busabase-sdk 0.14.1 → 0.16.0

package/dist/airapp.js

@@ -0,0 +1,359 @@
+// src/airapp.ts
+var AirAppSetupError = class extends Error {
+  code;
+  /** The human-readable half, without the `CODE: ` prefix. */
+  detail;
+  constructor(code, detail) {
+    super(`${code}: ${detail}`);
+    this.name = "AirAppSetupError";
+    this.code = code;
+    this.detail = detail;
+  }
+};
+var setupError = (code, detail) => new AirAppSetupError(code, detail);
+var isNotFound = (error) => typeof error === "object" && error !== null && ("code" in error && error.code === "NOT_FOUND" || "status" in error && error.status === 404);
+var isForbidden = (error) => typeof error === "object" && error !== null && ("code" in error && error.code === "FORBIDDEN" || "status" in error && error.status === 403);
+var ownsResource = (node, appId, resourceKey, schemaVersion) => node?.metadata?.appId === appId && node?.metadata?.resourceKey === resourceKey && node?.metadata?.schemaVersion === schemaVersion;
+var hasResourceIdentity = (node, appId, resourceKey) => node?.metadata?.appId === appId && node?.metadata?.resourceKey === resourceKey;
+var ownsAppRoot = (node, appId, schemaVersion) => hasResourceIdentity(node, appId, "app-root") && node?.metadata?.schemaVersion === schemaVersion;
+var hasEmptyMetadata = (node) => Object.keys(node?.metadata ?? {}).length === 0;
+var matchesDeclaration = (node, declaration, type) => node?.type === type && node?.slug === declaration.slug && node?.name === declaration.name && node?.description === (declaration.description ?? "");
+var matchesLegacyAirApp = (node, config) => hasEmptyMetadata(node) && node?.type === "airapp" && node?.slug === config.airApp?.slug && node?.name === config.airApp?.name;
+var resourceMetadata = (config, resourceKey) => ({
+  appId: config.appId,
+  resourceKey,
+  schemaVersion: config.schemaVersion
+});
+function resolveProvisionedFolder(folder, config) {
+  if (!folder) {
+    return { folder: null, bases: [], missing: [...config.bases], repairs: [] };
+  }
+  if (folder.node?.type !== "folder" || folder.node?.slug !== config.folder.slug) {
+    throw setupError(
+      "SETUP_CONFLICT",
+      `A different Folder already uses the slug ${config.folder.slug}; nothing was changed`
+    );
+  }
+  const rootOwned = hasResourceIdentity(folder.node, config.appId, "app-root");
+  const legacyRoot = hasEmptyMetadata(folder.node) && matchesDeclaration(folder.node, config.folder, "folder");
+  if (!rootOwned && !legacyRoot) {
+    throw setupError(
+      "SETUP_CONFLICT",
+      `The Folder ${config.folder.slug} does not belong to this app; nothing was changed`
+    );
+  }
+  const bases = [];
+  const missing = [];
+  const repairs = [];
+  if (!ownsAppRoot(folder.node, config.appId, config.schemaVersion)) {
+    repairs.push({
+      nodeId: folder.node.id,
+      resourceKey: "app-root",
+      metadata: resourceMetadata(config, "app-root")
+    });
+  }
+  for (const base of config.bases) {
+    const matches = (folder.children ?? []).filter((node2) => node2.slug === base.slug);
+    if (!matches.length) {
+      if (legacyRoot) {
+        throw setupError(
+          "SETUP_CONFLICT",
+          `The existing unstamped Folder is missing the resource ${base.slug}, so it cannot be claimed safely`
+        );
+      }
+      missing.push(base);
+      continue;
+    }
+    const node = matches[0];
+    if (matches.length !== 1 || node.type !== "base" || !node.baseId) {
+      throw setupError(
+        "SETUP_CONFLICT",
+        `The resource ${base.slug} does not match this app's declaration; nothing was changed`
+      );
+    }
+    const owned = hasResourceIdentity(node, config.appId, base.key);
+    const legacy = hasEmptyMetadata(node) && matchesDeclaration(node, base, "base");
+    if (!owned && !legacy) {
+      throw setupError(
+        "SETUP_CONFLICT",
+        `The resource ${base.slug} does not match this app's declaration; nothing was changed`
+      );
+    }
+    if (!ownsResource(node, config.appId, base.key, config.schemaVersion)) {
+      repairs.push({
+        nodeId: node.id,
+        baseId: node.baseId,
+        resourceKey: base.key,
+        metadata: resourceMetadata(config, base.key)
+      });
+    }
+    bases.push({ ...base, nodeId: node.id, baseId: node.baseId });
+  }
+  const airAppNode = config.airApp ? (folder.children ?? []).find(
+    (node) => hasResourceIdentity(
+      node,
+      config.appId,
+      config.airApp.resourceKey
+    ) || matchesLegacyAirApp(node, config)
+  ) : void 0;
+  if (config.airApp && airAppNode && !ownsResource(airAppNode, config.appId, config.airApp.resourceKey, config.schemaVersion)) {
+    repairs.push({
+      nodeId: airAppNode.id,
+      resourceKey: config.airApp.resourceKey,
+      metadata: resourceMetadata(config, config.airApp.resourceKey)
+    });
+  }
+  if (legacyRoot) {
+    const declaredSlugs = new Set(config.bases.map((base) => base.slug));
+    const ambiguousExtra = (folder.children ?? []).find(
+      (node) => !declaredSlugs.has(node.slug) && node.id !== airAppNode?.id && node?.metadata?.appId !== config.appId
+    );
+    if (ambiguousExtra) {
+      throw setupError(
+        "SETUP_CONFLICT",
+        `The existing unstamped Folder holds an unattributable resource ${ambiguousExtra.slug}; nothing was changed`
+      );
+    }
+  }
+  return {
+    folder: { ...config.folder, nodeId: folder.node.id },
+    bases,
+    missing,
+    repairs
+  };
+}
+function buildProvisionOperations(config, folder, missingBases) {
+  const operations = [];
+  if (!folder) {
+    operations.push({
+      kind: "create",
+      ref: "app-root",
+      nodeType: "folder",
+      slug: config.folder.slug,
+      name: config.folder.name,
+      description: config.folder.description ?? "",
+      metadata: resourceMetadata(config, "app-root")
+    });
+  }
+  for (const base of missingBases) {
+    operations.push({
+      kind: "create",
+      ...folder ? { parentNodeId: folder.nodeId } : { parentNodeRef: "app-root" },
+      nodeType: "base",
+      slug: base.slug,
+      name: base.name,
+      description: base.description ?? "",
+      metadata: resourceMetadata(config, base.key),
+      fields: base.fields
+    });
+  }
+  return operations;
+}
+var findTopLevelFolder = async (client, config) => {
+  const roots = await client.nodes.list({ parentId: null, depth: 2 });
+  const candidates = (roots ?? []).flatMap((node) => [node, ...node.children ?? []]).filter((node) => node.type === "folder" && node.slug === config.folder.slug);
+  if (candidates.length > 1) {
+    throw setupError(
+      "SETUP_CONFLICT",
+      `Found more than one Folder with the slug ${config.folder.slug}; nothing was changed`
+    );
+  }
+  return candidates[0] ?? null;
+};
+var readFolder = async (client, config) => {
+  let nodeId = config.folder.nodeId;
+  if (!nodeId) nodeId = (await findTopLevelFolder(client, config))?.id;
+  if (!nodeId) return null;
+  try {
+    return await client.nodes.get({ nodeId, type: "folder" });
+  } catch (error) {
+    if (isNotFound(error) && config.folder.nodeId) {
+      const discovered = await findTopLevelFolder(client, config);
+      return discovered ? await client.nodes.get({
+        nodeId: discovered.id,
+        type: "folder"
+      }) : null;
+    }
+    if (isNotFound(error)) return null;
+    throw error;
+  }
+};
+async function inspectProvisionedResources(client, config) {
+  return resolveProvisionedFolder(await readFolder(client, config), config);
+}
+var provisionStates = /* @__PURE__ */ new WeakMap();
+var stateFor = (client, appId) => {
+  let byApp = provisionStates.get(client);
+  if (!byApp) {
+    byApp = /* @__PURE__ */ new Map();
+    provisionStates.set(client, byApp);
+  }
+  let state = byApp.get(appId);
+  if (!state) {
+    state = { inFlight: null, metadataUpdatesSupported: void 0 };
+    byApp.set(appId, state);
+  }
+  return state;
+};
+var sameFieldName = (actual, expected) => JSON.stringify(actual) === JSON.stringify(expected);
+var fieldMatches = (actual, expected) => actual?.slug === expected.slug && actual?.type === expected.type && actual?.required === expected.required && sameFieldName(actual?.name, expected.name);
+var additiveFieldsFor = (actual, expected) => {
+  const fields = actual?.fields ?? [];
+  if (fields.length > expected.fields.length || !fields.every((field, index) => fieldMatches(field, expected.fields[index]))) {
+    throw setupError(
+      "SETUP_CONFLICT",
+      `The structure of ${expected.slug} does not match this app's declaration, so it cannot be upgraded safely`
+    );
+  }
+  return expected.fields.slice(fields.length);
+};
+var validateRepairBase = (actual, expected, nodeId) => {
+  if (!expected) {
+    throw setupError("SETUP_CONFLICT", "Cannot repair a resource this app does not declare");
+  }
+  const fields = actual?.fields ?? [];
+  const exactFields = fields.length === expected.fields.length && fields.every((field, index) => fieldMatches(field, expected.fields[index]));
+  if (actual?.nodeId !== nodeId || actual?.slug !== expected.slug || actual?.name !== expected.name || actual?.description !== (expected.description ?? "") || !exactFields) {
+    throw setupError(
+      "SETUP_CONFLICT",
+      `The structure of ${expected.slug} does not match this app's declaration, so it cannot be claimed safely`
+    );
+  }
+};
+async function repairResourceOwnership(client, config, current) {
+  if (!current.repairs.length) return current;
+  const state = stateFor(client, config.appId);
+  const baseRepairs = current.repairs.filter((repair) => repair.baseId);
+  const baseByKey = new Map(config.bases.map((base) => [base.key, base]));
+  const details = await Promise.all(
+    baseRepairs.map((repair) => client.bases.get({ baseId: repair.baseId }))
+  );
+  const migrations = details.map((detail, index) => {
+    const repair = baseRepairs[index];
+    const expected = baseByKey.get(repair.resourceKey);
+    if (!expected) {
+      throw setupError("SETUP_CONFLICT", "Cannot repair a resource this app does not declare");
+    }
+    if (detail?.nodeId !== repair.nodeId || detail?.slug !== expected.slug || detail?.name !== expected.name || detail?.description !== (expected.description ?? "")) {
+      throw setupError(
+        "SETUP_CONFLICT",
+        `The structure of ${expected.slug} does not match this app's declaration, so it cannot be upgraded safely`
+      );
+    }
+    return { repair, expected, fields: additiveFieldsFor(detail, expected) };
+  });
+  const pendingFieldRequests = [];
+  for (const migration of migrations) {
+    for (const field of migration.fields) {
+      const changeRequest = await client.bases.fieldChangeRequest({
+        operation: "create",
+        baseId: migration.repair.baseId,
+        slug: field.slug,
+        name: field.name,
+        type: field.type,
+        required: field.required,
+        message: `Upgrade ${config.appName}: add ${field.slug}`,
+        submittedBy: config.appId
+      });
+      const merged = changeRequest?.status === "merged" || changeRequest?.materialized === true;
+      if (!merged) pendingFieldRequests.push(changeRequest?.id ?? field.slug);
+    }
+  }
+  if (pendingFieldRequests.length) {
+    throw setupError(
+      "SETUP_PENDING",
+      `Submitted ${pendingFieldRequests.length} field upgrade request(s) awaiting Space admin approval: ${pendingFieldRequests.join(", ")}`
+    );
+  }
+  const verified = migrations.some((migration) => migration.fields.length) ? await Promise.all(
+    baseRepairs.map((repair) => client.bases.get({ baseId: repair.baseId }))
+  ) : details;
+  verified.forEach((detail, index) => {
+    const repair = baseRepairs[index];
+    validateRepairBase(detail, baseByKey.get(repair.resourceKey), repair.nodeId);
+  });
+  if (state.metadataUpdatesSupported === false) {
+    return { ...current, repairs: [], compatibilityMode: "verified-legacy-fingerprint" };
+  }
+  try {
+    for (const repair of current.repairs) {
+      await client.nodes.updateMetadata({ nodeId: repair.nodeId, metadata: repair.metadata });
+      state.metadataUpdatesSupported = true;
+    }
+  } catch (error) {
+    if (isNotFound(error)) {
+      state.metadataUpdatesSupported = false;
+      return { ...current, repairs: [], compatibilityMode: "verified-legacy-fingerprint" };
+    }
+    if (isForbidden(error)) {
+      throw setupError(
+        "SETUP_PERMISSION",
+        "This account may not repair resource ownership metadata for this app"
+      );
+    }
+    throw error;
+  }
+  const repaired = await inspectProvisionedResources(client, config);
+  if (repaired.repairs.length) {
+    throw setupError("SCHEMA_INCOMPLETE", "Ownership was repaired but read back incomplete");
+  }
+  return repaired;
+}
+var waitForMaterializedResources = async (client, config, attempts = 20) => {
+  let current;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    current = await inspectProvisionedResources(client, config);
+    current = await repairResourceOwnership(client, config, current);
+    if (current.folder && current.missing.length === 0) return current;
+    if (attempt < attempts - 1) {
+      await new Promise((resolve) => globalThis.setTimeout(resolve, 100));
+    }
+  }
+  throw setupError(
+    "SCHEMA_INCOMPLETE",
+    "Initialization merged but the resources read back incomplete"
+  );
+};
+async function provisionOnce(client, config) {
+  let current = await inspectProvisionedResources(client, config);
+  current = await repairResourceOwnership(client, config, current);
+  if (current.folder && current.missing.length === 0) return current;
+  const operations = buildProvisionOperations(config, current.folder, current.missing);
+  let changeRequest;
+  try {
+    changeRequest = await client.nodes.createChangeRequest({
+      message: `Initialize ${config.appName} workspace`,
+      submittedBy: config.appId,
+      autoMerge: true,
+      operations
+    });
+  } catch (error) {
+    if (isForbidden(error)) {
+      throw setupError(
+        "SETUP_PERMISSION",
+        "This account may not create this app's resources in this Space"
+      );
+    }
+    const concurrent = await inspectProvisionedResources(client, config).catch(() => null);
+    if (concurrent?.folder && concurrent.missing.length === 0) return concurrent;
+    throw error;
+  }
+  if (changeRequest?.status !== "merged") {
+    throw setupError(
+      "SETUP_PENDING",
+      `Initialization request ${changeRequest?.id ?? ""} was submitted and awaits Space admin approval`.trim()
+    );
+  }
+  return waitForMaterializedResources(client, config);
+}
+function provisionDeclaredResources(client, config) {
+  const state = stateFor(client, config.appId);
+  if (!state.inFlight) {
+    state.inFlight = provisionOnce(client, config).finally(() => {
+      state.inFlight = null;
+    });
+  }
+  return state.inFlight;
+}
+
+export { AirAppSetupError, buildProvisionOperations, inspectProvisionedResources, isNotFound, provisionDeclaredResources, resolveProvisionedFolder };

package/dist/chunk-C23JVY2Y.js

@@ -0,0 +1,211 @@
+import { BusabaseOAuthError, BUSABASE_AIRAPP_CLIENT_ID, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken } from './chunk-WSHJMHUS.js';
+import { normalizeBaseUrl } from './chunk-5NYQX65A.js';
+import { randomUUID } from 'crypto';
+import { readFileSync, rmSync, mkdirSync, chmodSync, writeFileSync, renameSync } from 'fs';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+
+var STORE_VERSION = 1;
+var APP_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var REFRESH_WINDOW_MS = 6e4;
+var refreshesByCredentialPath = /* @__PURE__ */ new Map();
+var assertAppId = (appId) => {
+  if (!APP_ID_RE.test(appId)) {
+    throw new BusabaseOAuthError(
+      "invalid_airapp_id",
+      "AirApp id must use letters, digits, dot, dash, or underscore"
+    );
+  }
+  return appId;
+};
+var storeRoot = (options = {}) => options.rootDir ?? join(homedir(), ".busabase");
+var busabaseAirAppCredentialsDir = (options = {}) => join(storeRoot(options), "airapps");
+var busabaseAirAppCredentialPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.json`);
+var busabaseAirAppDynamicClientsPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.clients.json`);
+var normalizeOrigin = (raw) => {
+  const url = new URL(normalizeBaseUrl(raw));
+  if (url.username || url.password || url.search || url.hash) {
+    throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL must be an origin");
+  }
+  return url.origin;
+};
+var writeOwnerOnlyJson = (path, value) => {
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  try {
+    chmodSync(directory, 448);
+  } catch {
+  }
+  const temporaryPath = `${path}.${randomUUID()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(temporaryPath, 384);
+  } catch {
+  }
+  renameSync(temporaryPath, path);
+};
+var parseCredential = (raw, expectedAppId) => {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  const item = value;
+  if (item.version !== STORE_VERSION || item.appId !== expectedAppId || typeof item.baseUrl !== "string" || typeof item.clientId !== "string" || typeof item.accessToken !== "string" || typeof item.refreshToken !== "string" || typeof item.expiresAt !== "string" || !Array.isArray(item.scope) || item.scope.some((scope) => typeof scope !== "string") || typeof item.tokenType !== "string") {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  if (item.selectedSpace !== void 0 && (typeof item.selectedSpace !== "object" || item.selectedSpace === null || typeof item.selectedSpace.id !== "string" || typeof item.selectedSpace.name !== "string")) {
+    throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+  }
+  return item;
+};
+function loadBusabaseAirAppOAuthCredential(appId, options = {}) {
+  const path = busabaseAirAppCredentialPath(appId, options);
+  try {
+    return parseCredential(readFileSync(path, "utf8"), appId);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function storeBusabaseAirAppOAuthCredential(input, options = {}) {
+  if (!input.tokenSet.refreshToken) {
+    throw new BusabaseOAuthError(
+      "missing_refresh_token",
+      "A refresh token is required for a persistent local AirApp login"
+    );
+  }
+  const credential = {
+    version: STORE_VERSION,
+    appId: assertAppId(input.appId),
+    baseUrl: normalizeOrigin(input.baseUrl),
+    clientId: input.clientId ?? BUSABASE_AIRAPP_CLIENT_ID,
+    accessToken: input.tokenSet.accessToken,
+    refreshToken: input.tokenSet.refreshToken,
+    expiresAt: input.tokenSet.expiresAt,
+    scope: input.tokenSet.scope,
+    tokenType: input.tokenSet.tokenType,
+    ...input.selectedSpace ? { selectedSpace: input.selectedSpace } : {}
+  };
+  writeOwnerOnlyJson(busabaseAirAppCredentialPath(input.appId, options), credential);
+  return credential;
+}
+var dynamicClientKey = (baseUrl, redirectUri) => `${normalizeOrigin(baseUrl)}|${new URL(redirectUri).toString()}`;
+var loadDynamicClientRegistry = (appId, options) => {
+  const empty = {
+    version: STORE_VERSION,
+    appId: assertAppId(appId),
+    clients: {}
+  };
+  let raw;
+  try {
+    raw = readFileSync(busabaseAirAppDynamicClientsPath(appId, options), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return empty;
+    throw error;
+  }
+  try {
+    const value = JSON.parse(raw);
+    if (value.version !== STORE_VERSION || value.appId !== appId || typeof value.clients !== "object" || value.clients === null) {
+      return empty;
+    }
+    const clients = Object.fromEntries(
+      Object.entries(value.clients).filter(([, clientId]) => typeof clientId === "string")
+    );
+    return { ...empty, clients };
+  } catch {
+    return empty;
+  }
+};
+function loadBusabaseAirAppDynamicClientId(input, options = {}) {
+  const registry = loadDynamicClientRegistry(input.appId, options);
+  return registry.clients[dynamicClientKey(input.baseUrl, input.redirectUri)] ?? null;
+}
+function storeBusabaseAirAppDynamicClientId(input, options = {}) {
+  const registry = loadDynamicClientRegistry(input.appId, options);
+  const key = dynamicClientKey(input.baseUrl, input.redirectUri);
+  delete registry.clients[key];
+  const entries = [...Object.entries(registry.clients), [key, input.clientId]];
+  writeOwnerOnlyJson(busabaseAirAppDynamicClientsPath(input.appId, options), {
+    ...registry,
+    clients: Object.fromEntries(entries.slice(-32))
+  });
+}
+async function getBusabaseAirAppAccessToken(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return null;
+  const expiresAt = Date.parse(credential.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt > Date.now() + REFRESH_WINDOW_MS) return credential;
+  const credentialPath = busabaseAirAppCredentialPath(appId, options);
+  const activeRefresh = refreshesByCredentialPath.get(credentialPath);
+  if (activeRefresh) return activeRefresh;
+  const refresh = (async () => {
+    const tokenSet = await refreshBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        refreshToken: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+    return storeBusabaseAirAppOAuthCredential(
+      {
+        appId,
+        baseUrl: credential.baseUrl,
+        clientId: credential.clientId,
+        tokenSet: {
+          ...tokenSet,
+          refreshToken: tokenSet.refreshToken ?? credential.refreshToken
+        },
+        selectedSpace: credential.selectedSpace
+      },
+      options
+    );
+  })();
+  refreshesByCredentialPath.set(credentialPath, refresh);
+  try {
+    return await refresh;
+  } finally {
+    if (refreshesByCredentialPath.get(credentialPath) === refresh) {
+      refreshesByCredentialPath.delete(credentialPath);
+    }
+  }
+}
+function storeBusabaseAirAppSelectedSpace(appId, selectedSpace, options = {}) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) {
+    throw new BusabaseOAuthError(
+      "missing_local_credential",
+      "Connect this local AirApp before selecting a Space"
+    );
+  }
+  const next = {
+    ...credential,
+    ...selectedSpace ? { selectedSpace } : { selectedSpace: void 0 }
+  };
+  writeOwnerOnlyJson(busabaseAirAppCredentialPath(appId, options), next);
+  return next;
+}
+function clearBusabaseAirAppOAuthCredential(appId, options = {}) {
+  rmSync(busabaseAirAppCredentialPath(appId, options), { force: true });
+}
+async function revokeBusabaseAirAppOAuthCredential(appId, options = {}, fetchImpl = fetch) {
+  const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+  if (!credential) return;
+  try {
+    await revokeBusabaseOAuthToken(
+      {
+        baseUrl: credential.baseUrl,
+        token: credential.refreshToken,
+        clientId: credential.clientId
+      },
+      fetchImpl
+    );
+  } finally {
+    clearBusabaseAirAppOAuthCredential(appId, options);
+  }
+}
+
+export { busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace };

package/dist/{chunk-J2DZKX7A.js → chunk-WSHJMHUS.js}

@@ -4,6 +4,7 @@ import { normalizeBaseUrl } from './chunk-5NYQX65A.js';
 var BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
 
 // src/oauth.ts
+var AIRAPP_OAUTH_SCOPE = "api";
 var BusabaseOAuthError = class extends Error {
   code;
   status;
@@ -46,6 +47,45 @@ var digestBase64Url = async (value) => {
   for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
+async function registerBusabaseAirAppOAuthClient(input, fetchImpl = fetch) {
+  const baseUrl = oauthBaseUrl(input.baseUrl);
+  const redirectUri = new URL(input.redirectUri).toString();
+  const response = await fetchImpl(new URL("/api/oauth/register", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: input.appId,
+      client_kind: "airapp",
+      scope: AIRAPP_OAUTH_SCOPE,
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    throw new BusabaseOAuthError(
+      typeof body?.error === "string" ? body.error : "client_registration_failed",
+      typeof body?.error_description === "string" ? body.error_description : `Busabase OAuth client registration failed (${response.status})`,
+      response.status
+    );
+  }
+  if (typeof body?.client_id !== "string" || !Array.isArray(body.redirect_uris) || body.redirect_uris.length !== 1 || body.redirect_uris[0] !== redirectUri) {
+    throw new BusabaseOAuthError(
+      "invalid_client_registration",
+      "Busabase returned an invalid OAuth client registration"
+    );
+  }
+  const grantedScopes = typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : null;
+  if (!grantedScopes?.includes(AIRAPP_OAUTH_SCOPE)) {
+    throw new BusabaseOAuthError(
+      "unsupported_airapp_registration",
+      `This Busabase server did not grant the "${AIRAPP_OAUTH_SCOPE}" scope to a dynamically registered AirApp. Upgrade Busabase, or run the AirApp on a loopback address to use the shared AirApp client.`
+    );
+  }
+  return { clientId: body.client_id, redirectUri };
+}
 async function createBusabaseOAuthRequest(input) {
   const baseUrl = oauthBaseUrl(input.baseUrl);
   const redirectUri = new URL(input.redirectUri).toString();
@@ -58,7 +98,7 @@ async function createBusabaseOAuthRequest(input) {
     response_type: "code",
     client_id: clientId,
     resource,
-    scope: "api",
+    scope: AIRAPP_OAUTH_SCOPE,
     code_challenge: await digestBase64Url(codeVerifier),
     code_challenge_method: "S256",
     redirect_uri: redirectUri,
@@ -172,4 +212,4 @@ async function revokeBusabaseOAuthToken(input, fetchImpl = fetch) {
   }
 }
 
-export { BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, revokeBusabaseOAuthToken };
+export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken };