@atlasauth/vue 0.1.0

package/dist/flow.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useFlow = useFlow;
+exports.useSignIn = useSignIn;
+exports.useSignUp = useSignUp;
+const vue_1 = require("vue");
+const fapi_1 = require("./fapi");
+const context_1 = require("./context");
+function useFlow() {
+    const atlas = (0, context_1.useAtlas)();
+    // Seeded from a redirect that came back mid-flow (e.g. OAuth needing a second
+    // factor), so the user resumes at the demanded step instead of starting over.
+    const state = (0, vue_1.shallowRef)((0, fapi_1.flowFromPending)(atlas.pendingAttempt));
+    const client = new fapi_1.FapiClient({
+        publishableKey: atlas.publishableKey,
+        baseUrl: atlas.frontendApi,
+    });
+    const submit = (values) => {
+        void (async () => {
+            state.value = { ...state.value, busy: true, errors: [] };
+            const next = await (0, fapi_1.advance)(client, state.value, values);
+            state.value = next;
+            // On completion the response carries a one-time ticket (§7.1). Exchange it
+            // for cookies over a same-origin request — FAPI is cross-origin to the app
+            // and cannot set the cookie on the completion response itself — THEN
+            // re-boot so the rest of the app sees a signed-in user.
+            if (next.attempt?.status === 'complete') {
+                if (next.ticket) {
+                    await client.post('/v1/client/tickets/exchange', {
+                        attempt_id: next.attempt.id,
+                        ticket: next.ticket,
+                    });
+                }
+                await atlas.reload();
+            }
+        })();
+    };
+    // §5.3: collect a sign-in completed by a link opened on another device. The
+    // poll restarts whenever the flow state changes and only runs while the state
+    // says it should — the Vue peer of React's polling effect.
+    let poller = null;
+    const stopPolling = () => {
+        if (poller) {
+            clearInterval(poller);
+            poller = null;
+        }
+    };
+    (0, vue_1.watch)(state, (current) => {
+        stopPolling();
+        if (!(0, fapi_1.shouldKeepPolling)(current))
+            return;
+        poller = setInterval(() => {
+            void (async () => {
+                const { state: next, ticket } = await (0, fapi_1.pollAttempt)(client, state.value);
+                state.value = next;
+                if (!ticket || !next.attempt)
+                    return;
+                // The ticket is exchanged by a normal request, so no session token has
+                // ever appeared in a URL.
+                await client.post('/v1/client/tickets/exchange', {
+                    attempt_id: next.attempt.id,
+                    ticket,
+                });
+                await atlas.reload();
+            })();
+        }, 2_000);
+    }, { immediate: true });
+    (0, vue_1.onScopeDispose)(stopPolling);
+    return { state, submit };
+}
+/** §10.2 `useSignIn()` — drive a sign-in attempt. */
+function useSignIn() {
+    return useFlow();
+}
+/** §10.2 `useSignUp()` — drive a sign-up attempt. */
+function useSignUp() {
+    return useFlow();
+}
+//# sourceMappingURL=flow.js.map

package/dist/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":";;AA2BA,0BAwEC;AAGD,8BAEC;AAGD,8BAEC;AA7GD,6BAAyE;AACzE,iCAOgB;AAChB,uCAAqC;AAkBrC,SAAgB,OAAO;IACrB,MAAM,KAAK,GAAG,IAAA,kBAAQ,GAAE,CAAC;IACzB,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAA,gBAAU,EAAY,IAAA,sBAAe,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,WAAW;KAC3B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAA8B,EAAE,EAAE;QAChD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,KAAK,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YAEnB,2EAA2E;YAC3E,2EAA2E;YAC3E,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;wBAC/C,UAAU,EAAG,IAAI,CAAC,OAA2B,CAAC,EAAE;wBAChD,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IAEF,4EAA4E;IAC5E,8EAA8E;IAC9E,2DAA2D;IAC3D,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,MAAM,EAAE,CAAC;YACX,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IAEF,IAAA,WAAK,EACH,KAAK,EACL,CAAC,OAAO,EAAE,EAAE;QACV,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC;YAAE,OAAO;QAExC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YACxB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,kBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBAErC,uEAAuE;gBACvE,0BAA0B;gBAC1B,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBAC/C,UAAU,EAAG,IAAI,CAAC,OAA2B,CAAC,EAAE;oBAChD,MAAM;iBACP,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC,EACD,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;IAEF,IAAA,oBAAc,EAAC,WAAW,CAAC,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS;IACvB,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS;IACvB,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}

package/dist/i18n.d.ts

@@ -0,0 +1,23 @@
+/**
+ * §10.3: "Every string passes through an i18n catalog; en-US ships, catalog
+ * format documented for community locales."
+ *
+ * A flat key-to-string map rather than nested objects, because nesting looks
+ * tidier and makes a missing key a runtime crash on `undefined.of.a.chain`
+ * rather than a visible fallback.
+ *
+ * A missing key renders the KEY, not an empty string. A blank button is a bug
+ * nobody can report; a button reading `signIn.submit` is one anyone can.
+ */
+export type Catalog = Record<string, string>;
+export declare const EN_US: Catalog;
+/**
+ * Look up a key and interpolate `{placeholders}`.
+ *
+ * An unknown placeholder is left visible for the same reason a missing key is:
+ * `Continue with {provider}` in the UI is a bug report waiting to be filed,
+ * whereas `Continue with ` is one nobody notices until a customer does.
+ */
+export declare function translate(catalog: Catalog, key: string, variables?: Record<string, string>): string;
+/** Merge a community locale over en-US so a partial translation still renders. */
+export declare function withFallback(locale: Catalog): Catalog;

package/dist/i18n.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * §10.3: "Every string passes through an i18n catalog; en-US ships, catalog
+ * format documented for community locales."
+ *
+ * A flat key-to-string map rather than nested objects, because nesting looks
+ * tidier and makes a missing key a runtime crash on `undefined.of.a.chain`
+ * rather than a visible fallback.
+ *
+ * A missing key renders the KEY, not an empty string. A blank button is a bug
+ * nobody can report; a button reading `signIn.submit` is one anyone can.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EN_US = void 0;
+exports.translate = translate;
+exports.withFallback = withFallback;
+exports.EN_US = {
+    'signIn.title': 'Sign in',
+    'signIn.subtitle': 'to continue to {application}',
+    'signIn.identifierLabel': 'Email address',
+    'signIn.passwordLabel': 'Password',
+    'signIn.submit': 'Continue',
+    'signIn.forgotPassword': 'Forgot password?',
+    'signIn.noAccount': 'No account?',
+    'signIn.signUpLink': 'Sign up',
+    'signIn.orDivider': 'or',
+    'signIn.socialButton': 'Continue with {provider}',
+    'signIn.emailCodeLabel': 'Verification code',
+    'signIn.magicLinkSent': 'Check your email for a sign-in link.',
+    'signIn.checkOtherTab': 'You can close this tab — you are signed in where you started.',
+    'signUp.title': 'Create your account',
+    'signUp.submit': 'Continue',
+    'signUp.haveAccount': 'Already have an account?',
+    'signUp.signInLink': 'Sign in',
+    'mfa.title': 'Two-step verification',
+    'mfa.subtitle': 'Enter the code from your authenticator app.',
+    'mfa.codeLabel': 'Code',
+    'mfa.enrollFirstCodeLabel': 'Code from your authenticator app',
+    'mfa.enrollSecondCodeLabel': 'The next code it shows',
+    'mfa.usePasskey': 'Use a passkey instead',
+    'mfa.useBackupCode': 'Use a recovery code',
+    'mfa.submit': 'Verify',
+    'reset.title': 'Reset your password',
+    'reset.submit': 'Send reset code',
+    'reset.newPasswordLabel': 'New password',
+    'userButton.manageAccount': 'Manage account',
+    'userButton.signOut': 'Sign out',
+    'userButton.signOutAll': 'Sign out of all devices',
+    'userProfile.title': 'Account',
+    'userProfile.profileSection': 'Profile',
+    'userProfile.emailsSection': 'Email addresses',
+    'userProfile.securitySection': 'Security',
+    'userProfile.devicesSection': 'Active devices',
+    'userProfile.dangerSection': 'Danger zone',
+    'userProfile.addEmail': 'Add an email address',
+    'userProfile.makePrimary': 'Make primary',
+    'userProfile.unverified': 'Unverified',
+    'userProfile.revokeDevice': 'Sign out',
+    'userProfile.deleteAccount': 'Delete account',
+    'organization.switcher': 'Switch organization',
+    'organization.personal': 'Personal account',
+    'organization.members': 'Members',
+    'organization.invite': 'Invite member',
+    'organization.roleLabel': 'Role',
+    'error.generic': 'Something went wrong. Please try again.',
+    'error.network': 'We could not reach the server. Check your connection.',
+};
+/**
+ * Look up a key and interpolate `{placeholders}`.
+ *
+ * An unknown placeholder is left visible for the same reason a missing key is:
+ * `Continue with {provider}` in the UI is a bug report waiting to be filed,
+ * whereas `Continue with ` is one nobody notices until a customer does.
+ */
+function translate(catalog, key, variables = {}) {
+    const template = catalog[key] ?? exports.EN_US[key] ?? key;
+    return template.replace(/\{(\w+)\}/g, (match, name) => variables[name] ?? match);
+}
+/** Merge a community locale over en-US so a partial translation still renders. */
+function withFallback(locale) {
+    return { ...exports.EN_US, ...locale };
+}
+//# sourceMappingURL=i18n.js.map

package/dist/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAsEH,8BAOC;AAGD,oCAEC;AA9EY,QAAA,KAAK,GAAY;IAC5B,cAAc,EAAE,SAAS;IACzB,iBAAiB,EAAE,8BAA8B;IACjD,wBAAwB,EAAE,eAAe;IACzC,sBAAsB,EAAE,UAAU;IAClC,eAAe,EAAE,UAAU;IAC3B,uBAAuB,EAAE,kBAAkB;IAC3C,kBAAkB,EAAE,aAAa;IACjC,mBAAmB,EAAE,SAAS;IAC9B,kBAAkB,EAAE,IAAI;IACxB,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,mBAAmB;IAC5C,sBAAsB,EAAE,sCAAsC;IAC9D,sBAAsB,EAAE,+DAA+D;IAEvF,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,UAAU;IAC3B,oBAAoB,EAAE,0BAA0B;IAChD,mBAAmB,EAAE,SAAS;IAE9B,WAAW,EAAE,uBAAuB;IACpC,cAAc,EAAE,6CAA6C;IAC7D,eAAe,EAAE,MAAM;IACvB,0BAA0B,EAAE,kCAAkC;IAC9D,2BAA2B,EAAE,wBAAwB;IACrD,gBAAgB,EAAE,uBAAuB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,YAAY,EAAE,QAAQ;IAEtB,aAAa,EAAE,qBAAqB;IACpC,cAAc,EAAE,iBAAiB;IACjC,wBAAwB,EAAE,cAAc;IAExC,0BAA0B,EAAE,gBAAgB;IAC5C,oBAAoB,EAAE,UAAU;IAChC,uBAAuB,EAAE,yBAAyB;IAElD,mBAAmB,EAAE,SAAS;IAC9B,4BAA4B,EAAE,SAAS;IACvC,2BAA2B,EAAE,iBAAiB;IAC9C,6BAA6B,EAAE,UAAU;IACzC,4BAA4B,EAAE,gBAAgB;IAC9C,2BAA2B,EAAE,aAAa;IAC1C,sBAAsB,EAAE,sBAAsB;IAC9C,yBAAyB,EAAE,cAAc;IACzC,wBAAwB,EAAE,YAAY;IACtC,0BAA0B,EAAE,UAAU;IACtC,2BAA2B,EAAE,gBAAgB;IAE7C,uBAAuB,EAAE,qBAAqB;IAC9C,uBAAuB,EAAE,kBAAkB;IAC3C,sBAAsB,EAAE,SAAS;IACjC,qBAAqB,EAAE,eAAe;IACtC,wBAAwB,EAAE,MAAM;IAEhC,eAAe,EAAE,yCAAyC;IAC1D,eAAe,EAAE,uDAAuD;CACzE,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,SAAS,CACvB,OAAgB,EAChB,GAAW,EACX,YAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,aAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IACnD,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,kFAAkF;AAClF,SAAgB,YAAY,CAAC,MAAe;IAC1C,OAAO,EAAE,GAAG,aAAK,EAAE,GAAG,MAAM,EAAE,CAAC;AACjC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export * from './appearance';
+export * from './protect';
+export * from './i18n';
+export * from './types';
+export * from './plugin';
+export * from './context';
+export * from './composables';
+export * from './flow';
+export * from './fapi';
+export * from './components';

package/dist/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./appearance"), exports);
+__exportStar(require("./protect"), exports);
+__exportStar(require("./i18n"), exports);
+__exportStar(require("./types"), exports);
+__exportStar(require("./plugin"), exports);
+__exportStar(require("./context"), exports);
+__exportStar(require("./composables"), exports);
+__exportStar(require("./flow"), exports);
+__exportStar(require("./fapi"), exports);
+__exportStar(require("./components"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,4CAA0B;AAC1B,yCAAuB;AACvB,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B;AAC1B,gDAA8B;AAC9B,yCAAuB;AACvB,yCAAuB;AACvB,+CAA6B"}

package/dist/plugin.d.ts

@@ -0,0 +1,72 @@
+import { type Plugin, type ShallowRef } from 'vue';
+import { type ProviderToken } from '@atlasauth/js';
+import { type Appearance } from './appearance';
+import { type Catalog } from './i18n';
+import type { AtlasOrganizationMembership, AtlasSession, AtlasUser, SessionClaims } from './types';
+/**
+ * §10.1 `app.use(createAtlas({ publishableKey }))`.
+ *
+ * The Vue peer of React's `<AtlasProvider>`. Holds exactly one thing that
+ * matters: the token, in memory. Not localStorage, not a cookie this code
+ * writes — the refresh token is HttpOnly so browser script never touches it,
+ * and the short-lived JWT lives only as long as the tab. A client that
+ * persisted either would survive the tab and become the thing an XSS reads
+ * first.
+ */
+export type AuthStatus = 'loading' | 'signed_in' | 'signed_out';
+/**
+ * The reactive auth state + actions provided to the whole app. Every field the
+ * React `AtlasContextValue` exposes, but the mutable ones are Vue refs so a
+ * composable can hand back a live `computed` rather than a snapshot.
+ */
+export interface AtlasClient {
+    publishableKey: string;
+    /** The instance's FAPI origin. */
+    frontendApi: string;
+    appearance?: Appearance;
+    catalog: Catalog;
+    status: ShallowRef<AuthStatus>;
+    user: ShallowRef<AtlasUser | null>;
+    session: ShallowRef<AtlasSession | null>;
+    claims: ShallowRef<SessionClaims | null>;
+    memberships: ShallowRef<AtlasOrganizationMembership[]>;
+    /**
+     * §5.3: a sign-in attempt handed back by an OAuth redirect that still needs a
+     * second factor (no session was issued). Null in the ordinary case. The
+     * <SignIn> flow seeds itself from this so the user resumes at the 2FA step
+     * instead of starting over. Captured synchronously at install time — before
+     * any component reads it — because a `needs_second_factor` redirect carries a
+     * status but no ticket, and that is what the 2FA resume seeds from.
+     */
+    pendingAttempt: {
+        id: string;
+        status: string;
+    } | null;
+    /** Always fresh: refreshes first if the cached token is close to expiry. */
+    getToken(): Promise<string | null>;
+    /**
+     * §6.6 the signed-in user's OWN live token at a connected provider (Google,
+     * GitHub, …), so the app can call that provider's API. Null when there is no
+     * usable token — no linked account, or the provider granted / kept none. The
+     * server refreshes a stale token on read; the refresh token is never exposed.
+     */
+    getProviderToken(provider: string): Promise<ProviderToken | null>;
+    signOut(): Promise<void>;
+    setActiveOrganization(organizationId: string | null): Promise<void>;
+    reload(): Promise<void>;
+}
+export interface CreateAtlasOptions {
+    publishableKey: string;
+    /** The instance's FAPI origin. */
+    frontendApi?: string;
+    appearance?: Appearance;
+    localization?: Catalog;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Build the Vue plugin. `app.use(createAtlas({ publishableKey }))` installs the
+ * client, provides it for `inject`, paints the appearance tokens onto the host
+ * DOM as CSS variables (no iframe — components render in the host DOM so
+ * Tailwind/CSS just works), and boots the session.
+ */
+export declare function createAtlas(options: CreateAtlasOptions): Plugin;

package/dist/plugin.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAtlas = createAtlas;
+const vue_1 = require("vue");
+const js_1 = require("@atlasauth/js");
+const appearance_1 = require("./appearance");
+const i18n_1 = require("./i18n");
+const context_1 = require("./context");
+/**
+ * Build the Vue plugin. `app.use(createAtlas({ publishableKey }))` installs the
+ * client, provides it for `inject`, paints the appearance tokens onto the host
+ * DOM as CSS variables (no iframe — components render in the host DOM so
+ * Tailwind/CSS just works), and boots the session.
+ */
+function createAtlas(options) {
+    const { client, boot } = createAtlasClient(options);
+    return {
+        install(app) {
+            app.provide(context_1.ATLAS_INJECTION_KEY, client);
+            // Tokens land as CSS variables on the host document root — the Vue peer of
+            // React's `<div class="atlas-root" style={cssVars}>`. There is no single
+            // element wrapping the whole app in a plugin, so the document root inherits
+            // them for every component that renders.
+            if (typeof document !== 'undefined') {
+                const vars = (0, appearance_1.cssVariables)((0, appearance_1.resolveTokens)(options.appearance));
+                for (const [name, value] of Object.entries(vars)) {
+                    document.documentElement.style.setProperty(name, value);
+                }
+                document.documentElement.classList.add('atlas-root');
+            }
+            // Boot once per install. Guarded to the browser: on the server there is no
+            // redirect to complete and no cookie jar to read, so the app renders
+            // `loading` and hydrates into the real status on the client.
+            if (typeof window !== 'undefined') {
+                void boot();
+            }
+        },
+    };
+}
+/**
+ * The reactive client. Separated from the plugin wrapper so a test can build it
+ * directly, and so a single `createAtlas(...)` result installs one consistent
+ * client no matter how many times the returned plugin is `use`d.
+ */
+function createAtlasClient(options) {
+    const publishableKey = options.publishableKey;
+    const baseUrl = options.frontendApi ?? '';
+    const doFetch = options.fetchImpl ?? fetch;
+    const status = (0, vue_1.shallowRef)('loading');
+    const user = (0, vue_1.shallowRef)(null);
+    const session = (0, vue_1.shallowRef)(null);
+    const claims = (0, vue_1.shallowRef)(null);
+    const memberships = (0, vue_1.shallowRef)([]);
+    const cache = new js_1.TokenCache();
+    let timer = null;
+    const pendingAttempt = (() => {
+        if (typeof window === 'undefined')
+            return null;
+        const result = (0, js_1.readRedirectResult)(window.location.search);
+        return result?.status && !result.ticket
+            ? { id: result.attemptId, status: result.status }
+            : null;
+    })();
+    const call = (path, init) => doFetch(`${baseUrl}${path}`, {
+        ...init,
+        // Cookies carry the session; a fetch without this looks identical to
+        // being signed out.
+        credentials: 'include',
+        headers: {
+            'x-publishable-key': publishableKey,
+            ...(init?.body ? { 'content-type': 'application/json' } : {}),
+            ...init?.headers,
+        },
+    });
+    const applyToken = (jwt, sessionId) => {
+        const expiresAt = (0, js_1.readExpiry)(jwt);
+        if (!expiresAt)
+            return;
+        cache.set({ jwt, expiresAt, sessionId });
+        claims.value = decodeClaims(jwt);
+    };
+    const reload = async () => {
+        try {
+            const response = await call('/v1/client');
+            if (!response.ok)
+                throw new Error('boot failed');
+            const body = (await response.json());
+            if (!body.session || !body.user) {
+                cache.clear();
+                status.value = 'signed_out';
+                user.value = null;
+                session.value = null;
+                claims.value = null;
+                memberships.value = [];
+                return;
+            }
+            user.value = body.user;
+            session.value = body.session;
+            memberships.value = body.organization_memberships ?? [];
+            if (body.jwt)
+                applyToken(body.jwt, body.session.id);
+            status.value = 'signed_in';
+        }
+        catch {
+            // A failed boot is NOT signed-out. Rendering a sign-in form because the
+            // network hiccuped throws away a perfectly good session and makes the
+            // user re-authenticate for no reason.
+            if (status.value === 'loading')
+                status.value = 'signed_out';
+        }
+    };
+    const refresh = async () => {
+        const current = cache.peek();
+        if (!current)
+            return;
+        try {
+            const response = await call(`/v1/client/sessions/${current.sessionId}/tokens`, {
+                method: 'POST',
+            });
+            if (!response.ok)
+                throw new Error('refresh failed');
+            const body = (await response.json());
+            applyToken(body.jwt, body.session_id);
+        }
+        catch {
+            // The session may genuinely be gone. Re-boot rather than guess.
+            await reload();
+        }
+    };
+    /** §7.4: proactive, jittered refresh scheduled from the token's own expiry. */
+    const scheduleRefresh = () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        if (status.value !== 'signed_in')
+            return;
+        const token = cache.peek();
+        if (!token)
+            return;
+        const delay = (0, js_1.msUntilRefresh)({ token, now: Date.now() });
+        timer = setTimeout(() => void refresh(), delay);
+    };
+    const getToken = async () => {
+        // A 5s skew so a token that would die inside the caller's request is
+        // refreshed first rather than handed over.
+        const usable = cache.get(5_000);
+        if (usable)
+            return usable.jwt;
+        await refresh();
+        return cache.get(5_000)?.jwt ?? null;
+    };
+    // The FAPI client for the token-vault read. Reuses the same publishable key
+    // and fetch so the framework-agnostic `@atlasauth/js` helper is the single
+    // implementation the Vue SDK surfaces.
+    const fapiClient = new js_1.FapiClient({ publishableKey, baseUrl, fetchImpl: doFetch });
+    const getProviderToken = (provider) => (0, js_1.getProviderToken)(fapiClient, provider);
+    const signOut = async () => {
+        const current = cache.peek();
+        if (current) {
+            await call(`/v1/client/sessions/${current.sessionId}/revoke`, { method: 'POST' }).catch(() => undefined);
+        }
+        cache.clear();
+        status.value = 'signed_out';
+        user.value = null;
+        session.value = null;
+        claims.value = null;
+        memberships.value = [];
+    };
+    const setActiveOrganization = async (organizationId) => {
+        const current = cache.peek();
+        if (!current)
+            return;
+        const response = await call(`/v1/client/sessions/${current.sessionId}/touch`, {
+            method: 'POST',
+            body: JSON.stringify({ active_organization_id: organizationId }),
+        });
+        if (!response.ok)
+            return;
+        const body = (await response.json());
+        // The new token carries the new org claims; re-boot would work too but
+        // costs a round trip for information already in hand.
+        applyToken(body.jwt, current.sessionId);
+        await reload();
+    };
+    const catalog = options.localization ? (0, i18n_1.withFallback)(options.localization) : i18n_1.EN_US;
+    // §7.4 the refresh timer is driven off the reactive state. Any change to
+    // status or claims (a new token has new claims and a new expiry) reschedules
+    // the proactive refresh — the Vue peer of React's expiry effect. A detached
+    // scope so the watcher lives for the app's lifetime and never attaches to a
+    // component that happens to install the plugin.
+    const scope = (0, vue_1.effectScope)(true);
+    scope.run(() => {
+        (0, vue_1.watch)([status, claims], () => scheduleRefresh(), { flush: 'post' });
+    });
+    /**
+     * §6.3 step 3: complete a redirect-based sign-in. An OAuth or hosted-page flow
+     * lands back here with a one-time ticket in the URL; exchange it for cookies,
+     * scrub the URL so a reload can't replay it, THEN boot. A redirect that only
+     * carries a `__atlas_status` (a second factor is still owed) has no ticket, so
+     * nothing is exchanged and the app boots signed-out — exactly as intended.
+     */
+    const boot = async () => {
+        const result = typeof window !== 'undefined' ? (0, js_1.readRedirectResult)(window.location.search) : null;
+        if (result?.ticket) {
+            await call('/v1/client/tickets/exchange', {
+                method: 'POST',
+                body: JSON.stringify({ attempt_id: result.attemptId, ticket: result.ticket }),
+            }).catch(() => undefined);
+        }
+        if (result && typeof window !== 'undefined') {
+            window.history.replaceState({}, document.title, (0, js_1.stripRedirectParams)(window.location.href));
+        }
+        await reload();
+    };
+    // `boot` is returned separately, not on the client — it is an install-time
+    // concern the plugin drives exactly once, so the public `AtlasClient` surface
+    // stays identical to React's context value.
+    return {
+        client: {
+            publishableKey,
+            frontendApi: baseUrl,
+            appearance: options.appearance,
+            catalog,
+            status,
+            user,
+            session,
+            claims,
+            memberships,
+            pendingAttempt,
+            getToken,
+            getProviderToken,
+            signOut,
+            setActiveOrganization,
+            reload,
+        },
+        boot,
+    };
+}
+function decodeClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        return JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":";;AA0FA,kCA2BC;AArHD,6BAOa;AACb,sCASuB;AACvB,6CAA4E;AAC5E,iCAA2D;AAC3D,uCAAgD;AAgEhD;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,OAA2B;IACrD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,OAAO,CAAC,GAAQ;YACd,GAAG,CAAC,OAAO,CAAC,6BAAmB,EAAE,MAAM,CAAC,CAAC;YAEzC,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,yCAAyC;YACzC,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,IAAA,yBAAY,EAAC,IAAA,0BAAa,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1D,CAAC;gBACD,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YAED,2EAA2E;YAC3E,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,KAAK,IAAI,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IAIpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAA,gBAAU,EAAa,SAAS,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAU,EAAmB,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAA,gBAAU,EAAsB,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAA,gBAAU,EAAuB,IAAI,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAA,gBAAU,EAAgC,EAAE,CAAC,CAAC;IAElE,MAAM,KAAK,GAAG,IAAI,eAAU,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAyC,IAAI,CAAC;IAEvD,MAAM,cAAc,GAA0C,CAAC,GAAG,EAAE;QAClE,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAA,uBAAkB,EAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;YACrC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAkB,EAAE,EAAE,CAChD,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;QAC3B,GAAG,IAAI;QACP,qEAAqE;QACrE,oBAAoB;QACpB,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,mBAAmB,EAAE,cAAc;YACnC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI,EAAE,OAAO;SACjB;KACF,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,IAAA,eAAU,EAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YAEjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;gBAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;gBACrB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;gBACpB,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,sEAAsE;YACtE,sCAAsC;YACtC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,OAAO,CAAC,SAAS,SAAS,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAEpD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;YAC5E,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,+EAA+E;IAC/E,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,GAAG,IAAA,mBAAc,EAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;QAC9B,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;IACvC,CAAC,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,UAAU,GAAG,IAAI,eAAU,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAA,qBAAkB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,uBAAuB,OAAO,CAAC,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CACrF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,cAA6B,EAAE,EAAE;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,OAAO,CAAC,SAAS,QAAQ,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,cAAc,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,uEAAuE;QACvE,sDAAsD;QACtD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,mBAAY,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAK,CAAC;IAElF,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,KAAK,GAAG,IAAA,iBAAW,EAAC,IAAI,CAAC,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;QACb,IAAA,WAAK,EAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAA,uBAAkB,EAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEpF,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,6BAA6B,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAA,wBAAmB,EAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,2EAA2E;IAC3E,8EAA8E;IAC9E,4CAA4C;IAC5C,OAAO;QACL,MAAM,EAAE;YACN,cAAc;YACd,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO;YACP,MAAM;YACN,IAAI;YACJ,OAAO;YACP,MAAM;YACN,WAAW;YACX,cAAc;YACd,QAAQ;YACR,gBAAgB;YAChB,OAAO;YACP,qBAAqB;YACrB,MAAM;SACP;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAkB,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/protect.d.ts

@@ -0,0 +1,18 @@
+/**
+ * §10.2 `<Protect permission="org:sys_memberships:manage">` — conditional
+ * rendering.
+ *
+ * The rule that makes this safe to ship: this is a RENDERING helper, never an
+ * authorization boundary. It decides what a user sees, and seeing is not doing.
+ * Anyone can open devtools and flip the condition; the only thing that stops
+ * them acting is the server checking the same permission on the request.
+ *
+ * That is worth stating loudly because the component reads like a guard, and a
+ * developer who believes it is one will eventually put a delete button behind
+ * it and no check behind the endpoint.
+ *
+ * The evaluation logic lives in `@atlasauth/authz` — the ONE primitive every SDK
+ * (backend, Next.js, React, React Native, JS) shares, so `<Protect>` here and
+ * `auth().has()` on the server judge a condition identically.
+ */
+export { type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, } from '@atlasauth/authz';

package/dist/protect.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasFromClaims = exports.evaluate = void 0;
+/**
+ * §10.2 `<Protect permission="org:sys_memberships:manage">` — conditional
+ * rendering.
+ *
+ * The rule that makes this safe to ship: this is a RENDERING helper, never an
+ * authorization boundary. It decides what a user sees, and seeing is not doing.
+ * Anyone can open devtools and flip the condition; the only thing that stops
+ * them acting is the server checking the same permission on the request.
+ *
+ * That is worth stating loudly because the component reads like a guard, and a
+ * developer who believes it is one will eventually put a delete button behind
+ * it and no check behind the endpoint.
+ *
+ * The evaluation logic lives in `@atlasauth/authz` — the ONE primitive every SDK
+ * (backend, Next.js, React, React Native, JS) shares, so `<Protect>` here and
+ * `auth().has()` on the server judge a condition identically.
+ */
+var authz_1 = require("@atlasauth/authz");
+Object.defineProperty(exports, "evaluate", { enumerable: true, get: function () { return authz_1.evaluate; } });
+Object.defineProperty(exports, "hasFromClaims", { enumerable: true, get: function () { return authz_1.hasFromClaims; } });
+//# sourceMappingURL=protect.js.map

package/dist/protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../src/protect.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,0CAM0B;AAFxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA"}