busa-sdk 0.14.1 → 0.16.0

package/dist/chunk-C23JVY2Y.js

@@ -0,0 +1,211 @@
+import { BusabaseOAuthError, BUSABASE_AIRAPP_CLIENT_ID, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken } from './chunk-WSHJMHUS.js';
+import { normalizeBaseUrl } from './chunk-5NYQX65A.js';
+import { randomUUID } from 'crypto';
+import { readFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, renameSync } from 'fs';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+
+var STORE_VERSION = 1;
+var APP_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var REFRESH_WINDOW_MS = 6e4;
+var refreshesByCredentialPath = /* @__PURE__ */ new Map();
+var assertAppId = (appId) => {
+  if (!APP_ID_RE.test(appId)) {
+    throw new BusabaseOAuthError(
+      "invalid_airapp_id",
+      "AirApp id must use letters, digits, dot, dash, or underscore"
+    );
+  }
+  return appId;
+};
+var storeRoot = (options = {}) => options.rootDir ?? join(homedir(), ".busabase");
+var busabaseAirAppCredentialsDir = (options = {}) => join(storeRoot(options), "airapps");
+var busabaseAirAppCredentialPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.json`);
+var busabaseAirAppDynamicClientsPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.clients.json`);
+var normalizeOrigin = (raw) => {
+  const url = new URL(normalizeBaseUrl(raw));
+  if (url.username || url.password || url.search || url.hash) {
+    throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL must be an origin");
+  }
+  return url.origin;
+};
+var writeOwnerOnlyJson = (path, value) => {
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  try {
+    chmodSync(directory, 448);
+  } catch {
+  }
+  const temporaryPath = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(temporaryPath, 384);
+  } catch {
+  }
+  renameSync(temporaryPath, path);
+};
+var parseCredential = (raw, expectedAppId) => {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  const item = value;
+  if (item.version !== STORE_VERSION || item.appId !== expectedAppId || typeof item.baseUrl !== "string" || typeof item.clientId !== "string" || typeof item.accessToken !== "string" || typeof item.refreshToken !== "string" || typeof item.expiresAt !== "string" || !Array.isArray(item.scope) || item.scope.some((scope) => typeof scope !== "string") || typeof item.tokenType !== "string") {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  if (item.selectedSpace !== void 0 && (typeof item.selectedSpace !== "object" || item.selectedSpace === null || typeof item.selectedSpace.id !== "string" || typeof item.selectedSpace.name !== "string")) {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  return item;
+};
+function loadBusabaseAirAppOAuthCredential(appId, options = {}) {
+  const path = busabaseAirAppCredentialPath(appId, options);
+  try {
+    return parseCredential(readFileSync(path, "utf8"), appId);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function storeBusabaseAirAppOAuthCredential(input, options = {}) {
+  if (!input.tokenSet.refreshToken) {
+    throw new BusabaseOAuthError(
+      "missing_refresh_token",
+      "A refresh token is required for a persistent local AirApp login"
+    );
+  }
+  const credential = {
+    version: STORE_VERSION,
+    appId: assertAppId(input.appId),
+    baseUrl: normalizeOrigin(input.baseUrl),
+    clientId: input.clientId ?? BUSABASE_AIRAPP_CLIENT_ID,
+    accessToken: input.tokenSet.accessToken,
+    refreshToken: input.tokenSet.refreshToken,
+    expiresAt: input.tokenSet.expiresAt,
+    scope: input.tokenSet.scope,
+    tokenType: input.tokenSet.tokenType,
+    ...input.selectedSpace ? { selectedSpace: input.selectedSpace } : {}
+  };
+  writeOwnerOnlyJson(busabaseAirAppCredentialPath(input.appId, options), credential);
+  return credential;
+}
+var dynamicClientKey = (baseUrl, redirectUri) => `${normalizeOrigin(baseUrl)}|${new URL(redirectUri).toString()}`;
+var loadDynamicClientRegistry = (appId, options) => {
+  const empty = {
+    version: STORE_VERSION,
+    appId: assertAppId(appId),
+    clients: {}
+  };
+  let raw;
+  try {
+    raw = readFileSync(busabaseAirAppDynamicClientsPath(appId, options), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return empty;
+    throw error;
+  }
+  try {
+    const value = JSON.parse(raw);
+    if (value.version !== STORE_VERSION || value.appId !== appId || typeof value.clients !== "object" || value.clients === null) {
+      return empty;
+    }
+    const clients = Object.fromEntries(
+      Object.entries(value.clients).filter(([, clientId]) => typeof clientId === "string")
+    );
+    return { ...empty, clients };
+  } catch {
+    return empty;
+  }
+};
+function loadBusabaseAirAppDynamicClientId(input, options = {}) {
+  const registry = loadDynamicClientRegistry(input.appId, options);
+  return registry.clients[dynamicClientKey(input.baseUrl, input.redirectUri)] ?? null;
+}
+function storeBusabaseAirAppDynamicClientId(input, options = {}) {
+  const registry = loadDynamicClientRegistry(input.appId, options);
+  const key = dynamicClientKey(input.baseUrl, input.redirectUri);
+  delete registry.clients[key];
+  const entries = [...Object.entries(registry.clients), [key, input.clientId]];
+  writeOwnerOnlyJson(busabaseAirAppDynamicClientsPath(input.appId, options), {
+    ...registry,
+    clients: Object.fromEntries(entries.slice(-32))
+  });
+}
+async function getBusabaseAirAppAccessToken(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return null;
+  const expiresAt = Date.parse(credential.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt > Date.now() + REFRESH_WINDOW_MS) return credential;
+  const credentialPath = busabaseAirAppCredentialPath(appId, options);
+  const activeRefresh = refreshesByCredentialPath.get(credentialPath);
+  if (activeRefresh) return activeRefresh;
+  const refresh = (async () => {
+    const tokenSet = await refreshBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        refreshToken: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+    return storeBusabaseAirAppOAuthCredential(
+      {
+        appId,
+        baseUrl: credential.baseUrl,
+        clientId: credential.clientId,
+        tokenSet: {
+          ...tokenSet,
+          refreshToken: tokenSet.refreshToken ?? credential.refreshToken
+        },
+        selectedSpace: credential.selectedSpace
+      },
+      options
+    );
+  })();
+  refreshesByCredentialPath.set(credentialPath, refresh);
+  try {
+    return await refresh;
+  } finally {
+    if (refreshesByCredentialPath.get(credentialPath) === refresh) {
+      refreshesByCredentialPath.delete(credentialPath);
+    }
+  }
+}
+function storeBusabaseAirAppSelectedSpace(appId, selectedSpace, options = {}) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) {
+    throw new BusabaseOAuthError(
+      "missing_local_credential",
+      "Connect this local AirApp before selecting a Space"
+    );
+  }
+  const next = {
+    ...credential,
+    ...selectedSpace ? { selectedSpace } : { selectedSpace: void 0 }
+  };
+  writeOwnerOnlyJson(busabaseAirAppCredentialPath(appId, options), next);
+  return next;
+}
+function clearBusabaseAirAppOAuthCredential(appId, options = {}) {
+  rmSync(busabaseAirAppCredentialPath(appId, options), { force: true });
+}
+async function revokeBusabaseAirAppOAuthCredential(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return;
+  try {
+    await revokeBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        token: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+  } finally {
+    clearBusabaseAirAppOAuthCredential(appId, options);
+  }
+}
+
+export { busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace };

package/dist/{chunk-J2DZKX7A.js → chunk-WSHJMHUS.js}

@@ -4,6 +4,7 @@ import { normalizeBaseUrl } from './chunk-5NYQX65A.js';
 var BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
 
 // src/oauth.ts
+var AIRAPP_OAUTH_SCOPE = "api";
 var BusabaseOAuthError = class extends Error {
   code;
   status;
@@ -46,6 +47,45 @@ var digestBase64Url = async (value) => {
   for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
+async function registerBusabaseAirAppOAuthClient(input, fetchImpl = fetch) {
+  const baseUrl = oauthBaseUrl(input.baseUrl);
+  const redirectUri = new URL(input.redirectUri).toString();
+  const response = await fetchImpl(new URL("/api/oauth/register", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: input.appId,
+      client_kind: "airapp",
+      scope: AIRAPP_OAUTH_SCOPE,
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    throw new BusabaseOAuthError(
+      typeof body?.error === "string" ? body.error : "client_registration_failed",
+      typeof body?.error_description === "string" ? body.error_description : `Busabase OAuth client registration failed (${response.status})`,
+      response.status
+    );
+  }
+  if (typeof body?.client_id !== "string" || !Array.isArray(body.redirect_uris) || body.redirect_uris.length !== 1 || body.redirect_uris[0] !== redirectUri) {
+    throw new BusabaseOAuthError(
+      "invalid_client_registration",
+      "Busabase returned an invalid OAuth client registration"
+    );
+  }
+  const grantedScopes = typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : null;
+  if (!grantedScopes?.includes(AIRAPP_OAUTH_SCOPE)) {
+    throw new BusabaseOAuthError(
+      "unsupported_airapp_registration",
+      `This Busabase server did not grant the "${AIRAPP_OAUTH_SCOPE}" scope to a dynamically registered AirApp. Upgrade Busabase, or run the AirApp on a loopback address to use the shared AirApp client.`
+    );
+  }
+  return { clientId: body.client_id, redirectUri };
+}
 async function createBusabaseOAuthRequest(input) {
   const baseUrl = oauthBaseUrl(input.baseUrl);
   const redirectUri = new URL(input.redirectUri).toString();
@@ -58,7 +98,7 @@ async function createBusabaseOAuthRequest(input) {
     response_type: "code",
     client_id: clientId,
     resource,
-    scope: "api",
+    scope: AIRAPP_OAUTH_SCOPE,
     code_challenge: await digestBase64Url(codeVerifier),
     code_challenge_method: "S256",
     redirect_uri: redirectUri,
@@ -172,4 +212,4 @@ async function revokeBusabaseOAuthToken(input, fetchImpl = fetch) {
   }
 }
 
-export { BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken };
+export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken };