   HttpFunctionsApi,
   HttpNodeTypes,
   HttpWorkspaceClient,
+  IdentityAuthApi,
   InboxApi,
   LocalStorageTokenStorage,
   LogLevel,
@@ -9007,6 +9170,7 @@ export {
   logger,
   normalizeHomePath,
   projectPlansFromMessages,
+  readTokensFromFragment,
   rowsToObjects,
   setLogLevel,
   sleep,