@grantforge/client 0.0.0-stage → 2026.0.0

package/dist/auth.d.ts

@@ -0,0 +1,67 @@
+/** How a browser application signs its users in through GrantForge. */
+export interface AuthOptions {
+    /** GrantForge's address, the issuer of its tokens, such as https://grantforge.example.com. */
+    issuer: string;
+    /** The application's public client ID, registered in GrantForge's resource catalog. */
+    clientId: string;
+    /** Where GrantForge sends users back to; one of the client's redirect URIs. */
+    redirectUri: string;
+    /** The scopes to ask for; openid and permissions by default. */
+    scope?: string;
+    /** Where tokens and pending sign-ins are kept; the session storage by default, so they end with the tab. */
+    storage?: Storage;
+    /** The fetch to call GrantForge with. */
+    fetch?: typeof fetch;
+    /** Navigates the browser; location.assign by default. */
+    navigate?: (url: string) => void;
+    /** The current time in milliseconds. */
+    now?: () => number;
+}
+/** The tokens of the signed-in user. */
+export interface Tokens {
+    accessToken: string;
+    refreshToken: string | null;
+    idToken: string | null;
+    /** When the access token expires, in milliseconds. */
+    expiresAt: number;
+}
+/**
+ * Signs users in through GrantForge with the authorization code flow and PKCE, as a public client, and keeps their tokens
+ * fresh. Refresh tokens rotate on every use and GrantForge revokes everything when a replaced one comes back, so one
+ * refresh runs at a time however many calls need a token.
+ */
+export declare class GrantForgeAuth {
+    private readonly options;
+    private readonly scope;
+    private readonly storage;
+    private readonly fetcher;
+    private readonly navigate;
+    private readonly now;
+    private endpoints;
+    private refreshing;
+    constructor(options: AuthOptions);
+    /** Sends the browser to GrantForge to sign in; it comes back to the redirect URI, where handleRedirect takes over. */
+    login(returnTo?: string | null): Promise<void>;
+    /**
+     * Finishes a sign-in at the redirect URI: exchanges the code for tokens and checks the ID token's nonce.
+     *
+     * @returns where the user was when login was called, if given
+     */
+    handleRedirect(url?: string): Promise<{
+        returnTo: string | null;
+    }>;
+    /** Returns a valid access token, refreshing it when it is about to expire; null if the user must sign in again. */
+    accessToken(): Promise<string | null>;
+    /** Returns whether a user is signed in in this browser. */
+    get signedIn(): boolean;
+    /** Returns the claims of the ID token: sub, preferred_username, name, email, tid. */
+    user(): Record<string, unknown> | null;
+    /** Forgets the user's tokens in this browser and asks GrantForge to revoke the refresh token. */
+    logout(): Promise<void>;
+    /** Forgets the tokens without telling GrantForge, as when it refused them. */
+    forget(): void;
+    private refresh;
+    private tokenRequest;
+    private stored;
+    private discovered;
+}

package/dist/auth.js

@@ -0,0 +1,168 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+import { discover } from './discovery.js';
+import { errorOf, GrantForgeError } from './errors.js';
+import { challengeOf, claimsOf, randomToken } from './pkce.js';
+const TOKENS = 'grantforge.tokens';
+const PENDING = 'grantforge.pending.';
+/** Access tokens are renewed this long before they expire, so calls do not race their expiry. */
+const EARLY = 30_000;
+/**
+ * Signs users in through GrantForge with the authorization code flow and PKCE, as a public client, and keeps their tokens
+ * fresh. Refresh tokens rotate on every use and GrantForge revokes everything when a replaced one comes back, so one
+ * refresh runs at a time however many calls need a token.
+ */
+export class GrantForgeAuth {
+    options;
+    scope;
+    storage;
+    fetcher;
+    navigate;
+    now;
+    endpoints = null;
+    refreshing = null;
+    constructor(options) {
+        this.options = options;
+        this.scope = options.scope ?? 'openid permissions';
+        this.storage = options.storage ?? sessionStorage;
+        this.fetcher = options.fetch ?? ((input, init) => fetch(input, init));
+        this.navigate = options.navigate ?? (url => window.location.assign(url));
+        this.now = options.now ?? (() => Date.now());
+    }
+    /** Sends the browser to GrantForge to sign in; it comes back to the redirect URI, where handleRedirect takes over. */
+    async login(returnTo = null) {
+        const endpoints = await this.discovered();
+        const state = randomToken(), verifier = randomToken(), nonce = randomToken();
+        this.storage.setItem(PENDING + state, JSON.stringify({ verifier, nonce, returnTo }));
+        const query = new URLSearchParams({ response_type: 'code', client_id: this.options.clientId, redirect_uri: this.options.redirectUri,
+            scope: this.scope, state, nonce, code_challenge: await challengeOf(verifier), code_challenge_method: 'S256' });
+        this.navigate(`${endpoints.authorization}?${query}`);
+    }
+    /**
+     * Finishes a sign-in at the redirect URI: exchanges the code for tokens and checks the ID token's nonce.
+     *
+     * @returns where the user was when login was called, if given
+     */
+    async handleRedirect(url = window.location.href) {
+        const params = new URL(url).searchParams;
+        const error = params.get('error');
+        if (error)
+            throw new GrantForgeError(error === 'access_denied' ? 'forbidden' : 'invalid', `GrantForge refused the sign-in: ${error}`);
+        const code = params.get('code'), state = params.get('state');
+        const stored = state ? this.storage.getItem(PENDING + state) : null;
+        if (!code || !state || !stored)
+            throw new GrantForgeError('invalid', 'No sign-in of this browser waits for this answer');
+        this.storage.removeItem(PENDING + state);
+        const pending = JSON.parse(stored);
+        const tokens = await this.tokenRequest({ grant_type: 'authorization_code', code, redirect_uri: this.options.redirectUri,
+            code_verifier: pending.verifier });
+        if (tokens.idToken && claimsOf(tokens.idToken).nonce !== pending.nonce) {
+            this.storage.removeItem(TOKENS);
+            throw new GrantForgeError('invalid', 'The ID token does not answer this sign-in');
+        }
+        return { returnTo: pending.returnTo };
+    }
+    /** Returns a valid access token, refreshing it when it is about to expire; null if the user must sign in again. */
+    async accessToken() {
+        const tokens = this.stored();
+        if (!tokens)
+            return null;
+        if (tokens.expiresAt - EARLY > this.now())
+            return tokens.accessToken;
+        if (!tokens.refreshToken)
+            return null;
+        const refreshed = await this.refresh(tokens.refreshToken);
+        return refreshed?.accessToken ?? null;
+    }
+    /** Returns whether a user is signed in in this browser. */
+    get signedIn() {
+        return this.stored() !== null;
+    }
+    /** Returns the claims of the ID token: sub, preferred_username, name, email, tid. */
+    user() {
+        const idToken = this.stored()?.idToken;
+        return idToken ? claimsOf(idToken) : null;
+    }
+    /** Forgets the user's tokens in this browser and asks GrantForge to revoke the refresh token. */
+    async logout() {
+        const tokens = this.stored();
+        this.storage.removeItem(TOKENS);
+        if (!tokens?.refreshToken)
+            return;
+        try {
+            const endpoints = await this.discovered();
+            if (endpoints.revocation) {
+                await this.fetcher(endpoints.revocation, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    body: new URLSearchParams({ token: tokens.refreshToken, token_type_hint: 'refresh_token', client_id: this.options.clientId }) });
+            }
+        }
+        catch {
+            // Signing out locally does not wait on GrantForge; the token expires anyway.
+        }
+    }
+    /** Forgets the tokens without telling GrantForge, as when it refused them. */
+    forget() {
+        this.storage.removeItem(TOKENS);
+    }
+    refresh(refreshToken) {
+        this.refreshing ??= this.tokenRequest({ grant_type: 'refresh_token', refresh_token: refreshToken })
+            .then(tokens => tokens)
+            .catch(failure => {
+            // A refused refresh token will not work again: the user signs in anew.
+            if (failure instanceof GrantForgeError && failure.reason !== 'unavailable') {
+                this.storage.removeItem(TOKENS);
+                return null;
+            }
+            throw failure;
+        })
+            .finally(() => { this.refreshing = null; });
+        return this.refreshing;
+    }
+    async tokenRequest(form) {
+        const endpoints = await this.discovered();
+        let response;
+        try {
+            response = await this.fetcher(endpoints.token, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({ ...form, client_id: this.options.clientId }) });
+        }
+        catch (failure) {
+            throw new GrantForgeError('unavailable', `GrantForge did not answer: ${String(failure)}`);
+        }
+        if (!response.ok) {
+            // OAuth answers refused grants with 400 invalid_grant: the user must sign in again.
+            throw errorOf(response.status === 400 ? new Response(null, { status: 401 }) : response, 'The token endpoint');
+        }
+        const answer = await response.json();
+        if (typeof answer.access_token !== 'string')
+            throw new GrantForgeError('unavailable', 'The token endpoint answered without a token');
+        const previous = this.stored();
+        const tokens = {
+            accessToken: answer.access_token,
+            refreshToken: typeof answer.refresh_token === 'string' ? answer.refresh_token : previous?.refreshToken ?? null,
+            idToken: typeof answer.id_token === 'string' ? answer.id_token : previous?.idToken ?? null,
+            expiresAt: this.now() + (typeof answer.expires_in === 'number' ? answer.expires_in : 300) * 1000,
+        };
+        this.storage.setItem(TOKENS, JSON.stringify(tokens));
+        return tokens;
+    }
+    stored() {
+        const stored = this.storage.getItem(TOKENS);
+        if (!stored)
+            return null;
+        try {
+            return JSON.parse(stored);
+        }
+        catch {
+            return null;
+        }
+    }
+    discovered() {
+        this.endpoints ??= discover(this.options.issuer, this.fetcher).catch(failure => {
+            this.endpoints = null;
+            throw failure;
+        });
+        return this.endpoints;
+    }
+}

package/dist/client.d.ts

@@ -0,0 +1,47 @@
+/** What the signed-in user may do in this application, as GrantForge answers it. */
+export interface UserAuthorization {
+    application: string;
+    accountId: string;
+    tenantId: string;
+    username: string;
+    version: number;
+    roles: string[];
+    resources: string[];
+    permissions: string[];
+    computedAt: string;
+}
+/** How the application asks GrantForge about its users. */
+export interface ClientOptions {
+    /** GrantForge's address. */
+    baseUrl: string;
+    /** Returns the user's access token, such as GrantForgeAuth.accessToken; null when nobody is signed in. */
+    accessToken: () => Promise<string | null>;
+    /** How long an answer is used before it is revalidated with its ETag, in milliseconds; 30 seconds by default. */
+    ttl?: number;
+    /** The fetch to call GrantForge with. */
+    fetch?: typeof fetch;
+    /** The current time in milliseconds. */
+    now?: () => number;
+}
+/**
+ * Asks GrantForge's open API what the signed-in user may do. The answer is kept for the TTL, then revalidated with
+ * If-None-Match, which costs GrantForge a 304 while nothing changed.
+ */
+export declare class GrantForgeClient {
+    private readonly options;
+    private readonly ttl;
+    private readonly fetcher;
+    private readonly now;
+    private kept;
+    private pending;
+    constructor(options: ClientOptions);
+    /** Returns what the user may do; throws a GrantForgeError when nobody is signed in or GrantForge refuses. */
+    authorization(): Promise<UserAuthorization>;
+    /** Returns whether the user may call an API of this application. */
+    can(permission: string): Promise<boolean>;
+    /** Returns whether the user may use a resource of this application, such as a page or a button. */
+    hasResource(resource: string): Promise<boolean>;
+    /** Forgets the kept answer, as when the user signs out or another user signs in. */
+    forget(): void;
+    private load;
+}

package/dist/client.js

@@ -0,0 +1,72 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+import { errorOf, GrantForgeError } from './errors.js';
+/**
+ * Asks GrantForge's open API what the signed-in user may do. The answer is kept for the TTL, then revalidated with
+ * If-None-Match, which costs GrantForge a 304 while nothing changed.
+ */
+export class GrantForgeClient {
+    options;
+    ttl;
+    fetcher;
+    now;
+    kept = null;
+    pending = null;
+    constructor(options) {
+        this.options = options;
+        this.ttl = options.ttl ?? 30_000;
+        this.fetcher = options.fetch ?? ((input, init) => fetch(input, init));
+        this.now = options.now ?? (() => Date.now());
+    }
+    /** Returns what the user may do; throws a GrantForgeError when nobody is signed in or GrantForge refuses. */
+    authorization() {
+        this.pending ??= this.load().finally(() => { this.pending = null; });
+        return this.pending;
+    }
+    /** Returns whether the user may call an API of this application. */
+    async can(permission) {
+        return (await this.authorization()).permissions.includes(permission);
+    }
+    /** Returns whether the user may use a resource of this application, such as a page or a button. */
+    async hasResource(resource) {
+        return (await this.authorization()).resources.includes(resource);
+    }
+    /** Forgets the kept answer, as when the user signs out or another user signs in. */
+    forget() {
+        this.kept = null;
+    }
+    async load() {
+        const token = await this.options.accessToken();
+        if (!token) {
+            this.kept = null;
+            throw new GrantForgeError('unauthenticated', 'Nobody is signed in');
+        }
+        const kept = this.kept?.token === token ? this.kept : null;
+        if (kept && kept.checkedAt + this.ttl > this.now())
+            return kept.answer;
+        const headers = { Authorization: `Bearer ${token}`, Accept: 'application/json' };
+        if (kept)
+            headers['If-None-Match'] = kept.etag;
+        let response;
+        try {
+            response = await this.fetcher(`${this.options.baseUrl.replace(/\/+$/, '')}/api/v1/open/me/authorization`, { headers });
+        }
+        catch (failure) {
+            throw new GrantForgeError('unavailable', `GrantForge did not answer: ${String(failure)}`);
+        }
+        if (response.status === 304 && kept) {
+            this.kept = { ...kept, checkedAt: this.now() };
+            return kept.answer;
+        }
+        if (!response.ok) {
+            if (response.status === 401 || response.status === 403)
+                this.kept = null;
+            throw errorOf(response, 'The open API');
+        }
+        const answer = await response.json();
+        this.kept = { token, answer, etag: response.headers.get('ETag') ?? `"${answer.version}"`, checkedAt: this.now() };
+        return answer;
+    }
+}

package/dist/discovery.d.ts

@@ -0,0 +1,11 @@
+/** The endpoints of GrantForge's authorization server, from its OpenID Connect discovery document. */
+export interface Endpoints {
+    issuer: string;
+    authorization: string;
+    token: string;
+    revocation: string | null;
+    userInfo: string | null;
+    endSession: string | null;
+}
+/** Reads the discovery document of an issuer. */
+export declare function discover(issuer: string, fetcher?: typeof fetch): Promise<Endpoints>;

package/dist/discovery.js

@@ -0,0 +1,25 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+import { errorOf, GrantForgeError } from './errors.js';
+/** Reads the discovery document of an issuer. */
+export async function discover(issuer, fetcher = fetch) {
+    const base = issuer.replace(/\/+$/, '');
+    let response;
+    try {
+        response = await fetcher(`${base}/.well-known/openid-configuration`, { headers: { Accept: 'application/json' } });
+    }
+    catch (failure) {
+        throw new GrantForgeError('unavailable', `GrantForge at ${base} did not answer: ${String(failure)}`);
+    }
+    if (!response.ok)
+        throw errorOf(response, 'The discovery document');
+    const document = await response.json();
+    const text = (name) => typeof document[name] === 'string' ? document[name] : null;
+    const authorization = text('authorization_endpoint'), token = text('token_endpoint');
+    if (!authorization || !token)
+        throw new GrantForgeError('unavailable', 'The discovery document lacks the authorization or token endpoint');
+    return { issuer: text('issuer') ?? base, authorization, token, revocation: text('revocation_endpoint'), userInfo: text('userinfo_endpoint'),
+        endSession: text('end_session_endpoint') };
+}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+/** Why GrantForge could not, or would not, answer. */
+export type GrantForgeReason = 'unauthenticated' | 'forbidden' | 'unavailable' | 'invalid';
+/** A refusal or failure of GrantForge, with the HTTP status when there was one. */
+export declare class GrantForgeError extends Error {
+    readonly reason: GrantForgeReason;
+    readonly status: number;
+    constructor(reason: GrantForgeReason, message: string, status?: number);
+}
+/** Turns an unsuccessful response into an error: 401 needs a new sign-in, 403 a permission, anything else waits. */
+export declare function errorOf(response: Response, what: string): GrantForgeError;

package/dist/errors.js

@@ -0,0 +1,21 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+/** A refusal or failure of GrantForge, with the HTTP status when there was one. */
+export class GrantForgeError extends Error {
+    reason;
+    status;
+    constructor(reason, message, status = 0) {
+        super(message);
+        this.reason = reason;
+        this.status = status;
+        this.name = 'GrantForgeError';
+    }
+}
+/** Turns an unsuccessful response into an error: 401 needs a new sign-in, 403 a permission, anything else waits. */
+export function errorOf(response, what) {
+    const reason = response.status === 401 ? 'unauthenticated' : response.status === 403 ? 'forbidden'
+        : response.status === 400 ? 'invalid' : 'unavailable';
+    return new GrantForgeError(reason, `${what} answered ${response.status}`, response.status);
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { GrantForgeAuth, type AuthOptions, type Tokens } from './auth.js';
+export { GrantForgeClient, type ClientOptions, type UserAuthorization } from './client.js';
+export { discover, type Endpoints } from './discovery.js';
+export { GrantForgeError, type GrantForgeReason } from './errors.js';

package/dist/index.js

@@ -0,0 +1,8 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+export { GrantForgeAuth } from './auth.js';
+export { GrantForgeClient } from './client.js';
+export { discover } from './discovery.js';
+export { GrantForgeError } from './errors.js';

package/dist/pkce.d.ts

@@ -0,0 +1,8 @@
+/** Random URL-safe text of 32 bytes, for PKCE verifiers, states and nonces. */
+export declare function randomToken(): string;
+/** The S256 challenge of a PKCE verifier. */
+export declare function challengeOf(verifier: string): Promise<string>;
+/** Base64url without padding, as OAuth uses it. */
+export declare function base64Url(bytes: Uint8Array): string;
+/** The claims of a JWT, read without checking its signature: the token came from GrantForge over TLS. */
+export declare function claimsOf(jwt: string): Record<string, unknown>;

package/dist/pkce.js

@@ -0,0 +1,33 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+/** Random URL-safe text of 32 bytes, for PKCE verifiers, states and nonces. */
+export function randomToken() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64Url(bytes);
+}
+/** The S256 challenge of a PKCE verifier. */
+export async function challengeOf(verifier) {
+    // Verifiers are ASCII (RFC 7636); bytes of this realm, as some environments mix realms of typed arrays.
+    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(verifier, character => character.charCodeAt(0)));
+    return base64Url(new Uint8Array(digest));
+}
+/** Base64url without padding, as OAuth uses it. */
+export function base64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** The claims of a JWT, read without checking its signature: the token came from GrantForge over TLS. */
+export function claimsOf(jwt) {
+    const payload = jwt.split('.')[1];
+    if (!payload)
+        throw new Error('not a JWT');
+    const padded = payload.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(payload.length / 4) * 4, '=');
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
+}

package/dist/vue.d.ts

@@ -0,0 +1,27 @@
+import { type App, type ShallowRef } from 'vue';
+import type { GrantForgeClient, UserAuthorization } from './client.js';
+import { GrantForgeError } from './errors.js';
+/** The signed-in user's permissions, reactive. */
+export interface GrantForgeState {
+    /** What the user may do, or null before it is known and when nobody is signed in. */
+    authorization: ShallowRef<UserAuthorization | null>;
+    /** Why the last attempt to know failed, or null. */
+    error: ShallowRef<GrantForgeError | null>;
+    /** Asks GrantForge again, as after signing in or out. */
+    refresh: () => Promise<void>;
+    /** Returns whether the user may call an API; false until known. */
+    can: (permission: string) => boolean;
+    /** Returns whether the user may use a resource, such as a button; false until known. */
+    hasResource: (resource: string) => boolean;
+}
+/**
+ * The Vue plugin: provides the user's permissions (useGrantForge) and the directives v-permission and v-resource, which
+ * hide an element unless the user holds all the codes given (a code or a list of codes); with the .disable modifier they
+ * disable it instead. Hiding is a convenience: the application's APIs must check permissions too.
+ */
+export declare function createGrantForge(client: GrantForgeClient): {
+    state: GrantForgeState;
+    install(app: App): void;
+};
+/** Returns the user's permissions inside components of an application with the plugin installed. */
+export declare function useGrantForge(): GrantForgeState;

package/dist/vue.js

@@ -0,0 +1,83 @@
+// Copyright (c) 2026 devlive-community/grantforge
+//
+// Licensed under the MIT License. See the LICENSE file in the
+// project root for full license text.
+import { inject, shallowRef, watchEffect } from 'vue';
+import { GrantForgeError } from './errors.js';
+const KEY = Symbol('grantforge');
+const HIDDEN = Symbol('grantforge.display');
+const STOP = Symbol('grantforge.stop');
+/**
+ * The Vue plugin: provides the user's permissions (useGrantForge) and the directives v-permission and v-resource, which
+ * hide an element unless the user holds all the codes given (a code or a list of codes); with the .disable modifier they
+ * disable it instead. Hiding is a convenience: the application's APIs must check permissions too.
+ */
+export function createGrantForge(client) {
+    const authorization = shallowRef(null);
+    const error = shallowRef(null);
+    const state = {
+        authorization,
+        error,
+        async refresh() {
+            try {
+                authorization.value = await client.authorization();
+                error.value = null;
+            }
+            catch (failure) {
+                authorization.value = null;
+                error.value = failure instanceof GrantForgeError ? failure : new GrantForgeError('unavailable', String(failure));
+            }
+        },
+        can: permission => authorization.value?.permissions.includes(permission) ?? false,
+        hasResource: resource => authorization.value?.resources.includes(resource) ?? false,
+    };
+    return {
+        state,
+        install(app) {
+            app.provide(KEY, state);
+            app.directive('permission', guard(codes => codes.every(state.can)));
+            app.directive('resource', guard(codes => codes.every(state.hasResource)));
+            void state.refresh();
+        },
+    };
+}
+/** Returns the user's permissions inside components of an application with the plugin installed. */
+export function useGrantForge() {
+    const state = inject(KEY, null);
+    if (!state)
+        throw new Error('useGrantForge needs the plugin of createGrantForge installed');
+    return state;
+}
+function guard(allowed) {
+    return {
+        mounted(element, binding) {
+            const target = element;
+            target[HIDDEN] = target.style.display;
+            target[STOP] = watchEffect(() => apply(target, allowed(codesOf(binding.value)), binding.modifiers.disable === true));
+        },
+        updated(element, binding) {
+            const target = element;
+            target[STOP]?.();
+            target[STOP] = watchEffect(() => apply(target, allowed(codesOf(binding.value)), binding.modifiers.disable === true));
+        },
+        unmounted(element) {
+            element[STOP]?.();
+        },
+    };
+}
+function apply(element, allowed, disable) {
+    if (disable) {
+        if (allowed)
+            element.removeAttribute('disabled');
+        else
+            element.setAttribute('disabled', '');
+        element.setAttribute('aria-disabled', String(!allowed));
+        return;
+    }
+    element.style.display = allowed ? element[HIDDEN] ?? '' : 'none';
+}
+function codesOf(value) {
+    if (value === undefined)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@grantforge/client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2026.0.0",
+  "description": "Sign users in through GrantForge with PKCE and ask what they may do, with a Vue plugin and directives.",
+  "license": "MIT",
+  "type": "module",
+  "packageManager": "pnpm@8.10.2",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./vue": {
+      "types": "./dist/vue.d.ts",
+      "default": "./dist/vue.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings 0",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "vue": "^3.5.0"
+  },
+  "peerDependenciesMeta": {
+    "vue": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.0",
+    "@vue/test-utils": "2.5.1",
+    "eslint": "10.11.0",
+    "globals": "^17.0.0",
+    "jsdom": "^29.0.0",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.71.0",
+    "vitest": "5.0.2",
+    "vue": "3.5.43"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.