teak-sdk 1.0.87 → 1.0.88

package/README.md

@@ -1,8 +1,8 @@
 # Teak SDK
 
-Typed API client and OAuth discovery for Teak. The distribution bundles the
-canonical implementation from `packages/convex/client/sdk.ts`; it has no runtime
-dependencies and works without the Teak monorepo.
+Typed API client and OAuth discovery for Teak. The source lives in `src/`, and
+`bun run build` writes the npm package to `dist/`: one bundle with no runtime
+dependencies, so it works without the Teak monorepo.
 
 ```ts
 import { createTeakClient, discoverAuthServer } from "teak-sdk";

package/{dist/sdk.js → index.js}

@@ -46,6 +46,9 @@ var consumeResponseWithinLimit = async (response, maxBytes, consume) => {
 };
 var readResponseTextWithinLimit = (response, maxBytes) => consumeResponseWithinLimit(response, maxBytes, (boundedResponse) => boundedResponse.text());
 
+// ../convex/shared/oauthSurfaces.ts
+var OAUTH_SURFACES = ["cli", "raycast", "chrome", "firefox"];
+
 // ../convex/devUrls.ts
 var TEAK_DEV_DEPLOYMENT_NAME = "reminiscent-kangaroo-59";
 var DEFAULT_TEAK_DEV_CONVEX_URL = `https://${TEAK_DEV_DEPLOYMENT_NAME}.convex.cloud`;
@@ -80,8 +83,7 @@ var workosResourcesFor = (url) => {
 };
 var PRODUCTION_WORKOS_RESOURCES = workosResourcesFor(PRODUCTION_WORKOS_RESOURCE_ORIGIN);
 
-// ../convex/client/authDiscovery.ts
-var OAUTH_SURFACES = ["cli", "raycast", "chrome", "firefox"];
+// src/authDiscovery.ts
 var caches = new WeakMap;
 var object = (value) => {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -195,7 +197,18 @@ function discoverAuthServer(siteUrl, options = {}) {
   });
   return pending;
 }
-// ../convex/client/workosConnect.ts
+// src/oauthCredentials.ts
+var isWorkosCredential = (saved) => Boolean(saved?.origin && saved.issuer && saved.clientId?.startsWith("client_"));
+var matchesBinding = (saved, current) => saved?.origin === current.origin && saved.issuer === current.issuer && saved.clientId === current.clientId;
+var isRefreshTokenDead = (result) => !result.ok && result.reason === "refresh_token_rejected";
+var refreshAndSave = async (refresh, save) => {
+  const renewed = await refresh();
+  if (renewed !== null && renewed !== undefined) {
+    await save(renewed);
+  }
+  return renewed;
+};
+// src/workosConnect.ts
 var WORKOS_CONNECT_SCOPE = "openid profile email offline_access";
 var MAX_RESPONSE_BYTES = 64 * 1024;
 var MAX_TOKEN_LIFETIME_SECONDS = 365 * 24 * 3600;
@@ -903,7 +916,7 @@ var RESERVED_KEYWORDS = [
   { value: "trash", label: "Trash" }
 ];
 
-// ../convex/client/sdk.ts
+// src/index.ts
 var CARD_TYPES2 = cardTypes;
 var CARD_SORTS = ["newest", "oldest", "relevance", "shuffle"];
 var ERROR_CODES = [
@@ -1347,10 +1360,14 @@ export {
   fetchConnectOwnerId,
   formatBytes,
   isCardType,
+  isRefreshTokenDead,
   isStringList,
+  isWorkosCredential,
+  matchesBinding,
   normalizeLimit,
   parseTags,
   randomBase64Url,
+  refreshAndSave,
   requestConnectTokens,
   staticTokenProvider,
   validateOAuthUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teak-sdk",
-  "version": "1.0.87",
+  "version": "1.0.88",
   "description": "Teak API client and OAuth discovery for browser and Node applications.",
   "repository": {
     "type": "git",
@@ -11,25 +11,10 @@
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/types/client/sdk.d.ts",
-      "import": "./dist/sdk.js"
+      "types": "./types/index.d.ts",
+      "import": "./index.js"
     }
   },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "bun --no-env-file run build.ts",
-    "prepack": "bun run build",
-    "typecheck": "tsc build.ts ../convex/client/sdk.ts --strict --noEmit --moduleResolution bundler --module esnext --target es2022 --skipLibCheck --types bun,node"
-  },
-  "devDependencies": {
-    "@teak/convex": "workspace:*",
-    "@types/bun": "^1.4.0",
-    "@types/node": "^26.6.5",
-    "typescript": "^6.0.3"
-  },
   "publishConfig": {
     "access": "public",
     "provenance": true

package/{dist/types/client → types}/authDiscovery.d.ts

@@ -1,6 +1,6 @@
-export { validateOAuthUrl } from "../shared/oauthUrl.js";
-export declare const OAUTH_SURFACES: readonly ["cli", "raycast", "chrome", "firefox"];
-export type OAuthSurface = (typeof OAUTH_SURFACES)[number];
+import { type OAuthSurface } from "./convex/shared/oauthSurfaces.js";
+export { OAUTH_SURFACES, type OAuthSurface, } from "./convex/shared/oauthSurfaces.js";
+export { validateOAuthUrl } from "./convex/shared/oauthUrl.js";
 export interface AuthDiscovery {
     readonly authorizationEndpoint: string;
     readonly clients: Readonly<Record<OAuthSurface, string>>;

package/types/convex/shared/oauthSurfaces.d.ts

@@ -0,0 +1,2 @@
+export declare const OAUTH_SURFACES: readonly ["cli", "raycast", "chrome", "firefox"];
+export type OAuthSurface = (typeof OAUTH_SURFACES)[number];

package/{dist/types/client/sdk.d.ts → types/index.d.ts}

@@ -1,10 +1,11 @@
-export { formatBytes } from "../shared/utils/formatBytes.js";
+export { formatBytes } from "./convex/shared/utils/formatBytes.js";
 export { type AuthDiscovery, discoverAuthServer, type OAuthSurface, validateOAuthUrl, } from "./authDiscovery.js";
+export { type CredentialBinding, isRefreshTokenDead, isWorkosCredential, matchesBinding, refreshAndSave, } from "./oauthCredentials.js";
 export { type ConnectTokenResult, type ConnectTokens, createConnectAuthorizeUrl, createPkceChallenge, disconnectConnectGrant, fetchConnectOwnerId, randomBase64Url, requestConnectTokens, WORKOS_CONNECT_SCOPE, } from "./workosConnect.js";
-import { type CardType } from "../shared/constants.js";
-import type { FileKind, FilePreviewFacts } from "../shared/fileFormats.js";
-import type { FOLDER_COLORS } from "../shared/folders.js";
-export type { CardType } from "../shared/constants.js";
+import { type CardType } from "./convex/shared/constants.js";
+import type { FileKind, FilePreviewFacts } from "./convex/shared/fileFormats.js";
+import type { FOLDER_COLORS } from "./convex/shared/folders.js";
+export type { CardType } from "./convex/shared/constants.js";
 export declare const CARD_TYPES: readonly ["text", "link", "image", "video", "audio", "document", "palette", "quote"];
 export declare const CARD_SORTS: readonly ["newest", "oldest", "relevance", "shuffle"];
 export declare const ERROR_CODES: readonly ["AUTH_REQUIRED", "BAD_REQUEST", "CARD_LIMIT_REACHED", "CONFIG_ERROR", "CONFLICT", "CONTENT_TOO_LARGE", "FILE_TOO_LARGE", "FOLDER_LIMIT", "FORBIDDEN", "IN_PROGRESS", "INTERNAL_ERROR", "INVALID_API_KEY", "INVALID_INPUT", "INVALID_STORAGE_KEY", "INVALID_UTF8", "LIMIT_REACHED", "METHOD_NOT_ALLOWED", "NETWORK_ERROR", "NOT_FOUND", "NO_CONTENT", "NOT_IN_TRASH", "PARSE_ERROR", "RATE_LIMITED", "REQUEST_FAILED", "SERVICE_UNAVAILABLE", "SMART_FOLDER", "TAG_EXISTS", "TAG_OPERATION_RUNNING", "TIMEOUT", "TYPE_MISMATCH", "UNAUTHORIZED", "UNSUPPORTED_TYPE"];

package/types/oauthCredentials.d.ts

@@ -0,0 +1,10 @@
+import type { ConnectTokenResult } from "./workosConnect.js";
+export interface CredentialBinding {
+    clientId: string;
+    issuer: string;
+    origin: string;
+}
+export declare const isWorkosCredential: (saved: Partial<CredentialBinding> | undefined) => saved is CredentialBinding;
+export declare const matchesBinding: (saved: Partial<CredentialBinding> | undefined, current: CredentialBinding) => boolean;
+export declare const isRefreshTokenDead: (result: ConnectTokenResult) => boolean;
+export declare const refreshAndSave: <T>(refresh: () => Promise<T>, save: (renewed: NonNullable<T>) => unknown) => Promise<T>;