@alneas/appkit-react 0.1.0 → 0.2.0

package/dist/tools/components/auth/session-cache.d.ts

@@ -1,51 +1,115 @@
 import { User } from './types.js';
 /**
- * 楽観セッションキャッシュ（stale-while-revalidate）
+ * A stored display snapshot, not proof of a valid authenticated session.
+ * See createSessionCache for writes, expiration checks and host verification.
  *
- * 認証は httpOnly クッキー等で実体を持つため、クライアントはセッション状態を知りません。
- * そのままだとリロードのたびにサーバー検証（whoami 等）が終わるまで画面がブロックされます。
- *
- * このモジュールは「最後に確定したセッション状態」を localStorage に保持し、
- * 次回ロード時に即座に描画（楽観表示）しつつ、裏で検証させるためのヘルパーです。
- *
- * 保存するのは表示用プロフィール（`User`）のみ。トークン等の機密は含めません。
- * クッキーが無効なら検証時に即座にログイン画面へフォールバックします。
- *
- * @example
- * ```ts
- * const cache = createSessionCache({ ttl: 7 * 24 * 60 * 60 * 1000 });
- * cache.write(user);   // ログイン成功 / 検証成功時
- * cache.writeLoggedOut(); // 明示的な未ログイン確定時
- * const hit = cache.read(); // { user: User|null, exp: number } | null
- * ```
+ * @see createSessionCache for the canonical usage example.
  */
 export interface SessionCacheEntry {
-    /** 最後に確定したユーザー。null は「明示的に未ログイン」を意味する */
+    /** Last confirmed display user; null records an explicitly logged-out state. */
     user: User | null;
-    /** 有効期限のエポックミリ秒 */
+    /** Expiration timestamp in milliseconds since the Unix epoch. */
     exp: number;
 }
+/**
+ * Storage settings for createSessionCache; no providers or CSS are required.
+ * @see createSessionCache for the canonical usage example.
+ */
 export interface SessionCacheOptions {
-    /** localStorage キー（デフォルト: dataarthub.auth.last-session） */
+    /** localStorage key; defaults to dataarthub.auth.last-session. */
     key?: string;
-    /** キャッシュの有効期間（ミリ秒）。デフォルト 7 日 */
+    /** Snapshot lifetime in milliseconds; defaults to seven days. */
     ttl?: number;
 }
+/**
+ * Best-effort browser snapshot storage; see createSessionCache for usage.
+ * @see createSessionCache for the canonical usage example.
+ */
 export interface SessionCache {
+    /** Resolved storage key shared with storage-event subscribers. */
     readonly key: string;
+    /**
+     * Read the stored snapshot without enforcing expiration.
+     *
+     * @returns Parsed entry (possibly expired), or null on server, missing data or parse/storage failure.
+     *
+     * @remarks See createSessionCache for the write/read usage pattern.
+     */
     read(): SessionCacheEntry | null;
+    /**
+     * Store display state with a fresh expiration.
+     *
+     * @param user - Display user or null for confirmed logout; exclude secrets.
+     *
+     * @returns No value; storage failures and server writes are ignored.
+     *
+     * @remarks See createSessionCache for the write/read usage pattern.
+     */
     write(user: User | null): void;
+    /**
+     * Remove the snapshot for this key.
+     *
+     * @returns No value; server calls and storage failures are ignored.
+     *
+     * @remarks Obtain this helper from createSessionCache, then call cache.clear().
+     */
     clear(): void;
-    /** キャッシュが存在し、かつ未期限切れなら true */
+    /**
+     * Check whether the stored expiration is still in the future.
+     *
+     * @returns True for a readable snapshot with exp greater than Date.now(), including a logged-out snapshot.
+     *
+     * @remarks See createSessionCache for a guarded read example.
+     */
     hasValid(): boolean;
 }
 /**
+ * Creates best-effort localStorage helpers for optimistic session display.
+ *
+ * @param options - Optional storage key and lifetime; defaults to the shared key and seven days.
+ *
+ * @returns Helpers that read, write, clear and check expiration without authenticating a user.
  *
+ * @remarks read() validates only the numeric exp field and does not reject expired data;
+ * hasValid() checks expiration. Server reads return null and writes/clears do nothing.
+ * Browser storage/JSON failures are swallowed. Store display fields only, never tokens
+ * or secrets; verify the actual session with the backend before allowing protected work.
+ *
+ * @example
+ * ```ts
+ * import { createSessionCache, type User } from '@alneas/appkit-react/tools/auth';
+ * export function rememberSession(user: User | null) {
+ *   const cache = createSessionCache({ ttl: 24 * 60 * 60 * 1000 });
+ *   cache.write(user); // null records confirmed logout.
+ *   const snapshot = cache.hasValid() ? cache.read() : null;
+ *   return snapshot;
+ * }
+ * ```
  */
 export declare function createSessionCache(options?: SessionCacheOptions): SessionCache;
 /**
- * 他タブでのログアウト/ログインを検知するための storage イベント監視。
+ * Subscribes to browser storage events for one session-cache key.
+ *
+ * @param key - Exact localStorage key to observe.
+ *
+ * @param onChanged - Synchronous callback invoked when a storage event has this exact key.
  *
- * @returns クリーンアップ関数
+ * @returns Cleanup that removes the listener; a no-op function on the server.
+ *
+ * @remarks Browser storage events generally come from other documents, not the writing
+ * window. Events with key null (including storage.clear()) do not match. The callback
+ * should reverify the session; its errors are not caught by this listener.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   createSessionCache, subscribeSessionCacheStorageEvent,
+ * } from '@alneas/appkit-react/tools/auth';
+ * export function watchSession(reverify: () => void) {
+ *   const cache = createSessionCache();
+ *   return subscribeSessionCacheStorageEvent(cache.key, reverify);
+ * }
+ * // Call the returned cleanup when the host subscription is disposed.
+ * ```
  */
 export declare function subscribeSessionCacheStorageEvent(key: string, onChanged: () => void): () => void;

package/dist/tools/components/auth/session-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-cache.js","names":["createSessionCache","key","options","ttl","read","raw","parsed","entry","hit","subscribeSessionCacheStorageEvent","handler","e","onChanged"],"sources":["../../../../src/tools/components/auth/session-cache.ts"],"sourcesContent":["import type { User } from './types';\n\n/**\n * 楽観セッションキャッシュ（stale-while-revalidate）\n *\n * 認証は httpOnly クッキー等で実体を持つため、クライアントはセッション状態を知りません。\n * そのままだとリロードのたびにサーバー検証（whoami 等）が終わるまで画面がブロックされます。\n *\n * このモジュールは「最後に確定したセッション状態」を localStorage に保持し、\n * 次回ロード時に即座に描画（楽観表示）しつつ、裏で検証させるためのヘルパーです。\n *\n * 保存するのは表示用プロフィール（`User`）のみ。トークン等の機密は含めません。\n * クッキーが無効なら検証時に即座にログイン画面へフォールバックします。\n *\n * @example\n * ```ts\n * const cache = createSessionCache({ ttl: 7 * 24 * 60 * 60 * 1000 });\n * cache.write(user);   // ログイン成功 / 検証成功時\n * cache.writeLoggedOut(); // 明示的な未ログイン確定時\n * const hit = cache.read(); // { user: User|null, exp: number } | null\n * ```\n */\n\nexport interface SessionCacheEntry {\n  /** 最後に確定したユーザー。null は「明示的に未ログイン」を意味する */\n  user: User | null;\n  /** 有効期限のエポックミリ秒 */\n  exp: number;\n}\n\nexport interface SessionCacheOptions {\n  /** localStorage キー（デフォルト: dataarthub.auth.last-session） */\n  key?: string;\n  /** キャッシュの有効期間（ミリ秒）。デフォルト 7 日 */\n  ttl?: number;\n}\n\nconst DEFAULT_KEY = 'dataarthub.auth.last-session';\nconst DEFAULT_TTL = 7 * 24 * 60 * 60 * 1000;\n\nexport interface SessionCache {\n  readonly key: string;\n  read(): SessionCacheEntry | null;\n  write(user: User | null): void;\n  clear(): void;\n  /** キャッシュが存在し、かつ未期限切れなら true */\n  hasValid(): boolean;\n}\n\n/**\n *\n */\nexport function createSessionCache(options: SessionCacheOptions = {}): SessionCache {\n  const key = options.key ?? DEFAULT_KEY;\n  const ttl = options.ttl ?? DEFAULT_TTL;\n\n  const read = (): SessionCacheEntry | null => {\n    if (typeof window === 'undefined') return null;\n    try {\n      const raw = window.localStorage.getItem(key);\n      if (!raw) return null;\n      const parsed = JSON.parse(raw) as SessionCacheEntry;\n      if (typeof parsed?.exp !== 'number') return null;\n      return parsed;\n    } catch {\n      return null;\n    }\n  };\n\n  const write = (user: User | null): void => {\n    if (typeof window === 'undefined') return;\n    try {\n      const entry: SessionCacheEntry = { user, exp: Date.now() + ttl };\n      window.localStorage.setItem(key, JSON.stringify(entry));\n    } catch {\n      /* storage が無効 (private mode 等) でも致命的ではない */\n    }\n  };\n\n  const clear = (): void => {\n    if (typeof window === 'undefined') return;\n    try {\n      window.localStorage.removeItem(key);\n    } catch {\n      /* noop */\n    }\n  };\n\n  return {\n    key,\n    read,\n    write,\n    clear,\n    hasValid: () => {\n      const hit = read();\n      return hit != null && hit.exp > Date.now();\n    },\n  };\n}\n\n/**\n * 他タブでのログアウト/ログインを検知するための storage イベント監視。\n *\n * @returns クリーンアップ関数\n */\nexport function subscribeSessionCacheStorageEvent(\n  key: string,\n  onChanged: () => void,\n): () => void {\n  if (typeof window === 'undefined') return () => {};\n  const handler = (e: StorageEvent) => {\n    if (e.key === key) onChanged();\n  };\n  window.addEventListener('storage', handler);\n  return () => window.removeEventListener('storage', handler);\n}\n"],"mappings":";AAoDA,SAAgBA,EAAmB,IAA+B,CAAC,GAAiB;CAClF,IAAMC,IAAMC,EAAQ,OAAO,gCACrBC,IAAMD,EAAQ,OAAO,QAErBE,UAAuC;EAC3C,IAAI,OAAO,SAAW,KAAa,OAAO;EAC1C,IAAI;GACF,IAAMC,IAAM,OAAO,aAAa,QAAQJ,CAAG;GAC3C,IAAI,CAACI,GAAK,OAAO;GACjB,IAAMC,IAAS,KAAK,MAAMD,CAAG;GAE7B,OADI,OAAOC,GAAQ,OAAQ,WACpBA,IADqC;EAE9C,QAAQ;GACN,OAAO;EACT;CACF;CAqBA,OAAO;EACL;EACA;EACA,QAtBa,MAA4B;GACzC,IAAI,OAAO,SAAW,KACtB,IAAI;IACF,IAAMC,IAA2B;KAAE;KAAM,KAAK,KAAK,IAAI,IAAIJ;IAAI;IAC/D,OAAO,aAAa,QAAQF,GAAK,KAAK,UAAUM,CAAK,CAAC;GACxD,QAAQ,CAER;EACF;EAeE,aAbwB;GACxB,IAAI,OAAO,SAAW,KACtB,IAAI;IACF,OAAO,aAAa,WAAWN,CAAG;GACpC,QAAQ,CAER;EACF;EAOE,gBAAgB;GACd,IAAMO,IAAMJ,EAAK;GACjB,OAAOI,KAAO,QAAQA,EAAI,MAAM,KAAK,IAAI;EAC3C;CACF;AACF;AAOA,SAAgBC,EACd,GACA,GACY;CACZ,IAAI,OAAO,SAAW,KAAa,aAAa,CAAC;CACjD,IAAMC,KAAW,MAAoB;EACnC,AAAIC,EAAE,QAAQV,KAAKW,EAAU;CAC/B;CAEA,OADA,OAAO,iBAAiB,WAAWF,CAAO,SAC7B,OAAO,oBAAoB,WAAWA,CAAO;AAC5D"}
+{"version":3,"file":"session-cache.js","names":["createSessionCache","key","options","ttl","read","raw","parsed","entry","hit","subscribeSessionCacheStorageEvent","handler","e","onChanged"],"sources":["../../../../src/tools/components/auth/session-cache.ts"],"sourcesContent":["import type { User } from './types';\n\n/**\n * A stored display snapshot, not proof of a valid authenticated session.\n * See createSessionCache for writes, expiration checks and host verification.\n *\n * @see createSessionCache for the canonical usage example.\n */\nexport interface SessionCacheEntry {\n  /** Last confirmed display user; null records an explicitly logged-out state. */\n  user: User | null;\n  /** Expiration timestamp in milliseconds since the Unix epoch. */\n  exp: number;\n}\n\n/**\n * Storage settings for createSessionCache; no providers or CSS are required.\n * @see createSessionCache for the canonical usage example.\n */\nexport interface SessionCacheOptions {\n  /** localStorage key; defaults to dataarthub.auth.last-session. */\n  key?: string;\n  /** Snapshot lifetime in milliseconds; defaults to seven days. */\n  ttl?: number;\n}\n\nconst DEFAULT_KEY = 'dataarthub.auth.last-session';\nconst DEFAULT_TTL = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Best-effort browser snapshot storage; see createSessionCache for usage.\n * @see createSessionCache for the canonical usage example.\n */\nexport interface SessionCache {\n  /** Resolved storage key shared with storage-event subscribers. */\n  readonly key: string;\n  /**\n   * Read the stored snapshot without enforcing expiration.\n   *\n   * @returns Parsed entry (possibly expired), or null on server, missing data or parse/storage failure.\n   *\n   * @remarks See createSessionCache for the write/read usage pattern.\n   */\n  read(): SessionCacheEntry | null;\n  /**\n   * Store display state with a fresh expiration.\n   *\n   * @param user - Display user or null for confirmed logout; exclude secrets.\n   *\n   * @returns No value; storage failures and server writes are ignored.\n   *\n   * @remarks See createSessionCache for the write/read usage pattern.\n   */\n  write(user: User | null): void;\n  /**\n   * Remove the snapshot for this key.\n   *\n   * @returns No value; server calls and storage failures are ignored.\n   *\n   * @remarks Obtain this helper from createSessionCache, then call cache.clear().\n   */\n  clear(): void;\n  /**\n   * Check whether the stored expiration is still in the future.\n   *\n   * @returns True for a readable snapshot with exp greater than Date.now(), including a logged-out snapshot.\n   *\n   * @remarks See createSessionCache for a guarded read example.\n   */\n  hasValid(): boolean;\n}\n\n/**\n * Creates best-effort localStorage helpers for optimistic session display.\n *\n * @param options - Optional storage key and lifetime; defaults to the shared key and seven days.\n *\n * @returns Helpers that read, write, clear and check expiration without authenticating a user.\n *\n * @remarks read() validates only the numeric exp field and does not reject expired data;\n * hasValid() checks expiration. Server reads return null and writes/clears do nothing.\n * Browser storage/JSON failures are swallowed. Store display fields only, never tokens\n * or secrets; verify the actual session with the backend before allowing protected work.\n *\n * @example\n * ```ts\n * import { createSessionCache, type User } from '@alneas/appkit-react/tools/auth';\n * export function rememberSession(user: User | null) {\n *   const cache = createSessionCache({ ttl: 24 * 60 * 60 * 1000 });\n *   cache.write(user); // null records confirmed logout.\n *   const snapshot = cache.hasValid() ? cache.read() : null;\n *   return snapshot;\n * }\n * ```\n */\nexport function createSessionCache(options: SessionCacheOptions = {}): SessionCache {\n  const key = options.key ?? DEFAULT_KEY;\n  const ttl = options.ttl ?? DEFAULT_TTL;\n\n  const read = (): SessionCacheEntry | null => {\n    if (typeof window === 'undefined') return null;\n    try {\n      const raw = window.localStorage.getItem(key);\n      if (!raw) return null;\n      const parsed = JSON.parse(raw) as SessionCacheEntry;\n      if (typeof parsed?.exp !== 'number') return null;\n      return parsed;\n    } catch {\n      return null;\n    }\n  };\n\n  const write = (user: User | null): void => {\n    if (typeof window === 'undefined') return;\n    try {\n      const entry: SessionCacheEntry = { user, exp: Date.now() + ttl };\n      window.localStorage.setItem(key, JSON.stringify(entry));\n    } catch {\n      /* storage が無効 (private mode 等) でも致命的ではない */\n    }\n  };\n\n  const clear = (): void => {\n    if (typeof window === 'undefined') return;\n    try {\n      window.localStorage.removeItem(key);\n    } catch {\n      /* noop */\n    }\n  };\n\n  return {\n    key,\n    read,\n    write,\n    clear,\n    hasValid: () => {\n      const hit = read();\n      return hit != null && hit.exp > Date.now();\n    },\n  };\n}\n\n/**\n * Subscribes to browser storage events for one session-cache key.\n *\n * @param key - Exact localStorage key to observe.\n *\n * @param onChanged - Synchronous callback invoked when a storage event has this exact key.\n *\n * @returns Cleanup that removes the listener; a no-op function on the server.\n *\n * @remarks Browser storage events generally come from other documents, not the writing\n * window. Events with key null (including storage.clear()) do not match. The callback\n * should reverify the session; its errors are not caught by this listener.\n *\n * @example\n * ```ts\n * import {\n *   createSessionCache, subscribeSessionCacheStorageEvent,\n * } from '@alneas/appkit-react/tools/auth';\n * export function watchSession(reverify: () => void) {\n *   const cache = createSessionCache();\n *   return subscribeSessionCacheStorageEvent(cache.key, reverify);\n * }\n * // Call the returned cleanup when the host subscription is disposed.\n * ```\n */\nexport function subscribeSessionCacheStorageEvent(\n  key: string,\n  onChanged: () => void,\n): () => void {\n  if (typeof window === 'undefined') return () => {};\n  const handler = (e: StorageEvent) => {\n    if (e.key === key) onChanged();\n  };\n  window.addEventListener('storage', handler);\n  return () => window.removeEventListener('storage', handler);\n}\n"],"mappings":";AA+FA,SAAgBA,EAAmB,IAA+B,CAAC,GAAiB;CAClF,IAAMC,IAAMC,EAAQ,OAAO,gCACrBC,IAAMD,EAAQ,OAAO,QAErBE,UAAuC;EAC3C,IAAI,OAAO,SAAW,KAAa,OAAO;EAC1C,IAAI;GACF,IAAMC,IAAM,OAAO,aAAa,QAAQJ,CAAG;GAC3C,IAAI,CAACI,GAAK,OAAO;GACjB,IAAMC,IAAS,KAAK,MAAMD,CAAG;GAE7B,OADI,OAAOC,GAAQ,OAAQ,WACpBA,IADqC;EAE9C,QAAQ;GACN,OAAO;EACT;CACF;CAqBA,OAAO;EACL;EACA;EACA,QAtBa,MAA4B;GACzC,IAAI,OAAO,SAAW,KACtB,IAAI;IACF,IAAMC,IAA2B;KAAE;KAAM,KAAK,KAAK,IAAI,IAAIJ;IAAI;IAC/D,OAAO,aAAa,QAAQF,GAAK,KAAK,UAAUM,CAAK,CAAC;GACxD,QAAQ,CAER;EACF;EAeE,aAbwB;GACxB,IAAI,OAAO,SAAW,KACtB,IAAI;IACF,OAAO,aAAa,WAAWN,CAAG;GACpC,QAAQ,CAER;EACF;EAOE,gBAAgB;GACd,IAAMO,IAAMJ,EAAK;GACjB,OAAOI,KAAO,QAAQA,EAAI,MAAM,KAAK,IAAI;EAC3C;CACF;AACF;AA2BA,SAAgBC,EACd,GACA,GACY;CACZ,IAAI,OAAO,SAAW,KAAa,aAAa,CAAC;CACjD,IAAMC,KAAW,MAAoB;EACnC,AAAIC,EAAE,QAAQV,KAAKW,EAAU;CAC/B;CAEA,OADA,OAAO,iBAAiB,WAAWF,CAAO,SAC7B,OAAO,oBAAoB,WAAWA,CAAO;AAC5D"}

package/dist/tools/components/auth/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":["z","zod","UserSchema"],"sources":["../../../../src/tools/components/auth/types.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const UserSchema = z.object({\n  /** ユーザーの一意識別子 */\n  id: z.string(),\n  /** メールアドレス */\n  email: z.string().email(),\n  /** 表示名 */\n  name: z.string().optional(),\n  /** アバター画像URL */\n  avatarUrl: z.string().optional(),\n  /** ユーザーロール (例: \"admin\", \"user\") */\n  role: z.string().optional(),\n  /** メールアドレスが認証済みかどうか（Firebase 等で利用） */\n  emailVerified: z.boolean().optional(),\n  /** 認証プロバイダー固有のメタデータ */\n  metadata: z.record(z.string(), z.any()).optional(),\n});\n\n/** ユーザー情報の定義 */\nexport type User = z.infer<typeof UserSchema>;\n\n/** 組み込み OAuth プロバイダー */\nexport type BuiltInOAuthProvider = 'google' | 'line' | 'apple' | 'github';\n\n/**\n * OAuth プロバイダー\n *\n * 組み込みプロバイダー (`google`, `line`, `apple`, `github`) に加え、\n * Supabase Dashboard で設定したカスタム OIDC プロバイダー名も指定可能です。\n *\n * @example\n * ```tsx\n * // 組み込みプロバイダー\n * await loginWithProvider('google');\n *\n * // カスタム OIDC プロバイダー（Supabase Dashboard で設定した名前）\n * await loginWithProvider('line-oidc');\n * ```\n */\nexport type OAuthProvider = BuiltInOAuthProvider | (string & {});\n\nexport interface OAuthLoginOptions {\n  redirectTo?: string;\n  scopes?: string[];\n  queryParams?: Record<string, string>;\n}\n\n/**\n * 認証アダプターのインターフェース\n * Firebase, Supabase, Mock などの認証プロバイダーを抽象化します。\n */\nexport interface AuthAdapter {\n  /**\n   * Optional non-secret namespace for this backend/tenant's optimistic session storage.\n   * Defaults to runtime adapter identity (no cross-reload reuse). Never infer it from cached\n   * profiles or credentials. Provider instances always have separate session query keys.\n   */\n  readonly cacheScope?: string;\n  /** ログイン */\n  login: (email: string, password: string) => Promise<User>;\n  /** 新規登録 */\n  register: (email: string, password: string, data?: { name?: string }) => Promise<User>;\n  /** ログアウト */\n  logout: () => Promise<void>;\n  /** パスワードリセットメール送信 */\n  resetPassword: (email: string) => Promise<void>;\n  /** メールアドレス変更 */\n  updateEmail: (email: string) => Promise<void>;\n  /** パスワード変更 */\n  updatePassword: (password: string) => Promise<void>;\n  /**\n   * 再認証（パスワード変更・メール変更前に必要）\n   *\n   * Firebase などのプロバイダーではセキュリティ上、メールアドレスや\n   * パスワードの変更前に現在のパスワードで再認証する必要があります。\n   * アダプターが対応していない場合は undefined になります。\n   *\n   * @param password - 現在のパスワード\n   */\n  reauthenticate?: (password: string) => Promise<void>;\n  /**\n   * メールアドレス確認メールを送信\n   *\n   * 新規登録後やメールアドレス変更後に、確認用メールを送信します。\n   * アダプターが対応していない場合は undefined になります。\n   */\n  sendVerificationEmail?: () => Promise<void>;\n  /**\n   * 認証トークンを取得\n   *\n   * API 呼び出し時の Authorization ヘッダーに使用するトークンを返します。\n   * Firebase の場合は ID Token、Supabase の場合は access_token を返します。\n   * アダプターが対応していない場合は undefined になります。\n   *\n   * @returns トークン文字列、または未認証の場合は null\n   */\n  getToken?: () => Promise<string | null>;\n  /** 現在のユーザーを取得 */\n  getCurrentUser: () => Promise<User | null>;\n\n  /**\n   * 認証状態の変更を監視\n   */\n  onAuthStateChanged: (callback: (user: User | null) => void) => () => void;\n  /** OAuth サインイン (Google/LINE など) */\n  loginWithProvider?: (\n    provider: OAuthProvider,\n    options?: OAuthLoginOptions,\n  ) => Promise<User | null>;\n}\n\n/**\n * ユーザープロファイルの基本型\n * id は認証ユーザーの uid と同一\n */\nexport interface BaseProfile {\n  id: string;\n  email: string;\n  created_at?: Date | string;\n  updated_at?: Date | string;\n}\n\n/**\n * プロファイルアダプターのインターフェース\n * データベースとの同期を抽象化します。\n *\n * @template T プロファイルの型 (BaseProfile を継承)\n */\nexport interface ProfileAdapter<T extends BaseProfile = BaseProfile> {\n  /** テーブル/コレクション名 */\n  tableName: string;\n\n  /**\n   * 新規ユーザー作成時にプロファイルを作成\n   * @param uid 認証ユーザーID\n   * @param authUser 認証ユーザー情報\n   * @param additionalData 追加データ\n   */\n  create: (uid: string, authUser: User, additionalData?: Partial<T>) => Promise<T>;\n\n  /**\n   * ログイン時にプロファイルを取得\n   * @param uid 認証ユーザーID\n   */\n  get: (uid: string) => Promise<T | null>;\n\n  /**\n   * プロファイルを更新\n   * @param uid 認証ユーザーID\n   * @param updates 更新データ\n   */\n  update: (uid: string, updates: Partial<T>) => Promise<T>;\n\n  /**\n   * プロファイルを削除\n   * @param uid 認証ユーザーID\n   */\n  delete: (uid: string) => Promise<void>;\n\n  /**\n   * プロファイルの存在確認\n   * @param uid 認証ユーザーID\n   */\n  exists?: (uid: string) => Promise<boolean>;\n}\n\n// =====================================================\n// Invitation System\n// =====================================================\n\n/** 招待種別 */\nexport type InvitationType = 'organization' | 'project' | 'team';\n\n/** 招待ステータス */\nexport type InvitationState = 'pending' | 'accepted' | 'declined' | 'expired' | 'cancelled';\n\n/**\n * 招待情報の定義\n */\nexport interface Invitation {\n  id: string;\n  /** 招待種別 */\n  type: InvitationType;\n  /** 対象ID (organization_id, project_id, team_id) */\n  targetId: string;\n  /** 対象名 (表示用) */\n  targetName?: string;\n  /** 招待先メールアドレス */\n  inviteeEmail: string;\n  /** 招待先ユーザーID (既存ユーザーの場合) */\n  inviteeUserId?: string;\n  /** 付与する役割 */\n  role: string;\n  /** ステータス */\n  state: InvitationState;\n  /** 招待トークン (リンク用) */\n  token: string;\n  /** 有効期限 */\n  expiresAt: Date | string;\n  /** 招待者ID */\n  invitedBy: string;\n  /** 招待者名 (表示用) */\n  invitedByName?: string;\n  /** 作成日時 */\n  createdAt: Date | string;\n  /** 応答日時 */\n  respondedAt?: Date | string;\n}\n\n/**\n * 招待作成パラメータ\n */\nexport interface CreateInvitationParams {\n  type: InvitationType;\n  targetId: string;\n  inviteeEmail: string;\n  role: string;\n  /** 有効期限 (時間, デフォルト: 168 = 7日) */\n  expirationHours?: number;\n  /** メッセージ */\n  message?: string;\n}\n\n/**\n * 招待承諾時のコールバック\n * organization_members, project_members, team_members への追加処理を実装\n */\nexport type OnInvitationAcceptedCallback = (\n  invitation: Invitation,\n  userId: string,\n) => Promise<void>;\n\n/**\n * 招待アダプターのインターフェース\n * 組織/プロジェクト/チームへの招待・承認フローを抽象化します。\n */\nexport interface InvitationAdapter {\n  /** テーブル/コレクション名 */\n  tableName: string;\n\n  /**\n   * 招待を作成\n   * @param params 招待パラメータ\n   * @param invitedBy 招待者のユーザーID\n   */\n  create: (params: CreateInvitationParams, invitedBy: string) => Promise<Invitation>;\n\n  /**\n   * トークンで招待を取得\n   * @param token 招待トークン\n   */\n  getByToken: (token: string) => Promise<Invitation | null>;\n\n  /**\n   * 招待を承諾\n   * @param token 招待トークン\n   * @param userId 承諾するユーザーID\n   * @param onAccepted メンバー追加処理のコールバック\n   */\n  accept: (\n    token: string,\n    userId: string,\n    onAccepted?: OnInvitationAcceptedCallback,\n  ) => Promise<void>;\n\n  /**\n   * 招待を拒否\n   * @param token 招待トークン\n   */\n  decline: (token: string) => Promise<void>;\n\n  /**\n   * ユーザーの保留中の招待を取得\n   * @param email ユーザーのメールアドレス\n   */\n  listPendingForUser: (email: string) => Promise<Invitation[]>;\n\n  /**\n   * 対象の保留中の招待を取得\n   * @param type 招待種別\n   * @param targetId 対象ID\n   */\n  listPendingForTarget: (type: InvitationType, targetId: string) => Promise<Invitation[]>;\n\n  /**\n   * 招待をキャンセル\n   * @param invitationId 招待ID\n   */\n  cancel: (invitationId: string) => Promise<void>;\n\n  /**\n   * 招待を再送信 (トークン再生成 + 期限延長)\n   * @param invitationId 招待ID\n   */\n  resend: (invitationId: string) => Promise<Invitation>;\n\n  /**\n   * 期限切れ招待をクリーンアップ\n   */\n  cleanupExpired?: () => Promise<number>;\n}\n"],"mappings":"A,qGAEA,IAAaE,EAAaF,EAAAA,EAAE,OAAO,CAEjC,GAAIA,EAAAA,EAAE,OAAO,EAEb,MAAOA,EAAAA,EAAE,OAAO,CAAC,CAAC,MAAM,EAExB,KAAMA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAE1B,UAAWA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAE/B,KAAMA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAE1B,cAAeA,EAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,EAEpC,SAAUA,EAAAA,EAAE,OAAOA,EAAAA,EAAE,OAAO,EAAGA,EAAAA,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC,E"}
+{"version":3,"file":"types.cjs","names":["z","zod","UserSchema"],"sources":["../../../../src/tools/components/auth/types.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Zod schema for Appkit display-user records with a required ID and valid email.\n *\n * @remarks Optional metadata accepts arbitrary values; this schema does not establish\n * session validity or authorization. See AuthProvider for session verification.\n *\n * @example\n * ```ts\n * import { UserSchema } from '@alneas/appkit-react/tools/auth';\n * const user = UserSchema.parse({ id: 'display-1', email: 'reader@example.com' });\n * ```\n */\nexport const UserSchema = z.object({\n  /**\n   * Stable display user identifier.\n   */\n  id: z.string(),\n  /**\n   * Required valid email address.\n   */\n  email: z.string().email(),\n  /**\n   * Optional display name.\n   */\n  name: z.string().optional(),\n  /**\n   * Optional avatar URL; not validated as a URL by this schema.\n   */\n  avatarUrl: z.string().optional(),\n  /**\n   * Optional host role string used for display.\n   */\n  role: z.string().optional(),\n  /**\n   * Optional host assertion of email verification.\n   */\n  emailVerified: z.boolean().optional(),\n  /**\n   * Optional string-keyed metadata; arbitrary values are accepted.\n   */\n  metadata: z.record(z.string(), z.any()).optional(),\n});\n\n/**\n * Display-user shape inferred from UserSchema; exclude credentials from optimistic storage.\n *\n * @see AuthProvider for consumption.\n */\nexport type User = z.infer<typeof UserSchema>;\n\n/**\n * Common OAuth identifiers; actual support depends on the host adapter/backend.\n *\n * @see AuthAdapter.loginWithProvider.\n */\nexport type BuiltInOAuthProvider = 'google' | 'line' | 'apple' | 'github';\n\n/**\n * OAuth identifier supporting both common names and host-defined custom provider names.\n *\n * @see AuthAdapter.loginWithProvider.\n */\nexport type OAuthProvider = BuiltInOAuthProvider | (string & {});\n\n/**\n * Optional OAuth redirect, scopes and provider query parameters interpreted by the host adapter.\n *\n * @see AuthAdapter.loginWithProvider.\n */\nexport interface OAuthLoginOptions {\n  /**\n   * Post-authentication destination interpreted by the adapter.\n   */\n  redirectTo?: string;\n  /**\n   * Optional requested provider scopes; adapter support varies.\n   */\n  scopes?: string[];\n  /**\n   * Additional provider query parameters; host validation is required.\n   */\n  queryParams?: Record<string, string>;\n}\n\n/**\n * Host authentication contract consumed by AuthProvider.\n *\n * @remarks Implementations own network access, credentials, session validation and backend\n * authorization. Optional methods are exposed only when supplied. Methods may reject with\n * backend/transport errors; AuthProvider tracks login/register/logout/OAuth errors.\n *\n * @see AuthProvider for a complete host-adapter example.\n */\nexport interface AuthAdapter {\n  /**\n   * Optional non-secret backend/tenant namespace for optimistic display cache reuse; omission uses runtime adapter identity.\n   */\n  readonly cacheScope?: string;\n  /**\n   * Sign in with email/password.\n   *\n   * @param email - Account email.\n   *\n   * @param password - Account password.\n   *\n   * @returns Signed-in user after adapter completion.\n   */\n  login: (email: string, password: string) => Promise<User>;\n  /**\n   * Create an account through the host backend.\n   *\n   * @param email - New account email.\n   *\n   * @param password - New account password.\n   *\n   * @param data - Optional name passed by the bundled registration form.\n   *\n   * @returns Registered user.\n   */\n  register: (email: string, password: string, data?: {\n    /** Optional display name. */\n    name?: string;\n  }) => Promise<User>;\n  /**\n   * End the host session.\n   *\n   * @returns No value after sign-out completion.\n   */\n  logout: () => Promise<void>;\n  /**\n   * Request a password reset.\n   *\n   * @param email - Account email.\n   *\n   * @returns No value after the host accepts the request; email delivery is host-owned.\n   */\n  resetPassword: (email: string) => Promise<void>;\n  /**\n   * Request an account email change.\n   *\n   * @param email - New account email.\n   *\n   * @returns No value after host completion.\n   */\n  updateEmail: (email: string) => Promise<void>;\n  /**\n   * Request an account password change.\n   *\n   * @param password - New password.\n   *\n   * @returns No value after host completion.\n   */\n  updatePassword: (password: string) => Promise<void>;\n  /**\n   * Optional confirmation of current credentials.\n   *\n   * @param password - Current account password.\n   *\n   * @returns No value after host confirmation.\n   */\n  reauthenticate?: (password: string) => Promise<void>;\n  /**\n   * Optional verification-email request.\n   *\n   * @returns No value after request completion; delivery is host-owned.\n   */\n  sendVerificationEmail?: () => Promise<void>;\n  /**\n   * Optional host token lookup.\n   *\n   * @returns Token string or null when unavailable; token type is adapter-specific.\n   */\n  getToken?: () => Promise<string | null>;\n  /**\n   * Read the current host session user.\n   *\n   * @returns User or null for no session; adapter-specific error handling may reject.\n   */\n  getCurrentUser: () => Promise<User | null>;\n  /**\n   * Subscribe to host user-state changes.\n   *\n   * @param callback - Receives each observed user or null; timing and initial invocation are adapter-specific.\n   *\n   * @returns Cleanup that stops future observation subject to in-flight adapter work.\n   */\n\n  onAuthStateChanged: (callback: (user: User | null) => void) => () => void;\n  /**\n   * Optional OAuth sign-in operation.\n   *\n   * @param provider - Host-configured provider identifier.\n   *\n   * @param options - Optional redirect, scopes and query parameters.\n   *\n   * @returns User when available, or null for a redirect-only/incomplete sign-in.\n   */\n  loginWithProvider?: (\n    provider: OAuthProvider,\n    options?: OAuthLoginOptions,\n  ) => Promise<User | null>;\n}\n\n/**\n * Persisted profile keyed by the authentication user ID.\n *\n * @see UserProfileProvider for adapter usage.\n */\nexport interface BaseProfile {\n  /**\n   * Authentication user ID used as the profile key.\n   */\n  id: string;\n  /**\n   * Profile email stored by the host.\n   */\n  email: string;\n  /**\n   * Optional host creation timestamp; no format validation is performed.\n   */\n  created_at?: Date | string;\n  /**\n   * Optional update timestamp; UserProfileProvider updates use an ISO string.\n   */\n  updated_at?: Date | string;\n}\n\n/**\n * Host persistence contract for authenticated profile records.\n *\n * @typeParam T - Persisted record extending BaseProfile; defaults to BaseProfile.\n *\n * @remarks No concrete profile backend is bundled. The host must enforce authorization\n * and decide persistence/transaction behavior; operations may reject with backend errors.\n *\n * @see UserProfileProvider for setup.\n */\nexport interface ProfileAdapter<T extends BaseProfile = BaseProfile> {\n  /**\n   * Collection name used in detail/list query keys.\n   */\n  tableName: string;\n  /**\n   * Create a profile for an authenticated user.\n   *\n   * @param uid - Authentication user ID.\n   *\n   * @param authUser - Authenticated display user.\n   *\n   * @param additionalData - Optional default profile fields supplied by UserProfileProvider.\n   *\n   * @returns Created persisted profile.\n   */\n\n  create: (uid: string, authUser: User, additionalData?: Partial<T>) => Promise<T>;\n  /**\n   * Read a profile by authentication user ID.\n   *\n   * @param uid - Profile/user identifier.\n   *\n   * @returns Profile or null when absent.\n   */\n\n  get: (uid: string) => Promise<T | null>;\n  /**\n   * Persist partial profile updates.\n   *\n   * @param uid - Profile identifier.\n   *\n   * @param updates - Partial fields to persist.\n   *\n   * @returns Updated persisted record.\n   */\n\n  update: (uid: string, updates: Partial<T>) => Promise<T>;\n  /**\n   * Delete a persisted profile.\n   *\n   * @param uid - Profile identifier.\n   *\n   * @returns No value after deletion completes.\n   */\n\n  delete: (uid: string) => Promise<void>;\n  /**\n   * Optional existence check.\n   *\n   * @param uid - Profile/user identifier.\n   *\n   * @returns Whether the host record exists.\n   */\n\n  exists?: (uid: string) => Promise<boolean>;\n}\n\n// =====================================================\n// Invitation System\n// =====================================================\n\n/**\n * Target category for a host-managed invitation.\n *\n * @see InvitationAdapter.create.\n */\nexport type InvitationType = 'organization' | 'project' | 'team';\n\n/**\n * Host invitation lifecycle state; the type does not perform transitions or expiry checks.\n *\n * @see InvitationAdapter.\n */\nexport type InvitationState = 'pending' | 'accepted' | 'declined' | 'expired' | 'cancelled';\n\n/**\n * Host-managed invitation record with target, recipient and response metadata.\n *\n * @see InvitationAdapter.getByToken.\n */\nexport interface Invitation {\n  /**\n   * Host invitation identifier.\n   */\n  id: string;\n  /**\n   * Invited resource category.\n   */\n  type: InvitationType;\n  /**\n   * Host resource identifier.\n   */\n  targetId: string;\n  /**\n   * Optional target display name.\n   */\n  targetName?: string;\n  /**\n   * Recipient email address.\n   */\n  inviteeEmail: string;\n  /**\n   * Recipient user identifier when already known.\n   */\n  inviteeUserId?: string;\n  /**\n   * Role to grant after host acceptance.\n   */\n  role: string;\n  /**\n   * Current host-managed lifecycle state.\n   */\n  state: InvitationState;\n  /**\n   * Invitation-link token; validate and protect it in host code.\n   */\n  token: string;\n  /**\n   * Host expiration timestamp as Date or string.\n   */\n  expiresAt: Date | string;\n  /**\n   * Inviting user identifier.\n   */\n  invitedBy: string;\n  /**\n   * Optional inviting user display name.\n   */\n  invitedByName?: string;\n  /**\n   * Host creation timestamp.\n   */\n  createdAt: Date | string;\n  /**\n   * Optional host acceptance/decline timestamp.\n   */\n  respondedAt?: Date | string;\n}\n\n/**\n * Inputs for host invitation creation; no bundled implementation imposes defaults.\n *\n * @see InvitationAdapter.create.\n */\nexport interface CreateInvitationParams {\n  /**\n   * Invited resource category.\n   */\n  type: InvitationType;\n  /**\n   * Target resource identifier.\n   */\n  targetId: string;\n  /**\n   * Recipient email address.\n   */\n  inviteeEmail: string;\n  /**\n   * Role requested for the recipient.\n   */\n  role: string;\n  /**\n   * Optional lifetime in hours; this interface does not enforce a seven-day or other default.\n   */\n  expirationHours?: number;\n  /**\n   * Optional host-delivered message.\n   */\n  message?: string;\n}\n\n/**\n * Host callback for adding an accepted user to the invited resource.\n *\n * @param invitation - Invitation being accepted.\n *\n * @param userId - Accepting user identifier.\n *\n * @returns No value after host membership work completes.\n *\n * @remarks Invocation order and rollback on rejection depend on the host adapter.\n *\n * @see InvitationAdapter.accept.\n */\nexport type OnInvitationAcceptedCallback = (\n  invitation: Invitation,\n  userId: string,\n) => Promise<void>;\n\n/**\n * Host contract for invitation persistence and lifecycle operations.\n *\n * @remarks No implementation is bundled here. Host code owns expiry, token validation,\n * permissions, delivery and transaction semantics. Any operation may reject on backend\n * failure; optional cleanup is undefined when unsupported.\n *\n * @example\n * ```ts\n * import type { InvitationAdapter } from '@alneas/appkit-react/tools/auth';\n * export async function inspectInvitation(adapter: InvitationAdapter, token: string) {\n *   return adapter.getByToken(token);\n * }\n * ```\n */\nexport interface InvitationAdapter {\n  /**\n   * Host collection name for invitations.\n   */\n  tableName: string;\n  /**\n   * Create and optionally deliver an invitation through the host.\n   *\n   * @param params - Recipient, target, role and optional lifetime/message.\n   *\n   * @param invitedBy - Inviting user identifier.\n   *\n   * @returns Created invitation.\n   */\n\n  create: (params: CreateInvitationParams, invitedBy: string) => Promise<Invitation>;\n  /**\n   * Find an invitation by host token.\n   *\n   * @param token - Invitation-link token.\n   *\n   * @returns Matching invitation or null.\n   */\n\n  getByToken: (token: string) => Promise<Invitation | null>;\n  /**\n   * Accept an invitation and optionally perform membership work.\n   *\n   * @param token - Invitation-link token.\n   *\n   * @param userId - Accepting user identifier.\n   *\n   * @param onAccepted - Optional async host membership callback; host implementation defines ordering and rollback.\n   *\n   * @returns No value after host acceptance completes.\n   */\n\n  accept: (\n    token: string,\n    userId: string,\n    onAccepted?: OnInvitationAcceptedCallback,\n  ) => Promise<void>;\n  /**\n   * Decline a host invitation.\n   *\n   * @param token - Invitation-link token.\n   *\n   * @returns No value after host completion.\n   */\n\n  decline: (token: string) => Promise<void>;\n  /**\n   * List pending invitations for a recipient.\n   *\n   * @param email - Recipient email.\n   *\n   * @returns Invitation array, possibly empty.\n   */\n\n  listPendingForUser: (email: string) => Promise<Invitation[]>;\n  /**\n   * List pending invitations for a resource.\n   *\n   * @param type - Resource category.\n   *\n   * @param targetId - Resource identifier.\n   *\n   * @returns Invitation array, possibly empty.\n   */\n\n  listPendingForTarget: (type: InvitationType, targetId: string) => Promise<Invitation[]>;\n  /**\n   * Cancel a host invitation.\n   *\n   * @param invitationId - Invitation identifier.\n   *\n   * @returns No value after cancellation completes.\n   */\n\n  cancel: (invitationId: string) => Promise<void>;\n  /**\n   * Request host invitation reissue/delivery.\n   *\n   * @param invitationId - Invitation identifier.\n   *\n   * @returns Updated invitation; token/expiry policy is host-owned.\n   */\n\n  resend: (invitationId: string) => Promise<Invitation>;\n  /**\n   * Optional host expiry cleanup.\n   *\n   * @returns Count of invitations affected by the host cleanup policy.\n   */\n\n  cleanupExpired?: () => Promise<number>;\n}\n"],"mappings":"A,qGAcA,IAAaE,EAAaF,EAAAA,EAAE,OAAO,CAIjC,GAAIA,EAAAA,EAAE,OAAO,EAIb,MAAOA,EAAAA,EAAE,OAAO,CAAC,CAAC,MAAM,EAIxB,KAAMA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAI1B,UAAWA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAI/B,KAAMA,EAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAI1B,cAAeA,EAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS,EAIpC,SAAUA,EAAAA,EAAE,OAAOA,EAAAA,EAAE,OAAO,EAAGA,EAAAA,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC,E"}