@eminuckan/spine 0.2.4 → 0.3.1

package/README.md

@@ -1,15 +1,23 @@
 # Spine
 
-Framework-agnostic SaaS primitives for authentication, identity, permissions, multi-tenancy, API access, realtime events, query configuration, and logging.
+[![CI](https://github.com/eminuckan/spine/actions/workflows/ci.yml/badge.svg)](https://github.com/eminuckan/spine/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/%40eminuckan%2Fspine.svg)](https://www.npmjs.com/package/@eminuckan/spine)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-Spine is designed around one idea: the reusable parts of a SaaS platform should live in a single package, while application policy and framework quirks should stay in thin adapters. Today the package ships a framework-agnostic core plus a React Router adapter surface. Future adapters can follow the same pattern.
+Framework-agnostic TypeScript primitives for authentication, identity, permissions, multi-tenancy, API access, realtime events, query configuration, and logging in SaaS frontends.
+
+Spine is designed around one idea: the reusable infrastructure in a SaaS frontend should live in a shared package, while product policy, backend DTOs, generated clients, and framework glue should stay in thin adapters owned by the consuming app.
+
+The package is currently on a `0.x` release line. It is usable, tested, and published, but some compatibility aliases remain while the public API moves toward a cleaner `1.0` shape.
 
 ## Status
 
 - Core package: `@eminuckan/spine`
 - Current adapter: `@eminuckan/spine/react-router`
-- Server primitives use Web `Request`/`Response` objects, not framework-specific response helpers
-- React Router adapter is intentionally thin today so other adapters can be added without changing the core contract
+- Server-facing APIs accept Web `Request`/`Response` objects instead of framework-specific response helpers
+- React Router adapter is intentionally thin so future adapters can follow the same core contract
+- Built-in auth uses OpenID Connect and Redis-backed session/OAuth state storage
+- Extracted from repeated production-facing SaaS frontend infrastructure needs and maintained as independent OSS
 
 ## Why Spine
 
@@ -20,6 +28,7 @@ Spine aims to be:
 - Framework-agnostic at its core
 - Adapter-friendly for framework integration
 - Config-driven for backend conventions
+- Explicit about backend contracts instead of forcing one API shape
 - Honest about boundaries between reusable primitives and app-specific policy
 - Small enough to understand, flexible enough to extend
 
@@ -27,8 +36,8 @@ Spine aims to be:
 
 - Core before adapter: framework-specific behavior belongs in dedicated adapter entry points
 - Configure, do not fork: backend claim names, cookie behavior, endpoints, and redirects should be configured first
-- Request/Response first: server modules should work anywhere a standard Web `Request` and `Response` exist
-- App policy stays local: onboarding flows, subscription gates, product-specific redirects, and permission taxonomies should live in the consuming app
+- Request/Response first: server-facing APIs should use standard Web `Request` and `Response` objects
+- App policy stays local: setup flows, entitlement gates, product-specific redirects, and permission taxonomies should live in the consuming app
 - Open for composition: apps should be able to wrap Spine primitives instead of rewriting them
 
 ## Package Surfaces
@@ -36,7 +45,7 @@ Spine aims to be:
 | Entry point | Purpose |
 | --- | --- |
 | `@eminuckan/spine` | Client-side primitives and shared types |
-| `@eminuckan/spine/server` | Framework-agnostic server primitives |
+| `@eminuckan/spine/server` | Framework-agnostic server primitives and shared exports |
 | `@eminuckan/spine/react-router` | React Router client adapter |
 | `@eminuckan/spine/react-router/server` | React Router server adapter |
 | `@eminuckan/spine/auth` | Auth types |
@@ -68,14 +77,28 @@ Spine aims to be:
 
 ## What Spine Does Not Include
 
-- Your product's onboarding rules
-- Your product's subscription rules
+- Your product's setup rules
+- Your product's billing or entitlement rules
 - Your product's permission vocabulary
 - Your backend DTOs or generated API clients
 - Your page structure, layouts, or UI system
 
 Those belong in the consuming app or in a product-specific adapter package.
 
+## Backend Contract Model
+
+Spine does not require your backend to expose a fixed set of endpoints. It provides defaults for simple apps, but real SaaS apps often have different vocabulary:
+
+- tenant, workspace, account, company, project, or organization
+- permissions, capabilities, scopes, roles, or policy grants
+- bearer headers, custom session headers, cookie-backed APIs, or generated clients
+
+The intended integration style is:
+
+1. Configure claim names, cookie names, route policy, and API headers.
+2. Provide fetchers when your identity, permission, or tenant response shape differs.
+3. Keep product setup, billing, entitlement, and permission vocabulary in your app.
+
 ## Architecture
 
 ```mermaid
@@ -108,6 +131,19 @@ If you use client-side React features, install peer dependencies too:
 pnpm add react @tanstack/react-query
 ```
 
+For a fuller setup path, see [docs/installation.md](docs/installation.md).
+
+## Try the Example App
+
+```bash
+cd examples/react-router-saas
+pnpm install
+cp .env.example .env
+pnpm dev
+```
+
+The example includes React Router auth routes, a protected dashboard loader, client provider wiring, and local app adapters for backend identity and tenant conventions.
+
 ## Environment Variables
 
 The built-in auth/session layer currently reads these environment variables:
@@ -121,12 +157,12 @@ The built-in auth/session layer currently reads these environment variables:
 | `OIDC_CLIENT_AUTH_METHOD` | No | `none`, `client_secret_post`, or `client_secret_basic` |
 | `OIDC_SCOPE` | No | Requested scope string. Defaults to `openid profile email api` |
 | `OIDC_POST_LOGOUT_REDIRECT_URI` | No | Logout return URL |
-| `OIDC_APPLICATION_TYPE` | No | `no-landing-page`, `landing-page`, or legacy aliases |
+| `OIDC_APPLICATION_TYPE` | No | `no-landing-page`, `landing-page`, or deprecated aliases `dashboard` and `tenant-app` |
 | `OIDC_HAS_LANDING_PAGE` | No | Explicit landing-page behavior override |
 | `OIDC_ALLOW_INSECURE_REQUESTS` | No | Allows non-HTTPS OIDC issuer calls only outside production |
 | `REDIS_URL` | No | Redis connection string for sessions and OAuth state |
 | `REDIS_KEY_PREFIX` | No | Prefix for Redis keys |
-| `API_BASE_URL` | No | Default API base URL for `createAPIConfigFactory` |
+| `API_BASE_URL` | No | Optional fallback API base URL for `createAPIConfigFactory` |
 
 ## OIDC Session Lifecycle
 
@@ -167,170 +203,148 @@ Back-channel logout verifies the signed `logout_token` against the provider JWKS
 
 ## Quick Start
 
-### 1. Configure Identity and Tenant Adapters
+The snippets below show the integration shape. See [examples/react-router-saas](examples/react-router-saas) for a runnable React Router app.
+
+### 1. Add Auth Routes
+
+```ts
+// app/routes/auth.login.tsx
+import { login } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  throw await login(request, { returnUrl: '/dashboard' });
+}
+```
+
+```ts
+// app/routes/auth.callback.tsx
+import { handleCallback } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  return handleCallback(request);
+}
+```
+
+```ts
+// app/routes/auth.logout.tsx
+import { logout } from '@eminuckan/spine/react-router/server';
+
+export async function loader({ request }: { request: Request }) {
+  return logout(request);
+}
+```
+
+### 2. Configure Server Adapters
 
-Spine's server modules are generic, so your app should provide backend-specific fetchers once.
+Spine's server modules are generic. Your app should provide backend-specific identity and tenant fetchers once.
 
 ```ts
-// app/lib/mimir/identity.server.ts
+// app/lib/spine/identity.server.ts
 import {
   configureIdentityAPIFetcher,
   configurePermissionFetcher,
   contextToUserInfo,
   getIdentityContext,
 } from '@eminuckan/spine/identity/server';
-import { createAPIConfigFactory } from '@eminuckan/spine/api-client/server';
 import { getAccessToken } from '@eminuckan/spine/react-router/server';
-import { getCurrentTenant } from '@eminuckan/spine/tenant/server';
-import { Configuration, IdentityApi } from '~/lib/api-clients/api';
 
-const { createAPIConfig } = createAPIConfigFactory(getAccessToken, getCurrentTenant);
+const apiBaseUrl = process.env.API_BASE_URL;
+
+if (!apiBaseUrl) {
+  throw new Error('API_BASE_URL is required by this app adapter.');
+}
 
 configureIdentityAPIFetcher(async (request) => {
-  const config = await createAPIConfig(request, {
-    requireTenant: false,
-    includeAuth: true,
-  });
+  const accessToken = await getAccessToken(request);
 
-  const api = new IdentityApi(
-    new Configuration({
-      basePath: config.basePath,
-      accessToken: config.accessToken,
-      baseOptions: { headers: config.headers },
-    })
-  );
+  const response = await fetch(`${apiBaseUrl}/api/me/context`, {
+    headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : undefined,
+  });
 
-  const response = await api.identityGetMyContext();
+  if (!response.ok) {
+    throw new Error(`Failed to load identity context: ${response.status}`);
+  }
 
-  return {
-    ...response.data,
-    contextVersion: Date.now(),
-    hasSubscription: Boolean(
-      response.data.onboarding?.subscription?.exists &&
-      ['active', 'trialing'].includes(response.data.onboarding?.subscription?.status || '')
-    ),
-  };
+  return response.json();
 });
 
 configurePermissionFetcher(async (request, tenantId) => {
-  const config = await createAPIConfig(request, { requireTenant: false });
-  const api = new IdentityApi(
-    new Configuration({
-      basePath: config.basePath,
-      accessToken: config.accessToken,
-      baseOptions: { headers: config.headers },
-    })
-  );
+  const accessToken = await getAccessToken(request);
+  const url = new URL('/api/me/permissions', apiBaseUrl);
+  url.searchParams.set('tenantId', tenantId);
+
+  const response = await fetch(url, {
+    headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : undefined,
+  });
+
+  if (!response.ok) {
+    return [];
+  }
 
-  const response = await api.identityGetMyPermissions(tenantId);
-  return response.data.permissions || [];
+  const payload = await response.json();
+  return Array.isArray(payload.permissions) ? payload.permissions : [];
 });
 
 export { contextToUserInfo, getIdentityContext };
 ```
 
 ```ts
-// app/lib/mimir/tenant.server.ts
+// app/lib/spine/tenant.server.ts
 import {
-  configureIdentityContextFetcher,
+  configureTenantResolution,
   configureTenantCookie,
-  getAvailableTenants,
-  getCurrentTenant,
+  getActiveTenant,
   initializeTenant,
 } from '@eminuckan/spine/tenant/server';
-import { fetchIdentityContext } from './identity.server';
+import { getUser } from '@eminuckan/spine/react-router/server';
+import { getIdentityContext } from './identity.server';
 
 configureTenantCookie({
+  name: '__spine_tenant',
   httpOnly: false,
   sameSite: 'Lax',
 });
 
-configureIdentityContextFetcher(fetchIdentityContext);
-
-export {
-  getAvailableTenants,
-  getCurrentTenant,
-  initializeTenant,
-};
-```
-
-### 2. Configure Server-Side Permission Protection
-
-```ts
-// app/lib/mimir/permissions.server.ts
-import {
-  configurePermissionRouteProtection,
-  requirePermission,
-} from '@eminuckan/spine/server';
-import { getAuthSession } from '@eminuckan/spine/react-router/server';
-import { contextToUserInfo, getIdentityContext } from './identity.server';
-import { getCurrentTenant } from './tenant.server';
-
-configurePermissionRouteProtection({
-  getSession: getAuthSession,
-  resolveContext: async (request, session) => {
-    if (!session.user?.sub) {
-      return { permissions: [], currentTenant: null };
+configureTenantResolution({
+  identityContextFetcher: async (request) => {
+    const user = await getUser(request);
+    if (!user) {
+      return null;
     }
 
-    const identityContext = await getIdentityContext(request, session.user.sub);
-    const currentTenant = await getCurrentTenant(request);
-    const userInfo = await contextToUserInfo(identityContext, {
-      currentTenant,
-      request,
-    });
-
+    const context = await getIdentityContext(request, user.sub);
     return {
-      permissions: userInfo.permissions,
-      currentTenant: userInfo.currentTenant,
+      memberships: context.memberships ?? [],
     };
   },
 });
 
-export { requirePermission };
+export { getActiveTenant, initializeTenant };
 ```
 
-### 3. Protect Routes
+### 3. Protect a Route
 
 ```ts
-// app/routes/_protected.tsx
+// app/routes/dashboard.tsx
 import { authRoute, getAccessToken } from '@eminuckan/spine/react-router/server';
-import { getCurrentTenant, initializeTenant } from '~/lib/mimir/tenant.server';
-import { contextToUserInfo, getIdentityContext } from '~/lib/mimir/identity.server';
+import { getActiveTenant, initializeTenant } from '~/lib/spine/tenant.server';
 
 export async function loader({ request }: { request: Request }) {
   return authRoute(request, async (user) => {
-    const [accessToken, identityContext, currentTenant] = await Promise.all([
-      getAccessToken(request),
-      getIdentityContext(request, user.sub),
-      getCurrentTenant(request),
-    ]);
-
-    const initResult =
-      !currentTenant && identityContext.hasAnyMembership
-        ? await initializeTenant(request)
-        : null;
-
-    const userInfo = await contextToUserInfo(identityContext, {
-      currentTenant: initResult?.tenantId ?? currentTenant,
-      request,
-    });
+    const currentTenant = await getActiveTenant(request);
+    const initializedTenant = currentTenant ? null : await initializeTenant(request);
+    const accessToken = await getAccessToken(request);
 
     return {
       user,
-      accessToken,
-      identity: {
-        ...identityContext,
-        permissions: userInfo.permissions,
-        currentTenant: userInfo.currentTenant,
-      },
-      tenantHeaders: initResult?.headers ?? null,
+      hasAccessToken: Boolean(accessToken),
+      currentTenant: initializedTenant?.tenantId ?? currentTenant,
     };
   });
 }
 ```
 
-### 4. Wire Client Providers
+### 4. Wire React Providers
 
 ```tsx
 import { QueryClientProvider } from '@tanstack/react-query';
@@ -378,20 +392,18 @@ export function AppProviders({
 }
 ```
 
-### 5. Configure Backend Conventions Instead of Forking
+### 5. Configure Conventions Instead of Forking
 
 ```ts
-import {
-  configureAuthClaimMapping,
-  configureIdentityStore,
-  configureRouteProtection,
-} from '@eminuckan/spine/server';
+import { configureAuthClaimMapping, configureRouteProtection } from '@eminuckan/spine/server';
+import { configureIdentityStore } from '@eminuckan/spine/identity';
+import { configureTenantClient } from '@eminuckan/spine/tenant';
 
 configureAuthClaimMapping({
-  tenantIds: ['organizations', 'tenant_ids'],
-  tenantRoles: ['organization_roles', 'tenant_roles'],
+  tenantIds: ['tenant_ids'],
+  tenantRoles: ['tenant_roles'],
   permissions: ['permissions', 'scope'],
-  isOnboarded: ['profile_complete', 'is_onboarded'],
+  isOnboarded: ['is_onboarded'],
 });
 
 configureIdentityStore({
@@ -400,22 +412,45 @@ configureIdentityStore({
   logoutPath: '/session/logout',
 });
 
+configureTenantClient({
+  fetchTenantData: async ({ tenantId }) => {
+    const response = await fetch(`/api/workspaces/${tenantId}`);
+    const payload = await response.json();
+    return {
+      id: payload.workspace.id,
+      name: payload.workspace.displayName,
+    };
+  },
+});
+
 configureRouteProtection({
   getLoginReturnUrl: ({ request }) => new URL(request.url).pathname,
 });
 ```
 
+Client contracts are configurable too. Simple apps can use endpoint configuration; apps with workspace/account/customer-specific contracts can provide `fetchTenantData`, `switchTenant`, `fetchContext`, and `fetchPermissions` functions. API header names are configurable through `createAPIConfigFactory`.
+
 More adaptation examples live in [docs/backend-adaptation.md](docs/backend-adaptation.md).
 
-## Module Guides
+## Documentation
+
+Integration docs:
 
 - [Architecture](docs/architecture.md)
+- [Installation](docs/installation.md)
 - [Adapters](docs/adapters.md)
 - [Backend Adaptation](docs/backend-adaptation.md)
 - [Module Reference](docs/module-reference.md)
+
+Project docs:
+
+- [Roadmap](ROADMAP.md)
 - [Releasing](docs/releasing.md)
 - [Contributing](CONTRIBUTING.md)
+- [Maintainers](MAINTAINERS.md)
 - [Security](SECURITY.md)
+- [Code of Conduct](CODE_OF_CONDUCT.md)
+- [Codex Maintenance Plan](docs/codex-maintenance.md)
 
 ## Current Boundaries
 
@@ -430,27 +465,27 @@ Spine already owns the reusable infrastructure for:
 
 Consuming apps should still own:
 
-- Product-specific onboarding pages and redirects
-- Product-specific subscription policies
+- Product-specific setup pages and redirects
+- Product-specific billing or entitlement policies
 - Permission constants and domain vocabulary
 - Generated API clients
 - UI-specific wrappers and design system components
 
 ## Roadmap
 
+The active roadmap lives in [ROADMAP.md](ROADMAP.md). Current tracks include:
+
 - First-class Next.js adapter surface
-- More adapter authoring guidance
-- Cleaner permission taxonomy extension story
-- More example apps
-- Broader runtime coverage tests
+- Clerk and Supabase integration guidance
+- More adapter authoring tests and examples
+- Cleaner migration from deprecated compatibility aliases
+- Public API stability review before `1.0`
 
 ## Development
 
 ```bash
 pnpm install
-pnpm typecheck
-pnpm build
-pnpm lint
+pnpm check
 ```
 
 Detailed contributor guidance lives in [CONTRIBUTING.md](CONTRIBUTING.md).

package/ROADMAP.md

@@ -0,0 +1,58 @@
+# Spine Roadmap
+
+Spine is a small, adapter-friendly foundation for SaaS frontend infrastructure. The roadmap favors reusable primitives, clear framework adapters, and backend-contract flexibility over product-specific features.
+
+## Current Focus
+
+- Keep the core framework-agnostic and based on Web `Request` and `Response` primitives.
+- Keep application policy, permission vocabularies, setup flows, and entitlement rules in consuming apps.
+- Make every backend convention configurable before adding a new abstraction.
+- Preserve compatibility for existing consumers while moving toward a cleaner `1.0` API.
+
+## Near-Term
+
+- Publish the `0.3.x` open source reboot with generic tenant, identity, permission, API, realtime, and adapter surfaces.
+- Expand the React Router example into a fuller SaaS shell with auth, tenant switching, permission gates, and API configuration.
+- Add adapter authoring tests that prove new adapters can stay thin.
+- Add more normalization examples for account, workspace, organization, and custom tenant contracts.
+- Document migration notes from deprecated organization and subscription aliases to tenant and entitlement terminology.
+
+## Adapter Track
+
+- First-class Next.js adapter entry points.
+- React Router adapter refinements where framework-specific helpers remove real boilerplate.
+- Research notes for Vue and Svelte adapter shapes.
+- Adapter request template and contribution checklist for community proposals.
+
+## Provider Track
+
+- Clerk identity/session adapter guidance.
+- Supabase auth and Postgres-backed tenant examples.
+- Auth0 and generic OpenID Connect recipes.
+- Optional examples for API clients generated from OpenAPI without making any generated client mandatory.
+
+## Core Hardening
+
+- Broader tests for route protection and OIDC/session lifecycle behavior.
+- More explicit storage abstraction boundaries for sessions and OAuth state.
+- Runtime compatibility notes for Node, edge-like runtimes, and serverless deployments.
+- Public API stability review before `1.0`.
+
+## Not Planned For Core
+
+- Product-specific route names.
+- Product-specific permission constants.
+- Billing plan vocabulary.
+- Backend DTOs or generated SDKs.
+- UI components tied to one design system.
+
+Those belong in consuming apps or app-specific adapter packages.
+
+## How To Propose Work
+
+Open an issue using the relevant template and describe:
+
+- the repeated SaaS infrastructure problem
+- whether it belongs in core, a framework adapter, provider guidance, or the consuming app
+- how the API can remain generic across multiple projects
+- what tests or docs would prove the behavior

package/SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied to the latest published release line.
+
+## Reporting a Vulnerability
+
+Please do not open public GitHub issues for security problems.
+
+Instead, report vulnerabilities privately to:
+
+- Email: `eminuckan@gmail.com`
+
+When possible, include:
+
+- A clear description of the issue
+- Affected versions
+- Reproduction steps
+- Potential impact
+- Any suggested mitigation
+
+## Response Expectations
+
+The goal is to acknowledge reports quickly, validate impact, and coordinate a fix before public disclosure.
+
+## Scope Notes
+
+Spine provides infrastructure primitives, but consuming applications are still responsible for:
+
+- Backend authorization enforcement
+- Secure secret management
+- Correct adapter configuration
+- Safe redirect and cookie policies
+- Protecting product-specific APIs and workflows
+
+Frontend permission checks and route guards in Spine improve UX, but they are not a substitute for backend authorization.

package/dist/access/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/access/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGd,iBAAiB,EACjB,aAAa,EAEd,MAAM,SAAS,CAAC;AA0CjB,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACjD,OAAO,EAAE,aAAa,GACrB,cAAc,CAkDhB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/access/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGd,iBAAiB,EACjB,aAAa,EAEd,MAAM,SAAS,CAAC;AA0CjB,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACjD,OAAO,EAAE,aAAa,GACrB,cAAc,CAqDhB"}

package/dist/access/index.js

@@ -1,4 +1,4 @@
 import "../permission-service-CvGpwI0d.js";
-import { evaluateAccessRequirement } from "../access-DlAqsVGQ.js";
+import { evaluateAccessRequirement } from "../access-CGrsDMwu.js";
 
 export { evaluateAccessRequirement };

package/dist/access/types.d.ts

@@ -1,14 +1,18 @@
 import type { PermissionCode } from '../permissions/types';
 export type AccessOperator = 'AND' | 'OR';
-export interface SubscriptionAccessSnapshot {
+export interface EntitlementAccessSnapshot {
     exists?: boolean;
     status?: string | null;
     planCode?: string | null;
     featureKeys?: readonly string[] | null;
     limits?: Record<string, unknown> | null;
 }
+/** @deprecated Use EntitlementAccessSnapshot instead. */
+export type SubscriptionAccessSnapshot = EntitlementAccessSnapshot;
 export interface AccessSubject {
     permissions?: readonly PermissionCode[] | null;
+    entitlement?: EntitlementAccessSnapshot | null;
+    /** @deprecated Use entitlement instead. */
     subscription?: SubscriptionAccessSnapshot | null;
     isInternalUser?: boolean;
 }
@@ -17,10 +21,14 @@ export interface AccessRequirement {
     permissionOperator?: AccessOperator;
     features?: readonly string[];
     featureOperator?: AccessOperator;
+    requireActiveEntitlement?: boolean;
+    /** @deprecated Use requireActiveEntitlement instead. */
     requireActiveSubscription?: boolean;
     internalOnly?: boolean;
 }
-export type AccessDeniedReason = 'internal-only' | 'inactive-subscription' | 'missing-permissions' | 'missing-features';
+export type AccessDeniedReason = 'internal-only' | 'inactive-entitlement'
+/** @deprecated Use inactive-entitlement instead. */
+ | 'inactive-subscription' | 'missing-permissions' | 'missing-features';
 export interface AccessDecision {
     allowed: boolean;
     reasons: AccessDeniedReason[];

package/dist/access/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC/C,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,MAAM,0BAA0B,GAAG,yBAAyB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC/C,WAAW,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C,2CAA2C;IAC3C,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,sBAAsB;AACxB,oDAAoD;GAClD,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}