@remixhq/core 0.1.38 → 0.1.39

package/dist/api.d.ts

@@ -1,5 +1,5 @@
 import { CoreConfig } from './config.js';
-import { T as TokenProvider } from './tokenProvider-B9so5Pm3.js';
+import { T as TokenProvider } from './tokenProvider-BP3YfJHm.js';
 import { T as TurnUsage } from './contracts-DTeSJnoC.js';
 import 'zod';
 

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
-import { W as WithRefreshLock, S as SessionStore, a as StoredSession } from './tokenProvider-B9so5Pm3.js';
-export { R as RefreshLockOptions, e as RefreshStoredSession, f as ResolvedAuthToken, T as TokenProvider, c as createRefreshLock, b as createStoredSessionTokenProvider, s as shouldRefreshSoon, d as storedSessionSchema } from './tokenProvider-B9so5Pm3.js';
+import { W as WithRefreshLock, S as SessionStore, a as StoredSession } from './tokenProvider-BP3YfJHm.js';
+export { R as RefreshLockOptions, e as RefreshStoredSession, f as ResolvedAuthToken, T as TokenProvider, c as createRefreshLock, b as createStoredSessionTokenProvider, s as shouldRefreshSoon, d as storedSessionSchema } from './tokenProvider-BP3YfJHm.js';
 import { CoreConfig } from './config.js';
 import 'zod';
 
@@ -31,10 +31,10 @@ declare function createDefaultRefreshLock(filePath?: string): WithRefreshLock;
  *   - `isNetworkError`: transient — DNS / TCP / TLS / undici fetch
  *     dropped mid-flight. Keep the existing session (it may already
  *     be unusable but the *refresh token* is most likely still alive
- *     server-side, especially within Supabase's reuse interval). The
+ *     server-side, especially within the backend's refresh-token reuse interval). The
  *     next attempt will retry.
  *
- *   - `isInvalidGrantError`: terminal — Supabase explicitly said the
+ *   - `isInvalidGrantError`: terminal — the backend explicitly said the
  *     refresh token is dead (revoked, reused outside the grace
  *     window, user signed out elsewhere). No amount of retrying will
  *     fix it; the user must re-authenticate.
@@ -46,19 +46,22 @@ declare function createDefaultRefreshLock(filePath?: string): WithRefreshLock;
 declare function isNetworkError(err: unknown): boolean;
 declare function isInvalidGrantError(err: unknown): boolean;
 
-type SupabaseAuthHelpers = {
+type RemixAuthHelpers = {
     startGoogleLogin(params: {
         redirectTo: string;
+        state?: string;
     }): Promise<{
         url: string;
+        codeVerifier?: string;
     }>;
     exchangeCode(params: {
         code: string;
+        codeVerifier?: string;
     }): Promise<StoredSession>;
     refreshWithStoredSession(params: {
         session: StoredSession;
     }): Promise<StoredSession>;
 };
-declare function createSupabaseAuthHelpers(config: CoreConfig): SupabaseAuthHelpers;
+declare function createRemixAuthHelpers(config: CoreConfig): RemixAuthHelpers;
 
-export { SessionStore, StoredSession, type SupabaseAuthHelpers, WithRefreshLock, createDefaultRefreshLock, createLocalSessionStore, createSupabaseAuthHelpers, defaultSessionFilePath, isInvalidGrantError, isNetworkError };
+export { type RemixAuthHelpers, SessionStore, StoredSession, WithRefreshLock, createDefaultRefreshLock, createLocalSessionStore, createRemixAuthHelpers, defaultSessionFilePath, isInvalidGrantError, isNetworkError };

package/dist/auth.js

@@ -2,21 +2,21 @@ import {
   createDefaultRefreshLock,
   createLocalSessionStore,
   createRefreshLock,
+  createRemixAuthHelpers,
   createStoredSessionTokenProvider,
-  createSupabaseAuthHelpers,
   defaultSessionFilePath,
   isInvalidGrantError,
   isNetworkError,
   shouldRefreshSoon,
   storedSessionSchema
-} from "./chunk-OMJ4JDME.js";
+} from "./chunk-QCRTVR5N.js";
 import "./chunk-7XJGOKEO.js";
 export {
   createDefaultRefreshLock,
   createLocalSessionStore,
   createRefreshLock,
+  createRemixAuthHelpers,
   createStoredSessionTokenProvider,
-  createSupabaseAuthHelpers,
   defaultSessionFilePath,
   isInvalidGrantError,
   isNetworkError,

package/dist/{chunk-OMJ4JDME.js → chunk-QCRTVR5N.js}

@@ -209,7 +209,7 @@ function isNetworkError(err) {
   if (e.cause) return isNetworkError(e.cause);
   return false;
 }
-var INVALID_GRANT_MESSAGE_PATTERN = /invalid[_ ]grant|invalid refresh token|refresh[_ ]token[_ ]not[_ ]found|token has expired or (been )?revoked|already used|user from sub claim in jwt does not exist/i;
+var INVALID_GRANT_MESSAGE_PATTERN = /invalid[_ ]grant|invalid refresh token|refresh[_ ]token[_ ]not[_ ]found|refresh token (has )?(been )?(expired|revoked)|token has expired or (been )?revoked|already used|user from sub claim in jwt does not exist/i;
 function isInvalidGrantError(err) {
   if (!err || typeof err !== "object") return false;
   const e = err;
@@ -222,6 +222,12 @@ function isInvalidGrantError(err) {
 }
 
 // src/auth/tokenProvider.ts
+function firstNonEmptyEnvToken() {
+  for (const value of [process.env.REMIX_ACCESS_TOKEN, process.env.COMERGE_ACCESS_TOKEN]) {
+    if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  }
+  return null;
+}
 function shouldRefreshSoon(session, skewSeconds = 60) {
   const nowSec = Math.floor(Date.now() / 1e3);
   return session.expires_at <= nowSec + skewSeconds;
@@ -230,15 +236,15 @@ function createStoredSessionTokenProvider(params) {
   const withLock = params.withRefreshLock ?? (async (fn) => fn());
   return async (opts) => {
     const forceRefresh = Boolean(opts?.forceRefresh);
-    const envToken = process.env.COMERGE_ACCESS_TOKEN;
-    if (typeof envToken === "string" && envToken.trim().length > 0) {
-      return { token: envToken.trim(), session: null, fromEnv: true };
+    const envToken = firstNonEmptyEnvToken();
+    if (envToken) {
+      return { token: envToken, session: null, fromEnv: true };
     }
     let session = await params.sessionStore.getSession();
     if (!session) {
       throw new RemixError("Not signed in.", {
         exitCode: 2,
-        hint: "Run `remix login`, or set COMERGE_ACCESS_TOKEN for CI."
+        hint: "Run `remix login`, or set REMIX_ACCESS_TOKEN for CI."
       });
     }
     if (forceRefresh || shouldRefreshSoon(session)) {
@@ -250,7 +256,7 @@ function createStoredSessionTokenProvider(params) {
           if (!base) {
             throw new RemixError("Not signed in.", {
               exitCode: 2,
-              hint: "Run `remix login`, or set COMERGE_ACCESS_TOKEN for CI."
+              hint: "Run `remix login`, or set REMIX_ACCESS_TOKEN for CI."
             });
           }
           const siblingRefreshed = latest != null && latest.access_token !== sessionAtEntry.access_token;
@@ -281,80 +287,72 @@ function createStoredSessionTokenProvider(params) {
 }
 
 // src/auth/supabase.ts
-import { createClient } from "@supabase/supabase-js";
-function createInMemoryStorage() {
-  const map = /* @__PURE__ */ new Map();
-  return {
-    getItem: (k) => map.get(k) ?? null,
-    setItem: (k, v) => {
-      map.set(k, v);
-    },
-    removeItem: (k) => {
-      map.delete(k);
-    }
-  };
-}
-function createSupabaseClient(config, storage) {
-  return createClient(config.supabaseUrl, config.supabaseAnonKey, {
-    auth: {
-      flowType: "pkce",
-      persistSession: false,
-      autoRefreshToken: false,
-      detectSessionInUrl: false,
-      storage
-    },
-    global: {
-      headers: {
-        "X-Requested-By": "comerge-cli"
-      }
-    }
+import crypto from "crypto";
+async function postBackend(config, path3, body, options) {
+  const response = await fetch(new URL(path3, config.apiUrl), {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Requested-By": "remix-cli" },
+    ...options?.credentials ? { credentials: options.credentials } : {},
+    body: JSON.stringify(body)
   });
+  const payload = await response.json();
+  if (!response.ok || !payload.success || payload.responseObject == null) {
+    throw new RemixError(payload.message || `Remix backend request failed with status ${response.status}.`, {
+      exitCode: 1
+    });
+  }
+  return payload.responseObject;
 }
-function toStoredSession(session) {
-  if (!session.access_token || !session.refresh_token || !session.expires_at) {
-    throw new RemixError("Supabase session is missing required fields.", { exitCode: 1 });
+function toStoredSession(payload) {
+  if (!payload.accessToken || !payload.refreshToken) {
+    throw new RemixError("Remix backend did not return a token pair.", { exitCode: 1 });
   }
+  const expiresIn = Number.isFinite(payload.expiresIn) && payload.expiresIn ? payload.expiresIn : 15 * 60;
   return {
-    access_token: session.access_token,
-    refresh_token: session.refresh_token,
-    expires_at: session.expires_at,
-    token_type: session.token_type ?? void 0,
-    user: session.user ? { id: session.user.id, email: session.user.email ?? null } : void 0
+    access_token: payload.accessToken,
+    refresh_token: payload.refreshToken,
+    expires_at: Math.floor(Date.now() / 1e3) + expiresIn,
+    token_type: payload.tokenType ?? "Bearer",
+    user: payload.user?.id ? { id: payload.user.id, email: payload.user.email ?? null } : void 0
   };
 }
-function createSupabaseAuthHelpers(config) {
-  const storage = createInMemoryStorage();
-  const supabase = createSupabaseClient(config, storage);
+function createPkcePair() {
+  const codeVerifier = crypto.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge };
+}
+function normalizeBrowserReturnTo(redirectTo) {
+  try {
+    const url = new URL(redirectTo);
+    if (url.protocol === "http:" || url.protocol === "https:") {
+      return `${url.pathname}${url.search}${url.hash}`;
+    }
+  } catch {
+  }
+  return redirectTo;
+}
+function createRemixAuthHelpers(config) {
   return {
     async startGoogleLogin(params) {
-      const { data, error } = await supabase.auth.signInWithOAuth({
-        provider: "google",
-        options: {
-          redirectTo: params.redirectTo,
-          skipBrowserRedirect: true,
-          queryParams: {
-            access_type: "offline",
-            prompt: "consent"
-          }
-        }
-      });
-      if (error) throw error;
-      if (!data?.url) throw new RemixError("Supabase did not return an OAuth URL.", { exitCode: 1 });
-      return { url: data.url };
+      const path3 = params.state ? "/v1/auth/cli/login-url" : "/v1/auth/login-url";
+      const pkce = params.state ? createPkcePair() : null;
+      const body = params.state ? { returnTo: params.redirectTo, state: params.state, codeChallenge: pkce?.codeChallenge } : { returnTo: normalizeBrowserReturnTo(params.redirectTo) };
+      const result = await postBackend(config, path3, body, params.state ? void 0 : { credentials: "include" });
+      if (!result.url) throw new RemixError("Remix backend did not return an auth URL.", { exitCode: 1 });
+      return pkce ? { url: result.url, codeVerifier: pkce.codeVerifier } : { url: result.url };
     },
     async exchangeCode(params) {
-      const { data, error } = await supabase.auth.exchangeCodeForSession(params.code);
-      if (error) throw error;
-      if (!data?.session) throw new RemixError("Supabase did not return a session.", { exitCode: 1 });
-      return toStoredSession(data.session);
+      const result = await postBackend(config, "/v1/auth/cli/exchange", {
+        code: params.code,
+        ...params.codeVerifier ? { codeVerifier: params.codeVerifier } : {}
+      });
+      return toStoredSession(result);
     },
     async refreshWithStoredSession(params) {
-      const { data, error } = await supabase.auth.refreshSession({
-        refresh_token: params.session.refresh_token
+      const result = await postBackend(config, "/v1/auth/token/refresh", {
+        refreshToken: params.session.refresh_token
       });
-      if (error) throw error;
-      if (!data?.session) throw new RemixError("No session returned after refresh.", { exitCode: 1 });
-      return toStoredSession(data.session);
+      return toStoredSession(result);
     }
   };
 }
@@ -369,5 +367,5 @@ export {
   isInvalidGrantError,
   shouldRefreshSoon,
   createStoredSessionTokenProvider,
-  createSupabaseAuthHelpers
+  createRemixAuthHelpers
 };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { CliError, REMIX_ERROR_CODES, CliError as RemixError, RemixErrorCode } from './errors.js';
 export { CoreConfig, ResolveConfigOptions, configSchema, resolveConfig } from './config.js';
-export { S as SessionStore, a as StoredSession, W as WithRefreshLock, c as createRefreshLock, b as createStoredSessionTokenProvider, s as shouldRefreshSoon, d as storedSessionSchema } from './tokenProvider-B9so5Pm3.js';
-export { createDefaultRefreshLock, createLocalSessionStore, createSupabaseAuthHelpers, defaultSessionFilePath, isInvalidGrantError, isNetworkError } from './auth.js';
+export { S as SessionStore, a as StoredSession, W as WithRefreshLock, c as createRefreshLock, b as createStoredSessionTokenProvider, s as shouldRefreshSoon, d as storedSessionSchema } from './tokenProvider-BP3YfJHm.js';
+export { createDefaultRefreshLock, createLocalSessionStore, createRemixAuthHelpers, defaultSessionFilePath, isInvalidGrantError, isNetworkError } from './auth.js';
 export { AgentMemoryItem, AgentMemoryKind, AgentMemorySearchItem, AgentMemorySearchResponse, AgentMemorySummary, AgentMemoryTimelineResponse, ApiClient, AppContext, AppContextAccessPath, AppPreviewExpectedKind, AppPreviewProcessStatus, AppPreviewQuery, AppPreviewResponse, AppReconcileResponse, AppSandboxCommandRun, AppShareLinkSummary, Bundle, BundlePlatform, BundleStatus, ChangeStepDiffResponse, CreateAppShareLinkPayload, DetectProjectRuntimeTargetsPayload, ImportProjectRuntimeEnvPayload, InitiateBundleRequest, InvitationRecord, MergeRequest, MergeRequestReview, MergeRequestStatus, ProjectRuntimeEnvMetadata, ProjectRuntimeEnvScope, ProjectRuntimeTargetMetadata, ProjectRuntimeTargetScope, ProjectTrigger, ProjectTriggerPayload, ProjectTriggerScope, ProjectTriggerStep, ProjectTriggerStepPayload, ReconcilePreflightResponse, ResolveProjectRuntimeEnvForLocalPullResponse, RunAppRuntimeTargetPayload, RunAppSandboxCommandPayload, RunAppTriggerEventPayload, RunAppTriggerPayload, RuntimeCommandKind, RuntimeTargetKind, SetProjectRuntimeEnvPayload, SetProjectRuntimeTargetPayload, SyncLocalResponse, SyncUpstreamResponse, TriggerEventMetadata, TriggerEventSource, TriggerIntegrationStatus, TriggerMode, TriggerRun, TriggerStepRun, TriggerStepType, UpdateProjectTriggerPayload, createApiClient } from './api.js';
 import 'zod';
 import './contracts-DTeSJnoC.js';

package/dist/index.js

@@ -5,14 +5,14 @@ import {
   createDefaultRefreshLock,
   createLocalSessionStore,
   createRefreshLock,
+  createRemixAuthHelpers,
   createStoredSessionTokenProvider,
-  createSupabaseAuthHelpers,
   defaultSessionFilePath,
   isInvalidGrantError,
   isNetworkError,
   shouldRefreshSoon,
   storedSessionSchema
-} from "./chunk-OMJ4JDME.js";
+} from "./chunk-QCRTVR5N.js";
 import {
   configSchema,
   resolveConfig
@@ -33,8 +33,8 @@ export {
   createDefaultRefreshLock,
   createLocalSessionStore,
   createRefreshLock,
+  createRemixAuthHelpers,
   createStoredSessionTokenProvider,
-  createSupabaseAuthHelpers,
   defaultSessionFilePath,
   isInvalidGrantError,
   isNetworkError,

package/dist/{tokenProvider-B9so5Pm3.d.ts → tokenProvider-BP3YfJHm.d.ts}

@@ -69,12 +69,12 @@ type TokenProvider = (opts?: {
 declare function shouldRefreshSoon(session: StoredSession, skewSeconds?: number): boolean;
 /**
  * Token provider that resolves a fresh access token from a stored
- * Supabase session, refreshing it through `refreshStoredSession` when
+ * Remix app session, refreshing it through `refreshStoredSession` when
  * the cached token is at/near expiry.
  *
  * # Why this code is more careful than it looks
  *
- * Supabase rotates refresh tokens: every successful refresh server-
+ * Remix rotates refresh tokens: every successful refresh server-
  * side invalidates the old refresh token and issues a new one. If we
  * lose the new token before persisting it (network drop after the
  * server processed our request; multiple processes refreshing the
@@ -101,7 +101,7 @@ declare function shouldRefreshSoon(session: StoredSession, skewSeconds?: number)
  *   3. **Network-vs-auth error classification** — `fetch failed`
  *      keeps the existing session (the refresh may or may not have
  *      landed server-side; we'll find out on the next attempt, ideally
- *      within Supabase's reuse interval). Only `invalid_grant` /
+ *      within the backend's reuse interval). Only `invalid_grant` /
  *      "refresh token not found" clears state and surfaces a clean
  *      sign-in prompt — by then the token is definitively dead and
  *      retrying won't help.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remixhq/core",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Remix core library",
   "homepage": "https://github.com/RemixDotOne/remix-core",
   "license": "MIT",