@auth-craft/client 0.1.0 → 0.1.1

package/dist/transport/worker.js

@@ -0,0 +1,421 @@
+/// <reference lib="webworker" />
+import { err, ok } from 'ts-micro-result';
+import { DEFAULT_REFRESH_EARLY_MS } from './constants';
+import { AuthErrors, DomainErrors, GeneralErrors, InitErrors, RequestErrors } from './errors';
+import { MSG } from './messages';
+import { buildProviderFromPreset } from './provider/register-presets';
+import { clearProviders, getProvider, hasProvider, listProviders, registerProvider, unregisterProvider, } from './utils/registry';
+import { sendAuthCallResult, sendAuthStateChanged, sendError, sendFetchError, sendFetchResult, sendPong, sendReady, sendSetupError, sendTokenRefreshed, } from './worker-post';
+// Re-export provider utilities for custom workers
+export { createProvider } from './provider/create-provider';
+export { bodyParser } from './provider/parser/body';
+export { cookieParser } from './provider/parser/cookie';
+export { createIndexedDBStorage } from './provider/storage/indexeddb';
+export { createBodyStrategy } from './provider/strategy/body';
+export { createCookieStrategy } from './provider/strategy/cookie';
+// Re-export registry functions for custom workers
+// This ensures custom workers use the SAME registry instance as the worker IIFE
+export { clearProviders, hasProvider, listProviders, registerProvider, unregisterProvider };
+import { arrayBufferToBase64, isBinaryContentType } from './utils/binary';
+/**
+ * IIFE Closure to protect sensitive tokens from external access
+ * Inspired by api-worker.js security pattern
+ */
+import { deserializeFormData, isSerializedFormData } from './utils/formdata';
+(() => {
+    let config = null;
+    let provider = null;
+    let accessToken = null;
+    let refreshToken = null;
+    let expiresAt = null;
+    let currentUser;
+    const pendingControllers = new Map();
+    let refreshPromise = null;
+    let authPromise = null;
+    /**
+     * Mutex wrapper for auth operations (login, logout, custom auth methods)
+     * Prevents race conditions when multiple concurrent auth calls are made.
+     *
+     * Edge case: If authPromise rejects, we catch and ignore it so the next
+     * operation can proceed. Without this, a failed login would block
+     * subsequent login attempts.
+     */
+    async function withAuthMutex(operation) {
+        // Wait for any pending auth operation (ignore previous errors)
+        if (authPromise) {
+            try {
+                await authPromise;
+            }
+            catch {
+                // Ignore previous auth error - allow new operation to proceed
+            }
+        }
+        const promise = operation();
+        authPromise = promise;
+        try {
+            return await promise;
+        }
+        finally {
+            authPromise = null;
+        }
+    }
+    /**
+     * Ensure we have a valid access token (not expired).
+     * If token is missing or expired, refresh it.
+     * Prevents concurrent refresh attempts.
+     *
+     * @returns Result<string> - access token on success, error on failure
+     */
+    async function ensureValidToken() {
+        // Provider must be initialized via SETUP first
+        if (!provider) {
+            return err(InitErrors.NotInitialized());
+        }
+        // Determine refresh reason before checking if refresh is needed
+        const refreshEarlyMs = config?.refreshEarlyMs ?? DEFAULT_REFRESH_EARLY_MS;
+        const now = Date.now();
+        const timeLeft = expiresAt ? expiresAt - now : 0;
+        const isExpired = !accessToken || !expiresAt || timeLeft <= 0;
+        const isProactive = !isExpired && timeLeft <= refreshEarlyMs;
+        if (accessToken && expiresAt && timeLeft > refreshEarlyMs) {
+            return ok(accessToken);
+        }
+        if (refreshPromise) {
+            const result = await refreshPromise;
+            return result;
+        }
+        refreshPromise = (async () => {
+            try {
+                // Provider already checked above, TypeScript needs assertion
+                if (!provider) {
+                    return err(InitErrors.NotInitialized());
+                }
+                const valueRes = await provider.refreshToken(refreshToken);
+                if (!valueRes.ok) {
+                    setTokenState({ token: null, expiresAt: null, user: undefined, refreshToken: undefined });
+                    return err(valueRes.errors);
+                }
+                const tokenInfo = valueRes.data;
+                if (!tokenInfo) {
+                    return err(AuthErrors.TokenRefreshFailed({ message: 'Provider returned null token info' }));
+                }
+                setTokenState(tokenInfo);
+                // Validate that we got a valid access token after refresh
+                if (!accessToken) {
+                    return err(AuthErrors.TokenRefreshFailed({ message: 'Access token is null after refresh' }));
+                }
+                // Emit TOKEN_REFRESHED event for debug hooks
+                sendTokenRefreshed(isProactive ? 'proactive' : 'expired');
+                return ok(accessToken);
+            }
+            finally {
+                refreshPromise = null;
+            }
+        })();
+        return refreshPromise;
+    }
+    /**
+     * Validate domain against allowed domains
+     */
+    function validateDomain(url) {
+        if (!config?.allowedDomains?.length) {
+            return true;
+        }
+        try {
+            const urlObj = new URL(url);
+            const hostname = urlObj.hostname;
+            const port = urlObj.port;
+            for (const entry of config.allowedDomains) {
+                const idx = entry.lastIndexOf(':');
+                const hasPort = idx > -1 && entry.indexOf(':') === idx;
+                const pattern = hasPort ? entry.slice(0, idx) : entry;
+                const entryPort = hasPort ? entry.slice(idx + 1) : '';
+                const isWildcard = pattern.startsWith('*.');
+                const base = isWildcard ? pattern.slice(2) : pattern;
+                const hostnameMatch = isWildcard ? hostname === base || hostname.endsWith(`.${base}`) : hostname === base;
+                if (!hostnameMatch)
+                    continue;
+                if (hasPort) {
+                    if (port === entryPort)
+                        return true;
+                    continue;
+                }
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Make API request with proactive token management
+     */
+    async function makeApiRequest(url, options = {}) {
+        if (!config) {
+            return err(InitErrors.NotInitialized());
+        }
+        if (!validateDomain(url)) {
+            return err(DomainErrors.NotAllowed({ url }));
+        }
+        const requiresAuth = options.requiresAuth !== false;
+        const includeHeaders = options.includeHeaders === true;
+        // Extract FetchGuard-specific options and keep only standard RequestInit
+        const { requiresAuth: _, includeHeaders: __, ...fetchOptions } = options;
+        // Deserialize FormData if present (inspired by api-worker.js:484-518)
+        if (fetchOptions.body && isSerializedFormData(fetchOptions.body)) {
+            fetchOptions.body = deserializeFormData(fetchOptions.body);
+        }
+        const headers = {
+            ...(config.defaultHeaders || {}),
+            ...(fetchOptions.headers || {}),
+        };
+        // Don't set Content-Type for FormData - browser will set it with boundary
+        if (!headers['Content-Type'] && !headers['content-type'] && fetchOptions.body) {
+            if (typeof fetchOptions.body === 'object' &&
+                !(fetchOptions.body instanceof FormData) &&
+                !(fetchOptions.body instanceof URLSearchParams)) {
+                headers['Content-Type'] = 'application/json';
+            }
+        }
+        if (requiresAuth) {
+            const tokenRes = await ensureValidToken();
+            if (!tokenRes.ok) {
+                // Propagate error - cast to correct return type
+                return err(tokenRes.errors);
+            }
+            const token = tokenRes.data;
+            if (token) {
+                headers.Authorization = `Bearer ${token}`;
+            }
+        }
+        let response;
+        try {
+            response = await fetch(url, { ...fetchOptions, headers, credentials: 'include' });
+        }
+        catch (e) {
+            const aborted = e instanceof Error && e.name === 'AbortError';
+            return aborted ? err(RequestErrors.Cancelled()) : err(RequestErrors.NetworkError({ message: String(e) }));
+        }
+        // Extract content-type (always needed for binary detection)
+        const contentType = response.headers.get('content-type') || 'application/octet-stream';
+        // Determine if response is binary
+        const isBinary = isBinaryContentType(contentType);
+        // Get body as text or base64
+        let body;
+        try {
+            if (isBinary) {
+                const buffer = await response.arrayBuffer();
+                body = arrayBufferToBase64(buffer);
+            }
+            else {
+                body = await response.text();
+            }
+        }
+        catch (e) {
+            // Reading/parsing response body failed
+            return err(RequestErrors.ResponseParseFailed({ message: String(e) }));
+        }
+        // Extract headers if requested
+        const responseHeaders = {};
+        if (includeHeaders) {
+            response.headers.forEach((value, key) => {
+                responseHeaders[key] = value;
+            });
+        }
+        const responseData = { body, status: response.status, contentType, headers: responseHeaders };
+        return ok(responseData);
+    }
+    /**
+     * Update token state from TokenInfo and auto emit AUTH_STATE_CHANGED
+     *
+     * Smart update logic for ALL fields:
+     * - Only update field if key exists in tokenInfo
+     * - If key exists with value: update to that value (including null)
+     * - If key doesn't exist: preserve existing value
+     *
+     * This allows flexible custom auth methods:
+     * - Standard login/refresh: returns { token, user, expiresAt }
+     * - Update user info: may only return { user: {...} } (no token change)
+     * - Verify OTP: may return {} (just validation, no state change)
+     * - Logout: returns { token: null, user: null, ... } to clear all
+     */
+    function setTokenState(tokenInfo, emitEvent = true) {
+        // Apply smart preservation to ALL fields
+        if ('token' in tokenInfo) {
+            accessToken = tokenInfo.token ?? null;
+        }
+        if ('expiresAt' in tokenInfo) {
+            expiresAt = tokenInfo.expiresAt ?? null;
+        }
+        if ('user' in tokenInfo) {
+            currentUser = tokenInfo.user;
+        }
+        if ('refreshToken' in tokenInfo) {
+            refreshToken = tokenInfo.refreshToken ?? null;
+        }
+        if (emitEvent) {
+            postAuthChanged();
+        }
+    }
+    /**
+     * Emit AUTH_STATE_CHANGED event based on current state
+     * authenticated = true if we have valid non-expired token
+     */
+    function postAuthChanged() {
+        const now = Date.now();
+        const authenticated = accessToken !== null && accessToken !== '' && (expiresAt === null || expiresAt > now);
+        sendAuthStateChanged({
+            authenticated,
+            expiresAt,
+            user: currentUser,
+        });
+    }
+    /**
+     * Main message handler
+     * Each case has its own try-catch for better error isolation
+     */
+    self.onmessage = async (event) => {
+        const data = event.data;
+        switch (data.type) {
+            case MSG.SETUP: {
+                try {
+                    const payload = data.payload;
+                    config = payload.config;
+                    const providerConfig = payload.providerConfig;
+                    // Build provider from config
+                    if (typeof providerConfig === 'string') {
+                        // Registry lookup
+                        provider = getProvider(providerConfig);
+                    }
+                    else if (providerConfig && typeof providerConfig === 'object' && 'type' in providerConfig) {
+                        // ProviderPresetConfig object - pass defaultHeaders for auth requests
+                        provider = buildProviderFromPreset(providerConfig, config.defaultHeaders);
+                    }
+                    else {
+                        sendSetupError('Invalid provider config');
+                        break;
+                    }
+                    // Validate provider was successfully created
+                    if (!provider) {
+                        sendSetupError('Provider initialization failed - provider is null');
+                        break;
+                    }
+                    sendReady();
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    console.error('[FetchGuard Worker] Setup failed:', errorMessage);
+                    sendSetupError(errorMessage);
+                }
+                break;
+            }
+            case MSG.FETCH: {
+                const { id } = data;
+                try {
+                    const { url, options } = data.payload;
+                    const controller = new AbortController();
+                    pendingControllers.set(id, controller);
+                    const merged = { ...(options || {}), signal: controller.signal };
+                    const result = await makeApiRequest(url, merged);
+                    if (result.ok) {
+                        sendFetchResult(id, result.data);
+                    }
+                    else {
+                        // Network/timeout/cancel error
+                        const error = result.errors[0];
+                        const message = error?.message || 'Unknown error';
+                        sendFetchError(id, message, undefined);
+                    }
+                    pendingControllers.delete(id);
+                }
+                catch (error) {
+                    pendingControllers.delete(id);
+                    sendFetchError(id, error instanceof Error ? error.message : String(error), undefined);
+                }
+                break;
+            }
+            case MSG.AUTH_CALL: {
+                const { id, payload } = data;
+                // Use mutex to prevent concurrent auth operations (login, logout, etc.)
+                await withAuthMutex(async () => {
+                    try {
+                        const { method, args, emitEvent } = payload;
+                        const shouldEmitEvent = emitEvent ?? true; // Default: emit event
+                        if (!provider) {
+                            sendError(id, err(InitErrors.NotInitialized()));
+                            return;
+                        }
+                        if (typeof provider[method] !== 'function') {
+                            sendError(id, err(GeneralErrors.Unexpected({ message: `Method '${method}' not found on provider` })));
+                            return;
+                        }
+                        // Inject current access token for exchangeToken method
+                        let methodArgs = args;
+                        if (method === 'exchangeToken') {
+                            methodArgs = [accessToken, ...args];
+                        }
+                        // Dynamic dispatch: the index signature uses `never[]` params (so
+                        // specific methods stay assignable without `any`); narrow to a
+                        // callable here to spread runtime args.
+                        const fn = provider[method];
+                        const result = await fn(...methodArgs);
+                        if (!result.ok) {
+                            sendError(id, result);
+                            return;
+                        }
+                        const tokenInfo = result.data;
+                        if (!tokenInfo) {
+                            sendError(id, err(GeneralErrors.Unexpected({ message: 'Provider returned null token info' })));
+                            return;
+                        }
+                        // Update token state and optionally emit event
+                        setTokenState(tokenInfo, shouldEmitEvent);
+                        // Always send AuthResult back
+                        const now = Date.now();
+                        const authenticated = accessToken !== null && accessToken !== '' && (expiresAt === null || expiresAt > now);
+                        sendAuthCallResult(id, {
+                            authenticated,
+                            expiresAt,
+                            user: currentUser,
+                        });
+                    }
+                    catch (error) {
+                        sendError(id, err(GeneralErrors.Unexpected({ message: error instanceof Error ? error.message : String(error) })));
+                    }
+                });
+                break;
+            }
+            case MSG.CANCEL: {
+                try {
+                    const { id } = data;
+                    const controller = pendingControllers.get(id);
+                    if (controller) {
+                        controller.abort();
+                        pendingControllers.delete(id);
+                    }
+                }
+                catch (_error) {
+                    // Silently ignore cancel errors
+                }
+                break;
+            }
+            case MSG.PING: {
+                const { id } = data;
+                try {
+                    const ts = data.payload?.timestamp ?? Date.now();
+                    sendPong(id, ts);
+                }
+                catch (error) {
+                    sendError(id, err(GeneralErrors.Unexpected({ message: error instanceof Error ? error.message : String(error) })));
+                }
+                break;
+            }
+            default: {
+                const unknownData = data;
+                sendError(unknownData.id ?? `evt_${Date.now()}`, err(GeneralErrors.UnknownMessage({ message: `Unknown message type: ${String(unknownData.type)}` })));
+            }
+        }
+    };
+})(); // End IIFE - Immediately Invoked Function Expression
+//# sourceMappingURL=worker.js.map

package/dist/transport/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/transport/worker.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9F,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAStE,OAAO,EACL,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,cAAc,EACd,eAAe,EACf,QAAQ,EACR,SAAS,EACT,cAAc,EACd,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,kDAAkD;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,kDAAkD;AAClD,gFAAgF;AAChF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;AAE5F,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1E;;;GAGG;AACH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,CAAC,GAAG,EAAE;IACJ,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAgC,CAAC;IACrC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9D,IAAI,cAAc,GAAmC,IAAI,CAAC;IAC1D,IAAI,WAAW,GAA4B,IAAI,CAAC;IAEhD;;;;;;;OAOG;IACH,KAAK,UAAU,aAAa,CAAI,SAA2B;QACzD,+DAA+D;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;QAC5B,WAAW,GAAG,OAAO,CAAC;QAEtB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,gBAAgB;QAC7B,+CAA+C;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,gEAAgE;QAChE,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,wBAAwB,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,SAAS,IAAI,QAAQ,IAAI,cAAc,CAAC;QAE7D,IAAI,WAAW,IAAI,SAAS,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,cAAc,GAAG,CAAC,KAAK,IAA6B,EAAE;YACpD,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAE3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC1F,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAChC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;gBAC9F,CAAC;gBAED,aAAa,CAAC,SAAS,CAAC,CAAC;gBAEzB,0DAA0D;gBAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC;gBAC/F,CAAC;gBAED,6CAA6C;gBAC7C,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAE1D,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CAAC,GAAW;QACjC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YAEzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;gBACvD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACtD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAErD,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;gBAE1G,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,IAAI,KAAK,SAAS;wBAAE,OAAO,IAAI,CAAC;oBACpC,SAAS;gBACX,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,UAAiC,EAAE;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;QACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC;QACvD,yEAAyE;QACzE,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QAEzE,sEAAsE;QACtE,IAAI,YAAY,CAAC,IAAI,IAAI,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,YAAY,CAAC,IAAI,GAAG,mBAAmB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;YAChC,GAAG,CAAE,YAAY,CAAC,OAAkC,IAAI,EAAE,CAAC;SAC5D,CAAC;QAEF,0EAA0E;QAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YAC9E,IACE,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ;gBACrC,CAAC,CAAC,YAAY,CAAC,IAAI,YAAY,QAAQ,CAAC;gBACxC,CAAC,CAAC,YAAY,CAAC,IAAI,YAAY,eAAe,CAAC,EAC/C,CAAC;gBACD,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,gDAAgD;gBAChD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC5B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;YAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;QAEvF,kCAAkC;QAClC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAElD,6BAA6B;QAC7B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uCAAuC;YACvC,OAAO,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,+BAA+B;QAC/B,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC9F,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,aAAa,CACpB,SAA6G,EAC7G,YAAqB,IAAI;QAEzB,yCAAyC;QACzC,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,WAAW,GAAG,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC;QACxC,CAAC;QAED,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,CAAC;QAED,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;YAChC,YAAY,GAAG,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,eAAe;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,GAAG,CAAC,CAAC;QAC5G,oBAAoB,CAAC;YACnB,aAAa;YACb,SAAS;YACT,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,SAAS,GAAG,KAAK,EAAE,KAAwC,EAAE,EAAE;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;oBAC7B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBAExB,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;oBAE9C,6BAA6B;oBAC7B,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;wBACvC,kBAAkB;wBAClB,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;oBACzC,CAAC;yBAAM,IAAI,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;wBAC5F,sEAAsE;wBACtE,QAAQ,GAAG,uBAAuB,CAAC,cAAsC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;oBACpG,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,yBAAyB,CAAC,CAAC;wBAC1C,MAAM;oBACR,CAAC;oBAED,6CAA6C;oBAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,cAAc,CAAC,mDAAmD,CAAC,CAAC;wBACpE,MAAM;oBACR,CAAC;oBAED,SAAS,EAAE,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC5E,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;oBACjE,cAAc,CAAC,YAAY,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBACf,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;oBACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;oBACzC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;oBACvC,MAAM,MAAM,GAAgB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;oBAC9E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBAEjD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;wBACd,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACnC,CAAC;yBAAM,CAAC;wBACN,+BAA+B;wBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC/B,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,eAAe,CAAC;wBAClD,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;oBACzC,CAAC;oBAED,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC9B,cAAc,CAAC,EAAE,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;gBAC7B,wEAAwE;gBACxE,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,CAAC;wBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;wBAC5C,MAAM,eAAe,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,sBAAsB;wBAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;4BAChD,OAAO;wBACT,CAAC;wBAED,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;4BAC3C,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,MAAM,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC;4BACtG,OAAO;wBACT,CAAC;wBAED,uDAAuD;wBACvD,IAAI,UAAU,GAAG,IAAI,CAAC;wBACtB,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;4BAC/B,UAAU,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;wBACtC,CAAC;wBAED,kEAAkE;wBAClE,+DAA+D;wBAC/D,wCAAwC;wBACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAoD,CAAC;wBAC/E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;wBACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;4BACf,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;4BACtB,OAAO;wBACT,CAAC;wBAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;wBAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,CAAC;4BAC/F,OAAO;wBACT,CAAC;wBAED,+CAA+C;wBAC/C,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;wBAE1C,8BAA8B;wBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACvB,MAAM,aAAa,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,GAAG,CAAC,CAAC;wBAE5G,kBAAkB,CAAC,EAAE,EAAE;4BACrB,aAAa;4BACb,SAAS;4BACT,IAAI,EAAE,WAAW;yBAClB,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,SAAS,CACP,EAAE,EACF,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CACnG,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YAED,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;oBACpB,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC9C,IAAI,UAAU,EAAE,CAAC;wBACf,UAAU,CAAC,KAAK,EAAE,CAAC;wBACnB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,gCAAgC;gBAClC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBACjD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,CACP,EAAE,EACF,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CACnG,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAG,IAAuC,CAAC;gBAC5D,SAAS,CACP,WAAW,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EACrC,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,yBAAyB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC,CAAC,qDAAqD"}

package/dist/types.test-d.js

@@ -1,16 +1,9 @@
-/**
- * Type-level POC: the generated client methods are typed FROM the contract.
- * Correct calls compile; wrong calls must fail (verified by @ts-expect-error).
- * This is the mechanical guarantee — a contract change re-types these call sites.
- *
- * This file is type-checked (tsc --noEmit), not executed.
- */
-import { authContract } from '@auth-craft/api-contract';
+void _unreachable;
 // ✓ me: no body, no params → callable with no argument
 void client.me();
 // ✓ authenticate: body inferred from the contract schema
 void client.authenticate({
-    body: { identityType: 'email', identityValue: 'a@b.com', credentialType: 'password', credentialValue: 'x' }
+    body: { identityType: 'email', identityValue: 'a@b.com', credentialType: 'password', credentialValue: 'x' },
 });
 // ✓ selectTenant: body { tenantId }
 void client.selectTenant({ body: { tenantId: 't1' } });
@@ -23,4 +16,5 @@ void client.selectTenant({ body: { tenant: 't1' } });
 // ✗ me takes no body → MUST error
 // @ts-expect-error me accepts no argument with body
 void client.me({ body: { x: 1 } });
+export {};
 //# sourceMappingURL=types.test-d.js.map

package/dist/types.test-d.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.test-d.js","sourceRoot":"","sources":["../src/types.test-d.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAKvD,uDAAuD;AACvD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAA;AAEhB,yDAAyD;AACzD,KAAK,MAAM,CAAC,YAAY,CAAC;IACvB,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE;CAC5G,CAAC,CAAA;AAEF,oCAAoC;AACpC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AAEtD,sDAAsD;AACtD,+DAA+D;AAC/D,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;AAE7D,+CAA+C;AAC/C,iDAAiD;AACjD,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AAEpD,kCAAkC;AAClC,oDAAoD;AACpD,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA"}
+{"version":3,"file":"types.test-d.js","sourceRoot":"","sources":["../src/types.test-d.ts"],"names":[],"mappings":"AA4CA,KAAM,YAA6B,CAAC;AAIpC,uDAAuD;AACvD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;AAEjB,yDAAyD;AACzD,KAAK,MAAM,CAAC,YAAY,CAAC;IACvB,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE;CAC5G,CAAC,CAAC;AAEH,oCAAoC;AACpC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEvD,sDAAsD;AACtD,+DAA+D;AAC/D,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAE9D,+CAA+C;AAC/C,iDAAiD;AACjD,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAErD,kCAAkC;AAClC,oDAAoD;AACpD,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC"}

package/eslint-isolation.mjs

@@ -0,0 +1,82 @@
+/**
+ * Auth Craft scope-isolation ESLint guard (shipped with @auth-craft/client-core).
+ *
+ * Any project that consumes the client gets this for free:
+ *   import { authCraftIsolation } from '@auth-craft/client-core/eslint'
+ *
+ * Goal: keep each web app's bundle (and its dev call surface) free of contract
+ * groups it doesn't own. The per-scope subpath split in @auth-craft/api-contract
+ * only pays off if apps import the narrow group entry — these rules make the
+ * wrong import a lint error instead of a silently-bloated bundle.
+ *
+ * Two invariants, enforced for every app:
+ *   1. Use @auth-craft/client-core + per-group contract subpaths. The
+ *      batteries-included class @auth-craft/client references ALL groups, so the
+ *      bundler can't tree-shake any of them away.
+ *   2. Importing the api-contract ROOT re-exports every group → same bloat.
+ *
+ * Plus a per-app allow-list: an app may only import the groups in its scope.
+ *
+ * Usage in an app's flat config (eslint.config.mjs):
+ *
+ *   import tseslint from 'typescript-eslint'
+ *   import { authCraftIsolation } from '@auth-craft/client-core/eslint'
+ *
+ *   export default tseslint.config(
+ *     // ...existing config...
+ *     authCraftIsolation({ allow: ['auth', 'password', 'verification', 'mfa', 'oauth', 'session', 'users'] })
+ *   )
+ *
+ * Omit a group (e.g. 'tenant') and importing it becomes an error.
+ */
+
+/** All contract groups exposed as @auth-craft/api-contract/<group> subpaths. */
+export const ALL_GROUPS = [
+  'auth', 'password', 'verification', 'session',
+  'mfa', 'oauth', 'users', 'tenant'
+]
+
+/**
+ * Build a flat-config block that restricts Auth Craft imports to an app's scope.
+ *
+ * @param {{ allow: string[], files?: string[] }} opts
+ *   allow — contract groups this app is permitted to import (subset of ALL_GROUPS).
+ *   files — glob(s) to apply to (default: src TS/TSX).
+ * @returns an ESLint flat-config object.
+ */
+export function authCraftIsolation({ allow, files = ['src/**/*.{ts,tsx}'] }) {
+  const unknown = allow.filter((g) => !ALL_GROUPS.includes(g))
+  if (unknown.length > 0) {
+    throw new Error(`authCraftIsolation: unknown group(s): ${unknown.join(', ')}. Valid: ${ALL_GROUPS.join(', ')}`)
+  }
+
+  const forbiddenGroups = ALL_GROUPS.filter((g) => !allow.includes(g))
+
+  const patterns = [
+    {
+      group: ['@auth-craft/client'],
+      message:
+        'Import @auth-craft/client-core + the per-group contract subpaths instead. ' +
+        '@auth-craft/client bundles every scope (auth+tenant+system) and cannot be tree-shaken.'
+    },
+    {
+      group: ['@auth-craft/api-contract'],
+      message:
+        'Import a focused group, e.g. @auth-craft/api-contract/auth, not the root ' +
+        '(the root re-exports every group and defeats per-scope isolation).'
+    },
+    ...forbiddenGroups.map((g) => ({
+      group: [`@auth-craft/api-contract/${g}`],
+      message:
+        `This app's scope does not include the '${g}' contract group. ` +
+        `Importing it pulls out-of-scope routes into the bundle. Allowed: ${allow.join(', ')}.`
+    }))
+  ]
+
+  return {
+    files,
+    rules: {
+      'no-restricted-imports': ['error', { patterns }]
+    }
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@auth-craft/client",
-  "version": "0.1.0",
-  "description": "Contract-driven typed frontend client for Auth Craft. Methods are generated from @auth-craft/api-contract over the @auth-craft/transport (Web-Worker token isolation), so routes and client cannot drift.",
+  "version": "0.1.1",
+  "description": "Contract-driven typed frontend client for Auth Craft. Methods are generated from @auth-craft/api-contract; tokens are isolated in a Web Worker. Import the root for all groups, or @auth-craft/client/core for a scope-agnostic core you wire per scope.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -9,25 +9,39 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    }
-  },
-  "files": ["dist", "README.md"],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "clean": "rm -rf dist",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    },
+    "./core": {
+      "types": "./dist/core/core.d.ts",
+      "import": "./dist/core/core.js"
+    },
+    "./worker": {
+      "import": "./dist/transport/worker.js"
+    },
+    "./eslint": "./eslint-isolation.mjs"
   },
+  "files": [
+    "dist",
+    "eslint-isolation.mjs",
+    "README.md"
+  ],
   "dependencies": {
-    "@auth-craft/api-contract": "workspace:*",
-    "@auth-craft/transport": "workspace:*",
     "ts-micro-result": "^3.3.0",
-    "valibot": "^1.4.1"
+    "valibot": "^1.4.1",
+    "@auth-craft/api-contract": "^0.1.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
   },
-  "license": "MIT"
-}
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}