@trylight/app 0.3.7 → 0.3.8

package/dist/invoke/server.d.ts

@@ -20,7 +20,7 @@ export type MiiInvoke<C extends Contracts> = {
     readonly handler: (request: Request) => Promise<Response>;
     /**
      * Start a contract from a POST server function, as the person whose request
-     * it is answering, and return the run's id without waiting for it: for work
+     * it is answering (on a public app, a visitor with no session), and return the run's id without waiting for it: for work
      * that must be recorded with its run (a job row that names it). A page
      * follows it with `resume(id)`. Refusals reject with InvocationError, with
      * the codes a button's press gets.

package/dist/invoke/server.js

@@ -6,7 +6,8 @@ import { isSameOrigin, readCookie } from "../chat/server.js";
 import { errorBody } from "../request-error.js";
 import { isUuid } from "../uuid.js";
 import { failedRun, InvocationError } from "./error.js";
-import { INVOKE_BASE_PATH } from "../platform/contract.js";
+import { APP_CALLER_HEADERS, INVOKE_BASE_PATH } from "../platform/contract.js";
+import { env } from "../server/env.js";
 export { InvocationError };
 function routeOf(request) {
     const { pathname } = new URL(request.url);
@@ -21,6 +22,14 @@ function routeOf(request) {
     const [, id = ""] = read;
     return { kind: "read", id };
 }
+function platformPath(route) {
+    switch (route.kind) {
+        case "start":
+            return "/invocations";
+        case "read":
+            return `/invocations/${route.id}`;
+    }
+}
 const invokeBody = z.object({ key: z.string(), input: z.unknown() });
 const plazaInvocation = z.object({
     id: z.string(),
@@ -67,28 +76,40 @@ function startBody(contract, key, rawInput) {
     return JSON.stringify({ contractId: contract.id, input: input.data, outputSchema: contract.outputSchema });
 }
 /**
- * The person behind a request to this app: the session cookie, from one of
+ * The caller behind a request to this app: the session cookie, from one of
  * this app's own pages. Every org app shares one site with every other
  * (*.<domain>), so a page on another org's app can send this app's cookie along.
  */
-async function signedIn(auth, request) {
+async function callerOf(auth, request) {
     if (!isSameOrigin(request, new URL(request.url))) {
         throw new InvocationError(403, "cross_site", "Contracts can only be invoked from this app's own pages.");
     }
     const token = readCookie(request.headers.get("cookie"), auth.SESSION_COOKIE);
-    if (token === null)
-        throw new InvocationError(401, "not_signed_in", "Sign in to use this.");
+    if (token === null) {
+        const { appSecret } = env();
+        if (appSecret === null)
+            throw new InvocationError(401, "not_signed_in", "Sign in to use this.");
+        return { kind: "visitor", appId: miiAuthConfig().appId, secret: appSecret };
+    }
     const session = await auth.resolveSessionWithPlaza(token);
     if (session === null)
         throw new InvocationError(401, "sign_in_again", "Sign out and back in to use it here.");
-    return { token, plazaToken: session.plazaToken };
+    return { kind: "person", token, plazaToken: session.plazaToken };
+}
+function callerHeaders(caller) {
+    switch (caller.kind) {
+        case "person":
+            return { Authorization: `Bearer ${caller.plazaToken}` };
+        case "visitor":
+            return { [APP_CALLER_HEADERS.appId]: caller.appId, [APP_CALLER_HEADERS.secret]: caller.secret };
+    }
 }
-/** One call to the platform's contract API as the person; a refused token ends their session. Rejects only when the platform can't be reached. */
-async function callPlaza(auth, person, call) {
+/** One call to the platform's contract API as the caller; a refused token ends a person's session. Rejects only when the platform can't be reached. */
+async function callPlaza(auth, caller, call) {
     const answer = await fetch(call.target, {
         method: call.method,
         headers: {
-            Authorization: `Bearer ${person.plazaToken}`,
+            ...callerHeaders(caller),
             ...(call.body === null ? {} : { "Content-Type": "application/json" })
         },
         body: call.body,
@@ -96,17 +117,17 @@ async function callPlaza(auth, person, call) {
         redirect: "manual",
         signal: call.signal
     });
-    if (answer.status === 401 || answer.status === 403) {
-        await auth.revokeSession(person.token, answer.status === 403 ? "not_a_member" : "token_rejected");
+    if (caller.kind === "person" && (answer.status === 401 || answer.status === 403)) {
+        await auth.revokeSession(caller.token, answer.status === 403 ? "not_a_member" : "token_rejected");
     }
     return answer;
 }
 const plazaTarget = (path) => new URL(`${miiAuthConfig().plazaUrl}/api/app-contracts/v1${path}`);
-/** One call to the platform as the person, read as JSON. A refusal, or no answer, rejects with InvocationError. */
-async function askPlaza(auth, person, call) {
+/** One call to the platform as the caller, read as JSON. A refusal, or no answer, rejects with InvocationError. */
+async function askPlaza(auth, caller, call) {
     let answer;
     try {
-        answer = await callPlaza(auth, person, call);
+        answer = await callPlaza(auth, caller, call);
     }
     catch (error) {
         if (call.signal !== null && call.signal.aborted)
@@ -143,10 +164,10 @@ export function createMiiInvoke(auth, contracts, { reportError = (error, context
         if (route.kind === "read" && !isUuid(route.id)) {
             return refuse(404, "not_found", "Invocation not found.");
         }
-        let person;
+        let caller;
         let body = null;
         try {
-            person = await signedIn(auth, request);
+            caller = await callerOf(auth, request);
             if (route.kind === "start")
                 body = await readInvoke(request, declared);
         }
@@ -155,7 +176,7 @@ export function createMiiInvoke(auth, contracts, { reportError = (error, context
                 throw error;
             return refuse(error.status, error.code, error.message);
         }
-        const target = plazaTarget(route.kind === "start" ? "/invocations" : `/invocations/${route.id}`);
+        const target = plazaTarget(platformPath(route));
         // How long the platform may hold a read of a pending invocation. This app's own
         // function limit has to outlast it (see the README).
         const wait = new URL(request.url).searchParams.get("wait");
@@ -164,7 +185,7 @@ export function createMiiInvoke(auth, contracts, { reportError = (error, context
         let answer;
         try {
             // The browser giving up ends the platform's hold too.
-            answer = await callPlaza(auth, person, { method: request.method, target, body, signal: request.signal });
+            answer = await callPlaza(auth, caller, { method: request.method, target, body, signal: request.signal });
         }
         catch (error) {
             if (!request.signal.aborted)
@@ -190,17 +211,17 @@ export function createMiiInvoke(auth, contracts, { reportError = (error, context
         return respond(answer.status, plazaInvocation.parse(await answer.json()), declared, reportError);
     };
     const start = async ({ request, key, input, signal = null }) => {
-        const person = await signedIn(auth, request);
+        const caller = await callerOf(auth, request);
         const body = startBody(declared.get(key), key, input);
-        const answer = await askPlaza(auth, person, { method: "POST", target: plazaTarget("/invocations"), body, signal });
+        const answer = await askPlaza(auth, caller, { method: "POST", target: plazaTarget("/invocations"), body, signal });
         return { id: plazaInvocation.parse(answer).id };
     };
     const result = async (key, id, request) => {
-        const person = await signedIn(auth, request);
+        const caller = await callerOf(auth, request);
         const contract = contracts[key];
         if (!isUuid(id))
             throw new InvocationError(404, "not_found", "Invocation not found.");
-        const invocation = plazaInvocation.parse(await askPlaza(auth, person, { method: "GET", target: plazaTarget(`/invocations/${id}`), body: null, signal: null }));
+        const invocation = plazaInvocation.parse(await askPlaza(auth, caller, { method: "GET", target: plazaTarget(`/invocations/${id}`), body: null, signal: null }));
         if (invocation.contractId !== contract.id) {
             throw new InvocationError(404, "not_found", `Invocation ${id} is not a run of "${key}".`);
         }

package/dist/platform/contract.d.ts

@@ -16,6 +16,13 @@ export declare const PLATFORM_AUTH_PATHS: {
     /** "Continue with Google / Microsoft": the platform signs the person in and returns with a one-time code. */
     socialSignIn: string;
 };
+/** An app's server calling the platform as the app, for a visitor with no session: which app, and its secret. */
+export declare const APP_CALLER_HEADERS: {
+    appId: string;
+    secret: string;
+};
+/** The server env that secret is provisioned in. */
+export declare const APP_SECRET_ENV = "PLATFORM_APP_SECRET";
 /** The platform's chat API: an app's chat route forwards any path beneath it, so a new widget route needs no SDK release. */
 export declare const PLATFORM_CHAT_PATH = "/api/app-chat/v1/chat";
 /** What this app's chat server forwards beyond the first contract: the widget, served to every app version, offers only these. */

package/dist/platform/contract.js

@@ -22,6 +22,10 @@ export const PLATFORM_AUTH_PATHS = {
     /** "Continue with Google / Microsoft": the platform signs the person in and returns with a one-time code. */
     socialSignIn: "/api/app-auth/social"
 };
+/** An app's server calling the platform as the app, for a visitor with no session: which app, and its secret. */
+export const APP_CALLER_HEADERS = { appId: "x-app-id", secret: "x-app-secret" };
+/** The server env that secret is provisioned in. */
+export const APP_SECRET_ENV = "PLATFORM_APP_SECRET";
 /** The platform's chat API: an app's chat route forwards any path beneath it, so a new widget route needs no SDK release. */
 export const PLATFORM_CHAT_PATH = "/api/app-chat/v1/chat";
 /** What this app's chat server forwards beyond the first contract: the widget, served to every app version, offers only these. */

package/dist/server/env.d.ts

@@ -2,6 +2,7 @@
 export declare function env(): {
     databaseUrl: string | undefined;
     unpooledDatabaseUrl: string | undefined;
+    appSecret: string | null;
     /** Sign-in needs the platform, this app's id in it, and a database for sessions. */
     configured: boolean;
     /**

package/dist/server/env.js

@@ -1,6 +1,7 @@
 // The server env the SDK reads, in one schema: what the platform injects
 // (Vercel env, the sandbox's .env.local).
 import { z } from "zod/v4";
+import { APP_SECRET_ENV } from "../platform/contract.js";
 const serverEnv = z
     .object({
     DATABASE_URL: z.string().min(1).optional(),
@@ -8,11 +9,14 @@ const serverEnv = z
     DATABASE_URL_UNPOOLED: z.string().min(1).optional(),
     MII_PLAZA_URL: z.url().optional(),
     MII_APP_ID: z.string().min(1).optional(),
+    /** What this app's server presents to call the platform as the app, for a visitor with no session. */
+    [APP_SECRET_ENV]: z.string().min(1).nullable().default(null),
     NODE_ENV: z.string().optional()
 })
     .transform((env) => ({
     databaseUrl: env.DATABASE_URL,
     unpooledDatabaseUrl: env.DATABASE_URL_UNPOOLED,
+    appSecret: env[APP_SECRET_ENV],
     /** Sign-in needs the platform, this app's id in it, and a database for sessions. */
     configured: Boolean(env.MII_PLAZA_URL && env.MII_APP_ID && env.DATABASE_URL),
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",
@@ -12,7 +12,6 @@
     "url": "https://github.com/shubh9/mii.git",
     "directory": "packages/app-sdk"
   },
-  "packageManager": "pnpm@11.0.9",
   "files": [
     "dist",
     "bin"
@@ -42,15 +41,6 @@
       "default": "./dist/vite.js"
     }
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src test --max-warnings 0",
-    "test": "node --test --import tsx \"test/**/*.test.ts\"",
-    "check": "tsx scripts/write-brand.ts --check && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build",
-    "prepack": "pnpm run build",
-    "brand": "tsx scripts/write-brand.ts"
-  },
   "peerDependencies": {
     "@tanstack/react-query": ">=5.69",
     "@tanstack/react-router": ">=1.170",
@@ -84,5 +74,13 @@
     "typescript-eslint": "^8.70.1",
     "vite": "^8.2.0",
     "zod": "^4.6.5"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src test --max-warnings 0",
+    "test": "node --test --import tsx \"test/**/*.test.ts\"",
+    "check": "tsx scripts/write-brand.ts --check && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build",
+    "brand": "tsx scripts/write-brand.ts"
   }
-}
+}