@cellarnode/auth 0.10.0 → 0.11.0

package/dist/auth-guard.d.ts

@@ -3,10 +3,10 @@ export declare function validateUserType(user: AuthUser, expected: UserType): bo
 /**
  * True if the user/session holds the given entitlement (CEL-599 / Epic A).
  *
- * Accepts an `AuthUser` (from `getMe`, where `entitlements` may be absent on
- * older backends) OR `SessionClaims` (from `authStore.getSessionClaims()`,
- * always populated). Null-safe — returns false for a missing source or a source
- * with no entitlements. Mirrors the `validateUserType` guard shape.
+ * Accepts an `AuthUser` (from `getMe` / `/auth/me`, where `entitlements` may be
+ * absent on older backends) OR a `SessionClaims`-shaped object. Null-safe —
+ * returns false for a missing source or a source with no entitlements. Mirrors
+ * the `validateUserType` guard shape.
  */
 export declare function hasEntitlement(source: AuthUser | SessionClaims | null | undefined, entitlement: string): boolean;
 //# sourceMappingURL=auth-guard.d.ts.map

package/dist/auth-guard.js

@@ -4,10 +4,10 @@ export function validateUserType(user, expected) {
 /**
  * True if the user/session holds the given entitlement (CEL-599 / Epic A).
  *
- * Accepts an `AuthUser` (from `getMe`, where `entitlements` may be absent on
- * older backends) OR `SessionClaims` (from `authStore.getSessionClaims()`,
- * always populated). Null-safe — returns false for a missing source or a source
- * with no entitlements. Mirrors the `validateUserType` guard shape.
+ * Accepts an `AuthUser` (from `getMe` / `/auth/me`, where `entitlements` may be
+ * absent on older backends) OR a `SessionClaims`-shaped object. Null-safe —
+ * returns false for a missing source or a source with no entitlements. Mirrors
+ * the `validateUserType` guard shape.
  */
 export function hasEntitlement(source, entitlement) {
     return source?.entitlements?.includes(entitlement) ?? false;

package/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,SAAS,EACT,eAAe,EAKhB,MAAM,YAAY,CAAC;AAqEpB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CA4LlE"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,SAAS,EACT,eAAe,EAKhB,MAAM,YAAY,CAAC;AAuCpB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAsRlE"}

package/dist/auth-store.js

@@ -1,73 +1,42 @@
-import { decodeJwt } from "jose";
 import { extractAccessToken } from "./extract-token.js";
-const VALID_USER_TYPES = new Set([
-    "importer",
-    "producer",
-    "distributor",
-    "admin",
-]);
 /**
- * Decode a JWT payload into SessionClaims.
+ * Map a `/auth/me` AuthUser onto the minimal cached identity.
  *
- * Returns null on any decode failure or if required fields are missing /
- * mistyped. Signature verification is intentionally NOT performed — that
- * is the backend's job at the next authenticated request. This decode is
- * informational only (used for clientId / orgId / userType lookups in the
- * UI layer).
+ * `AuthUser.id` is the userId. `entitlements` is optional on the wire (older
+ * backends omit it) → defaults to `[]`. The element filter guards against a
+ * malformed array carrying non-string entries.
  */
-function decodeSessionClaims(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    const userId = payload.userId;
-    const email = payload.email;
-    const sessionId = payload.sessionId;
-    const orgIdRaw = payload.orgId;
-    const rolesRaw = payload.roles;
-    const userTypeRaw = payload.userType;
-    const entitlementsRaw = payload.entitlements;
-    if (typeof userId !== "string" || userId.length === 0)
-        return null;
-    if (typeof email !== "string")
-        return null;
-    if (typeof sessionId !== "string" || sessionId.length === 0)
-        return null;
-    const orgId = orgIdRaw === null || orgIdRaw === undefined
-        ? null
-        : typeof orgIdRaw === "string"
-            ? orgIdRaw
-            : null;
-    const roles = Array.isArray(rolesRaw)
-        ? rolesRaw.filter((r) => typeof r === "string")
-        : [];
-    // CEL-599: tolerate tokens minted before entitlements existed (→ []).
-    const entitlements = Array.isArray(entitlementsRaw)
-        ? entitlementsRaw.filter((e) => typeof e === "string")
+function toIdentity(user) {
+    const entitlements = Array.isArray(user.entitlements)
+        ? user.entitlements.filter((e) => typeof e === "string")
         : [];
-    if (typeof userTypeRaw !== "string")
-        return null;
-    if (!VALID_USER_TYPES.has(userTypeRaw))
-        return null;
     return {
-        userId,
-        email,
-        orgId,
-        roles,
-        sessionId,
-        userType: userTypeRaw,
+        userId: user.id,
+        orgId: user.orgId ?? null,
+        userType: user.userType,
         entitlements,
     };
 }
 export function createAuthStore(config) {
     const { baseUrl, refreshPath = "/auth/refresh", refreshBuffer = 60 } = config;
     let accessToken = null;
-    let claims = null;
+    let identity = null;
     let refreshTimer = null;
     let refreshPromise = null;
+    // Tracks the orgId observed at the last emitted state so `onOrgChange` only
+    // fires on an actual transition. `hasEmittedOrgId` disambiguates the two
+    // meanings `previousOrgId === null` would otherwise carry — "no org emitted
+    // yet" vs "the current org is admin/null". Without it, the FIRST admin
+    // identity (orgId null) and an admin login right after `clearToken()` would
+    // skip `onOrgChange(null)`. Both are reset on logout so a subsequent login
+    // re-fires `onOrgChange` even into the same org.
+    let previousOrgId = null;
+    let hasEmittedOrgId = false;
+    // Monotonic generation counter. Bumped on every token change (set / clear /
+    // refresh). An in-flight `/auth/me` resolution only commits if its captured
+    // generation still matches — this discards stale identity results when the
+    // token changed again before the previous fetch resolved.
+    let tokenGeneration = 0;
     const orgChangeListeners = new Set();
     const accessTokenSetListeners = new Set();
     const logoutListeners = new Set();
@@ -111,28 +80,104 @@ export function createAuthStore(config) {
         }, delay);
     }
     /**
-     * Apply a new access-token value to internal state.
+     * Fetch `/auth/me` with the bearer token and return the parsed identity, or
+     * null on any failure (network error, non-2xx, malformed body).
+     *
+     * Tolerant by design — mirrors how `performRefresh` swallows errors. A failed
+     * `/auth/me` must NOT throw out of `setAccessToken` / `performRefresh`; the
+     * caller treats null identity as "logged in but identity unknown" and the
+     * getters fall back to null/[].
+     */
+    async function fetchIdentity(token) {
+        try {
+            const res = await fetch(`${baseUrl}/auth/me`, {
+                method: "GET",
+                credentials: "include",
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (!res.ok)
+                return null;
+            const user = (await res.json());
+            if (!user || typeof user.id !== "string" || user.id.length === 0) {
+                return null;
+            }
+            return toIdentity(user);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Commit a freshly-resolved identity and emit the dependent events.
      *
-     * - Decodes the JWT via `jose.decodeJwt` (no signature verify).
-     * - Caches the decoded claims.
-     * - Fires `onOrgChange` listeners ONLY when `orgId` actually changes
-     *   (no-op on a same-orgId refresh).
-     * - Always fires `onAccessTokenSet` listeners after the token + claims
-     *   are committed.
+     * EVENT ORDERING (CRITICAL — consumer realtime hooks depend on it):
+     * identity is async, so on a token change the sequence is:
+     *   1. set token (synchronous, in `setAccessToken` / `performRefresh`)
+     *   2. kick off `fetchIdentity(token)` (async)
+     *   3. ON RESOLVE → here:
+     *        a. cache identity FIRST (so getters return real values)
+     *        b. emit `onAccessTokenSet(token)` (consumer hooks re-read getOrgId()
+     *           inside this handler — identity must already be cached)
+     *        c. emit `onOrgChange(orgId)` IF orgId actually changed vs the last
+     *           emitted state
      *
-     * Malformed JWTs are tolerated: claims become `null` and `onOrgChange`
-     * fires with `null` only if the previous orgId was non-null (i.e. the
-     * effective orgId transitioned).
+     * The `generation` guard discards this commit if the token changed again
+     * (set/clear/refresh) while this `/auth/me` was in flight.
      */
-    function applyToken(token) {
-        const previousOrgId = claims?.orgId ?? null;
-        accessToken = token;
-        claims = token ? decodeSessionClaims(token) : null;
-        const nextOrgId = claims?.orgId ?? null;
-        if (nextOrgId !== previousOrgId) {
-            emitOrgChange(nextOrgId);
+    function commitIdentity(generation, token, nextIdentity) {
+        if (generation !== tokenGeneration) {
+            // A newer token change superseded this fetch — drop the stale result.
+            return;
         }
+        identity = nextIdentity;
+        const nextOrgId = nextIdentity?.orgId ?? null;
+        // (b) Token-set first — handlers read getOrgId()/getUserId() and must see
+        // the just-cached identity.
         emitAccessTokenSet(token);
+        // (c) Org-change on the first emission OR an actual transition. The
+        // `!hasEmittedOrgId` guard ensures the first identity (incl. an admin
+        // orgId of null) always fires once.
+        if (!hasEmittedOrgId || nextOrgId !== previousOrgId) {
+            hasEmittedOrgId = true;
+            previousOrgId = nextOrgId;
+            emitOrgChange(nextOrgId);
+        }
+    }
+    /**
+     * Apply a new access token, kicking off async identity resolution.
+     *
+     * The token is committed synchronously (so `getAccessToken()` is immediately
+     * correct); identity + `onAccessTokenSet` + `onOrgChange` settle only after
+     * `/auth/me` resolves (see `commitIdentity`).
+     */
+    function applyToken(token) {
+        tokenGeneration += 1;
+        const generation = tokenGeneration;
+        accessToken = token;
+        // Clear the prior session's identity synchronously so the getters return
+        // the documented null/[] defaults until the fresh /auth/me resolves —
+        // otherwise a token switch (e.g. logging in as a different user) would leak
+        // the previous session's userId/orgId/entitlements until the new fetch
+        // lands. The realtime consumer hooks read the getters on events (not by
+        // polling), so this introduces no flicker: a same-user refresh re-commits
+        // the same orgId without firing `onOrgChange`.
+        identity = null;
+        void fetchIdentity(token).then((next) => commitIdentity(generation, token, next));
+    }
+    /**
+     * Clear all token + identity state synchronously and reset org tracking.
+     *
+     * `onAccessTokenSet(null)` fires synchronously (no `/auth/me` round-trip on
+     * logout). `previousOrgId` is reset so a subsequent login re-fires
+     * `onOrgChange` even when the user logs back into the same org.
+     */
+    function clearToken() {
+        tokenGeneration += 1; // invalidate any in-flight /auth/me
+        accessToken = null;
+        identity = null;
+        previousOrgId = null;
+        hasEmittedOrgId = false;
+        emitAccessTokenSet(null);
     }
     async function performRefresh() {
         try {
@@ -142,7 +187,7 @@ export function createAuthStore(config) {
                 headers: { "Content-Type": "application/json" },
             });
             if (!res.ok) {
-                applyToken(null);
+                clearToken();
                 return null;
             }
             const json = (await res.json());
@@ -155,7 +200,7 @@ export function createAuthStore(config) {
             return token;
         }
         catch {
-            applyToken(null);
+            clearToken();
             return null;
         }
     }
@@ -171,7 +216,7 @@ export function createAuthStore(config) {
             scheduleRefresh(expiresIn);
         },
         clearAccessToken() {
-            applyToken(null);
+            clearToken();
             if (refreshTimer) {
                 clearTimeout(refreshTimer);
                 refreshTimer = null;
@@ -190,25 +235,18 @@ export function createAuthStore(config) {
             });
             return refreshPromise;
         },
-        getSessionClaims() {
-            // Return a defensive copy so external callers cannot mutate the
-            // internal claims object (e.g. push to roles, reassign userType).
-            return claims
-                ? { ...claims, roles: [...claims.roles], entitlements: [...claims.entitlements] }
-                : null;
-        },
         getUserId() {
-            return claims?.userId ?? null;
+            return identity?.userId ?? null;
         },
         getOrgId() {
-            return claims?.orgId ?? null;
+            return identity?.orgId ?? null;
         },
         getUserType() {
-            return claims?.userType ?? null;
+            return identity?.userType ?? null;
         },
         getEntitlements() {
-            // Defensive copy; [] when logged out (consistent with roles).
-            return claims ? [...claims.entitlements] : [];
+            // Defensive copy; [] when logged out or identity unresolved.
+            return identity ? [...identity.entitlements] : [];
         },
         onOrgChange(listener) {
             orgChangeListeners.add(listener);

package/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAUjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,gBAAgB,GAAiC,IAAI,GAAG,CAAC;IAC7D,UAAU;IACV,UAAU;IACV,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IACrC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IAE7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAEP,sEAAsE;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK;QACL,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,WAA8B;QACxC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,SAAS,aAAa,CAAC,KAAoB;QACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4CAA4C;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAoB;QAC9C,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,UAAU,CAAC,KAAoB;QACtC,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAE5C,WAAW,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAExC,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,UAAU,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gBAAgB;YACd,gEAAgE;YAChE,kEAAkE;YAClE,OAAO,MAAM;gBACX,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;gBACjF,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAED,SAAS;YACP,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;QAChC,CAAC;QAED,QAAQ;YACN,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAED,WAAW;YACT,OAAO,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;QAClC,CAAC;QAED,eAAe;YACb,8DAA8D;YAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE;gBACV,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ;YACvB,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,EAAE;gBACV,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAmBxD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,SAAS,aAAa,CAAC,KAAoB;QACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4CAA4C;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAoB;QAC9C,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,cAAc,CACrB,UAAkB,EAClB,KAAa,EACb,YAA6B;QAE7B,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;YACnC,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,QAAQ,GAAG,YAAY,CAAC;QACxB,MAAM,SAAS,GAAG,YAAY,EAAE,KAAK,IAAI,IAAI,CAAC;QAE9C,0EAA0E;QAC1E,4BAA4B;QAC5B,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,CAAC,eAAe,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACpD,eAAe,GAAG,IAAI,CAAC;YACvB,aAAa,GAAG,SAAS,CAAC;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,SAAS,UAAU,CAAC,KAAa;QAC/B,eAAe,IAAI,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,eAAe,CAAC;QACnC,WAAW,GAAG,KAAK,CAAC;QACpB,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CACxC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,UAAU;QACjB,eAAe,IAAI,CAAC,CAAC,CAAC,oCAAoC;QAC1D,WAAW,GAAG,IAAI,CAAC;QACnB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,IAAI,CAAC;QACrB,eAAe,GAAG,KAAK,CAAC;QACxB,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,UAAU,EAAE,CAAC;YACb,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,SAAS;YACP,OAAO,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;QAClC,CAAC;QAED,QAAQ;YACN,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;QACjC,CAAC;QAED,WAAW;YACT,OAAO,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;QACpC,CAAC;QAED,eAAe;YACb,6DAA6D;YAC7D,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE;gBACV,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ;YACvB,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,EAAE;gBACV,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -88,18 +88,22 @@ export interface AuthStore {
     setAccessToken(token: string, expiresIn: number): void;
     clearAccessToken(): void;
     ensureAccessToken(forceRefresh?: boolean): Promise<string | null>;
-    /** Decoded session claims from the current access token, or null. */
-    getSessionClaims(): SessionClaims | null;
-    /** userId from the current access token, or null. */
+    /**
+     * userId of the current session, or null.
+     *
+     * CEL-622 — sourced from `GET /auth/me` (the public access token is an opaque
+     * encrypted JWE and cannot be decoded client-side). Resolves asynchronously
+     * after a token is set/refreshed; reads null until `/auth/me` settles.
+     */
     getUserId(): string | null;
-    /** orgId from the current access token, or null. Admin returns null. */
+    /** orgId of the current session, or null. Admin returns null. Sourced from `/auth/me`. */
     getOrgId(): string | null;
-    /** userType from the current access token, or null. */
+    /** userType of the current session, or null. Sourced from `/auth/me`. */
     getUserType(): SessionUserType | null;
     /**
-     * Per-user entitlements from the current access token (CEL-599). Always an
-     * array — empty when logged out or when the token carries none. Decoded from
-     * the JWT, so it reflects the freshest minted token.
+     * Per-user entitlements for the current session (CEL-599). Always an array —
+     * empty when logged out or when `/auth/me` carries none. Sourced from
+     * `/auth/me` (CEL-622), so it reflects the authoritative server-side state.
      */
     getEntitlements(): string[];
     /** Subscribe to orgId change events. Returns unsubscribe. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE,qEAAqE;IACrE,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAAC;IAEzC,qDAAqD;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAE1B,uDAAuD;IACvD,WAAW,IAAI,eAAe,GAAG,IAAI,CAAC;IAEtC;;;;OAIG;IACH,eAAe,IAAI,MAAM,EAAE,CAAC;IAE5B,6DAA6D;IAC7D,WAAW,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAErD,oGAAoG;IACpG,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAC;IAE/D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B,0FAA0F;IAC1F,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAE1B,yEAAyE;IACzE,WAAW,IAAI,eAAe,GAAG,IAAI,CAAC;IAEtC;;;;OAIG;IACH,eAAe,IAAI,MAAM,EAAE,CAAC;IAE5B,6DAA6D;IAC7D,WAAW,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAErD,oGAAoG;IACpG,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAC;IAE/D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cellarnode/auth",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Shared OTP-based authentication — token store, API client, React UI components for CellarNode dashboards.",
   "license": "MIT",
   "type": "module",
@@ -42,8 +42,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "clsx": "^2.1.0",
-    "jose": "^6.2.3"
+    "clsx": "^2.1.0"
   },
   "peerDependencies": {
     "@react-three/fiber": ">=8.0.0",