busabase-sdk 0.17.2 → 0.18.0

package/dist/oauth-Dg2Z41RP.js

@@ -0,0 +1,173 @@
+import { t as normalizeBaseUrl } from "./url-B8GMXalA.js";
+//#region ../../packages/busabase-contract/src/auth/device-authorization.ts
+/** Public client identifier used by local Hono/AirApp development servers. */
+const BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
+//#endregion
+//#region src/oauth.ts
+/** The only scope an AirApp ever requests; bound to the `/api/v1` resource. */
+const AIRAPP_OAUTH_SCOPE = "api";
+var BusabaseOAuthError = class extends Error {
+	code;
+	status;
+	constructor(code, message, status) {
+		super(message);
+		this.name = "BusabaseOAuthError";
+		this.code = code;
+		this.status = status;
+	}
+};
+const oauthBaseUrl = (raw) => {
+	let url;
+	try {
+		url = new URL(normalizeBaseUrl(raw));
+	} catch {
+		throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL is invalid");
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL must be an HTTP(S) origin without credentials, query, or path");
+	return url.origin;
+};
+const randomBase64Url = (byteLength) => {
+	const bytes = globalThis.crypto.getRandomValues(new Uint8Array(byteLength));
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+const digestBase64Url = async (value) => {
+	const encoded = new TextEncoder().encode(value);
+	const data = encoded.buffer.slice(encoded.byteOffset, encoded.byteOffset + encoded.byteLength);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+	let binary = "";
+	for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+/** Register an exact HTTPS callback for a public AirApp OAuth client. */
+async function registerBusabaseAirAppOAuthClient(input, fetchImpl = fetch) {
+	const baseUrl = oauthBaseUrl(input.baseUrl);
+	const redirectUri = new URL(input.redirectUri).toString();
+	const response = await fetchImpl(new URL("/api/oauth/register", baseUrl), {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_name: input.appId,
+			client_kind: "airapp",
+			scope: "api",
+			redirect_uris: [redirectUri],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none"
+		})
+	});
+	const body = await response.json().catch(() => null);
+	if (!response.ok) throw new BusabaseOAuthError(typeof body?.error === "string" ? body.error : "client_registration_failed", typeof body?.error_description === "string" ? body.error_description : `Busabase OAuth client registration failed (${response.status})`, response.status);
+	if (typeof body?.client_id !== "string" || !Array.isArray(body.redirect_uris) || body.redirect_uris.length !== 1 || body.redirect_uris[0] !== redirectUri) throw new BusabaseOAuthError("invalid_client_registration", "Busabase returned an invalid OAuth client registration");
+	if (!(typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : null)?.includes("api")) throw new BusabaseOAuthError("unsupported_airapp_registration", `This Busabase server did not grant the "api" scope to a dynamically registered AirApp. Upgrade Busabase, or run the AirApp on a loopback address to use the shared AirApp client.`);
+	return {
+		clientId: body.client_id,
+		redirectUri
+	};
+}
+/** Build a public-client OAuth 2.1 authorization request with PKCE S256. */
+async function createBusabaseOAuthRequest(input) {
+	const baseUrl = oauthBaseUrl(input.baseUrl);
+	const redirectUri = new URL(input.redirectUri).toString();
+	const clientId = input.clientId ?? "busabase-airapp";
+	const codeVerifier = randomBase64Url(32);
+	const state = input.state ?? randomBase64Url(24);
+	const resource = new URL("/api/v1", baseUrl).toString();
+	const authorizeUrl = new URL("/api/oauth/authorize", baseUrl);
+	authorizeUrl.search = new URLSearchParams({
+		response_type: "code",
+		client_id: clientId,
+		resource,
+		scope: "api",
+		code_challenge: await digestBase64Url(codeVerifier),
+		code_challenge_method: "S256",
+		redirect_uri: redirectUri,
+		state
+	}).toString();
+	if (input.prompt) authorizeUrl.searchParams.set("prompt", input.prompt);
+	return {
+		authorizeUrl: authorizeUrl.toString(),
+		baseUrl,
+		clientId,
+		codeVerifier,
+		redirectUri,
+		resource,
+		state
+	};
+}
+/** Validate state and issuer before accepting the authorization code. */
+function parseBusabaseOAuthCallback(callbackUrl, request) {
+	const callback = new URL(callbackUrl);
+	const error = callback.searchParams.get("error");
+	if (error) throw new BusabaseOAuthError(error, callback.searchParams.get("error_description") || "Busabase authorization was denied");
+	if (callback.searchParams.get("state") !== request.state) throw new BusabaseOAuthError("state_mismatch", "OAuth callback state did not match");
+	const issuer = callback.searchParams.get("iss");
+	let issuerMatches = false;
+	try {
+		issuerMatches = Boolean(issuer && new URL(issuer).origin === new URL(request.baseUrl).origin);
+	} catch {
+		issuerMatches = false;
+	}
+	if (!issuerMatches) throw new BusabaseOAuthError("issuer_mismatch", "OAuth callback issuer did not match");
+	const code = callback.searchParams.get("code");
+	if (!code) throw new BusabaseOAuthError("missing_code", "OAuth callback had no code");
+	return code;
+}
+const parseTokenResponse = async (response) => {
+	const body = await response.json().catch(() => null);
+	if (!response.ok) throw new BusabaseOAuthError(typeof body?.error === "string" ? body.error : "token_request_failed", typeof body?.error_description === "string" ? body.error_description : `Busabase OAuth token request failed (${response.status})`, response.status);
+	if (typeof body?.access_token !== "string" || typeof body.expires_in !== "number") throw new BusabaseOAuthError("invalid_token_response", "Busabase returned an invalid token set");
+	return {
+		accessToken: body.access_token,
+		refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+		expiresIn: body.expires_in,
+		expiresAt: new Date(Date.now() + body.expires_in * 1e3).toISOString(),
+		scope: typeof body.scope === "string" ? body.scope.split(/\s+/).filter(Boolean) : [],
+		tokenType: typeof body.token_type === "string" ? body.token_type : "Bearer",
+		user: body.user && typeof body.user === "object" ? body.user : void 0
+	};
+};
+async function exchangeBusabaseOAuthCode(request, code, fetchImpl = fetch) {
+	const response = await fetchImpl(new URL("/api/oauth/token", request.baseUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: request.clientId,
+			code,
+			code_verifier: request.codeVerifier,
+			redirect_uri: request.redirectUri,
+			resource: request.resource
+		})
+	});
+	return parseTokenResponse(response);
+}
+async function refreshBusabaseOAuthToken(input, fetchImpl = fetch) {
+	const baseUrl = oauthBaseUrl(input.baseUrl);
+	const response = await fetchImpl(new URL("/api/oauth/token", baseUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: input.refreshToken,
+			client_id: input.clientId ?? "busabase-airapp",
+			resource: new URL("/api/v1", baseUrl).toString()
+		})
+	});
+	return parseTokenResponse(response);
+}
+async function revokeBusabaseOAuthToken(input, fetchImpl = fetch) {
+	const baseUrl = oauthBaseUrl(input.baseUrl);
+	const response = await fetchImpl(new URL("/api/oauth/revoke", baseUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token: input.token,
+			client_id: input.clientId ?? "busabase-airapp"
+		})
+	});
+	if (!response.ok) throw new BusabaseOAuthError("revoke_failed", `Busabase OAuth revocation failed (${response.status})`, response.status);
+}
+//#endregion
+export { parseBusabaseOAuthCallback as a, revokeBusabaseOAuthToken as c, exchangeBusabaseOAuthCode as i, BUSABASE_AIRAPP_CLIENT_ID as l, BusabaseOAuthError as n, refreshBusabaseOAuthToken as o, createBusabaseOAuthRequest as r, registerBusabaseAirAppOAuthClient as s, AIRAPP_OAUTH_SCOPE as t };

package/dist/oauth-FfuT0EGC.d.ts

@@ -0,0 +1,69 @@
+//#region ../../packages/busabase-contract/src/auth/device-authorization.d.ts
+/** Public client identifier used by local Hono/AirApp development servers. */
+declare const BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
+//#endregion
+//#region src/oauth.d.ts
+/** The only scope an AirApp ever requests; bound to the `/api/v1` resource. */
+declare const AIRAPP_OAUTH_SCOPE = "api";
+interface BusabaseOAuthRequest {
+  authorizeUrl: string;
+  baseUrl: string;
+  clientId: string;
+  codeVerifier: string;
+  redirectUri: string;
+  resource: string;
+  state: string;
+}
+interface CreateBusabaseOAuthRequestInput {
+  baseUrl: string;
+  redirectUri: string;
+  clientId?: string;
+  state?: string;
+  prompt?: "login";
+}
+interface BusabaseOAuthTokenSet {
+  accessToken: string;
+  refreshToken?: string;
+  expiresIn: number;
+  expiresAt: string;
+  scope: string[];
+  tokenType: string;
+  user?: {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+  };
+}
+interface RegisterBusabaseAirAppOAuthClientInput {
+  appId: string;
+  baseUrl: string;
+  redirectUri: string;
+}
+declare class BusabaseOAuthError extends Error {
+  readonly code: string;
+  readonly status?: number;
+  constructor(code: string, message: string, status?: number);
+}
+/** Register an exact HTTPS callback for a public AirApp OAuth client. */
+declare function registerBusabaseAirAppOAuthClient(input: RegisterBusabaseAirAppOAuthClientInput, fetchImpl?: typeof fetch): Promise<{
+  clientId: string;
+  redirectUri: string;
+}>;
+/** Build a public-client OAuth 2.1 authorization request with PKCE S256. */
+declare function createBusabaseOAuthRequest(input: CreateBusabaseOAuthRequestInput): Promise<BusabaseOAuthRequest>;
+/** Validate state and issuer before accepting the authorization code. */
+declare function parseBusabaseOAuthCallback(callbackUrl: string, request: BusabaseOAuthRequest): string;
+declare function exchangeBusabaseOAuthCode(request: BusabaseOAuthRequest, code: string, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
+declare function refreshBusabaseOAuthToken(input: {
+  baseUrl: string;
+  refreshToken: string;
+  clientId?: string;
+}, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
+declare function revokeBusabaseOAuthToken(input: {
+  baseUrl: string;
+  token: string;
+  clientId?: string;
+}, fetchImpl?: typeof fetch): Promise<void>;
+//#endregion
+export { CreateBusabaseOAuthRequestInput as a, exchangeBusabaseOAuthCode as c, registerBusabaseAirAppOAuthClient as d, revokeBusabaseOAuthToken as f, BusabaseOAuthTokenSet as i, parseBusabaseOAuthCallback as l, BusabaseOAuthError as n, RegisterBusabaseAirAppOAuthClientInput as o, BUSABASE_AIRAPP_CLIENT_ID as p, BusabaseOAuthRequest as r, createBusabaseOAuthRequest as s, AIRAPP_OAUTH_SCOPE as t, refreshBusabaseOAuthToken as u };

package/dist/oauth-node-DGiWkh_l.d.ts

@@ -0,0 +1,64 @@
+import { i as BusabaseOAuthTokenSet } from "./oauth-FfuT0EGC.js";
+//#region src/oauth-node.d.ts
+interface BusabaseAirAppOAuthCredential {
+  version: 1;
+  appId: string;
+  baseUrl: string;
+  clientId: string;
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: string;
+  scope: string[];
+  tokenType: string;
+  /** Validated target for this local AirApp. Tokens remain user-scoped. */
+  selectedSpace?: {
+    id: string;
+    name: string;
+  };
+}
+interface BusabaseAirAppCredentialStoreOptions {
+  /** Override only for tests or an explicitly isolated installation. */
+  rootDir?: string;
+}
+/** Directory containing one owner-only OAuth registration per local AirApp. */
+declare const busabaseAirAppCredentialsDir: (options?: BusabaseAirAppCredentialStoreOptions) => string;
+declare const busabaseAirAppCredentialPath: (appId: string, options?: BusabaseAirAppCredentialStoreOptions) => string;
+/**
+ * Dynamically registered public client ids, keyed by `${baseUrl}|${redirectUri}`.
+ *
+ * Kept out of the credential file because registration happens before any token exists, and the
+ * mapping must outlive both the process and a logout — re-registering on every restart would
+ * churn server-side client records and burn the registration rate limit.
+ */
+declare const busabaseAirAppDynamicClientsPath: (appId: string, options?: BusabaseAirAppCredentialStoreOptions) => string;
+declare function loadBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential | null;
+declare function storeBusabaseAirAppOAuthCredential(input: {
+  appId: string;
+  baseUrl: string;
+  tokenSet: BusabaseOAuthTokenSet;
+  clientId?: string;
+  selectedSpace?: BusabaseAirAppOAuthCredential["selectedSpace"];
+}, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential;
+/** Reuse a previously registered public client for this exact origin and callback. */
+declare function loadBusabaseAirAppDynamicClientId(input: {
+  appId: string;
+  baseUrl: string;
+  redirectUri: string;
+}, options?: BusabaseAirAppCredentialStoreOptions): string | null;
+declare function storeBusabaseAirAppDynamicClientId(input: {
+  appId: string;
+  baseUrl: string;
+  redirectUri: string;
+  clientId: string;
+}, options?: BusabaseAirAppCredentialStoreOptions): void;
+/** Load a valid access token, rotating and persisting the token set when needed. */
+declare function getBusabaseAirAppAccessToken(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<BusabaseAirAppOAuthCredential | null>;
+/** Persist a Space only after the caller has verified membership through `/api/v1/auth`. */
+declare function storeBusabaseAirAppSelectedSpace(appId: string, selectedSpace: {
+  id: string;
+  name: string;
+} | null, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential;
+declare function clearBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): void;
+declare function revokeBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<void>;
+//#endregion
+export { busabaseAirAppDynamicClientsPath as a, loadBusabaseAirAppDynamicClientId as c, storeBusabaseAirAppDynamicClientId as d, storeBusabaseAirAppOAuthCredential as f, busabaseAirAppCredentialsDir as i, loadBusabaseAirAppOAuthCredential as l, BusabaseAirAppOAuthCredential as n, clearBusabaseAirAppOAuthCredential as o, storeBusabaseAirAppSelectedSpace as p, busabaseAirAppCredentialPath as r, getBusabaseAirAppAccessToken as s, BusabaseAirAppCredentialStoreOptions as t, revokeBusabaseAirAppOAuthCredential as u };

package/dist/oauth-node.d.ts

@@ -1,64 +1,2 @@
-import { BusabaseOAuthTokenSet } from './oauth.js';
-
-interface BusabaseAirAppOAuthCredential {
-    version: 1;
-    appId: string;
-    baseUrl: string;
-    clientId: string;
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: string;
-    scope: string[];
-    tokenType: string;
-    /** Validated target for this local AirApp. Tokens remain user-scoped. */
-    selectedSpace?: {
-        id: string;
-        name: string;
-    };
-}
-interface BusabaseAirAppCredentialStoreOptions {
-    /** Override only for tests or an explicitly isolated installation. */
-    rootDir?: string;
-}
-/** Directory containing one owner-only OAuth registration per local AirApp. */
-declare const busabaseAirAppCredentialsDir: (options?: BusabaseAirAppCredentialStoreOptions) => string;
-declare const busabaseAirAppCredentialPath: (appId: string, options?: BusabaseAirAppCredentialStoreOptions) => string;
-/**
- * Dynamically registered public client ids, keyed by `${baseUrl}|${redirectUri}`.
- *
- * Kept out of the credential file because registration happens before any token exists, and the
- * mapping must outlive both the process and a logout — re-registering on every restart would
- * churn server-side client records and burn the registration rate limit.
- */
-declare const busabaseAirAppDynamicClientsPath: (appId: string, options?: BusabaseAirAppCredentialStoreOptions) => string;
-declare function loadBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential | null;
-declare function storeBusabaseAirAppOAuthCredential(input: {
-    appId: string;
-    baseUrl: string;
-    tokenSet: BusabaseOAuthTokenSet;
-    clientId?: string;
-    selectedSpace?: BusabaseAirAppOAuthCredential["selectedSpace"];
-}, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential;
-/** Reuse a previously registered public client for this exact origin and callback. */
-declare function loadBusabaseAirAppDynamicClientId(input: {
-    appId: string;
-    baseUrl: string;
-    redirectUri: string;
-}, options?: BusabaseAirAppCredentialStoreOptions): string | null;
-declare function storeBusabaseAirAppDynamicClientId(input: {
-    appId: string;
-    baseUrl: string;
-    redirectUri: string;
-    clientId: string;
-}, options?: BusabaseAirAppCredentialStoreOptions): void;
-/** Load a valid access token, rotating and persisting the token set when needed. */
-declare function getBusabaseAirAppAccessToken(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<BusabaseAirAppOAuthCredential | null>;
-/** Persist a Space only after the caller has verified membership through `/api/v1/auth`. */
-declare function storeBusabaseAirAppSelectedSpace(appId: string, selectedSpace: {
-    id: string;
-    name: string;
-} | null, options?: BusabaseAirAppCredentialStoreOptions): BusabaseAirAppOAuthCredential;
-declare function clearBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions): void;
-declare function revokeBusabaseAirAppOAuthCredential(appId: string, options?: BusabaseAirAppCredentialStoreOptions, fetchImpl?: typeof fetch): Promise<void>;
-
-export { type BusabaseAirAppCredentialStoreOptions, type BusabaseAirAppOAuthCredential, busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace };
+import { a as busabaseAirAppDynamicClientsPath, c as loadBusabaseAirAppDynamicClientId, d as storeBusabaseAirAppDynamicClientId, f as storeBusabaseAirAppOAuthCredential, i as busabaseAirAppCredentialsDir, l as loadBusabaseAirAppOAuthCredential, n as BusabaseAirAppOAuthCredential, o as clearBusabaseAirAppOAuthCredential, p as storeBusabaseAirAppSelectedSpace, r as busabaseAirAppCredentialPath, s as getBusabaseAirAppAccessToken, t as BusabaseAirAppCredentialStoreOptions, u as revokeBusabaseAirAppOAuthCredential } from "./oauth-node-DGiWkh_l.js";
+export { BusabaseAirAppCredentialStoreOptions, BusabaseAirAppOAuthCredential, busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace };

package/dist/oauth-node.js

@@ -1,3 +1,188 @@
-export { busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace } from './chunk-C23JVY2Y.js';
-import './chunk-WSHJMHUS.js';
-import './chunk-5NYQX65A.js';
+import { t as normalizeBaseUrl } from "./url-B8GMXalA.js";
+import { c as revokeBusabaseOAuthToken, n as BusabaseOAuthError, o as refreshBusabaseOAuthToken } from "./oauth-Dg2Z41RP.js";
+import { randomUUID } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+//#region src/oauth-node.ts
+const STORE_VERSION = 1;
+const APP_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const REFRESH_WINDOW_MS = 6e4;
+const refreshesByCredentialPath = /* @__PURE__ */ new Map();
+const assertAppId = (appId) => {
+	if (!APP_ID_RE.test(appId)) throw new BusabaseOAuthError("invalid_airapp_id", "AirApp id must use letters, digits, dot, dash, or underscore");
+	return appId;
+};
+const storeRoot = (options = {}) => options.rootDir ?? join(homedir(), ".busabase");
+/** Directory containing one owner-only OAuth registration per local AirApp. */
+const busabaseAirAppCredentialsDir = (options = {}) => join(storeRoot(options), "airapps");
+const busabaseAirAppCredentialPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.json`);
+/**
+* Dynamically registered public client ids, keyed by `${baseUrl}|${redirectUri}`.
+*
+* Kept out of the credential file because registration happens before any token exists, and the
+* mapping must outlive both the process and a logout — re-registering on every restart would
+* churn server-side client records and burn the registration rate limit.
+*/
+const busabaseAirAppDynamicClientsPath = (appId, options = {}) => join(busabaseAirAppCredentialsDir(options), `${assertAppId(appId)}.clients.json`);
+const normalizeOrigin = (raw) => {
+	const url = new URL(normalizeBaseUrl(raw));
+	if (url.username || url.password || url.search || url.hash) throw new BusabaseOAuthError("invalid_base_url", "Busabase base URL must be an origin");
+	return url.origin;
+};
+const writeOwnerOnlyJson = (path, value) => {
+	const directory = dirname(path);
+	mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(directory, 448);
+	} catch {}
+	const temporaryPath = `${path}.${randomUUID()}.tmp`;
+	writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+	try {
+		chmodSync(temporaryPath, 384);
+	} catch {}
+	renameSync(temporaryPath, path);
+};
+const parseCredential = (raw, expectedAppId) => {
+	let value;
+	try {
+		value = JSON.parse(raw);
+	} catch {
+		throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+	}
+	const item = value;
+	if (item.version !== STORE_VERSION || item.appId !== expectedAppId || typeof item.baseUrl !== "string" || typeof item.clientId !== "string" || typeof item.accessToken !== "string" || typeof item.refreshToken !== "string" || typeof item.expiresAt !== "string" || !Array.isArray(item.scope) || item.scope.some((scope) => typeof scope !== "string") || typeof item.tokenType !== "string") throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+	if (item.selectedSpace !== void 0 && (typeof item.selectedSpace !== "object" || item.selectedSpace === null || typeof item.selectedSpace.id !== "string" || typeof item.selectedSpace.name !== "string")) throw new BusabaseOAuthError("invalid_local_credential", "AirApp OAuth credential is invalid");
+	return item;
+};
+function loadBusabaseAirAppOAuthCredential(appId, options = {}) {
+	const path = busabaseAirAppCredentialPath(appId, options);
+	try {
+		return parseCredential(readFileSync(path, "utf8"), appId);
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+function storeBusabaseAirAppOAuthCredential(input, options = {}) {
+	if (!input.tokenSet.refreshToken) throw new BusabaseOAuthError("missing_refresh_token", "A refresh token is required for a persistent local AirApp login");
+	const credential = {
+		version: STORE_VERSION,
+		appId: assertAppId(input.appId),
+		baseUrl: normalizeOrigin(input.baseUrl),
+		clientId: input.clientId ?? "busabase-airapp",
+		accessToken: input.tokenSet.accessToken,
+		refreshToken: input.tokenSet.refreshToken,
+		expiresAt: input.tokenSet.expiresAt,
+		scope: input.tokenSet.scope,
+		tokenType: input.tokenSet.tokenType,
+		...input.selectedSpace ? { selectedSpace: input.selectedSpace } : {}
+	};
+	writeOwnerOnlyJson(busabaseAirAppCredentialPath(input.appId, options), credential);
+	return credential;
+}
+const dynamicClientKey = (baseUrl, redirectUri) => `${normalizeOrigin(baseUrl)}|${new URL(redirectUri).toString()}`;
+const loadDynamicClientRegistry = (appId, options) => {
+	const empty = {
+		version: STORE_VERSION,
+		appId: assertAppId(appId),
+		clients: {}
+	};
+	let raw;
+	try {
+		raw = readFileSync(busabaseAirAppDynamicClientsPath(appId, options), "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return empty;
+		throw error;
+	}
+	try {
+		const value = JSON.parse(raw);
+		if (value.version !== STORE_VERSION || value.appId !== appId || typeof value.clients !== "object" || value.clients === null) return empty;
+		const clients = Object.fromEntries(Object.entries(value.clients).filter(([, clientId]) => typeof clientId === "string"));
+		return {
+			...empty,
+			clients
+		};
+	} catch {
+		return empty;
+	}
+};
+/** Reuse a previously registered public client for this exact origin and callback. */
+function loadBusabaseAirAppDynamicClientId(input, options = {}) {
+	return loadDynamicClientRegistry(input.appId, options).clients[dynamicClientKey(input.baseUrl, input.redirectUri)] ?? null;
+}
+function storeBusabaseAirAppDynamicClientId(input, options = {}) {
+	const registry = loadDynamicClientRegistry(input.appId, options);
+	const key = dynamicClientKey(input.baseUrl, input.redirectUri);
+	delete registry.clients[key];
+	const entries = [...Object.entries(registry.clients), [key, input.clientId]];
+	writeOwnerOnlyJson(busabaseAirAppDynamicClientsPath(input.appId, options), {
+		...registry,
+		clients: Object.fromEntries(entries.slice(-32))
+	});
+}
+/** Load a valid access token, rotating and persisting the token set when needed. */
+async function getBusabaseAirAppAccessToken(appId, options = {}, fetchImpl = fetch) {
+	const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+	if (!credential) return null;
+	const expiresAt = Date.parse(credential.expiresAt);
+	if (Number.isFinite(expiresAt) && expiresAt > Date.now() + REFRESH_WINDOW_MS) return credential;
+	const credentialPath = busabaseAirAppCredentialPath(appId, options);
+	const activeRefresh = refreshesByCredentialPath.get(credentialPath);
+	if (activeRefresh) return activeRefresh;
+	const refresh = (async () => {
+		const tokenSet = await refreshBusabaseOAuthToken({
+			baseUrl: credential.baseUrl,
+			refreshToken: credential.refreshToken,
+			clientId: credential.clientId
+		}, fetchImpl);
+		return storeBusabaseAirAppOAuthCredential({
+			appId,
+			baseUrl: credential.baseUrl,
+			clientId: credential.clientId,
+			tokenSet: {
+				...tokenSet,
+				refreshToken: tokenSet.refreshToken ?? credential.refreshToken
+			},
+			selectedSpace: credential.selectedSpace
+		}, options);
+	})();
+	refreshesByCredentialPath.set(credentialPath, refresh);
+	try {
+		return await refresh;
+	} finally {
+		if (refreshesByCredentialPath.get(credentialPath) === refresh) refreshesByCredentialPath.delete(credentialPath);
+	}
+}
+/** Persist a Space only after the caller has verified membership through `/api/v1/auth`. */
+function storeBusabaseAirAppSelectedSpace(appId, selectedSpace, options = {}) {
+	const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+	if (!credential) throw new BusabaseOAuthError("missing_local_credential", "Connect this local AirApp before selecting a Space");
+	const next = {
+		...credential,
+		...selectedSpace ? { selectedSpace } : { selectedSpace: void 0 }
+	};
+	writeOwnerOnlyJson(busabaseAirAppCredentialPath(appId, options), next);
+	return next;
+}
+function clearBusabaseAirAppOAuthCredential(appId, options = {}) {
+	rmSync(busabaseAirAppCredentialPath(appId, options), { force: true });
+}
+async function revokeBusabaseAirAppOAuthCredential(appId, options = {}, fetchImpl = fetch) {
+	const credential = loadBusabaseAirAppOAuthCredential(appId, options);
+	if (!credential) return;
+	try {
+		await revokeBusabaseOAuthToken({
+			baseUrl: credential.baseUrl,
+			token: credential.refreshToken,
+			clientId: credential.clientId
+		}, fetchImpl);
+	} finally {
+		clearBusabaseAirAppOAuthCredential(appId, options);
+	}
+}
+//#endregion
+export { busabaseAirAppCredentialPath, busabaseAirAppCredentialsDir, busabaseAirAppDynamicClientsPath, clearBusabaseAirAppOAuthCredential, getBusabaseAirAppAccessToken, loadBusabaseAirAppDynamicClientId, loadBusabaseAirAppOAuthCredential, revokeBusabaseAirAppOAuthCredential, storeBusabaseAirAppDynamicClientId, storeBusabaseAirAppOAuthCredential, storeBusabaseAirAppSelectedSpace };

package/dist/oauth.d.ts

@@ -1,67 +1,2 @@
-/** Public client identifier used by local Hono/AirApp development servers. */
-declare const BUSABASE_AIRAPP_CLIENT_ID = "busabase-airapp";
-
-/** The only scope an AirApp ever requests; bound to the `/api/v1` resource. */
-declare const AIRAPP_OAUTH_SCOPE = "api";
-interface BusabaseOAuthRequest {
-    authorizeUrl: string;
-    baseUrl: string;
-    clientId: string;
-    codeVerifier: string;
-    redirectUri: string;
-    resource: string;
-    state: string;
-}
-interface CreateBusabaseOAuthRequestInput {
-    baseUrl: string;
-    redirectUri: string;
-    clientId?: string;
-    state?: string;
-    prompt?: "login";
-}
-interface BusabaseOAuthTokenSet {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn: number;
-    expiresAt: string;
-    scope: string[];
-    tokenType: string;
-    user?: {
-        id: string;
-        name: string;
-        email: string;
-        image: string | null;
-    };
-}
-interface RegisterBusabaseAirAppOAuthClientInput {
-    appId: string;
-    baseUrl: string;
-    redirectUri: string;
-}
-declare class BusabaseOAuthError extends Error {
-    readonly code: string;
-    readonly status?: number;
-    constructor(code: string, message: string, status?: number);
-}
-/** Register an exact HTTPS callback for a public AirApp OAuth client. */
-declare function registerBusabaseAirAppOAuthClient(input: RegisterBusabaseAirAppOAuthClientInput, fetchImpl?: typeof fetch): Promise<{
-    clientId: string;
-    redirectUri: string;
-}>;
-/** Build a public-client OAuth 2.1 authorization request with PKCE S256. */
-declare function createBusabaseOAuthRequest(input: CreateBusabaseOAuthRequestInput): Promise<BusabaseOAuthRequest>;
-/** Validate state and issuer before accepting the authorization code. */
-declare function parseBusabaseOAuthCallback(callbackUrl: string, request: BusabaseOAuthRequest): string;
-declare function exchangeBusabaseOAuthCode(request: BusabaseOAuthRequest, code: string, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
-declare function refreshBusabaseOAuthToken(input: {
-    baseUrl: string;
-    refreshToken: string;
-    clientId?: string;
-}, fetchImpl?: typeof fetch): Promise<BusabaseOAuthTokenSet>;
-declare function revokeBusabaseOAuthToken(input: {
-    baseUrl: string;
-    token: string;
-    clientId?: string;
-}, fetchImpl?: typeof fetch): Promise<void>;
-
-export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, type BusabaseOAuthRequest, type BusabaseOAuthTokenSet, type CreateBusabaseOAuthRequestInput, type RegisterBusabaseAirAppOAuthClientInput, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken };
+import { a as CreateBusabaseOAuthRequestInput, c as exchangeBusabaseOAuthCode, d as registerBusabaseAirAppOAuthClient, f as revokeBusabaseOAuthToken, i as BusabaseOAuthTokenSet, l as parseBusabaseOAuthCallback, n as BusabaseOAuthError, o as RegisterBusabaseAirAppOAuthClientInput, p as BUSABASE_AIRAPP_CLIENT_ID, r as BusabaseOAuthRequest, s as createBusabaseOAuthRequest, t as AIRAPP_OAUTH_SCOPE, u as refreshBusabaseOAuthToken } from "./oauth-FfuT0EGC.js";
+export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, BusabaseOAuthRequest, BusabaseOAuthTokenSet, CreateBusabaseOAuthRequestInput, RegisterBusabaseAirAppOAuthClientInput, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken };

package/dist/oauth.js

@@ -1,2 +1,2 @@
-export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken } from './chunk-WSHJMHUS.js';
-import './chunk-5NYQX65A.js';
+import { a as parseBusabaseOAuthCallback, c as revokeBusabaseOAuthToken, i as exchangeBusabaseOAuthCode, l as BUSABASE_AIRAPP_CLIENT_ID, n as BusabaseOAuthError, o as refreshBusabaseOAuthToken, r as createBusabaseOAuthRequest, s as registerBusabaseAirAppOAuthClient, t as AIRAPP_OAUTH_SCOPE } from "./oauth-Dg2Z41RP.js";
+export { AIRAPP_OAUTH_SCOPE, BUSABASE_AIRAPP_CLIENT_ID, BusabaseOAuthError, createBusabaseOAuthRequest, exchangeBusabaseOAuthCode, parseBusabaseOAuthCallback, refreshBusabaseOAuthToken, registerBusabaseAirAppOAuthClient, revokeBusabaseOAuthToken };

package/dist/url-B8GMXalA.js

@@ -0,0 +1,10 @@
+//#region src/url.ts
+/**
+* Normalize a user-supplied base URL to the server root. The API contract
+* already carries `/api/v1`, so accept either form and strip the suffix.
+*/
+function normalizeBaseUrl(raw) {
+	return raw.replace(/\/+$/, "").replace(/\/api\/v1$/, "");
+}
+//#endregion
+export { normalizeBaseUrl as t };