@hansenexus/hud 0.3.0 → 0.4.0

package/dist/next.d.ts

@@ -1,21 +1,6 @@
-import { n as HudMountProps } from "./define-hud-BHQR8Lbv.js";
+import { n as HudMountProps } from "./define-hud-BBzsSl8b.js";
+import { n as hudEnvLabel, r as resolveHudEnv, t as HudEnv } from "./env-vEjyJfPW.js";
 import { ComponentType } from "react";
-//#region src/next/env.d.ts
-/**
- * Where the HUD believes it runs. An explicit `NEXT_PUBLIC_HUD_ENV` wins over
- * heuristics because k3s deploys have no `VERCEL_ENV`.
- */
-type HudEnv = "development" | "preview" | "staging" | "production" | "disabled";
-/**
- * Env ladder: kill switch → `NODE_ENV` (inlined by Next, so production
- * bundles fold the development branch) → `NEXT_PUBLIC_HUD_ENV` (k8s overlays)
- * → `VERCEL_ENV` → production.
- *
- * Each read is a literal `process.env.X` so Next can inline it in client code.
- */
-export declare function resolveHudEnv(): HudEnv;
-export declare function hudEnvLabel(env?: HudEnv): string;
-//#endregion
 //#region src/next/loader.d.ts
 type HudModuleLoader = () => Promise<{
   default: ComponentType<HudMountProps>;
@@ -45,4 +30,4 @@ type HudModuleLoader = () => Promise<{
  */
 export declare function createHudLoader(load: HudModuleLoader | null): ComponentType<HudMountProps>;
 //#endregion
-export type { HudEnv, HudModuleLoader, HudMountProps };
+export { type HudEnv, type HudModuleLoader, type HudMountProps, hudEnvLabel, resolveHudEnv };

package/dist/next.js

@@ -1,32 +1,6 @@
+import { n as resolveHudEnv, t as hudEnvLabel } from "./env-DfxpPfs9.js";
 import { Suspense, lazy, useEffect, useState } from "react";
 import { jsx } from "react/jsx-runtime";
-//#region src/next/env.ts
-/**
-* Env ladder: kill switch → `NODE_ENV` (inlined by Next, so production
-* bundles fold the development branch) → `NEXT_PUBLIC_HUD_ENV` (k8s overlays)
-* → `VERCEL_ENV` → production.
-*
-* Each read is a literal `process.env.X` so Next can inline it in client code.
-*/
-function resolveHudEnv() {
-	if (process.env.NEXT_PUBLIC_HUD_DISABLED === "true") return "disabled";
-	if (process.env.NODE_ENV === "development") return "development";
-	const explicit = process.env.NEXT_PUBLIC_HUD_ENV;
-	if (explicit === "staging" || explicit === "preview" || explicit === "production") return explicit;
-	if (process.env.VERCEL_ENV === "preview") return "preview";
-	return "production";
-}
-const LABELS = {
-	development: "DEV",
-	preview: "PREVIEW",
-	staging: "STAGING",
-	production: "PROD",
-	disabled: "OFF"
-};
-function hudEnvLabel(env = resolveHudEnv()) {
-	return LABELS[env];
-}
-//#endregion
 //#region src/next/loader.tsx
 /**
 * Mounts the app's `defineHud` module, lazily and client side only.
@@ -64,7 +38,8 @@ function createHudLoader(load) {
 			fallback: null,
 			children: /* @__PURE__ */ jsx(LazyHud, {
 				envLabel: hudEnvLabel(env),
-				...props
+				...props,
+				env
 			})
 		});
 	}

package/dist/payload-CLKDVZWl.d.ts

@@ -0,0 +1,68 @@
+//#region src/core/grabber/inspect.d.ts
+/**
+ * Which React component rendered a DOM element, read from the fiber React
+ * attaches to it in development. Best effort by design: fibers are React
+ * internals, so every field is probed rather than trusted, and a page that is
+ * not React (or a production build) simply yields `null`.
+ */
+interface GrabComponent {
+  /** Nearest named component above the element, e.g. `HeroCta`. */
+  name: string;
+  /** Named components further up, nearest first, at most five. */
+  owners: string[];
+  /**
+   * Where the element's JSX was written, e.g. `src/site.tsx:12:5`. A hint, not
+   * a resolution: the file is reliable, the line is the position in the
+   * dev server's transformed module and can sit a few lines below the original.
+   */
+  source?: string;
+}
+//#endregion
+//#region src/core/grabber/payload.d.ts
+/** Box in viewport percentages, measured at grab time. */
+interface GrabRect {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+interface GrabAnchor {
+  /** `nth-of-type` path from `<body>`. */
+  selector: string;
+  /** Human label, e.g. `button “Termin buchen”`. */
+  label: string;
+  tag: string;
+  /**
+   * Viewport-relative, so correct only for a grab that is acted on at once.
+   * Anything that persists a position (review pins) needs document-relative
+   * coordinates instead.
+   */
+  rect: GrabRect;
+}
+/** One entry of an app's component manifest: a name and the file it lives in. */
+interface ComponentHint {
+  name: string;
+  path: string;
+}
+/** What a completed grab hands to plugins (`onGrab`, `ctx.grab`). */
+interface GrabPayload {
+  app: string;
+  url: string;
+  route: string;
+  anchor: GrabAnchor;
+  /** The React component that rendered the element, when the page is React in development. */
+  component: GrabComponent | null;
+  viewport: {
+    width: number;
+    height: number;
+  };
+  grabbedAt: string;
+}
+/**
+ * Scores manifest entries against the route and anchor label. Pure token
+ * overlap: a hint for the agent, not a resolution. Ported from the old HUD's
+ * `grabber/payload.ts`.
+ */
+declare function matchComponentHints(hints: readonly ComponentHint[] | undefined, route: string, label: string, max?: number): ComponentHint[];
+//#endregion
+export { GrabComponent as a, matchComponentHints as i, GrabAnchor as n, GrabPayload as r, ComponentHint as t };

package/dist/plugins/access/server.d.ts

@@ -0,0 +1,122 @@
+import { r as HudCapability } from "../../plugins-CQ_0w1ot.js";
+import { t as HudEnv } from "../../env-vEjyJfPW.js";
+import { a as signHudUnlockToken, c as CAPABILITY_MATRIX, d as hasCapability, f as isHudVisible, i as resolveHudAccess, l as CapabilityMatrixOverride, n as HudAccess, o as verifyHudUnlockToken, r as hudRequiresUnlock, s as ACCESS_UNLOCK_CAPABILITY, t as HUD_UNLOCK_COOKIE, u as HUD_CAPABILITIES } from "../../access-CNvJOwKM.js";
+import { t as HudGuard } from "../../handler-WmE4Lu7l.js";
+//#region src/plugins/access/server/settings.d.ts
+/** What the server half reads from its environment, per request. */
+interface AccessSettings {
+  env: HudEnv;
+  /** `NEXT_PUBLIC_HUD_ENABLED=true`: the deployed tier opted in. */
+  enabled: boolean;
+  /** `HUD_ACCESS_PASSWORD`. Server only: never pass it to client code. */
+  password: string | undefined;
+  /**
+   * `HUD_ACCESS_SECRET`: optional, server only. When set, the unlock cookie is
+   * signed with it instead of the password, so a stolen cookie gives nothing
+   * to guess the password against.
+   */
+  secret?: string | undefined;
+}
+interface AccessServerOptions {
+  /** Path `createHudHandler` is mounted at, for the guard's unlock exemption. Default `/api/hud`. */
+  basePath?: string;
+  /** Replaces the default matrix's list for a deployed tier. Keep it equal to the client half's. */
+  matrix?: CapabilityMatrixOverride;
+  /** Default: `readAccessSettings`, i.e. `process.env`. A seam for tests and the playground. */
+  settings?: () => AccessSettings;
+}
+/**
+ * Reads the env ladder, the opt-in flag and the secrets, at call time.
+ * `HUD_DISABLED=true` is a runtime kill switch: unlike the `NEXT_PUBLIC_*`
+ * flags, which are inlined at build time, it takes effect on a restart
+ * without a rebuild, and turns every route into a 404.
+ */
+export declare function readAccessSettings(): AccessSettings;
+//#endregion
+//#region src/plugins/access/server/guard.d.ts
+interface HudGuardRequest {
+  headers: {
+    get(name: string): string | null;
+  };
+}
+type HudGuardResult = {
+  ok: true;
+  env: HudEnv;
+} | {
+  ok: false;
+  status: 401 | 403 | 404;
+  error: string;
+};
+/**
+ * Whether this request may exercise `capability` right now.
+ *
+ * Order matters: a HUD that is not enabled answers 404 (nothing here), a
+ * denied capability answers 403 before any password is considered (the
+ * password must never be a way to widen the matrix), and only a permitted
+ * capability gets as far as the unlock check. A route without a capability
+ * is development-only: default-deny means undeclared is denied.
+ */
+export declare function checkHudRequest(request: HudGuardRequest, capability: HudCapability | undefined, options?: AccessServerOptions): Promise<HudGuardResult>;
+/** Whether the request already carries a valid unlock (the status route). */
+export declare function isHudRequestUnlocked(request: HudGuardRequest, options?: AccessServerOptions): Promise<boolean>;
+//#endregion
+//#region src/plugins/access/server/unlock.d.ts
+interface HudUnlockRequest extends HudGuardRequest {
+  json(): Promise<unknown>;
+}
+interface HudUnlockResult {
+  status: number;
+  body: Record<string, unknown>;
+  /** `Set-Cookie` value, when the attempt changed the unlock state. */
+  setCookie?: string;
+}
+/**
+ * GET: what the client needs to decide between the panels and the lock, and
+ * nothing more. The route is reachable while locked, so it names no tier.
+ */
+export declare function handleHudUnlockStatus(request: HudGuardRequest, options?: AccessServerOptions): Promise<HudUnlockResult>;
+/** POST: exchanges the password for a signed, expiring unlock cookie. */
+export declare function handleHudUnlockAttempt(request: HudUnlockRequest, options?: AccessServerOptions): Promise<HudUnlockResult>;
+/** Test seam: the attempt budget is process state, not request state. */
+export declare function resetHudUnlockAttempts(): void;
+/** Test seam: how many clients the attempt budget tracks. */
+export declare function trackedHudUnlockClients(): number;
+//#endregion
+//#region src/plugins/access/server.d.ts
+/**
+ * The guard for `createHudHandler({ guard })` on deployed tiers. It answers
+ * exactly like the old `checkHudRequest`: 404 while the tier has not opted in,
+ * 403 for a capability the tier's matrix denies (before any password is
+ * considered), 401 until the request carries a valid unlock cookie. In
+ * development it lets everything through, like `developmentOnly`.
+ *
+ * The unlock route itself is the one exemption, so a locked HUD can unlock.
+ * Pass the handler's `basePath` when it is not `/api/hud`.
+ */
+export declare function accessGuard(options?: AccessServerOptions): HudGuard;
+/**
+ * Server half of the access plugin: `GET|POST <basePath>/access/unlock`.
+ * GET reports `{ unlocked, configured }`; POST trades `{ password }` for an
+ * httpOnly cookie. Wrong passwords are budgeted: ten per client per ten
+ * minutes, and past a hundred overall every client with failures of its own
+ * is throttled; a throttled client gets 429 even for the right password.
+ *
+ * ```ts
+ * const options = {};
+ * export const { GET, POST } = createHudHandler([accessServer(options), ...], {
+ *   guard: accessGuard(options),
+ * });
+ * ```
+ */
+export declare function accessServer(options?: AccessServerOptions): {
+  readonly id: "access";
+  readonly capability: "access.unlock";
+  readonly routes: {
+    readonly "/unlock": {
+      readonly GET: (request: Request) => Promise<Response>;
+      readonly POST: (request: Request) => Promise<Response>;
+    };
+  };
+};
+//#endregion
+export { ACCESS_UNLOCK_CAPABILITY, type AccessServerOptions, type AccessSettings, CAPABILITY_MATRIX, type CapabilityMatrixOverride, HUD_CAPABILITIES, HUD_UNLOCK_COOKIE, type HudAccess, type HudGuardResult, hasCapability, hudRequiresUnlock, isHudVisible, resolveHudAccess, signHudUnlockToken, verifyHudUnlockToken };

package/dist/plugins/access/server.js

@@ -0,0 +1,339 @@
+import { i as definePlugin } from "../../plugins-DVy_vaYr.js";
+import { n as resolveHudEnv } from "../../env-DfxpPfs9.js";
+import { a as isHudVisible, c as HUD_UNLOCK_COOKIE, d as hudUnlockTtlMs, f as readCookie, g as verifyHudUnlockToken, h as timingSafeEqual, i as hasCapability, l as hudRequiresUnlock, m as signHudUnlockToken, n as CAPABILITY_MATRIX, o as resolveMatrix, p as resolveHudAccess, r as HUD_CAPABILITIES, t as ACCESS_UNLOCK_CAPABILITY, u as hudUnlockCookieString } from "../../capabilities-CjulXFQX.js";
+//#region src/plugins/access/server/settings.ts
+/** The key material unlock cookies are signed with. */
+function signingSecret({ secret, password }) {
+	return secret || password;
+}
+/**
+* Reads the env ladder, the opt-in flag and the secrets, at call time.
+* `HUD_DISABLED=true` is a runtime kill switch: unlike the `NEXT_PUBLIC_*`
+* flags, which are inlined at build time, it takes effect on a restart
+* without a rebuild, and turns every route into a 404.
+*/
+function readAccessSettings() {
+	return {
+		env: process.env.HUD_DISABLED === "true" ? "disabled" : resolveHudEnv(),
+		enabled: process.env.NEXT_PUBLIC_HUD_ENABLED === "true",
+		password: process.env.HUD_ACCESS_PASSWORD || void 0,
+		secret: process.env.HUD_ACCESS_SECRET || void 0
+	};
+}
+//#endregion
+//#region src/plugins/access/server/guard.ts
+/**
+* Whether this request may exercise `capability` right now.
+*
+* Order matters: a HUD that is not enabled answers 404 (nothing here), a
+* denied capability answers 403 before any password is considered (the
+* password must never be a way to widen the matrix), and only a permitted
+* capability gets as far as the unlock check. A route without a capability
+* is development-only: default-deny means undeclared is denied.
+*/
+async function checkHudRequest(request, capability, options = {}) {
+	const settings = (options.settings ?? readAccessSettings)();
+	const { env, enabled, password } = settings;
+	if (!isHudVisible(env, enabled)) return {
+		ok: false,
+		status: 404,
+		error: "not found"
+	};
+	if (env !== "development" && (capability === void 0 || !hasCapability(env, capability, resolveMatrix(options.matrix)))) return {
+		ok: false,
+		status: 403,
+		error: "forbidden"
+	};
+	const access = resolveHudAccess(env);
+	if (!hudRequiresUnlock(access)) return {
+		ok: true,
+		env
+	};
+	if (!password) return {
+		ok: false,
+		status: 401,
+		error: "hud unlock is not configured"
+	};
+	const token = readCookie(request.headers.get("cookie"), HUD_UNLOCK_COOKIE);
+	if (!await verifyHudUnlockToken(token, signingSecret(settings), env, { ttlMs: hudUnlockTtlMs(access) })) return {
+		ok: false,
+		status: 401,
+		error: "hud is locked"
+	};
+	return {
+		ok: true,
+		env
+	};
+}
+/** Whether the request already carries a valid unlock (the status route). */
+async function isHudRequestUnlocked(request, options = {}) {
+	const settings = (options.settings ?? readAccessSettings)();
+	const access = resolveHudAccess(settings.env);
+	if (access === "denied") return false;
+	if (!hudRequiresUnlock(access)) return true;
+	if (!settings.password) return false;
+	const token = readCookie(request.headers.get("cookie"), HUD_UNLOCK_COOKIE);
+	return verifyHudUnlockToken(token, signingSecret(settings), settings.env, { ttlMs: hudUnlockTtlMs(access) });
+}
+//#endregion
+//#region src/plugins/access/server/unlock.ts
+/**
+* The unlock route, `<basePath>/access/unlock`. Verification is an HMAC over
+* the tier and the token's own issue time (see ../access.ts), so nothing is
+* stored server side apart from the failed-attempt budget.
+*/
+/**
+* Failed-attempt budget, per process. The password is the only barrier in
+* front of a deployed HUD, and a pod lives long enough that unlimited
+* guessing is a real risk. Deliberately crude: an in-memory counter is
+* enough friction for an operator-facing surface, and it cannot fail open
+* the way a shared store can when it is unreachable.
+*
+* The throttle is checked before the password, so a throttled client gets
+* 429 even for the right one; a guess that lands while throttled is worth
+* nothing. Two budgets:
+*
+* - ten failures per client;
+* - a ceiling of a hundred across all clients, against address rotation.
+*   It blocks only clients with recent failures of their own, so an
+*   operator who has not mistyped still unlocks during an attack.
+*/
+const ATTEMPT_WINDOW_MS = 6e5;
+const MAX_FAILED_ATTEMPTS = 10;
+const MAX_FAILED_GLOBAL = 100;
+/** Most clients tracked at once. */
+const MAX_TRACKED = 1e3;
+/**
+* Requests without client headers share this key. It has no per-client
+* limit (it would let anyone lock out everyone), only the global ceiling.
+*/
+const UNKNOWN_CLIENT = "unknown";
+const failures = /* @__PURE__ */ new Map();
+let globalFailures = {
+	count: 0,
+	firstAt: 0
+};
+function isLive(bucket, now) {
+	return now - bucket.firstAt <= ATTEMPT_WINDOW_MS;
+}
+/**
+* `x-real-ip` when the proxy sets it, else the last `x-forwarded-for` entry:
+* the one the trusted proxy appended. Entries before it are whatever the
+* client sent, so keying on them would let a client pick its own bucket.
+*/
+function clientKey(request) {
+	const realIp = request.headers.get("x-real-ip")?.trim();
+	if (realIp) return realIp;
+	return request.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim() || UNKNOWN_CLIENT;
+}
+function isThrottled(key, now) {
+	const entry = failures.get(key);
+	if (!entry || !isLive(entry, now)) return false;
+	if (key !== UNKNOWN_CLIENT && entry.count >= MAX_FAILED_ATTEMPTS) return true;
+	return isLive(globalFailures, now) && globalFailures.count >= MAX_FAILED_GLOBAL;
+}
+/** Makes room for one more client without resetting a bucket close to its limit. */
+function makeRoom(now) {
+	if (failures.size < MAX_TRACKED) return true;
+	for (const [key, tracked] of failures) if (!isLive(tracked, now)) failures.delete(key);
+	if (failures.size < MAX_TRACKED) return true;
+	for (const [key, tracked] of failures) if (tracked.count < MAX_FAILED_ATTEMPTS / 2) {
+		failures.delete(key);
+		return true;
+	}
+	return false;
+}
+function recordFailure(key, now) {
+	if (isLive(globalFailures, now)) globalFailures.count += 1;
+	else globalFailures = {
+		count: 1,
+		firstAt: now
+	};
+	const entry = failures.get(key);
+	if (entry && isLive(entry, now)) {
+		entry.count += 1;
+		return;
+	}
+	failures.delete(key);
+	if (makeRoom(now)) failures.set(key, {
+		count: 1,
+		firstAt: now
+	});
+}
+/**
+* GET: what the client needs to decide between the panels and the lock, and
+* nothing more. The route is reachable while locked, so it names no tier.
+*/
+async function handleHudUnlockStatus(request, options = {}) {
+	const settings = (options.settings ?? readAccessSettings)();
+	const { env, enabled, password } = settings;
+	if (!isHudVisible(env, enabled)) return {
+		status: 404,
+		body: { error: "not found" }
+	};
+	const required = hudRequiresUnlock(resolveHudAccess(env));
+	return {
+		status: 200,
+		body: {
+			unlocked: await isHudRequestUnlocked(request, { settings: () => settings }),
+			configured: !required || Boolean(password)
+		}
+	};
+}
+/** POST: exchanges the password for a signed, expiring unlock cookie. */
+async function handleHudUnlockAttempt(request, options = {}) {
+	const settings = (options.settings ?? readAccessSettings)();
+	const { env, enabled, password: expected } = settings;
+	if (!isHudVisible(env, enabled)) return {
+		status: 404,
+		body: { error: "not found" }
+	};
+	const access = resolveHudAccess(env);
+	if (!hudRequiresUnlock(access)) return {
+		status: 200,
+		body: {
+			unlocked: true,
+			required: false
+		}
+	};
+	const secret = signingSecret(settings);
+	if (!expected || !secret) return {
+		status: 503,
+		body: {
+			unlocked: false,
+			configured: false,
+			error: "hud unlock is not configured"
+		}
+	};
+	const now = Date.now();
+	const key = clientKey(request);
+	if (isThrottled(key, now)) return {
+		status: 429,
+		body: {
+			unlocked: false,
+			error: "too many attempts, try again later"
+		}
+	};
+	let submitted = "";
+	try {
+		const payload = await request.json();
+		if (typeof payload?.password === "string") submitted = payload.password;
+	} catch {}
+	if (!submitted || !timingSafeEqual(submitted, expected)) {
+		recordFailure(key, now);
+		return {
+			status: 401,
+			body: {
+				unlocked: false,
+				error: "wrong password"
+			}
+		};
+	}
+	failures.delete(key);
+	const ttlMs = hudUnlockTtlMs(access);
+	return {
+		status: 200,
+		body: {
+			unlocked: true,
+			expiresInMs: ttlMs
+		},
+		setCookie: hudUnlockCookieString(await signHudUnlockToken(secret, env, now), ttlMs)
+	};
+}
+/** Test seam: the attempt budget is process state, not request state. */
+function resetHudUnlockAttempts() {
+	failures.clear();
+	globalFailures = {
+		count: 0,
+		firstAt: 0
+	};
+}
+/** Test seam: how many clients the attempt budget tracks. */
+function trackedHudUnlockClients() {
+	return failures.size;
+}
+//#endregion
+//#region src/plugins/access/server.ts
+function toResponse({ status, body, setCookie }) {
+	const res = Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+	if (setCookie) res.headers.append("set-cookie", setCookie);
+	return res;
+}
+function splitPath(path) {
+	return path.split("/").filter(Boolean);
+}
+/**
+* The guard for `createHudHandler({ guard })` on deployed tiers. It answers
+* exactly like the old `checkHudRequest`: 404 while the tier has not opted in,
+* 403 for a capability the tier's matrix denies (before any password is
+* considered), 401 until the request carries a valid unlock cookie. In
+* development it lets everything through, like `developmentOnly`.
+*
+* The unlock route itself is the one exemption, so a locked HUD can unlock.
+* Pass the handler's `basePath` when it is not `/api/hud`.
+*/
+function accessGuard(options = {}) {
+	const settings = options.settings ?? readAccessSettings;
+	const unlockPath = [
+		...splitPath(options.basePath ?? "/api/hud"),
+		"access",
+		"unlock"
+	].join("/");
+	return async (request, capability) => {
+		const path = splitPath(new URL(request.url).pathname).join("/");
+		if (capability === "access.unlock" && path === unlockPath) {
+			const { env, enabled } = settings();
+			return isHudVisible(env, enabled) ? null : Response.json({
+				ok: false,
+				error: "not found"
+			}, { status: 404 });
+		}
+		const result = await checkHudRequest(request, capability, {
+			...options,
+			settings
+		});
+		if (result.ok) return null;
+		return Response.json({
+			ok: false,
+			error: result.error
+		}, {
+			status: result.status,
+			headers: { "cache-control": "no-store" }
+		});
+	};
+}
+/**
+* Server half of the access plugin: `GET|POST <basePath>/access/unlock`.
+* GET reports `{ unlocked, configured }`; POST trades `{ password }` for an
+* httpOnly cookie. Wrong passwords are budgeted: ten per client per ten
+* minutes, and past a hundred overall every client with failures of its own
+* is throttled; a throttled client gets 429 even for the right password.
+*
+* ```ts
+* const options = {};
+* export const { GET, POST } = createHudHandler([accessServer(options), ...], {
+*   guard: accessGuard(options),
+* });
+* ```
+*/
+function accessServer(options = {}) {
+	return definePlugin({
+		id: "access",
+		capability: ACCESS_UNLOCK_CAPABILITY,
+		routes: { "/unlock": {
+			GET: async (request) => request.method === "GET" ? toResponse(await handleHudUnlockStatus(request, options)) : Response.json({
+				ok: false,
+				error: "method not allowed"
+			}, {
+				status: 405,
+				headers: { allow: "GET, POST" }
+			}),
+			POST: async (request) => toResponse(await handleHudUnlockAttempt(request, options))
+		} }
+	});
+}
+//#endregion
+export { ACCESS_UNLOCK_CAPABILITY, CAPABILITY_MATRIX, HUD_CAPABILITIES, HUD_UNLOCK_COOKIE, accessGuard, accessServer, checkHudRequest, handleHudUnlockAttempt, handleHudUnlockStatus, hasCapability, hudRequiresUnlock, isHudRequestUnlocked, isHudVisible, readAccessSettings, resetHudUnlockAttempts, resolveHudAccess, signHudUnlockToken, trackedHudUnlockClients, verifyHudUnlockToken };

package/dist/plugins/access.d.ts

@@ -0,0 +1,41 @@
+import { c as HudPluginProps, r as HudCapability } from "../plugins-CQ_0w1ot.js";
+import "../index-BYsdS-7d.js";
+import { c as CAPABILITY_MATRIX, d as hasCapability, i as resolveHudAccess, l as CapabilityMatrixOverride, n as HudAccess, r as hudRequiresUnlock, s as ACCESS_UNLOCK_CAPABILITY, u as HUD_CAPABILITIES } from "../access-CNvJOwKM.js";
+//#region src/plugins/access/access-panel.d.ts
+declare function AccessPill(): import("react").JSX.Element;
+//#endregion
+//#region src/plugins/access/unlock-store.d.ts
+type UnlockStatus = "checking" | "locked" | "unlocked" | "unconfigured";
+/**
+ * `HudAccessControl.useUnlocked`: development is open, a disabled or unknown
+ * tier never unlocks, every deployed tier asks the server once per mount.
+ */
+declare function useUnlocked(envName: string, apiBase: string): boolean;
+//#endregion
+//#region src/plugins/access/index.d.ts
+export interface AccessOptions {
+  /** Replaces the default matrix's list for a deployed tier. Keep it equal to the server half's. */
+  matrix?: CapabilityMatrixOverride;
+}
+/**
+ * Opt-in for deployed tiers. Without it `defineHud` renders nothing outside
+ * development. With it the HUD follows the env ladder: a tier's capability
+ * matrix narrows the plugins, and until the operator unlocks with the
+ * server's password only this plugin's lock shows.
+ *
+ * Client half; the password check lives in `@hansenexus/hud/plugins/access/server`
+ * (`accessServer()` + `accessGuard()`), and the password never reaches the browser.
+ */
+export declare function access(options?: AccessOptions): {
+  readonly id: "access";
+  readonly title: "Access";
+  readonly capability: "access.unlock";
+  readonly pill: typeof AccessPill;
+  readonly panel: ({ ctx }: HudPluginProps) => import("react").JSX.Element;
+  readonly access: {
+    readonly can: (env: string, capability: HudCapability) => boolean;
+    readonly useUnlocked: typeof useUnlocked;
+  };
+};
+//#endregion
+export { ACCESS_UNLOCK_CAPABILITY, CAPABILITY_MATRIX, type CapabilityMatrixOverride, HUD_CAPABILITIES, type HudAccess, type UnlockStatus, hasCapability, hudRequiresUnlock, resolveHudAccess };