web-comments 1.0.0 → 1.0.2

package/dist/server.js

@@ -2,7 +2,7 @@ import {
   CommentsError,
   createComments,
   newId
-} from "./chunks/chunk-RRSB326L.js";
+} from "./chunks/chunk-HN5V6BS6.js";
 import "./chunks/chunk-WSFCRVEQ.js";
 export {
   CommentsError,

package/dist/types/connectors/linear/icon.d.ts

@@ -0,0 +1 @@
+export declare const icon = "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMjQgMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTIuODg2IDQuMThBMTEuOTgyIDExLjk4MiAwIDAgMSAxMS45OSAwQzE4LjYyNCAwIDI0IDUuMzc2IDI0IDEyLjAwOWMwIDMuNjQtMS42MiA2LjkwMy00LjE4IDkuMTA1TDIuODg3IDQuMThaTTEuODE3IDUuNjI2bDE2LjU1NiAxNi41NTZjLS41MjQuMzMtMS4wNzUuNjItMS42NS44NjZMLjk1MSA3LjI3N2MuMjQ3LS41NzUuNTM3LTEuMTI2Ljg2Ni0xLjY1Wk0uMzIyIDkuMTYzbDE0LjUxNSAxNC41MTVjLS43MS4xNzItMS40NDMuMjgyLTIuMTk1LjMyMkwwIDExLjM1OGExMiAxMiAwIDAgMSAuMzIyLTIuMTk1Wm0tLjE3IDQuODYyIDkuODIzIDkuODI0YTEyLjAyIDEyLjAyIDAgMCAxLTkuODI0LTkuODI0WiIvPjwvc3ZnPg==";

package/dist/types/connectors/linear/index.d.ts

@@ -7,7 +7,9 @@ export interface LinearOptions {
      * - `{ accessToken }`: an OAuth token.
      * - `{ clientId, clientSecret }`: an OAuth app with client credentials
      *   enabled. Issues and comments are the app's, shown under each
-     *   commenter's name and picture.
+     *   commenter's name and picture, and people can connect their own Linear
+     *   account to it (its callback URL: `{basePath}/linear/callback`), after
+     *   which what they do reaches Linear as themselves.
      */
     auth: {
         apiKey: string;
@@ -38,9 +40,10 @@ export interface LinearOptions {
 /**
  * Every thread becomes a Linear issue, with its screenshots, and stays in
  * step with it: replies go both ways, and resolving one resolves the other.
- * Options can depend on the environment; returning null leaves Linear out
- * of that one (say, until its secrets are set).
+ * People are matched across by email, or connect their Linear account in
+ * the widget's Linear panel. Options can depend on the environment;
+ * returning null leaves Linear out of that one (say, until its secrets are set).
  *
- *   connectors: [linear((env) => ({ auth: { apiKey: env.LINEAR_API_KEY }, team: "ENG", webhookSecret: env.LINEAR_WEBHOOK_SECRET }))]
+ *   connectors: [linear((env) => ({ auth: { clientId: env.LINEAR_CLIENT_ID, clientSecret: env.LINEAR_CLIENT_SECRET }, team: "ENG", webhookSecret: env.LINEAR_WEBHOOK_SECRET }))]
  */
 export declare function linear<Env = unknown>(options: LinearOptions | ((env: Env) => LinearOptions | null)): Connector<Env>;

package/dist/types/connectors/mcp/icon.d.ts

@@ -0,0 +1 @@
+export declare const icon = "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIxLjIxIDAgMjEuNTggMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTEzLjg1IDBhNC4xNiA0LjE2IDAgMCAwLTIuOTUgMS4yMTdMMS40NTYgMTAuNjZhLjgzNS44MzUgMCAwIDAgMCAxLjE4LjgzNS44MzUgMCAwIDAgMS4xOCAwbDkuNDQyLTkuNDQyYTIuNDkgMi40OSAwIDAgMSAzLjU0MSAwIDIuNDkgMi40OSAwIDAgMSAwIDMuNTQxTDguNTkgMTIuOTdsLS4xLjFhLjgzNS44MzUgMCAwIDAgMCAxLjE4LjgzNS44MzUgMCAwIDAgMS4xOCAwbC4xLS4wOTggNy4wMy03LjAzNGEyLjQ5IDIuNDkgMCAwIDEgMy41NDIgMGwuMDQ5LjA1YTIuNDkgMi40OSAwIDAgMSAwIDMuNTRsLTguNTQgOC41NGExLjk2IDEuOTYgMCAwIDAgMCAyLjc1NWwxLjc1MyAxLjc1M2EuODM1LjgzNSAwIDAgMCAxLjE4IDAgLjgzNS44MzUgMCAwIDAgMC0xLjE4bC0xLjc1My0xLjc1M2EuMjY2LjI2NiAwIDAgMSAwLS4zOTRsOC41NC04LjU0YTQuMTg1IDQuMTg1IDAgMCAwIDAtNS45bC0uMDUtLjA1YTQuMTYgNC4xNiAwIDAgMC0yLjk1LTEuMjE4Yy0uMiAwLS40MDEuMDItLjYuMDQ4YTQuMTcgNC4xNyAwIDAgMC0xLjE3LTMuNTUyQTQuMTYgNC4xNiAwIDAgMCAxMy44NSAwbTAgMy4zMzNhLjg0Ljg0IDAgMCAwLS41OS4yNDVMNi4yNzUgMTAuNTZhNC4xODYgNC4xODYgMCAwIDAgMCA1LjkwMiA0LjE4NiA0LjE4NiAwIDAgMCA1LjkwMiAwTDE5LjE2IDkuNDhhLjgzNS44MzUgMCAwIDAgMC0xLjE4LjgzNS44MzUgMCAwIDAtMS4xOCAwbC02Ljk4NSA2Ljk4NGEyLjQ5IDIuNDkgMCAwIDEtMy41NCAwIDIuNDkgMi40OSAwIDAgMSAwLTMuNTRsNi45ODMtNi45ODVhLjgzNS44MzUgMCAwIDAgMC0xLjE4Ljg0Ljg0IDAgMCAwLS41OS0uMjQ1Ii8+PC9zdmc+";

package/dist/types/connectors/mcp/oauth.d.ts

@@ -8,6 +8,8 @@ export interface OAuthOptions {
 }
 /** What a token stands for. */
 export interface Grant {
+    /** One approval of one client by one person; revoking it ends every token it issued. */
+    grantId: string;
     identity: Identity;
     clientId: string;
     clientName: string;
@@ -45,6 +47,17 @@ export declare function authorizationServerMetadata(base: string, oidc: boolean)
 export declare function jwks(): Response;
 /** The grant behind an access token, or null if it isn't a live one. */
 export declare function grantOf(storage: ConnectorStorage, token: string): Promise<Grant | null>;
+interface GrantRecord {
+    clientId: string;
+    clientName: string;
+    createdAt: string;
+}
+/** The agents a person has approved and not revoked, newest first. */
+export declare function grantsOf(storage: ConnectorStorage, identityId: string): Promise<(GrantRecord & {
+    grantId: string;
+})[]>;
+export declare function revokeGrant(storage: ConnectorStorage, identityId: string, grantId: string): Promise<void>;
 export declare function looksLikeOurToken(token: string): boolean;
 /** Answers the OAuth paths under the connector's base; null for anything else. */
 export declare function handleOAuth(request: Request, path: string, context: ConnectorRequestContext, options: OAuthOptions): Promise<Response | null>;
+export {};

package/dist/types/server/connector.d.ts

@@ -1,4 +1,4 @@
-import type { Comment, Identity, ScreenshotKind, Thread, ThreadStatus } from "../shared/types";
+import type { Comment, ConnectorPanel, Identity, ScreenshotKind, Thread, ThreadStatus } from "../shared/types";
 import type { CommentsEvent } from "./events";
 import type { ThreadLink } from "./store";
 /**
@@ -29,10 +29,24 @@ export interface Connector<Env = unknown> {
      * sends them (see `matches()`).
      */
     rootPaths?(basePath: string): string[];
+    /**
+     * What this connector shows in the widget: a button on the toolbar (above
+     * the person's avatar) that opens a panel of its own. Built from the
+     * blocks below, so a connector needs no front-end code. Null hides it
+     * (say, for someone it has nothing for).
+     */
+    panel?(who: Identity, context: ConnectorContext<Env>): Promise<ConnectorPanel | null>;
+    /**
+     * A button in the panel was pressed (`{ type: "button", action }`). Runs
+     * signed in and checked like the API's own requests.
+     */
+    action?(action: string, who: Identity, input: Record<string, unknown>, context: ConnectorContext<Env>): Promise<void>;
 }
 export interface ConnectorContext<Env = unknown> {
     env: Env;
     site: string;
+    /** The origin the request came to, e.g. https://app.example.com. */
+    origin: string;
     /** Where the API is mounted, e.g. "/__comments". */
     basePath: string;
     /**
@@ -73,6 +87,10 @@ export interface ConnectorRequestContext<Env = unknown> extends ConnectorContext
      * `authorize`), or null: e.g. the person approving an OAuth client.
      */
     identify(request: Request): Promise<Identity | null>;
+    /** Who a request is from by the auth plugins alone, whether or not `authorize` lets them in. */
+    signedIn(request: Request): Promise<Identity | null>;
+    /** Whether the API's `authorize` lets this person in now (for credentials kept since, like tokens). */
+    allowed(who: Identity, request: Request): Promise<boolean>;
     /** Where the auth plugins send someone to sign in, if they know. */
     loginUrl(request: Request): string | undefined;
 }

package/dist/types/server/service.d.ts

@@ -11,6 +11,8 @@ export declare class CommentsError extends Error {
 /** One request's view of the comments: its site, where things are kept, and where changes go. */
 export interface Scope {
     site: string;
+    /** The origin the request came to, e.g. https://app.example.com. */
+    origin: string;
     store: CommentsStore;
     assets: AssetStore | null;
     announce(event: CommentsEvent): void;

package/dist/types/shared/types.d.ts

@@ -100,6 +100,61 @@ export interface ThreadLinkSummary {
     /** How to show it, e.g. "ENG-123". */
     title: string | null;
 }
+/** A connector's panel in the widget. */
+export interface ConnectorPanel {
+    title: string;
+    /** An image URL (https: or data:), shown at 20px on the toolbar and in the panel's header. */
+    icon: string;
+    /** Puts a dot on the toolbar button: something here wants the person's attention. */
+    attention?: boolean;
+    blocks: PanelBlock[];
+}
+export type PanelBlock = {
+    type: "text";
+    text: string;
+} | {
+    type: "status";
+    label: string;
+    /** positive: all set; notice: worth acting on; neutral: just so. */
+    tone: "positive" | "notice" | "neutral";
+    description?: string;
+} | {
+    type: "code";
+    label: string;
+    value: string;
+} | {
+    /**
+     * Leaves the page for `href` (e.g. an OAuth page). With `returnTo`,
+     * the current address goes along as `?return=`.
+     */
+    type: "link";
+    label: string;
+    href: string;
+    returnTo?: boolean;
+    variant?: "accent" | "secondary";
+} | {
+    /** Calls the connector's `action`, then shows the panel again. */
+    type: "button";
+    label: string;
+    action: string;
+    input?: Record<string, unknown>;
+    variant?: "accent" | "secondary" | "negative";
+    /** Asks first, with this question. */
+    confirm?: string;
+} | {
+    type: "list";
+    label: string;
+    empty: string;
+    items: {
+        title: string;
+        description?: string;
+        button?: {
+            label: string;
+            action: string;
+            input?: Record<string, unknown>;
+        };
+    }[];
+};
 export interface ApiError {
     error: {
         code: string;

package/dist/types/widget/api.d.ts

@@ -1,4 +1,4 @@
-import type { Anchor, Identity, Thread, ThreadContext, ThreadStatus } from "../shared/types";
+import type { Anchor, ConnectorPanel, Identity, Thread, ThreadContext, ThreadStatus } from "../shared/types";
 import type { Shots } from "./capture";
 export interface ApiOptions {
     endpoint: string;
@@ -17,10 +17,19 @@ export declare class ApiError extends Error {
     readonly status: number;
     constructor(message: string, status: number);
 }
+/** A connector's panel, as /connectors sends it. */
+export type ConnectorPanelView = ConnectorPanel & {
+    connector: string;
+};
 export declare function createApi(options: ApiOptions): {
     /** A path the API returned (a screenshot), as a URL the browser can load: it's relative to the API's host. */
     resolve: (path: string) => string;
     me: () => Promise<Identity>;
+    /** The connectors' panels for this person; none from a server that has no connectors. */
+    connectors: () => Promise<ConnectorPanelView[]>;
+    connectorAction: (connector: string, action: string, input?: Record<string, unknown>) => Promise<{
+        ok: true;
+    }>;
     threads: (page: string) => Promise<Thread[]>;
     thread: (threadId: string) => Promise<Thread>;
     /** Opens a thread, sending its screenshots along in the same request when there are any. */

package/dist/types/widget/connectors.d.ts

@@ -0,0 +1,13 @@
+import type { Api, ConnectorPanelView } from "./api";
+/** A connector's mark, monochrome, in the colour of the text around it. */
+export declare function ConnectorIcon({ src, size }: {
+    src: string;
+    size?: number;
+}): import("react").JSX.Element;
+/** One connector's panel. Actions run, then the panel is asked for again. */
+export declare function ConnectorPanel({ panel, api, onClose, onChanged, }: {
+    panel: ConnectorPanelView;
+    api: Api;
+    onClose: () => void;
+    onChanged: () => Promise<void>;
+}): import("react").JSX.Element;