@raster-app/sdk 0.1.0-canary-2e1834e

package/dist/auth/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/auth/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAe/D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,OAAoB,EACpB,IAAY,EACZ,IAA6B,EAC7B,UAAoD,EAAE;IAEtD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC;aACvF;YACD,IAAI,EAAE,OAAO,CAAC,IAAI;gBACjB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACtB,CAAC,CAAC,IAAI,eAAe,CACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAChE,CAAC,QAAQ,EAAE;YACd,qFAAqF;YACrF,qFAAqF;YACrF,iDAAiD;YACjD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,MAAM,OAAO,GAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAE1D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAW,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QACtF,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,MAAM,WAAW,GAAG,mBAAmB,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,MAAM,IAAI,cAAc,CACvB,OAAO,WAAW,KAAK,QAAQ;YAC9B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,EACrD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAChD,QAAQ,CAAC,MAAM,CACf,CAAA;IACF,CAAC;IAED,2FAA2F;IAC3F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,cAAc,CACvB,qDAAqD,EACrD,oBAAoB,EACpB,QAAQ,CAAC,MAAM,CACf,CAAA;IACF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAoB;IAC/D,OAAO;QACN,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;KAC/C,CAAA;AACF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAmB;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5C,OAAO,EAAE,CAAA;QACV,CAAC,EAAE,EAAE,CAAC,CAAA;QACN,SAAS,OAAO;YACf,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,cAAc,CAAC,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAA;;YACxB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { RasterApiError, toFetchError } from '../api/errors.js'\nimport type { OAuthSession } from '../types/session.js'\n\n/** The token endpoint's response, in OAuth's own snake_case. */\nexport type TokenResponse = {\n\taccess_token: string\n\texpires_in: number\n\trefresh_token: string\n}\n\nexport type AuthContext = {\n\tauthOrigin: string\n\tfetch: typeof globalThis.fetch\n}\n\n/**\n * POST to the authorization server. Bodies are form-encoded as OAuth expects — a \"simple\"\n * request, so no CORS preflight — except registration, whose metadata is JSON. Failures\n * come back as `{ error, error_description }` and are thrown as `RasterApiError` with the\n * OAuth error as `code`, so the poll loop can branch on `authorization_pending` and friends.\n */\nexport async function authPost<T>(\n\tcontext: AuthContext,\n\tpath: string,\n\tbody: Record<string, unknown>,\n\toptions: { json?: boolean; signal?: AbortSignal } = {}\n): Promise<T> {\n\tlet response: Response\n\ttry {\n\t\tresponse = await context.fetch(`${context.authOrigin}${path}`, {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Content-Type': options.json ? 'application/json' : 'application/x-www-form-urlencoded',\n\t\t\t},\n\t\t\tbody: options.json\n\t\t\t\t? JSON.stringify(body)\n\t\t\t\t: new URLSearchParams(\n\t\t\t\t\t\tObject.entries(body).map(([key, value]) => [key, String(value)])\n\t\t\t\t\t).toString(),\n\t\t\t// Raster answers these itself; a redirect comes from something in between, such as a\n\t\t\t// captive portal or a protected preview. Followed, a 307 or 308 would post the body,\n\t\t\t// refresh token included, to wherever it points.\n\t\t\tredirect: 'error',\n\t\t\tsignal: options.signal,\n\t\t})\n\t} catch (caught) {\n\t\tthrow toFetchError(caught)\n\t}\n\n\tconst payload: T = await response.json().catch(() => null)\n\n\tif (!response.ok) {\n\t\tconst failure: object = typeof payload === 'object' && payload !== null ? payload : {}\n\t\tconst error = 'error' in failure ? failure.error : undefined\n\t\tconst description = 'error_description' in failure ? failure.error_description : undefined\n\t\tthrow new RasterApiError(\n\t\t\ttypeof description === 'string'\n\t\t\t\t? description\n\t\t\t\t: `Raster sign-in failed (HTTP ${response.status}).`,\n\t\t\ttypeof error === 'string' ? error : 'HTTP_ERROR',\n\t\t\tresponse.status\n\t\t)\n\t}\n\n\t// A 2xx without a JSON object came from something other than Raster, such as a login page.\n\tif (typeof payload !== 'object' || payload === null) {\n\t\tthrow new RasterApiError(\n\t\t\t'Unexpected response from the Raster sign-in server.',\n\t\t\t'MALFORMED_RESPONSE',\n\t\t\tresponse.status\n\t\t)\n\t}\n\n\treturn payload\n}\n\n/** Build the persisted session from a token response, resolving `expires_in` to a deadline. */\nexport function toSession(clientId: string, token: TokenResponse): OAuthSession {\n\treturn {\n\t\tclientId,\n\t\taccessToken: token.access_token,\n\t\trefreshToken: token.refresh_token,\n\t\texpiresAt: Date.now() + token.expires_in * 1000,\n\t}\n}\n\n/** A `setTimeout` that an `AbortSignal` can cut short, rejecting with `ABORTED`. */\nexport function sleep(ms: number, signal: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tconst timer = setTimeout(() => {\n\t\t\tsignal.removeEventListener('abort', onAbort)\n\t\t\tresolve()\n\t\t}, ms)\n\t\tfunction onAbort() {\n\t\t\tclearTimeout(timer)\n\t\t\treject(new RasterApiError('Sign-in cancelled.', 'ABORTED', 0))\n\t\t}\n\t\tif (signal.aborted) onAbort()\n\t\telse signal.addEventListener('abort', onAbort, { once: true })\n\t})\n}\n"]}

package/dist/auth/register.d.ts

@@ -0,0 +1,14 @@
+import { type AuthContext } from './http.js';
+/**
+ * Registration requires a redirect URI, though the device grant never redirects: the consent
+ * page stands in for one.
+ */
+export declare function defaultRedirectUri(authOrigin: string): string;
+/**
+ * Dynamic Client Registration (RFC 7591). Any client may register, and the record becomes
+ * permanent once a sign-in completes. `clientName` is what the consent page and Connected apps
+ * display (see `RasterHost.name`).
+ */
+export declare function registerClient(context: AuthContext, options: {
+    clientName: string;
+}): Promise<string>;

package/dist/auth/register.js

@@ -0,0 +1,21 @@
+import { authPost } from './http.js';
+/**
+ * Registration requires a redirect URI, though the device grant never redirects: the consent
+ * page stands in for one.
+ */
+export function defaultRedirectUri(authOrigin) {
+    return `${authOrigin}/device`;
+}
+/**
+ * Dynamic Client Registration (RFC 7591). Any client may register, and the record becomes
+ * permanent once a sign-in completes. `clientName` is what the consent page and Connected apps
+ * display (see `RasterHost.name`).
+ */
+export async function registerClient(context, options) {
+    const registered = await authPost(context, '/oauth/register', {
+        client_name: options.clientName,
+        redirect_uris: [defaultRedirectUri(context.authOrigin)],
+    }, { json: true });
+    return registered.client_id;
+}
+//# sourceMappingURL=register.js.map

package/dist/auth/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/auth/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEtD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACpD,OAAO,GAAG,UAAU,SAAS,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAoB,EACpB,OAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,QAAQ,CAChC,OAAO,EACP,iBAAiB,EACjB;QACC,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,aAAa,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;KACvD,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACd,CAAA;IACD,OAAO,UAAU,CAAC,SAAS,CAAA;AAC5B,CAAC","sourcesContent":["import { type AuthContext, authPost } from './http.js'\n\n/**\n * Registration requires a redirect URI, though the device grant never redirects: the consent\n * page stands in for one.\n */\nexport function defaultRedirectUri(authOrigin: string): string {\n\treturn `${authOrigin}/device`\n}\n\n/**\n * Dynamic Client Registration (RFC 7591). Any client may register, and the record becomes\n * permanent once a sign-in completes. `clientName` is what the consent page and Connected apps\n * display (see `RasterHost.name`).\n */\nexport async function registerClient(\n\tcontext: AuthContext,\n\toptions: { clientName: string }\n): Promise<string> {\n\tconst registered = await authPost<{ client_id: string }>(\n\t\tcontext,\n\t\t'/oauth/register',\n\t\t{\n\t\t\tclient_name: options.clientName,\n\t\t\tredirect_uris: [defaultRedirectUri(context.authOrigin)],\n\t\t},\n\t\t{ json: true }\n\t)\n\treturn registered.client_id\n}\n"]}

package/dist/auth/session.d.ts

@@ -0,0 +1,30 @@
+import type { CredentialStore } from '../adapters/index.js';
+import { type StoredCredentials } from '../types/session.js';
+import type { AuthContext } from './http.js';
+/**
+ * The credential a client holds, and everything that keeps it valid. Each
+ * `createRasterClient` has its own, so clients on one page, such as one per Sanity Studio
+ * workspace, never share a token.
+ */
+export interface SessionStore {
+    /** The credentials in memory. `undefined` until `hydrate()` has run. */
+    current(): StoredCredentials | undefined;
+    /** Load from the `CredentialStore`. Idempotent; safe to await more than once. */
+    hydrate(): Promise<StoredCredentials>;
+    /** Persist, then replace in memory. A failed write changes nothing and rejects with its error. */
+    save(credentials: StoredCredentials): Promise<void>;
+    /** Called on every change — a sign-in, a token refresh, a sign-out. */
+    subscribe(listener: (credentials: StoredCredentials) => void): () => void;
+    isSignedIn(): boolean;
+    /** Whether there is any credential at all (a session or an API key). */
+    isConfigured(): boolean;
+    credentialIdentity(): string | null;
+    getAccessToken(options?: {
+        rejected?: string;
+    }): Promise<string>;
+    signOut(): Promise<void>;
+}
+export declare function createSessionStore(options: {
+    credentials: CredentialStore;
+    auth: AuthContext;
+}): SessionStore;

package/dist/auth/session.js

@@ -0,0 +1,231 @@
+import { RasterApiError } from '../api/errors.js';
+import { SIGNED_OUT, emptyCredentials, } from '../types/session.js';
+import { refreshSession, revokeSession } from './tokens.js';
+/** Refresh this far ahead of `expiresAt`, so a token is never presented right at its edge. */
+const EXPIRY_MARGIN_MS = 60 * 1000;
+/** One name for every client on the origin: refreshes are rare, so queueing costs little. */
+const REFRESH_LOCK = 'raster-sdk:refresh';
+/**
+ * Run a refresh under a lock every tab on the origin shares, so two tabs never rotate one
+ * refresh token at once. Without the Web Locks API, or where it refuses the request (an
+ * opaque origin such as Figma's plugin iframe), it runs unlocked: re-reading the store
+ * first then narrows that race rather than closing it.
+ */
+async function withRefreshLock(refresh) {
+    const locks = globalThis.navigator?.locks;
+    if (!locks)
+        return refresh();
+    let granted = false;
+    try {
+        return await locks.request(REFRESH_LOCK, () => {
+            granted = true;
+            return refresh();
+        });
+    }
+    catch (caught) {
+        if (granted)
+            throw caught;
+        return refresh();
+    }
+}
+/**
+ * A 64-bit FNV-1a digest of an API key: the same for the same key, different for another in
+ * practice, and too short to recover the key from.
+ */
+function keyDigest(apiKey) {
+    let hash = 0xcbf29ce484222325n;
+    for (const byte of new TextEncoder().encode(apiKey)) {
+        hash = ((hash ^ BigInt(byte)) * 0x100000001b3n) & 0xffffffffffffffffn;
+    }
+    return hash.toString(36);
+}
+export function createSessionStore(options) {
+    const { credentials: store, auth } = options;
+    let current;
+    /** What `save` is writing, which memory takes only once the store has it. */
+    let writing;
+    let hydrating = null;
+    let refreshing = null;
+    const listeners = new Set();
+    function emit(next) {
+        current = next;
+        for (const listener of listeners)
+            listener(next);
+    }
+    /**
+     * Write first, then change memory and tell listeners. A failed write leaves memory as it
+     * was and rejects with the store's own error, so a sign-in or sign-out the store never took
+     * is not in use either.
+     */
+    async function save(next) {
+        writing = next;
+        try {
+            await store.save(next);
+        }
+        finally {
+            if (writing === next)
+                writing = undefined;
+        }
+        emit(next);
+    }
+    /**
+     * Read the store, filling in the fields a credential saved before they existed lacks:
+     * a missing `oauth` is not `null`, so it would read as signed in.
+     */
+    async function load() {
+        const stored = await store.load();
+        return stored === null ? null : { ...emptyCredentials(), ...stored };
+    }
+    /** Signed-out credentials that keep this install's registration (see `clientId`). */
+    function signedOut() {
+        return { ...SIGNED_OUT, clientId: current?.clientId ?? null };
+    }
+    /** Whether the stored session, or the one being written, is still the one a refresh started from. */
+    function isSameSession(session) {
+        return (writing ?? current)?.oauth?.refreshToken === session.refreshToken;
+    }
+    /**
+     * Single-flight: a provider and a first request can both call this on mount, and two
+     * concurrent loads would race to `emit` — the later one winning even if it read staler
+     * data.
+     */
+    function hydrate() {
+        hydrating ?? (hydrating = load()
+            .then((loaded) => {
+            const next = loaded ?? emptyCredentials();
+            emit(next);
+            return next;
+        })
+            .catch((caught) => {
+            // Clear the cached promise so a transient read failure can be retried rather
+            // than poisoning every later call.
+            hydrating = null;
+            throw caught;
+        }));
+        return hydrating;
+    }
+    async function refresh(session) {
+        let next;
+        try {
+            next = await refreshSession(auth, session);
+        }
+        catch (caught) {
+            // The connection is gone — revoked under Connected apps, membership lost, or the
+            // token was spent already. Only signing in again fixes that, so drop the dead
+            // session now rather than fail every request with it.
+            if (caught instanceof RasterApiError && caught.code === 'invalid_grant') {
+                if (isSameSession(session))
+                    await save(signedOut());
+                throw new RasterApiError('Your Raster session has ended. Sign in again.', 'SESSION_EXPIRED', 401);
+            }
+            throw caught;
+        }
+        // The old refresh token died the moment this one was minted, so memory takes the new
+        // one first and keeps it even if the write fails; the token is handed out only once
+        // written. Skipped if the session changed under us (signed out, or signed in again)
+        // while the refresh was in flight — that newer session must not be clobbered.
+        if (current !== undefined && isSameSession(session)) {
+            const rotated = { ...current, oauth: next };
+            emit(rotated);
+            await store.save(rotated);
+        }
+        return next;
+    }
+    /**
+     * The bearer the credentials can send as they stand, or the session to refresh first:
+     * its token is about to expire, or is the `rejected` one a request just got a 401 with.
+     */
+    function tokenOrStale(credentials, rejected) {
+        if (credentials === undefined || credentials.oauth === null) {
+            const apiKey = credentials?.apiKey;
+            if (!apiKey)
+                throw new RasterApiError('Sign in to Raster first.', 'NOT_SIGNED_IN', 401);
+            return apiKey;
+        }
+        const { oauth } = credentials;
+        const fresh = Date.now() < oauth.expiresAt - EXPIRY_MARGIN_MS;
+        // A rejected token that has already been replaced here: another request refreshed
+        // first, so this one can simply use the new token.
+        return fresh && oauth.accessToken !== rejected ? oauth.accessToken : oauth;
+    }
+    /**
+     * Refresh unless another tab sharing the store got there first. Its copy wins — it may
+     * have rotated the token, signed out, or signed in as somebody else — unless this tab
+     * changed its own credentials while waiting. A store that reads back null is unreadable
+     * (blocked storage), not signed out.
+     */
+    async function refreshLatest(from, rejected) {
+        const stored = await load();
+        if (stored !== null &&
+            current === from &&
+            stored.oauth?.refreshToken !== from?.oauth?.refreshToken) {
+            emit(stored);
+        }
+        const found = tokenOrStale(current, rejected);
+        return typeof found === 'string' ? found : (await refresh(found)).accessToken;
+    }
+    return {
+        current() {
+            return current;
+        },
+        hydrate,
+        save,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        isSignedIn() {
+            return current !== undefined && current.oauth !== null;
+        },
+        isConfigured() {
+            return (current !== undefined &&
+                (current.oauth !== null || (typeof current.apiKey === 'string' && current.apiKey !== '')));
+        },
+        /**
+         * Identifies WHOSE credential is in use, so a caller can tell a token refresh apart
+         * from a different account signing in. Stable across refreshes and reloads, and new
+         * with every sign-in, even one through the same client (see `OAuthSession.signInId`).
+         * A session saved before sign-ins had an id falls back to its client. An API key is
+         * named by its digest, so the key itself never lands in a cache key or a log.
+         */
+        credentialIdentity() {
+            if (current === undefined)
+                return null;
+            const { oauth, apiKey } = current;
+            if (oauth !== null)
+                return `oauth:${oauth.signInId ?? oauth.clientId}`;
+            return apiKey === null ? null : `key:${keyDigest(apiKey)}`;
+        },
+        /**
+         * The bearer to send: the API key, or the session's access token, refreshed first when
+         * it is about to expire or is the `rejected` one. Refreshes are single-flight, because
+         * the server treats a second use of a rotated refresh token as theft and revokes the
+         * whole connection; tabs sharing a store share one too (`refreshLatest`).
+         */
+        async getAccessToken(tokenOptions = {}) {
+            if (current === undefined)
+                await hydrate();
+            const found = tokenOrStale(current, tokenOptions.rejected);
+            if (typeof found === 'string')
+                return found;
+            const from = current;
+            refreshing ?? (refreshing = withRefreshLock(() => refreshLatest(from, tokenOptions.rejected)).finally(() => {
+                refreshing = null;
+            }));
+            return refreshing;
+        },
+        /**
+         * Sign out: clear the session, and revoke it in Raster (best-effort — it is gone
+         * locally either way, and a failed revoke must not leave the user stuck signed in).
+         */
+        async signOut() {
+            const oauth = current?.oauth ?? null;
+            await save(signedOut());
+            if (oauth !== null)
+                await revokeSession(auth, oauth).catch(() => { });
+        },
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAEN,UAAU,EAEV,gBAAgB,GAChB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,6FAA6F;AAC7F,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEzC;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAI,OAAyB;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAA;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,EAAE,CAAA;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,CAAC;QACJ,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE;YAC7C,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,OAAO,EAAE,CAAA;QACjB,CAAC,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,IAAI,OAAO;YAAE,MAAM,MAAM,CAAA;QACzB,OAAO,OAAO,EAAE,CAAA;IACjB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,IAAI,GAAG,mBAAmB,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,mBAAmB,CAAA;IACtE,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AACzB,CAAC;AAwBD,MAAM,UAAU,kBAAkB,CAAC,OAGlC;IACA,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAE5C,IAAI,OAAsC,CAAA;IAC1C,6EAA6E;IAC7E,IAAI,OAAsC,CAAA;IAC1C,IAAI,SAAS,GAAsC,IAAI,CAAA;IACvD,IAAI,UAAU,GAA2B,IAAI,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4C,CAAA;IAErE,SAAS,IAAI,CAAC,IAAuB;QACpC,OAAO,GAAG,IAAI,CAAA;QACd,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CAAC,IAAuB;QAC1C,OAAO,GAAG,IAAI,CAAA;QACd,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,GAAG,SAAS,CAAA;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACX,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,IAAI;QAClB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,EAAE,GAAG,MAAM,EAAE,CAAA;IACrE,CAAC;IAED,qFAAqF;IACrF,SAAS,SAAS;QACjB,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAA;IAC9D,CAAC;IAED,qGAAqG;IACrG,SAAS,aAAa,CAAC,OAAqB;QAC3C,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAA;IAC1E,CAAC;IAED;;;;OAIG;IACH,SAAS,OAAO;QACf,SAAS,KAAT,SAAS,GAAK,IAAI,EAAE;aAClB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,MAAM,IAAI,gBAAgB,EAAE,CAAA;YACzC,IAAI,CAAC,IAAI,CAAC,CAAA;YACV,OAAO,IAAI,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;YACjB,6EAA6E;YAC7E,mCAAmC;YACnC,SAAS,GAAG,IAAI,CAAA;YAChB,MAAM,MAAM,CAAA;QACb,CAAC,CAAC,EAAA;QACH,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAqB;QAC3C,IAAI,IAAkB,CAAA;QACtB,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YACjB,iFAAiF;YACjF,8EAA8E;YAC9E,sDAAsD;YACtD,IAAI,MAAM,YAAY,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACzE,IAAI,aAAa,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;gBACnD,MAAM,IAAI,cAAc,CACvB,+CAA+C,EAC/C,iBAAiB,EACjB,GAAG,CACH,CAAA;YACF,CAAC;YACD,MAAM,MAAM,CAAA;QACb,CAAC;QAED,qFAAqF;QACrF,oFAAoF;QACpF,oFAAoF;QACpF,8EAA8E;QAC9E,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC3C,IAAI,CAAC,OAAO,CAAC,CAAA;YACb,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED;;;OAGG;IACH,SAAS,YAAY,CACpB,WAA0C,EAC1C,QAA4B;QAE5B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,CAAA;YAClC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,0BAA0B,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;YACvF,OAAO,MAAM,CAAA;QACd,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAA;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,gBAAgB,CAAA;QAC7D,kFAAkF;QAClF,mDAAmD;QACnD,OAAO,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAA;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC3B,IAAmC,EACnC,QAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,IACC,MAAM,KAAK,IAAI;YACf,OAAO,KAAK,IAAI;YAChB,MAAM,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,EAAE,KAAK,EAAE,YAAY,EACvD,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAA;IAC9E,CAAC;IAED,OAAO;QACN,OAAO;YACN,OAAO,OAAO,CAAA;QACf,CAAC;QAED,OAAO;QAEP,IAAI;QAEJ,SAAS,CAAC,QAAQ;YACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,OAAO,GAAG,EAAE;gBACX,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3B,CAAC,CAAA;QACF,CAAC;QAED,UAAU;YACT,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAA;QACvD,CAAC;QAED,YAAY;YACX,OAAO,CACN,OAAO,KAAK,SAAS;gBACrB,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CACzF,CAAA;QACF,CAAC;QAED;;;;;;WAMG;QACH,kBAAkB;YACjB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,SAAS,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;YACtE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,CAAA;QAC3D,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,cAAc,CAAC,YAAY,GAAG,EAAE;YACrC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,OAAO,EAAE,CAAA;YAE1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAE3C,MAAM,IAAI,GAAG,OAAO,CAAA;YACpB,UAAU,KAAV,UAAU,GAAK,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CACvF,GAAG,EAAE;gBACJ,UAAU,GAAG,IAAI,CAAA;YAClB,CAAC,CACD,EAAA;YACD,OAAO,UAAU,CAAA;QAClB,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,OAAO;YACZ,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAA;YACpC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACvB,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrE,CAAC;KACD,CAAA;AACF,CAAC","sourcesContent":["import type { CredentialStore } from '../adapters/index.js'\nimport { RasterApiError } from '../api/errors.js'\nimport {\n\ttype OAuthSession,\n\tSIGNED_OUT,\n\ttype StoredCredentials,\n\temptyCredentials,\n} from '../types/session.js'\nimport type { AuthContext } from './http.js'\nimport { refreshSession, revokeSession } from './tokens.js'\n\n/** Refresh this far ahead of `expiresAt`, so a token is never presented right at its edge. */\nconst EXPIRY_MARGIN_MS = 60 * 1000\n\n/** One name for every client on the origin: refreshes are rare, so queueing costs little. */\nconst REFRESH_LOCK = 'raster-sdk:refresh'\n\n/**\n * Run a refresh under a lock every tab on the origin shares, so two tabs never rotate one\n * refresh token at once. Without the Web Locks API, or where it refuses the request (an\n * opaque origin such as Figma's plugin iframe), it runs unlocked: re-reading the store\n * first then narrows that race rather than closing it.\n */\nasync function withRefreshLock<T>(refresh: () => Promise<T>): Promise<T> {\n\tconst locks = globalThis.navigator?.locks\n\tif (!locks) return refresh()\n\tlet granted = false\n\ttry {\n\t\treturn await locks.request(REFRESH_LOCK, () => {\n\t\t\tgranted = true\n\t\t\treturn refresh()\n\t\t})\n\t} catch (caught) {\n\t\tif (granted) throw caught\n\t\treturn refresh()\n\t}\n}\n\n/**\n * A 64-bit FNV-1a digest of an API key: the same for the same key, different for another in\n * practice, and too short to recover the key from.\n */\nfunction keyDigest(apiKey: string): string {\n\tlet hash = 0xcbf29ce484222325n\n\tfor (const byte of new TextEncoder().encode(apiKey)) {\n\t\thash = ((hash ^ BigInt(byte)) * 0x100000001b3n) & 0xffffffffffffffffn\n\t}\n\treturn hash.toString(36)\n}\n\n/**\n * The credential a client holds, and everything that keeps it valid. Each\n * `createRasterClient` has its own, so clients on one page, such as one per Sanity Studio\n * workspace, never share a token.\n */\nexport interface SessionStore {\n\t/** The credentials in memory. `undefined` until `hydrate()` has run. */\n\tcurrent(): StoredCredentials | undefined\n\t/** Load from the `CredentialStore`. Idempotent; safe to await more than once. */\n\thydrate(): Promise<StoredCredentials>\n\t/** Persist, then replace in memory. A failed write changes nothing and rejects with its error. */\n\tsave(credentials: StoredCredentials): Promise<void>\n\t/** Called on every change — a sign-in, a token refresh, a sign-out. */\n\tsubscribe(listener: (credentials: StoredCredentials) => void): () => void\n\tisSignedIn(): boolean\n\t/** Whether there is any credential at all (a session or an API key). */\n\tisConfigured(): boolean\n\tcredentialIdentity(): string | null\n\tgetAccessToken(options?: { rejected?: string }): Promise<string>\n\tsignOut(): Promise<void>\n}\n\nexport function createSessionStore(options: {\n\tcredentials: CredentialStore\n\tauth: AuthContext\n}): SessionStore {\n\tconst { credentials: store, auth } = options\n\n\tlet current: StoredCredentials | undefined\n\t/** What `save` is writing, which memory takes only once the store has it. */\n\tlet writing: StoredCredentials | undefined\n\tlet hydrating: Promise<StoredCredentials> | null = null\n\tlet refreshing: Promise<string> | null = null\n\tconst listeners = new Set<(credentials: StoredCredentials) => void>()\n\n\tfunction emit(next: StoredCredentials): void {\n\t\tcurrent = next\n\t\tfor (const listener of listeners) listener(next)\n\t}\n\n\t/**\n\t * Write first, then change memory and tell listeners. A failed write leaves memory as it\n\t * was and rejects with the store's own error, so a sign-in or sign-out the store never took\n\t * is not in use either.\n\t */\n\tasync function save(next: StoredCredentials): Promise<void> {\n\t\twriting = next\n\t\ttry {\n\t\t\tawait store.save(next)\n\t\t} finally {\n\t\t\tif (writing === next) writing = undefined\n\t\t}\n\t\temit(next)\n\t}\n\n\t/**\n\t * Read the store, filling in the fields a credential saved before they existed lacks:\n\t * a missing `oauth` is not `null`, so it would read as signed in.\n\t */\n\tasync function load(): Promise<StoredCredentials | null> {\n\t\tconst stored = await store.load()\n\t\treturn stored === null ? null : { ...emptyCredentials(), ...stored }\n\t}\n\n\t/** Signed-out credentials that keep this install's registration (see `clientId`). */\n\tfunction signedOut(): StoredCredentials {\n\t\treturn { ...SIGNED_OUT, clientId: current?.clientId ?? null }\n\t}\n\n\t/** Whether the stored session, or the one being written, is still the one a refresh started from. */\n\tfunction isSameSession(session: OAuthSession): boolean {\n\t\treturn (writing ?? current)?.oauth?.refreshToken === session.refreshToken\n\t}\n\n\t/**\n\t * Single-flight: a provider and a first request can both call this on mount, and two\n\t * concurrent loads would race to `emit` — the later one winning even if it read staler\n\t * data.\n\t */\n\tfunction hydrate(): Promise<StoredCredentials> {\n\t\thydrating ??= load()\n\t\t\t.then((loaded) => {\n\t\t\t\tconst next = loaded ?? emptyCredentials()\n\t\t\t\temit(next)\n\t\t\t\treturn next\n\t\t\t})\n\t\t\t.catch((caught) => {\n\t\t\t\t// Clear the cached promise so a transient read failure can be retried rather\n\t\t\t\t// than poisoning every later call.\n\t\t\t\thydrating = null\n\t\t\t\tthrow caught\n\t\t\t})\n\t\treturn hydrating\n\t}\n\n\tasync function refresh(session: OAuthSession): Promise<OAuthSession> {\n\t\tlet next: OAuthSession\n\t\ttry {\n\t\t\tnext = await refreshSession(auth, session)\n\t\t} catch (caught) {\n\t\t\t// The connection is gone — revoked under Connected apps, membership lost, or the\n\t\t\t// token was spent already. Only signing in again fixes that, so drop the dead\n\t\t\t// session now rather than fail every request with it.\n\t\t\tif (caught instanceof RasterApiError && caught.code === 'invalid_grant') {\n\t\t\t\tif (isSameSession(session)) await save(signedOut())\n\t\t\t\tthrow new RasterApiError(\n\t\t\t\t\t'Your Raster session has ended. Sign in again.',\n\t\t\t\t\t'SESSION_EXPIRED',\n\t\t\t\t\t401\n\t\t\t\t)\n\t\t\t}\n\t\t\tthrow caught\n\t\t}\n\n\t\t// The old refresh token died the moment this one was minted, so memory takes the new\n\t\t// one first and keeps it even if the write fails; the token is handed out only once\n\t\t// written. Skipped if the session changed under us (signed out, or signed in again)\n\t\t// while the refresh was in flight — that newer session must not be clobbered.\n\t\tif (current !== undefined && isSameSession(session)) {\n\t\t\tconst rotated = { ...current, oauth: next }\n\t\t\temit(rotated)\n\t\t\tawait store.save(rotated)\n\t\t}\n\t\treturn next\n\t}\n\n\t/**\n\t * The bearer the credentials can send as they stand, or the session to refresh first:\n\t * its token is about to expire, or is the `rejected` one a request just got a 401 with.\n\t */\n\tfunction tokenOrStale(\n\t\tcredentials: StoredCredentials | undefined,\n\t\trejected: string | undefined\n\t): string | OAuthSession {\n\t\tif (credentials === undefined || credentials.oauth === null) {\n\t\t\tconst apiKey = credentials?.apiKey\n\t\t\tif (!apiKey) throw new RasterApiError('Sign in to Raster first.', 'NOT_SIGNED_IN', 401)\n\t\t\treturn apiKey\n\t\t}\n\n\t\tconst { oauth } = credentials\n\t\tconst fresh = Date.now() < oauth.expiresAt - EXPIRY_MARGIN_MS\n\t\t// A rejected token that has already been replaced here: another request refreshed\n\t\t// first, so this one can simply use the new token.\n\t\treturn fresh && oauth.accessToken !== rejected ? oauth.accessToken : oauth\n\t}\n\n\t/**\n\t * Refresh unless another tab sharing the store got there first. Its copy wins — it may\n\t * have rotated the token, signed out, or signed in as somebody else — unless this tab\n\t * changed its own credentials while waiting. A store that reads back null is unreadable\n\t * (blocked storage), not signed out.\n\t */\n\tasync function refreshLatest(\n\t\tfrom: StoredCredentials | undefined,\n\t\trejected: string | undefined\n\t): Promise<string> {\n\t\tconst stored = await load()\n\t\tif (\n\t\t\tstored !== null &&\n\t\t\tcurrent === from &&\n\t\t\tstored.oauth?.refreshToken !== from?.oauth?.refreshToken\n\t\t) {\n\t\t\temit(stored)\n\t\t}\n\t\tconst found = tokenOrStale(current, rejected)\n\t\treturn typeof found === 'string' ? found : (await refresh(found)).accessToken\n\t}\n\n\treturn {\n\t\tcurrent() {\n\t\t\treturn current\n\t\t},\n\n\t\thydrate,\n\n\t\tsave,\n\n\t\tsubscribe(listener) {\n\t\t\tlisteners.add(listener)\n\t\t\treturn () => {\n\t\t\t\tlisteners.delete(listener)\n\t\t\t}\n\t\t},\n\n\t\tisSignedIn() {\n\t\t\treturn current !== undefined && current.oauth !== null\n\t\t},\n\n\t\tisConfigured() {\n\t\t\treturn (\n\t\t\t\tcurrent !== undefined &&\n\t\t\t\t(current.oauth !== null || (typeof current.apiKey === 'string' && current.apiKey !== ''))\n\t\t\t)\n\t\t},\n\n\t\t/**\n\t\t * Identifies WHOSE credential is in use, so a caller can tell a token refresh apart\n\t\t * from a different account signing in. Stable across refreshes and reloads, and new\n\t\t * with every sign-in, even one through the same client (see `OAuthSession.signInId`).\n\t\t * A session saved before sign-ins had an id falls back to its client. An API key is\n\t\t * named by its digest, so the key itself never lands in a cache key or a log.\n\t\t */\n\t\tcredentialIdentity() {\n\t\t\tif (current === undefined) return null\n\t\t\tconst { oauth, apiKey } = current\n\t\t\tif (oauth !== null) return `oauth:${oauth.signInId ?? oauth.clientId}`\n\t\t\treturn apiKey === null ? null : `key:${keyDigest(apiKey)}`\n\t\t},\n\n\t\t/**\n\t\t * The bearer to send: the API key, or the session's access token, refreshed first when\n\t\t * it is about to expire or is the `rejected` one. Refreshes are single-flight, because\n\t\t * the server treats a second use of a rotated refresh token as theft and revokes the\n\t\t * whole connection; tabs sharing a store share one too (`refreshLatest`).\n\t\t */\n\t\tasync getAccessToken(tokenOptions = {}) {\n\t\t\tif (current === undefined) await hydrate()\n\n\t\t\tconst found = tokenOrStale(current, tokenOptions.rejected)\n\t\t\tif (typeof found === 'string') return found\n\n\t\t\tconst from = current\n\t\t\trefreshing ??= withRefreshLock(() => refreshLatest(from, tokenOptions.rejected)).finally(\n\t\t\t\t() => {\n\t\t\t\t\trefreshing = null\n\t\t\t\t}\n\t\t\t)\n\t\t\treturn refreshing\n\t\t},\n\n\t\t/**\n\t\t * Sign out: clear the session, and revoke it in Raster (best-effort — it is gone\n\t\t * locally either way, and a failed revoke must not leave the user stuck signed in).\n\t\t */\n\t\tasync signOut() {\n\t\t\tconst oauth = current?.oauth ?? null\n\t\t\tawait save(signedOut())\n\t\t\tif (oauth !== null) await revokeSession(auth, oauth).catch(() => {})\n\t\t},\n\t}\n}\n"]}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,10 @@
+import type { OAuthSession } from '../types/session.js';
+import { type AuthContext } from './http.js';
+/**
+ * Trade the refresh token for a new access token — and a new refresh token, since they
+ * rotate. `invalid_grant` means the connection is gone (revoked in Raster, membership lost,
+ * or the token was already spent): only a fresh sign-in can recover from that.
+ */
+export declare function refreshSession(context: AuthContext, session: OAuthSession): Promise<OAuthSession>;
+/** Revoke the connection (RFC 7009). The server answers 200 whatever the token's state. */
+export declare function revokeSession(context: AuthContext, session: OAuthSession): Promise<void>;

package/dist/auth/tokens.js

@@ -0,0 +1,20 @@
+import { authPost, toSession } from './http.js';
+/**
+ * Trade the refresh token for a new access token — and a new refresh token, since they
+ * rotate. `invalid_grant` means the connection is gone (revoked in Raster, membership lost,
+ * or the token was already spent): only a fresh sign-in can recover from that.
+ */
+export async function refreshSession(context, session) {
+    const token = await authPost(context, '/oauth/token', {
+        grant_type: 'refresh_token',
+        refresh_token: session.refreshToken,
+        client_id: session.clientId,
+    });
+    // A rotation replaces the tokens, not the sign-in they belong to (`signInId`).
+    return { ...session, ...toSession(session.clientId, token) };
+}
+/** Revoke the connection (RFC 7009). The server answers 200 whatever the token's state. */
+export async function revokeSession(context, session) {
+    await authPost(context, '/oauth/revoke', { token: session.refreshToken });
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAoB,EACpB,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,OAAO,EAAE,cAAc,EAAE;QACpE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IACF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,OAAqB;IAC9E,MAAM,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;AAC1E,CAAC","sourcesContent":["import type { OAuthSession } from '../types/session.js'\nimport { type AuthContext, type TokenResponse, authPost, toSession } from './http.js'\n\n/**\n * Trade the refresh token for a new access token — and a new refresh token, since they\n * rotate. `invalid_grant` means the connection is gone (revoked in Raster, membership lost,\n * or the token was already spent): only a fresh sign-in can recover from that.\n */\nexport async function refreshSession(\n\tcontext: AuthContext,\n\tsession: OAuthSession\n): Promise<OAuthSession> {\n\tconst token = await authPost<TokenResponse>(context, '/oauth/token', {\n\t\tgrant_type: 'refresh_token',\n\t\trefresh_token: session.refreshToken,\n\t\tclient_id: session.clientId,\n\t})\n\t// A rotation replaces the tokens, not the sign-in they belong to (`signInId`).\n\treturn { ...session, ...toSession(session.clientId, token) }\n}\n\n/** Revoke the connection (RFC 7009). The server answers 200 whatever the token's state. */\nexport async function revokeSession(context: AuthContext, session: OAuthSession): Promise<void> {\n\tawait authPost(context, '/oauth/revoke', { token: session.refreshToken })\n}\n"]}

package/dist/client.d.ts

@@ -0,0 +1,138 @@
+import type { CredentialStore, RasterHost } from './adapters/index.js';
+import { hasMorePages } from './api/assets.js';
+import { type Me } from './api/me.js';
+import { type PromoteResult } from './api/promote.js';
+import { type SearchResult } from './api/search.js';
+import { type Transport } from './api/transport.js';
+import { type UploadSource } from './api/upload.js';
+import { type DeviceAuthorization } from './auth/device.js';
+import { type SessionStore } from './auth/session.js';
+import type { Asset, UploadedAsset } from './types/asset.js';
+import type { Library } from './types/library.js';
+import type { OAuthSession, StoredCredentials } from './types/session.js';
+export type RasterClientConfig = {
+    /** Which application this is, and how it reaches the user's browser. */
+    host: RasterHost;
+    /** Where the credential lives. See the security note on `CredentialStore`. */
+    credentials: CredentialStore;
+    /** Override for tests or a proxy. Defaults to `https://api.raster.app`. */
+    apiOrigin?: string;
+    /** Override for tests. Defaults to `https://raster.app`. */
+    authOrigin?: string;
+    /** Override `fetch`. Defaults to the global one, bound to `globalThis`. */
+    fetch?: typeof globalThis.fetch;
+};
+export interface RasterClient {
+    readonly host: RasterHost;
+    readonly session: SessionStore;
+    /** Escape hatch: the raw authorized transport, for endpoints the SDK has not wrapped. */
+    readonly transport: Transport;
+    /** Resolve what the current credential can reach. Doubles as credential validation. */
+    me(bearer?: string): Promise<Me>;
+    libraries: {
+        /** Every library in the organization, however many pages that takes. */
+        list(options: {
+            organizationId: string;
+            organizationName?: string | null;
+            signal?: AbortSignal;
+        }): Promise<Array<Library>>;
+    };
+    assets: {
+        list(options: {
+            organizationId: string;
+            libraryId: string;
+            page?: number;
+            pageSize?: number;
+            signal?: AbortSignal;
+        }): Promise<Array<Asset>>;
+        get(options: {
+            organizationId: string;
+            libraryId: string;
+            assetId: string;
+            signal?: AbortSignal;
+        }): Promise<Asset>;
+        upload(options: {
+            organizationId: string;
+            libraryId: string;
+            parentId?: string | null;
+            source: UploadSource;
+            filename?: string;
+            signal?: AbortSignal;
+        }): Promise<UploadedAsset>;
+        /**
+         * Wait until Raster has processed an upload, which is after `upload` returns. Resolves
+         * with the asset — for a variant, its parent, whose `variants` then carry it — or with
+         * null if it was still processing when the wait gave up.
+         */
+        waitUntilProcessed(options: {
+            organizationId: string;
+            libraryId: string;
+            assetId: string;
+            parentId?: string | null;
+            signal?: AbortSignal;
+        }): Promise<Asset | null>;
+        promote(options: {
+            organizationId: string;
+            libraryId: string;
+            assetId: string;
+            variantId: string;
+            signal?: AbortSignal;
+        }): Promise<PromoteResult>;
+        /**
+         * Wait until a promote has landed, which is after `promote` returns. Resolves with the
+         * asset as it then reads, or with null if it had not landed when the wait gave up.
+         */
+        waitUntilPromoted(options: {
+            organizationId: string;
+            libraryId: string;
+            assetId: string;
+            variantId: string;
+            signal?: AbortSignal;
+        }): Promise<Asset | null>;
+        hasMorePages: typeof hasMorePages;
+    };
+    search(options: {
+        organizationId: string;
+        query: string;
+        libraryIds?: Array<string>;
+        page?: number;
+        pageSize?: number;
+        signal?: AbortSignal;
+    }): Promise<SearchResult>;
+    auth: {
+        /**
+         * Sign in with the device grant (RFC 8628), which works in every host, a Figma plugin's
+         * null-origin iframe included. Opens the consent page through `host.openExternal` as
+         * soon as the code exists, unless `openBrowser: false` leaves that to the caller.
+         */
+        signInWithDevice(options: {
+            onCode: (device: DeviceAuthorization) => void;
+            signal: AbortSignal;
+            openBrowser?: boolean;
+            /**
+             * `user`, the default, lets the user grant every organization or narrow the grant to
+             * one on the consent page; `org` has them pick exactly one. Access tokens last 60
+             * minutes for one organization and 15 for every organization.
+             */
+            scope?: 'user' | 'org';
+            /**
+             * The organization the sign-in must be bound to. The consent page cannot preselect it,
+             * so when the user grants another, or the whole account, the session is revoked
+             * unsaved and the call fails with `ORGANIZATION_MISMATCH`.
+             */
+            organizationId?: string;
+        }): Promise<StoredCredentials>;
+        /**
+         * Adopt a credential once `/me` accepts it, and persist what `/me` reports with it (the
+         * account name, the organizations reached). The device sign-in ends here too. Verifying
+         * first makes a bad key an error on the form rather than a broken session later.
+         */
+        connect(credential: {
+            apiKey: string;
+        } | {
+            oauth: OAuthSession;
+        }): Promise<StoredCredentials>;
+        signOut(): Promise<void>;
+    };
+}
+export declare function createRasterClient(config: RasterClientConfig): RasterClient;