fauna-api 1.0.686 → 1.0.692

package/dist/src/shared/server.d.ts

@@ -1,3 +1,4 @@
+import { Fauna } from "../../index.js";
 import { ApiKey, Credentials, Profile } from "../authentification.js";
 export type Authorization = {
     authorization: Credentials | ApiKey;
@@ -63,3 +64,25 @@ export declare class Room {
     generateAccessCode(): Promise<string>;
 }
 export declare function connect(authorization: Authorization, endpoint: string, hooks?: Hooks): Promise<Presence>;
+/** A code you own: a room you shared, or a file link. */
+export type AccessCode = {
+    code: string;
+    /** What it opens, e.g. `parrot:chat:{id}` or `file:{path}`. */
+    reference: string;
+    /** True when people who join with it may act in the room, not only watch. */
+    write: boolean;
+    expires: Date;
+};
+export declare const AccessCode: {
+    fromJSON(json: any): AccessCode;
+};
+/**
+ * The access codes you own, the one that lasts longest first: your room shares
+ * and file links, and the ones you made for your groups.
+ */
+export declare function listAccessCodes(authorization: Credentials | ApiKey, query: {
+    cursor: number;
+    max: number;
+}): Promise<AccessCode[]>;
+/** Revoke one of your access codes. It stops working at once; anyone in a room with it is disconnected. */
+export declare function revokeAccessCode(authorization: Credentials | ApiKey, code: string): Promise<void>;

package/dist/src/shared/server.js

@@ -1,3 +1,4 @@
+import { Fauna } from "../../index.js";
 export class Presence {
     constructor(room, id, profile) {
         Object.defineProperty(this, "room", {
@@ -300,3 +301,43 @@ export async function connect(authorization, endpoint, hooks = {}) {
         };
     });
 }
+export const AccessCode = {
+    fromJSON(json) {
+        return {
+            code: String(json.code ?? ""),
+            reference: String(json.reference ?? ""),
+            write: json.write === true,
+            expires: new Date(json.expires),
+        };
+    },
+};
+/**
+ * The access codes you own, the one that lasts longest first: your room shares
+ * and file links, and the ones you made for your groups.
+ */
+export async function listAccessCodes(authorization, query) {
+    const params = new URLSearchParams({ cursor: String(query.cursor), max: String(query.max) });
+    const response = await fetch(`${Fauna.getURL()}/access-codes?${params}`, {
+        method: "GET",
+        headers: {
+            Authorization: 'email' in authorization ? `Token ${authorization.token}` : `ApiKey ${authorization.id}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(await response.text());
+    }
+    const json = await response.json();
+    return (Array.isArray(json) ? json : []).map((row) => AccessCode.fromJSON(row));
+}
+/** Revoke one of your access codes. It stops working at once; anyone in a room with it is disconnected. */
+export async function revokeAccessCode(authorization, code) {
+    const response = await fetch(`${Fauna.getURL()}/access-codes/${encodeURIComponent(code)}`, {
+        method: "DELETE",
+        headers: {
+            Authorization: 'email' in authorization ? `Token ${authorization.token}` : `ApiKey ${authorization.id}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(await response.text());
+    }
+}

package/dist/src/ui/authentification.d.ts

@@ -1,13 +1,17 @@
+import { Fauna } from "fauna-api";
 export declare function getToken(): string | undefined;
 export declare function setToken(token: string): void;
 export declare function clearToken(): void;
+/** Signs this browser out: ends the session on the server, then forgets the login cookie. */
+export declare function signOut(credentials: Fauna.Authentification.Credentials): Promise<void>;
 /** Whether this tab is a support session opened from Fauna's ticket board. */
 export declare function isSupportView(): boolean;
 /**
- * Takes `token` and `support` off a page's query. A support token stays in this tab; any other token
+ * Takes `handoff` and `support` off a page's query (and the address bar, before anything else loads),
+ * then redeems the handoff code for its session. A support session stays in this tab; any other
  * becomes the login cookie and ends the tab's support session. Returns whether the query changed.
  */
-export declare function takeTokenFromURL(params: URLSearchParams): boolean;
+export declare function takeHandoffFromURL(params: URLSearchParams): Promise<boolean>;
 /** The token this tab signs in with: the support session's in a support view, else the login cookie. */
 export declare function sessionToken(): string | undefined;
 export type OAuthProvider = 'google' | 'microsoft';

package/dist/src/ui/authentification.js

@@ -44,8 +44,17 @@ export function clearToken() {
         return;
     document.cookie = `${CREDENTIALS_COOKIE}=; ${cookieSuffix(0)}`;
 }
-// Support sessions: Fauna's ticket board opens a reporter's page with `?token=...&support=1`.
-// That token belongs to the reporter, so it lives in this tab only and never replaces the login cookie.
+/** Signs this browser out: ends the session on the server, then forgets the login cookie. */
+export async function signOut(credentials) {
+    try {
+        await Fauna.Authentification.signOut(credentials);
+    }
+    finally {
+        clearToken();
+    }
+}
+// Support sessions: Fauna's ticket board opens a reporter's page with `?handoff=...&support=1`.
+// That session belongs to the reporter, so it lives in this tab only and never replaces the login cookie.
 const SUPPORT_TOKEN_KEY = 'fauna-support-token';
 function readSupportToken() {
     try {
@@ -60,13 +69,32 @@ export function isSupportView() {
     return Boolean(readSupportToken());
 }
 /**
- * Takes `token` and `support` off a page's query. A support token stays in this tab; any other token
+ * Takes `handoff` and `support` off a page's query (and the address bar, before anything else loads),
+ * then redeems the handoff code for its session. A support session stays in this tab; any other
  * becomes the login cookie and ends the tab's support session. Returns whether the query changed.
  */
-export function takeTokenFromURL(params) {
-    const token = params.get('token');
-    const changed = Boolean(token) || params.has('support');
-    if (token && params.get('support') === '1') {
+export async function takeHandoffFromURL(params) {
+    const code = params.get('handoff');
+    const support = params.get('support') === '1';
+    const changed = Boolean(code) || params.has('support');
+    params.delete('handoff');
+    params.delete('support');
+    if (changed && typeof location !== 'undefined') {
+        const url = new URL(location.href);
+        url.searchParams.delete('handoff');
+        url.searchParams.delete('support');
+        history.replaceState(history.state, '', url);
+    }
+    if (!code)
+        return changed;
+    let token;
+    try {
+        token = await Fauna.Authentification.redeemHandoff(code);
+    }
+    catch {
+        return changed;
+    }
+    if (support) {
         try {
             sessionStorage.setItem(SUPPORT_TOKEN_KEY, token);
         }
@@ -74,7 +102,7 @@ export function takeTokenFromURL(params) {
             /* no tab storage: drop it rather than sign in as the reporter */
         }
     }
-    else if (token) {
+    else {
         try {
             sessionStorage.removeItem(SUPPORT_TOKEN_KEY);
         }
@@ -83,8 +111,6 @@ export function takeTokenFromURL(params) {
         }
         setToken(token);
     }
-    params.delete('token');
-    params.delete('support');
     return changed;
 }
 /** The token this tab signs in with: the support session's in a support view, else the login cookie. */

package/dist/src/ui/browser.js

@@ -388,7 +388,7 @@ export function createBrowser(container, options) {
     gsap.set(cursorHost, { x: 0, y: 0, scale: 1 });
     const replayer = new DomReplayer(frame);
     let toolTl = null;
-    // Only a full document replays in its own frame; a fragment shares this page's document.
+    // Until the first replay's frame loads, the replayer's document is still this page's.
     const caret = caretPainter(() => {
         const doc = replayer.getDocument();
         return doc === document ? null : doc;

package/dist/src/ui/chat.js

@@ -3,7 +3,6 @@ import { useLayoutEffect, useImperativeHandle, useMemo, useRef, useState, forwar
 import { createRoot } from "react-dom/client";
 import { flushSync } from "react-dom";
 import gsap from "gsap";
-import { marked } from "marked";
 import { Fauna } from "fauna-api";
 import { mimeFromFileName } from "../marmot/media.js";
 import { createTokenizedInput, parseRichText, toPlainText, hasTokens } from "./tokenized.js";
@@ -14,6 +13,7 @@ import { createTooltip } from "./hover.js";
 import { sendInformaticToast } from "./toast.js";
 import { buildAvatar, createSelector, stampModelAvatar, stampUserAvatar } from "./generative.js";
 import { authorColorSeed, colorFromSeed } from "./cursor.js";
+import { render as renderMarkdown } from "./markdown.js";
 // Re-export so apps can flatten serialized token markers (e.g. before sending
 // history to the LLM) without reaching into the tokenized-input module.
 export { toPlainText } from "./tokenized.js";
@@ -56,7 +56,8 @@ function webResults(call, query) {
     for (const result of JSON.parse(String(call.result))) {
         const link = document.createElement('a');
         link.className = 'chat-tool-web-source';
-        link.href = result.url;
+        if (/^https?:/i.test(result.url))
+            link.href = result.url;
         link.target = '_blank';
         link.rel = 'noopener';
         const title = document.createElement('span');
@@ -153,7 +154,7 @@ function buildMessageToken(token, opts) {
 // render text segments as plain text and hydrate each marker into a chip.
 function renderRichText(textEl, text, opts) {
     if (!hasTokens(text)) {
-        textEl.innerHTML = marked.parse(text);
+        textEl.innerHTML = renderMarkdown(text);
         return;
     }
     for (const part of parseRichText(text)) {
@@ -369,7 +370,7 @@ function createStreamRenderer(modelEl, messagesEl, renderToolCall) {
     // just behind the incoming text.
     function renderShown() {
         if (currentTextEl)
-            currentTextEl.innerHTML = marked.parse(currentBuffer.slice(0, shown));
+            currentTextEl.innerHTML = renderMarkdown(currentBuffer.slice(0, shown));
     }
     function stopReveal() {
         if (rafId !== null) {
@@ -418,6 +419,7 @@ function createStreamRenderer(modelEl, messagesEl, renderToolCall) {
                     const stored = toolCalls.find((item) => item.id === id);
                     const changed = stored.status !== call.status
                         || stored.result !== call.result
+                        || stored.session?.reference !== call.session?.reference
                         || stored.session?.code !== call.session?.code
                         || (call.status === 'running' && stored.progress !== call.progress);
                     if (!changed)
@@ -464,7 +466,7 @@ function createStreamRenderer(modelEl, messagesEl, renderToolCall) {
             if (currentBuffer) {
                 completedSegments.push(currentBuffer);
                 if (currentTextEl) {
-                    currentTextEl.innerHTML = await marked.parse(currentBuffer);
+                    currentTextEl.innerHTML = renderMarkdown(currentBuffer);
                 }
             }
             autoScroll(messagesEl);
@@ -499,7 +501,7 @@ function createStreamRenderer(modelEl, messagesEl, renderToolCall) {
             shown = trailing.length;
             ensureTextEl();
             if (currentTextEl)
-                currentTextEl.innerHTML = marked.parse(trailing);
+                currentTextEl.innerHTML = renderMarkdown(trailing);
         },
     };
 }

package/dist/src/ui/chatSequence.d.ts

@@ -1,7 +1,8 @@
-/** The live room a tool opened, to watch it: a browser, or a machine's desktop, by access code. */
+/** The live room a tool opened, to watch it: a browser, joined with its access code, or a machine's desktop, joined by reference by the people who may use the machine. */
 export type ToolSession = {
     kind: 'browser' | 'desktop';
-    code: string;
+    reference: string;
+    code?: string;
     url?: string;
 };
 export type ChatSequenceToolCall = {

package/dist/src/ui/chatSequence.js

@@ -1,7 +1,12 @@
 function toolSession(raw) {
-    if (!raw || typeof raw.code !== 'string' || !raw.code)
+    if (!raw || typeof raw.reference !== 'string' || !raw.reference)
         return undefined;
-    return { kind: raw.kind === 'desktop' ? 'desktop' : 'browser', code: raw.code, ...(typeof raw.url === 'string' && raw.url ? { url: raw.url } : {}) };
+    return {
+        kind: raw.kind === 'desktop' ? 'desktop' : 'browser',
+        reference: raw.reference,
+        ...(typeof raw.code === 'string' && raw.code ? { code: raw.code } : {}),
+        ...(typeof raw.url === 'string' && raw.url ? { url: raw.url } : {}),
+    };
 }
 export function roomPartsToChatFields(parts) {
     const texts = [];

package/dist/src/ui/drive.js

@@ -233,7 +233,7 @@ export function createFileElement(file, options = {}) {
     name.readOnly = true;
     label.appendChild(name);
     const type = document.createElement('span');
-    type.innerHTML = extensionFor(file.contentType, file.name).toUpperCase();
+    type.textContent = extensionFor(file.contentType, file.name).toUpperCase();
     label.appendChild(type);
     const opts = document.createElement('div');
     opts.className = `file-${view}-options`;

package/dist/src/ui/index.d.ts

@@ -15,6 +15,7 @@ import * as BrowserUI from "./browser.js";
 import * as RosterUI from "./roster.js";
 import * as MapsUI from "./maps.js";
 import * as ViewUI from "./view.js";
+import * as MarkdownUI from "./markdown.js";
 export declare namespace UI {
     function setRoute(route: string): void;
     function getIP(): string;
@@ -39,4 +40,5 @@ export declare namespace UI {
     export import Roster = RosterUI;
     export import Maps = MapsUI;
     export import View = ViewUI;
+    export import Markdown = MarkdownUI;
 }

package/dist/src/ui/index.js

@@ -15,6 +15,7 @@ import * as BrowserUI from "./browser.js";
 import * as RosterUI from "./roster.js";
 import * as MapsUI from "./maps.js";
 import * as ViewUI from "./view.js";
+import * as MarkdownUI from "./markdown.js";
 export var UI;
 (function (UI) {
     var PREFIX = 'https://';
@@ -84,4 +85,5 @@ export var UI;
     UI.Roster = RosterUI;
     UI.Maps = MapsUI;
     UI.View = ViewUI;
+    UI.Markdown = MarkdownUI;
 })(UI || (UI = {}));

package/dist/src/ui/maps.d.ts

@@ -1,5 +1,5 @@
 import { type CSSProperties } from "react";
-import maplibregl from "maplibre-gl";
+import * as maplibregl from "maplibre-gl";
 import type { ApiKey, Credentials } from "../authentification.js";
 import type { Group } from "../groups.js";
 import type { Coordinates, MapTheme, Place, Route, TravelMode, Units } from "../maps.js";

package/dist/src/ui/maps.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useLayoutEffect, useRef, useState } from "react";
 import { createRoot } from "react-dom/client";
-import maplibregl from "maplibre-gl";
+import * as maplibregl from "maplibre-gl";
 import { gsap } from "gsap";
 import { Fauna } from "fauna-api";
 function reducedMotion() {
@@ -368,6 +368,8 @@ function formatTime(value) {
 }
 /** Open where to book: a link, or a form posted in a new tab when the offer carries one. */
 export function openOffer(offer) {
+    if (!/^https?:/i.test(offer.url))
+        return;
     if (!offer.form) {
         window.open(offer.url, "_blank", "noopener");
         return;

package/dist/src/ui/markdown.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Markdown as HTML that is safe to put in the page, for text anyone else wrote: people,
+ * models, mail and the web.
+ */
+export declare function render(text: string): string;

package/dist/src/ui/markdown.js

@@ -0,0 +1,33 @@
+import { Marked } from "marked";
+function escapeHtml(text) {
+    return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+const LINK = /^(https:|mailto:)/i;
+const IMAGE = /^https:/i;
+/** Raw HTML shows as text, links go only to https or mail, and images only load over https. */
+const markdown = new Marked({
+    renderer: {
+        html({ text }) {
+            return escapeHtml(text);
+        },
+        link({ href, title, tokens }) {
+            const text = this.parser.parseInline(tokens);
+            if (!LINK.test(href))
+                return text;
+            return `<a href="${escapeHtml(href)}"${title ? ` title="${escapeHtml(title)}"` : ""} target="_blank" rel="noopener noreferrer">${text}</a>`;
+        },
+        image({ href, title, text, tokens }) {
+            const alt = escapeHtml(tokens ? this.parser.parseInline(tokens, this.parser.textRenderer) : text);
+            if (!IMAGE.test(href))
+                return alt;
+            return `<img src="${escapeHtml(href)}" alt="${alt}"${title ? ` title="${escapeHtml(title)}"` : ""}>`;
+        },
+    },
+});
+/**
+ * Markdown as HTML that is safe to put in the page, for text anyone else wrote: people,
+ * models, mail and the web.
+ */
+export function render(text) {
+    return markdown.parse(text, { async: false });
+}

package/dist/src/ui/toast.d.ts

@@ -1,6 +1,6 @@
 type ToastType = 'success' | 'error' | 'warning' | 'info';
-export declare function sendInformaticToast(html: string, type: ToastType, duration?: number): Promise<boolean>;
-export declare function sendProgressToast(html: string): {
+export declare function sendInformaticToast(text: string, type: ToastType, duration?: number): Promise<boolean>;
+export declare function sendProgressToast(text: string): {
     show: Promise<boolean>;
     setProgress: (progress: number) => void;
 };

package/dist/src/ui/toast.js

@@ -41,13 +41,13 @@ async function drain() {
     PROCESSING = false;
 }
 // ─── Public API (imperative, unchanged signatures) ────────────────────────────
-export async function sendInformaticToast(html, type, duration = 5000) {
+export async function sendInformaticToast(text, type, duration = 5000) {
     return new Promise((resolveShow) => {
         QUEUE.push(() => {
             let resolveDone;
             const done = new Promise((res) => { resolveDone = res; });
             const toast = {
-                state: { html, type, progress: null },
+                state: { text, type, progress: null },
                 done,
                 resolveDone,
                 resolveShow,
@@ -61,7 +61,7 @@ export async function sendInformaticToast(html, type, duration = 5000) {
         void drain();
     });
 }
-export function sendProgressToast(html) {
+export function sendProgressToast(text) {
     let setter = () => { };
     let current = 0;
     const show = new Promise((resolveShow) => {
@@ -73,7 +73,7 @@ export function sendProgressToast(html) {
             let resolveDone;
             const done = new Promise((res) => { resolveDone = res; });
             const toast = {
-                state: { html, type: 'info', progress: current },
+                state: { text, type: 'info', progress: current },
                 done,
                 resolveDone,
                 resolveShow,
@@ -246,7 +246,7 @@ function ToastRoot() {
                     borderRadius: 999,
                     background: `${p.accent}18`,
                     color: p.accent,
-                }, children: _jsx("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 2.4, strokeLinecap: "round", strokeLinejoin: "round", children: _jsx("path", { d: p.icon }) }) }), _jsx("span", { style: { flex: 1, minWidth: 0, overflowWrap: 'anywhere' }, dangerouslySetInnerHTML: { __html: state.html } }), _jsx("span", { "aria-hidden": "true", style: { flex: '0 0 auto', color: '#8d8981', fontSize: 16, lineHeight: 1 }, children: "\u00D7" }), state.progress !== null && (_jsx("span", { style: {
+                }, children: _jsx("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 2.4, strokeLinecap: "round", strokeLinejoin: "round", children: _jsx("path", { d: p.icon }) }) }), _jsx("span", { style: { flex: 1, minWidth: 0, overflowWrap: 'anywhere' }, children: state.text }), _jsx("span", { "aria-hidden": "true", style: { flex: '0 0 auto', color: '#8d8981', fontSize: 16, lineHeight: 1 }, children: "\u00D7" }), state.progress !== null && (_jsx("span", { style: {
                     position: 'absolute',
                     left: 0,
                     bottom: 0,

package/dist/src/webhooks.d.ts

@@ -12,6 +12,8 @@ export type Webhook = {
     id: string;
     url: string;
     events: EventType[];
+    /** Who made it. A webhook goes when its maker can no longer read what it listens to. */
+    creator?: Profile;
     created: Date;
 };
 /** What `create` resolves to. The secret is only ever returned here. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fauna-api",
-  "version": "1.0.686",
+  "version": "1.0.692",
   "description": "The Fauna SDK: accounts, Drive, groups, calendar, chats, payments and every Fauna app (Parrot, Marmot, Magpie, Cicada, Ant, Termite), plus React UI.",
   "homepage": "https://docs.faunakit.com",
   "repository": {
@@ -64,7 +64,7 @@
     "codemirror": "^6.0.2",
     "gsap": "^3.13.0",
     "isomorphic-ws": "^5.0.0",
-    "maplibre-gl": "^5.24.0",
+    "maplibre-gl": "^6.16.0",
     "marked": "^16.4.1",
     "y-codemirror.next": "^0.3.6",
     "yjs": "^13.6.33"