@entifix/next-shell 0.1.0-0

package/dist/lib/search/record-search-source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/search/record-search-source.ts"],"sourcesContent":["import {\n  describeEntityColumns,\n  EntifixLogicError,\n  type Entity,\n  type EntityConstructor,\n  type EntityFieldDescriptor,\n  type EntityLoadRequest,\n  envelopeEntityName,\n  readEntityPageEnvelope,\n  serializeLoadRequestParams,\n} from '@entifix/core';\nimport { Effect, Exit } from 'effect';\n\nimport type { RecordSearchOption } from './record-search.types.js';\n\n/**\n * What a host declares in order to make one entity searchable from the palette\n * (ADR 0040).\n *\n * The search and label members are **declared**, not derived, and that is not an\n * oversight in the metadata: `linkSearchProperty`/`linkLabelProperty` are\n * properties of a *referring* accessor — they say how the owner of a relation\n * looks up its target — and an entity has no member that says \"this is what I am\n * called\". So the host that mounts the screens says it, next to the route those\n * screens live at.\n */\nexport interface RecordSearchSourceConfig<TEntity extends Entity> {\n  /** Stable id, unique per host. Defaults to the entity's wire name. */\n  readonly key?: string;\n  readonly entityConstructor: EntityConstructor<TEntity>;\n  /** Where the owning service listens, **without** the `/api` suffix. */\n  readonly baseUrl: string;\n  /** The `filterable` string member a term is matched against with `like`. */\n  readonly searchProperty: string;\n  /** The `sortable` member read as a record's label. */\n  readonly labelProperty: string;\n  /** An optional secondary line — a code, a role. */\n  readonly sublabelProperty?: string;\n  /** The group heading, as the entity's own `pluralKey`. */\n  readonly labelKey: string;\n  /** Where selecting a record lands. Locale-free; the caller prefixes it. */\n  readonly href: (id: string) => string;\n}\n\n/** A declared source, reduced to what the fan-out actually calls. */\nexport interface RecordSearchSource {\n  readonly key: string;\n  readonly entity: string;\n  readonly labelKey: string;\n  /** The upstream URL for one term. */\n  readonly url: (term: string, limit: number) => string;\n  /** `undefined` when the body is not a readable `entityPage` envelope. */\n  readonly read: (\n    body: unknown,\n  ) => { items: RecordSearchOption[]; total: number } | undefined;\n}\n\nconst descriptorOf = (\n  columns: EntityFieldDescriptor[],\n  name: string,\n): EntityFieldDescriptor | undefined =>\n  columns.find(column => column.name === name);\n\nconst rejection = (\n  entityName: string,\n  member: string,\n  because: string,\n  fix: string,\n): EntifixLogicError =>\n  new EntifixLogicError(\n    `Cannot search ${entityName} by \"${member}\": ${because} ${fix}`,\n    undefined,\n    { entity: entityName, member },\n  );\n\n/**\n * Declare a record search source, validating it against the entity's own\n * metadata **now** rather than on the first keystroke.\n *\n * Every check here guards a failure that is otherwise silent at both ends: the\n * service answers `400`, and a caller renders that as a group it could not\n * reach — which reads as \"there are no products\". `assertSearchable` took the\n * same posture for the relation picker, for the same reason.\n *\n * ⚠️ This throws at **module load**, so a bad declaration fails the whole app at\n * boot rather than just search. That is deliberate — a source silently missing\n * from a palette is indistinguishable from a permission the caller lacks — but\n * the blast radius is wider than the picker's, which fails only its own render.\n */\nexport const defineRecordSearchSource = <TEntity extends Entity>({\n  key,\n  entityConstructor,\n  baseUrl,\n  searchProperty,\n  labelProperty,\n  sublabelProperty,\n  labelKey,\n  href,\n}: RecordSearchSourceConfig<TEntity>): RecordSearchSource => {\n  const entity = envelopeEntityName(entityConstructor);\n  const entityName = entityConstructor.name;\n  const columns = describeEntityColumns(entityConstructor);\n\n  const search = descriptorOf(columns, searchProperty);\n  if (search === undefined) {\n    throw rejection(\n      entityName,\n      searchProperty,\n      'the entity declares no such member.',\n      'Name a member the entity actually has.',\n    );\n  }\n  // `filterable` is simultaneously the server-side RSQL allowlist.\n  if (!search.filterable) {\n    throw rejection(\n      entityName,\n      searchProperty,\n      'the member is not filterable, so the service would reject the query.',\n      'Declare it `filterable` on the entity, or search another member.',\n    );\n  }\n  // A `like` against anything else reaches `coerceValue`, which rejects a\n  // partial term — so an enum member reads as declarable and is permanently\n  // broken: every keystroke short of a whole value answers `400`.\n  if (search.type !== 'string') {\n    throw rejection(\n      entityName,\n      searchProperty,\n      `the member is a ${search.type}, and a partial term is not a valid value for it.`,\n      'Search a string member instead.',\n    );\n  }\n\n  const label = descriptorOf(columns, labelProperty);\n  if (label === undefined) {\n    throw rejection(\n      entityName,\n      labelProperty,\n      'the entity declares no such label member.',\n      'Name a member the entity actually has.',\n    );\n  }\n  // The group is sorted by the label, so the flag is load-bearing: without it\n  // the service rejects the sort and the group degrades whole. Unsorted was the\n  // alternative and is worse — the services apply no default order, so results\n  // would arrive in storage order and shuffle as records are rewritten.\n  if (!label.sortable) {\n    throw rejection(\n      entityName,\n      labelProperty,\n      'the label member is not sortable, so the service would reject the sort.',\n      'Declare it `sortable` on the entity, or label records by another member.',\n    );\n  }\n\n  let sublabel: EntityFieldDescriptor | undefined;\n  if (sublabelProperty !== undefined) {\n    sublabel = descriptorOf(columns, sublabelProperty);\n    if (sublabel === undefined) {\n      throw rejection(\n        entityName,\n        sublabelProperty,\n        'the entity declares no such sublabel member.',\n        'Name a member the entity actually has, or drop `sublabelProperty`.',\n      );\n    }\n  }\n\n  const read = (\n    body: unknown,\n  ): { items: RecordSearchOption[]; total: number } | undefined => {\n    const page = Effect.runSyncExit(\n      readEntityPageEnvelope(entityConstructor, body),\n    );\n    if (Exit.isFailure(page)) return undefined;\n\n    const items = page.value.items\n      .filter(record => (record as Entity).id != null)\n      .map(record => {\n        const row = record as unknown as Record<string, unknown>;\n        const raw = row[labelProperty];\n        const id = String((record as Entity).id);\n        return {\n          id,\n          // A blank label is as useless as a missing one, so both fall back to\n          // the id — an unnamed record must stay distinguishable from the one\n          // above it. Same rule the relation picker's `labelOf` applies.\n          label: raw == null || raw === '' ? id : String(raw),\n          ...(sublabel !== undefined && row[sublabel.name] != null\n            ? { sublabel: String(row[sublabel.name]) }\n            : {}),\n          entity,\n          href: href(id),\n        } satisfies RecordSearchOption;\n      });\n\n    return { items, total: page.value.total };\n  };\n\n  return {\n    key: key ?? entity,\n    entity,\n    labelKey,\n    /**\n     * Built through `serializeLoadRequestParams`, never by hand. That is\n     * correctness rather than tidiness: `encodeRsqlValue` quotes a term carrying\n     * any of `;,()'\"=!<>\\` or whitespace, so `Acme, Inc.` stays one value\n     * instead of splitting the expression into two comparisons.\n     */\n    url: (term, limit) => {\n      const request = {\n        filtering: [\n          {\n            property: search.key,\n            operator: 'like' as const,\n            value: term,\n          },\n        ],\n        sorting: [{ 0: { property: label.key, type: 'asc' as const } }],\n        page: 1,\n        pageSize: limit,\n      } as unknown as EntityLoadRequest;\n\n      return `${baseUrl}/api/${entity}?${serializeLoadRequestParams(request).toString()}`;\n    },\n    read,\n  };\n};\n"],"names":["describeEntityColumns","EntifixLogicError","envelopeEntityName","readEntityPageEnvelope","serializeLoadRequestParams","Effect","Exit","descriptorOf","columns","name","find","column","rejection","entityName","member","because","fix","undefined","entity","defineRecordSearchSource","key","entityConstructor","baseUrl","searchProperty","labelProperty","sublabelProperty","labelKey","href","search","filterable","type","label","sortable","sublabel","read","body","page","runSyncExit","isFailure","items","value","filter","record","id","map","row","raw","String","total","url","term","limit","request","filtering","property","operator","sorting","pageSize","toString"],"mappings":";AAAA,SACEA,qBAAqB,EACrBC,iBAAiB,EAKjBC,kBAAkB,EAClBC,sBAAsB,EACtBC,0BAA0B,QACrB,gBAAgB;AACvB,SAASC,MAAM,EAAEC,IAAI,QAAQ,SAAS;AA8CtC,MAAMC,eAAe,CACnBC,SACAC,OAEAD,QAAQE,IAAI,CAACC,CAAAA,SAAUA,OAAOF,IAAI,KAAKA;AAEzC,MAAMG,YAAY,CAChBC,YACAC,QACAC,SACAC,MAEA,IAAIf,kBACF,CAAC,cAAc,EAAEY,WAAW,KAAK,EAAEC,OAAO,GAAG,EAAEC,QAAQ,CAAC,EAAEC,KAAK,EAC/DC,WACA;QAAEC,QAAQL;QAAYC;IAAO;AAGjC;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMK,2BAA2B,CAAyB,EAC/DC,GAAG,EACHC,iBAAiB,EACjBC,OAAO,EACPC,cAAc,EACdC,aAAa,EACbC,gBAAgB,EAChBC,QAAQ,EACRC,IAAI,EAC8B;IAClC,MAAMT,SAAShB,mBAAmBmB;IAClC,MAAMR,aAAaQ,kBAAkBZ,IAAI;IACzC,MAAMD,UAAUR,sBAAsBqB;IAEtC,MAAMO,SAASrB,aAAaC,SAASe;IACrC,IAAIK,WAAWX,WAAW;QACxB,MAAML,UACJC,YACAU,gBACA,uCACA;IAEJ;IACA,iEAAiE;IACjE,IAAI,CAACK,OAAOC,UAAU,EAAE;QACtB,MAAMjB,UACJC,YACAU,gBACA,wEACA;IAEJ;IACA,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAIK,OAAOE,IAAI,KAAK,UAAU;QAC5B,MAAMlB,UACJC,YACAU,gBACA,CAAC,gBAAgB,EAAEK,OAAOE,IAAI,CAAC,iDAAiD,CAAC,EACjF;IAEJ;IAEA,MAAMC,QAAQxB,aAAaC,SAASgB;IACpC,IAAIO,UAAUd,WAAW;QACvB,MAAML,UACJC,YACAW,eACA,6CACA;IAEJ;IACA,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,CAACO,MAAMC,QAAQ,EAAE;QACnB,MAAMpB,UACJC,YACAW,eACA,2EACA;IAEJ;IAEA,IAAIS;IACJ,IAAIR,qBAAqBR,WAAW;QAClCgB,WAAW1B,aAAaC,SAASiB;QACjC,IAAIQ,aAAahB,WAAW;YAC1B,MAAML,UACJC,YACAY,kBACA,gDACA;QAEJ;IACF;IAEA,MAAMS,OAAO,CACXC;QAEA,MAAMC,OAAO/B,OAAOgC,WAAW,CAC7BlC,uBAAuBkB,mBAAmBc;QAE5C,IAAI7B,KAAKgC,SAAS,CAACF,OAAO,OAAOnB;QAEjC,MAAMsB,QAAQH,KAAKI,KAAK,CAACD,KAAK,CAC3BE,MAAM,CAACC,CAAAA,SAAU,AAACA,OAAkBC,EAAE,IAAI,MAC1CC,GAAG,CAACF,CAAAA;YACH,MAAMG,MAAMH;YACZ,MAAMI,MAAMD,GAAG,CAACrB,cAAc;YAC9B,MAAMmB,KAAKI,OAAO,AAACL,OAAkBC,EAAE;YACvC,OAAO;gBACLA;gBACA,qEAAqE;gBACrE,oEAAoE;gBACpE,+DAA+D;gBAC/DZ,OAAOe,OAAO,QAAQA,QAAQ,KAAKH,KAAKI,OAAOD;eAC3Cb,aAAahB,aAAa4B,GAAG,CAACZ,SAASxB,IAAI,CAAC,IAAI,OAChD;gBAAEwB,UAAUc,OAAOF,GAAG,CAACZ,SAASxB,IAAI,CAAC;YAAE,IACvC,CAAC;gBACLS;gBACAS,MAAMA,KAAKgB;;QAEf;QAEF,OAAO;YAAEJ;YAAOS,OAAOZ,KAAKI,KAAK,CAACQ,KAAK;QAAC;IAC1C;IAEA,OAAO;QACL5B,GAAG,EAAEA,cAAAA,MAAOF;QACZA;QACAQ;QACA;;;;;KAKC,GACDuB,KAAK,CAACC,MAAMC;YACV,MAAMC,UAAU;gBACdC,WAAW;oBACT;wBACEC,UAAU1B,OAAOR,GAAG;wBACpBmC,UAAU;wBACVf,OAAOU;oBACT;iBACD;gBACDM,SAAS;oBAAC;wBAAE,GAAG;4BAAEF,UAAUvB,MAAMX,GAAG;4BAAEU,MAAM;wBAAe;oBAAE;iBAAE;gBAC/DM,MAAM;gBACNqB,UAAUN;YACZ;YAEA,OAAO,GAAG7B,QAAQ,KAAK,EAAEJ,OAAO,CAAC,EAAEd,2BAA2BgD,SAASM,QAAQ,IAAI;QACrF;QACAxB;IACF;AACF,EAAE"}

package/dist/lib/search/record-search.types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The wire contract of `GET /api/search` — the cross-domain record search the
+ * command palette reads (ADR 0040).
+ *
+ * Types only, so both halves can name them: the route handler builds these on
+ * the server, and the browser's `searchRecords` returns them. A type crosses the
+ * client/server entry split freely because it erases.
+ */
+/**
+ * Why a source produced no group.
+ *
+ * The split is the point, and it is not cosmetic. `forbidden` and
+ * `noActiveOrganization` are the **normal** state for some callers on some
+ * sources — an operator holds no membership, so every tenant-plane search
+ * answers `409` — and rendering "we could not reach this" for the ordinary case
+ * teaches an operator to ignore the warning. `timeout`/`network`/`unexpected`
+ * are the ones that mean something is actually wrong.
+ *
+ * Every member is a key in the shared `errors` catalog, so a caller renders one
+ * through the documented runtime-key hatch rather than inventing copy.
+ */
+export type RecordSearchUnavailableReason = 'timeout' | 'network' | 'unauthenticated' | 'forbidden' | 'noActiveOrganization' | 'invalidQuery' | 'notFound' | 'unexpected';
+/** One record a caller can show and route to. */
+export interface RecordSearchOption {
+    readonly id: string;
+    readonly label: string;
+    /** A secondary line — a code, a role. Absent when the source declared none. */
+    readonly sublabel?: string;
+    /**
+     * `envelopeEntityName(Ctor)` — `key ?? name`.
+     *
+     * Repeated on every option rather than left to the group, because an option is
+     * routed on its own once a caller has flattened the list: `['entity', entity]`
+     * is exactly `entityQueryScope`'s output, and `entity:<entity>:<id>` is the
+     * workspace tab address.
+     */
+    readonly entity: string;
+    /**
+     * Where selecting this record lands, **without** a locale prefix — the caller
+     * adds one, the same way every other internal href in the back office works.
+     */
+    readonly href: string;
+}
+/** One source's answer. */
+export interface RecordSearchGroup {
+    /** The source's declared key. Stable, and the caller's ordering. */
+    readonly source: string;
+    readonly entity: string;
+    /**
+     * The heading, as the entity's own `pluralKey`. A key rather than copy,
+     * because the server has no locale — and the entity catalogs already carry one
+     * for every source, so record search introduces no copy of its own.
+     */
+    readonly labelKey: string;
+    readonly items: readonly RecordSearchOption[];
+    /**
+     * Matches **before** the per-group limit, so "3 more" is renderable. A
+     * reachable source with no matches is a present group with an empty `items`,
+     * never an omission — that distinction is the whole reason
+     * {@link RecordSearchResponse.unavailable} exists.
+     */
+    readonly total: number;
+}
+/** One source that produced nothing, and why. */
+export interface RecordSearchUnavailable {
+    readonly source: string;
+    readonly entity: string;
+    readonly reason: RecordSearchUnavailableReason;
+    /** The upstream status, when there was a response. Absent on a throw. */
+    readonly status?: number;
+}
+/**
+ * The whole answer.
+ *
+ * A degraded source is **named**, never a silently missing group. An empty group
+ * is a confident claim that there are no matching records, and a search that
+ * confidently reports nothing when it in fact could not look is the failure
+ * mode this shape exists to prevent.
+ */
+export interface RecordSearchResponse {
+    readonly term: string;
+    readonly groups: readonly RecordSearchGroup[];
+    readonly unavailable: readonly RecordSearchUnavailable[];
+}
+//# sourceMappingURL=record-search.types.d.ts.map

package/dist/lib/search/record-search.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-search.types.d.ts","sourceRoot":"","sources":["../../../src/lib/search/record-search.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GACrC,SAAS,GACT,SAAS,GACT,iBAAiB,GACjB,WAAW,GACX,sBAAsB,GACtB,cAAc,GACd,UAAU,GACV,YAAY,CAAC;AAEjB,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,2BAA2B;AAC3B,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC1D"}

package/dist/lib/search/record-search.types.js

@@ -0,0 +1,29 @@
+/**
+ * The wire contract of `GET /api/search` — the cross-domain record search the
+ * command palette reads (ADR 0040).
+ *
+ * Types only, so both halves can name them: the route handler builds these on
+ * the server, and the browser's `searchRecords` returns them. A type crosses the
+ * client/server entry split freely because it erases.
+ */ /**
+ * Why a source produced no group.
+ *
+ * The split is the point, and it is not cosmetic. `forbidden` and
+ * `noActiveOrganization` are the **normal** state for some callers on some
+ * sources — an operator holds no membership, so every tenant-plane search
+ * answers `409` — and rendering "we could not reach this" for the ordinary case
+ * teaches an operator to ignore the warning. `timeout`/`network`/`unexpected`
+ * are the ones that mean something is actually wrong.
+ *
+ * Every member is a key in the shared `errors` catalog, so a caller renders one
+ * through the documented runtime-key hatch rather than inventing copy.
+ */ /**
+ * The whole answer.
+ *
+ * A degraded source is **named**, never a silently missing group. An empty group
+ * is a confident claim that there are no matching records, and a search that
+ * confidently reports nothing when it in fact could not look is the failure
+ * mode this shape exists to prevent.
+ */ export { };
+
+//# sourceMappingURL=record-search.types.js.map

package/dist/lib/search/record-search.types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/search/record-search.types.ts"],"sourcesContent":["/**\n * The wire contract of `GET /api/search` — the cross-domain record search the\n * command palette reads (ADR 0040).\n *\n * Types only, so both halves can name them: the route handler builds these on\n * the server, and the browser's `searchRecords` returns them. A type crosses the\n * client/server entry split freely because it erases.\n */\n\n/**\n * Why a source produced no group.\n *\n * The split is the point, and it is not cosmetic. `forbidden` and\n * `noActiveOrganization` are the **normal** state for some callers on some\n * sources — an operator holds no membership, so every tenant-plane search\n * answers `409` — and rendering \"we could not reach this\" for the ordinary case\n * teaches an operator to ignore the warning. `timeout`/`network`/`unexpected`\n * are the ones that mean something is actually wrong.\n *\n * Every member is a key in the shared `errors` catalog, so a caller renders one\n * through the documented runtime-key hatch rather than inventing copy.\n */\nexport type RecordSearchUnavailableReason =\n  | 'timeout'\n  | 'network'\n  | 'unauthenticated'\n  | 'forbidden'\n  | 'noActiveOrganization'\n  | 'invalidQuery'\n  | 'notFound'\n  | 'unexpected';\n\n/** One record a caller can show and route to. */\nexport interface RecordSearchOption {\n  readonly id: string;\n  readonly label: string;\n  /** A secondary line — a code, a role. Absent when the source declared none. */\n  readonly sublabel?: string;\n  /**\n   * `envelopeEntityName(Ctor)` — `key ?? name`.\n   *\n   * Repeated on every option rather than left to the group, because an option is\n   * routed on its own once a caller has flattened the list: `['entity', entity]`\n   * is exactly `entityQueryScope`'s output, and `entity:<entity>:<id>` is the\n   * workspace tab address.\n   */\n  readonly entity: string;\n  /**\n   * Where selecting this record lands, **without** a locale prefix — the caller\n   * adds one, the same way every other internal href in the back office works.\n   */\n  readonly href: string;\n}\n\n/** One source's answer. */\nexport interface RecordSearchGroup {\n  /** The source's declared key. Stable, and the caller's ordering. */\n  readonly source: string;\n  readonly entity: string;\n  /**\n   * The heading, as the entity's own `pluralKey`. A key rather than copy,\n   * because the server has no locale — and the entity catalogs already carry one\n   * for every source, so record search introduces no copy of its own.\n   */\n  readonly labelKey: string;\n  readonly items: readonly RecordSearchOption[];\n  /**\n   * Matches **before** the per-group limit, so \"3 more\" is renderable. A\n   * reachable source with no matches is a present group with an empty `items`,\n   * never an omission — that distinction is the whole reason\n   * {@link RecordSearchResponse.unavailable} exists.\n   */\n  readonly total: number;\n}\n\n/** One source that produced nothing, and why. */\nexport interface RecordSearchUnavailable {\n  readonly source: string;\n  readonly entity: string;\n  readonly reason: RecordSearchUnavailableReason;\n  /** The upstream status, when there was a response. Absent on a throw. */\n  readonly status?: number;\n}\n\n/**\n * The whole answer.\n *\n * A degraded source is **named**, never a silently missing group. An empty group\n * is a confident claim that there are no matching records, and a search that\n * confidently reports nothing when it in fact could not look is the failure\n * mode this shape exists to prevent.\n */\nexport interface RecordSearchResponse {\n  readonly term: string;\n  readonly groups: readonly RecordSearchGroup[];\n  readonly unavailable: readonly RecordSearchUnavailable[];\n}\n"],"names":[],"mappings":"AAAA;;;;;;;CAOC,GAED;;;;;;;;;;;;CAYC,GA+DD;;;;;;;CAOC,GACD,WAIC"}

package/dist/lib/search/search-records.d.ts

@@ -0,0 +1,25 @@
+import type { RecordSearchResponse } from './record-search.types.js';
+/** Where the aggregating route is mounted. Same-origin, so the cookie rides along. */
+export declare const RECORD_SEARCH_PATH = "/api/search";
+export interface SearchRecordsOptions {
+    /** Aborts an in-flight request when the term moves on. */
+    readonly signal?: AbortSignal;
+    /** Narrow the fan-out to these source keys. Omit to ask every source. */
+    readonly sources?: readonly string[];
+    /** Records per group. */
+    readonly limit?: number;
+}
+/**
+ * Ask the back office for records matching `term`.
+ *
+ * Deliberately framework-free — no React, no router, no debounce, no retry. It
+ * is a typed `fetch`, so the palette can own its own keystroke policy (which is
+ * where debounce and abort belong) and a server component or a test can call the
+ * same function.
+ *
+ * Same-origin on purpose: `entifix_at` is httpOnly and `sameSite: 'lax'`, so a
+ * cross-origin call would carry no session and every group would come back
+ * unavailable.
+ */
+export declare const searchRecords: (term: string, { signal, sources, limit }?: SearchRecordsOptions) => Promise<RecordSearchResponse>;
+//# sourceMappingURL=search-records.d.ts.map

package/dist/lib/search/search-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-records.d.ts","sourceRoot":"","sources":["../../../src/lib/search/search-records.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yBAAyB;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,6BAA4B,oBAAyB,KACpD,OAAO,CAAC,oBAAoB,CAoB9B,CAAC"}

package/dist/lib/search/search-records.js

@@ -0,0 +1,36 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/** Where the aggregating route is mounted. Same-origin, so the cookie rides along. */ export const RECORD_SEARCH_PATH = '/api/search';
+/**
+ * Ask the back office for records matching `term`.
+ *
+ * Deliberately framework-free — no React, no router, no debounce, no retry. It
+ * is a typed `fetch`, so the palette can own its own keystroke policy (which is
+ * where debounce and abort belong) and a server component or a test can call the
+ * same function.
+ *
+ * Same-origin on purpose: `entifix_at` is httpOnly and `sameSite: 'lax'`, so a
+ * cross-origin call would carry no session and every group would come back
+ * unavailable.
+ */ export const searchRecords = async (term, { signal, sources, limit } = {})=>{
+    const params = new URLSearchParams({
+        q: term
+    });
+    if (sources !== undefined && sources.length > 0) {
+        params.set('sources', sources.join(','));
+    }
+    if (limit !== undefined) params.set('limit', String(limit));
+    const response = await fetch(`${RECORD_SEARCH_PATH}?${params.toString()}`, _extends({
+        cache: 'no-store'
+    }, signal === undefined ? {} : {
+        signal
+    }));
+    if (!response.ok) {
+        // The route answers `401` for a lapsed session and `400` for a caller naming
+        // a source that does not exist. Neither is a per-source degradation — those
+        // arrive inside a `200` — so both are the caller's to handle.
+        throw new Error(`record search failed with ${response.status}`);
+    }
+    return await response.json();
+};
+
+//# sourceMappingURL=search-records.js.map

package/dist/lib/search/search-records.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/search/search-records.ts"],"sourcesContent":["import type { RecordSearchResponse } from './record-search.types.js';\n\n/** Where the aggregating route is mounted. Same-origin, so the cookie rides along. */\nexport const RECORD_SEARCH_PATH = '/api/search';\n\nexport interface SearchRecordsOptions {\n  /** Aborts an in-flight request when the term moves on. */\n  readonly signal?: AbortSignal;\n  /** Narrow the fan-out to these source keys. Omit to ask every source. */\n  readonly sources?: readonly string[];\n  /** Records per group. */\n  readonly limit?: number;\n}\n\n/**\n * Ask the back office for records matching `term`.\n *\n * Deliberately framework-free — no React, no router, no debounce, no retry. It\n * is a typed `fetch`, so the palette can own its own keystroke policy (which is\n * where debounce and abort belong) and a server component or a test can call the\n * same function.\n *\n * Same-origin on purpose: `entifix_at` is httpOnly and `sameSite: 'lax'`, so a\n * cross-origin call would carry no session and every group would come back\n * unavailable.\n */\nexport const searchRecords = async (\n  term: string,\n  { signal, sources, limit }: SearchRecordsOptions = {},\n): Promise<RecordSearchResponse> => {\n  const params = new URLSearchParams({ q: term });\n  if (sources !== undefined && sources.length > 0) {\n    params.set('sources', sources.join(','));\n  }\n  if (limit !== undefined) params.set('limit', String(limit));\n\n  const response = await fetch(`${RECORD_SEARCH_PATH}?${params.toString()}`, {\n    cache: 'no-store',\n    ...(signal === undefined ? {} : { signal }),\n  });\n\n  if (!response.ok) {\n    // The route answers `401` for a lapsed session and `400` for a caller naming\n    // a source that does not exist. Neither is a per-source degradation — those\n    // arrive inside a `200` — so both are the caller's to handle.\n    throw new Error(`record search failed with ${response.status}`);\n  }\n\n  return (await response.json()) as RecordSearchResponse;\n};\n"],"names":["RECORD_SEARCH_PATH","searchRecords","term","signal","sources","limit","params","URLSearchParams","q","undefined","length","set","join","String","response","fetch","toString","cache","ok","Error","status","json"],"mappings":";AAEA,oFAAoF,GACpF,OAAO,MAAMA,qBAAqB,cAAc;AAWhD;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC,MACA,EAAEC,MAAM,EAAEC,OAAO,EAAEC,KAAK,EAAwB,GAAG,CAAC,CAAC;IAErD,MAAMC,SAAS,IAAIC,gBAAgB;QAAEC,GAAGN;IAAK;IAC7C,IAAIE,YAAYK,aAAaL,QAAQM,MAAM,GAAG,GAAG;QAC/CJ,OAAOK,GAAG,CAAC,WAAWP,QAAQQ,IAAI,CAAC;IACrC;IACA,IAAIP,UAAUI,WAAWH,OAAOK,GAAG,CAAC,SAASE,OAAOR;IAEpD,MAAMS,WAAW,MAAMC,MAAM,GAAGf,mBAAmB,CAAC,EAAEM,OAAOU,QAAQ,IAAI,EAAE;QACzEC,OAAO;OACHd,WAAWM,YAAY,CAAC,IAAI;QAAEN;IAAO;IAG3C,IAAI,CAACW,SAASI,EAAE,EAAE;QAChB,6EAA6E;QAC7E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,IAAIC,MAAM,CAAC,0BAA0B,EAAEL,SAASM,MAAM,EAAE;IAChE;IAEA,OAAQ,MAAMN,SAASO,IAAI;AAC7B,EAAE"}

package/dist/lib/session/account-links.d.ts

@@ -0,0 +1,46 @@
+import type { Locale } from '@entifix/core';
+/**
+ * The catalog keys naming these destinations, in the `shell` namespace.
+ *
+ * They are keys of `shell` and not of `app` because this list is shell-owned:
+ * the module that authors a string owns its catalog entry and resolves it. When
+ * they lived under `app:auth.*`, every host app had to resolve a key belonging
+ * to a *different* app's sub-tree just to render this menu.
+ *
+ * Typed as a union rather than `string` so `useT('shell')` still checks them —
+ * no `useTranslateKey` escape hatch is needed to render the menu.
+ */
+export type AccountLabelKey = 'account.profile' | 'account.security' | 'account.sessions';
+/** An account destination: a catalog key plus the path it lives at. */
+export interface AccountDestination {
+    /** Key in the `shell` namespace, resolved by whichever control renders it. */
+    readonly labelKey: AccountLabelKey;
+    /** Path within the host serving the account surface, with no locale prefix. */
+    readonly path: string;
+}
+/**
+ * Every account screen, in one list.
+ *
+ * The sidebar section and the account menu are the same three destinations and
+ * were drifting as two hand-kept lists; both build from this one now, so adding
+ * a screen is a one-line change here.
+ *
+ * It lives in the shared shell rather than in the auth shell because the menu
+ * is rendered by `BackOfficeShell`, which any host mounts — a `shell:base`
+ * package cannot reach up into a `shell:domain` one.
+ */
+export declare const ACCOUNT_DESTINATIONS: readonly AccountDestination[];
+export interface AccountLink {
+    readonly labelKey: AccountLabelKey;
+    readonly href: string;
+}
+/**
+ * Account links as locale-prefixed paths on the host that serves them.
+ *
+ * There is no absolute-URL variant any more. There used to be one, for the apps
+ * that linked across to auth-app on another port — the account surface and the
+ * back office share an origin now, so every one of these is an ordinary in-app
+ * navigation and a cross-origin builder would have no caller.
+ */
+export declare const accountPaths: (locale: Locale) => readonly AccountLink[];
+//# sourceMappingURL=account-links.d.ts.map

package/dist/lib/session/account-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-links.d.ts","sourceRoot":"","sources":["../../../src/lib/session/account-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACzB,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAE9D,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,kBAAkB,EAQ7D,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,SAAS,WAAW,EAI7D,CAAC"}

package/dist/lib/session/account-links.js

@@ -0,0 +1,41 @@
+/**
+ * Every account screen, in one list.
+ *
+ * The sidebar section and the account menu are the same three destinations and
+ * were drifting as two hand-kept lists; both build from this one now, so adding
+ * a screen is a one-line change here.
+ *
+ * It lives in the shared shell rather than in the auth shell because the menu
+ * is rendered by `BackOfficeShell`, which any host mounts — a `shell:base`
+ * package cannot reach up into a `shell:domain` one.
+ */ export const ACCOUNT_DESTINATIONS = [
+    {
+        labelKey: 'account.profile',
+        path: '/account'
+    },
+    // Not `/account/password` any more. r10c holds no password to change, so the
+    // screen behind this is a set of links into the provider's own self-service —
+    // which is also where a second factor is enrolled and a social account is
+    // linked, neither of which had anywhere to live before.
+    {
+        labelKey: 'account.security',
+        path: '/account/security'
+    },
+    {
+        labelKey: 'account.sessions',
+        path: '/account/sessions'
+    }
+];
+/**
+ * Account links as locale-prefixed paths on the host that serves them.
+ *
+ * There is no absolute-URL variant any more. There used to be one, for the apps
+ * that linked across to auth-app on another port — the account surface and the
+ * back office share an origin now, so every one of these is an ordinary in-app
+ * navigation and a cross-origin builder would have no caller.
+ */ export const accountPaths = (locale)=>ACCOUNT_DESTINATIONS.map((destination)=>({
+            labelKey: destination.labelKey,
+            href: `/${locale}${destination.path}`
+        }));
+
+//# sourceMappingURL=account-links.js.map

package/dist/lib/session/account-links.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/session/account-links.ts"],"sourcesContent":["import type { Locale } from '@entifix/core';\n\n/**\n * The catalog keys naming these destinations, in the `shell` namespace.\n *\n * They are keys of `shell` and not of `app` because this list is shell-owned:\n * the module that authors a string owns its catalog entry and resolves it. When\n * they lived under `app:auth.*`, every host app had to resolve a key belonging\n * to a *different* app's sub-tree just to render this menu.\n *\n * Typed as a union rather than `string` so `useT('shell')` still checks them —\n * no `useTranslateKey` escape hatch is needed to render the menu.\n */\nexport type AccountLabelKey =\n  'account.profile' | 'account.security' | 'account.sessions';\n\n/** An account destination: a catalog key plus the path it lives at. */\nexport interface AccountDestination {\n  /** Key in the `shell` namespace, resolved by whichever control renders it. */\n  readonly labelKey: AccountLabelKey;\n  /** Path within the host serving the account surface, with no locale prefix. */\n  readonly path: string;\n}\n\n/**\n * Every account screen, in one list.\n *\n * The sidebar section and the account menu are the same three destinations and\n * were drifting as two hand-kept lists; both build from this one now, so adding\n * a screen is a one-line change here.\n *\n * It lives in the shared shell rather than in the auth shell because the menu\n * is rendered by `BackOfficeShell`, which any host mounts — a `shell:base`\n * package cannot reach up into a `shell:domain` one.\n */\nexport const ACCOUNT_DESTINATIONS: readonly AccountDestination[] = [\n  { labelKey: 'account.profile', path: '/account' },\n  // Not `/account/password` any more. r10c holds no password to change, so the\n  // screen behind this is a set of links into the provider's own self-service —\n  // which is also where a second factor is enrolled and a social account is\n  // linked, neither of which had anywhere to live before.\n  { labelKey: 'account.security', path: '/account/security' },\n  { labelKey: 'account.sessions', path: '/account/sessions' },\n];\n\nexport interface AccountLink {\n  readonly labelKey: AccountLabelKey;\n  readonly href: string;\n}\n\n/**\n * Account links as locale-prefixed paths on the host that serves them.\n *\n * There is no absolute-URL variant any more. There used to be one, for the apps\n * that linked across to auth-app on another port — the account surface and the\n * back office share an origin now, so every one of these is an ordinary in-app\n * navigation and a cross-origin builder would have no caller.\n */\nexport const accountPaths = (locale: Locale): readonly AccountLink[] =>\n  ACCOUNT_DESTINATIONS.map(destination => ({\n    labelKey: destination.labelKey,\n    href: `/${locale}${destination.path}`,\n  }));\n"],"names":["ACCOUNT_DESTINATIONS","labelKey","path","accountPaths","locale","map","destination","href"],"mappings":"AAwBA;;;;;;;;;;CAUC,GACD,OAAO,MAAMA,uBAAsD;IACjE;QAAEC,UAAU;QAAmBC,MAAM;IAAW;IAChD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,wDAAwD;IACxD;QAAED,UAAU;QAAoBC,MAAM;IAAoB;IAC1D;QAAED,UAAU;QAAoBC,MAAM;IAAoB;CAC3D,CAAC;AAOF;;;;;;;CAOC,GACD,OAAO,MAAMC,eAAe,CAACC,SAC3BJ,qBAAqBK,GAAG,CAACC,CAAAA,cAAgB,CAAA;YACvCL,UAAUK,YAAYL,QAAQ;YAC9BM,MAAM,CAAC,CAAC,EAAEH,SAASE,YAAYJ,IAAI,EAAE;QACvC,CAAA,GAAI"}

package/dist/lib/session/bearer.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The caller's access token, or `undefined` when they hold no session.
+ *
+ * `entifix_at` is httpOnly, so only the server can read it — which is the whole
+ * reason a browser talks to a backend through this app's own origin rather than
+ * calling `:310N` directly.
+ */
+export declare const sessionToken: () => Promise<string | undefined>;
+/**
+ * The token as a forwardable header, and `{}` when there is none.
+ *
+ * The empty case is the point: a header of `Bearer undefined` is not "no
+ * credential", it is a malformed one, and a service that answers `401` to both
+ * hides the difference right up until one of them starts answering something
+ * else. Omitting the header lets the upstream apply its own rule for an
+ * anonymous caller — which for `catalog-reference` reads is to allow it.
+ *
+ * This lives on its own because three server surfaces carry the same cookie the
+ * same way — the per-backend proxy, the auth shell's hand-written handlers, and
+ * the record search fan-out — and none of them grants anything by doing so. They
+ * only carry; the service still verifies the token and applies its own
+ * `requirePermission`.
+ */
+export declare const bearerHeader: (token: string | undefined) => Record<string, string>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/lib/session/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../src/lib/session/bearer.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,MAAM,GAAG,SAAS,CACnB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,OAAO,MAAM,GAAG,SAAS,KACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CACyC,CAAC"}

package/dist/lib/session/bearer.js

@@ -0,0 +1,31 @@
+import { ACCESS_COOKIE } from '@entifix/core';
+import { cookies } from 'next/headers';
+/**
+ * The caller's access token, or `undefined` when they hold no session.
+ *
+ * `entifix_at` is httpOnly, so only the server can read it — which is the whole
+ * reason a browser talks to a backend through this app's own origin rather than
+ * calling `:310N` directly.
+ */ export const sessionToken = async ()=>{
+    var _get;
+    return (_get = (await cookies()).get(ACCESS_COOKIE)) == null ? void 0 : _get.value;
+};
+/**
+ * The token as a forwardable header, and `{}` when there is none.
+ *
+ * The empty case is the point: a header of `Bearer undefined` is not "no
+ * credential", it is a malformed one, and a service that answers `401` to both
+ * hides the difference right up until one of them starts answering something
+ * else. Omitting the header lets the upstream apply its own rule for an
+ * anonymous caller — which for `catalog-reference` reads is to allow it.
+ *
+ * This lives on its own because three server surfaces carry the same cookie the
+ * same way — the per-backend proxy, the auth shell's hand-written handlers, and
+ * the record search fan-out — and none of them grants anything by doing so. They
+ * only carry; the service still verifies the token and applies its own
+ * `requirePermission`.
+ */ export const bearerHeader = (token)=>token === undefined ? {} : {
+        Authorization: `Bearer ${token}`
+    };
+
+//# sourceMappingURL=bearer.js.map

package/dist/lib/session/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/session/bearer.ts"],"sourcesContent":["import { ACCESS_COOKIE } from '@entifix/core';\nimport { cookies } from 'next/headers';\n\n/**\n * The caller's access token, or `undefined` when they hold no session.\n *\n * `entifix_at` is httpOnly, so only the server can read it — which is the whole\n * reason a browser talks to a backend through this app's own origin rather than\n * calling `:310N` directly.\n */\nexport const sessionToken = async (): Promise<string | undefined> =>\n  (await cookies()).get(ACCESS_COOKIE)?.value;\n\n/**\n * The token as a forwardable header, and `{}` when there is none.\n *\n * The empty case is the point: a header of `Bearer undefined` is not \"no\n * credential\", it is a malformed one, and a service that answers `401` to both\n * hides the difference right up until one of them starts answering something\n * else. Omitting the header lets the upstream apply its own rule for an\n * anonymous caller — which for `catalog-reference` reads is to allow it.\n *\n * This lives on its own because three server surfaces carry the same cookie the\n * same way — the per-backend proxy, the auth shell's hand-written handlers, and\n * the record search fan-out — and none of them grants anything by doing so. They\n * only carry; the service still verifies the token and applies its own\n * `requirePermission`.\n */\nexport const bearerHeader = (\n  token: string | undefined,\n): Record<string, string> =>\n  token === undefined ? {} : { Authorization: `Bearer ${token}` };\n"],"names":["ACCESS_COOKIE","cookies","sessionToken","get","value","bearerHeader","token","undefined","Authorization"],"mappings":"AAAA,SAASA,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,OAAO,QAAQ,eAAe;AAEvC;;;;;;CAMC,GACD,OAAO,MAAMC,eAAe;QAC1B;YAAA,OAAA,AAAC,CAAA,MAAMD,SAAQ,EAAGE,GAAG,CAACH,mCAAtB,KAAsCI,KAAK;EAAC;AAE9C;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,eAAe,CAC1BC,QAEAA,UAAUC,YAAY,CAAC,IAAI;QAAEC,eAAe,CAAC,OAAO,EAAEF,OAAO;IAAC,EAAE"}

package/dist/lib/session/cookies.d.ts

@@ -0,0 +1,14 @@
+import type { NextResponse } from 'next/server';
+/** What auth-service hands back from login / register / refresh. */
+export interface SessionCookiePayload {
+    readonly accessToken: string;
+    /** Absent on a refresh: the session id does not change. */
+    readonly sessionId?: string;
+    /** Seconds until the session's absolute ceiling — both cookies are sized to it. */
+    readonly sessionExpiresIn: number;
+}
+/** Write the session cookies onto an outgoing response. */
+export declare const applySessionCookies: (response: NextResponse, payload: SessionCookiePayload) => NextResponse;
+/** Clear both cookies on an outgoing response (sign-out, dead session). */
+export declare const clearSessionCookies: (response: NextResponse) => NextResponse;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/lib/session/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/lib/session/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAqBD,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,GAC9B,UAAU,YAAY,EACtB,SAAS,oBAAoB,KAC5B,YAeF,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,GAAI,UAAU,YAAY,KAAG,YAI5D,CAAC"}

package/dist/lib/session/cookies.js

@@ -0,0 +1,33 @@
+import { ACCESS_COOKIE, SESSION_COOKIE } from '@entifix/core';
+/**
+ * Both cookies outlive the access token on purpose.
+ *
+ * Sizing `entifix_at` to the token's own 15 minutes is what used to sign everyone
+ * out four times an hour: once the cookie vanished, the middleware's presence
+ * check could no longer tell "your token needs refreshing" from "you were never
+ * signed in", and chose the second. The JWT's `exp` is the real authority on
+ * whether a token is usable; the cookie only has to survive long enough for the
+ * refresh path to notice.
+ */ const cookieOptions = (maxAge)=>({
+        httpOnly: true,
+        sameSite: 'lax',
+        // Host-scoped in dev (localhost shares cookies across ports); Secure in production.
+        secure: process.env.NODE_ENV === 'production',
+        path: '/',
+        maxAge
+    });
+/** Write the session cookies onto an outgoing response. */ export const applySessionCookies = (response, payload)=>{
+    const maxAge = payload.sessionExpiresIn;
+    response.cookies.set(ACCESS_COOKIE, payload.accessToken, cookieOptions(maxAge));
+    if (payload.sessionId !== undefined) {
+        response.cookies.set(SESSION_COOKIE, payload.sessionId, cookieOptions(maxAge));
+    }
+    return response;
+};
+/** Clear both cookies on an outgoing response (sign-out, dead session). */ export const clearSessionCookies = (response)=>{
+    response.cookies.delete(ACCESS_COOKIE);
+    response.cookies.delete(SESSION_COOKIE);
+    return response;
+};
+
+//# sourceMappingURL=cookies.js.map

package/dist/lib/session/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/session/cookies.ts"],"sourcesContent":["import { ACCESS_COOKIE, SESSION_COOKIE } from '@entifix/core';\nimport type { NextResponse } from 'next/server';\n\n/** What auth-service hands back from login / register / refresh. */\nexport interface SessionCookiePayload {\n  readonly accessToken: string;\n  /** Absent on a refresh: the session id does not change. */\n  readonly sessionId?: string;\n  /** Seconds until the session's absolute ceiling — both cookies are sized to it. */\n  readonly sessionExpiresIn: number;\n}\n\n/**\n * Both cookies outlive the access token on purpose.\n *\n * Sizing `entifix_at` to the token's own 15 minutes is what used to sign everyone\n * out four times an hour: once the cookie vanished, the middleware's presence\n * check could no longer tell \"your token needs refreshing\" from \"you were never\n * signed in\", and chose the second. The JWT's `exp` is the real authority on\n * whether a token is usable; the cookie only has to survive long enough for the\n * refresh path to notice.\n */\nconst cookieOptions = (maxAge: number) => ({\n  httpOnly: true,\n  sameSite: 'lax' as const,\n  // Host-scoped in dev (localhost shares cookies across ports); Secure in production.\n  secure: process.env.NODE_ENV === 'production',\n  path: '/',\n  maxAge,\n});\n\n/** Write the session cookies onto an outgoing response. */\nexport const applySessionCookies = (\n  response: NextResponse,\n  payload: SessionCookiePayload,\n): NextResponse => {\n  const maxAge = payload.sessionExpiresIn;\n  response.cookies.set(\n    ACCESS_COOKIE,\n    payload.accessToken,\n    cookieOptions(maxAge),\n  );\n  if (payload.sessionId !== undefined) {\n    response.cookies.set(\n      SESSION_COOKIE,\n      payload.sessionId,\n      cookieOptions(maxAge),\n    );\n  }\n  return response;\n};\n\n/** Clear both cookies on an outgoing response (sign-out, dead session). */\nexport const clearSessionCookies = (response: NextResponse): NextResponse => {\n  response.cookies.delete(ACCESS_COOKIE);\n  response.cookies.delete(SESSION_COOKIE);\n  return response;\n};\n"],"names":["ACCESS_COOKIE","SESSION_COOKIE","cookieOptions","maxAge","httpOnly","sameSite","secure","process","env","NODE_ENV","path","applySessionCookies","response","payload","sessionExpiresIn","cookies","set","accessToken","sessionId","undefined","clearSessionCookies","delete"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,gBAAgB;AAY9D;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,CAACC,SAAoB,CAAA;QACzCC,UAAU;QACVC,UAAU;QACV,oFAAoF;QACpFC,QAAQC,QAAQC,GAAG,CAACC,QAAQ,KAAK;QACjCC,MAAM;QACNP;IACF,CAAA;AAEA,yDAAyD,GACzD,OAAO,MAAMQ,sBAAsB,CACjCC,UACAC;IAEA,MAAMV,SAASU,QAAQC,gBAAgB;IACvCF,SAASG,OAAO,CAACC,GAAG,CAClBhB,eACAa,QAAQI,WAAW,EACnBf,cAAcC;IAEhB,IAAIU,QAAQK,SAAS,KAAKC,WAAW;QACnCP,SAASG,OAAO,CAACC,GAAG,CAClBf,gBACAY,QAAQK,SAAS,EACjBhB,cAAcC;IAElB;IACA,OAAOS;AACT,EAAE;AAEF,yEAAyE,GACzE,OAAO,MAAMQ,sBAAsB,CAACR;IAClCA,SAASG,OAAO,CAACM,MAAM,CAACrB;IACxBY,SAASG,OAAO,CAACM,MAAM,CAACpB;IACxB,OAAOW;AACT,EAAE"}

package/dist/lib/session/device.d.ts

@@ -0,0 +1,31 @@
+import type { DeviceContext } from '@entifix/business';
+import { type NextRequest, type NextResponse } from 'next/server';
+/**
+ * Reduce a client IP to its /24 (or the v6 prefix).
+ *
+ * Enough to notice "this sign-in came from somewhere else", without keeping a
+ * precise location against every session.
+ */
+export declare const truncateIp: (ip: string | undefined) => string | undefined;
+/**
+ * Read (or mint) the device context for a request.
+ *
+ * Parsing uses `userAgent()` from `next/server` — already bundled with Next, so
+ * no dependency is added, and notably not `ua-parser-js`, whose v2 is
+ * AGPL/dual-licensed.
+ *
+ * Returns `issued` when the id had to be minted, so the caller knows to write
+ * the cookie onto its response.
+ */
+export declare const readDeviceContext: (request: NextRequest) => {
+    device: DeviceContext;
+    issued: boolean;
+};
+/**
+ * Persist the device id.
+ *
+ * `httpOnly` because nothing in the browser needs to read it, and `lax` so it
+ * still arrives on the top-level navigation back from a sign-in.
+ */
+export declare const applyDeviceCookie: (response: NextResponse, deviceId: string) => NextResponse;
+//# sourceMappingURL=device.d.ts.map

package/dist/lib/session/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../src/lib/session/device.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAa,MAAM,aAAa,CAAC;AAmB7E;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAO5D,CAAC;AAcF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,WAAW,KACnB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAe1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,YAAY,EACtB,UAAU,MAAM,KACf,YASF,CAAC"}

package/dist/lib/session/device.js

@@ -0,0 +1,80 @@
+import { DEVICE_COOKIE } from '@entifix/core';
+import { userAgent } from 'next/server';
+/** Two years: long enough that a familiar browser stays familiar. */ const DID_MAX_AGE = 60 * 60 * 24 * 730;
+/**
+ * Mint an unguessable device id.
+ *
+ * `crypto.getRandomValues` rather than `node:crypto`, so this module also runs
+ * on the edge runtime.
+ */ const mintDeviceId = ()=>{
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+/**
+ * Reduce a client IP to its /24 (or the v6 prefix).
+ *
+ * Enough to notice "this sign-in came from somewhere else", without keeping a
+ * precise location against every session.
+ */ export const truncateIp = (ip)=>{
+    if (ip === undefined || ip === '') return undefined;
+    if (ip.includes(':')) {
+        return `${ip.split(':').slice(0, 4).join(':')}::`;
+    }
+    const octets = ip.split('.');
+    return octets.length === 4 ? `${octets.slice(0, 3).join('.')}.0` : undefined;
+};
+/**
+ * The client IP as the proxy reports it.
+ *
+ * `x-forwarded-for` is client-controlled unless a trusted proxy overwrites it,
+ * which is why the value is only ever a label — see {@link DeviceContext}.
+ */ const clientIp = (request)=>{
+    var _request_headers_get;
+    var _forwarded_split_;
+    const forwarded = request.headers.get('x-forwarded-for');
+    if (forwarded !== null) return (_forwarded_split_ = forwarded.split(',')[0]) == null ? void 0 : _forwarded_split_.trim();
+    return (_request_headers_get = request.headers.get('x-real-ip')) != null ? _request_headers_get : undefined;
+};
+/**
+ * Read (or mint) the device context for a request.
+ *
+ * Parsing uses `userAgent()` from `next/server` — already bundled with Next, so
+ * no dependency is added, and notably not `ua-parser-js`, whose v2 is
+ * AGPL/dual-licensed.
+ *
+ * Returns `issued` when the id had to be minted, so the caller knows to write
+ * the cookie onto its response.
+ */ export const readDeviceContext = (request)=>{
+    var _agent_device_type;
+    var _request_cookies_get;
+    const existing = (_request_cookies_get = request.cookies.get(DEVICE_COOKIE)) == null ? void 0 : _request_cookies_get.value;
+    const deviceId = existing != null ? existing : mintDeviceId();
+    const agent = userAgent(request);
+    return {
+        device: {
+            deviceId,
+            browser: agent.browser.name,
+            os: agent.os.name,
+            type: (_agent_device_type = agent.device.type) != null ? _agent_device_type : 'desktop',
+            ip: truncateIp(clientIp(request))
+        },
+        issued: existing === undefined
+    };
+};
+/**
+ * Persist the device id.
+ *
+ * `httpOnly` because nothing in the browser needs to read it, and `lax` so it
+ * still arrives on the top-level navigation back from a sign-in.
+ */ export const applyDeviceCookie = (response, deviceId)=>{
+    response.cookies.set(DEVICE_COOKIE, deviceId, {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env.NODE_ENV === 'production',
+        path: '/',
+        maxAge: DID_MAX_AGE
+    });
+    return response;
+};
+
+//# sourceMappingURL=device.js.map

package/dist/lib/session/device.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/session/device.ts"],"sourcesContent":["import type { DeviceContext } from '@entifix/business';\nimport { DEVICE_COOKIE } from '@entifix/core';\nimport { type NextRequest, type NextResponse, userAgent } from 'next/server';\n\n/** Two years: long enough that a familiar browser stays familiar. */\nconst DID_MAX_AGE = 60 * 60 * 24 * 730;\n\n/**\n * Mint an unguessable device id.\n *\n * `crypto.getRandomValues` rather than `node:crypto`, so this module also runs\n * on the edge runtime.\n */\nconst mintDeviceId = (): string => {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  return btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n};\n\n/**\n * Reduce a client IP to its /24 (or the v6 prefix).\n *\n * Enough to notice \"this sign-in came from somewhere else\", without keeping a\n * precise location against every session.\n */\nexport const truncateIp = (ip: string | undefined): string | undefined => {\n  if (ip === undefined || ip === '') return undefined;\n  if (ip.includes(':')) {\n    return `${ip.split(':').slice(0, 4).join(':')}::`;\n  }\n  const octets = ip.split('.');\n  return octets.length === 4 ? `${octets.slice(0, 3).join('.')}.0` : undefined;\n};\n\n/**\n * The client IP as the proxy reports it.\n *\n * `x-forwarded-for` is client-controlled unless a trusted proxy overwrites it,\n * which is why the value is only ever a label — see {@link DeviceContext}.\n */\nconst clientIp = (request: NextRequest): string | undefined => {\n  const forwarded = request.headers.get('x-forwarded-for');\n  if (forwarded !== null) return forwarded.split(',')[0]?.trim();\n  return request.headers.get('x-real-ip') ?? undefined;\n};\n\n/**\n * Read (or mint) the device context for a request.\n *\n * Parsing uses `userAgent()` from `next/server` — already bundled with Next, so\n * no dependency is added, and notably not `ua-parser-js`, whose v2 is\n * AGPL/dual-licensed.\n *\n * Returns `issued` when the id had to be minted, so the caller knows to write\n * the cookie onto its response.\n */\nexport const readDeviceContext = (\n  request: NextRequest,\n): { device: DeviceContext; issued: boolean } => {\n  const existing = request.cookies.get(DEVICE_COOKIE)?.value;\n  const deviceId = existing ?? mintDeviceId();\n  const agent = userAgent(request);\n\n  return {\n    device: {\n      deviceId,\n      browser: agent.browser.name,\n      os: agent.os.name,\n      type: agent.device.type ?? 'desktop',\n      ip: truncateIp(clientIp(request)),\n    },\n    issued: existing === undefined,\n  };\n};\n\n/**\n * Persist the device id.\n *\n * `httpOnly` because nothing in the browser needs to read it, and `lax` so it\n * still arrives on the top-level navigation back from a sign-in.\n */\nexport const applyDeviceCookie = (\n  response: NextResponse,\n  deviceId: string,\n): NextResponse => {\n  response.cookies.set(DEVICE_COOKIE, deviceId, {\n    httpOnly: true,\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    path: '/',\n    maxAge: DID_MAX_AGE,\n  });\n  return response;\n};\n"],"names":["DEVICE_COOKIE","userAgent","DID_MAX_AGE","mintDeviceId","bytes","crypto","getRandomValues","Uint8Array","btoa","String","fromCharCode","replace","truncateIp","ip","undefined","includes","split","slice","join","octets","length","clientIp","request","forwarded","headers","get","trim","readDeviceContext","agent","existing","cookies","value","deviceId","device","browser","name","os","type","issued","applyDeviceCookie","response","set","httpOnly","sameSite","secure","process","env","NODE_ENV","path","maxAge"],"mappings":"AACA,SAASA,aAAa,QAAQ,gBAAgB;AAC9C,SAA8CC,SAAS,QAAQ,cAAc;AAE7E,mEAAmE,GACnE,MAAMC,cAAc,KAAK,KAAK,KAAK;AAEnC;;;;;CAKC,GACD,MAAMC,eAAe;IACnB,MAAMC,QAAQC,OAAOC,eAAe,CAAC,IAAIC,WAAW;IACpD,OAAOC,KAAKC,OAAOC,YAAY,IAAIN,QAChCO,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO;AACpB;AAEA;;;;;CAKC,GACD,OAAO,MAAMC,aAAa,CAACC;IACzB,IAAIA,OAAOC,aAAaD,OAAO,IAAI,OAAOC;IAC1C,IAAID,GAAGE,QAAQ,CAAC,MAAM;QACpB,OAAO,GAAGF,GAAGG,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAG,GAAGC,IAAI,CAAC,KAAK,EAAE,CAAC;IACnD;IACA,MAAMC,SAASN,GAAGG,KAAK,CAAC;IACxB,OAAOG,OAAOC,MAAM,KAAK,IAAI,GAAGD,OAAOF,KAAK,CAAC,GAAG,GAAGC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAGJ;AACrE,EAAE;AAEF;;;;;CAKC,GACD,MAAMO,WAAW,CAACC;QAGTA;QADwBC;IAD/B,MAAMA,YAAYD,QAAQE,OAAO,CAACC,GAAG,CAAC;IACtC,IAAIF,cAAc,MAAM,QAAOA,oBAAAA,UAAUP,KAAK,CAAC,IAAI,CAAC,EAAE,qBAAvBO,kBAAyBG,IAAI;IAC5D,QAAOJ,uBAAAA,QAAQE,OAAO,CAACC,GAAG,CAAC,wBAApBH,uBAAoCR;AAC7C;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMa,oBAAoB,CAC/BL;QAWUM;QATON;IAAjB,MAAMO,YAAWP,uBAAAA,QAAQQ,OAAO,CAACL,GAAG,CAACzB,mCAApBsB,qBAAoCS,KAAK;IAC1D,MAAMC,WAAWH,mBAAAA,WAAY1B;IAC7B,MAAMyB,QAAQ3B,UAAUqB;IAExB,OAAO;QACLW,QAAQ;YACND;YACAE,SAASN,MAAMM,OAAO,CAACC,IAAI;YAC3BC,IAAIR,MAAMQ,EAAE,CAACD,IAAI;YACjBE,IAAI,GAAET,qBAAAA,MAAMK,MAAM,CAACI,IAAI,YAAjBT,qBAAqB;YAC3Bf,IAAID,WAAWS,SAASC;QAC1B;QACAgB,QAAQT,aAAaf;IACvB;AACF,EAAE;AAEF;;;;;CAKC,GACD,OAAO,MAAMyB,oBAAoB,CAC/BC,UACAR;IAEAQ,SAASV,OAAO,CAACW,GAAG,CAACzC,eAAegC,UAAU;QAC5CU,UAAU;QACVC,UAAU;QACVC,QAAQC,QAAQC,GAAG,CAACC,QAAQ,KAAK;QACjCC,MAAM;QACNC,QAAQ/C;IACV;IACA,OAAOsC;AACT,EAAE"}

package/dist/lib/session/index.d.ts

@@ -0,0 +1,3 @@
+export * from './session-keepalive.js';
+export * from './use-session-refresh.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/session/index.ts"],"names":[],"mappings":"AAQA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC"}

package/dist/lib/session/index.js

@@ -0,0 +1,12 @@
+// Client-safe session helpers only.
+//
+// The cookie writers, the refresh route handler AND the account-link builders
+// ship from `@entifix/next-shell/server` instead. The link builders are
+// pure functions, but everything reachable from this entry is stamped
+// `"use client"` by the bundler — so exporting them here turns a plain function
+// call in a server layout into "Attempted to call accountPaths() from the
+// server but accountPaths is on the client".
+export * from './session-keepalive.js';
+export * from './use-session-refresh.js';
+
+//# sourceMappingURL=index.js.map