teak-sdk 1.0.80 → 1.0.82

package/README.md

@@ -14,7 +14,10 @@ const client = createTeakClient({
 });
 ```
 
-Use the discovered endpoints and client ID for your OAuth surface. Refresh
+Use the discovered endpoints and client ID for your OAuth surface. The WorkOS
+Connect helpers (`createPkceChallenge`, `createConnectAuthorizeUrl`,
+`requestConnectTokens`, `fetchConnectOwnerId`, `disconnectConnectGrant`) cover
+PKCE sign-in, refresh, account binding and disconnect. Refresh
 discovery after sign-in or refresh failures. Keep tokens in your platform's secure
 storage; this package does not store credentials or open a browser.
 

package/dist/sdk.js

@@ -143,7 +143,7 @@ function discoverAuthServer(siteUrl, options = {}) {
     if (metadata.issuer !== servers[0]) {
       throw new Error("OAuth issuer mismatch");
     }
-    if (clientDocument.primary !== "betterauth" && clientDocument.primary !== "workos") {
+    if (clientDocument.primary !== "workos") {
       throw new Error("Unknown OAuth provider");
     }
     if (!(Array.isArray(metadata.code_challenge_methods_supported) && metadata.code_challenge_methods_supported.includes("S256"))) {
@@ -155,18 +155,14 @@ function discoverAuthServer(siteUrl, options = {}) {
         throw new Error("Missing OAuth client registration");
       }
     }
-    const expectedResource = clientDocument.primary === "workos" ? WORKOS_RESOURCES.mcp : `${site.origin}/mcp`;
-    if (resource.resource !== expectedResource) {
+    if (resource.resource !== WORKOS_RESOURCES.mcp) {
       throw new Error("OAuth resource mismatch");
     }
     return Object.freeze({
-      primary: clientDocument.primary,
+      primary: "workos",
       issuer: servers[0],
       authorizationEndpoint: validateUrl(metadata.authorization_endpoint).href,
       tokenEndpoint: validateUrl(metadata.token_endpoint).href,
-      ...metadata.revocation_endpoint === undefined ? {} : {
-        revocationEndpoint: validateUrl(metadata.revocation_endpoint).href
-      },
       resource: resource.resource,
       clients: Object.freeze(Object.fromEntries(OAUTH_SURFACES.map((surface) => [surface, clients[surface]])))
     });
@@ -183,6 +179,125 @@ function discoverAuthServer(siteUrl, options = {}) {
   });
   return pending;
 }
+// ../convex/client/workosConnect.ts
+var WORKOS_CONNECT_SCOPE = "openid profile email offline_access";
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var MAX_TOKEN_LIFETIME_SECONDS = 365 * 24 * 3600;
+var REQUEST_TIMEOUT_MS = 1e4;
+var base64Url = (bytes) => {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/[=]+$/, "");
+};
+var randomBase64Url = (byteLength) => base64Url(crypto.getRandomValues(new Uint8Array(byteLength)));
+var createPkceChallenge = async (verifier) => base64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+var apiResource = (auth) => new URL("/api", auth.resource).href;
+var createConnectAuthorizeUrl = (auth, params) => {
+  const url = new URL(auth.authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("resource", apiResource(auth));
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("scope", WORKOS_CONNECT_SCOPE);
+  url.searchParams.set("state", params.state);
+  return url;
+};
+var send = (url, init, local) => fetch(validateOAuthUrl(url, local).href, {
+  ...init,
+  credentials: "omit",
+  redirect: "error",
+  signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+});
+var readObject = async (response) => {
+  const text = await readResponseTextWithinLimit(response, MAX_RESPONSE_BYTES);
+  if (text === null) {
+    return null;
+  }
+  try {
+    const value = JSON.parse(text);
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+var requestConnectTokens = async (auth, options) => {
+  const response = await send(auth.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      ...options.grant,
+      client_id: options.clientId,
+      resource: apiResource(auth)
+    })
+  }, options.local ?? false);
+  const payload = await readObject(response);
+  const { status } = response;
+  if (!response.ok) {
+    if (status !== 400 && status !== 401) {
+      return { ok: false, reason: "failed", status };
+    }
+    const refreshTokenRejected = options.grant.grant_type === "refresh_token" && (payload?.error === "invalid_grant" || payload?.error === "invalid_refresh_token" || payload?.code === "invalid_refresh_token");
+    if (refreshTokenRejected) {
+      return { ok: false, reason: "refresh_token_rejected", status };
+    }
+    const clientRejected = payload?.error === "invalid_client" || payload?.error === "unauthorized_client";
+    return {
+      ok: false,
+      reason: clientRejected ? "client_rejected" : "rejected",
+      status
+    };
+  }
+  const expiresIn = payload?.expires_in;
+  const keepsRefreshToken = options.grant.grant_type === "refresh_token" && payload !== null && !("refresh_token" in payload);
+  const refreshToken = keepsRefreshToken ? options.grant.refresh_token : payload?.refresh_token;
+  if (typeof payload?.access_token !== "string" || !payload.access_token || typeof refreshToken !== "string" || !refreshToken || typeof expiresIn !== "number" || !Number.isSafeInteger(expiresIn) || expiresIn <= 0 || expiresIn > MAX_TOKEN_LIFETIME_SECONDS) {
+    return { ok: false, reason: "invalid_response", status };
+  }
+  return {
+    ok: true,
+    tokens: {
+      accessToken: payload.access_token,
+      refreshToken,
+      expiresAt: Date.now() + expiresIn * 1000,
+      expiresIn
+    }
+  };
+};
+var apiEndpoint = (apiUrl, path, local) => {
+  let base = validateOAuthUrl(apiUrl, local).href;
+  while (base.endsWith("/")) {
+    base = base.slice(0, -1);
+  }
+  return `${base.replace(/\/v1$/, "")}${path}`;
+};
+var disconnectConnectGrant = async (apiUrl, accessToken, options = {}) => {
+  const local = options.local ?? false;
+  const endpoint = apiEndpoint(apiUrl, "/v1/oauth/disconnect", local);
+  const disconnect = (token) => send(endpoint, { method: "POST", headers: { Authorization: `Bearer ${token}` } }, local);
+  let response = await disconnect(accessToken);
+  if (response.status === 401 && options.refreshAccessToken) {
+    const renewed = await options.refreshAccessToken();
+    if (renewed === null) {
+      return "refresh_rejected";
+    }
+    response = await disconnect(renewed);
+  }
+  return response.status === 204 ? "disconnected" : "unconfirmed";
+};
+var fetchConnectOwnerId = async (apiUrl, accessToken, options = {}) => {
+  const local = options.local ?? false;
+  const response = await send(apiEndpoint(apiUrl, "/v1/me", local), { headers: { Authorization: `Bearer ${accessToken}` } }, local);
+  if (!response.ok) {
+    return null;
+  }
+  const data = (await readObject(response))?.data;
+  const id = data && typeof data === "object" && "id" in data ? data.id : undefined;
+  return typeof id === "string" && id ? id : null;
+};
 // ../convex/shared/markdown.ts
 var MARKDOWN_CONTENT_MAX_BYTES = 512 * 1024;
 
@@ -986,13 +1101,20 @@ export {
   CARD_TYPES2 as CARD_TYPES,
   ERROR_CODES,
   TeakApiError,
+  WORKOS_CONNECT_SCOPE,
   buildCardsSearchParams,
+  createConnectAuthorizeUrl,
+  createPkceChallenge,
   createTeakClient,
+  disconnectConnectGrant,
   discoverAuthServer,
+  fetchConnectOwnerId,
   isCardType,
   isStringList,
   normalizeLimit,
   parseTags,
+  randomBase64Url,
+  requestConnectTokens,
   staticTokenProvider,
   validateOAuthUrl
 };

package/dist/types/client/authDiscovery.d.ts

@@ -4,9 +4,8 @@ export interface AuthDiscovery {
     readonly authorizationEndpoint: string;
     readonly clients: Readonly<Record<OAuthSurface, string>>;
     readonly issuer: string;
-    readonly primary: "betterauth" | "workos";
+    readonly primary: "workos";
     readonly resource: string;
-    readonly revocationEndpoint?: string;
     readonly tokenEndpoint: string;
 }
 export declare const validateOAuthUrl: (raw: unknown, local?: boolean) => URL;

package/dist/types/client/sdk.d.ts

@@ -1,4 +1,5 @@
 export { type AuthDiscovery, discoverAuthServer, type OAuthSurface, validateOAuthUrl, } from "./authDiscovery.js";
+export { type ConnectTokenResult, type ConnectTokens, createConnectAuthorizeUrl, createPkceChallenge, disconnectConnectGrant, fetchConnectOwnerId, randomBase64Url, requestConnectTokens, WORKOS_CONNECT_SCOPE, } from "./workosConnect.js";
 import { type CardType } from "../shared/constants.js";
 import type { FileKind, FilePreviewFacts } from "../shared/fileFormats.js";
 export type { CardType } from "../shared/constants.js";

package/dist/types/client/workosConnect.d.ts

@@ -0,0 +1,36 @@
+import { type AuthDiscovery } from "./authDiscovery.js";
+export declare const WORKOS_CONNECT_SCOPE = "openid profile email offline_access";
+export declare const randomBase64Url: (byteLength: number) => string;
+export declare const createPkceChallenge: (verifier: string) => Promise<string>;
+export declare const createConnectAuthorizeUrl: (auth: AuthDiscovery, params: {
+    clientId: string;
+    codeChallenge: string;
+    redirectUri: string;
+    state: string;
+}) => URL;
+export interface ConnectTokens {
+    accessToken: string;
+    expiresAt: number;
+    expiresIn: number;
+    refreshToken: string;
+}
+export type ConnectTokenResult = {
+    ok: true;
+    tokens: ConnectTokens;
+} | {
+    ok: false;
+    reason: "refresh_token_rejected" | "client_rejected" | "rejected" | "failed" | "invalid_response";
+    status: number;
+};
+export declare const requestConnectTokens: (auth: AuthDiscovery, options: {
+    clientId: string;
+    grant: Record<string, string>;
+    local?: boolean;
+}) => Promise<ConnectTokenResult>;
+export declare const disconnectConnectGrant: (apiUrl: string, accessToken: string, options?: {
+    local?: boolean;
+    refreshAccessToken?: () => Promise<string | null>;
+}) => Promise<"disconnected" | "unconfirmed" | "refresh_rejected">;
+export declare const fetchConnectOwnerId: (apiUrl: string, accessToken: string, options?: {
+    local?: boolean;
+}) => Promise<string | null>;

package/dist/types/shared/constants.d.ts

@@ -1,4 +1,5 @@
-export declare const SIGNUPS_PAUSED_MESSAGE = "New sign-ups are paused while we upgrade sign-in";
+export declare const SIGNUPS_PAUSED_MESSAGE = "New sign-ups are paused right now. Please try again later.";
+export declare const ACCOUNT_CHANGES_PAUSED_MESSAGE = "Account changes are paused right now. Please try again later.";
 export declare const cardTypes: readonly ["text", "link", "image", "video", "audio", "document", "palette", "quote"];
 export type CardType = (typeof cardTypes)[number];
 export declare const VISUAL_STYLE_TAXONOMY: readonly ["abstract", "cinematic", "dark", "illustrative", "minimal", "monochrome", "moody", "pastel", "photographic", "retro", "surreal", "vintage", "vibrant"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teak-sdk",
-  "version": "1.0.80",
+  "version": "1.0.82",
   "description": "Teak API client and OAuth discovery for browser and Node applications.",
   "repository": {
     "type": "git",