@smarthivelabs-devs/auth-sdk 0.1.0

package/dist/index.cjs

@@ -0,0 +1,237 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  SmartHiveAuthError: () => SmartHiveAuthError,
+  generateCodeChallenge: () => generateCodeChallenge,
+  generateCodeVerifier: () => generateCodeVerifier,
+  initAuth: () => initAuth,
+  smartHiveAuthStorageKeys: () => smartHiveAuthStorageKeys
+});
+module.exports = __toCommonJS(index_exports);
+var SmartHiveAuthError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SmartHiveAuthError";
+  }
+  code;
+};
+async function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64urlEncode(array);
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64urlEncode(new Uint8Array(digest));
+}
+function base64urlEncode(buffer) {
+  let str = "";
+  for (const byte of buffer) str += String.fromCharCode(byte);
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var smartHiveAuthStorageKeys = {
+  session: "smarthive.auth.session",
+  pkceVerifier: "smarthive.auth.pkce_verifier",
+  pkceState: "smarthive.auth.pkce_state"
+};
+function browserStorage() {
+  return {
+    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,
+    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),
+    removeItem: (key) => globalThis.localStorage?.removeItem(key)
+  };
+}
+function sessionStorageAdapter() {
+  return {
+    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,
+    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),
+    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)
+  };
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.replace(/\/$/, "");
+}
+function initAuth(config) {
+  const baseUrl = normalizeBaseUrl(config.baseUrl);
+  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);
+  const storage = config.storage ?? browserStorage();
+  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();
+  async function saveSession(session) {
+    if (!session) {
+      await storage.removeItem(smartHiveAuthStorageKeys.session);
+      return;
+    }
+    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));
+  }
+  async function readSession() {
+    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);
+    return raw ? JSON.parse(raw) : null;
+  }
+  const client = {
+    async initialize() {
+      const response = await fetch(
+        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`
+      );
+      if (!response.ok) throw new SmartHiveAuthError("project_not_found", "Smart Hive Auth project configuration was not found.");
+    },
+    async login(options) {
+      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;
+      const state = options?.state ?? crypto.randomUUID();
+      const verifier = await generateCodeVerifier();
+      const challenge = await generateCodeChallenge(verifier);
+      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);
+      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);
+      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);
+      url.searchParams.set("project_id", config.projectId);
+      url.searchParams.set("publishable_key", config.publishableKey);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("redirect_uri", redirectUri);
+      url.searchParams.set("state", state);
+      url.searchParams.set("code_challenge", challenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      globalThis.location.assign(url.toString());
+    },
+    async handleCallback(options) {
+      const href = options?.url ?? globalThis.location?.href;
+      if (!href) throw new SmartHiveAuthError("callback_failed", "No URL provided for callback handling.");
+      const url = new URL(href);
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      if (!code) throw new SmartHiveAuthError("callback_failed", "No authorization code in callback URL.");
+      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);
+      if (!storedState || !returnedState || storedState !== returnedState) {
+        throw new SmartHiveAuthError("state_mismatch", "OAuth state mismatch \u2014 possible CSRF attack.");
+      }
+      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);
+      if (!verifier) {
+        throw new SmartHiveAuthError("pkce_missing", "Missing PKCE verifier for authorization code exchange.");
+      }
+      const redirectUri = config.redirectUri ?? url.origin + url.pathname;
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: config.publishableKey
+      });
+      body.set("code_verifier", verifier);
+      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      if (!response.ok) {
+        const err = await response.json().catch(() => ({}));
+        throw new SmartHiveAuthError(err.error ?? "token_error", err.error_description ?? "Token exchange failed.");
+      }
+      const tokenBody = await response.json();
+      const session = {
+        accessToken: tokenBody.access_token,
+        refreshToken: tokenBody.refresh_token,
+        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1e3 : void 0
+      };
+      await saveSession(session);
+      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);
+      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);
+      return session;
+    },
+    async logout() {
+      await saveSession(null);
+      await fetch(`${baseUrl}/api/auth/sign-out`, { method: "POST", credentials: "include" });
+    },
+    getSession: readSession,
+    async getAccessToken() {
+      const session = await readSession();
+      if (!session) return null;
+      if (session.expiresAt && Date.now() > session.expiresAt - 3e4) {
+        return (await client.refreshSession())?.accessToken ?? null;
+      }
+      return session.accessToken;
+    },
+    async getAuthorizationHeader() {
+      const token = await client.getAccessToken();
+      const headers = {};
+      if (token) headers.authorization = `Bearer ${token}`;
+      return headers;
+    },
+    async fetch(input, init = {}) {
+      const authHeader = await client.getAuthorizationHeader();
+      const headers = new Headers(init.headers);
+      for (const [key, value] of Object.entries(authHeader)) {
+        headers.set(key, value);
+      }
+      return fetch(input, { ...init, headers });
+    },
+    async refreshSession() {
+      const session = await readSession();
+      if (!session?.refreshToken) return session;
+      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: session.refreshToken
+        })
+      });
+      if (!response.ok) {
+        await saveSession(null);
+        return null;
+      }
+      const body = await response.json();
+      const nextSession = {
+        ...session,
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token ?? session.refreshToken,
+        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1e3 : session.expiresAt
+      };
+      await saveSession(nextSession);
+      return nextSession;
+    },
+    async verifyToken(token) {
+      if (token.split(".").length !== 3) return false;
+      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {
+        headers: { authorization: `Bearer ${token}` }
+      });
+      return response.ok;
+    },
+    async getUser() {
+      const token = await client.getAccessToken();
+      if (!token) return null;
+      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {
+        headers: { authorization: `Bearer ${token}` }
+      });
+      return response.ok ? response.json() : null;
+    }
+  };
+  return client;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SmartHiveAuthError,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  initAuth,
+  smartHiveAuthStorageKeys
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    }\n  };\n\n  return client;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAIO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AAErE,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,55 @@
+interface SmartHiveAuthConfig {
+    projectId: string;
+    publishableKey: string;
+    baseUrl: string;
+    /** Custom branded auth domain, e.g. "https://auth.myapp.com". Used as the entry point for login/token flows. Falls back to baseUrl. */
+    authDomain?: string;
+    /** Fallback auth domain if authDomain is unreachable, e.g. "https://auth.smarthivelabs.dev". */
+    fallbackAuthDomain?: string;
+    redirectUri?: string;
+    storage?: AuthStorage;
+    temporaryStorage?: AuthStorage;
+}
+interface AuthStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+interface AuthSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    user?: unknown;
+}
+interface SmartHiveAuthClient {
+    initialize(): Promise<void>;
+    login(options?: {
+        redirectUri?: string;
+        state?: string;
+    }): Promise<void>;
+    handleCallback(options?: {
+        url?: string;
+    }): Promise<AuthSession>;
+    logout(): Promise<void>;
+    getSession(): Promise<AuthSession | null>;
+    getAccessToken(): Promise<string | null>;
+    getAuthorizationHeader(): Promise<Record<string, string>>;
+    fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+    refreshSession(): Promise<AuthSession | null>;
+    verifyToken(token: string): Promise<boolean>;
+    getUser(): Promise<unknown>;
+}
+declare class SmartHiveAuthError extends Error {
+    code: string;
+    constructor(code: string, message: string);
+}
+declare function generateCodeVerifier(): Promise<string>;
+declare function generateCodeChallenge(verifier: string): Promise<string>;
+declare const smartHiveAuthStorageKeys: {
+    readonly session: "smarthive.auth.session";
+    readonly pkceVerifier: "smarthive.auth.pkce_verifier";
+    readonly pkceState: "smarthive.auth.pkce_state";
+};
+declare function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient;
+
+export { type AuthSession, type AuthStorage, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };

package/dist/index.d.ts

@@ -0,0 +1,55 @@
+interface SmartHiveAuthConfig {
+    projectId: string;
+    publishableKey: string;
+    baseUrl: string;
+    /** Custom branded auth domain, e.g. "https://auth.myapp.com". Used as the entry point for login/token flows. Falls back to baseUrl. */
+    authDomain?: string;
+    /** Fallback auth domain if authDomain is unreachable, e.g. "https://auth.smarthivelabs.dev". */
+    fallbackAuthDomain?: string;
+    redirectUri?: string;
+    storage?: AuthStorage;
+    temporaryStorage?: AuthStorage;
+}
+interface AuthStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+interface AuthSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    user?: unknown;
+}
+interface SmartHiveAuthClient {
+    initialize(): Promise<void>;
+    login(options?: {
+        redirectUri?: string;
+        state?: string;
+    }): Promise<void>;
+    handleCallback(options?: {
+        url?: string;
+    }): Promise<AuthSession>;
+    logout(): Promise<void>;
+    getSession(): Promise<AuthSession | null>;
+    getAccessToken(): Promise<string | null>;
+    getAuthorizationHeader(): Promise<Record<string, string>>;
+    fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+    refreshSession(): Promise<AuthSession | null>;
+    verifyToken(token: string): Promise<boolean>;
+    getUser(): Promise<unknown>;
+}
+declare class SmartHiveAuthError extends Error {
+    code: string;
+    constructor(code: string, message: string);
+}
+declare function generateCodeVerifier(): Promise<string>;
+declare function generateCodeChallenge(verifier: string): Promise<string>;
+declare const smartHiveAuthStorageKeys: {
+    readonly session: "smarthive.auth.session";
+    readonly pkceVerifier: "smarthive.auth.pkce_verifier";
+    readonly pkceState: "smarthive.auth.pkce_state";
+};
+declare function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient;
+
+export { type AuthSession, type AuthStorage, type SmartHiveAuthClient, type SmartHiveAuthConfig, SmartHiveAuthError, generateCodeChallenge, generateCodeVerifier, initAuth, smartHiveAuthStorageKeys };

package/dist/index.js

@@ -0,0 +1,208 @@
+// src/index.ts
+var SmartHiveAuthError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SmartHiveAuthError";
+  }
+  code;
+};
+async function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64urlEncode(array);
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64urlEncode(new Uint8Array(digest));
+}
+function base64urlEncode(buffer) {
+  let str = "";
+  for (const byte of buffer) str += String.fromCharCode(byte);
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var smartHiveAuthStorageKeys = {
+  session: "smarthive.auth.session",
+  pkceVerifier: "smarthive.auth.pkce_verifier",
+  pkceState: "smarthive.auth.pkce_state"
+};
+function browserStorage() {
+  return {
+    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,
+    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),
+    removeItem: (key) => globalThis.localStorage?.removeItem(key)
+  };
+}
+function sessionStorageAdapter() {
+  return {
+    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,
+    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),
+    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)
+  };
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.replace(/\/$/, "");
+}
+function initAuth(config) {
+  const baseUrl = normalizeBaseUrl(config.baseUrl);
+  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);
+  const storage = config.storage ?? browserStorage();
+  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();
+  async function saveSession(session) {
+    if (!session) {
+      await storage.removeItem(smartHiveAuthStorageKeys.session);
+      return;
+    }
+    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));
+  }
+  async function readSession() {
+    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);
+    return raw ? JSON.parse(raw) : null;
+  }
+  const client = {
+    async initialize() {
+      const response = await fetch(
+        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`
+      );
+      if (!response.ok) throw new SmartHiveAuthError("project_not_found", "Smart Hive Auth project configuration was not found.");
+    },
+    async login(options) {
+      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;
+      const state = options?.state ?? crypto.randomUUID();
+      const verifier = await generateCodeVerifier();
+      const challenge = await generateCodeChallenge(verifier);
+      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);
+      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);
+      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);
+      url.searchParams.set("project_id", config.projectId);
+      url.searchParams.set("publishable_key", config.publishableKey);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("redirect_uri", redirectUri);
+      url.searchParams.set("state", state);
+      url.searchParams.set("code_challenge", challenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      globalThis.location.assign(url.toString());
+    },
+    async handleCallback(options) {
+      const href = options?.url ?? globalThis.location?.href;
+      if (!href) throw new SmartHiveAuthError("callback_failed", "No URL provided for callback handling.");
+      const url = new URL(href);
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      if (!code) throw new SmartHiveAuthError("callback_failed", "No authorization code in callback URL.");
+      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);
+      if (!storedState || !returnedState || storedState !== returnedState) {
+        throw new SmartHiveAuthError("state_mismatch", "OAuth state mismatch \u2014 possible CSRF attack.");
+      }
+      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);
+      if (!verifier) {
+        throw new SmartHiveAuthError("pkce_missing", "Missing PKCE verifier for authorization code exchange.");
+      }
+      const redirectUri = config.redirectUri ?? url.origin + url.pathname;
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: config.publishableKey
+      });
+      body.set("code_verifier", verifier);
+      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      if (!response.ok) {
+        const err = await response.json().catch(() => ({}));
+        throw new SmartHiveAuthError(err.error ?? "token_error", err.error_description ?? "Token exchange failed.");
+      }
+      const tokenBody = await response.json();
+      const session = {
+        accessToken: tokenBody.access_token,
+        refreshToken: tokenBody.refresh_token,
+        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1e3 : void 0
+      };
+      await saveSession(session);
+      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);
+      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);
+      return session;
+    },
+    async logout() {
+      await saveSession(null);
+      await fetch(`${baseUrl}/api/auth/sign-out`, { method: "POST", credentials: "include" });
+    },
+    getSession: readSession,
+    async getAccessToken() {
+      const session = await readSession();
+      if (!session) return null;
+      if (session.expiresAt && Date.now() > session.expiresAt - 3e4) {
+        return (await client.refreshSession())?.accessToken ?? null;
+      }
+      return session.accessToken;
+    },
+    async getAuthorizationHeader() {
+      const token = await client.getAccessToken();
+      const headers = {};
+      if (token) headers.authorization = `Bearer ${token}`;
+      return headers;
+    },
+    async fetch(input, init = {}) {
+      const authHeader = await client.getAuthorizationHeader();
+      const headers = new Headers(init.headers);
+      for (const [key, value] of Object.entries(authHeader)) {
+        headers.set(key, value);
+      }
+      return fetch(input, { ...init, headers });
+    },
+    async refreshSession() {
+      const session = await readSession();
+      if (!session?.refreshToken) return session;
+      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: session.refreshToken
+        })
+      });
+      if (!response.ok) {
+        await saveSession(null);
+        return null;
+      }
+      const body = await response.json();
+      const nextSession = {
+        ...session,
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token ?? session.refreshToken,
+        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1e3 : session.expiresAt
+      };
+      await saveSession(nextSession);
+      return nextSession;
+    },
+    async verifyToken(token) {
+      if (token.split(".").length !== 3) return false;
+      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {
+        headers: { authorization: `Bearer ${token}` }
+      });
+      return response.ok;
+    },
+    async getUser() {
+      const token = await client.getAccessToken();
+      if (!token) return null;
+      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {
+        headers: { authorization: `Bearer ${token}` }
+      });
+      return response.ok ? response.json() : null;
+    }
+  };
+  return client;
+}
+export {
+  SmartHiveAuthError,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  initAuth,
+  smartHiveAuthStorageKeys
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface SmartHiveAuthConfig {\n  projectId: string;\n  publishableKey: string;\n  baseUrl: string;\n  /** Custom branded auth domain, e.g. \"https://auth.myapp.com\". Used as the entry point for login/token flows. Falls back to baseUrl. */\n  authDomain?: string;\n  /** Fallback auth domain if authDomain is unreachable, e.g. \"https://auth.smarthivelabs.dev\". */\n  fallbackAuthDomain?: string;\n  redirectUri?: string;\n  storage?: AuthStorage;\n  temporaryStorage?: AuthStorage;\n}\n\nexport interface AuthStorage {\n  getItem(key: string): string | null | Promise<string | null>;\n  setItem(key: string, value: string): void | Promise<void>;\n  removeItem(key: string): void | Promise<void>;\n}\n\nexport interface AuthSession {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number;\n  user?: unknown;\n}\n\nexport interface SmartHiveAuthClient {\n  initialize(): Promise<void>;\n  login(options?: { redirectUri?: string; state?: string }): Promise<void>;\n  handleCallback(options?: { url?: string }): Promise<AuthSession>;\n  logout(): Promise<void>;\n  getSession(): Promise<AuthSession | null>;\n  getAccessToken(): Promise<string | null>;\n  getAuthorizationHeader(): Promise<Record<string, string>>;\n  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;\n  refreshSession(): Promise<AuthSession | null>;\n  verifyToken(token: string): Promise<boolean>;\n  getUser(): Promise<unknown>;\n}\n\nexport class SmartHiveAuthError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = \"SmartHiveAuthError\";\n  }\n}\n\n// ── PKCE helpers (Web Crypto — works in browser + Node 18+) ──────────────────\n\nexport async function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64urlEncode(array);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return base64urlEncode(new Uint8Array(digest));\n}\n\nfunction base64urlEncode(buffer: Uint8Array): string {\n  let str = \"\";\n  for (const byte of buffer) str += String.fromCharCode(byte);\n  return btoa(str).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// ── Storage keys ─────────────────────────────────────────────────────────────\n\nexport const smartHiveAuthStorageKeys = {\n  session: \"smarthive.auth.session\",\n  pkceVerifier: \"smarthive.auth.pkce_verifier\",\n  pkceState: \"smarthive.auth.pkce_state\"\n} as const;\n\nfunction browserStorage(): AuthStorage {\n  return {\n    getItem: (key) => globalThis.localStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.localStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.localStorage?.removeItem(key)\n  };\n}\n\nfunction sessionStorageAdapter(): Pick<AuthStorage, \"getItem\" | \"setItem\" | \"removeItem\"> {\n  return {\n    getItem: (key) => globalThis.sessionStorage?.getItem(key) ?? null,\n    setItem: (key, value) => globalThis.sessionStorage?.setItem(key, value),\n    removeItem: (key) => globalThis.sessionStorage?.removeItem(key)\n  };\n}\n\nfunction normalizeBaseUrl(baseUrl: string) {\n  return baseUrl.replace(/\\/$/, \"\");\n}\n\n// ── Factory ───────────────────────────────────────────────────────────────────\n\nexport function initAuth(config: SmartHiveAuthConfig): SmartHiveAuthClient {\n  const baseUrl = normalizeBaseUrl(config.baseUrl);\n  const authBase = normalizeBaseUrl(config.authDomain ?? config.baseUrl);\n  const storage = config.storage ?? browserStorage();\n  const tempStorage = config.temporaryStorage ?? sessionStorageAdapter();\n\n  async function saveSession(session: AuthSession | null) {\n    if (!session) { await storage.removeItem(smartHiveAuthStorageKeys.session); return; }\n    await storage.setItem(smartHiveAuthStorageKeys.session, JSON.stringify(session));\n  }\n\n  async function readSession(): Promise<AuthSession | null> {\n    const raw = await storage.getItem(smartHiveAuthStorageKeys.session);\n    return raw ? JSON.parse(raw) as AuthSession : null;\n  }\n\n  const client: SmartHiveAuthClient = {\n    async initialize() {\n      const response = await fetch(\n        `${baseUrl}/sdk/config?projectId=${encodeURIComponent(config.projectId)}&publishableKey=${encodeURIComponent(config.publishableKey)}`\n      );\n      if (!response.ok) throw new SmartHiveAuthError(\"project_not_found\", \"Smart Hive Auth project configuration was not found.\");\n    },\n\n    async login(options) {\n      const redirectUri = options?.redirectUri ?? config.redirectUri ?? globalThis.location?.href;\n      const state = options?.state ?? crypto.randomUUID();\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceVerifier, verifier);\n      await tempStorage.setItem(smartHiveAuthStorageKeys.pkceState, state);\n\n      const url = new URL(`${authBase}/api/auth/oauth2/authorize`);\n      url.searchParams.set(\"project_id\", config.projectId);\n      url.searchParams.set(\"publishable_key\", config.publishableKey);\n      url.searchParams.set(\"response_type\", \"code\");\n      url.searchParams.set(\"redirect_uri\", redirectUri);\n      url.searchParams.set(\"state\", state);\n      url.searchParams.set(\"code_challenge\", challenge);\n      url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n      globalThis.location.assign(url.toString());\n    },\n\n    async handleCallback(options) {\n      const href = options?.url ?? globalThis.location?.href;\n      if (!href) throw new SmartHiveAuthError(\"callback_failed\", \"No URL provided for callback handling.\");\n\n      const url = new URL(href);\n      const code = url.searchParams.get(\"code\");\n      const returnedState = url.searchParams.get(\"state\");\n\n      if (!code) throw new SmartHiveAuthError(\"callback_failed\", \"No authorization code in callback URL.\");\n\n      const storedState = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceState);\n      if (!storedState || !returnedState || storedState !== returnedState) {\n        throw new SmartHiveAuthError(\"state_mismatch\", \"OAuth state mismatch — possible CSRF attack.\");\n      }\n\n      const verifier = await tempStorage.getItem(smartHiveAuthStorageKeys.pkceVerifier);\n      if (!verifier) {\n        throw new SmartHiveAuthError(\"pkce_missing\", \"Missing PKCE verifier for authorization code exchange.\");\n      }\n      const redirectUri = config.redirectUri ?? (url.origin + url.pathname);\n\n      const body = new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        redirect_uri: redirectUri,\n        client_id: config.publishableKey\n      });\n      body.set(\"code_verifier\", verifier);\n\n      const response = await fetch(`${authBase}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body\n      });\n\n      if (!response.ok) {\n        const err = await response.json().catch(() => ({})) as { error?: string; error_description?: string };\n        throw new SmartHiveAuthError(err.error ?? \"token_error\", err.error_description ?? \"Token exchange failed.\");\n      }\n\n      const tokenBody = await response.json() as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in?: number;\n        token_type?: string;\n      };\n\n      const session: AuthSession = {\n        accessToken: tokenBody.access_token,\n        refreshToken: tokenBody.refresh_token,\n        expiresAt: tokenBody.expires_in ? Date.now() + tokenBody.expires_in * 1000 : undefined\n      };\n\n      await saveSession(session);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceVerifier);\n      await tempStorage.removeItem(smartHiveAuthStorageKeys.pkceState);\n\n      return session;\n    },\n\n    async logout() {\n      await saveSession(null);\n      await fetch(`${baseUrl}/api/auth/sign-out`, { method: \"POST\", credentials: \"include\" });\n    },\n\n    getSession: readSession,\n\n    async getAccessToken() {\n      const session = await readSession();\n      if (!session) return null;\n      if (session.expiresAt && Date.now() > session.expiresAt - 30000) {\n        return (await client.refreshSession())?.accessToken ?? null;\n      }\n      return session.accessToken;\n    },\n\n    async getAuthorizationHeader() {\n      const token = await client.getAccessToken();\n      const headers: Record<string, string> = {};\n      if (token) headers.authorization = `Bearer ${token}`;\n      return headers;\n    },\n\n    async fetch(input, init = {}) {\n      const authHeader = await client.getAuthorizationHeader();\n      const headers = new Headers(init.headers);\n      for (const [key, value] of Object.entries(authHeader)) {\n        headers.set(key, value);\n      }\n      return fetch(input, { ...init, headers });\n    },\n\n    async refreshSession() {\n      const session = await readSession();\n      if (!session?.refreshToken) return session;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/token`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"refresh_token\",\n          refresh_token: session.refreshToken\n        })\n      });\n      if (!response.ok) { await saveSession(null); return null; }\n      const body = await response.json() as { access_token: string; refresh_token?: string; expires_in?: number };\n      const nextSession: AuthSession = {\n        ...session,\n        accessToken: body.access_token,\n        refreshToken: body.refresh_token ?? session.refreshToken,\n        expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : session.expiresAt\n      };\n      await saveSession(nextSession);\n      return nextSession;\n    },\n\n    async verifyToken(token) {\n      if (token.split(\".\").length !== 3) return false;\n      const response = await fetch(`${authBase}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok;\n    },\n\n    async getUser() {\n      const token = await client.getAccessToken();\n      if (!token) return null;\n      const response = await fetch(`${baseUrl}/api/auth/oauth2/userinfo`, {\n        headers: { authorization: `Bearer ${token}` }\n      });\n      return response.ok ? response.json() : null;\n    }\n  };\n\n  return client;\n}\n"],"mappings":";AAwCO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAmB,MAAc,SAAiB;AAChD,UAAM,OAAO;AADI;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;AAIA,eAAsB,uBAAwC;AAC5D,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,MAAM;AACV,aAAW,QAAQ,OAAQ,QAAO,OAAO,aAAa,IAAI;AAC1D,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAIO,IAAM,2BAA2B;AAAA,EACtC,SAAS;AAAA,EACT,cAAc;AAAA,EACd,WAAW;AACb;AAEA,SAAS,iBAA8B;AACrC,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,cAAc,QAAQ,GAAG,KAAK;AAAA,IAC3D,SAAS,CAAC,KAAK,UAAU,WAAW,cAAc,QAAQ,KAAK,KAAK;AAAA,IACpE,YAAY,CAAC,QAAQ,WAAW,cAAc,WAAW,GAAG;AAAA,EAC9D;AACF;AAEA,SAAS,wBAAiF;AACxF,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,KAAK;AAAA,IAC7D,SAAS,CAAC,KAAK,UAAU,WAAW,gBAAgB,QAAQ,KAAK,KAAK;AAAA,IACtE,YAAY,CAAC,QAAQ,WAAW,gBAAgB,WAAW,GAAG;AAAA,EAChE;AACF;AAEA,SAAS,iBAAiB,SAAiB;AACzC,SAAO,QAAQ,QAAQ,OAAO,EAAE;AAClC;AAIO,SAAS,SAAS,QAAkD;AACzE,QAAM,UAAU,iBAAiB,OAAO,OAAO;AAC/C,QAAM,WAAW,iBAAiB,OAAO,cAAc,OAAO,OAAO;AACrE,QAAM,UAAU,OAAO,WAAW,eAAe;AACjD,QAAM,cAAc,OAAO,oBAAoB,sBAAsB;AAErE,iBAAe,YAAY,SAA6B;AACtD,QAAI,CAAC,SAAS;AAAE,YAAM,QAAQ,WAAW,yBAAyB,OAAO;AAAG;AAAA,IAAQ;AACpF,UAAM,QAAQ,QAAQ,yBAAyB,SAAS,KAAK,UAAU,OAAO,CAAC;AAAA,EACjF;AAEA,iBAAe,cAA2C;AACxD,UAAM,MAAM,MAAM,QAAQ,QAAQ,yBAAyB,OAAO;AAClE,WAAO,MAAM,KAAK,MAAM,GAAG,IAAmB;AAAA,EAChD;AAEA,QAAM,SAA8B;AAAA,IAClC,MAAM,aAAa;AACjB,YAAM,WAAW,MAAM;AAAA,QACrB,GAAG,OAAO,yBAAyB,mBAAmB,OAAO,SAAS,CAAC,mBAAmB,mBAAmB,OAAO,cAAc,CAAC;AAAA,MACrI;AACA,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,mBAAmB,qBAAqB,sDAAsD;AAAA,IAC5H;AAAA,IAEA,MAAM,MAAM,SAAS;AACnB,YAAM,cAAc,SAAS,eAAe,OAAO,eAAe,WAAW,UAAU;AACvF,YAAM,QAAQ,SAAS,SAAS,OAAO,WAAW;AAClD,YAAM,WAAW,MAAM,qBAAqB;AAC5C,YAAM,YAAY,MAAM,sBAAsB,QAAQ;AAEtD,YAAM,YAAY,QAAQ,yBAAyB,cAAc,QAAQ;AACzE,YAAM,YAAY,QAAQ,yBAAyB,WAAW,KAAK;AAEnE,YAAM,MAAM,IAAI,IAAI,GAAG,QAAQ,4BAA4B;AAC3D,UAAI,aAAa,IAAI,cAAc,OAAO,SAAS;AACnD,UAAI,aAAa,IAAI,mBAAmB,OAAO,cAAc;AAC7D,UAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,UAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,UAAI,aAAa,IAAI,SAAS,KAAK;AACnC,UAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,UAAI,aAAa,IAAI,yBAAyB,MAAM;AAEpD,iBAAW,SAAS,OAAO,IAAI,SAAS,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,eAAe,SAAS;AAC5B,YAAM,OAAO,SAAS,OAAO,WAAW,UAAU;AAClD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,MAAM,IAAI,IAAI,IAAI;AACxB,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,gBAAgB,IAAI,aAAa,IAAI,OAAO;AAElD,UAAI,CAAC,KAAM,OAAM,IAAI,mBAAmB,mBAAmB,wCAAwC;AAEnG,YAAM,cAAc,MAAM,YAAY,QAAQ,yBAAyB,SAAS;AAChF,UAAI,CAAC,eAAe,CAAC,iBAAiB,gBAAgB,eAAe;AACnE,cAAM,IAAI,mBAAmB,kBAAkB,mDAA8C;AAAA,MAC/F;AAEA,YAAM,WAAW,MAAM,YAAY,QAAQ,yBAAyB,YAAY;AAChF,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,mBAAmB,gBAAgB,wDAAwD;AAAA,MACvG;AACA,YAAM,cAAc,OAAO,eAAgB,IAAI,SAAS,IAAI;AAE5D,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,YAAY;AAAA,QACZ;AAAA,QACA,cAAc;AAAA,QACd,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,WAAK,IAAI,iBAAiB,QAAQ;AAElC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,0BAA0B;AAAA,QAChE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,MACF,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,cAAM,IAAI,mBAAmB,IAAI,SAAS,eAAe,IAAI,qBAAqB,wBAAwB;AAAA,MAC5G;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AAOtC,YAAM,UAAuB;AAAA,QAC3B,aAAa,UAAU;AAAA,QACvB,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU,aAAa,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;AAAA,MAC/E;AAEA,YAAM,YAAY,OAAO;AACzB,YAAM,YAAY,WAAW,yBAAyB,YAAY;AAClE,YAAM,YAAY,WAAW,yBAAyB,SAAS;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,YAAY,IAAI;AACtB,YAAM,MAAM,GAAG,OAAO,sBAAsB,EAAE,QAAQ,QAAQ,aAAa,UAAU,CAAC;AAAA,IACxF;AAAA,IAEA,YAAY;AAAA,IAEZ,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,UAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,QAAQ,YAAY,KAAO;AAC/D,gBAAQ,MAAM,OAAO,eAAe,IAAI,eAAe;AAAA,MACzD;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,IAEA,MAAM,yBAAyB;AAC7B,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,YAAM,UAAkC,CAAC;AACzC,UAAI,MAAO,SAAQ,gBAAgB,UAAU,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG;AAC5B,YAAM,aAAa,MAAM,OAAO,uBAAuB;AACvD,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,gBAAQ,IAAI,KAAK,KAAK;AAAA,MACxB;AACA,aAAO,MAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,CAAC,SAAS,aAAc,QAAO;AACnC,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0BAA0B;AAAA,QAC/D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACxB,YAAY;AAAA,UACZ,eAAe,QAAQ;AAAA,QACzB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAAE,cAAM,YAAY,IAAI;AAAG,eAAO;AAAA,MAAM;AAC1D,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,cAA2B;AAAA,QAC/B,GAAG;AAAA,QACH,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB,QAAQ;AAAA,QAC5C,WAAW,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,QAAQ;AAAA,MAC7E;AACA,YAAM,YAAY,WAAW;AAC7B,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,UAAI,MAAM,MAAM,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,6BAA6B;AAAA,QACnE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,UAAU;AACd,YAAM,QAAQ,MAAM,OAAO,eAAe;AAC1C,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,WAAW,MAAM,MAAM,GAAG,OAAO,6BAA6B;AAAA,QAClE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC9C,CAAC;AACD,aAAO,SAAS,KAAK,SAAS,KAAK,IAAI;AAAA,IACzC;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@smarthivelabs-devs/auth-sdk",
+  "version": "0.1.0",
+  "description": "SmartHive Auth JavaScript/TypeScript SDK — core client for browser, Node.js, and React Native",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/smarthivelabs-devs/smarthive-auth-sdk"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.3"
+  },
+  "scripts": {
+    "build": "tsup",
+    "build:watch": "tsup --watch",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}