@cellarnode/auth 0.8.0 → 0.10.0

package/dist/auth-guard.d.ts

@@ -1,3 +1,12 @@
-import type { AuthUser, UserType } from "./types.js";
+import type { AuthUser, SessionClaims, UserType } from "./types.js";
 export declare function validateUserType(user: AuthUser, expected: UserType): boolean;
+/**
+ * True if the user/session holds the given entitlement (CEL-599 / Epic A).
+ *
+ * Accepts an `AuthUser` (from `getMe`, where `entitlements` may be absent on
+ * older backends) OR `SessionClaims` (from `authStore.getSessionClaims()`,
+ * always populated). Null-safe — returns false for a missing source or a source
+ * with no entitlements. Mirrors the `validateUserType` guard shape.
+ */
+export declare function hasEntitlement(source: AuthUser | SessionClaims | null | undefined, entitlement: string): boolean;
 //# sourceMappingURL=auth-guard.d.ts.map

package/dist/auth-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,IAAI,GAAG,SAAS,EACnD,WAAW,EAAE,MAAM,GAClB,OAAO,CAET"}

package/dist/auth-guard.js

@@ -1,4 +1,15 @@
 export function validateUserType(user, expected) {
     return user.userType === expected;
 }
+/**
+ * True if the user/session holds the given entitlement (CEL-599 / Epic A).
+ *
+ * Accepts an `AuthUser` (from `getMe`, where `entitlements` may be absent on
+ * older backends) OR `SessionClaims` (from `authStore.getSessionClaims()`,
+ * always populated). Null-safe — returns false for a missing source or a source
+ * with no entitlements. Mirrors the `validateUserType` guard shape.
+ */
+export function hasEntitlement(source, entitlement) {
+    return source?.entitlements?.includes(entitlement) ?? false;
+}
 //# sourceMappingURL=auth-guard.js.map

package/dist/auth-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.js","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,QAAkB;IACjE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpC,CAAC"}
+{"version":3,"file":"auth-guard.js","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,QAAkB;IACjE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmD,EACnD,WAAmB;IAEnB,OAAO,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;AAC9D,CAAC"}

package/dist/auth-store.d.ts

@@ -1,3 +1,3 @@
-import type { AuthStoreConfig, AuthStore } from "./types.js";
+import type { AuthStore, AuthStoreConfig } from "./types.js";
 export declare function createAuthStore(config: AuthStoreConfig): AuthStore;
 //# sourceMappingURL=auth-store.d.ts.map

package/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CA0ElE"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,SAAS,EACT,eAAe,EAKhB,MAAM,YAAY,CAAC;AAqEpB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CA4LlE"}

package/dist/auth-store.js

@@ -1,9 +1,107 @@
+import { decodeJwt } from "jose";
 import { extractAccessToken } from "./extract-token.js";
+const VALID_USER_TYPES = new Set([
+    "importer",
+    "producer",
+    "distributor",
+    "admin",
+]);
+/**
+ * Decode a JWT payload into SessionClaims.
+ *
+ * Returns null on any decode failure or if required fields are missing /
+ * mistyped. Signature verification is intentionally NOT performed — that
+ * is the backend's job at the next authenticated request. This decode is
+ * informational only (used for clientId / orgId / userType lookups in the
+ * UI layer).
+ */
+function decodeSessionClaims(token) {
+    let payload;
+    try {
+        payload = decodeJwt(token);
+    }
+    catch {
+        return null;
+    }
+    const userId = payload.userId;
+    const email = payload.email;
+    const sessionId = payload.sessionId;
+    const orgIdRaw = payload.orgId;
+    const rolesRaw = payload.roles;
+    const userTypeRaw = payload.userType;
+    const entitlementsRaw = payload.entitlements;
+    if (typeof userId !== "string" || userId.length === 0)
+        return null;
+    if (typeof email !== "string")
+        return null;
+    if (typeof sessionId !== "string" || sessionId.length === 0)
+        return null;
+    const orgId = orgIdRaw === null || orgIdRaw === undefined
+        ? null
+        : typeof orgIdRaw === "string"
+            ? orgIdRaw
+            : null;
+    const roles = Array.isArray(rolesRaw)
+        ? rolesRaw.filter((r) => typeof r === "string")
+        : [];
+    // CEL-599: tolerate tokens minted before entitlements existed (→ []).
+    const entitlements = Array.isArray(entitlementsRaw)
+        ? entitlementsRaw.filter((e) => typeof e === "string")
+        : [];
+    if (typeof userTypeRaw !== "string")
+        return null;
+    if (!VALID_USER_TYPES.has(userTypeRaw))
+        return null;
+    return {
+        userId,
+        email,
+        orgId,
+        roles,
+        sessionId,
+        userType: userTypeRaw,
+        entitlements,
+    };
+}
 export function createAuthStore(config) {
     const { baseUrl, refreshPath = "/auth/refresh", refreshBuffer = 60 } = config;
     let accessToken = null;
+    let claims = null;
     let refreshTimer = null;
     let refreshPromise = null;
+    const orgChangeListeners = new Set();
+    const accessTokenSetListeners = new Set();
+    const logoutListeners = new Set();
+    function emitOrgChange(orgId) {
+        for (const listener of orgChangeListeners) {
+            try {
+                listener(orgId);
+            }
+            catch {
+                // Swallow listener errors so a single bad subscriber cannot
+                // break event fan-out to other subscribers.
+            }
+        }
+    }
+    function emitAccessTokenSet(token) {
+        for (const listener of accessTokenSetListeners) {
+            try {
+                listener(token);
+            }
+            catch {
+                // Swallow.
+            }
+        }
+    }
+    function emitLogout() {
+        for (const listener of logoutListeners) {
+            try {
+                listener();
+            }
+            catch {
+                // Swallow.
+            }
+        }
+    }
     function scheduleRefresh(expiresInSeconds) {
         if (refreshTimer)
             clearTimeout(refreshTimer);
@@ -12,6 +110,30 @@ export function createAuthStore(config) {
             performRefresh();
         }, delay);
     }
+    /**
+     * Apply a new access-token value to internal state.
+     *
+     * - Decodes the JWT via `jose.decodeJwt` (no signature verify).
+     * - Caches the decoded claims.
+     * - Fires `onOrgChange` listeners ONLY when `orgId` actually changes
+     *   (no-op on a same-orgId refresh).
+     * - Always fires `onAccessTokenSet` listeners after the token + claims
+     *   are committed.
+     *
+     * Malformed JWTs are tolerated: claims become `null` and `onOrgChange`
+     * fires with `null` only if the previous orgId was non-null (i.e. the
+     * effective orgId transitioned).
+     */
+    function applyToken(token) {
+        const previousOrgId = claims?.orgId ?? null;
+        accessToken = token;
+        claims = token ? decodeSessionClaims(token) : null;
+        const nextOrgId = claims?.orgId ?? null;
+        if (nextOrgId !== previousOrgId) {
+            emitOrgChange(nextOrgId);
+        }
+        emitAccessTokenSet(token);
+    }
     async function performRefresh() {
         try {
             const res = await fetch(`${baseUrl}${refreshPath}`, {
@@ -20,20 +142,20 @@ export function createAuthStore(config) {
                 headers: { "Content-Type": "application/json" },
             });
             if (!res.ok) {
-                accessToken = null;
+                applyToken(null);
                 return null;
             }
             const json = (await res.json());
             const token = extractAccessToken(json);
             if (token) {
                 const expiresIn = typeof json.expiresIn === "number" ? json.expiresIn : 900;
-                accessToken = token;
+                applyToken(token);
                 scheduleRefresh(expiresIn);
             }
             return token;
         }
         catch {
-            accessToken = null;
+            applyToken(null);
             return null;
         }
     }
@@ -45,15 +167,18 @@ export function createAuthStore(config) {
             return accessToken !== null;
         },
         setAccessToken(token, expiresIn) {
-            accessToken = token;
+            applyToken(token);
             scheduleRefresh(expiresIn);
         },
         clearAccessToken() {
-            accessToken = null;
+            applyToken(null);
             if (refreshTimer) {
                 clearTimeout(refreshTimer);
                 refreshTimer = null;
             }
+            // Emits unconditionally so consumers can rely on `onLogout` as a
+            // canonical logout signal regardless of prior token state.
+            emitLogout();
         },
         async ensureAccessToken(forceRefresh = false) {
             if (!forceRefresh && accessToken)
@@ -65,6 +190,44 @@ export function createAuthStore(config) {
             });
             return refreshPromise;
         },
+        getSessionClaims() {
+            // Return a defensive copy so external callers cannot mutate the
+            // internal claims object (e.g. push to roles, reassign userType).
+            return claims
+                ? { ...claims, roles: [...claims.roles], entitlements: [...claims.entitlements] }
+                : null;
+        },
+        getUserId() {
+            return claims?.userId ?? null;
+        },
+        getOrgId() {
+            return claims?.orgId ?? null;
+        },
+        getUserType() {
+            return claims?.userType ?? null;
+        },
+        getEntitlements() {
+            // Defensive copy; [] when logged out (consistent with roles).
+            return claims ? [...claims.entitlements] : [];
+        },
+        onOrgChange(listener) {
+            orgChangeListeners.add(listener);
+            return () => {
+                orgChangeListeners.delete(listener);
+            };
+        },
+        onAccessTokenSet(listener) {
+            accessTokenSetListeners.add(listener);
+            return () => {
+                accessTokenSetListeners.delete(listener);
+            };
+        },
+        onLogout(listener) {
+            logoutListeners.add(listener);
+            return () => {
+                logoutListeners.delete(listener);
+            };
+        },
     };
     return store;
 }

package/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,WAAW,GAAG,IAAI,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,WAAW,GAAG,KAAK,CAAC;gBACpB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,WAAW,GAAG,KAAK,CAAC;YACpB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAUjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,gBAAgB,GAAiC,IAAI,GAAG,CAAC;IAC7D,UAAU;IACV,UAAU;IACV,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IACrC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IAE7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAEP,sEAAsE;IACtE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK;QACL,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,WAA8B;QACxC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,SAAS,aAAa,CAAC,KAAoB;QACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4CAA4C;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAoB;QAC9C,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,UAAU,CAAC,KAAoB;QACtC,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAE5C,WAAW,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAExC,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,UAAU,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gBAAgB;YACd,gEAAgE;YAChE,kEAAkE;YAClE,OAAO,MAAM;gBACX,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;gBACjF,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAED,SAAS;YACP,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;QAChC,CAAC;QAED,QAAQ;YACN,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAED,WAAW;YACT,OAAO,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;QAClC,CAAC;QAED,eAAe;YACb,8DAA8D;YAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE;gBACV,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ;YACvB,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,EAAE;gBACV,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createAuthStore } from "./auth-store.js";
 export { createAuthClient } from "./auth-client.js";
 export { createAuthApi } from "./auth-api.js";
-export { validateUserType } from "./auth-guard.js";
+export { validateUserType, hasEntitlement } from "./auth-guard.js";
 export { extractAccessToken } from "./extract-token.js";
-export { AuthError, type AuthUser, type AuthStore, type AuthStoreConfig, type AuthClient, type AuthClientConfig, type AuthApi, type RegisterInput, type RequestOtpResponse, type VerifyOtpResponse, type AuthErrorResponse, type UserType, type DashboardLink, } from "./types.js";
+export { AuthError, type AuthUser, type AuthStore, type AuthStoreConfig, type AuthClient, type AuthClientConfig, type AuthApi, type RegisterInput, type RequestOtpResponse, type VerifyOtpResponse, type AuthErrorResponse, type UserType, type DashboardLink, type SessionClaims, type SessionUserType, type OrgChangeListener, type AccessTokenSetListener, type LogoutListener, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { createAuthStore } from "./auth-store.js";
 export { createAuthClient } from "./auth-client.js";
 export { createAuthApi } from "./auth-api.js";
-export { validateUserType } from "./auth-guard.js";
+export { validateUserType, hasEntitlement } from "./auth-guard.js";
 export { extractAccessToken } from "./extract-token.js";
 export { AuthError, } from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,GAaV,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,GAkBV,MAAM,YAAY,CAAC"}

package/dist/types.d.ts

@@ -6,6 +6,13 @@ export interface AuthUser {
     userType: "importer" | "producer" | "admin";
     orgId: string | null;
     roles: string[];
+    /**
+     * Per-user entitlements (CEL-599 / Epic A). Optional on the `/auth/me` wire
+     * shape: present once the backend's `/auth/me` mapper returns it, absent for
+     * older backends. Consumers should read it as `user.entitlements ?? []`, or
+     * prefer `authStore.getEntitlements()` (decoded from the JWT, always present).
+     */
+    entitlements?: string[];
     createdAt: string;
 }
 export interface RegisterInput {
@@ -39,12 +46,68 @@ export interface AuthStoreConfig {
     refreshPath?: string;
     refreshBuffer?: number;
 }
+/**
+ * userType values carried in the V2 access-token JWT.
+ *
+ * Mirrors `SessionClaims["userType"]` in cellarnode-backend-v2
+ * (`src/middleware/auth.ts`). Kept as a distinct type from `UserType`
+ * because the session JWT may also carry `"distributor"` (reserved for
+ * future use) whereas the public-facing `UserType` enum currently only
+ * advertises importer/producer/admin to consumers.
+ */
+export type SessionUserType = "importer" | "producer" | "distributor" | "admin";
+/**
+ * Decoded claims from a V2 access-token JWT.
+ *
+ * Mirrors the backend `SessionClaims` shape in `cellarnode-backend-v2`
+ * (`src/middleware/auth.ts`) — copied locally so consumers do not need
+ * to import from the backend. Signature verification still happens
+ * server-side; the client-side decode is informational only.
+ */
+export interface SessionClaims {
+    userId: string;
+    email: string;
+    orgId: string | null;
+    roles: string[];
+    sessionId: string;
+    userType: SessionUserType;
+    /**
+     * Per-user entitlements carried in the JWT (CEL-599 / Epic A) — e.g.
+     * `"producer-dashboard"`, `"importer-dashboard"`, `"elabel"`. Always an array
+     * on the decoded claims (empty if the token predates entitlements or the user
+     * holds none); the backend mints them from the `user_entitlements` table.
+     */
+    entitlements: string[];
+}
+export type OrgChangeListener = (orgId: string | null) => void;
+export type AccessTokenSetListener = (token: string | null) => void;
+export type LogoutListener = () => void;
 export interface AuthStore {
     getAccessToken(): string | null;
     hasAccessToken(): boolean;
     setAccessToken(token: string, expiresIn: number): void;
     clearAccessToken(): void;
     ensureAccessToken(forceRefresh?: boolean): Promise<string | null>;
+    /** Decoded session claims from the current access token, or null. */
+    getSessionClaims(): SessionClaims | null;
+    /** userId from the current access token, or null. */
+    getUserId(): string | null;
+    /** orgId from the current access token, or null. Admin returns null. */
+    getOrgId(): string | null;
+    /** userType from the current access token, or null. */
+    getUserType(): SessionUserType | null;
+    /**
+     * Per-user entitlements from the current access token (CEL-599). Always an
+     * array — empty when logged out or when the token carries none. Decoded from
+     * the JWT, so it reflects the freshest minted token.
+     */
+    getEntitlements(): string[];
+    /** Subscribe to orgId change events. Returns unsubscribe. */
+    onOrgChange(listener: OrgChangeListener): () => void;
+    /** Subscribe to access-token (re-)set events. Fires after the token is set. Returns unsubscribe. */
+    onAccessTokenSet(listener: AccessTokenSetListener): () => void;
+    /** Subscribe to logout events. Returns unsubscribe. */
+    onLogout(listener: LogoutListener): () => void;
 }
 export interface AuthClientConfig {
     baseUrl: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE,qEAAqE;IACrE,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAAC;IAEzC,qDAAqD;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAE1B,uDAAuD;IACvD,WAAW,IAAI,eAAe,GAAG,IAAI,CAAC;IAEtC;;;;OAIG;IACH,eAAe,IAAI,MAAM,EAAE,CAAC;IAE5B,6DAA6D;IAC7D,WAAW,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAErD,oGAAoG;IACpG,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAC;IAE/D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAmCA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IAEA;IAJlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,iBAA0B;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,sBAAiB,GAAjB,iBAAiB,CAAS;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA0CA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IAEA;IAJlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,iBAA0B;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,sBAAiB,GAAjB,iBAAiB,CAAS;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cellarnode/auth",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Shared OTP-based authentication — token store, API client, React UI components for CellarNode dashboards.",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,16 @@
   },
   "types": "./dist/index.d.ts",
   "sideEffects": false,
-  "files": ["dist"],
-  "keywords": ["cellarnode", "auth", "otp", "jwt", "react"],
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "cellarnode",
+    "auth",
+    "otp",
+    "jwt",
+    "react"
+  ],
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "npm run build",
@@ -34,39 +42,54 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "clsx": "^2.1.0"
+    "clsx": "^2.1.0",
+    "jose": "^6.2.3"
   },
   "peerDependencies": {
+    "@react-three/fiber": ">=8.0.0",
+    "input-otp": ">=1.4.0",
+    "lucide-react": ">=0.400.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "lucide-react": ">=0.400.0",
-    "input-otp": ">=1.4.0",
-    "@react-three/fiber": ">=8.0.0",
-    "three": ">=0.160.0",
-    "tailwindcss": ">=4.0.0"
+    "tailwindcss": ">=4.0.0",
+    "three": ">=0.160.0"
   },
   "peerDependenciesMeta": {
-    "react": { "optional": true },
-    "react-dom": { "optional": true },
-    "lucide-react": { "optional": true },
-    "input-otp": { "optional": true },
-    "@react-three/fiber": { "optional": true },
-    "three": { "optional": true },
-    "tailwindcss": { "optional": true }
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "input-otp": {
+      "optional": true
+    },
+    "@react-three/fiber": {
+      "optional": true
+    },
+    "three": {
+      "optional": true
+    },
+    "tailwindcss": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=20.19.0"
   },
   "devDependencies": {
-    "typescript": "^5.7.0",
-    "vitest": "^3.0.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "@react-three/fiber": ">=8.0.0",
     "@types/react": "^19.0.0",
     "@types/three": ">=0.160.0",
-    "@react-three/fiber": ">=8.0.0",
-    "three": ">=0.160.0",
+    "input-otp": ">=1.4.0",
     "lucide-react": ">=0.400.0",
-    "input-otp": ">=1.4.0"
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "three": ">=0.160.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
   }
 }