busabase-sdk 0.10.2 → 0.11.0

package/dist/oauth-node.d.ts

@@ -0,0 +1,33 @@
+import { BusabaseOAuthTokenSet } from './oauth.js';
+
+interface BusabaseAirAppOAuthCredential {
+    version: 1;
+    appId: string;
+    baseUrl: string;
+    clientId: string;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: string;
+    scope: string[];
+    tokenType: string;
+}
+interface BusabaseAirAppCredentialStoreOptions {
+    /** Override only for tests or an explicitly isolated installation. */
+    rootDir?: string;
+}
+/** Directory containing one owner-only OAuth registration per local AirApp. */
+declare const busabaseAirAppCredentialsDir: (options?: BusabaseAirAppCredentialStoreOptions) => string;
+declare const busabaseAirAppCredentialPath: (appId: string, options?: BusabaseAirAppCredentialStoreOptions) => string;
+declare function loadBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential | null;
+declare function storeBusabaseAirAppOAuthCredential(input: {
+    appId: string;
+    baseUrl: string;
+    tokenSet: BusabaseOAuthTokenSet;
+    clientId?: string;
+}, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential;
+/** Load a valid access token, rotating and persisting the token set when needed. */
+declare function getBusabaseAirAppAccessToken(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<BusabaseAirAppOAuthCredential | null>;
+declare function clearBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): void;
+declare function revokeBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<void>;
+
+export { type BusabaseAirAppCredentialStoreOptions, type BusabaseAirAppOAuthCredential, busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppOAuthCredential };

package/dist/oauth-node.js

@@ -0,0 +1,147 @@
+import { BusabaseOAuthError, BUSABASE_AIRAPP_CLIENT_ID, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken } from './chunk-J2DZKX7A.js';
+import { normalizeBaseUrl } from './chunk-5NYQX65A.js';
+import { randomUUID } from 'crypto';
+import { readFileSync, mkdirSync, chmodSync, writeFileSync, renameSync, rmSync } from 'fs';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+
+var STORE_VERSION = 1;
+var APP_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var REFRESH_WINDOW_MS = 6e4;
+var refreshesByCredentialPath = /* @__PURE__ */ new Map();
+var assertAppId = (appId) => {
+  if (!APP_ID_RE.test(appId)) {
+    throw new BusabaseOAuthError(
+      "invalid_airapp_id",
+      "AirApp id must use letters, digits, dot, dash, or underscore"
+    );
+  }
+  return appId;
+};
+var storeRoot = (options = {}) => options.rootDir ?? join(homedir(), ".busabase");
+var busabaseAirAppCredentialsDir = (options = {}) => join(storeRoot(options), "airapps");
+var busabaseAirAppCredentialPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.json`);
+var normalizeOrigin = (raw) => {
+  const url = new URL(normalizeBaseUrl(raw));
+  if (url.username || url.password || url.search || url.hash) {
+    throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL must be an origin");
+  }
+  return url.origin;
+};
+var parseCredential = (raw, expectedAppId) => {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  const item = value;
+  if (item.version !== STORE_VERSION || item.appId !== expectedAppId || typeof item.baseUrl !== "string" || typeof item.clientId !== "string" || typeof item.accessToken !== "string" || typeof item.refreshToken !== "string" || typeof item.expiresAt !== "string" || !Array.isArray(item.scope) || item.scope.some((scope) => typeof scope !== "string") || typeof item.tokenType !== "string") {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  return item;
+};
+function loadBusabaseAirAppOAuthCredential(appId, options = {}) {
+  const path = busabaseAirAppCredentialPath(appId, options);
+  try {
+    return parseCredential(readFileSync(path, "utf8"), appId);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function storeBusabaseAirAppOAuthCredential(input, options = {}) {
+  if (!input.tokenSet.refreshToken) {
+    throw new BusabaseOAuthError(
+      "missing_refresh_token",
+      "A refresh token is required for a persistent local AirApp login"
+    );
+  }
+  const credential = {
+    version: STORE_VERSION,
+    appId: assertAppId(input.appId),
+    baseUrl: normalizeOrigin(input.baseUrl),
+    clientId: input.clientId ?? BUSABASE_AIRAPP_CLIENT_ID,
+    accessToken: input.tokenSet.accessToken,
+    refreshToken: input.tokenSet.refreshToken,
+    expiresAt: input.tokenSet.expiresAt,
+    scope: input.tokenSet.scope,
+    tokenType: input.tokenSet.tokenType
+  };
+  const path = busabaseAirAppCredentialPath(input.appId, options);
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  try {
+    chmodSync(directory, 448);
+  } catch {
+  }
+  const temporaryPath = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(credential, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(temporaryPath, 384);
+  } catch {
+  }
+  renameSync(temporaryPath, path);
+  return credential;
+}
+async function getBusabaseAirAppAccessToken(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return null;
+  const expiresAt = Date.parse(credential.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt > Date.now() + REFRESH_WINDOW_MS) return credential;
+  const credentialPath = busabaseAirAppCredentialPath(appId, options);
+  const activeRefresh = refreshesByCredentialPath.get(credentialPath);
+  if (activeRefresh) return activeRefresh;
+  const refresh = (async () => {
+    const tokenSet = await refreshBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        refreshToken: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+    return storeBusabaseAirAppOAuthCredential(
+      {
+        appId,
+        baseUrl: credential.baseUrl,
+        clientId: credential.clientId,
+        tokenSet: {
+          ...tokenSet,
+          refreshToken: tokenSet.refreshToken ?? credential.refreshToken
+        }
+      },
+      options
+    );
+  })();
+  refreshesByCredentialPath.set(credentialPath, refresh);
+  try {
+    return await refresh;
+  } finally {
+    if (refreshesByCredentialPath.get(credentialPath) === refresh) {
+      refreshesByCredentialPath.delete(credentialPath);
+    }
+  }
+}
+function clearBusabaseAirAppOAuthCredential(appId, options = {}) {
+  rmSync(busabaseAirAppCredentialPath(appId, options), { force: true });
+}
+async function revokeBusabaseAirAppOAuthCredential(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return;
+  try {
+    await revokeBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        token: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+  } finally {
+    clearBusabaseAirAppOAuthCredential(appId, options);
+  }
+}
+
+export { busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppOAuthCredential };

package/dist/oauth.d.ts

@@ -0,0 +1,55 @@
+/** Public client identifier used by local Hono/AirApp development servers. */
+declare const BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
+
+interface BusabaseOAuthRequest {
+    authorizeUrl: string;
+    baseUrl: string;
+    clientId: string;
+    codeVerifier: string;
+    redirectUri: string;
+    resource: string;
+    state: string;
+}
+interface CreateBusabaseOAuthRequestInput {
+    baseUrl: string;
+    redirectUri: string;
+    clientId?: string;
+    state?: string;
+    prompt?: "login";
+}
+interface BusabaseOAuthTokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn: number;
+    expiresAt: string;
+    scope: string[];
+    tokenType: string;
+    user?: {
+        id: string;
+        name: string;
+        email: string;
+        image: string | null;
+    };
+}
+declare class BusabaseOAuthError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    constructor(code: string, message: string, status?: number);
+}
+/** Build a public-client OAuth 2.1 authorization request with PKCE S256. */
+declare function createBusabaseOAuthRequest(input: CreateBusabaseOAuthRequestInput): Promise<BusabaseOAuthRequest>;
+/** Validate state and issuer before accepting the authorization code. */
+declare function parseBusabaseOAuthCallback(callbackUrl: string, request: BusabaseOAuthRequest): string;
+declare function exchangeBusabaseOAuthCode(request: BusabaseOAuthRequest, code: string, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
+declare function refreshBusabaseOAuthToken(input: {
+    baseUrl: string;
+    refreshToken: string;
+    clientId?: string;
+}, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
+declare function revokeBusabaseOAuthToken(input: {
+    baseUrl: string;
+    token: string;
+    clientId?: string;
+}, fetchImpl?: typeof fetch): Promise<void>;
+
+export { BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, type BusabaseOAuthRequest, type BusabaseOAuthTokenSet, type CreateBusabaseOAuthRequestInput, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken };

package/dist/oauth.js

@@ -0,0 +1,2 @@
+export { BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken } from './chunk-J2DZKX7A.js';
+import './chunk-5NYQX65A.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busabase-sdk",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "Typed TypeScript/JavaScript SDK for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server` (or Busabase Cloud).",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-sdk",
@@ -22,6 +22,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./oauth": {
+      "types": "./dist/oauth.d.ts",
+      "default": "./dist/oauth.js"
+    },
+    "./oauth-node": {
+      "types": "./dist/oauth-node.d.ts",
+      "default": "./dist/oauth-node.js"
     }
   },
   "files": [
@@ -41,9 +49,9 @@
     "tsx": "^4.20.5",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8",
-    "busabase-contract": "0.10.2",
-    "open-domains": "0.0.2",
-    "openlib": "0.1.1"
+    "busabase-contract": "0.11.0",
+    "openlib": "0.1.1",
+    "open-domains": "0.0.2"
   },
   "engines": {
     "node": ">=24.18.0"