stitchkit 0.93.0 → 0.94.1

package/dist/entrypoints/oauth.js

@@ -0,0 +1,170 @@
+import {
+  deriveCodeChallenge
+} from "../index-hr4tzbwq.js";
+import {
+  bytesToBase64Url
+} from "../index-rxfy4cq7.js";
+
+// src/oauth/authorization-code.ts
+var TRANSACTION_VERSION = 1;
+var RESERVED_PARAMETERS = new Set([
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "scope",
+  "state",
+  "nonce",
+  "code_challenge",
+  "code_challenge_method"
+]);
+var ERROR_MESSAGES = {
+  INVALID_CONFIGURATION: "The OAuth client configuration is invalid.",
+  RESERVED_PARAMETER: "A provider parameter conflicts with the OAuth protocol.",
+  INVALID_CONTEXT: "The OAuth transaction context is invalid.",
+  STORAGE_FAILURE: "The OAuth transaction store is unavailable.",
+  MISSING_TRANSACTION: "The OAuth transaction is missing or was already consumed.",
+  MALFORMED_TRANSACTION: "The OAuth transaction is malformed.",
+  UNSUPPORTED_TRANSACTION_VERSION: "The OAuth transaction version is unsupported.",
+  STATE_MISMATCH: "The OAuth response state does not match the pending transaction."
+};
+
+class AuthorizationCodeClientError extends Error {
+  code;
+  constructor(code, options) {
+    super(ERROR_MESSAGES[code], options);
+    this.name = "AuthorizationCodeClientError";
+    this.code = code;
+  }
+}
+function recordOf(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+}
+function randomToken(crypto) {
+  return bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function runtimeCrypto() {
+  const runtime = globalThis.crypto;
+  if (!runtime?.subtle || typeof runtime.getRandomValues !== "function") {
+    throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+  }
+  return {
+    getRandomValues: (bytes) => runtime.getRandomValues(bytes),
+    subtle: runtime.subtle
+  };
+}
+function parseTransaction(raw, contextSchema) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  }
+  const record = recordOf(decoded);
+  if (!record)
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  if (record.version !== TRANSACTION_VERSION) {
+    throw new AuthorizationCodeClientError("UNSUPPORTED_TRANSACTION_VERSION");
+  }
+  const context = contextSchema.safeParse(record.context);
+  if (!context.success)
+    throw new AuthorizationCodeClientError("INVALID_CONTEXT");
+  if (typeof record.state !== "string" || typeof record.nonce !== "string" || typeof record.codeVerifier !== "string" || typeof record.redirectUri !== "string") {
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  }
+  return {
+    version: TRANSACTION_VERSION,
+    state: record.state,
+    nonce: record.nonce,
+    codeVerifier: record.codeVerifier,
+    redirectUri: record.redirectUri,
+    context: context.data
+  };
+}
+function createAuthorizationCodeClient(config) {
+  if (!config.authorizationEndpoint || !config.clientId || !config.redirectUri || !config.storageKey || config.scopes.length === 0 || config.scopes.some((scope) => !scope)) {
+    throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+  }
+  for (const parameter of Object.keys(config.authorizationParameters ?? {})) {
+    if (RESERVED_PARAMETERS.has(parameter)) {
+      throw new AuthorizationCodeClientError("RESERVED_PARAMETER");
+    }
+  }
+  return {
+    async begin({ context }) {
+      const parsedContext = config.contextSchema.safeParse(context);
+      if (!parsedContext.success)
+        throw new AuthorizationCodeClientError("INVALID_CONTEXT");
+      const crypto = config.crypto ?? runtimeCrypto();
+      const state = randomToken(crypto);
+      const nonce = randomToken(crypto);
+      const codeVerifier = randomToken(crypto);
+      const codeChallenge = await deriveCodeChallenge(codeVerifier, crypto.subtle);
+      let url;
+      try {
+        url = new URL(config.authorizationEndpoint);
+      } catch {
+        throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+      }
+      for (const [name, value] of Object.entries(config.authorizationParameters ?? {})) {
+        url.searchParams.set(name, value);
+      }
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      url.searchParams.set("redirect_uri", config.redirectUri);
+      url.searchParams.set("scope", config.scopes.join(" "));
+      url.searchParams.set("state", state);
+      url.searchParams.set("nonce", nonce);
+      url.searchParams.set("code_challenge", codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      const transaction = {
+        version: TRANSACTION_VERSION,
+        state,
+        nonce,
+        codeVerifier,
+        redirectUri: config.redirectUri,
+        context: parsedContext.data
+      };
+      try {
+        config.storage.setItem(config.storageKey, JSON.stringify(transaction));
+      } catch {
+        throw new AuthorizationCodeClientError("STORAGE_FAILURE");
+      }
+      return { authorizationUrl: url.toString() };
+    },
+    consume({ state }) {
+      let raw;
+      try {
+        raw = config.storage.getItem(config.storageKey);
+        config.storage.removeItem(config.storageKey);
+      } catch {
+        throw new AuthorizationCodeClientError("STORAGE_FAILURE");
+      }
+      if (raw === null)
+        throw new AuthorizationCodeClientError("MISSING_TRANSACTION");
+      const transaction = parseTransaction(raw, config.contextSchema);
+      if (transaction.state !== state)
+        throw new AuthorizationCodeClientError("STATE_MISMATCH");
+      return {
+        codeVerifier: transaction.codeVerifier,
+        nonce: transaction.nonce,
+        redirectUri: transaction.redirectUri,
+        context: transaction.context
+      };
+    }
+  };
+}
+function safeInternalReturnPath(candidate, fallback) {
+  const hasAsciiControl = [...candidate ?? ""].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (!candidate?.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\") || hasAsciiControl) {
+    return fallback;
+  }
+  return candidate;
+}
+export {
+  safeInternalReturnPath,
+  createAuthorizationCodeClient,
+  AuthorizationCodeClientError
+};

package/dist/entrypoints/observability.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `stitchkit/observability` — the audit layer one level above the raw hooks.
+ *
+ * W3C trace context, an `AsyncLocalStorage` request context, payload
+ * sanitisation, a normalised `RequestEvent`, and `createObservability` to wire
+ * framework-owned HTTP completion plus canonical tool hooks into independent
+ * sinks.
+ */
+export { createDimensionsProjector, createObservability, type DimensionsProjector, type DimensionsProjectorConfig, type HttpRequestCompletion, type HttpRequestObserver, type Observability, type ObservabilityConfig, type ObservabilityDrainBound, type ProjectedDimensions, type RequestEventSinkConfig, type RequestObservabilityConfig, type SinkDrop, type SinkDropReason, type SinkError, } from '../observability/audit.js';
+export { type BoundedLoggerBounds, type BoundedLoggerOptions, createBoundedLogger, DEFAULT_REDACT_PATHS, } from '../observability/bounded-logger.js';
+export { auditChanges } from '../observability/changes.js';
+export { type DimensionCollision, getRequestContext, getTraceId, getUserId, type RequestContext, type RequestContextKind, runWithRequestContext, type SetRequestDimensionsOptions, setRequestDimensions, setRequestEndpoint, setRequestError, setRequestUser, type WrapRequestContextOptions, wrapInRequestContext, } from '../observability/context.js';
+export type { RequestEvent } from '../observability/event.js';
+export { type JsonValue, measureSize, redact, type SanitizeOptions, type SizeMeasure, sanitizePayload, truncatePreview, } from '../observability/sanitize.js';
+export { createSpooledSink, type SpooledSink, type SpooledSinkConfig, type SpoolRecovery, } from '../observability/spool.js';
+export { type ObservabilityDrainReport, ObservabilityDrainReportSchema, type ObservabilitySinkStatus, ObservabilitySinkStatusSchema, type ObservabilityStatus, ObservabilityStatusSchema, } from '../observability/status.js';
+export { childSpan, createTraceContext, formatTraceparent, parseTraceparent, resolvePropagationContext, resolveTraceContext, type TraceContext, } from '../observability/trace.js';
+export { type RunUnitOfWorkOptions, runUnitOfWork } from '../observability/work.js';
+//# sourceMappingURL=observability.d.ts.map

package/dist/entrypoints/observability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../src/entrypoints/observability.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EACL,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,KAAK,yBAAyB,EAC9B,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,KAAK,SAAS,EACd,WAAW,EACX,MAAM,EACN,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC"}