mirror of
https://github.com/HeyPuter/puter.git
synced 2026-11-07 14:33:57 +00:00
Daniel Salazar
52aedde3c5
Backend Tests / changes (push) Canceled after 0s
Backend Tests / typecheck (push) Canceled after 0s
Backend Tests / test shard 1/4 (push) Canceled after 0s
Backend Tests / test shard 2/4 (push) Canceled after 0s
Backend Tests / test shard 3/4 (push) Canceled after 0s
Backend Tests / test shard 4/4 (push) Canceled after 0s
Backend Tests / test (main) (push) Canceled after 0s
Backend Tests / coverage (push) Canceled after 0s
Maintain Release Merge PR / update-release-pr (push) Canceled after 0s
Notify HeyPuter / notify (push) Canceled after 0s
release-please / release-please (push) Canceled after 0s
* fix(permissions): delete user-to-user grants by their exact spelling MySQL compares the permission column case-insensitively, and LIKE folds case on MySQL and SQLite, so withdrawing a grant could also remove one spelled differently, which checks and the flat view treat as distinct. The single, batch and subtree deletes for one holder now match the permission byte for byte. * fix(auth): refuse key-value share grants on /auth/revoke-user-user Withdrawing a share's grant there left its handle live and listed. The route now refuses kv-share permissions and points to puter.kv.unshare(). * perf(kv): ask whether a delegate app is authorized once per check The app-delegate implicator re-read the app's authorization for every option a refused check offered, one read per ancestor of a deep key. * fix(puter-js): default a kvShare consent request to read puter.kv.share() creates read shares by default, so a consent asked for with the defaults (watch) didn't cover the share made with the defaults. * fix(kv): treat a private entry as missing for a share holder's writes Through a handle, a private entry reads as absent, but writes to it were refused with an error naming it as private, and onlyIfAbsent answered false. Deleting one through a handle now answers as deleting a missing key does and leaves the entry in place. Any other write is refused with kv_handle_access_denied, the same error as a call the share's level doesn't allow, onlyIfAbsent included. Cross-app access is unchanged. * fix(kv): cap handle traffic per owner namespace Every call through a share handle lands on its owner's namespace, and per-holder limits put no bound on what all holders together could send there. Handle calls into one namespace now share a budget of 6,000 units per 10 seconds, counted from the storage reads and writes each call consumes (at least one), and are refused with too_many_requests past it.
Puter.js
Learn More · Docs · Tutorials · Examples · X
Puter.js gives you auth, cloud storage, database, AI, and more through a single JavaScript library. It is the go-to backend for AI-generated apps.
There is nothing to configure, no API keys, no infrastructure to set up, whether you write the code yourself or have your AI tool do it. Tools like Claude Code, Codex, OpenCode, Lovable, and Replit can generate complete, production-ready apps in a single shot with fewer AI tokens.
Installation
NPM:
npm install @heyputer/puter.js
CDN:
Include Puter.js directly in your HTML via CDN in the <head> section:
<script src="https://js.puter.com/v2/"></script>
Usage
Browser
ES Modules
import {puter} from '@heyputer/puter.js';
// or
import puter from '@heyputer/puter.js';
// or
import '@heyputer/puter.js'; // puter will be available globally
CommonJS
const {puter} = require('@heyputer/puter.js');
// or
const puter = require('@heyputer/puter.js');
// or
require('@heyputer/puter.js'); // puter will be available globally
Node.js (with Auth Token)
const {init} = require("@heyputer/puter.js/src/init.cjs"); // NODE JS ONLY
// or
import {init} from "@heyputer/puter.js/src/init.cjs";
const puter = init(process.env.puterAuthToken); // uses your auth token
const puter2 = init(process.env.puterAuthToken2); // use some other auth token
Node.js (with Auth Token + Web Login)
const {init, getAuthToken} = require("@heyputer/puter.js/src/init.cjs");
// or
import {init, getAuthToken} from "@heyputer/puter.js/src/init.cjs";
const authToken = await getAuthToken(); // performs browser based auth and retrieves token (requires browser)
const puter = init(authToken); // uses your auth token
Usage Example
After importing, you can use the global puter object:
// Print a message
puter.print('Hello from Puter.js!');
// Chat with GPT-5 nano
puter.ai.chat('What color was Napoleon\'s white horse?').then(response => {
puter.print(response);
});
Starter Templates
You can also use one of the following templates:
- Client-side projects: Angular, React, Next.js, Vue.js, Vanilla.js
- Node.js + Express: Node.js + Express template
Setting Custom Origins
By default puter.js uses the official Puter API and GUI origins. You can customize these origins by setting global variables before importing the SDK like so:
// For API origin
globalThis.PUTER_API_ORIGIN = 'https://custom-api.puter.com';
// For GUI origin
globalThis.PUTER_ORIGIN = 'https://custom-gui.puter.com';
import {puter} from '@heyputer/puter.js'; // or however you import it for your env
Documentation & Community
License
Apache-2.0