@era-laboratories/era-sdk 0.1.0-next.32 → 0.1.0-next.45

package/dist/auth-D2XawwCn.d.ts

@@ -0,0 +1,489 @@
+//#region src/core/auth.d.ts
+/** PKCE mode — Authorization Code + PKCE against oauth.era.world. */
+interface EraAuthPkce {
+  /** Auth mode discriminant — always `'pkce'`. */
+  mode: 'pkce';
+  /** OAuth client id registered with the Era authorization server. */
+  clientId: string;
+  /** Redirect URI the authorization code is returned to; must match the registered client. */
+  redirectUri: string;
+  /** OAuth scopes to request; omit to use the client's default grant. */
+  scopes?: string[];
+  /**
+   * Pluggable token storage. Defaults to in-memory (per session).
+   *
+   * **Browser callers: do not use browser `localStorage` for refresh tokens.**
+   * Any XSS in the host page reads them, and a refresh token is a bearer
+   * credential. See {@link TokenStorage} and https://docs.era.world/docs/getting-started/authentication
+   * for the matrix (when in-memory is fine, when to wrap a server proxy,
+   * when to fall back to IndexedDB + WebCrypto).
+   */
+  tokenStorage?: TokenStorage;
+}
+/** API-key mode — Bearer era_sk_live_… / era_sk_test_… / era_pk_live_… */
+interface EraAuthApiKey {
+  /** Auth mode discriminant — always `'apiKey'`. */
+  mode: 'apiKey';
+  /** API key (`era_sk_live_…` / `era_sk_test_…` / `era_pk_live_…`) injected as a Bearer token. */
+  apiKey: string;
+  /**
+   * Suppress the one-shot "secret key in a browser" warning emitted when a
+   * browser-like environment is detected and the key starts with `era_sk_`.
+   *
+   * Default: `false`. Set to `true` only when you're sure the apparent
+   * browser globals are not actually a public web page — e.g. Electron
+   * renderer talking to a Node host that holds the secret, or a Tauri
+   * webview where the key is bundled into the native binary. **If a
+   * real user could open dev-tools and read `window.fetch.calls[0]`,
+   * leave this `false` and switch to a publishable key + server proxy
+   * instead.** See https://docs.era.world/docs/getting-started/authentication.
+   */
+  allowBrowserSecretKey?: boolean;
+}
+/**
+ * Auth configuration passed as `auth` to {@link createEraClient}. Discriminated
+ * on `mode`: use `'pkce'` ({@link EraAuthPkce}) for first-party apps that sign a
+ * user in and hold refreshable OAuth tokens, or `'apiKey'` ({@link EraAuthApiKey})
+ * for server-side integrations that authenticate with a static Era API key.
+ *
+ * @example
+ * ```ts
+ * // Server-side, static key:
+ * const era = createEraClient({ auth: { mode: 'apiKey', apiKey: process.env.ERA_KEY! } });
+ *
+ * // First-party app, signed-in user (tokens seeded via seedTokens):
+ * const era = createEraClient({
+ *   auth: { mode: 'pkce', clientId: 'client_0000000000', redirectUri, tokenStorage },
+ * });
+ * ```
+ */
+type EraAuthConfig = EraAuthPkce | EraAuthApiKey;
+/**
+ * Pluggable token storage. Defaults to in-memory (per session).
+ *
+ * **Security:** do not use browser `localStorage` for refresh tokens. Any
+ * XSS in the host page reads them, and a refresh token is a bearer
+ * credential — it needs the same protection level as a `Secure; HttpOnly`
+ * cookie. `sessionStorage` shares the same XSS surface and only "fixes"
+ * persistence; it is not safer.
+ *
+ * Recommended patterns by runtime:
+ *
+ *  - **Native / server / CLI:** keep the default `MemoryTokenStorage`
+ *  (per-process). Persisting across restarts is the OS keychain's job —
+ *  a small adapter can wrap that (Keychain, KWallet, libsecret, …).
+ *  - **Browser SPAs:** prefer a cookie-backed session via a server-side
+ *  proxy that exchanges the auth code on the user's behalf. If the SDK
+ *  must hold tokens client-side, wrap them with WebCrypto and persist
+ *  in IndexedDB; never `localStorage` / `sessionStorage`.
+ *
+ * See https://docs.era.world/docs/getting-started/authentication for the full matrix and a reference
+ * IndexedDB adapter.
+ */
+interface TokenStorage {
+  /**
+   * Read the value previously written under `key`. Resolve to `null` when the
+   * key is absent (never reject for a missing key). The SDK treats `null` as
+   * "no session" and, for PKCE, raises a `no_token` {@link EraAuthError}.
+   *
+   * @param key - Namespaced storage key the SDK owns (e.g. `era-sdk:tokens:<clientId>`).
+   * @returns The stored value, or `null` if nothing is stored under `key`.
+   */
+  get(key: string): Promise<string | null>;
+  /**
+   * Persist `value` under `key`, overwriting any existing value. The SDK
+   * calls this after every successful token refresh, and {@link seedTokens}
+   * calls it to prime storage after the initial code exchange.
+   *
+   * @param key - Namespaced storage key the SDK owns.
+   * @param value - Opaque serialized token bundle; treat as a bearer credential and do not log it.
+   */
+  set(key: string, value: string): Promise<void>;
+  /**
+   * Remove the value stored under `key`. The SDK calls this on logout
+   * ({@link AuthDispatcher.clear}) and when a refresh definitively fails
+   * (bad/revoked credential). Deleting an absent key must be a no-op, not a reject.
+   *
+   * @param key - Namespaced storage key the SDK owns.
+   */
+  delete(key: string): Promise<void>;
+}
+/**
+ * In-memory {@link TokenStorage} — the default when `tokenStorage` is not
+ * supplied on a PKCE auth config. Tokens live only for the lifetime of the
+ * process (or the browser tab): they are wiped on restart or reload, and are
+ * never written to disk or `localStorage`.
+ *
+ * Fine for Node, servers, CLIs, and tests. In a browser the SDK emits a
+ * one-shot console warning when this default is detected, because sign-in
+ * won't survive a reload — supply your own {@link TokenStorage} over a store
+ * that persists **without** being XSS-readable (do not use `localStorage`).
+ * See {@link https://docs.era.world/docs/getting-started/authentication}.
+ *
+ * @example
+ * ```ts
+ * const storage = new MemoryTokenStorage();
+ * await seedTokens(storage, 'client_0000000000', tokens);
+ * const era = createEraClient({ auth: { mode: 'pkce', clientId: 'client_0000000000', redirectUri, tokenStorage: storage } });
+ * ```
+ */
+declare class MemoryTokenStorage implements TokenStorage {
+  private readonly store;
+  /** {@inheritDoc TokenStorage.get} */
+  get(key: string): Promise<string | null>;
+  /** {@inheritDoc TokenStorage.set} */
+  set(key: string, value: string): Promise<void>;
+  /** {@inheritDoc TokenStorage.delete} */
+  delete(key: string): Promise<void>;
+}
+/**
+ * Machine-readable {@link EraAuthError.code} value. Branch on it (instead of
+ * parsing `.message`) to decide how to recover from an auth failure:
+ *
+ * - `auth_failed` — the token endpoint rejected the request. From a token
+ *   refresh this is definitive (HTTP 400/401): the credential is bad, re-run
+ *   the sign-in flow. From {@link exchangeCodeForToken} it is thrown for any
+ *   HTTP error status — check {@link EraAuthError.transient} (`true` for 5xx,
+ *   where retrying the exchange may succeed) before discarding the flow.
+ * - `refresh_failed` — a token refresh failed transiently (5xx, network error,
+ *   or a non-credential 4xx) after exhausting retries. Retrying the request
+ *   later may succeed.
+ * - `no_token` — no tokens are stored (initial PKCE sign-in required), no
+ *   refresh token is available, or the stored tokens were cleared mid-refresh.
+ * - `pkce_invalid` — the runtime lacks Web Crypto (`globalThis.crypto.subtle`);
+ *   PKCE helpers need Node 18+, a modern browser, or an edge runtime.
+ * - `invalid_config` — the auth config is malformed: a bad API-key shape, a
+ *   `state` shorter than 16 chars, or `seedTokens` called without an access token.
+ */
+type EraAuthErrorCode = 'auth_failed' | 'refresh_failed' | 'no_token' | 'pkce_invalid' | 'invalid_config';
+/**
+ * Constructor payload for {@link EraAuthError}. You normally **catch**
+ * `EraAuthError` rather than construct one; this shape is exported so custom
+ * `TokenStorage` adapters or auth wrappers can raise SDK-consistent errors.
+ */
+interface EraAuthErrorInit {
+  /** Machine-readable auth error code driving retry/re-auth decisions. */
+  code: EraAuthErrorCode;
+  /** Human-readable, body-free error message safe to log. */
+  message: string;
+  /** true → caller may retry; false → caller must re-auth. */
+  transient: boolean;
+  /** Underlying error that triggered this one, when available. */
+  cause?: unknown;
+  /**
+   * HTTP status from the token endpoint, when the error came from one
+   * (4xx/5xx response). Lets callers branch on the status without
+   * regex-parsing `.message`.
+   */
+  status?: number;
+  /**
+   * OAuth-level error code parsed from the response body's `error` field
+   * (`invalid_grant`, `invalid_client`, `server_error`, `invalid_request`,
+   * …). Used by the refresh path to decide whether to purge stored
+   * tokens — only `invalid_grant` and `invalid_client` mean the
+   * credential itself is bad.
+   */
+  oauthErrorCode?: string;
+  /**
+   * Raw response body from the token endpoint. Attached non-enumerably so
+   * it never appears in `JSON.stringify(err)` or default `console.error`
+   * output — authorization-server error bodies can carry `client_id`,
+   * fragments of the supplied `code`, or `refresh_token`, and those must not
+   * land in third-party log stores via `error.message`.
+   * See {@link EraAuthError.responseBody}.
+   */
+  responseBody?: string;
+}
+/**
+ * Auth-related error. `code` and `transient` drive retry/re-auth decisions.
+ *
+ * **Security:** `.message` is a fixed status-keyed string (no response body
+ * interpolation) so it can be safely logged or shipped to error aggregators
+ * like Sentry/Datadog. The raw token-endpoint response body, when one is
+ * available, is exposed as the **non-enumerable** {@link EraAuthError.responseBody}
+ * field — accessible by name for debugging, invisible to `JSON.stringify`,
+ * `Object.keys`, and default `console.error` formatting. Do not log it
+ * unfiltered.
+ */
+declare class EraAuthError extends Error {
+  /**
+   * Machine-readable failure category; see {@link EraAuthErrorCode} for the
+   * recovery each value calls for.
+   */
+  readonly code: EraAuthErrorCode;
+  /**
+   * `true` when retrying later may succeed (network error, 5xx); `false`
+   * when the failure is definitive and the user must re-authenticate (or the
+   * config must be fixed).
+   */
+  readonly transient: boolean;
+  /**
+   * HTTP status from the token endpoint (4xx/5xx). Only token-refresh
+   * failures carry it; errors from {@link exchangeCodeForToken} and non-HTTP
+   * failures leave it `undefined`.
+   */
+  readonly status?: number;
+  /**
+   * OAuth error code parsed from the token-endpoint response body's `error`
+   * field (`invalid_grant`, `invalid_client`, `server_error`, …). Only
+   * token-refresh failures with a JSON-parseable body populate it; non-JSON
+   * bodies, non-HTTP failures, and errors from {@link exchangeCodeForToken}
+   * leave it `undefined`.
+   */
+  readonly oauthErrorCode?: string;
+  /**
+   * Raw response body from the token endpoint, when available. Defined
+   * non-enumerable — accessible by name (`err.responseBody`) but absent
+   * from `JSON.stringify(err)` and `Object.keys(err)`. May contain
+   * sensitive data (tokens, code fragments, client_id) — do not log
+   * unfiltered.
+   *
+   * `declare` here is intentional: TypeScript with
+   * `useDefineForClassFields` would otherwise emit an enumerable
+   * `responseBody: undefined` slot on every instance, defeating the
+   * non-enumerable invariant. The constructor is the only thing that
+   * defines the property — via `Object.defineProperty` when present.
+   */
+  readonly responseBody?: string;
+  /**
+   * @param init - Error fields; see {@link EraAuthErrorInit}. `responseBody`,
+   * when present, is attached non-enumerably so it stays out of
+   * `JSON.stringify` / `console.error` output.
+   */
+  constructor(init: EraAuthErrorInit);
+}
+/**
+ * Token pair returned by the OAuth token endpoint. Produced by
+ * {@link exchangeCodeForToken} (initial sign-in) and consumed by
+ * {@link seedTokens} to prime a PKCE client's storage. Field names are the
+ * raw OAuth 2.0 wire names (RFC 6749 §5.1).
+ */
+interface TokenResponse {
+  /** OAuth access token (Bearer credential for API calls). */
+  access_token: string;
+  /** OAuth refresh token; absent when the grant doesn't issue one. */
+  refresh_token?: string;
+  /** Access-token lifetime in seconds from issuance. */
+  expires_in: number;
+  /** Token type returned by the issuer (typically `Bearer`). */
+  token_type?: string;
+  /** Space-delimited scopes actually granted, when echoed back. */
+  scope?: string;
+}
+/**
+ * Options for {@link buildAuthorizationUrl} — the fields needed to construct
+ * the `/oauth2/auth` redirect URL that starts the PKCE sign-in flow.
+ */
+interface AuthorizationUrlOpts {
+  /** OAuth issuer base URL the `/oauth2/auth` URL is built against. */
+  hubUrl: string;
+  /** OAuth client id to request authorization for. */
+  clientId: string;
+  /** Redirect URI the authorization code is returned to. */
+  redirectUri: string;
+  /** PKCE S256 code challenge (BASE64URL(SHA-256(verifier))). */
+  codeChallenge: string;
+  /** OAuth CSRF nonce; must be at least 16 chars (use `generateOauthState()`). */
+  state: string;
+  /** OAuth scopes to request; omit to use the client's default grant. */
+  scopes?: string[];
+}
+/**
+ * Options for {@link exchangeCodeForToken} — the fields needed to redeem an
+ * authorization `code` (plus its PKCE verifier) for a {@link TokenResponse} at
+ * the callback step of the PKCE flow.
+ */
+interface TokenExchangeOpts {
+  /** OAuth issuer base URL the `/oauth2/token` request is POSTed to. */
+  hubUrl: string;
+  /** OAuth client id the authorization code was issued for. */
+  clientId: string;
+  /** Authorization code returned to the redirect URI. */
+  code: string;
+  /** PKCE code verifier matching the challenge sent in the auth request. */
+  codeVerifier: string;
+  /** Redirect URI that received the code; must match the auth request. */
+  redirectUri: string;
+  /**
+   * Custom `fetch` for the token request. Defaults to the global `fetch`.
+   * Supply the same implementation you pass as `EraConfig.fetch` (proxy,
+   * egress control, request auditing) so sign-in traffic isn't a hole in
+   * that boundary. This helper runs before a client exists, so — unlike the
+   * refresh path — it can't pick up `EraConfig.fetch` automatically.
+   */
+  fetch?: typeof globalThis.fetch;
+}
+/**
+ * Returns a 43-char base64url-safe PKCE verifier (32 random bytes).
+ * Uses `globalThis.crypto.getRandomValues` (Node 18+, browser, edge runtime).
+ * Generate one per sign-in attempt, keep it until the callback, and pass it
+ * to {@link exchangeCodeForToken} as `codeVerifier`.
+ *
+ * @returns A 43-character base64url string.
+ * @throws {EraAuthError} `pkce_invalid` when Web Crypto is unavailable
+ * (requires Node 18+, a modern browser, or an edge runtime).
+ */
+declare function generatePkceVerifier(): string;
+/**
+ * Returns a 43-char base64url-safe OAuth `state` value (32 random bytes,
+ * mirrors {@link generatePkceVerifier}). `state` is OAuth's CSRF defence:
+ * generate one before redirecting to `/oauth2/auth`, persist it next to the
+ * PKCE verifier (sessionStorage is acceptable — `state` is not a secret,
+ * only an unguessable nonce), and on the callback assert that the `state`
+ * query param matches what you stored. A mismatch means the callback was
+ * triggered by an attacker-controlled flow; reject without exchanging the
+ * code. See https://docs.era.world/docs/getting-started/authentication.
+ *
+ * @returns A 43-character base64url string.
+ * @throws {EraAuthError} `pkce_invalid` when Web Crypto is unavailable
+ * (requires Node 18+, a modern browser, or an edge runtime).
+ */
+declare function generateOauthState(): string;
+/**
+ * Returns BASE64URL(SHA-256(verifier)) — the RFC 7636 S256 code challenge to
+ * send in {@link buildAuthorizationUrl}.
+ *
+ * @param verifier - The PKCE verifier from {@link generatePkceVerifier}.
+ * @returns The base64url-encoded SHA-256 challenge.
+ * @throws {EraAuthError} `pkce_invalid` when Web Crypto is unavailable
+ * (requires Node 18+, a modern browser, or an edge runtime).
+ */
+declare function generatePkceChallenge(verifier: string): Promise<string>;
+/**
+ * Build the `/oauth2/auth` authorization URL that starts the PKCE sign-in
+ * flow. Redirect the user's browser to the returned URL; the authorization
+ * code comes back on `redirectUri`, ready for {@link exchangeCodeForToken}.
+ * The `code_challenge_method` is always S256 (plain challenges are not
+ * supported).
+ *
+ * @param opts - Client id, redirect URI, S256 code challenge, and CSRF
+ * `state`; see {@link AuthorizationUrlOpts}.
+ * @returns The absolute `${hubUrl}/oauth2/auth?…` URL to redirect the user to.
+ * @throws {EraAuthError} `invalid_config` when `opts.state` is not a string of
+ * at least 16 characters — short states defeat OAuth's CSRF protection; mint
+ * one with {@link generateOauthState}.
+ * @example
+ * ```ts
+ * const verifier = generatePkceVerifier();
+ * const state = generateOauthState();
+ * const url = buildAuthorizationUrl({
+ *   hubUrl: 'https://oauth.era.world',
+ *   clientId: 'client_0000000000',
+ *   redirectUri: 'https://example.com/callback',
+ *   codeChallenge: await generatePkceChallenge(verifier),
+ *   state,
+ * });
+ * ```
+ */
+declare function buildAuthorizationUrl(opts: AuthorizationUrlOpts): string;
+/**
+ * Exchange an authorization code (+ PKCE verifier) for a {@link TokenResponse}.
+ * POSTs `grant_type=authorization_code` to `${hubUrl}/oauth2/token`. Call it
+ * from your redirect-URI handler, then hand the result to {@link seedTokens}
+ * so the client can authenticate.
+ *
+ * @param opts - Code, verifier, client id, redirect URI, and issuer URL; see
+ * {@link TokenExchangeOpts}.
+ * @returns The token pair issued by the OAuth server.
+ * @throws {EraAuthError} `auth_failed` when the token endpoint responds with
+ * any error status. `transient` is `true` for 5xx (retrying the exchange may
+ * succeed) and `false` for 4xx (wrong/expired code, verifier mismatch, or bad
+ * client). The raw body is exposed only on the non-enumerable `responseBody`,
+ * never in `.message`.
+ * @example
+ * ```ts
+ * const tokens = await exchangeCodeForToken({
+ *   hubUrl: 'https://oauth.era.world',
+ *   clientId: 'client_0000000000',
+ *   code: callbackParams.get('code')!,
+ *   codeVerifier,
+ *   redirectUri: 'https://example.com/callback',
+ * });
+ * ```
+ */
+declare function exchangeCodeForToken(opts: TokenExchangeOpts): Promise<TokenResponse>;
+/**
+ * Auth dispatcher. Returns headers to inject on every request.
+ * For PKCE: refreshes proactively near expiry, coalescing concurrent refreshes
+ * and retrying transient failures with backoff.
+ * For apiKey: static Bearer header, no refresh.
+ */
+interface AuthDispatcher {
+  /** Which auth mode this dispatcher implements; matches the config's `mode`. */
+  readonly mode: 'pkce' | 'apiKey';
+  /**
+   * Returns auth headers to inject (`Authorization: Bearer …`). In PKCE mode
+   * this refreshes first when the access token is near expiry, and throws
+   * {@link EraAuthError} when no session exists (`no_token`) or the refresh
+   * fails (`auth_failed` / `refresh_failed`). apiKey mode never throws.
+   */
+  getAuthHeaders(): Promise<Record<string, string>>;
+  /** Force a token refresh (PKCE only). No-op for apiKey. */
+  refresh(): Promise<void>;
+  /** Returns the access token if available, else null. */
+  getAccessToken(): Promise<string | null>;
+  /** Clear stored tokens (logout). For apiKey, no-op (apiKey is config, not state). */
+  clear(): Promise<void>;
+}
+/**
+ * Build the {@link AuthDispatcher} for an {@link EraAuthConfig}. `createEraClient`
+ * calls this internally; call it directly only when you need the header-injection
+ * / refresh machinery outside a full client (e.g. a custom transport).
+ *
+ * Returns an api-key dispatcher (static Bearer, no refresh) when
+ * `config.mode === 'apiKey'`, otherwise a PKCE dispatcher that reads tokens from
+ * storage, refreshes proactively near expiry, and coalesces concurrent refreshes.
+ *
+ * @param config - The auth mode and credentials; see {@link EraAuthConfig}.
+ * @param options - Transport overrides. `oauthUrl` is the OAuth issuer host for
+ * PKCE refresh (defaults to `https://oauth.era.world`); `fetch` is the fetch
+ * implementation used for the refresh call (defaults to `globalThis.fetch`).
+ * `hubUrl` is accepted for symmetry but not used by the dispatcher.
+ * @returns An {@link AuthDispatcher} matching `config.mode`.
+ * @throws {EraAuthError} `invalid_config` when an api-key config carries a key
+ * that does not match `era_(sk|pk)_(live|test)_<token>`.
+ * @example
+ * ```ts
+ * const dispatcher = createAuthDispatcher({ mode: 'apiKey', apiKey: 'era_sk_test_0000000000' });
+ * const headers = await dispatcher.getAuthHeaders();
+ * ```
+ */
+declare function createAuthDispatcher(config: EraAuthConfig, options?: {
+  hubUrl?: string;
+  oauthUrl?: string;
+  fetch?: typeof globalThis.fetch;
+}): AuthDispatcher;
+/**
+ * Seed a PKCE client's token storage with the result of
+ * {@link exchangeCodeForToken}.
+ *
+ * This is the bridge between the OAuth callback and a working client. After you
+ * exchange the `code`, call `seedTokens` with the **same** `tokenStorage` and
+ * `clientId` you pass to `createEraClient({ auth: { mode: 'pkce', … } })`. The
+ * client then authenticates immediately and refreshes the session on its own.
+ *
+ * ⚠️ A refresh token is a bearer credential. In browsers, back `tokenStorage`
+ * with a store that is NOT XSS-readable — never plain `localStorage`. See
+ * https://docs.era.world/docs/getting-started/authentication.
+ *
+ * @param storage - The same {@link TokenStorage} instance the client will use.
+ * @param clientId - The OAuth client id; must match the client's `auth.clientId`
+ * (tokens are stored under a key namespaced by it).
+ * @param tokens - The {@link TokenResponse} from {@link exchangeCodeForToken}.
+ * If `refresh_token` is absent, the session works until the access token
+ * expires and cannot be refreshed.
+ * @throws {EraAuthError} `invalid_config` if `tokens.access_token` is missing.
+ * @example
+ * ```ts
+ * const tokens = await exchangeCodeForToken({ … });
+ * const storage = new MemoryTokenStorage(); // or your adapter
+ * await seedTokens(storage, CLIENT_ID, tokens);
+ * const era = createEraClient({
+ *  auth: { mode: 'pkce', clientId: CLIENT_ID, redirectUri, tokenStorage: storage },
+ * });
+ * ```
+ */
+declare function seedTokens(storage: TokenStorage, clientId: string, tokens: TokenResponse): Promise<void>;
+//#endregion
+export { generatePkceChallenge as _, EraAuthError as a, EraAuthPkce as c, TokenResponse as d, TokenStorage as f, generateOauthState as g, exchangeCodeForToken as h, EraAuthConfig as i, MemoryTokenStorage as l, createAuthDispatcher as m, AuthorizationUrlOpts as n, EraAuthErrorCode as o, buildAuthorizationUrl as p, EraAuthApiKey as r, EraAuthErrorInit as s, AuthDispatcher as t, TokenExchangeOpts as u, generatePkceVerifier as v, seedTokens as y };
+//# sourceMappingURL=auth-D2XawwCn.d.ts.map

package/dist/auth-D2XawwCn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-D2XawwCn.d.ts","names":[],"sources":["../src/core/auth.ts"],"mappings":";;UAeiB;;EAEhB;;EAEA;;EAEA;;EAEA;;;;;;;;;;EAUA,eAAe;;;UAIC;;EAEhB;;EAEA;;;;;;;;;;;;;EAaA;;;;;;;;;;;;;;;;;;;KAoBW,gBAAgB,cAAc;;;;;;;;;;;;;;;;;;;;;;;UA0BzB;;;;;;;;;EAShB,IAAI,cAAc;;;;;;;;;EASlB,IAAI,aAAa,gBAAgB;;;;;;;;EAQjC,OAAO,cAAc;;;;;;;;;;;;;;;;;;;;;cAsBT,8BAA8B;mBACzB;;EAGjB,IAAI,cAAc;;EAKlB,IAAI,aAAa,gBAAgB;;EAMjC,OAAO,cAAc;;;;;;;;;;;;;;;;;;;;;KA2BV;;;;;;UAYK;;EAEhB,MAAM;;EAEN;;EAEA;;EAEA;;;;;;EAMA;;;;;;;;EAQA;;;;;;;;;EASA;;;;;;;;;;;;;cAcY,qBAAqB;;;;;WAKjB,MAAM;;;;;;WAMN;;;;;;WAMA;;;;;;;;WAQA;;;;;;;;;;;;;;WAcQ;;;;;;cAOZ,MAAM;;;;;;;;UAuCF;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;UAOgB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;UAQgB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;EAQA,eAAe,WAAW;;;;;;;;;;;;iBAwCX;;;;;;;;;;;;;;;iBAoBA;;;;;;;;;;iBAkBM,sBAAsB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC/C,sBAAsB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDtB,qBACrB,MAAM,oBACJ,QAAQ;;;;;;;UAqCM;;WAEP;;;;;;;EAOT,kBAAkB,QAAQ;;EAE1B,WAAW;;EAEX,kBAAkB;;EAElB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BM,qBACf,QAAQ,eACR;EACC;EACA;EACA,eAAe,WAAW;IAEzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkZmB,WACrB,SAAS,cACT,kBACA,QAAQ,gBACN"}

package/dist/casing-_Mn2NyTK.d.ts

@@ -0,0 +1,24 @@
+//#region src/core/casing.d.ts
+/** `foo_bar_baz` → `fooBarBaz` at the type level. */
+type SnakeToCamel<S extends string> = S extends `${infer Head}_${infer Tail}` ? `${Head}${Capitalize<SnakeToCamel<Tail>>}` : S;
+/**
+ * Rename every snake_case key of `T` to camelCase, preserving optionality,
+ * readonly-ness, and value types. Homomorphic — applying it to a generated
+ * component yields the SDK's camelCase view of the exact same wire shape.
+ */
+type CamelizeKeys<T> = { [K in keyof T as K extends string ? SnakeToCamel<K> : K]: T[K]; };
+/**
+ * Make the keys `K` of `T` required. Used for generated frame types whose
+ * discriminator is `type?: 'x'` (the emitter always stamps it; the schema
+ * marks it optional-with-default) — the SDK narrows it to required.
+ */
+type WithRequired<T, K extends keyof T> = T & Required<Pick<T, K>>;
+/**
+ * Pick the keys `K` of `T`, made required and with `null`/`undefined`
+ * stripped from their value types. Used where the SDK guarantees presence at
+ * runtime (e.g. it throws before constructing the object when absent).
+ */
+type PickNonNullable<T, K extends keyof T> = { [P in K]-?: NonNullable<T[P]>; };
+//#endregion
+export { PickNonNullable as n, WithRequired as r, CamelizeKeys as t };
+//# sourceMappingURL=casing-_Mn2NyTK.d.ts.map

package/dist/casing-_Mn2NyTK.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"casing-_Mn2NyTK.d.ts","names":[],"sources":["../src/core/casing.ts"],"mappings":";;KAaY,aAAa,oBACxB,mBAAmB,cAAc,YAC3B,OAAO,WAAW,aAAa,WAClC;;;;;;KAOQ,aAAa,QACvB,WAAW,KAAK,mBAAmB,aAAa,KAAK,IAAI,EAAE;;;;;;KAQjD,aAAa,GAAG,gBAAgB,KAAK,IAAI,SAAS,KAAK,GAAG;;;;;;KAO1D,gBAAgB,GAAG,gBAAgB,QAC7C,KAAK,MAAM,YAAY,EAAE"}