@abyss-project/commons-front-core 3.3.2 → 4.0.0

package/dist/use-auth.hook-B_TU5W3g.js

@@ -0,0 +1,391 @@
+import { MfaFactorType as U, SessionPlatform as B, AbyssCore as F, Code as J, AuthResultStatus as X } from "@abyss-project/main";
+import { browserSupportsWebAuthn as g, startRegistration as $, browserSupportsWebAuthnAutofill as V, startAuthentication as Q, WebAuthnError as Z } from "@simplewebauthn/browser";
+import { a as c, A as d, s as ee } from "./token-storage-D3e11ePD.js";
+import { createContext as te, useState as ne, useEffect as se, useMemo as re, useContext as oe } from "react";
+import { jsx as ae } from "react/jsx-runtime";
+var ie = /* @__PURE__ */ ((e) => (e.LOADING = "loading", e.ANONYMOUS = "anonymous", e.AUTHENTICATED = "authenticated", e))(ie || {}), ue = /* @__PURE__ */ ((e) => (e.PASSKEY = "passkey", e.TOTP = "totp", e.PASSWORD = "password", e.EMAIL_CODE = "email-code", e))(ue || {});
+const le = 6e4, x = 3e4, ce = [
+  500,
+  1e3,
+  2e3
+], de = [
+  7500,
+  15e3,
+  22500,
+  27e3
+], G = 3e4, fe = 5e3, pe = "abyss-auth-refresh", he = 2147483647, we = "Token Expired", Ee = (e) => typeof e == "object" && e !== null && e.isAxiosError === !0, H = (e) => {
+  var r;
+  if (!Ee(e) || e.code === "ERR_CANCELED")
+    return { kind: "other" };
+  if (!e.response)
+    return { kind: "network" };
+  const s = (r = e.response.data) == null ? void 0 : r.error;
+  return {
+    kind: "http",
+    status: e.response.status,
+    code: s == null ? void 0 : s.code,
+    message: s == null ? void 0 : s.message,
+    params: s == null ? void 0 : s.params
+  };
+}, me = /* @__PURE__ */ new Map([
+  [
+    U.TOTP,
+    "totp"
+    /* TOTP */
+  ],
+  [
+    U.PASSKEY,
+    "passkey"
+    /* PASSKEY */
+  ]
+]), Ae = (e) => {
+  const s = e == null ? void 0 : e.methods;
+  return Array.isArray(s) ? {
+    methods: s.flatMap((r) => {
+      const i = me.get(r);
+      return i ? [i] : [];
+    })
+  } : {};
+}, ye = (e) => new Promise((s) => setTimeout(s, e)), Re = () => typeof navigator > "u" || navigator.onLine !== !1, Te = () => typeof navigator > "u" ? null : navigator.locks ?? null, De = (e) => {
+  const s = e.bridge.platform === B.WEB, r = e.isOnline ?? Re;
+  let i = {
+    status: "loading"
+    /* LOADING */
+  }, a = null, n = null, E = null, y = null, _ = null, m = null, p = null, l = null, A = 0;
+  const R = /* @__PURE__ */ new Set(), T = /* @__PURE__ */ new Set(), S = (t) => {
+    i = t, R.forEach((o) => o(i));
+  }, D = (t) => {
+    a = t, e.applyToken(t), T.forEach((o) => o(t));
+  }, k = () => {
+    m && (clearTimeout(m), m = null), p && (clearTimeout(p), p = null);
+  }, K = (t) => {
+    const o = Date.parse(t);
+    if (!Number.isFinite(o))
+      return;
+    const u = Math.min(
+      Math.max(o - le - Date.now(), 0),
+      he
+    );
+    m = setTimeout(() => {
+      m = null, h.refresh();
+    }, u);
+  }, P = async (t) => {
+    var o;
+    k(), t.refreshToken && await e.storage.setRefreshToken(t.refreshToken), D(t.accessToken), n = t.user, (o = e.onPersistUser) == null || o.call(e, t.user), S({
+      status: "authenticated",
+      user: t.user,
+      mfaEnrollmentRequired: t.mfaEnrollmentRequired,
+      offline: !1
+    }), K(t.accessTokenExpiresAt);
+  }, N = async () => {
+    var t;
+    A += 1, k(), l = null, await e.storage.setRefreshToken(null), D(null), n = null, (t = e.onPersistUser) == null || t.call(e, null), S({
+      status: "anonymous"
+      /* ANONYMOUS */
+    });
+  }, j = () => {
+    if (l === null)
+      return G;
+    const t = Date.now() - l, o = de.find(
+      (u) => u > t && u < x
+    );
+    return o === void 0 ? (l = null, G) : o - t;
+  }, z = () => {
+    k();
+    const t = i.user ?? n;
+    S(
+      t ? {
+        status: "authenticated",
+        user: t,
+        mfaEnrollmentRequired: i.mfaEnrollmentRequired,
+        offline: !0
+      } : { status: "anonymous", offline: !0 }
+    ), p = setTimeout(() => {
+      p = null, h.refresh();
+    }, j());
+  }, I = async () => {
+    const t = s ? null : await e.storage.getRefreshToken();
+    if (!s && !t)
+      return { kind: "revoked" };
+    if (!r())
+      return { kind: "offline" };
+    const o = Date.now(), u = new AbortController(), f = setTimeout(
+      () => u.abort(),
+      fe
+    );
+    try {
+      const w = await F.sdk.auth.refresh(
+        t ? { refreshToken: t } : void 0,
+        { signal: u.signal }
+      );
+      return w.error ? { kind: "unreachable", sentAt: o } : { kind: "session", session: w.data };
+    } catch (w) {
+      if (u.signal.aborted)
+        return { kind: "unreachable", sentAt: o };
+      const L = H(w);
+      if (L.kind === "other")
+        throw w;
+      return L.kind === "http" && L.status === 401 ? { kind: "revoked" } : { kind: "unreachable", sentAt: o };
+    } finally {
+      clearTimeout(f);
+    }
+  }, O = async () => {
+    const t = A;
+    l !== null && Date.now() - l >= x && (l = null);
+    let o = await I();
+    const u = l === null ? ce : [];
+    for (const f of u) {
+      if (o.kind !== "unreachable" || t !== A || (l = l ?? o.sentAt, await ye(f), t !== A))
+        break;
+      o = await I();
+    }
+    if (o.kind === "unreachable" ? l = l ?? o.sentAt : o.kind !== "offline" && (l = null), t !== A) {
+      e.applyToken(a);
+      return;
+    }
+    switch (o.kind) {
+      case "session":
+        await P(o.session);
+        return;
+      case "revoked":
+        await N();
+        return;
+      case "offline":
+      case "unreachable":
+        z();
+        return;
+    }
+  }, b = () => {
+    i.offline && (p && (clearTimeout(p), p = null), h.refresh());
+  }, M = () => {
+    document.visibilityState === "visible" && b();
+  };
+  typeof window < "u" && window.addEventListener("online", b), typeof document < "u" && document.addEventListener("visibilitychange", M);
+  const h = {
+    bridge: e.bridge,
+    state: () => i,
+    subscribe: (t) => (R.add(t), () => {
+      R.delete(t);
+    }),
+    accessToken: () => a,
+    subscribeToken: (t) => (T.add(t), t(a), () => {
+      T.delete(t);
+    }),
+    bootstrap: () => (_ || (_ = (async () => {
+      var t;
+      n = await ((t = e.restoreUser) == null ? void 0 : t.call(e)) ?? null, await h.refresh();
+    })()), _),
+    handleResult: async (t) => (t.status === X.AUTHENTICATED && await P(t.session), t),
+    refresh: () => {
+      if (!y) {
+        const t = s ? Te() : null;
+        y = (t ? t.request(pe, O) : O()).finally(() => {
+          y = null;
+        });
+      }
+      return y;
+    },
+    withAuthRetry: async (t) => {
+      const o = a;
+      try {
+        return await t();
+      } catch (u) {
+        const f = H(u);
+        if (f.kind !== "http")
+          throw u;
+        if (f.status === 401 && f.message === we) {
+          if (a === o && await h.refresh(), i.status !== "authenticated" || a === null || a === o)
+            throw u;
+          return t();
+        }
+        if (f.status === 403 && f.code === J.reauthRequired && E) {
+          if (!await E(Ae(f.params)))
+            throw u;
+          return t();
+        }
+        throw u;
+      }
+    },
+    onReauthRequired: (t) => (E = t, () => {
+      E === t && (E = null);
+    }),
+    logout: async () => {
+      try {
+        i.status === "authenticated" && a === null && await h.refresh(), a !== null && await h.withAuthRetry(() => F.sdk.auth.logout());
+      } finally {
+        await N();
+      }
+    },
+    dispose: () => {
+      k(), R.clear(), T.clear(), typeof window < "u" && window.removeEventListener("online", b), typeof document < "u" && document.removeEventListener("visibilitychange", M);
+    }
+  };
+  return h;
+}, ke = "https://accounts.google.com/gsi/client", _e = "https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1.0/en_US/appleid.auth.js", v = /* @__PURE__ */ new Map(), W = (e) => {
+  const s = v.get(e);
+  if (s)
+    return s;
+  const r = new Promise((i, a) => {
+    const n = document.createElement("script");
+    n.src = e, n.async = !0, n.onload = () => i(), n.onerror = () => {
+      v.delete(e), n.remove(), a(
+        new c(
+          d.FAILED,
+          `Could not load ${e}`
+        )
+      );
+    }, document.head.appendChild(n);
+  });
+  return v.set(e, r), r;
+}, Se = [
+  "popup_closed_by_user",
+  "user_cancelled_authorize"
+], Y = (e) => {
+  const { name: s, message: r } = e ?? {}, i = typeof r == "string" ? r : "Passkey ceremony failed";
+  return s === "NotAllowedError" || s === "AbortError" || e instanceof Z && e.code === "ERROR_CEREMONY_ABORTED" ? new c(d.CANCELLED, i, e) : new c(d.FAILED, i, e);
+}, C = (e) => new c(
+  d.UNSUPPORTED,
+  `${e} is not supported by this browser`
+), Pe = (e) => ({
+  platform: B.WEB,
+  passkeySupported: async () => g(),
+  getPasskey: async (s, r = !1) => {
+    if (!g())
+      throw C("WebAuthn");
+    if (r && !await V())
+      throw C("Passkey autofill");
+    try {
+      return await Q({
+        // abyss-main's options are the WebAuthn JSON this call reads (base64url binary fields).
+        optionsJSON: s,
+        useBrowserAutofill: r
+      });
+    } catch (i) {
+      throw Y(i);
+    }
+  },
+  createPasskey: async (s) => {
+    if (!g())
+      throw C("WebAuthn");
+    try {
+      return await $({
+        optionsJSON: s
+      });
+    } catch (r) {
+      throw Y(r);
+    }
+  },
+  google: async (s) => {
+    await W(ke);
+    const r = window.google;
+    if (!r)
+      throw new c(
+        d.FAILED,
+        "Google Identity Services missing"
+      );
+    return new Promise((i, a) => {
+      r.accounts.id.initialize({
+        client_id: e.googleClientId,
+        // Google copies the raw nonce into the id_token; abyss-main compares it as is.
+        nonce: s,
+        callback: (n) => {
+          if (n.credential) {
+            i({ idToken: n.credential });
+            return;
+          }
+          a(
+            new c(
+              d.FAILED,
+              "Google returned no credential"
+            )
+          );
+        },
+        auto_select: !1,
+        cancel_on_tap_outside: !0,
+        use_fedcm_for_prompt: !0,
+        itp_support: !0
+      }), r.accounts.id.prompt((n) => {
+        if (n.isSkippedMoment()) {
+          a(
+            new c(
+              d.CANCELLED,
+              "Google prompt skipped"
+            )
+          );
+          return;
+        }
+        n.isDismissedMoment() && n.getDismissedReason() !== "credential_returned" && a(
+          new c(
+            d.CANCELLED,
+            "Google prompt dismissed"
+          )
+        );
+      });
+    });
+  },
+  apple: async (s) => {
+    var i;
+    await W(_e);
+    const r = window.AppleID;
+    if (!r)
+      throw new c(
+        d.FAILED,
+        "Sign in with Apple JS missing"
+      );
+    r.auth.init({
+      clientId: e.appleServiceId,
+      scope: "name email",
+      redirectURI: e.appleRedirectUri,
+      usePopup: !0,
+      // Apple carries what it is given; abyss-main compares it with SHA-256(raw nonce) in hex.
+      nonce: await ee(s)
+    });
+    try {
+      const a = await r.auth.signIn(), n = (i = a.user) == null ? void 0 : i.name;
+      return {
+        idToken: a.authorization.id_token,
+        ...n != null && n.firstName ? { givenName: n.firstName } : {},
+        ...n != null && n.lastName ? { familyName: n.lastName } : {}
+      };
+    } catch (a) {
+      const n = a == null ? void 0 : a.error;
+      throw typeof n == "string" && Se.includes(n) ? new c(d.CANCELLED, n, a) : new c(
+        d.FAILED,
+        typeof n == "string" ? n : "Sign in with Apple failed",
+        a
+      );
+    }
+  }
+}), q = te(null), Ne = ({ client: e, children: s }) => {
+  const [r, i] = ne(() => e.state());
+  se(() => {
+    i(e.state());
+    const n = e.subscribe(i);
+    return e.bootstrap(), n;
+  }, [e]);
+  const a = re(() => ({ state: r, client: e }), [r, e]);
+  return /* @__PURE__ */ ae(q.Provider, { value: a, children: s });
+}, Ie = () => {
+  const e = oe(q);
+  if (!e)
+    throw new Error("useAuth() must be called inside <AuthProvider>");
+  return e;
+};
+export {
+  ie as A,
+  ke as G,
+  ce as L,
+  ue as R,
+  G as U,
+  le as a,
+  x as b,
+  de as c,
+  fe as d,
+  pe as e,
+  De as f,
+  _e as g,
+  Pe as h,
+  q as i,
+  Ne as j,
+  Ie as u
+};

package/dist/utils/billing.utils.d.ts

@@ -13,8 +13,8 @@ export declare const EUR_TRANSACTION_TYPE_COLORS: Record<EurTransactionType, str
  *
  * Exposed as an id for hosts whose intl wrapper has no `formatMessage`.
  */
-export declare const getPlanNameMessageId: (planTemplate: Pick<IPlanTemplate, 'catalogKey' | 'tier'> | null | undefined) => string;
-export declare const getPlanDisplayName: (planTemplate: Pick<IPlanTemplate, 'catalogKey' | 'tier'> | null | undefined, intl: Pick<IntlShape, 'formatMessage'>) => string;
+export declare const getPlanNameMessageId: (planTemplate: Pick<IPlanTemplate, "catalogKey" | "tier"> | null | undefined) => string;
+export declare const getPlanDisplayName: (planTemplate: Pick<IPlanTemplate, "catalogKey" | "tier"> | null | undefined, intl: Pick<IntlShape, "formatMessage">) => string;
 /**
  * The interpolation values of a billing notification: its payload plus the `{planName}`,
  * `{oldPlanName}` and `{newPlanName}` labels resolved from the plan identities it carries

package/dist/utils/cookie.utils.d.ts

@@ -1,7 +1,7 @@
 export declare const getCookie: (name: string) => string | null;
 export declare const setCookie: (name: string, value: string, days?: number, domain?: string, options?: {
     secure?: boolean;
-    sameSite?: 'Lax' | 'Strict' | 'None';
+    sameSite?: "Lax" | "Strict" | "None";
 }) => void;
 export declare const deleteCookie: (name: string, domain?: string) => void;
 export declare const getOrCreatePersistentId: (cookieName: string, generateId: () => string) => string;

package/dist/utils/space-display-name.utils.d.ts

@@ -9,8 +9,8 @@ import { ISpace } from '@abyss-project/cloud';
  * a label is missing, falls back to a generic localized wording.
  */
 export type SpaceScope = 'personal' | 'perso-in-org' | 'org-common' | 'project';
-export declare const resolveSpaceScope: (space: Pick<ISpace, 'organizationId' | 'userId' | 'projectId'>) => SpaceScope;
-export declare const resolveSpaceDisplayName: (space: Pick<ISpace, 'organizationId' | 'userId' | 'projectId'>, intl: IntlShape, context?: {
+export declare const resolveSpaceScope: (space: Pick<ISpace, "organizationId" | "userId" | "projectId">) => SpaceScope;
+export declare const resolveSpaceDisplayName: (space: Pick<ISpace, "organizationId" | "userId" | "projectId">, intl: IntlShape, context?: {
     organizationName?: string;
     projectName?: string;
     userAlias?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abyss-project/commons-front-core",
-  "version": "3.3.2",
+  "version": "4.0.0",
   "description": "Front Core package of AbyssProject",
   "main": "dist/index.js",
   "module": "./dist/index.js",
@@ -13,12 +13,26 @@
     "./cookie-consent": {
       "import": "./dist/cookie-consent.js",
       "types": "./dist/cookie-consent.d.ts"
+    },
+    "./auth-native": {
+      "import": "./dist/auth-native.js",
+      "types": "./dist/auth-native.d.ts"
+    },
+    "./auth": {
+      "import": "./dist/auth-client.js",
+      "types": "./dist/auth-client.d.ts"
     }
   },
   "typesVersions": {
     "*": {
       "cookie-consent": [
         "./dist/cookie-consent.d.ts"
+      ],
+      "auth-native": [
+        "./dist/auth-native.d.ts"
+      ],
+      "auth": [
+        "./dist/auth-client.d.ts"
       ]
     }
   },
@@ -35,6 +49,7 @@
   },
   "homepage": "https://gitlab.com/abyss-group",
   "peerDependencies": {
+    "@abyss-project/capacitor-auth": "^1.0.0",
     "@dnd-kit/core": "^6.0.0",
     "@dnd-kit/sortable": "^9.0.0",
     "@dnd-kit/utilities": "^3.0.0",
@@ -53,7 +68,12 @@
     "react-is": "^18.0.0 || ^19.0.0",
     "react-router-dom": "^6.15.0",
     "zustand": "^5.0.0",
-    "@abyss-project/main": "11.2.0"
+    "@abyss-project/main": "13.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@abyss-project/capacitor-auth": {
+      "optional": true
+    }
   },
   "dependencies": {
     "@abyss-project/banking": "^1.1.0",
@@ -61,7 +81,7 @@
     "@abyss-project/crypt": "^1.0.9",
     "@abyss-project/form": "^1.0.13",
     "@abyss-project/memories": "^1.0.12",
-    "@abyss-project/monitor": "^6.1.0",
+    "@abyss-project/monitor": "^9.0.1",
     "@abyss-project/spotlight": "^1.0.24",
     "@abyss-project/storage": "^1.0.30",
     "@capacitor/clipboard": "^7.0.1",
@@ -76,6 +96,7 @@
     "@nivo/core": "^0.88.0",
     "@nivo/line": "^0.88.0",
     "@nivo/pie": "^0.88.0",
+    "@simplewebauthn/browser": "^13.3.0",
     "@tanstack/react-table": "^8.21.3",
     "axios": "^1.6.0",
     "axios-retry": "^4.5.0",
@@ -95,7 +116,7 @@
     "use-debounce": "^10.0.5",
     "uuid": "^9.0.0",
     "yup": "^0.32.11",
-    "@abyss-project/main": "11.2.0"
+    "@abyss-project/main": "13.0.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.2",
@@ -108,11 +129,11 @@
     "@types/react-animate-on-scroll": "^2.1.8",
     "@types/react-dom": "^18.3.5",
     "@types/uuid": "^9.0.0",
-    "@typescript-eslint/eslint-plugin": "6.21.0",
-    "@typescript-eslint/parser": "7.3.1",
+    "@typescript-eslint/eslint-plugin": "8.71.0",
+    "@typescript-eslint/parser": "8.71.0",
     "@vitejs/plugin-react": "^4.2.0",
     "@vitest/coverage-v8": "^2.0.0",
-    "eslint": "^7.28.0",
+    "eslint": "^8.57.1",
     "eslint-config-prettier": "^8.3.0",
     "eslint-config-standard": "^16.0.3",
     "eslint-plugin-filenames-simple": "^0.7.0",
@@ -124,16 +145,17 @@
     "jsdom": "^29.1.1",
     "prettier": "^2.5.1",
     "tsc-watch": "^4.6.2",
-    "typescript": "5.4.2",
+    "typescript": "5.9.3",
     "vite": "^6.3.5",
     "vite-plugin-dts": "^4.5.4",
-    "vitest": "^2.0.0"
+    "vitest": "^2.0.0",
+    "@abyss-project/capacitor-auth": "1.0.0"
   },
   "scripts": {
     "lint": "eslint \"{src,apps,libs,test,core}/**/*.{ts,tsx}\" --fix",
     "lint:check": "eslint \"{src,apps,libs,test,core}/**/*.{ts,tsx}\" --max-warnings 0",
     "tsc": "tsc --noEmit",
-    "build": "vite build",
+    "build": "vite build && node scripts/check-auth-entry-isolation.cjs",
     "dev": "vite build --watch",
     "test": "vitest run --config vitest.config.ts",
     "test:watch": "vitest --config vitest.config.ts"

package/scripts/check-auth-entry-isolation.cjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+/* eslint-disable no-console */
+'use strict';
+
+/**
+ * check-auth-entry-isolation.cjs — build guard for the `auth` entry (#510 task 14d).
+ *
+ * The `@abyss-project/commons-front-core/auth` entry exists so that an app's auth bootstrap
+ * module (and every test that re-imports it, e.g. after `vi.resetModules()`) never pays for the
+ * screens (`AuthFlow`, `SecuritySettings`, `ReauthDialog`…) and their dependencies (MUI, pdf.js,
+ * milkdown, nivo, react-toastify…) — the whole reason this entry exists alongside the full
+ * barrel, same as `cookie-consent` and `auth-native` already do for their own concerns.
+ *
+ * This walks `dist/auth.js` and every chunk it statically imports by a relative path (a bare
+ * specifier is a real npm dependency — react, @abyss-project/main, @simplewebauthn/browser — left
+ * alone: those are peer/externalized, not bundled here) and fails if either:
+ *   - any reachable file's source mentions one of the markers below — a component or a dependency
+ *     that must never show up on this entry;
+ *   - the combined size of the entry and its local chunks crosses MAX_TOTAL_BYTES — the UI chunk
+ *     bundled into `dist/index.js` is several MB, the real auth client chunk is under 20 KB.
+ *
+ * Exit 0: isolated. Exit 1: a chunk strayed in, the offending file(s) are printed. Exit 2: usage
+ * or tooling error (dist absent — build the package first). Run from the package's own `build`
+ * script, after `vite build`.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const DIST_DIR = path.resolve(__dirname, '../dist');
+// Dist filename `auth-client.js`, public subpath `./auth` (package.json `exports`) — see the
+// `auth-client` entry comment in `vite.config.ts` for why the filenames differ.
+const ENTRY = path.join(DIST_DIR, 'auth-client.js');
+
+// The real auth client chunk (client/auth-bridge.ts, auth-client.ts, token-storage.ts,
+// web-bridge.ts, react/AuthProvider.component.tsx, use-auth.hook.ts) measured under 20 KB
+// (packages/abyss_front_core/dist/token-storage-*.js, shared with the `auth-native` entry);
+// 100 KB leaves ample room for growth of that same code without tolerating a UI chunk (several
+// MB) sneaking in.
+const MAX_TOTAL_BYTES = 100 * 1024;
+
+const FORBIDDEN_MARKERS = [
+  '@mui/',
+  '@nivo/',
+  '@milkdown/',
+  'pdfjs-dist',
+  'pdf-lib',
+  'react-toastify',
+  'react-dropzone',
+  'qrcode',
+  '@dnd-kit/',
+  '@tanstack/react-table',
+  './components',
+];
+
+class UsageError extends Error {}
+
+function localImportSpecifiers(source) {
+  const specifiers = new Set();
+  const re = /(?:import|export)\s[^'"]*?from\s*["']([^"']+)["']|import\s*["']([^"']+)["']/g;
+  let match = re.exec(source);
+  while (match !== null) {
+    const specifier = match[1] || match[2];
+    if (specifier.startsWith('.')) {
+      specifiers.add(specifier);
+    }
+    match = re.exec(source);
+  }
+  return specifiers;
+}
+
+function walk(entry) {
+  if (!fs.existsSync(entry)) {
+    throw new UsageError(`${entry} is missing: build the package first (\`vite build\`).`);
+  }
+  const files = new Map();
+  const queue = [entry];
+  while (queue.length > 0) {
+    const file = queue.shift();
+    if (files.has(file)) {
+      continue;
+    }
+    if (!fs.existsSync(file)) {
+      throw new UsageError(`${file} is missing: build the package first (\`vite build\`).`);
+    }
+    const source = fs.readFileSync(file, 'utf8');
+    files.set(file, source);
+    for (const specifier of localImportSpecifiers(source)) {
+      queue.push(path.resolve(path.dirname(file), specifier));
+    }
+  }
+  return files;
+}
+
+function run() {
+  const files = walk(ENTRY);
+  const totalBytes = [...files.values()].reduce(
+    (sum, source) => sum + Buffer.byteLength(source, 'utf8'),
+    0,
+  );
+
+  const offenders = [];
+  for (const [file, source] of files) {
+    for (const marker of FORBIDDEN_MARKERS) {
+      if (source.includes(marker)) {
+        offenders.push(`${path.relative(DIST_DIR, file)} references "${marker}"`);
+      }
+    }
+  }
+  if (offenders.length > 0) {
+    console.error('AUTH ENTRY ISOLATION REFUSEE :');
+    for (const offender of offenders) console.error(`  - ${offender}`);
+    return 1;
+  }
+
+  if (totalBytes > MAX_TOTAL_BYTES) {
+    console.error(
+      `AUTH ENTRY ISOLATION REFUSEE : dist/auth.js + ses ${files.size - 1} chunk(s) local(aux) ` +
+        `pesent ${totalBytes} octets (> ${MAX_TOTAL_BYTES}) — un chunk hors du client d'auth s'est ` +
+        'glisse dans cet entry.',
+    );
+    return 1;
+  }
+
+  console.log(
+    `AUTH ENTRY ISOLATION OK : ${files.size} fichier(s), ${totalBytes} octets, aucun marqueur UI.`,
+  );
+  return 0;
+}
+
+if (require.main === module) {
+  try {
+    process.exit(run());
+  } catch (err) {
+    console.error(`check-auth-entry-isolation : ${err instanceof UsageError ? err.message : err.stack || err}`);
+    process.exit(2);
+  }
+}
+
+module.exports = { run, localImportSpecifiers, walk };