@cellarnode/auth 0.9.0 → 0.11.0

package/dist/auth-guard.d.ts

@@ -1,3 +1,12 @@
-import type { AuthUser, UserType } from "./types.js";
+import type { AuthUser, SessionClaims, UserType } from "./types.js";
 export declare function validateUserType(user: AuthUser, expected: UserType): boolean;
+/**
+ * True if the user/session holds the given entitlement (CEL-599 / Epic A).
+ *
+ * Accepts an `AuthUser` (from `getMe` / `/auth/me`, where `entitlements` may be
+ * absent on older backends) OR a `SessionClaims`-shaped object. Null-safe —
+ * returns false for a missing source or a source with no entitlements. Mirrors
+ * the `validateUserType` guard shape.
+ */
+export declare function hasEntitlement(source: AuthUser | SessionClaims | null | undefined, entitlement: string): boolean;
 //# sourceMappingURL=auth-guard.d.ts.map

package/dist/auth-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,IAAI,GAAG,SAAS,EACnD,WAAW,EAAE,MAAM,GAClB,OAAO,CAET"}

package/dist/auth-guard.js

@@ -1,4 +1,15 @@
 export function validateUserType(user, expected) {
     return user.userType === expected;
 }
+/**
+ * True if the user/session holds the given entitlement (CEL-599 / Epic A).
+ *
+ * Accepts an `AuthUser` (from `getMe` / `/auth/me`, where `entitlements` may be
+ * absent on older backends) OR a `SessionClaims`-shaped object. Null-safe —
+ * returns false for a missing source or a source with no entitlements. Mirrors
+ * the `validateUserType` guard shape.
+ */
+export function hasEntitlement(source, entitlement) {
+    return source?.entitlements?.includes(entitlement) ?? false;
+}
 //# sourceMappingURL=auth-guard.js.map

package/dist/auth-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.js","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,QAAkB;IACjE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpC,CAAC"}
+{"version":3,"file":"auth-guard.js","sourceRoot":"","sources":["../src/auth-guard.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,QAAkB;IACjE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmD,EACnD,WAAmB;IAEnB,OAAO,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;AAC9D,CAAC"}

package/dist/auth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,SAAS,EACT,eAAe,EAKhB,MAAM,YAAY,CAAC;AA8DpB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAuLlE"}
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,SAAS,EACT,eAAe,EAKhB,MAAM,YAAY,CAAC;AAuCpB,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAsRlE"}

package/dist/auth-store.js

@@ -1,67 +1,42 @@
-import { decodeJwt } from "jose";
 import { extractAccessToken } from "./extract-token.js";
-const VALID_USER_TYPES = new Set([
-    "importer",
-    "producer",
-    "distributor",
-    "admin",
-]);
 /**
- * Decode a JWT payload into SessionClaims.
+ * Map a `/auth/me` AuthUser onto the minimal cached identity.
  *
- * Returns null on any decode failure or if required fields are missing /
- * mistyped. Signature verification is intentionally NOT performed — that
- * is the backend's job at the next authenticated request. This decode is
- * informational only (used for clientId / orgId / userType lookups in the
- * UI layer).
+ * `AuthUser.id` is the userId. `entitlements` is optional on the wire (older
+ * backends omit it) → defaults to `[]`. The element filter guards against a
+ * malformed array carrying non-string entries.
  */
-function decodeSessionClaims(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    const userId = payload.userId;
-    const email = payload.email;
-    const sessionId = payload.sessionId;
-    const orgIdRaw = payload.orgId;
-    const rolesRaw = payload.roles;
-    const userTypeRaw = payload.userType;
-    if (typeof userId !== "string" || userId.length === 0)
-        return null;
-    if (typeof email !== "string")
-        return null;
-    if (typeof sessionId !== "string" || sessionId.length === 0)
-        return null;
-    const orgId = orgIdRaw === null || orgIdRaw === undefined
-        ? null
-        : typeof orgIdRaw === "string"
-            ? orgIdRaw
-            : null;
-    const roles = Array.isArray(rolesRaw)
-        ? rolesRaw.filter((r) => typeof r === "string")
+function toIdentity(user) {
+    const entitlements = Array.isArray(user.entitlements)
+        ? user.entitlements.filter((e) => typeof e === "string")
         : [];
-    if (typeof userTypeRaw !== "string")
-        return null;
-    if (!VALID_USER_TYPES.has(userTypeRaw))
-        return null;
     return {
-        userId,
-        email,
-        orgId,
-        roles,
-        sessionId,
-        userType: userTypeRaw,
+        userId: user.id,
+        orgId: user.orgId ?? null,
+        userType: user.userType,
+        entitlements,
     };
 }
 export function createAuthStore(config) {
     const { baseUrl, refreshPath = "/auth/refresh", refreshBuffer = 60 } = config;
     let accessToken = null;
-    let claims = null;
+    let identity = null;
     let refreshTimer = null;
     let refreshPromise = null;
+    // Tracks the orgId observed at the last emitted state so `onOrgChange` only
+    // fires on an actual transition. `hasEmittedOrgId` disambiguates the two
+    // meanings `previousOrgId === null` would otherwise carry — "no org emitted
+    // yet" vs "the current org is admin/null". Without it, the FIRST admin
+    // identity (orgId null) and an admin login right after `clearToken()` would
+    // skip `onOrgChange(null)`. Both are reset on logout so a subsequent login
+    // re-fires `onOrgChange` even into the same org.
+    let previousOrgId = null;
+    let hasEmittedOrgId = false;
+    // Monotonic generation counter. Bumped on every token change (set / clear /
+    // refresh). An in-flight `/auth/me` resolution only commits if its captured
+    // generation still matches — this discards stale identity results when the
+    // token changed again before the previous fetch resolved.
+    let tokenGeneration = 0;
     const orgChangeListeners = new Set();
     const accessTokenSetListeners = new Set();
     const logoutListeners = new Set();
@@ -105,28 +80,104 @@ export function createAuthStore(config) {
         }, delay);
     }
     /**
-     * Apply a new access-token value to internal state.
+     * Fetch `/auth/me` with the bearer token and return the parsed identity, or
+     * null on any failure (network error, non-2xx, malformed body).
      *
-     * - Decodes the JWT via `jose.decodeJwt` (no signature verify).
-     * - Caches the decoded claims.
-     * - Fires `onOrgChange` listeners ONLY when `orgId` actually changes
-     *   (no-op on a same-orgId refresh).
-     * - Always fires `onAccessTokenSet` listeners after the token + claims
-     *   are committed.
+     * Tolerant by design — mirrors how `performRefresh` swallows errors. A failed
+     * `/auth/me` must NOT throw out of `setAccessToken` / `performRefresh`; the
+     * caller treats null identity as "logged in but identity unknown" and the
+     * getters fall back to null/[].
+     */
+    async function fetchIdentity(token) {
+        try {
+            const res = await fetch(`${baseUrl}/auth/me`, {
+                method: "GET",
+                credentials: "include",
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (!res.ok)
+                return null;
+            const user = (await res.json());
+            if (!user || typeof user.id !== "string" || user.id.length === 0) {
+                return null;
+            }
+            return toIdentity(user);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Commit a freshly-resolved identity and emit the dependent events.
      *
-     * Malformed JWTs are tolerated: claims become `null` and `onOrgChange`
-     * fires with `null` only if the previous orgId was non-null (i.e. the
-     * effective orgId transitioned).
+     * EVENT ORDERING (CRITICAL — consumer realtime hooks depend on it):
+     * identity is async, so on a token change the sequence is:
+     *   1. set token (synchronous, in `setAccessToken` / `performRefresh`)
+     *   2. kick off `fetchIdentity(token)` (async)
+     *   3. ON RESOLVE → here:
+     *        a. cache identity FIRST (so getters return real values)
+     *        b. emit `onAccessTokenSet(token)` (consumer hooks re-read getOrgId()
+     *           inside this handler — identity must already be cached)
+     *        c. emit `onOrgChange(orgId)` IF orgId actually changed vs the last
+     *           emitted state
+     *
+     * The `generation` guard discards this commit if the token changed again
+     * (set/clear/refresh) while this `/auth/me` was in flight.
      */
-    function applyToken(token) {
-        const previousOrgId = claims?.orgId ?? null;
-        accessToken = token;
-        claims = token ? decodeSessionClaims(token) : null;
-        const nextOrgId = claims?.orgId ?? null;
-        if (nextOrgId !== previousOrgId) {
-            emitOrgChange(nextOrgId);
+    function commitIdentity(generation, token, nextIdentity) {
+        if (generation !== tokenGeneration) {
+            // A newer token change superseded this fetch — drop the stale result.
+            return;
         }
+        identity = nextIdentity;
+        const nextOrgId = nextIdentity?.orgId ?? null;
+        // (b) Token-set first — handlers read getOrgId()/getUserId() and must see
+        // the just-cached identity.
         emitAccessTokenSet(token);
+        // (c) Org-change on the first emission OR an actual transition. The
+        // `!hasEmittedOrgId` guard ensures the first identity (incl. an admin
+        // orgId of null) always fires once.
+        if (!hasEmittedOrgId || nextOrgId !== previousOrgId) {
+            hasEmittedOrgId = true;
+            previousOrgId = nextOrgId;
+            emitOrgChange(nextOrgId);
+        }
+    }
+    /**
+     * Apply a new access token, kicking off async identity resolution.
+     *
+     * The token is committed synchronously (so `getAccessToken()` is immediately
+     * correct); identity + `onAccessTokenSet` + `onOrgChange` settle only after
+     * `/auth/me` resolves (see `commitIdentity`).
+     */
+    function applyToken(token) {
+        tokenGeneration += 1;
+        const generation = tokenGeneration;
+        accessToken = token;
+        // Clear the prior session's identity synchronously so the getters return
+        // the documented null/[] defaults until the fresh /auth/me resolves —
+        // otherwise a token switch (e.g. logging in as a different user) would leak
+        // the previous session's userId/orgId/entitlements until the new fetch
+        // lands. The realtime consumer hooks read the getters on events (not by
+        // polling), so this introduces no flicker: a same-user refresh re-commits
+        // the same orgId without firing `onOrgChange`.
+        identity = null;
+        void fetchIdentity(token).then((next) => commitIdentity(generation, token, next));
+    }
+    /**
+     * Clear all token + identity state synchronously and reset org tracking.
+     *
+     * `onAccessTokenSet(null)` fires synchronously (no `/auth/me` round-trip on
+     * logout). `previousOrgId` is reset so a subsequent login re-fires
+     * `onOrgChange` even when the user logs back into the same org.
+     */
+    function clearToken() {
+        tokenGeneration += 1; // invalidate any in-flight /auth/me
+        accessToken = null;
+        identity = null;
+        previousOrgId = null;
+        hasEmittedOrgId = false;
+        emitAccessTokenSet(null);
     }
     async function performRefresh() {
         try {
@@ -136,7 +187,7 @@ export function createAuthStore(config) {
                 headers: { "Content-Type": "application/json" },
             });
             if (!res.ok) {
-                applyToken(null);
+                clearToken();
                 return null;
             }
             const json = (await res.json());
@@ -149,7 +200,7 @@ export function createAuthStore(config) {
             return token;
         }
         catch {
-            applyToken(null);
+            clearToken();
             return null;
         }
     }
@@ -165,7 +216,7 @@ export function createAuthStore(config) {
             scheduleRefresh(expiresIn);
         },
         clearAccessToken() {
-            applyToken(null);
+            clearToken();
             if (refreshTimer) {
                 clearTimeout(refreshTimer);
                 refreshTimer = null;
@@ -184,21 +235,18 @@ export function createAuthStore(config) {
             });
             return refreshPromise;
         },
-        getSessionClaims() {
-            // Return a defensive copy so external callers cannot mutate the
-            // internal claims object (e.g. push to roles, reassign userType).
-            return claims
-                ? { ...claims, roles: [...claims.roles] }
-                : null;
-        },
         getUserId() {
-            return claims?.userId ?? null;
+            return identity?.userId ?? null;
         },
         getOrgId() {
-            return claims?.orgId ?? null;
+            return identity?.orgId ?? null;
         },
         getUserType() {
-            return claims?.userType ?? null;
+            return identity?.userType ?? null;
+        },
+        getEntitlements() {
+            // Defensive copy; [] when logged out or identity unresolved.
+            return identity ? [...identity.entitlements] : [];
         },
         onOrgChange(listener) {
             orgChangeListeners.add(listener);

package/dist/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAUjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,gBAAgB,GAAiC,IAAI,GAAG,CAAC;IAC7D,UAAU;IACV,UAAU;IACV,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAErC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,CAAC;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK;QACL,KAAK;QACL,SAAS;QACT,QAAQ,EAAE,WAA8B;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,SAAS,aAAa,CAAC,KAAoB;QACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4CAA4C;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAoB;QAC9C,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,UAAU,CAAC,KAAoB;QACtC,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAE5C,WAAW,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAExC,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,UAAU,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gBAAgB;YACd,gEAAgE;YAChE,kEAAkE;YAClE,OAAO,MAAM;gBACX,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE;gBACzC,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAED,SAAS;YACP,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;QAChC,CAAC;QAED,QAAQ;YACN,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;QAC/B,CAAC;QAED,WAAW;YACT,OAAO,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;QAClC,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE;gBACV,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ;YACvB,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,EAAE;gBACV,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAmBxD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,eAAe,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE9E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAyC,IAAI,CAAC;IAC9D,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,SAAS,aAAa,CAAC,KAAoB;QACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4CAA4C;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAoB;QAC9C,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,gBAAwB;QAC/C,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,GAAG,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,cAAc,CACrB,UAAkB,EAClB,KAAa,EACb,YAA6B;QAE7B,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;YACnC,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,QAAQ,GAAG,YAAY,CAAC;QACxB,MAAM,SAAS,GAAG,YAAY,EAAE,KAAK,IAAI,IAAI,CAAC;QAE9C,0EAA0E;QAC1E,4BAA4B;QAC5B,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,oEAAoE;QACpE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,CAAC,eAAe,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YACpD,eAAe,GAAG,IAAI,CAAC;YACvB,aAAa,GAAG,SAAS,CAAC;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,SAAS,UAAU,CAAC,KAAa;QAC/B,eAAe,IAAI,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,eAAe,CAAC;QACnC,WAAW,GAAG,KAAK,CAAC;QACpB,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,+CAA+C;QAC/C,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CACxC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,UAAU;QACjB,eAAe,IAAI,CAAC,CAAC,CAAC,oCAAoC;QAC1D,WAAW,GAAG,IAAI,CAAC;QACnB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,IAAI,CAAC;QACrB,eAAe,GAAG,KAAK,CAAC;QACxB,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,UAAU,CAAC,KAAK,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,cAAc;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;QAED,cAAc,CAAC,KAAa,EAAE,SAAiB;YAC7C,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,gBAAgB;YACd,UAAU,EAAE,CAAC;YACb,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY,GAAG,KAAK;YAC1C,IAAI,CAAC,YAAY,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;YACrD,IAAI,cAAc;gBAAE,OAAO,cAAc,CAAC;YAC1C,cAAc,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,SAAS;YACP,OAAO,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;QAClC,CAAC;QAED,QAAQ;YACN,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;QACjC,CAAC;QAED,WAAW;YACT,OAAO,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;QACpC,CAAC;QAED,eAAe;YACb,6DAA6D;YAC7D,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE;gBACV,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,QAAQ;YACvB,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,GAAG,EAAE;gBACV,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createAuthStore } from "./auth-store.js";
 export { createAuthClient } from "./auth-client.js";
 export { createAuthApi } from "./auth-api.js";
-export { validateUserType } from "./auth-guard.js";
+export { validateUserType, hasEntitlement } from "./auth-guard.js";
 export { extractAccessToken } from "./extract-token.js";
 export { AuthError, type AuthUser, type AuthStore, type AuthStoreConfig, type AuthClient, type AuthClientConfig, type AuthApi, type RegisterInput, type RequestOtpResponse, type VerifyOtpResponse, type AuthErrorResponse, type UserType, type DashboardLink, type SessionClaims, type SessionUserType, type OrgChangeListener, type AccessTokenSetListener, type LogoutListener, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { createAuthStore } from "./auth-store.js";
 export { createAuthClient } from "./auth-client.js";
 export { createAuthApi } from "./auth-api.js";
-export { validateUserType } from "./auth-guard.js";
+export { validateUserType, hasEntitlement } from "./auth-guard.js";
 export { extractAccessToken } from "./extract-token.js";
 export { AuthError, } from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,GAkBV,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EACL,SAAS,GAkBV,MAAM,YAAY,CAAC"}

package/dist/types.d.ts

@@ -6,6 +6,13 @@ export interface AuthUser {
     userType: "importer" | "producer" | "admin";
     orgId: string | null;
     roles: string[];
+    /**
+     * Per-user entitlements (CEL-599 / Epic A). Optional on the `/auth/me` wire
+     * shape: present once the backend's `/auth/me` mapper returns it, absent for
+     * older backends. Consumers should read it as `user.entitlements ?? []`, or
+     * prefer `authStore.getEntitlements()` (decoded from the JWT, always present).
+     */
+    entitlements?: string[];
     createdAt: string;
 }
 export interface RegisterInput {
@@ -64,6 +71,13 @@ export interface SessionClaims {
     roles: string[];
     sessionId: string;
     userType: SessionUserType;
+    /**
+     * Per-user entitlements carried in the JWT (CEL-599 / Epic A) — e.g.
+     * `"producer-dashboard"`, `"importer-dashboard"`, `"elabel"`. Always an array
+     * on the decoded claims (empty if the token predates entitlements or the user
+     * holds none); the backend mints them from the `user_entitlements` table.
+     */
+    entitlements: string[];
 }
 export type OrgChangeListener = (orgId: string | null) => void;
 export type AccessTokenSetListener = (token: string | null) => void;
@@ -74,14 +88,24 @@ export interface AuthStore {
     setAccessToken(token: string, expiresIn: number): void;
     clearAccessToken(): void;
     ensureAccessToken(forceRefresh?: boolean): Promise<string | null>;
-    /** Decoded session claims from the current access token, or null. */
-    getSessionClaims(): SessionClaims | null;
-    /** userId from the current access token, or null. */
+    /**
+     * userId of the current session, or null.
+     *
+     * CEL-622 — sourced from `GET /auth/me` (the public access token is an opaque
+     * encrypted JWE and cannot be decoded client-side). Resolves asynchronously
+     * after a token is set/refreshed; reads null until `/auth/me` settles.
+     */
     getUserId(): string | null;
-    /** orgId from the current access token, or null. Admin returns null. */
+    /** orgId of the current session, or null. Admin returns null. Sourced from `/auth/me`. */
     getOrgId(): string | null;
-    /** userType from the current access token, or null. */
+    /** userType of the current session, or null. Sourced from `/auth/me`. */
     getUserType(): SessionUserType | null;
+    /**
+     * Per-user entitlements for the current session (CEL-599). Always an array —
+     * empty when logged out or when `/auth/me` carries none. Sourced from
+     * `/auth/me` (CEL-622), so it reflects the authoritative server-side state.
+     */
+    getEntitlements(): string[];
     /** Subscribe to orgId change events. Returns unsubscribe. */
     onOrgChange(listener: OrgChangeListener): () => void;
     /** Subscribe to access-token (re-)set events. Fires after the token is set. Returns unsubscribe. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE,qEAAqE;IACrE,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAAC;IAEzC,qDAAqD;IACrD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B,wEAAwE;IACxE,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAE1B,uDAAuD;IACvD,WAAW,IAAI,eAAe,GAAG,IAAI,CAAC;IAEtC,6DAA6D;IAC7D,WAAW,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAErD,oGAAoG;IACpG,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAC;IAE/D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;aAEZ,iBAAiB,CAAC,EAAE,MAAM;gBAH1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,iBAAiB,CAAC,EAAE,MAAM,YAAA;CAK7C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,OAAO,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACpE,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,IAAI,OAAO,CAAC;IAC1B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,gBAAgB,IAAI,IAAI,CAAC;IACzB,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B,0FAA0F;IAC1F,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAE1B,yEAAyE;IACzE,WAAW,IAAI,eAAe,GAAG,IAAI,CAAC;IAEtC;;;;OAIG;IACH,eAAe,IAAI,MAAM,EAAE,CAAC;IAE5B,6DAA6D;IAC7D,WAAW,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAC;IAErD,oGAAoG;IACpG,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAC;IAE/D,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAmCA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IAEA;IAJlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,iBAA0B;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,sBAAiB,GAAjB,iBAAiB,CAAS;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA0CA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IACA;IAEA;IAJlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,iBAA0B;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,sBAAiB,GAAjB,iBAAiB,CAAS;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cellarnode/auth",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Shared OTP-based authentication — token store, API client, React UI components for CellarNode dashboards.",
   "license": "MIT",
   "type": "module",
@@ -42,8 +42,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "clsx": "^2.1.0",
-    "jose": "^6.2.3"
+    "clsx": "^2.1.0"
   },
   "peerDependencies": {
     "@react-three/fiber": ">=8.0.0",