@seletech/sele 0.0.0-stage → 0.1.1

package/dist/cjs/http.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enc = exports.Http = exports.SeleError = void 0;
+/** Thrown for every non-2xx response. `code` is the machine-readable error code from the API. */
+class SeleError extends Error {
+    status;
+    code;
+    requestId;
+    body;
+    constructor(status, code, message, body, requestId) {
+        super(message);
+        this.name = 'SeleError';
+        this.status = status;
+        this.code = code;
+        this.body = body;
+        this.requestId = requestId;
+    }
+}
+exports.SeleError = SeleError;
+class Http {
+    baseUrl;
+    apiKey;
+    fetchFn;
+    timeoutMs;
+    constructor(defaults, o = {}) {
+        this.baseUrl = (o.baseUrl ?? defaults.baseUrl).replace(/\/+$/, '');
+        this.apiKey = o.apiKey;
+        this.fetchFn = o.fetch ?? ((i, init) => fetch(i, init));
+        this.timeoutMs = o.timeoutMs ?? 15000;
+    }
+    async raw(method, path, init = {}) {
+        const q = init.query ? Object.entries(init.query).filter(([, v]) => v !== undefined).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join('&') : '';
+        const headers = { ...init.headers };
+        if (this.apiKey && !headers.authorization)
+            headers.authorization = `Bearer ${this.apiKey}`;
+        const res = await this.fetchFn(`${this.baseUrl}${path}${q ? `?${q}` : ''}`, { method, headers, body: init.body ?? undefined, signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!res.ok)
+            throw await toError(res);
+        return res;
+    }
+    async json(method, path, body, query) {
+        const res = await this.raw(method, path, { headers: body === undefined ? {} : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body), query });
+        return (await res.json());
+    }
+}
+exports.Http = Http;
+async function toError(res) {
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch { /* not JSON */ }
+    const e = body?.error;
+    const code = typeof e === 'string' ? e : typeof e?.code === 'string' ? e.code : `http_${res.status}`;
+    const message = typeof e?.message === 'string' ? e.message : typeof body?.error_description === 'string' ? body.error_description : `Request failed with status ${res.status}`;
+    return new SeleError(res.status, code, message, body, typeof e?.request_id === 'string' ? e.request_id : undefined);
+}
+const enc = (s) => s.split('/').map(encodeURIComponent).join('/');
+exports.enc = enc;

package/dist/cjs/index.d.ts

@@ -0,0 +1,7 @@
+export { SeleError, type ClientOptions, type FetchLike } from './http.ts';
+export { SeleIdAuth, createPkce, buildAuthorizeUrl, ISSUER, type Tokens, type UserInfo, type PkcePair, type AuthorizeRequest, type AuthorizeResult } from './auth.ts';
+export { SeleStorage, type StoredObject, type ObjectList, type SignedUrl } from './storage.ts';
+export { SeleDb, SeleDb as SeleBase, type Param, type QueryResult } from './db.ts';
+export { seleIdAccessToken, type SeleIdTokenSource } from './supabase.ts';
+export { SeleEvents, verifyWebhook } from './events.ts';
+export { SeleAi, type ChatMessage, type ChatResponse } from './ai.ts';

package/dist/cjs/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SeleAi = exports.verifyWebhook = exports.SeleEvents = exports.seleIdAccessToken = exports.SeleBase = exports.SeleDb = exports.SeleStorage = exports.ISSUER = exports.buildAuthorizeUrl = exports.createPkce = exports.SeleIdAuth = exports.SeleError = void 0;
+var http_ts_1 = require("./http.js");
+Object.defineProperty(exports, "SeleError", { enumerable: true, get: function () { return http_ts_1.SeleError; } });
+var auth_ts_1 = require("./auth.js");
+Object.defineProperty(exports, "SeleIdAuth", { enumerable: true, get: function () { return auth_ts_1.SeleIdAuth; } });
+Object.defineProperty(exports, "createPkce", { enumerable: true, get: function () { return auth_ts_1.createPkce; } });
+Object.defineProperty(exports, "buildAuthorizeUrl", { enumerable: true, get: function () { return auth_ts_1.buildAuthorizeUrl; } });
+Object.defineProperty(exports, "ISSUER", { enumerable: true, get: function () { return auth_ts_1.ISSUER; } });
+var storage_ts_1 = require("./storage.js");
+Object.defineProperty(exports, "SeleStorage", { enumerable: true, get: function () { return storage_ts_1.SeleStorage; } });
+var db_ts_1 = require("./db.js");
+Object.defineProperty(exports, "SeleDb", { enumerable: true, get: function () { return db_ts_1.SeleDb; } });
+Object.defineProperty(exports, "SeleBase", { enumerable: true, get: function () { return db_ts_1.SeleDb; } });
+var supabase_ts_1 = require("./supabase.js");
+Object.defineProperty(exports, "seleIdAccessToken", { enumerable: true, get: function () { return supabase_ts_1.seleIdAccessToken; } });
+var events_ts_1 = require("./events.js");
+Object.defineProperty(exports, "SeleEvents", { enumerable: true, get: function () { return events_ts_1.SeleEvents; } });
+Object.defineProperty(exports, "verifyWebhook", { enumerable: true, get: function () { return events_ts_1.verifyWebhook; } });
+var ai_ts_1 = require("./ai.js");
+Object.defineProperty(exports, "SeleAi", { enumerable: true, get: function () { return ai_ts_1.SeleAi; } });

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/storage.d.ts

@@ -0,0 +1,41 @@
+import { type ClientOptions } from './http.ts';
+export interface StoredObject {
+    key: string;
+    size: number;
+    uploaded: string | null;
+}
+export interface ObjectList {
+    objects: StoredObject[];
+    truncated: boolean;
+    cursor: string | null;
+}
+export interface SignedUrl {
+    url: string;
+    method: 'GET' | 'PUT';
+    expires_at: string;
+}
+export declare class SeleStorage {
+    private readonly http;
+    constructor(o: ClientOptions);
+    put(key: string, body: Uint8Array | string, contentType?: string): Promise<{
+        key: string;
+        size: number;
+    }>;
+    get(key: string): Promise<Uint8Array>;
+    getText(key: string): Promise<string>;
+    delete(key: string): Promise<{
+        deleted: string;
+    }>;
+    list(o?: {
+        prefix?: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<ObjectList>;
+    /** A URL that lets a browser upload or download one object without your key. Relative to the storage base URL. */
+    signedUrl(o: {
+        method: 'GET' | 'PUT';
+        key: string;
+        expiresIn?: number;
+    }): Promise<SignedUrl>;
+    usage(): Promise<Record<string, unknown>>;
+}

package/dist/cjs/storage.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SeleStorage = void 0;
+const http_ts_1 = require("./http.js");
+class SeleStorage {
+    http;
+    constructor(o) { this.http = new http_ts_1.Http({ baseUrl: 'https://storage.seleid.dev' }, o); }
+    async put(key, body, contentType = 'application/octet-stream') {
+        const bytes = typeof body === 'string' ? new TextEncoder().encode(body) : body;
+        const res = await this.http.raw('PUT', `/v1/objects/${(0, http_ts_1.enc)(key)}`, { headers: { 'content-type': contentType, 'content-length': String(bytes.byteLength) }, body: bytes });
+        return (await res.json());
+    }
+    async get(key) { return new Uint8Array(await (await this.http.raw('GET', `/v1/objects/${(0, http_ts_1.enc)(key)}`)).arrayBuffer()); }
+    async getText(key) { return new TextDecoder().decode(await this.get(key)); }
+    delete(key) { return this.http.json('DELETE', `/v1/objects/${(0, http_ts_1.enc)(key)}`); }
+    list(o = {}) { return this.http.json('GET', '/v1/objects', undefined, o); }
+    /** A URL that lets a browser upload or download one object without your key. Relative to the storage base URL. */
+    signedUrl(o) {
+        return this.http.json('POST', '/v1/signed-urls', { method: o.method, key: o.key, expires_in: o.expiresIn });
+    }
+    usage() { return this.http.json('GET', '/v1/usage'); }
+}
+exports.SeleStorage = SeleStorage;

package/dist/cjs/supabase.d.ts

@@ -0,0 +1,18 @@
+import type { Tokens } from './auth.ts';
+export interface SeleIdTokenSource {
+    /** Current session tokens, or null when signed out. Must include `id_token` (request the `openid` scope). */
+    getTokens(): Promise<Tokens | null> | Tokens | null;
+    /** Called with the refresh token when the ID token is (almost) expired. Typically `(rt) => auth.refresh(rt)`. */
+    refresh(refreshToken: string): Promise<Tokens>;
+    /** Called with the fresh tokens so your app can persist the rotated refresh token. */
+    onTokens?(tokens: Tokens): void | Promise<void>;
+    /** Refresh this many seconds before expiry. Default 60. */
+    skewSeconds?: number;
+    /** Clock override for tests (ms). */
+    now?: () => number;
+}
+/**
+ * Returns the callback for `createClient(url, anonKey, { accessToken })`. It returns a valid SeleID ID token,
+ * refreshing it (once, even for concurrent calls) when it is within `skewSeconds` of expiry, and null when signed out.
+ */
+export declare function seleIdAccessToken(src: SeleIdTokenSource): () => Promise<string | null>;

package/dist/cjs/supabase.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seleIdAccessToken = seleIdAccessToken;
+function expOf(jwt) {
+    try {
+        const part = jwt.split('.')[1]?.replace(/-/g, '+').replace(/_/g, '/');
+        if (!part)
+            return null;
+        const json = JSON.parse(atob(part.padEnd(Math.ceil(part.length / 4) * 4, '=')));
+        return typeof json.exp === 'number' ? json.exp : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Returns the callback for `createClient(url, anonKey, { accessToken })`. It returns a valid SeleID ID token,
+ * refreshing it (once, even for concurrent calls) when it is within `skewSeconds` of expiry, and null when signed out.
+ */
+function seleIdAccessToken(src) {
+    const skew = (src.skewSeconds ?? 60) * 1000;
+    const now = src.now ?? (() => Date.now());
+    let inflight = null;
+    const fresh = (t) => {
+        const exp = t?.id_token ? expOf(t.id_token) : null;
+        return t?.id_token && exp !== null && exp * 1000 - now() > skew ? t.id_token : null;
+    };
+    return async () => {
+        const tokens = await src.getTokens();
+        if (!tokens)
+            return null;
+        const ok = fresh(tokens);
+        if (ok)
+            return ok;
+        if (!tokens.refresh_token)
+            return null;
+        inflight ??= (async () => {
+            try {
+                const next = await src.refresh(tokens.refresh_token);
+                await src.onTokens?.(next);
+                return fresh(next);
+            }
+            catch {
+                return null;
+            }
+            finally {
+                inflight = null;
+            }
+        })();
+        return inflight;
+    };
+}

package/dist/esm/ai.d.ts

@@ -0,0 +1,37 @@
+import { type ClientOptions } from './http.ts';
+export interface ChatMessage {
+    role: 'system' | 'user' | 'assistant';
+    content: string;
+}
+export interface ChatResponse {
+    id: string;
+    model: string;
+    message: {
+        role: 'assistant';
+        content: string;
+    };
+    usage: {
+        input_tokens: number;
+        output_tokens: number;
+        attempts: number;
+        charge_micro_usd: number;
+    };
+}
+export declare class SeleAi {
+    private readonly http;
+    constructor(o: ClientOptions);
+    models(): Promise<{
+        models: Array<{
+            id: string;
+            context_tokens: number;
+            max_output_tokens: number;
+        }>;
+    }>;
+    usage(): Promise<Record<string, number>>;
+    /** Throws SeleError with code `spend_cap_reached` (HTTP 402) when the cap or credit is used up. */
+    chat(r: {
+        model: string;
+        messages: ChatMessage[];
+        maxTokens?: number;
+    }): Promise<ChatResponse>;
+}

package/dist/esm/ai.js

@@ -0,0 +1,11 @@
+import { Http } from "./http.js";
+export class SeleAi {
+    http;
+    constructor(o) { this.http = new Http({ baseUrl: 'https://api.seleid.dev' }, o); }
+    models() { return this.http.json('GET', '/v1/ai/models'); }
+    usage() { return this.http.json('GET', '/v1/ai/usage'); }
+    /** Throws SeleError with code `spend_cap_reached` (HTTP 402) when the cap or credit is used up. */
+    chat(r) {
+        return this.http.json('POST', '/v1/ai/chat', { model: r.model, messages: r.messages, max_tokens: r.maxTokens });
+    }
+}

package/dist/esm/auth.d.ts

@@ -0,0 +1,61 @@
+import { type FetchLike } from './http.ts';
+export declare const ISSUER = "https://auth.seleid.dev";
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** Generates a 64 character verifier and its S256 challenge. */
+export declare function createPkce(): Promise<PkcePair>;
+export interface AuthorizeRequest {
+    clientId: string;
+    redirectUri: string;
+    /** Default: openid profile email. Must include openid. */
+    scope?: string;
+    codeChallenge: string;
+    state?: string;
+    nonce?: string;
+    issuer?: string;
+}
+export interface AuthorizeResult {
+    url: string;
+    state: string;
+    nonce: string;
+}
+/** Builds the /authorize URL. Store `state`, `nonce` and the verifier with the session; check `state` on return. */
+export declare function buildAuthorizeUrl(r: AuthorizeRequest): AuthorizeResult;
+export interface Tokens {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    id_token?: string;
+    scope?: string;
+}
+export interface UserInfo {
+    sub: string;
+    name?: string;
+    email?: string;
+    email_verified?: boolean;
+}
+export declare class SeleIdAuth {
+    private readonly http;
+    private readonly o;
+    constructor(o: {
+        clientId: string;
+        clientSecret?: string;
+        issuer?: string;
+        fetch?: FetchLike;
+    });
+    private form;
+    /** Exchange the `code` from the redirect. Check `state` yourself before calling this. */
+    exchangeCode(p: {
+        code: string;
+        redirectUri: string;
+        codeVerifier: string;
+    }): Promise<Tokens>;
+    /** Refresh tokens rotate: store the new refresh_token from the response. */
+    refresh(refreshToken: string): Promise<Tokens>;
+    userInfo(accessToken: string): Promise<UserInfo>;
+    revoke(token: string): Promise<void>;
+    discovery(): Promise<Record<string, unknown>>;
+}

package/dist/esm/auth.js

@@ -0,0 +1,56 @@
+// Continue with SeleID: authorization code flow with PKCE (S256). Safe for public clients (no secret needed).
+import { Http, SeleError } from "./http.js";
+export const ISSUER = 'https://auth.seleid.dev';
+const b64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const random = (n) => b64url(crypto.getRandomValues(new Uint8Array(n)));
+/** Generates a 64 character verifier and its S256 challenge. */
+export async function createPkce() {
+    const codeVerifier = random(48);
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier)));
+    return { codeVerifier, codeChallenge: b64url(digest) };
+}
+/** Builds the /authorize URL. Store `state`, `nonce` and the verifier with the session; check `state` on return. */
+export function buildAuthorizeUrl(r) {
+    const scope = r.scope ?? 'openid profile email';
+    if (!scope.split(' ').includes('openid'))
+        throw new Error('scope must include openid');
+    const state = r.state ?? random(24);
+    const nonce = r.nonce ?? random(24);
+    const u = new URL(`${(r.issuer ?? ISSUER).replace(/\/+$/, '')}/authorize`);
+    u.search = new URLSearchParams({ client_id: r.clientId, redirect_uri: r.redirectUri, response_type: 'code', scope, state, nonce, code_challenge: r.codeChallenge, code_challenge_method: 'S256' }).toString();
+    return { url: u.toString(), state, nonce };
+}
+export class SeleIdAuth {
+    http;
+    o;
+    constructor(o) {
+        this.o = o;
+        this.http = new Http({ baseUrl: ISSUER }, { baseUrl: o.issuer, fetch: o.fetch });
+    }
+    async form(path, params) {
+        const res = await this.http.raw('POST', path, { headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams(params).toString() });
+        return (await res.json());
+    }
+    /** Exchange the `code` from the redirect. Check `state` yourself before calling this. */
+    exchangeCode(p) {
+        return this.form('/oauth/token', { grant_type: 'authorization_code', code: p.code, redirect_uri: p.redirectUri, client_id: this.o.clientId, code_verifier: p.codeVerifier, ...(this.o.clientSecret ? { client_secret: this.o.clientSecret } : {}) });
+    }
+    /** Refresh tokens rotate: store the new refresh_token from the response. */
+    refresh(refreshToken) {
+        return this.form('/oauth/token', { grant_type: 'refresh_token', refresh_token: refreshToken, client_id: this.o.clientId, ...(this.o.clientSecret ? { client_secret: this.o.clientSecret } : {}) });
+    }
+    async userInfo(accessToken) {
+        const res = await this.http.raw('GET', '/oauth/userinfo', { headers: { authorization: `Bearer ${accessToken}` } });
+        return (await res.json());
+    }
+    async revoke(token) {
+        try {
+            await this.form('/oauth/revoke', { token, client_id: this.o.clientId });
+        }
+        catch (e) {
+            if (!(e instanceof SeleError) || e.status >= 500)
+                throw e;
+        }
+    }
+    discovery() { return this.http.json('GET', '/.well-known/openid-configuration'); }
+}

package/dist/esm/db.d.ts

@@ -0,0 +1,29 @@
+import { type ClientOptions } from './http.ts';
+export type Param = string | number | boolean | null;
+export interface QueryResult {
+    [k: string]: unknown;
+}
+export declare class SeleDb {
+    private readonly http;
+    constructor(o: ClientOptions);
+    listDatabases(): Promise<{
+        databases: Array<{
+            name: string;
+            sizeBytes: number;
+            createdAt: string;
+        }>;
+    }>;
+    createDatabase(name: string): Promise<{
+        name: string;
+        createdAt: string;
+    }>;
+    deleteDatabase(name: string): Promise<{
+        deleted: string;
+    }>;
+    /** One statement per call. Always pass user input through `params`, never string-concatenate it into `sql`. */
+    query(database: string, sql: string, params?: Param[]): Promise<QueryResult>;
+    schema(database: string): Promise<{
+        schema: unknown;
+    }>;
+    usage(): Promise<Record<string, unknown>>;
+}

package/dist/esm/db.js

@@ -0,0 +1,14 @@
+import { Http } from "./http.js";
+export class SeleDb {
+    http;
+    constructor(o) { this.http = new Http({ baseUrl: 'https://api.seleid.dev' }, o); }
+    listDatabases() { return this.http.json('GET', '/v1/databases'); }
+    createDatabase(name) { return this.http.json('POST', '/v1/databases', { name }); }
+    deleteDatabase(name) { return this.http.json('DELETE', `/v1/databases/${encodeURIComponent(name)}`); }
+    /** One statement per call. Always pass user input through `params`, never string-concatenate it into `sql`. */
+    query(database, sql, params = []) {
+        return this.http.json('POST', `/v1/databases/${encodeURIComponent(database)}/query`, { sql, params });
+    }
+    schema(database) { return this.http.json('GET', `/v1/databases/${encodeURIComponent(database)}/schema`); }
+    usage() { return this.http.json('GET', '/v1/usage'); }
+}

package/dist/esm/events.d.ts

@@ -0,0 +1,51 @@
+import { type ClientOptions } from './http.ts';
+export declare class SeleEvents {
+    private readonly http;
+    constructor(o: ClientOptions);
+    createWebhookEndpoint(url: string, events: string[]): Promise<{
+        id: string;
+        secret: string;
+    }>;
+    listWebhookEndpoints(): Promise<{
+        endpoints: unknown[];
+    }>;
+    deleteWebhookEndpoint(id: string): Promise<{
+        deleted: string;
+    }>;
+    rotateWebhookSecret(id: string): Promise<{
+        secret: string;
+    }>;
+    emit(type: string, data: unknown): Promise<{
+        deliveries: unknown[];
+    }>;
+    deliveries(endpoint?: string): Promise<{
+        deliveries: unknown[];
+    }>;
+    replay(deliveryId: string): Promise<unknown>;
+    sendMail(m: {
+        from: string;
+        to: string;
+        subject: string;
+        text?: string;
+        html?: string;
+    }): Promise<unknown>;
+    registerDevice(d: {
+        userId: string;
+        platform: 'android' | 'ios' | 'web';
+        token: string;
+    }): Promise<unknown>;
+    sendPush(p: {
+        userId: string;
+        title: string;
+        body: string;
+        data?: unknown;
+    }): Promise<unknown>;
+}
+/**
+ * Verify a webhook. Pass the RAW request body string, the `seleid-signature` header and your endpoint secret.
+ * Header format: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">. Rejects timestamps older than `toleranceSec` (default 300).
+ */
+export declare function verifyWebhook(secret: string, rawBody: string, header: string | null | undefined, opts?: {
+    nowSec?: number;
+    toleranceSec?: number;
+}): Promise<boolean>;

package/dist/esm/events.js

@@ -0,0 +1,36 @@
+import { Http } from "./http.js";
+export class SeleEvents {
+    http;
+    constructor(o) { this.http = new Http({ baseUrl: 'https://api.seleid.dev' }, o); }
+    createWebhookEndpoint(url, events) { return this.http.json('POST', '/v1/webhooks/endpoints', { url, events }); }
+    listWebhookEndpoints() { return this.http.json('GET', '/v1/webhooks/endpoints'); }
+    deleteWebhookEndpoint(id) { return this.http.json('DELETE', `/v1/webhooks/endpoints/${encodeURIComponent(id)}`); }
+    rotateWebhookSecret(id) { return this.http.json('POST', `/v1/webhooks/endpoints/${encodeURIComponent(id)}/rotate`); }
+    emit(type, data) { return this.http.json('POST', '/v1/events', { type, data }); }
+    deliveries(endpoint) { return this.http.json('GET', '/v1/webhooks/deliveries', undefined, { endpoint }); }
+    replay(deliveryId) { return this.http.json('POST', `/v1/webhooks/deliveries/${encodeURIComponent(deliveryId)}/replay`); }
+    sendMail(m) { return this.http.json('POST', '/v1/mail/send', m); }
+    registerDevice(d) { return this.http.json('POST', '/v1/push/devices', d); }
+    sendPush(p) { return this.http.json('POST', '/v1/push/send', p); }
+}
+const hex = (b) => [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, '0')).join('');
+/**
+ * Verify a webhook. Pass the RAW request body string, the `seleid-signature` header and your endpoint secret.
+ * Header format: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">. Rejects timestamps older than `toleranceSec` (default 300).
+ */
+export async function verifyWebhook(secret, rawBody, header, opts = {}) {
+    const parts = Object.fromEntries(String(header ?? '').split(',').map((p) => { const i = p.indexOf('='); return [p.slice(0, i), p.slice(i + 1)]; }));
+    const t = Number(parts.t);
+    if (!Number.isInteger(t) || typeof parts.v1 !== 'string')
+        return false;
+    if (Math.abs((opts.nowSec ?? Date.now() / 1000) - t) > (opts.toleranceSec ?? 300))
+        return false;
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const want = hex(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${t}.${rawBody}`)));
+    if (want.length !== parts.v1.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < want.length; i++)
+        diff |= want.charCodeAt(i) ^ parts.v1.charCodeAt(i);
+    return diff === 0;
+}

package/dist/esm/http.d.ts

@@ -0,0 +1,33 @@
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface ClientOptions {
+    /** API key from the developer console. Keep it on the server; never ship it in a browser or mobile app. */
+    apiKey?: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+    /** Request timeout in milliseconds. Default 15000. */
+    timeoutMs?: number;
+}
+/** Thrown for every non-2xx response. `code` is the machine-readable error code from the API. */
+export declare class SeleError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly requestId?: string;
+    readonly body: unknown;
+    constructor(status: number, code: string, message: string, body: unknown, requestId?: string);
+}
+export declare class Http {
+    readonly baseUrl: string;
+    private readonly apiKey?;
+    private readonly fetchFn;
+    private readonly timeoutMs;
+    constructor(defaults: {
+        baseUrl: string;
+    }, o?: ClientOptions);
+    raw(method: string, path: string, init?: {
+        headers?: Record<string, string>;
+        body?: BodyInit | null;
+        query?: Record<string, string | number | undefined>;
+    }): Promise<Response>;
+    json<T>(method: string, path: string, body?: unknown, query?: Record<string, string | number | undefined>): Promise<T>;
+}
+export declare const enc: (s: string) => string;

package/dist/esm/http.js

@@ -0,0 +1,53 @@
+/** Thrown for every non-2xx response. `code` is the machine-readable error code from the API. */
+export class SeleError extends Error {
+    status;
+    code;
+    requestId;
+    body;
+    constructor(status, code, message, body, requestId) {
+        super(message);
+        this.name = 'SeleError';
+        this.status = status;
+        this.code = code;
+        this.body = body;
+        this.requestId = requestId;
+    }
+}
+export class Http {
+    baseUrl;
+    apiKey;
+    fetchFn;
+    timeoutMs;
+    constructor(defaults, o = {}) {
+        this.baseUrl = (o.baseUrl ?? defaults.baseUrl).replace(/\/+$/, '');
+        this.apiKey = o.apiKey;
+        this.fetchFn = o.fetch ?? ((i, init) => fetch(i, init));
+        this.timeoutMs = o.timeoutMs ?? 15000;
+    }
+    async raw(method, path, init = {}) {
+        const q = init.query ? Object.entries(init.query).filter(([, v]) => v !== undefined).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join('&') : '';
+        const headers = { ...init.headers };
+        if (this.apiKey && !headers.authorization)
+            headers.authorization = `Bearer ${this.apiKey}`;
+        const res = await this.fetchFn(`${this.baseUrl}${path}${q ? `?${q}` : ''}`, { method, headers, body: init.body ?? undefined, signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!res.ok)
+            throw await toError(res);
+        return res;
+    }
+    async json(method, path, body, query) {
+        const res = await this.raw(method, path, { headers: body === undefined ? {} : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body), query });
+        return (await res.json());
+    }
+}
+async function toError(res) {
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch { /* not JSON */ }
+    const e = body?.error;
+    const code = typeof e === 'string' ? e : typeof e?.code === 'string' ? e.code : `http_${res.status}`;
+    const message = typeof e?.message === 'string' ? e.message : typeof body?.error_description === 'string' ? body.error_description : `Request failed with status ${res.status}`;
+    return new SeleError(res.status, code, message, body, typeof e?.request_id === 'string' ? e.request_id : undefined);
+}
+export const enc = (s) => s.split('/').map(encodeURIComponent).join('/');

package/dist/esm/index.d.ts

@@ -0,0 +1,7 @@
+export { SeleError, type ClientOptions, type FetchLike } from './http.ts';
+export { SeleIdAuth, createPkce, buildAuthorizeUrl, ISSUER, type Tokens, type UserInfo, type PkcePair, type AuthorizeRequest, type AuthorizeResult } from './auth.ts';
+export { SeleStorage, type StoredObject, type ObjectList, type SignedUrl } from './storage.ts';
+export { SeleDb, SeleDb as SeleBase, type Param, type QueryResult } from './db.ts';
+export { seleIdAccessToken, type SeleIdTokenSource } from './supabase.ts';
+export { SeleEvents, verifyWebhook } from './events.ts';
+export { SeleAi, type ChatMessage, type ChatResponse } from './ai.ts';

package/dist/esm/index.js

@@ -0,0 +1,7 @@
+export { SeleError } from "./http.js";
+export { SeleIdAuth, createPkce, buildAuthorizeUrl, ISSUER } from "./auth.js";
+export { SeleStorage } from "./storage.js";
+export { SeleDb, SeleDb as SeleBase } from "./db.js";
+export { seleIdAccessToken } from "./supabase.js";
+export { SeleEvents, verifyWebhook } from "./events.js";
+export { SeleAi } from "./ai.js";