@tetrascience-npm/tetrascience-react-ui 0.7.0-beta.129.1 → 0.7.0-beta.131.1

package/dist/jest-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jest-setup.js","sources":["../src/jest-setup.tsx"],"sourcesContent":["/**\n * Single-file Jest support for consumers. Add one line to jest.config:\n *\n *   module.exports = {\n *     testEnvironment: \"jsdom\",\n *     setupFiles: [\"@tetrascience-npm/tetrascience-react-ui/jest-setup\"],\n *   };\n *\n * The kit ships dual ESM + CJS output, so Jest's CommonJS runtime loads every\n * kit module directly. What Jest cannot load are the few third-party deps\n * that publish ESM-only (streamdown, use-stick-to-bottom,\n * react-resizable-panels, shiki/@shikijs) and the optional peers a consumer\n * may not have installed (plotly.js-dist, @streamdown/math|mermaid). On\n * import this file registers lightweight functional stubs for exactly those\n * via `jest.mock(id, factory)` and installs the jsdom shims Radix-based\n * components need. Everything else in the kit runs for real.\n *\n * Registration strategy: non-virtual first — Jest then keys the mock by the\n * resolved module path, which matches what kit modules load because this\n * file ships inside the kit package (same dependency context under npm and\n * pnpm layouts alike). When resolution fails — the package publishes\n * `import`-only exports Jest's CJS resolver can't see (e.g. streamdown), or\n * it's an optional peer that isn't installed — fall back to\n * `{ virtual: true }`: virtual mocks of bare specifiers are keyed by the\n * specifier itself, so they intercept the kit's `require` without any\n * resolution.\n *\n * Overrides: a consumer's own `jest.mock(\"<id>\", …)` — in a test file or a\n * later setup file — replaces any registration made here.\n *\n * Maintenance: when the kit gains a static import of a new ESM-only package\n * (`\"type\": \"module\"`, no `require` export condition), add a registration\n * here or Jest consumers regress to `ERR_REQUIRE_ESM`.\n */\nimport type { CSSProperties, ReactNode } from \"react\";\n\n// ---------------------------------------------------------------------------\n// Plotly stub — jsdom has no layout or WebGL, so chart tests assert on the\n// calls the kit makes into Plotly rather than on rendered output. `newPlot`/\n// `react` attach the plot-event API to the target element (kit code registers\n// hover/click handlers on it) and resolve it; tests can fire those handlers\n// through the element's `emit`.\n// ---------------------------------------------------------------------------\n\ntype PlotHandler = (payload: unknown) => void;\n\nexport interface MockPlotElement extends HTMLElement {\n  on: (event: string, handler: PlotHandler) => void;\n  once: (event: string, handler: PlotHandler) => void;\n  removeListener: (event: string, handler: PlotHandler) => void;\n  removeAllListeners: (event?: string) => void;\n  emit: (event: string, payload?: unknown) => void;\n}\n\nfunction attachPlotEvents(el: HTMLElement): MockPlotElement {\n  const plotEl = el as MockPlotElement;\n  const listeners = new Map<string, Set<PlotHandler>>();\n\n  plotEl.on = (event, handler) => {\n    const set = listeners.get(event) ?? new Set<PlotHandler>();\n    set.add(handler);\n    listeners.set(event, set);\n  };\n  plotEl.once = (event, handler) => {\n    const onceHandler: PlotHandler = (payload) => {\n      plotEl.removeListener(event, onceHandler);\n      handler(payload);\n    };\n    plotEl.on(event, onceHandler);\n  };\n  plotEl.removeListener = (event, handler) => {\n    listeners.get(event)?.delete(handler);\n  };\n  plotEl.removeAllListeners = (event) => {\n    if (event) {\n      listeners.delete(event);\n    } else {\n      listeners.clear();\n    }\n  };\n  plotEl.emit = (event, payload) => {\n    for (const handler of listeners.get(event) ?? []) {\n      handler(payload);\n    }\n  };\n  return plotEl;\n}\n\nexport const plotlyStub = {\n  newPlot: (el: HTMLElement): Promise<MockPlotElement> =>\n    Promise.resolve(attachPlotEvents(el)),\n  react: (el: HTMLElement): Promise<MockPlotElement> =>\n    Promise.resolve(attachPlotEvents(el)),\n  relayout: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  restyle: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  update: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  addTraces: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  deleteTraces: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  extendTraces: (el: HTMLElement): Promise<HTMLElement> => Promise.resolve(el),\n  purge: (): void => {},\n  setPlotConfig: (): void => {},\n  toImage: (): Promise<string> => Promise.resolve(\"data:image/png;base64,\"),\n  downloadImage: (): Promise<string> => Promise.resolve(\"mock-download\"),\n  Plots: {\n    resize: (): Promise<void> => Promise.resolve(),\n  },\n};\n\n// ---------------------------------------------------------------------------\n// RDKit stub — `MoleculeStructure` loads the optional `@rdkit/rdkit` peer\n// (a WASM module) via `loadRDKit()` → `import(\"@rdkit/rdkit\")`. This is a\n// safety net for tests that render `MoleculeStructure` without configuring\n// their own fake: `get_mol` always returns a valid, empty-SVG molecule.\n// For real behavior assertions (invalid-SMILES handling, rendered markup,\n// …), use the kit's own override hook instead — it's more accurate than\n// anything this generic stub can be:\n//\n//   import { configureRDKit } from \"@tetrascience-npm/tetrascience-react-ui/composed/MoleculeStructure\";\n//   configureRDKit({ importFactory: () => Promise.resolve(myFakeRDKitModule) });\n//\n// (see src/components/composed/MoleculeStructure/__tests__/rdkit-loader.test.ts\n// in the kit's own source for a fuller fake to model one on.)\n// ---------------------------------------------------------------------------\n\nexport interface MinimalRdkitMol {\n  is_valid: () => boolean;\n  get_svg_with_highlights: (details: string) => string;\n  delete: () => void;\n}\n\nexport const rdkitModuleStub = {\n  get_mol: (smiles: string): MinimalRdkitMol => ({\n    is_valid: () => true,\n    get_svg_with_highlights: () =>\n      `<?xml version='1.0' encoding='iso-8859-1'?>\\n<svg data-smiles=\"${smiles}\"></svg>`,\n    delete: () => {},\n  }),\n};\n\nexport const rdkitFactoryStub = (): Promise<typeof rdkitModuleStub> =>\n  Promise.resolve(rdkitModuleStub);\n\n// ---------------------------------------------------------------------------\n// streamdown stub — renders the markdown source as plain text so\n// text-content assertions on `MessageResponse` / `Reasoning` keep working\n// without transpiling the unified markdown ecosystem.\n// ---------------------------------------------------------------------------\n\nexport interface StreamdownStubProps {\n  children?: ReactNode;\n  className?: string;\n  [prop: string]: unknown;\n}\n\nexport function StreamdownStub({ children, className }: StreamdownStubProps) {\n  return (\n    <div data-slot=\"streamdown-mock\" className={className}>\n      {children}\n    </div>\n  );\n}\n\n/** Inert factory for `@streamdown/*` plugin packages (cjk, math, mermaid). */\nexport const streamdownPluginStub = (): Record<string, never> => ({});\n\n// ---------------------------------------------------------------------------\n// use-stick-to-bottom stub — used by `Conversation`. jsdom has no scrolling\n// to pin, so containers render plainly and report the view as at the bottom.\n// ---------------------------------------------------------------------------\n\ninterface ContainerStubProps {\n  children?: ReactNode;\n  className?: string;\n  style?: CSSProperties;\n  role?: string;\n  [prop: string]: unknown;\n}\n\nfunction StickToBottomRoot({ children, className, style, role }: ContainerStubProps) {\n  return (\n    <div data-slot=\"stick-to-bottom-mock\" className={className} style={style} role={role}>\n      {children}\n    </div>\n  );\n}\n\nfunction StickToBottomContent({ children, className, style }: ContainerStubProps) {\n  return (\n    <div data-slot=\"stick-to-bottom-content-mock\" className={className} style={style}>\n      {children}\n    </div>\n  );\n}\n\nexport const StickToBottomStub = Object.assign(StickToBottomRoot, {\n  Content: StickToBottomContent,\n});\n\nconst stickToBottomContext = {\n  isAtBottom: true,\n  scrollToBottom: (): void => {},\n  stopScroll: (): void => {},\n};\n\nexport function useStickToBottomContextStub(): typeof stickToBottomContext {\n  return stickToBottomContext;\n}\n\nexport function useStickToBottomStub(): typeof stickToBottomContext & {\n  scrollRef: (node: HTMLElement | null) => void;\n  contentRef: (node: HTMLElement | null) => void;\n} {\n  return { ...stickToBottomContext, scrollRef: () => {}, contentRef: () => {} };\n}\n\n// ---------------------------------------------------------------------------\n// react-resizable-panels stub — used by `Resizable*`. jsdom has no layout,\n// so panels render as plain containers; drag/resize is not simulated.\n// ---------------------------------------------------------------------------\n\nexport function ResizableGroupStub({ children, className, style }: ContainerStubProps) {\n  return (\n    <div data-slot=\"resizable-group-mock\" className={className} style={style}>\n      {children}\n    </div>\n  );\n}\n\nexport function ResizablePanelStub({ children, className, style }: ContainerStubProps) {\n  return (\n    <div data-slot=\"resizable-panel-mock\" className={className} style={style}>\n      {children}\n    </div>\n  );\n}\n\nexport function ResizableSeparatorStub({ children, className, style }: ContainerStubProps) {\n  return (\n    <div\n      data-slot=\"resizable-separator-mock\"\n      role=\"separator\"\n      className={className}\n      style={style}\n    >\n      {children}\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// shiki stub — serves the subpaths the kit's slim highlighter\n// (`src/lib/shiki.ts`) dynamic-imports. The stub highlighter tokenizes each\n// line as one unstyled token, so `CodeBlock` renders the raw code.\n// ---------------------------------------------------------------------------\n\ninterface StubToken {\n  content: string;\n  color: string;\n}\n\nexport interface StubHighlighterCore {\n  codeToTokens: (\n    code: string,\n    options?: unknown,\n  ) => { bg: string; fg: string; tokens: StubToken[][] };\n  codeToHtml: (code: string, options?: unknown) => string;\n  loadLanguage: (...grammars: unknown[]) => Promise<void>;\n  getLoadedLanguages: () => string[];\n  dispose: () => void;\n}\n\nfunction escapeHtml(code: string): string {\n  return code\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nexport function createHighlighterCoreStub(): Promise<StubHighlighterCore> {\n  return Promise.resolve({\n    codeToTokens: (code: string) => ({\n      bg: \"transparent\",\n      fg: \"inherit\",\n      tokens: code\n        .split(\"\\n\")\n        .map((line) => [{ content: line, color: \"inherit\" }]),\n    }),\n    codeToHtml: (code: string) => `<pre><code>${escapeHtml(code)}</code></pre>`,\n    loadLanguage: () => Promise.resolve(),\n    getLoadedLanguages: () => [],\n    dispose: () => {},\n  });\n}\n\n/** Languages the kit's `CodeBlock` highlighter loads by id (src/lib/shiki.ts). */\nexport const KIT_SHIKI_LANGUAGES = [\n  \"bash\",\n  \"javascript\",\n  \"json\",\n  \"markdown\",\n  \"python\",\n  \"sql\",\n  \"tsx\",\n  \"typescript\",\n  \"yaml\",\n] as const;\n\n// ---------------------------------------------------------------------------\n// Registration + jsdom shims\n// ---------------------------------------------------------------------------\n\n/** Structural subset of Jest's `jest` object — avoids @types/jest. */\nexport interface JestMockApi {\n  mock: (\n    moduleName: string,\n    factory?: () => unknown,\n    options?: { virtual?: boolean },\n  ) => unknown;\n}\n\n/**\n * Register stubs for every ESM-only / optional-peer module the kit reaches.\n * Non-virtual when the module resolves, virtual fallback when it doesn't —\n * see the module docblock.\n */\nexport function installUiKitJestMocks(jestApi: JestMockApi): void {\n  const tryMock = (moduleName: string, factory: () => unknown): void => {\n    try {\n      jestApi.mock(moduleName, factory);\n    } catch {\n      jestApi.mock(moduleName, factory, { virtual: true });\n    }\n  };\n  tryMock(\"plotly.js-dist\", () => plotlyStub);\n  // Same interop shape as plotly: MoleculeStructure's loader does\n  // `mod.default ?? mod`, so the factory returns the raw function directly.\n  tryMock(\"@rdkit/rdkit\", () => rdkitFactoryStub);\n  tryMock(\"streamdown\", () => ({\n    Streamdown: StreamdownStub,\n    default: StreamdownStub,\n  }));\n  tryMock(\"use-stick-to-bottom\", () => ({\n    StickToBottom: StickToBottomStub,\n    useStickToBottomContext: useStickToBottomContextStub,\n    useStickToBottom: useStickToBottomStub,\n  }));\n  tryMock(\"react-resizable-panels\", () => ({\n    Group: ResizableGroupStub,\n    Panel: ResizablePanelStub,\n    Separator: ResizableSeparatorStub,\n    // Pre-v4 API names, for consumer code using the library directly.\n    PanelGroup: ResizableGroupStub,\n    PanelResizeHandle: ResizableSeparatorStub,\n  }));\n  // Each package exports exactly one of these — separate one-key objects\n  // (not a shared multi-key literal) so the shape doesn't imply a\n  // relationship between packages that don't actually share one.\n  tryMock(\"@streamdown/cjk\", () => ({ cjk: streamdownPluginStub }));\n  tryMock(\"@streamdown/math\", () => ({ math: streamdownPluginStub }));\n  tryMock(\"@streamdown/mermaid\", () => ({ mermaid: streamdownPluginStub }));\n  tryMock(\"shiki/core\", () => ({\n    createHighlighterCore: createHighlighterCoreStub,\n  }));\n  tryMock(\"shiki/engine/javascript\", () => ({\n    createJavaScriptRegexEngine: () => ({}),\n  }));\n  // These four are consumed via dynamic `import()`, which Rollup's CJS\n  // output rewrites to an interop-wrapped `require()` (see\n  // `dynamicImportInCjs: false` in vite.config.ts) — and that interop\n  // helper unconditionally does `namespace.default = <raw required value>`,\n  // with no `__esModule` check. So a factory returning `{ default: X }`\n  // produces `namespace.default === { default: X }`, not `X` — the factory\n  // must return the value the consuming code expects at `.default` directly.\n  tryMock(\"@shikijs/themes/github-light\", () => ({}));\n  tryMock(\"@shikijs/themes/github-dark\", () => ({}));\n  for (const lang of KIT_SHIKI_LANGUAGES) {\n    // `src/lib/shiki.ts` does `highlighter.loadLanguage(...grammar.default)`\n    // — an empty array is inert there once unwrapped correctly.\n    tryMock(`@shikijs/langs/${lang}`, () => []);\n  }\n}\n\ntype MutableGlobal = Record<string, unknown>;\n\nclass ResizeObserverShim {\n  observe(): void {}\n  unobserve(): void {}\n  disconnect(): void {}\n}\n\nclass IntersectionObserverShim {\n  readonly root = null;\n  readonly rootMargin = \"\";\n  readonly thresholds: ReadonlyArray<number> = [];\n  observe(): void {}\n  unobserve(): void {}\n  disconnect(): void {}\n  takeRecords(): unknown[] {\n    return [];\n  }\n}\n\n/**\n * Install the browser APIs jsdom lacks but the kit's components touch —\n * ResizeObserver (charts, sidebar), matchMedia (sonner, hooks),\n * IntersectionObserver, pointer capture and scrollIntoView (Radix menus and\n * selects). Install-if-missing, so a consumer's own polyfills always win.\n */\nexport function installUiKitDomShims(): void {\n  const globalRef = globalThis as unknown as MutableGlobal;\n\n  if (typeof globalRef.ResizeObserver === \"undefined\") {\n    globalRef.ResizeObserver = ResizeObserverShim;\n  }\n  if (typeof globalRef.IntersectionObserver === \"undefined\") {\n    globalRef.IntersectionObserver = IntersectionObserverShim;\n  }\n\n  if (typeof window === \"undefined\") {\n    return;\n  }\n\n  if (typeof window.matchMedia === \"undefined\") {\n    window.matchMedia = (query: string) =>\n      ({\n        matches: false,\n        media: query,\n        onchange: null,\n        addListener: () => {},\n        removeListener: () => {},\n        addEventListener: () => {},\n        removeEventListener: () => {},\n        dispatchEvent: () => false,\n      }) as unknown as MediaQueryList;\n  }\n\n  const elementProto = window.Element.prototype as unknown as MutableGlobal;\n  if (typeof elementProto.scrollIntoView === \"undefined\") {\n    elementProto.scrollIntoView = () => {};\n  }\n  if (typeof elementProto.scrollTo === \"undefined\") {\n    elementProto.scrollTo = () => {};\n  }\n  if (typeof elementProto.hasPointerCapture === \"undefined\") {\n    elementProto.hasPointerCapture = () => false;\n  }\n  if (typeof elementProto.setPointerCapture === \"undefined\") {\n    elementProto.setPointerCapture = () => {};\n  }\n  if (typeof elementProto.releasePointerCapture === \"undefined\") {\n    elementProto.releasePointerCapture = () => {};\n  }\n}\n\n// Side effect on import: active only under Jest. The `jest` object is not a\n// true global — Jest injects it into every module as a wrapper parameter —\n// so it must be read as a free variable behind a `typeof` guard, which also\n// keeps this module inert everywhere else (bundlers, Vitest, tooling).\ndeclare const jest: JestMockApi | undefined;\n\nconst jestObject =\n  typeof jest !== \"undefined\" && jest && typeof jest.mock === \"function\"\n    ? jest\n    : undefined;\nif (jestObject) {\n  installUiKitDomShims();\n  installUiKitJestMocks(jestObject);\n}\n"],"names":["attachPlotEvents","el","plotEl","listeners","event","handler","set","onceHandler","payload","plotlyStub","rdkitModuleStub","smiles","rdkitFactoryStub","StreamdownStub","children","className","jsx","streamdownPluginStub","StickToBottomRoot","style","role","StickToBottomContent","StickToBottomStub","stickToBottomContext","useStickToBottomContextStub","useStickToBottomStub","ResizableGroupStub","ResizablePanelStub","ResizableSeparatorStub","escapeHtml","code","createHighlighterCoreStub","line","KIT_SHIKI_LANGUAGES","installUiKitJestMocks","jestApi","tryMock","moduleName","factory","lang","ResizeObserverShim","IntersectionObserverShim","installUiKitDomShims","globalRef","query","elementProto","jestObject"],"mappings":";AAsDA,SAASA,EAAiBC,GAAkC;AAC1D,QAAMC,IAASD,GACTE,wBAAgB,IAAA;AAEtB,SAAAD,EAAO,KAAK,CAACE,GAAOC,MAAY;AAC9B,UAAMC,IAAMH,EAAU,IAAIC,CAAK,yBAAS,IAAA;AACxC,IAAAE,EAAI,IAAID,CAAO,GACfF,EAAU,IAAIC,GAAOE,CAAG;AAAA,EAC1B,GACAJ,EAAO,OAAO,CAACE,GAAOC,MAAY;AAChC,UAAME,IAA2B,CAACC,MAAY;AAC5C,MAAAN,EAAO,eAAeE,GAAOG,CAAW,GACxCF,EAAQG,CAAO;AAAA,IACjB;AACA,IAAAN,EAAO,GAAGE,GAAOG,CAAW;AAAA,EAC9B,GACAL,EAAO,iBAAiB,CAACE,GAAOC,MAAY;AAC1C,IAAAF,EAAU,IAAIC,CAAK,GAAG,OAAOC,CAAO;AAAA,EACtC,GACAH,EAAO,qBAAqB,CAACE,MAAU;AACrC,IAAIA,IACFD,EAAU,OAAOC,CAAK,IAEtBD,EAAU,MAAA;AAAA,EAEd,GACAD,EAAO,OAAO,CAACE,GAAOI,MAAY;AAChC,eAAWH,KAAWF,EAAU,IAAIC,CAAK,KAAK,CAAA;AAC5C,MAAAC,EAAQG,CAAO;AAAA,EAEnB,GACON;AACT;AAEO,MAAMO,IAAa;AAAA,EACxB,SAAS,CAACR,MACR,QAAQ,QAAQD,EAAiBC,CAAE,CAAC;AAAA,EACtC,OAAO,CAACA,MACN,QAAQ,QAAQD,EAAiBC,CAAE,CAAC;AAAA,EACtC,UAAU,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EACvE,SAAS,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EACtE,QAAQ,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EACrE,WAAW,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EACxE,cAAc,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EAC3E,cAAc,CAACA,MAA0C,QAAQ,QAAQA,CAAE;AAAA,EAC3E,OAAO,MAAY;AAAA,EAAC;AAAA,EACpB,eAAe,MAAY;AAAA,EAAC;AAAA,EAC5B,SAAS,MAAuB,QAAQ,QAAQ,wBAAwB;AAAA,EACxE,eAAe,MAAuB,QAAQ,QAAQ,eAAe;AAAA,EACrE,OAAO;AAAA,IACL,QAAQ,MAAqB,QAAQ,QAAA;AAAA,EAAQ;AAEjD,GAwBaS,IAAkB;AAAA,EAC7B,SAAS,CAACC,OAAqC;AAAA,IAC7C,UAAU,MAAM;AAAA,IAChB,yBAAyB,MACvB;AAAA,oBAAkEA,CAAM;AAAA,IAC1E,QAAQ,MAAM;AAAA,IAAC;AAAA,EAAA;AAEnB,GAEaC,IAAmB,MAC9B,QAAQ,QAAQF,CAAe;AAc1B,SAASG,EAAe,EAAE,UAAAC,GAAU,WAAAC,KAAkC;AAC3E,SACE,gBAAAC,EAAC,OAAA,EAAI,aAAU,mBAAkB,WAAAD,GAC9B,UAAAD,GACH;AAEJ;AAGO,MAAMG,IAAuB,OAA8B,CAAA;AAelE,SAASC,EAAkB,EAAE,UAAAJ,GAAU,WAAAC,GAAW,OAAAI,GAAO,MAAAC,KAA4B;AACnF,2BACG,OAAA,EAAI,aAAU,wBAAuB,WAAAL,GAAsB,OAAAI,GAAc,MAAAC,GACvE,UAAAN,GACH;AAEJ;AAEA,SAASO,EAAqB,EAAE,UAAAP,GAAU,WAAAC,GAAW,OAAAI,KAA6B;AAChF,2BACG,OAAA,EAAI,aAAU,gCAA+B,WAAAJ,GAAsB,OAAAI,GACjE,UAAAL,GACH;AAEJ;AAEO,MAAMQ,IAAoB,OAAO,OAAOJ,GAAmB;AAAA,EAChE,SAASG;AACX,CAAC,GAEKE,IAAuB;AAAA,EAC3B,YAAY;AAAA,EACZ,gBAAgB,MAAY;AAAA,EAAC;AAAA,EAC7B,YAAY,MAAY;AAAA,EAAC;AAC3B;AAEO,SAASC,IAA2D;AACzE,SAAOD;AACT;AAEO,SAASE,IAGd;AACA,SAAO,EAAE,GAAGF,GAAsB,WAAW,MAAM;AAAA,EAAC,GAAG,YAAY,MAAM;AAAA,EAAC,EAAA;AAC5E;AAOO,SAASG,EAAmB,EAAE,UAAAZ,GAAU,WAAAC,GAAW,OAAAI,KAA6B;AACrF,2BACG,OAAA,EAAI,aAAU,wBAAuB,WAAAJ,GAAsB,OAAAI,GACzD,UAAAL,GACH;AAEJ;AAEO,SAASa,EAAmB,EAAE,UAAAb,GAAU,WAAAC,GAAW,OAAAI,KAA6B;AACrF,2BACG,OAAA,EAAI,aAAU,wBAAuB,WAAAJ,GAAsB,OAAAI,GACzD,UAAAL,GACH;AAEJ;AAEO,SAASc,EAAuB,EAAE,UAAAd,GAAU,WAAAC,GAAW,OAAAI,KAA6B;AACzF,SACE,gBAAAH;AAAA,IAAC;AAAA,IAAA;AAAA,MACC,aAAU;AAAA,MACV,MAAK;AAAA,MACL,WAAAD;AAAA,MACA,OAAAI;AAAA,MAEC,UAAAL;AAAA,IAAA;AAAA,EAAA;AAGP;AAwBA,SAASe,EAAWC,GAAsB;AACxC,SAAOA,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM;AACzB;AAEO,SAASC,IAA0D;AACxE,SAAO,QAAQ,QAAQ;AAAA,IACrB,cAAc,CAACD,OAAkB;AAAA,MAC/B,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,QAAQA,EACL,MAAM;AAAA,CAAI,EACV,IAAI,CAACE,MAAS,CAAC,EAAE,SAASA,GAAM,OAAO,UAAA,CAAW,CAAC;AAAA,IAAA;AAAA,IAExD,YAAY,CAACF,MAAiB,cAAcD,EAAWC,CAAI,CAAC;AAAA,IAC5D,cAAc,MAAM,QAAQ,QAAA;AAAA,IAC5B,oBAAoB,MAAM,CAAA;AAAA,IAC1B,SAAS,MAAM;AAAA,IAAC;AAAA,EAAA,CACjB;AACH;AAGO,MAAMG,IAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,SAASC,EAAsBC,GAA4B;AAChE,QAAMC,IAAU,CAACC,GAAoBC,MAAiC;AACpE,QAAI;AACF,MAAAH,EAAQ,KAAKE,GAAYC,CAAO;AAAA,IAClC,QAAQ;AACN,MAAAH,EAAQ,KAAKE,GAAYC,GAAS,EAAE,SAAS,IAAM;AAAA,IACrD;AAAA,EACF;AACA,EAAAF,EAAQ,kBAAkB,MAAM3B,CAAU,GAG1C2B,EAAQ,gBAAgB,MAAMxB,CAAgB,GAC9CwB,EAAQ,cAAc,OAAO;AAAA,IAC3B,YAAYvB;AAAA,IACZ,SAASA;AAAA,EAAA,EACT,GACFuB,EAAQ,uBAAuB,OAAO;AAAA,IACpC,eAAed;AAAA,IACf,yBAAyBE;AAAA,IACzB,kBAAkBC;AAAA,EAAA,EAClB,GACFW,EAAQ,0BAA0B,OAAO;AAAA,IACvC,OAAOV;AAAA,IACP,OAAOC;AAAA,IACP,WAAWC;AAAA;AAAA,IAEX,YAAYF;AAAA,IACZ,mBAAmBE;AAAA,EAAA,EACnB,GAIFQ,EAAQ,mBAAmB,OAAO,EAAE,KAAKnB,IAAuB,GAChEmB,EAAQ,oBAAoB,OAAO,EAAE,MAAMnB,IAAuB,GAClEmB,EAAQ,uBAAuB,OAAO,EAAE,SAASnB,IAAuB,GACxEmB,EAAQ,cAAc,OAAO;AAAA,IAC3B,uBAAuBL;AAAA,EAAA,EACvB,GACFK,EAAQ,2BAA2B,OAAO;AAAA,IACxC,6BAA6B,OAAO,CAAA;AAAA,EAAC,EACrC,GAQFA,EAAQ,gCAAgC,OAAO,CAAA,EAAG,GAClDA,EAAQ,+BAA+B,OAAO,CAAA,EAAG;AACjD,aAAWG,KAAQN;AAGjB,IAAAG,EAAQ,kBAAkBG,CAAI,IAAI,MAAM,CAAA,CAAE;AAE9C;AAIA,MAAMC,EAAmB;AAAA,EACvB,UAAgB;AAAA,EAAC;AAAA,EACjB,YAAkB;AAAA,EAAC;AAAA,EACnB,aAAmB;AAAA,EAAC;AACtB;AAEA,MAAMC,EAAyB;AAAA,EACpB,OAAO;AAAA,EACP,aAAa;AAAA,EACb,aAAoC,CAAA;AAAA,EAC7C,UAAgB;AAAA,EAAC;AAAA,EACjB,YAAkB;AAAA,EAAC;AAAA,EACnB,aAAmB;AAAA,EAAC;AAAA,EACpB,cAAyB;AACvB,WAAO,CAAA;AAAA,EACT;AACF;AAQO,SAASC,IAA6B;AAC3C,QAAMC,IAAY;AASlB,MAPI,OAAOA,EAAU,iBAAmB,QACtCA,EAAU,iBAAiBH,IAEzB,OAAOG,EAAU,uBAAyB,QAC5CA,EAAU,uBAAuBF,IAG/B,OAAO,SAAW;AACpB;AAGF,EAAI,OAAO,OAAO,aAAe,QAC/B,OAAO,aAAa,CAACG,OAClB;AAAA,IACC,SAAS;AAAA,IACT,OAAOA;AAAA,IACP,UAAU;AAAA,IACV,aAAa,MAAM;AAAA,IAAC;AAAA,IACpB,gBAAgB,MAAM;AAAA,IAAC;AAAA,IACvB,kBAAkB,MAAM;AAAA,IAAC;AAAA,IACzB,qBAAqB,MAAM;AAAA,IAAC;AAAA,IAC5B,eAAe,MAAM;AAAA,EAAA;AAI3B,QAAMC,IAAe,OAAO,QAAQ;AACpC,EAAI,OAAOA,EAAa,iBAAmB,QACzCA,EAAa,iBAAiB,MAAM;AAAA,EAAC,IAEnC,OAAOA,EAAa,WAAa,QACnCA,EAAa,WAAW,MAAM;AAAA,EAAC,IAE7B,OAAOA,EAAa,oBAAsB,QAC5CA,EAAa,oBAAoB,MAAM,KAErC,OAAOA,EAAa,oBAAsB,QAC5CA,EAAa,oBAAoB,MAAM;AAAA,EAAC,IAEtC,OAAOA,EAAa,wBAA0B,QAChDA,EAAa,wBAAwB,MAAM;AAAA,EAAC;AAEhD;AAQA,MAAMC,IACJ,OAAO,OAAS,OAAe,QAAQ,OAAO,KAAK,QAAS,aACxD,OACA;AACFA,MACFJ,EAAA,GACAR,EAAsBY,CAAU;"}

package/dist/lib/shiki.cjs

@@ -1,2 +1,2 @@
-"use strict";var m=Object.create;var s=Object.defineProperty;var h=Object.getOwnPropertyDescriptor;var d=Object.getOwnPropertyNames;var f=Object.getPrototypeOf,C=Object.prototype.hasOwnProperty;var y=(t,e,o,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of d(e))!C.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(r=h(e,n))||r.enumerable});return t};var a=(t,e,o)=>(o=t!=null?m(f(t)):{},y(e||!t||!t.__esModule?s(o,"default",{value:t,enumerable:!0}):o,t));Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const i=new Map([["bash",()=>import("@shikijs/langs/bash")],["javascript",()=>import("@shikijs/langs/javascript")],["json",()=>import("@shikijs/langs/json")],["markdown",()=>import("@shikijs/langs/markdown")],["python",()=>import("@shikijs/langs/python")],["sql",()=>import("@shikijs/langs/sql")],["tsx",()=>import("@shikijs/langs/tsx")],["typescript",()=>import("@shikijs/langs/typescript")],["yaml",()=>import("@shikijs/langs/yaml")]]),c=new Map([["sh","bash"],["shell","bash"],["shellscript","bash"],["zsh","bash"],["js","javascript"],["jsx","tsx"],["md","markdown"],["py","python"],["ts","typescript"],["yml","yaml"]]);function p(t){const e=t.trim().toLowerCase(),o=c.get(e)??e;return i.has(o)?o:null}function L(){return[...i.keys()]}function k(t,e,o=[]){const r=t.trim().toLowerCase();i.set(r,e);for(const n of o)c.set(n.trim().toLowerCase(),r)}let l=null;const g=new Map;function w(){return l??=Promise.all([import("shiki/core"),import("shiki/engine/javascript"),import("@shikijs/themes/github-light"),import("@shikijs/themes/github-dark")]).then(([t,e,o,r])=>t.createHighlighterCore({engine:e.createJavaScriptRegexEngine({forgiving:!0}),langs:[],themes:[o.default,r.default]})),l}async function v(t){const e=p(t),o=await w();if(e){let r=g.get(e);if(!r){const n=i.get(e);r=n?n().then(u=>o.loadLanguage(...u.default)):Promise.resolve(),g.set(e,r)}await r}return{highlighter:o,lang:e??"text"}}exports.getCodeBlockHighlighter=v;exports.getSupportedCodeBlockLanguages=L;exports.registerCodeBlockLanguage=k;exports.resolveCodeBlockLanguage=p;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});function o(t){const e=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(t){for(const r in t)if(r!=="default"){const n=Object.getOwnPropertyDescriptor(t,r);Object.defineProperty(e,r,n.get?n:{enumerable:!0,get:()=>t[r]})}}return e.default=t,Object.freeze(e)}const i=new Map([["bash",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/bash")))],["javascript",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/javascript")))],["json",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/json")))],["markdown",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/markdown")))],["python",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/python")))],["sql",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/sql")))],["tsx",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/tsx")))],["typescript",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/typescript")))],["yaml",()=>Promise.resolve().then(()=>o(require("@shikijs/langs/yaml")))]]),g=new Map([["sh","bash"],["shell","bash"],["shellscript","bash"],["zsh","bash"],["js","javascript"],["jsx","tsx"],["md","markdown"],["py","python"],["ts","typescript"],["yml","yaml"]]);function u(t){const e=t.trim().toLowerCase(),r=g.get(e)??e;return i.has(r)?r:null}function h(){return[...i.keys()]}function m(t,e,r=[]){const n=t.trim().toLowerCase();i.set(n,e);for(const s of r)g.set(s.trim().toLowerCase(),n)}let a=null;const l=new Map;function d(){return a??=Promise.all([Promise.resolve().then(()=>o(require("shiki/core"))),Promise.resolve().then(()=>o(require("shiki/engine/javascript"))),Promise.resolve().then(()=>o(require("@shikijs/themes/github-light"))),Promise.resolve().then(()=>o(require("@shikijs/themes/github-dark")))]).then(([t,e,r,n])=>t.createHighlighterCore({engine:e.createJavaScriptRegexEngine({forgiving:!0}),langs:[],themes:[r.default,n.default]})),a}async function p(t){const e=u(t),r=await d();if(e){let n=l.get(e);if(!n){const s=i.get(e);n=s?s().then(c=>r.loadLanguage(...c.default)):Promise.resolve(),l.set(e,n)}await n}return{highlighter:r,lang:e??"text"}}exports.getCodeBlockHighlighter=p;exports.getSupportedCodeBlockLanguages=h;exports.registerCodeBlockLanguage=m;exports.resolveCodeBlockLanguage=u;
 //# sourceMappingURL=shiki.cjs.map

package/dist/lib/shiki.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"shiki.cjs","sources":["../../src/lib/shiki.ts"],"sourcesContent":["/**\n * Shared slim Shiki setup (SW-2007).\n *\n * Importing `createHighlighter` from \"shiki\" pulls the full bundle — ~200\n * grammars, each its own module — which balloons consumer builds (~9k\n * modules) and can OOM Vite's default heap. This module uses `shiki/core`\n * with an explicit language set instead: the engine, themes, and grammars\n * all arrive through dynamic imports, so they land in lazy chunks and only\n * the languages listed here are ever pulled into a build.\n *\n * Consumers can extend the set at runtime with `registerCodeBlockLanguage`.\n */\nimport type { HighlighterCore, LanguageRegistration } from \"shiki/core\";\n\ntype LanguageLoader = () => Promise<{ default: LanguageRegistration[] }>;\n\n// Default grammars, chosen for scientific data-app content. Keys are the\n// canonical ids requested via `lang`; aliases map onto them below.\nconst languageLoaders = new Map<string, LanguageLoader>([\n  [\"bash\", () => import(\"@shikijs/langs/bash\")],\n  [\"javascript\", () => import(\"@shikijs/langs/javascript\")],\n  [\"json\", () => import(\"@shikijs/langs/json\")],\n  [\"markdown\", () => import(\"@shikijs/langs/markdown\")],\n  [\"python\", () => import(\"@shikijs/langs/python\")],\n  [\"sql\", () => import(\"@shikijs/langs/sql\")],\n  [\"tsx\", () => import(\"@shikijs/langs/tsx\")],\n  [\"typescript\", () => import(\"@shikijs/langs/typescript\")],\n  [\"yaml\", () => import(\"@shikijs/langs/yaml\")],\n]);\n\nconst languageAliases = new Map<string, string>([\n  [\"sh\", \"bash\"],\n  [\"shell\", \"bash\"],\n  [\"shellscript\", \"bash\"],\n  [\"zsh\", \"bash\"],\n  [\"js\", \"javascript\"],\n  [\"jsx\", \"tsx\"],\n  [\"md\", \"markdown\"],\n  [\"py\", \"python\"],\n  [\"ts\", \"typescript\"],\n  [\"yml\", \"yaml\"],\n]);\n\n/**\n * Resolve a requested language to a registered canonical id, or null when\n * the language isn't in the set (callers fall back to plaintext).\n */\nexport function resolveCodeBlockLanguage(language: string): string | null {\n  const normalized = language.trim().toLowerCase();\n  const canonical = languageAliases.get(normalized) ?? normalized;\n  return languageLoaders.has(canonical) ? canonical : null;\n}\n\n/** Canonical ids of every language the slim highlighter can load. */\nexport function getSupportedCodeBlockLanguages(): string[] {\n  return [...languageLoaders.keys()];\n}\n\n/**\n * Register an additional grammar for `CodeBlock`/`MessageResponse` code\n * highlighting, e.g.:\n *\n * ```ts\n * registerCodeBlockLanguage(\"rust\", () => import(\"@shikijs/langs/rust\"), [\"rs\"]);\n * ```\n *\n * The loader stays a dynamic import, so added grammars are also code-split.\n */\nexport function registerCodeBlockLanguage(\n  language: string,\n  loader: LanguageLoader,\n  aliases: string[] = [],\n): void {\n  const canonical = language.trim().toLowerCase();\n  languageLoaders.set(canonical, loader);\n  for (const alias of aliases) {\n    languageAliases.set(alias.trim().toLowerCase(), canonical);\n  }\n}\n\n// One shared highlighter core; grammars are loaded into it on demand.\nlet corePromise: Promise<HighlighterCore> | null = null;\nconst loadedLanguages = new Map<string, Promise<void>>();\n\nfunction getHighlighterCore(): Promise<HighlighterCore> {\n  corePromise ??= Promise.all([\n    import(\"shiki/core\"),\n    import(\"shiki/engine/javascript\"),\n    import(\"@shikijs/themes/github-light\"),\n    import(\"@shikijs/themes/github-dark\"),\n  ]).then(([core, engine, githubLight, githubDark]) =>\n    core.createHighlighterCore({\n      // The JS regex engine avoids shipping the oniguruma WASM asset;\n      // `forgiving` skips the few grammar rules it can't translate.\n      engine: engine.createJavaScriptRegexEngine({ forgiving: true }),\n      langs: [],\n      themes: [githubLight.default, githubDark.default],\n    }),\n  );\n  return corePromise;\n}\n\n/**\n * Get the shared highlighter with the requested language loaded. `lang` is\n * the id to pass to `codeToTokens` — the canonical id when supported,\n * otherwise \"text\" (plaintext needs no grammar).\n */\nexport async function getCodeBlockHighlighter(\n  language: string,\n): Promise<{ highlighter: HighlighterCore; lang: string }> {\n  const canonical = resolveCodeBlockLanguage(language);\n  const highlighter = await getHighlighterCore();\n  if (canonical) {\n    let pending = loadedLanguages.get(canonical);\n    if (!pending) {\n      const loader = languageLoaders.get(canonical);\n      pending = loader\n        ? loader().then((grammar) => highlighter.loadLanguage(...grammar.default))\n        : Promise.resolve();\n      loadedLanguages.set(canonical, pending);\n    }\n    await pending;\n  }\n  return { highlighter, lang: canonical ?? \"text\" };\n}\n"],"names":["languageLoaders","languageAliases","resolveCodeBlockLanguage","language","normalized","canonical","getSupportedCodeBlockLanguages","registerCodeBlockLanguage","loader","aliases","alias","corePromise","loadedLanguages","getHighlighterCore","core","engine","githubLight","githubDark","getCodeBlockHighlighter","highlighter","pending","grammar"],"mappings":"2hBAkBA,MAAMA,MAAsB,IAA4B,CACtD,CAAC,OAAQ,IAAM,OAAO,qBAAqB,CAAC,EAC5C,CAAC,aAAc,IAAM,OAAO,2BAA2B,CAAC,EACxD,CAAC,OAAQ,IAAM,OAAO,qBAAqB,CAAC,EAC5C,CAAC,WAAY,IAAM,OAAO,yBAAyB,CAAC,EACpD,CAAC,SAAU,IAAM,OAAO,uBAAuB,CAAC,EAChD,CAAC,MAAO,IAAM,OAAO,oBAAoB,CAAC,EAC1C,CAAC,MAAO,IAAM,OAAO,oBAAoB,CAAC,EAC1C,CAAC,aAAc,IAAM,OAAO,2BAA2B,CAAC,EACxD,CAAC,OAAQ,IAAM,OAAO,qBAAqB,CAAC,CAC9C,CAAC,EAEKC,MAAsB,IAAoB,CAC9C,CAAC,KAAM,MAAM,EACb,CAAC,QAAS,MAAM,EAChB,CAAC,cAAe,MAAM,EACtB,CAAC,MAAO,MAAM,EACd,CAAC,KAAM,YAAY,EACnB,CAAC,MAAO,KAAK,EACb,CAAC,KAAM,UAAU,EACjB,CAAC,KAAM,QAAQ,EACf,CAAC,KAAM,YAAY,EACnB,CAAC,MAAO,MAAM,CAChB,CAAC,EAMM,SAASC,EAAyBC,EAAiC,CACxE,MAAMC,EAAaD,EAAS,KAAA,EAAO,YAAA,EAC7BE,EAAYJ,EAAgB,IAAIG,CAAU,GAAKA,EACrD,OAAOJ,EAAgB,IAAIK,CAAS,EAAIA,EAAY,IACtD,CAGO,SAASC,GAA2C,CACzD,MAAO,CAAC,GAAGN,EAAgB,MAAM,CACnC,CAYO,SAASO,EACdJ,EACAK,EACAC,EAAoB,CAAA,EACd,CACN,MAAMJ,EAAYF,EAAS,KAAA,EAAO,YAAA,EAClCH,EAAgB,IAAIK,EAAWG,CAAM,EACrC,UAAWE,KAASD,EAClBR,EAAgB,IAAIS,EAAM,KAAA,EAAO,YAAA,EAAeL,CAAS,CAE7D,CAGA,IAAIM,EAA+C,KACnD,MAAMC,MAAsB,IAE5B,SAASC,GAA+C,CACtD,OAAAF,IAAgB,QAAQ,IAAI,CAC1B,OAAO,YAAY,EACnB,OAAO,yBAAyB,EAChC,OAAO,8BAA8B,EACrC,OAAO,6BAA6B,CAAA,CACrC,EAAE,KAAK,CAAC,CAACG,EAAMC,EAAQC,EAAaC,CAAU,IAC7CH,EAAK,sBAAsB,CAGzB,OAAQC,EAAO,4BAA4B,CAAE,UAAW,GAAM,EAC9D,MAAO,CAAA,EACP,OAAQ,CAACC,EAAY,QAASC,EAAW,OAAO,CAAA,CACjD,CAAA,EAEIN,CACT,CAOA,eAAsBO,EACpBf,EACyD,CACzD,MAAME,EAAYH,EAAyBC,CAAQ,EAC7CgB,EAAc,MAAMN,EAAA,EAC1B,GAAIR,EAAW,CACb,IAAIe,EAAUR,EAAgB,IAAIP,CAAS,EAC3C,GAAI,CAACe,EAAS,CACZ,MAAMZ,EAASR,EAAgB,IAAIK,CAAS,EAC5Ce,EAAUZ,EACNA,EAAA,EAAS,KAAMa,GAAYF,EAAY,aAAa,GAAGE,EAAQ,OAAO,CAAC,EACvE,QAAQ,QAAA,EACZT,EAAgB,IAAIP,EAAWe,CAAO,CACxC,CACA,MAAMA,CACR,CACA,MAAO,CAAE,YAAAD,EAAa,KAAMd,GAAa,MAAA,CAC3C"}
+{"version":3,"file":"shiki.cjs","sources":["../../src/lib/shiki.ts"],"sourcesContent":["/**\n * Shared slim Shiki setup (SW-2007).\n *\n * Importing `createHighlighter` from \"shiki\" pulls the full bundle — ~200\n * grammars, each its own module — which balloons consumer builds (~9k\n * modules) and can OOM Vite's default heap. This module uses `shiki/core`\n * with an explicit language set instead: the engine, themes, and grammars\n * all arrive through dynamic imports, so they land in lazy chunks and only\n * the languages listed here are ever pulled into a build.\n *\n * Consumers can extend the set at runtime with `registerCodeBlockLanguage`.\n */\nimport type { HighlighterCore, LanguageRegistration } from \"shiki/core\";\n\ntype LanguageLoader = () => Promise<{ default: LanguageRegistration[] }>;\n\n// Default grammars, chosen for scientific data-app content. Keys are the\n// canonical ids requested via `lang`; aliases map onto them below.\nconst languageLoaders = new Map<string, LanguageLoader>([\n  [\"bash\", () => import(\"@shikijs/langs/bash\")],\n  [\"javascript\", () => import(\"@shikijs/langs/javascript\")],\n  [\"json\", () => import(\"@shikijs/langs/json\")],\n  [\"markdown\", () => import(\"@shikijs/langs/markdown\")],\n  [\"python\", () => import(\"@shikijs/langs/python\")],\n  [\"sql\", () => import(\"@shikijs/langs/sql\")],\n  [\"tsx\", () => import(\"@shikijs/langs/tsx\")],\n  [\"typescript\", () => import(\"@shikijs/langs/typescript\")],\n  [\"yaml\", () => import(\"@shikijs/langs/yaml\")],\n]);\n\nconst languageAliases = new Map<string, string>([\n  [\"sh\", \"bash\"],\n  [\"shell\", \"bash\"],\n  [\"shellscript\", \"bash\"],\n  [\"zsh\", \"bash\"],\n  [\"js\", \"javascript\"],\n  [\"jsx\", \"tsx\"],\n  [\"md\", \"markdown\"],\n  [\"py\", \"python\"],\n  [\"ts\", \"typescript\"],\n  [\"yml\", \"yaml\"],\n]);\n\n/**\n * Resolve a requested language to a registered canonical id, or null when\n * the language isn't in the set (callers fall back to plaintext).\n */\nexport function resolveCodeBlockLanguage(language: string): string | null {\n  const normalized = language.trim().toLowerCase();\n  const canonical = languageAliases.get(normalized) ?? normalized;\n  return languageLoaders.has(canonical) ? canonical : null;\n}\n\n/** Canonical ids of every language the slim highlighter can load. */\nexport function getSupportedCodeBlockLanguages(): string[] {\n  return [...languageLoaders.keys()];\n}\n\n/**\n * Register an additional grammar for `CodeBlock`/`MessageResponse` code\n * highlighting, e.g.:\n *\n * ```ts\n * registerCodeBlockLanguage(\"rust\", () => import(\"@shikijs/langs/rust\"), [\"rs\"]);\n * ```\n *\n * The loader stays a dynamic import, so added grammars are also code-split.\n */\nexport function registerCodeBlockLanguage(\n  language: string,\n  loader: LanguageLoader,\n  aliases: string[] = [],\n): void {\n  const canonical = language.trim().toLowerCase();\n  languageLoaders.set(canonical, loader);\n  for (const alias of aliases) {\n    languageAliases.set(alias.trim().toLowerCase(), canonical);\n  }\n}\n\n// One shared highlighter core; grammars are loaded into it on demand.\nlet corePromise: Promise<HighlighterCore> | null = null;\nconst loadedLanguages = new Map<string, Promise<void>>();\n\nfunction getHighlighterCore(): Promise<HighlighterCore> {\n  corePromise ??= Promise.all([\n    import(\"shiki/core\"),\n    import(\"shiki/engine/javascript\"),\n    import(\"@shikijs/themes/github-light\"),\n    import(\"@shikijs/themes/github-dark\"),\n  ]).then(([core, engine, githubLight, githubDark]) =>\n    core.createHighlighterCore({\n      // The JS regex engine avoids shipping the oniguruma WASM asset;\n      // `forgiving` skips the few grammar rules it can't translate.\n      engine: engine.createJavaScriptRegexEngine({ forgiving: true }),\n      langs: [],\n      themes: [githubLight.default, githubDark.default],\n    }),\n  );\n  return corePromise;\n}\n\n/**\n * Get the shared highlighter with the requested language loaded. `lang` is\n * the id to pass to `codeToTokens` — the canonical id when supported,\n * otherwise \"text\" (plaintext needs no grammar).\n */\nexport async function getCodeBlockHighlighter(\n  language: string,\n): Promise<{ highlighter: HighlighterCore; lang: string }> {\n  const canonical = resolveCodeBlockLanguage(language);\n  const highlighter = await getHighlighterCore();\n  if (canonical) {\n    let pending = loadedLanguages.get(canonical);\n    if (!pending) {\n      const loader = languageLoaders.get(canonical);\n      pending = loader\n        ? loader().then((grammar) => highlighter.loadLanguage(...grammar.default))\n        : Promise.resolve();\n      loadedLanguages.set(canonical, pending);\n    }\n    await pending;\n  }\n  return { highlighter, lang: canonical ?? \"text\" };\n}\n"],"names":["languageLoaders","_interopNamespaceDefault","languageAliases","resolveCodeBlockLanguage","language","normalized","canonical","getSupportedCodeBlockLanguages","registerCodeBlockLanguage","loader","aliases","alias","corePromise","loadedLanguages","getHighlighterCore","core","engine","githubLight","githubDark","getCodeBlockHighlighter","highlighter","pending","grammar"],"mappings":"6VAkBA,MAAMA,MAAsB,IAA4B,CACtD,CAAC,OAAQ,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAC,EAAA,QAAO,qBAAqB,GAAC,EAC5C,CAAC,aAAc,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,2BAA2B,GAAC,EACxD,CAAC,OAAQ,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,qBAAqB,GAAC,EAC5C,CAAC,WAAY,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,yBAAyB,GAAC,EACpD,CAAC,SAAU,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,uBAAuB,GAAC,EAChD,CAAC,MAAO,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,oBAAoB,GAAC,EAC1C,CAAC,MAAO,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,oBAAoB,GAAC,EAC1C,CAAC,aAAc,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,2BAA2B,GAAC,EACxD,CAAC,OAAQ,IAAM,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,qBAAqB,CAAA,CAAA,CAAC,CAC9C,CAAC,EAEKC,MAAsB,IAAoB,CAC9C,CAAC,KAAM,MAAM,EACb,CAAC,QAAS,MAAM,EAChB,CAAC,cAAe,MAAM,EACtB,CAAC,MAAO,MAAM,EACd,CAAC,KAAM,YAAY,EACnB,CAAC,MAAO,KAAK,EACb,CAAC,KAAM,UAAU,EACjB,CAAC,KAAM,QAAQ,EACf,CAAC,KAAM,YAAY,EACnB,CAAC,MAAO,MAAM,CAChB,CAAC,EAMM,SAASC,EAAyBC,EAAiC,CACxE,MAAMC,EAAaD,EAAS,KAAA,EAAO,YAAA,EAC7BE,EAAYJ,EAAgB,IAAIG,CAAU,GAAKA,EACrD,OAAOL,EAAgB,IAAIM,CAAS,EAAIA,EAAY,IACtD,CAGO,SAASC,GAA2C,CACzD,MAAO,CAAC,GAAGP,EAAgB,MAAM,CACnC,CAYO,SAASQ,EACdJ,EACAK,EACAC,EAAoB,CAAA,EACd,CACN,MAAMJ,EAAYF,EAAS,KAAA,EAAO,YAAA,EAClCJ,EAAgB,IAAIM,EAAWG,CAAM,EACrC,UAAWE,KAASD,EAClBR,EAAgB,IAAIS,EAAM,KAAA,EAAO,YAAA,EAAeL,CAAS,CAE7D,CAGA,IAAIM,EAA+C,KACnD,MAAMC,MAAsB,IAE5B,SAASC,GAA+C,CACtD,OAAAF,IAAgB,QAAQ,IAAI,CAC1B,QAAA,QAAA,EAAA,KAAA,IAAAX,EAAA,QAAO,YAAY,CAAA,CAAA,EACnB,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,yBAAyB,CAAA,CAAA,EAChC,QAAA,QAAA,EAAA,KAAA,IAAAA,EAAA,QAAO,8BAA8B,CAAA,CAAA,EACrC,qCAAO,6BAA6B,CAAA,CAAA,CAAA,CACrC,EAAE,KAAK,CAAC,CAACc,EAAMC,EAAQC,EAAaC,CAAU,IAC7CH,EAAK,sBAAsB,CAGzB,OAAQC,EAAO,4BAA4B,CAAE,UAAW,GAAM,EAC9D,MAAO,CAAA,EACP,OAAQ,CAACC,EAAY,QAASC,EAAW,OAAO,CAAA,CACjD,CAAA,EAEIN,CACT,CAOA,eAAsBO,EACpBf,EACyD,CACzD,MAAME,EAAYH,EAAyBC,CAAQ,EAC7CgB,EAAc,MAAMN,EAAA,EAC1B,GAAIR,EAAW,CACb,IAAIe,EAAUR,EAAgB,IAAIP,CAAS,EAC3C,GAAI,CAACe,EAAS,CACZ,MAAMZ,EAAST,EAAgB,IAAIM,CAAS,EAC5Ce,EAAUZ,EACNA,EAAA,EAAS,KAAMa,GAAYF,EAAY,aAAa,GAAGE,EAAQ,OAAO,CAAC,EACvE,QAAQ,QAAA,EACZT,EAAgB,IAAIP,EAAWe,CAAO,CACxC,CACA,MAAMA,CACR,CACA,MAAO,CAAE,YAAAD,EAAa,KAAMd,GAAa,MAAA,CAC3C"}

package/dist/lib/shiki.d.ts

@@ -0,0 +1,32 @@
+import { HighlighterCore, LanguageRegistration } from 'shiki/core';
+type LanguageLoader = () => Promise<{
+    default: LanguageRegistration[];
+}>;
+/**
+ * Resolve a requested language to a registered canonical id, or null when
+ * the language isn't in the set (callers fall back to plaintext).
+ */
+export declare function resolveCodeBlockLanguage(language: string): string | null;
+/** Canonical ids of every language the slim highlighter can load. */
+export declare function getSupportedCodeBlockLanguages(): string[];
+/**
+ * Register an additional grammar for `CodeBlock`/`MessageResponse` code
+ * highlighting, e.g.:
+ *
+ * ```ts
+ * registerCodeBlockLanguage("rust", () => import("@shikijs/langs/rust"), ["rs"]);
+ * ```
+ *
+ * The loader stays a dynamic import, so added grammars are also code-split.
+ */
+export declare function registerCodeBlockLanguage(language: string, loader: LanguageLoader, aliases?: string[]): void;
+/**
+ * Get the shared highlighter with the requested language loaded. `lang` is
+ * the id to pass to `codeToTokens` — the canonical id when supported,
+ * otherwise "text" (plaintext needs no grammar).
+ */
+export declare function getCodeBlockHighlighter(language: string): Promise<{
+    highlighter: HighlighterCore;
+    lang: string;
+}>;
+export {};

package/dist/lib/utils.d.ts

@@ -0,0 +1,2 @@
+import { ClassValue } from 'clsx';
+export declare function cn(...inputs: ClassValue[]): string;

package/dist/server/auth/JwtTokenManager.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("@tetrascience-npm/ts-connectors-sdk"),c=60,s=1e3,l=5*c*s;class i{baseUrlOverride;connectorId;orgSlug;tokenCache;tokenRefreshThresholdMs;tdpClient;constructor(e={}){this.baseUrlOverride=e.baseUrl,this.connectorId=process.env.CONNECTOR_ID,this.orgSlug=process.env.ORG_SLUG,this.tokenCache=new Map,this.tokenRefreshThresholdMs=e.tokenRefreshThresholdMs||l,this.tdpClient=null}getBaseUrl(){const e=this.baseUrlOverride||process.env.TDP_ENDPOINT;if(!e)throw new Error("TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.");return e}decodeJwtPayload(e){try{const t=e.split(".");if(t.length!==3)return console.warn("Invalid JWT token format"),null;const n=t[1].replace(/-/g,"+").replace(/_/g,"/"),o=n.padEnd(n.length+(4-n.length%4)%4,"=");return JSON.parse(Buffer.from(o,"base64").toString("utf-8"))}catch(t){return console.warn("Error decoding JWT token:",t),null}}isPayloadExpiringSoon(e){if(!e.exp)return console.warn("JWT token has no expiration claim"),!0;const t=e.exp*s,r=Date.now()+this.tokenRefreshThresholdMs;return t<=r}getValidUserJwt(e){const t=this.tokenCache.get(e);return t&&!this.isPayloadExpiringSoon(t.payload)?t.token:(t&&this.tokenCache.delete(e),null)}async getTdpClient(){if(this.tdpClient!==null)return this.tdpClient;if(!this.connectorId||!this.orgSlug)throw new Error("Missing required configuration: CONNECTOR_ID or ORG_SLUG");const e=this.getBaseUrl();try{const t=new a.TDPClient({tdpEndpoint:e,connectorId:this.connectorId,orgSlug:this.orgSlug,artifactType:"data-app"});return await t.init(),this.tdpClient=t,this.tdpClient}catch(t){throw console.error("Failed to initialize TDP client:",t),t}}async getJwtFromTokenRefInternal(e){const t=await this.getTdpClient();try{const r=await t.getValues([e]);if(r&&r.length>0&&r[0]?.jwt){const n=r[0].jwt,o=this.decodeJwtPayload(n);return o&&this.tokenCache.set(e,{token:n,payload:o}),n}console.error(`No JWT found for key '${e}' in connector store`)}catch(r){console.error("Error retrieving JWT token:",r)}return null}async getJwtFromTokenRef(e){if(!e||!this.orgSlug)return console.warn("Missing required parameters for JWT token retrieval"),null;const t=this.getValidUserJwt(e);return t||this.getJwtFromTokenRefInternal(e)}async getUserToken(e){const t=e["ts-auth-token"]||process.env.TS_AUTH_TOKEN;if(t)return t;const r=e["ts-token-ref"];if(r&&this.connectorId){const n=await this.getJwtFromTokenRef(r);if(n)return n;console.warn("Failed to resolve ts-token-ref to JWT token")}else r&&console.error("Connector ID not configured");return console.warn("No valid authentication token found"),null}async getTokenFromExpressRequest(e){return this.getUserToken(e.cookies||{})}clearCache(){this.tokenCache.clear()}}const h=new i;exports.JwtTokenManager=i;exports.jwtManager=h;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const c=require("@tetrascience-npm/ts-connectors-sdk"),l="ts-auth-token",h=60,a=1e3,d=5*h*a;class i{baseUrlOverride;connectorId;orgSlug;tokenCache;tokenRefreshThresholdMs;tdpClient;constructor(e={}){this.baseUrlOverride=e.baseUrl,this.connectorId=process.env.CONNECTOR_ID,this.orgSlug=process.env.ORG_SLUG,this.tokenCache=new Map,this.tokenRefreshThresholdMs=e.tokenRefreshThresholdMs||d,this.tdpClient=null}getBaseUrl(){const e=this.baseUrlOverride||process.env.TDP_ENDPOINT;if(!e)throw new Error("TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.");return e}decodeJwtPayload(e){try{const t=e.split(".");if(t.length!==3)return console.warn("Invalid JWT token format"),null;const n=t[1].replace(/-/g,"+").replace(/_/g,"/"),o=n.padEnd(n.length+(4-n.length%4)%4,"=");return JSON.parse(Buffer.from(o,"base64").toString("utf-8"))}catch(t){return console.warn("Error decoding JWT token:",t),null}}isPayloadExpiringSoon(e){if(!e.exp)return console.warn("JWT token has no expiration claim"),!0;const t=e.exp*a,r=Date.now()+this.tokenRefreshThresholdMs;return t<=r}getValidUserJwt(e){const t=this.tokenCache.get(e);return t&&!this.isPayloadExpiringSoon(t.payload)?t.token:(t&&this.tokenCache.delete(e),null)}async getTdpClient(){if(this.tdpClient!==null)return this.tdpClient;if(!this.connectorId||!this.orgSlug)throw new Error("Missing required configuration: CONNECTOR_ID or ORG_SLUG");const e=this.getBaseUrl();try{const t=new c.TDPClient({tdpEndpoint:e,connectorId:this.connectorId,orgSlug:this.orgSlug,artifactType:"data-app"});return await t.init(),this.tdpClient=t,this.tdpClient}catch(t){throw console.error("Failed to initialize TDP client:",t),t}}async getJwtFromTokenRefInternal(e){const t=await this.getTdpClient();try{const r=await t.getValues([e]);if(r&&r.length>0&&r[0]?.jwt){const n=r[0].jwt,o=this.decodeJwtPayload(n);return o&&this.tokenCache.set(e,{token:n,payload:o}),n}console.error(`No JWT found for key '${e}' in connector store`)}catch(r){console.error("Error retrieving JWT token:",r)}return null}async getJwtFromTokenRef(e){if(!e||!this.orgSlug)return console.warn("Missing required parameters for JWT token retrieval"),null;const t=this.getValidUserJwt(e);return t||this.getJwtFromTokenRefInternal(e)}getHeaderAuthToken(e){const t=e?.[l];return(Array.isArray(t)?t[0]:t)||null}async getUserToken(e,t){const r=this.getHeaderAuthToken(t);if(r)return r;const n=e["ts-auth-token"]||process.env.TS_AUTH_TOKEN;if(n)return n;const o=e["ts-token-ref"];if(o&&this.connectorId){const s=await this.getJwtFromTokenRef(o);if(s)return s;console.warn("Failed to resolve ts-token-ref to JWT token")}else o&&console.error("Connector ID not configured");return console.warn("No valid authentication token found"),null}async getTokenFromExpressRequest(e){return this.getUserToken(e.cookies||{},e.headers)}clearCache(){this.tokenCache.clear()}}const u=new i;exports.JwtTokenManager=i;exports.jwtManager=u;
 //# sourceMappingURL=JwtTokenManager.cjs.map

package/dist/server/auth/JwtTokenManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"JwtTokenManager.cjs","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n}\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */\n  async getUserToken(cookies: CookieDict): Promise<string | null> {\n    // Prefer ts-auth-token or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed)\n    return this.getUserToken(req.cookies || {});\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","cookies","authToken","req","jwtManager"],"mappings":"uIA6CMA,EAAqB,GAErBC,EAAgB,IAChBC,EAAqC,EAAIF,EAAqBC,EAM7D,MAAME,CAAgB,CACnB,gBACA,YACA,QACA,WACA,wBACA,UAER,YAAYC,EAAgC,GAAI,CAC9C,KAAK,gBAAkBA,EAAO,QAC9B,KAAK,YAAc,QAAQ,IAAI,aAC/B,KAAK,QAAU,QAAQ,IAAI,SAC3B,KAAK,eAAiB,IACtB,KAAK,wBAA0BA,EAAO,yBAA2BF,EACjE,KAAK,UAAY,IACnB,CAMQ,YAAqB,CAC3B,MAAMG,EAAU,KAAK,iBAAmB,QAAQ,IAAI,aACpD,GAAI,CAACA,EACH,MAAM,IAAI,MAAM,+FAA+F,EAEjH,OAAOA,CACT,CAOQ,iBAAiBC,EAAkC,CACzD,GAAI,CACF,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACnB,eAAQ,KAAK,0BAA0B,EAChC,KAIT,MAAMC,EADUD,EAAM,CAAC,EACA,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACrDE,EAAeD,EAAO,OAAOA,EAAO,QAAW,EAAKA,EAAO,OAAS,GAAM,EAAI,GAAG,EAGvF,OAAO,KAAK,MAAM,OAAO,KAAKC,EAAc,QAAQ,EAAE,SAAS,OAAO,CAAC,CACzE,OAASC,EAAO,CACd,eAAQ,KAAK,4BAA6BA,CAAK,EACxC,IACT,CACF,CAGQ,sBAAsBC,EAA8B,CAC1D,GAAI,CAACA,EAAQ,IACX,eAAQ,KAAK,mCAAmC,EACzC,GAGT,MAAMC,EAAeD,EAAQ,IAAMV,EAC7BY,EAAgB,KAAK,IAAA,EAAQ,KAAK,wBACxC,OAAOD,GAAgBC,CACzB,CAGQ,gBAAgBC,EAAiC,CACvD,MAAMC,EAAS,KAAK,WAAW,IAAID,CAAQ,EAC3C,OAAIC,GAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,EAC/CA,EAAO,OAGZA,GAGF,KAAK,WAAW,OAAOD,CAAQ,EAE1B,KACT,CAGA,MAAc,cAAmC,CAC/C,GAAI,KAAK,YAAc,KACrB,OAAO,KAAK,UAGd,GAAI,CAAC,KAAK,aAAe,CAAC,KAAK,QAC7B,MAAM,IAAI,MAAM,0DAA0D,EAI5E,MAAMT,EAAU,KAAK,WAAA,EAErB,GAAI,CACF,MAAMW,EAAS,IAAIC,YAAU,CAC3B,YAAaZ,EACb,YAAa,KAAK,YAClB,QAAS,KAAK,QACd,aAAc,UAAA,CACf,EAED,aAAMW,EAAO,KAAA,EAEb,KAAK,UAAYA,EACV,KAAK,SACd,OAASN,EAAO,CAEd,cAAQ,MAAM,mCAAoCA,CAAK,EACjDA,CACR,CACF,CAGA,MAAc,2BAA2BI,EAA0C,CAEjF,MAAMI,EAAY,MAAM,KAAK,aAAA,EAE7B,GAAI,CAGF,MAAMC,EAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC,EAEnD,GAAIK,GAAUA,EAAO,OAAS,GAAKA,EAAO,CAAC,GAAG,IAAK,CACjD,MAAMC,EAAWD,EAAO,CAAC,EAAE,IAErBR,EAAU,KAAK,iBAAiBS,CAAQ,EAC9C,OAAIT,GACF,KAAK,WAAW,IAAIG,EAAU,CAAE,MAAOM,EAAU,QAAAT,EAAS,EAErDS,CACT,CAEA,QAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB,CACvE,OAASJ,EAAO,CACd,QAAQ,MAAM,8BAA+BA,CAAK,CACpD,CAEA,OAAO,IACT,CAGA,MAAM,mBAAmBI,EAA0C,CACjE,GAAI,CAACA,GAAY,CAAC,KAAK,QACrB,eAAQ,KAAK,qDAAqD,EAC3D,KAGT,MAAMO,EAAkB,KAAK,gBAAgBP,CAAQ,EACrD,OAAIO,GAIG,KAAK,2BAA2BP,CAAQ,CACjD,CAGA,MAAM,aAAaQ,EAA6C,CAE9D,MAAMC,EAAYD,EAAQ,eAAe,GAAK,QAAQ,IAAI,cAC1D,GAAIC,EACF,OAAOA,EAIT,MAAMT,EAAWQ,EAAQ,cAAc,EACvC,GAAIR,GAAY,KAAK,YAAa,CAChC,MAAMM,EAAW,MAAM,KAAK,mBAAmBN,CAAQ,EACvD,GAAIM,EACF,OAAOA,EAET,QAAQ,KAAK,6CAA6C,CAC5D,MAAWN,GACT,QAAQ,MAAM,6BAA6B,EAG7C,eAAQ,KAAK,qCAAqC,EAC3C,IACT,CAiBA,MAAM,2BAA2BU,EAAiD,CAEhF,OAAO,KAAK,aAAaA,EAAI,SAAW,CAAA,CAAE,CAC5C,CAGA,YAAmB,CACjB,KAAK,WAAW,MAAA,CAClB,CACF,CAaO,MAAMC,EAAa,IAAItB"}
+{"version":3,"file":"JwtTokenManager.cjs","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Header dictionary type - matches Express req.headers (keys are lowercased) */\nexport interface HeaderDict {\n  [key: string]: string | string[] | undefined;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n  headers?: HeaderDict;\n}\n\n/** Request header carrying the resolved JWT injected by the data-apps proxy. */\nconst AUTH_TOKEN_HEADER = \"ts-auth-token\";\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /**\n   * Read the ts-auth-token request header, normalizing the array form that\n   * Node/Express may produce for a repeated header.\n   */\n  private getHeaderAuthToken(headers?: HeaderDict): string | null {\n    const raw = headers?.[AUTH_TOKEN_HEADER];\n    const value = Array.isArray(raw) ? raw[0] : raw;\n    return value || null;\n  }\n\n  /**\n   * Get token from a request (proxy-injected header, then cookie, then token ref).\n   *\n   * Precedence (SW-2352):\n   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps\n   *      proxy resolves the token reference server-side and injects the real JWT\n   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.\n   *      Checking the header first is also what keeps SSO users authenticated.\n   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).\n   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes\n   *      dead in prod once the proxy stops forwarding the cookie, retained for\n   *      local dev and defense in depth).\n   */\n  async getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null> {\n    // Prefer the proxy-injected ts-auth-token request header.\n    const headerAuthToken = this.getHeaderAuthToken(headers);\n    if (headerAuthToken) {\n      return headerAuthToken;\n    }\n\n    // Then ts-auth-token cookie or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref (legacy fallback).\n    // TODO(next major): drop the ts-token-ref → connector-KV resolution entirely.\n    // As of SW-2352 the data-apps proxy resolves the reference server-side and\n    // injects the JWT via the ts-auth-token header (preferred above), and no\n    // longer forwards the ts-token-ref cookie to the container — so this path is\n    // dead in production and kept only for local dev / older proxies.\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed).\n    // Headers are checked first (proxy-injected ts-auth-token) — see getUserToken.\n    return this.getUserToken(req.cookies || {}, req.headers);\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["AUTH_TOKEN_HEADER","SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","headers","raw","cookies","headerAuthToken","authToken","req","jwtManager"],"mappings":"uIAsCMA,EAAoB,gBAgBpBC,EAAqB,GAErBC,EAAgB,IAChBC,EAAqC,EAAIF,EAAqBC,EAM7D,MAAME,CAAgB,CACnB,gBACA,YACA,QACA,WACA,wBACA,UAER,YAAYC,EAAgC,GAAI,CAC9C,KAAK,gBAAkBA,EAAO,QAC9B,KAAK,YAAc,QAAQ,IAAI,aAC/B,KAAK,QAAU,QAAQ,IAAI,SAC3B,KAAK,eAAiB,IACtB,KAAK,wBAA0BA,EAAO,yBAA2BF,EACjE,KAAK,UAAY,IACnB,CAMQ,YAAqB,CAC3B,MAAMG,EAAU,KAAK,iBAAmB,QAAQ,IAAI,aACpD,GAAI,CAACA,EACH,MAAM,IAAI,MAAM,+FAA+F,EAEjH,OAAOA,CACT,CAOQ,iBAAiBC,EAAkC,CACzD,GAAI,CACF,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACnB,eAAQ,KAAK,0BAA0B,EAChC,KAIT,MAAMC,EADUD,EAAM,CAAC,EACA,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACrDE,EAAeD,EAAO,OAAOA,EAAO,QAAW,EAAKA,EAAO,OAAS,GAAM,EAAI,GAAG,EAGvF,OAAO,KAAK,MAAM,OAAO,KAAKC,EAAc,QAAQ,EAAE,SAAS,OAAO,CAAC,CACzE,OAASC,EAAO,CACd,eAAQ,KAAK,4BAA6BA,CAAK,EACxC,IACT,CACF,CAGQ,sBAAsBC,EAA8B,CAC1D,GAAI,CAACA,EAAQ,IACX,eAAQ,KAAK,mCAAmC,EACzC,GAGT,MAAMC,EAAeD,EAAQ,IAAMV,EAC7BY,EAAgB,KAAK,IAAA,EAAQ,KAAK,wBACxC,OAAOD,GAAgBC,CACzB,CAGQ,gBAAgBC,EAAiC,CACvD,MAAMC,EAAS,KAAK,WAAW,IAAID,CAAQ,EAC3C,OAAIC,GAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,EAC/CA,EAAO,OAGZA,GAGF,KAAK,WAAW,OAAOD,CAAQ,EAE1B,KACT,CAGA,MAAc,cAAmC,CAC/C,GAAI,KAAK,YAAc,KACrB,OAAO,KAAK,UAGd,GAAI,CAAC,KAAK,aAAe,CAAC,KAAK,QAC7B,MAAM,IAAI,MAAM,0DAA0D,EAI5E,MAAMT,EAAU,KAAK,WAAA,EAErB,GAAI,CACF,MAAMW,EAAS,IAAIC,YAAU,CAC3B,YAAaZ,EACb,YAAa,KAAK,YAClB,QAAS,KAAK,QACd,aAAc,UAAA,CACf,EAED,aAAMW,EAAO,KAAA,EAEb,KAAK,UAAYA,EACV,KAAK,SACd,OAASN,EAAO,CAEd,cAAQ,MAAM,mCAAoCA,CAAK,EACjDA,CACR,CACF,CAGA,MAAc,2BAA2BI,EAA0C,CAEjF,MAAMI,EAAY,MAAM,KAAK,aAAA,EAE7B,GAAI,CAGF,MAAMC,EAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC,EAEnD,GAAIK,GAAUA,EAAO,OAAS,GAAKA,EAAO,CAAC,GAAG,IAAK,CACjD,MAAMC,EAAWD,EAAO,CAAC,EAAE,IAErBR,EAAU,KAAK,iBAAiBS,CAAQ,EAC9C,OAAIT,GACF,KAAK,WAAW,IAAIG,EAAU,CAAE,MAAOM,EAAU,QAAAT,EAAS,EAErDS,CACT,CAEA,QAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB,CACvE,OAASJ,EAAO,CACd,QAAQ,MAAM,8BAA+BA,CAAK,CACpD,CAEA,OAAO,IACT,CAGA,MAAM,mBAAmBI,EAA0C,CACjE,GAAI,CAACA,GAAY,CAAC,KAAK,QACrB,eAAQ,KAAK,qDAAqD,EAC3D,KAGT,MAAMO,EAAkB,KAAK,gBAAgBP,CAAQ,EACrD,OAAIO,GAIG,KAAK,2BAA2BP,CAAQ,CACjD,CAMQ,mBAAmBQ,EAAqC,CAC9D,MAAMC,EAAMD,IAAUvB,CAAiB,EAEvC,OADc,MAAM,QAAQwB,CAAG,EAAIA,EAAI,CAAC,EAAIA,IAC5B,IAClB,CAeA,MAAM,aAAaC,EAAqBF,EAA8C,CAEpF,MAAMG,EAAkB,KAAK,mBAAmBH,CAAO,EACvD,GAAIG,EACF,OAAOA,EAIT,MAAMC,EAAYF,EAAQ,eAAe,GAAK,QAAQ,IAAI,cAC1D,GAAIE,EACF,OAAOA,EAST,MAAMZ,EAAWU,EAAQ,cAAc,EACvC,GAAIV,GAAY,KAAK,YAAa,CAChC,MAAMM,EAAW,MAAM,KAAK,mBAAmBN,CAAQ,EACvD,GAAIM,EACF,OAAOA,EAET,QAAQ,KAAK,6CAA6C,CAC5D,MAAWN,GACT,QAAQ,MAAM,6BAA6B,EAG7C,eAAQ,KAAK,qCAAqC,EAC3C,IACT,CAiBA,MAAM,2BAA2Ba,EAAiD,CAGhF,OAAO,KAAK,aAAaA,EAAI,SAAW,CAAA,EAAIA,EAAI,OAAO,CACzD,CAGA,YAAmB,CACjB,KAAK,WAAW,MAAA,CAClB,CACF,CAaO,MAAMC,EAAa,IAAIzB"}

package/dist/server/auth/JwtTokenManager.d.ts

@@ -0,0 +1,113 @@
+/**
+ * JWT Token Manager for TetraScience Data Apps
+ *
+ * Handles authentication token retrieval from Express request cookies,
+ * supporting both direct JWT tokens (ts-auth-token) and token references
+ * (ts-token-ref) that are resolved via the connector K/V store.
+ *
+ * Note: This manager does not perform cryptographic verification of JWT signatures.
+ * Signature verification is the responsibility of the consuming application or
+ * the upstream authentication layer. The JWT payload is decoded only to read
+ * expiration times for cache invalidation.
+ */
+/** Configuration options for JwtTokenManager */
+export interface JwtTokenManagerConfig {
+    baseUrl?: string;
+    tokenRefreshThresholdMs?: number;
+}
+/** Cookie dictionary type - matches Express req.cookies */
+export interface CookieDict {
+    [key: string]: string;
+}
+/** Header dictionary type - matches Express req.headers (keys are lowercased) */
+export interface HeaderDict {
+    [key: string]: string | string[] | undefined;
+}
+/** Express-like request interface (works with Express, Koa, etc.) */
+export interface ExpressRequestLike {
+    cookies?: CookieDict;
+    headers?: HeaderDict;
+}
+/**
+ * Manages JWT token retrieval from request cookies.
+ * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).
+ */
+export declare class JwtTokenManager {
+    private baseUrlOverride;
+    private connectorId;
+    private orgSlug;
+    private tokenCache;
+    private tokenRefreshThresholdMs;
+    private tdpClient;
+    constructor(config?: JwtTokenManagerConfig);
+    /**
+     * Get the base URL for TDP API calls.
+     * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).
+     */
+    private getBaseUrl;
+    /**
+     * Decode JWT payload without verifying signature.
+     * Used only for reading expiration times for cache invalidation.
+     * Signature verification is NOT performed here.
+     */
+    private decodeJwtPayload;
+    /** Check if payload is expiring within the refresh threshold */
+    private isPayloadExpiringSoon;
+    /** Get valid cached token if not expiring */
+    private getValidUserJwt;
+    /** Initialize or get TDP client */
+    private getTdpClient;
+    /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */
+    private getJwtFromTokenRefInternal;
+    /** Resolve ts-token-ref to full JWT token (with caching) */
+    getJwtFromTokenRef(tokenRef: string): Promise<string | null>;
+    /**
+     * Read the ts-auth-token request header, normalizing the array form that
+     * Node/Express may produce for a repeated header.
+     */
+    private getHeaderAuthToken;
+    /**
+     * Get token from a request (proxy-injected header, then cookie, then token ref).
+     *
+     * Precedence (SW-2352):
+     *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps
+     *      proxy resolves the token reference server-side and injects the real JWT
+     *      here; the `ts-token-ref` cookie is no longer forwarded to the container.
+     *      Checking the header first is also what keeps SSO users authenticated.
+     *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).
+     *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes
+     *      dead in prod once the proxy stops forwarding the cookie, retained for
+     *      local dev and defense in depth).
+     */
+    getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null>;
+    /**
+     * Get user token from an Express request object.
+     * This is the primary method for Express middleware integration.
+     *
+     * @example
+     * ```typescript
+     * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';
+     *
+     * app.use(async (req, res, next) => {
+     *   const token = await jwtManager.getTokenFromExpressRequest(req);
+     *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };
+     *   next();
+     * });
+     * ```
+     */
+    getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null>;
+    /** Clear the token cache */
+    clearCache(): void;
+}
+/**
+ * Global singleton instance.
+ *
+ * Note: This instance is created when the module is imported. Configuration
+ * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)
+ * is read at module load time. Ensure these environment
+ * variables are set before importing this module.
+ *
+ * If you need different configuration at runtime, create a new JwtTokenManager
+ * instance instead of using this singleton.
+ */
+export declare const jwtManager: JwtTokenManager;

package/dist/server/auth/JwtTokenManager.js

@@ -1,6 +1,6 @@
-import { TDPClient as i } from "@tetrascience-npm/ts-connectors-sdk";
-const a = 60, s = 1e3, c = 5 * a * s;
-class l {
+import { TDPClient as a } from "@tetrascience-npm/ts-connectors-sdk";
+const c = "ts-auth-token", l = 60, i = 1e3, h = 5 * l * i;
+class d {
   baseUrlOverride;
   connectorId;
   orgSlug;
@@ -8,7 +8,7 @@ class l {
   tokenRefreshThresholdMs;
   tdpClient;
   constructor(e = {}) {
-    this.baseUrlOverride = e.baseUrl, this.connectorId = process.env.CONNECTOR_ID, this.orgSlug = process.env.ORG_SLUG, this.tokenCache = /* @__PURE__ */ new Map(), this.tokenRefreshThresholdMs = e.tokenRefreshThresholdMs || c, this.tdpClient = null;
+    this.baseUrlOverride = e.baseUrl, this.connectorId = process.env.CONNECTOR_ID, this.orgSlug = process.env.ORG_SLUG, this.tokenCache = /* @__PURE__ */ new Map(), this.tokenRefreshThresholdMs = e.tokenRefreshThresholdMs || h, this.tdpClient = null;
   }
   /**
    * Get the base URL for TDP API calls.
@@ -40,7 +40,7 @@ class l {
   isPayloadExpiringSoon(e) {
     if (!e.exp)
       return console.warn("JWT token has no expiration claim"), !0;
-    const t = e.exp * s, r = Date.now() + this.tokenRefreshThresholdMs;
+    const t = e.exp * i, r = Date.now() + this.tokenRefreshThresholdMs;
     return t <= r;
   }
   /** Get valid cached token if not expiring */
@@ -56,7 +56,7 @@ class l {
       throw new Error("Missing required configuration: CONNECTOR_ID or ORG_SLUG");
     const e = this.getBaseUrl();
     try {
-      const t = new i({
+      const t = new a({
         tdpEndpoint: e,
         connectorId: this.connectorId,
         orgSlug: this.orgSlug,
@@ -89,18 +89,41 @@ class l {
     const t = this.getValidUserJwt(e);
     return t || this.getJwtFromTokenRefInternal(e);
   }
-  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */
-  async getUserToken(e) {
-    const t = e["ts-auth-token"] || process.env.TS_AUTH_TOKEN;
-    if (t)
-      return t;
-    const r = e["ts-token-ref"];
-    if (r && this.connectorId) {
-      const n = await this.getJwtFromTokenRef(r);
-      if (n)
-        return n;
+  /**
+   * Read the ts-auth-token request header, normalizing the array form that
+   * Node/Express may produce for a repeated header.
+   */
+  getHeaderAuthToken(e) {
+    const t = e?.[c];
+    return (Array.isArray(t) ? t[0] : t) || null;
+  }
+  /**
+   * Get token from a request (proxy-injected header, then cookie, then token ref).
+   *
+   * Precedence (SW-2352):
+   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps
+   *      proxy resolves the token reference server-side and injects the real JWT
+   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.
+   *      Checking the header first is also what keeps SSO users authenticated.
+   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).
+   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes
+   *      dead in prod once the proxy stops forwarding the cookie, retained for
+   *      local dev and defense in depth).
+   */
+  async getUserToken(e, t) {
+    const r = this.getHeaderAuthToken(t);
+    if (r)
+      return r;
+    const n = e["ts-auth-token"] || process.env.TS_AUTH_TOKEN;
+    if (n)
+      return n;
+    const o = e["ts-token-ref"];
+    if (o && this.connectorId) {
+      const s = await this.getJwtFromTokenRef(o);
+      if (s)
+        return s;
       console.warn("Failed to resolve ts-token-ref to JWT token");
-    } else r && console.error("Connector ID not configured");
+    } else o && console.error("Connector ID not configured");
     return console.warn("No valid authentication token found"), null;
   }
   /**
@@ -119,16 +142,16 @@ class l {
    * ```
    */
   async getTokenFromExpressRequest(e) {
-    return this.getUserToken(e.cookies || {});
+    return this.getUserToken(e.cookies || {}, e.headers);
   }
   /** Clear the token cache */
   clearCache() {
     this.tokenCache.clear();
   }
 }
-const u = new l();
+const g = new d();
 export {
-  l as JwtTokenManager,
-  u as jwtManager
+  d as JwtTokenManager,
+  g as jwtManager
 };
 //# sourceMappingURL=JwtTokenManager.js.map

package/dist/server/auth/JwtTokenManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtTokenManager.js","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n}\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */\n  async getUserToken(cookies: CookieDict): Promise<string | null> {\n    // Prefer ts-auth-token or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed)\n    return this.getUserToken(req.cookies || {});\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","cookies","authToken","req","jwtManager"],"mappings":";AA6CA,MAAMA,IAAqB,IAErBC,IAAgB,KAChBC,IAAqC,IAAIF,IAAqBC;AAM7D,MAAME,EAAgB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAYC,IAAgC,IAAI;AAC9C,SAAK,kBAAkBA,EAAO,SAC9B,KAAK,cAAc,QAAQ,IAAI,cAC/B,KAAK,UAAU,QAAQ,IAAI,UAC3B,KAAK,iCAAiB,IAAA,GACtB,KAAK,0BAA0BA,EAAO,2BAA2BF,GACjE,KAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAqB;AAC3B,UAAMG,IAAU,KAAK,mBAAmB,QAAQ,IAAI;AACpD,QAAI,CAACA;AACH,YAAM,IAAI,MAAM,+FAA+F;AAEjH,WAAOA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiBC,GAAkC;AACzD,QAAI;AACF,YAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,UAAIC,EAAM,WAAW;AACnB,uBAAQ,KAAK,0BAA0B,GAChC;AAIT,YAAMC,IADUD,EAAM,CAAC,EACA,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GACrDE,IAAeD,EAAO,OAAOA,EAAO,UAAW,IAAKA,EAAO,SAAS,KAAM,GAAI,GAAG;AAGvF,aAAO,KAAK,MAAM,OAAO,KAAKC,GAAc,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACzE,SAASC,GAAO;AACd,qBAAQ,KAAK,6BAA6BA,CAAK,GACxC;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,sBAAsBC,GAA8B;AAC1D,QAAI,CAACA,EAAQ;AACX,qBAAQ,KAAK,mCAAmC,GACzC;AAGT,UAAMC,IAAeD,EAAQ,MAAMV,GAC7BY,IAAgB,KAAK,IAAA,IAAQ,KAAK;AACxC,WAAOD,KAAgBC;AAAA,EACzB;AAAA;AAAA,EAGQ,gBAAgBC,GAAiC;AACvD,UAAMC,IAAS,KAAK,WAAW,IAAID,CAAQ;AAC3C,WAAIC,KAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,IAC/CA,EAAO,SAGZA,KAGF,KAAK,WAAW,OAAOD,CAAQ,GAE1B;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,eAAmC;AAC/C,QAAI,KAAK,cAAc;AACrB,aAAO,KAAK;AAGd,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK;AAC7B,YAAM,IAAI,MAAM,0DAA0D;AAI5E,UAAMT,IAAU,KAAK,WAAA;AAErB,QAAI;AACF,YAAMW,IAAS,IAAIC,EAAU;AAAA,QAC3B,aAAaZ;AAAA,QACb,aAAa,KAAK;AAAA,QAClB,SAAS,KAAK;AAAA,QACd,cAAc;AAAA,MAAA,CACf;AAED,mBAAMW,EAAO,KAAA,GAEb,KAAK,YAAYA,GACV,KAAK;AAAA,IACd,SAASN,GAAO;AAEd,oBAAQ,MAAM,oCAAoCA,CAAK,GACjDA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA2BI,GAA0C;AAEjF,UAAMI,IAAY,MAAM,KAAK,aAAA;AAE7B,QAAI;AAGF,YAAMC,IAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC;AAEnD,UAAIK,KAAUA,EAAO,SAAS,KAAKA,EAAO,CAAC,GAAG,KAAK;AACjD,cAAMC,IAAWD,EAAO,CAAC,EAAE,KAErBR,IAAU,KAAK,iBAAiBS,CAAQ;AAC9C,eAAIT,KACF,KAAK,WAAW,IAAIG,GAAU,EAAE,OAAOM,GAAU,SAAAT,GAAS,GAErDS;AAAA,MACT;AAEA,cAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB;AAAA,IACvE,SAASJ,GAAO;AACd,cAAQ,MAAM,+BAA+BA,CAAK;AAAA,IACpD;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmBI,GAA0C;AACjE,QAAI,CAACA,KAAY,CAAC,KAAK;AACrB,qBAAQ,KAAK,qDAAqD,GAC3D;AAGT,UAAMO,IAAkB,KAAK,gBAAgBP,CAAQ;AACrD,WAAIO,KAIG,KAAK,2BAA2BP,CAAQ;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,aAAaQ,GAA6C;AAE9D,UAAMC,IAAYD,EAAQ,eAAe,KAAK,QAAQ,IAAI;AAC1D,QAAIC;AACF,aAAOA;AAIT,UAAMT,IAAWQ,EAAQ,cAAc;AACvC,QAAIR,KAAY,KAAK,aAAa;AAChC,YAAMM,IAAW,MAAM,KAAK,mBAAmBN,CAAQ;AACvD,UAAIM;AACF,eAAOA;AAET,cAAQ,KAAK,6CAA6C;AAAA,IAC5D,OAAWN,KACT,QAAQ,MAAM,6BAA6B;AAG7C,mBAAQ,KAAK,qCAAqC,GAC3C;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,2BAA2BU,GAAiD;AAEhF,WAAO,KAAK,aAAaA,EAAI,WAAW,CAAA,CAAE;AAAA,EAC5C;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,WAAW,MAAA;AAAA,EAClB;AACF;AAaO,MAAMC,IAAa,IAAItB,EAAA;"}
+{"version":3,"file":"JwtTokenManager.js","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Header dictionary type - matches Express req.headers (keys are lowercased) */\nexport interface HeaderDict {\n  [key: string]: string | string[] | undefined;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n  headers?: HeaderDict;\n}\n\n/** Request header carrying the resolved JWT injected by the data-apps proxy. */\nconst AUTH_TOKEN_HEADER = \"ts-auth-token\";\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /**\n   * Read the ts-auth-token request header, normalizing the array form that\n   * Node/Express may produce for a repeated header.\n   */\n  private getHeaderAuthToken(headers?: HeaderDict): string | null {\n    const raw = headers?.[AUTH_TOKEN_HEADER];\n    const value = Array.isArray(raw) ? raw[0] : raw;\n    return value || null;\n  }\n\n  /**\n   * Get token from a request (proxy-injected header, then cookie, then token ref).\n   *\n   * Precedence (SW-2352):\n   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps\n   *      proxy resolves the token reference server-side and injects the real JWT\n   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.\n   *      Checking the header first is also what keeps SSO users authenticated.\n   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).\n   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes\n   *      dead in prod once the proxy stops forwarding the cookie, retained for\n   *      local dev and defense in depth).\n   */\n  async getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null> {\n    // Prefer the proxy-injected ts-auth-token request header.\n    const headerAuthToken = this.getHeaderAuthToken(headers);\n    if (headerAuthToken) {\n      return headerAuthToken;\n    }\n\n    // Then ts-auth-token cookie or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref (legacy fallback).\n    // TODO(next major): drop the ts-token-ref → connector-KV resolution entirely.\n    // As of SW-2352 the data-apps proxy resolves the reference server-side and\n    // injects the JWT via the ts-auth-token header (preferred above), and no\n    // longer forwards the ts-token-ref cookie to the container — so this path is\n    // dead in production and kept only for local dev / older proxies.\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed).\n    // Headers are checked first (proxy-injected ts-auth-token) — see getUserToken.\n    return this.getUserToken(req.cookies || {}, req.headers);\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["AUTH_TOKEN_HEADER","SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","headers","raw","cookies","headerAuthToken","authToken","req","jwtManager"],"mappings":";AAsCA,MAAMA,IAAoB,iBAgBpBC,IAAqB,IAErBC,IAAgB,KAChBC,IAAqC,IAAIF,IAAqBC;AAM7D,MAAME,EAAgB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAYC,IAAgC,IAAI;AAC9C,SAAK,kBAAkBA,EAAO,SAC9B,KAAK,cAAc,QAAQ,IAAI,cAC/B,KAAK,UAAU,QAAQ,IAAI,UAC3B,KAAK,iCAAiB,IAAA,GACtB,KAAK,0BAA0BA,EAAO,2BAA2BF,GACjE,KAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAqB;AAC3B,UAAMG,IAAU,KAAK,mBAAmB,QAAQ,IAAI;AACpD,QAAI,CAACA;AACH,YAAM,IAAI,MAAM,+FAA+F;AAEjH,WAAOA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiBC,GAAkC;AACzD,QAAI;AACF,YAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,UAAIC,EAAM,WAAW;AACnB,uBAAQ,KAAK,0BAA0B,GAChC;AAIT,YAAMC,IADUD,EAAM,CAAC,EACA,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GACrDE,IAAeD,EAAO,OAAOA,EAAO,UAAW,IAAKA,EAAO,SAAS,KAAM,GAAI,GAAG;AAGvF,aAAO,KAAK,MAAM,OAAO,KAAKC,GAAc,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACzE,SAASC,GAAO;AACd,qBAAQ,KAAK,6BAA6BA,CAAK,GACxC;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,sBAAsBC,GAA8B;AAC1D,QAAI,CAACA,EAAQ;AACX,qBAAQ,KAAK,mCAAmC,GACzC;AAGT,UAAMC,IAAeD,EAAQ,MAAMV,GAC7BY,IAAgB,KAAK,IAAA,IAAQ,KAAK;AACxC,WAAOD,KAAgBC;AAAA,EACzB;AAAA;AAAA,EAGQ,gBAAgBC,GAAiC;AACvD,UAAMC,IAAS,KAAK,WAAW,IAAID,CAAQ;AAC3C,WAAIC,KAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,IAC/CA,EAAO,SAGZA,KAGF,KAAK,WAAW,OAAOD,CAAQ,GAE1B;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,eAAmC;AAC/C,QAAI,KAAK,cAAc;AACrB,aAAO,KAAK;AAGd,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK;AAC7B,YAAM,IAAI,MAAM,0DAA0D;AAI5E,UAAMT,IAAU,KAAK,WAAA;AAErB,QAAI;AACF,YAAMW,IAAS,IAAIC,EAAU;AAAA,QAC3B,aAAaZ;AAAA,QACb,aAAa,KAAK;AAAA,QAClB,SAAS,KAAK;AAAA,QACd,cAAc;AAAA,MAAA,CACf;AAED,mBAAMW,EAAO,KAAA,GAEb,KAAK,YAAYA,GACV,KAAK;AAAA,IACd,SAASN,GAAO;AAEd,oBAAQ,MAAM,oCAAoCA,CAAK,GACjDA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA2BI,GAA0C;AAEjF,UAAMI,IAAY,MAAM,KAAK,aAAA;AAE7B,QAAI;AAGF,YAAMC,IAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC;AAEnD,UAAIK,KAAUA,EAAO,SAAS,KAAKA,EAAO,CAAC,GAAG,KAAK;AACjD,cAAMC,IAAWD,EAAO,CAAC,EAAE,KAErBR,IAAU,KAAK,iBAAiBS,CAAQ;AAC9C,eAAIT,KACF,KAAK,WAAW,IAAIG,GAAU,EAAE,OAAOM,GAAU,SAAAT,GAAS,GAErDS;AAAA,MACT;AAEA,cAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB;AAAA,IACvE,SAASJ,GAAO;AACd,cAAQ,MAAM,+BAA+BA,CAAK;AAAA,IACpD;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmBI,GAA0C;AACjE,QAAI,CAACA,KAAY,CAAC,KAAK;AACrB,qBAAQ,KAAK,qDAAqD,GAC3D;AAGT,UAAMO,IAAkB,KAAK,gBAAgBP,CAAQ;AACrD,WAAIO,KAIG,KAAK,2BAA2BP,CAAQ;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmBQ,GAAqC;AAC9D,UAAMC,IAAMD,IAAUvB,CAAiB;AAEvC,YADc,MAAM,QAAQwB,CAAG,IAAIA,EAAI,CAAC,IAAIA,MAC5B;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aAAaC,GAAqBF,GAA8C;AAEpF,UAAMG,IAAkB,KAAK,mBAAmBH,CAAO;AACvD,QAAIG;AACF,aAAOA;AAIT,UAAMC,IAAYF,EAAQ,eAAe,KAAK,QAAQ,IAAI;AAC1D,QAAIE;AACF,aAAOA;AAST,UAAMZ,IAAWU,EAAQ,cAAc;AACvC,QAAIV,KAAY,KAAK,aAAa;AAChC,YAAMM,IAAW,MAAM,KAAK,mBAAmBN,CAAQ;AACvD,UAAIM;AACF,eAAOA;AAET,cAAQ,KAAK,6CAA6C;AAAA,IAC5D,OAAWN,KACT,QAAQ,MAAM,6BAA6B;AAG7C,mBAAQ,KAAK,qCAAqC,GAC3C;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,2BAA2Ba,GAAiD;AAGhF,WAAO,KAAK,aAAaA,EAAI,WAAW,CAAA,GAAIA,EAAI,OAAO;AAAA,EACzD;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,WAAW,MAAA;AAAA,EAClB;AACF;AAaO,MAAMC,IAAa,IAAIzB,EAAA;"}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Authentication utilities for TetraScience data apps
+ */
+export { JwtTokenManager, jwtManager } from './JwtTokenManager';
+export type { JwtTokenManagerConfig, CookieDict, HeaderDict, ExpressRequestLike, } from './JwtTokenManager';

package/dist/server/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * TetraScience Server Utilities
+ *
+ * Backend utilities and helper functions for TetraScience applications.
+ * This module contains server-side code that does not depend on React or browser APIs.
+ */
+export * from './auth';
+export * from './providers';

package/dist/server/providers/AthenaProvider.cjs

@@ -1,2 +1,2 @@
-"use strict";var f=Object.create;var y=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var x=(e,t,o,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of S(t))!T.call(e,r)&&r!==o&&y(e,r,{get:()=>t[r],enumerable:!(n=g(t,r))||n.enumerable});return e};var C=(e,t,o)=>(o=e!=null?f(k(e)):{},x(t||!e||!e.__esModule?y(o,"default",{value:e,enumerable:!0}):o,e));Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const d=require("./exceptions.cjs"),_=1e3;async function A(){try{return await import("@aws-sdk/client-athena")}catch{throw new d.InvalidProviderConfigurationError("The '@aws-sdk/client-athena' package is required to use the Athena provider. Please install it: npm install @aws-sdk/client-athena")}}const Q=262144;class m{client;sdk;workgroup;database;outputLocation;constructor(t,o,n,r,a){this.client=t,this.sdk=o,this.workgroup=n,this.database=r,this.outputLocation=a}async query(t,o={}){if(t.length>Q)throw new Error("Query length exceeds the maximum allowed limit.");const n=new this.sdk.StartQueryExecutionCommand({QueryString:t,WorkGroup:this.workgroup,QueryExecutionContext:{Database:this.database},ResultConfiguration:this.outputLocation?{OutputLocation:this.outputLocation}:void 0}),a=(await this.client.send(n)).QueryExecutionId;if(!a)throw new d.QueryError("Failed to start query execution");return await this.waitForQueryCompletion(a,t),this.fetchAllResults(a)}async waitForQueryCompletion(t,o){const a=Date.now();for(;Date.now()-a<3e5;){const c=new this.sdk.GetQueryExecutionCommand({QueryExecutionId:t}),s=await this.client.send(c),i=s.QueryExecution?.Status?.State;if(i===this.sdk.QueryExecutionState.SUCCEEDED)return;if(i===this.sdk.QueryExecutionState.FAILED||i===this.sdk.QueryExecutionState.CANCELLED){const u=s.QueryExecution?.Status?.StateChangeReason??"Unknown error";if(u.includes("TABLE_NOT_FOUND")){const l=u.split(":").pop()?.trim()??"";throw new d.MissingTableError("Athena is unable to find the table. If the table is created by a tetraflow, make sure that the tetraflow has run successfully. "+l+".")}throw new d.QueryError(`Query failed: ${o}. Reason: ${u}`)}await new Promise(u=>setTimeout(u,1e3))}throw new d.QueryError(`Query timed out after ${3e5/_} seconds`)}async fetchAllResults(t){const o=[];let n,r=[],a=!0;do{const c=new this.sdk.GetQueryResultsCommand({QueryExecutionId:t,NextToken:n}),s=await this.client.send(c);a&&s.ResultSet?.ResultSetMetadata?.ColumnInfo&&(r=s.ResultSet.ResultSetMetadata.ColumnInfo.map((l,w)=>{const h=l.Name;return h&&h.trim()!==""?h:`column_${w}`}));const i=s.ResultSet?.Rows??[],u=a?i.slice(1):i;for(const l of u){const w={};l.Data?.forEach((h,p)=>{const E=r[p]??`column_${p}`;w[E]=h.VarCharValue??null}),o.push(w)}n=s.NextToken,a=!1}while(n);return o}async close(){this.client.destroy()}}async function R(){const e=await A(),t=process.env.ORG_SLUG??"",o=t.replace(/-/g,"_"),n=process.env.ATHENA_S3_OUTPUT_LOCATION,r=process.env.AWS_REGION,a=`${o}__tss__default`,c=t,s=new e.AthenaClient({region:r});try{return await s.send(new e.GetWorkGroupCommand({WorkGroup:c})),new m(s,e,c,a)}catch{if(!n)throw new Error("ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. Either set this variable or ensure the org-specific workgroup exists.");const i=`s3://${n}/${o}/`;return new m(s,e,"primary",a,i)}}exports.AthenaProvider=m;exports.getTdpAthenaProvider=R;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const d=require("./exceptions.cjs");function f(r){const t=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(r){for(const e in r)if(e!=="default"){const n=Object.getOwnPropertyDescriptor(r,e);Object.defineProperty(t,e,n.get?n:{enumerable:!0,get:()=>r[e]})}}return t.default=r,Object.freeze(t)}const E=1e3;async function g(){try{return await Promise.resolve().then(()=>f(require("@aws-sdk/client-athena")))}catch{throw new d.InvalidProviderConfigurationError("The '@aws-sdk/client-athena' package is required to use the Athena provider. Please install it: npm install @aws-sdk/client-athena")}}const S=262144;class w{client;sdk;workgroup;database;outputLocation;constructor(t,e,n,s,o){this.client=t,this.sdk=e,this.workgroup=n,this.database=s,this.outputLocation=o}async query(t,e={}){if(t.length>S)throw new Error("Query length exceeds the maximum allowed limit.");const n=new this.sdk.StartQueryExecutionCommand({QueryString:t,WorkGroup:this.workgroup,QueryExecutionContext:{Database:this.database},ResultConfiguration:this.outputLocation?{OutputLocation:this.outputLocation}:void 0}),o=(await this.client.send(n)).QueryExecutionId;if(!o)throw new d.QueryError("Failed to start query execution");return await this.waitForQueryCompletion(o,t),this.fetchAllResults(o)}async waitForQueryCompletion(t,e){const o=Date.now();for(;Date.now()-o<3e5;){const c=new this.sdk.GetQueryExecutionCommand({QueryExecutionId:t}),a=await this.client.send(c),i=a.QueryExecution?.Status?.State;if(i===this.sdk.QueryExecutionState.SUCCEEDED)return;if(i===this.sdk.QueryExecutionState.FAILED||i===this.sdk.QueryExecutionState.CANCELLED){const u=a.QueryExecution?.Status?.StateChangeReason??"Unknown error";if(u.includes("TABLE_NOT_FOUND")){const l=u.split(":").pop()?.trim()??"";throw new d.MissingTableError("Athena is unable to find the table. If the table is created by a tetraflow, make sure that the tetraflow has run successfully. "+l+".")}throw new d.QueryError(`Query failed: ${e}. Reason: ${u}`)}await new Promise(u=>setTimeout(u,1e3))}throw new d.QueryError(`Query timed out after ${3e5/E} seconds`)}async fetchAllResults(t){const e=[];let n,s=[],o=!0;do{const c=new this.sdk.GetQueryResultsCommand({QueryExecutionId:t,NextToken:n}),a=await this.client.send(c);o&&a.ResultSet?.ResultSetMetadata?.ColumnInfo&&(s=a.ResultSet.ResultSetMetadata.ColumnInfo.map((l,m)=>{const h=l.Name;return h&&h.trim()!==""?h:`column_${m}`}));const i=a.ResultSet?.Rows??[],u=o?i.slice(1):i;for(const l of u){const m={};l.Data?.forEach((h,p)=>{const y=s[p]??`column_${p}`;m[y]=h.VarCharValue??null}),e.push(m)}n=a.NextToken,o=!1}while(n);return e}async close(){this.client.destroy()}}async function k(){const r=await g(),t=process.env.ORG_SLUG??"",e=t.replace(/-/g,"_"),n=process.env.ATHENA_S3_OUTPUT_LOCATION,s=process.env.AWS_REGION,o=`${e}__tss__default`,c=t,a=new r.AthenaClient({region:s});try{return await a.send(new r.GetWorkGroupCommand({WorkGroup:c})),new w(a,r,c,o)}catch{if(!n)throw new Error("ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. Either set this variable or ensure the org-specific workgroup exists.");const i=`s3://${n}/${e}/`;return new w(a,r,"primary",o,i)}}exports.AthenaProvider=w;exports.getTdpAthenaProvider=k;
 //# sourceMappingURL=AthenaProvider.cjs.map