@hexclave/shared 1.0.0

package/dist/helpers/support-sla.js

@@ -0,0 +1,72 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/helpers/support-sla.ts
+const DEFAULT_SUPPORT_SLA = {
+	enabled: false,
+	firstResponseMinutes: null,
+	nextResponseMinutes: null
+};
+function addMinutesOrNull(now, minutes) {
+	if (minutes == null || !Number.isFinite(minutes) || minutes <= 0) return null;
+	return new Date(now.getTime() + minutes * 6e4);
+}
+/**
+* Returns the target first-response due timestamp for a new conversation,
+* or `null` if SLA tracking is off or no target is set.
+*/
+function computeFirstResponseDueAt(now, sla) {
+	if (!sla.enabled) return null;
+	return addMinutesOrNull(now, sla.firstResponseMinutes);
+}
+/**
+* Returns the target next-response due timestamp when a conversation has been
+* re-opened by a user reply, or `null` if SLA tracking is off or no target
+* is set.
+*/
+function computeNextResponseDueAt(now, sla) {
+	if (!sla.enabled) return null;
+	return addMinutesOrNull(now, sla.nextResponseMinutes);
+}
+/**
+* How soon (in milliseconds) before a due timestamp we switch into the
+* "urgent" state. Within this window the due timestamp should be rendered
+* with a strong alert treatment.
+*/
+const SLA_URGENT_THRESHOLD_MS = 900 * 1e3;
+/**
+* How soon (in milliseconds) before a due timestamp we switch into the
+* "warning" state. Within this window the due timestamp should be rendered
+* with a subtle alert treatment so agents can notice it without being
+* distracted.
+*/
+const SLA_WARNING_THRESHOLD_MS = 3600 * 1e3;
+/**
+* Classifies how close a due timestamp is to `now` so we can subtly alert
+* agents as it approaches (and after it passes).
+*
+* If `windowStartedAt` is provided, thresholds scale with the total SLA
+* window length - so a 5-minute SLA doesn't read as "urgent" from t=0 - and
+* are capped by the fixed wall-clock thresholds so a 24-hour SLA doesn't
+* sit in "warning" for 12 hours. If `windowStartedAt` isn't known, we fall
+* back to the fixed wall-clock thresholds.
+*/
+function computeSlaUrgency(dueAt, now, options) {
+	const remainingMs = dueAt.getTime() - now.getTime();
+	if (remainingMs <= 0) return "overdue";
+	const windowStartedAt = options?.windowStartedAt ?? null;
+	const totalWindowMs = windowStartedAt != null ? Math.max(1, dueAt.getTime() - windowStartedAt.getTime()) : null;
+	const urgentThresholdMs = totalWindowMs != null ? Math.min(totalWindowMs * .25, SLA_URGENT_THRESHOLD_MS) : SLA_URGENT_THRESHOLD_MS;
+	const warningThresholdMs = totalWindowMs != null ? Math.min(totalWindowMs * .5, SLA_WARNING_THRESHOLD_MS) : SLA_WARNING_THRESHOLD_MS;
+	if (remainingMs <= urgentThresholdMs) return "urgent";
+	if (remainingMs <= warningThresholdMs) return "warning";
+	return "ok";
+}
+
+//#endregion
+exports.DEFAULT_SUPPORT_SLA = DEFAULT_SUPPORT_SLA;
+exports.SLA_URGENT_THRESHOLD_MS = SLA_URGENT_THRESHOLD_MS;
+exports.SLA_WARNING_THRESHOLD_MS = SLA_WARNING_THRESHOLD_MS;
+exports.computeFirstResponseDueAt = computeFirstResponseDueAt;
+exports.computeNextResponseDueAt = computeNextResponseDueAt;
+exports.computeSlaUrgency = computeSlaUrgency;
+//# sourceMappingURL=support-sla.js.map

package/dist/helpers/support-sla.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-sla.js","names":[],"sources":["../../src/helpers/support-sla.ts"],"sourcesContent":["export type SupportSlaConfig = {\n  enabled: boolean,\n  firstResponseMinutes: number | null,\n  nextResponseMinutes: number | null,\n};\n\nexport const DEFAULT_SUPPORT_SLA: SupportSlaConfig = {\n  enabled: false,\n  firstResponseMinutes: null,\n  nextResponseMinutes: null,\n};\n\nfunction addMinutesOrNull(now: Date, minutes: number | null): Date | null {\n  if (minutes == null || !Number.isFinite(minutes) || minutes <= 0) return null;\n  return new Date(now.getTime() + minutes * 60_000);\n}\n\n/**\n * Returns the target first-response due timestamp for a new conversation,\n * or `null` if SLA tracking is off or no target is set.\n */\nexport function computeFirstResponseDueAt(\n  now: Date,\n  sla: SupportSlaConfig,\n): Date | null {\n  if (!sla.enabled) return null;\n  return addMinutesOrNull(now, sla.firstResponseMinutes);\n}\n\n/**\n * Returns the target next-response due timestamp when a conversation has been\n * re-opened by a user reply, or `null` if SLA tracking is off or no target\n * is set.\n */\nexport function computeNextResponseDueAt(\n  now: Date,\n  sla: SupportSlaConfig,\n): Date | null {\n  if (!sla.enabled) return null;\n  return addMinutesOrNull(now, sla.nextResponseMinutes);\n}\n\nexport type SlaUrgency = \"ok\" | \"warning\" | \"urgent\" | \"overdue\";\n\n/**\n * How soon (in milliseconds) before a due timestamp we switch into the\n * \"urgent\" state. Within this window the due timestamp should be rendered\n * with a strong alert treatment.\n */\nexport const SLA_URGENT_THRESHOLD_MS = 15 * 60 * 1000;\n\n/**\n * How soon (in milliseconds) before a due timestamp we switch into the\n * \"warning\" state. Within this window the due timestamp should be rendered\n * with a subtle alert treatment so agents can notice it without being\n * distracted.\n */\nexport const SLA_WARNING_THRESHOLD_MS = 60 * 60 * 1000;\n\n/**\n * Classifies how close a due timestamp is to `now` so we can subtly alert\n * agents as it approaches (and after it passes).\n *\n * If `windowStartedAt` is provided, thresholds scale with the total SLA\n * window length - so a 5-minute SLA doesn't read as \"urgent\" from t=0 - and\n * are capped by the fixed wall-clock thresholds so a 24-hour SLA doesn't\n * sit in \"warning\" for 12 hours. If `windowStartedAt` isn't known, we fall\n * back to the fixed wall-clock thresholds.\n */\nexport function computeSlaUrgency(\n  dueAt: Date,\n  now: Date,\n  options?: { windowStartedAt?: Date | null },\n): SlaUrgency {\n  const remainingMs = dueAt.getTime() - now.getTime();\n  if (remainingMs <= 0) return \"overdue\";\n\n  const windowStartedAt = options?.windowStartedAt ?? null;\n  const totalWindowMs = windowStartedAt != null\n    ? Math.max(1, dueAt.getTime() - windowStartedAt.getTime())\n    : null;\n\n  const urgentThresholdMs = totalWindowMs != null\n    ? Math.min(totalWindowMs * 0.25, SLA_URGENT_THRESHOLD_MS)\n    : SLA_URGENT_THRESHOLD_MS;\n  const warningThresholdMs = totalWindowMs != null\n    ? Math.min(totalWindowMs * 0.5, SLA_WARNING_THRESHOLD_MS)\n    : SLA_WARNING_THRESHOLD_MS;\n\n  if (remainingMs <= urgentThresholdMs) return \"urgent\";\n  if (remainingMs <= warningThresholdMs) return \"warning\";\n  return \"ok\";\n}\n"],"mappings":";;;AAMA,MAAa,sBAAwC;CACnD,SAAS;CACT,sBAAsB;CACtB,qBAAqB;CACtB;AAED,SAAS,iBAAiB,KAAW,SAAqC;AACxE,KAAI,WAAW,QAAQ,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAAG,QAAO;AACzE,QAAO,IAAI,KAAK,IAAI,SAAS,GAAG,UAAU,IAAO;;;;;;AAOnD,SAAgB,0BACd,KACA,KACa;AACb,KAAI,CAAC,IAAI,QAAS,QAAO;AACzB,QAAO,iBAAiB,KAAK,IAAI,qBAAqB;;;;;;;AAQxD,SAAgB,yBACd,KACA,KACa;AACb,KAAI,CAAC,IAAI,QAAS,QAAO;AACzB,QAAO,iBAAiB,KAAK,IAAI,oBAAoB;;;;;;;AAUvD,MAAa,0BAA0B,MAAU;;;;;;;AAQjD,MAAa,2BAA2B,OAAU;;;;;;;;;;;AAYlD,SAAgB,kBACd,OACA,KACA,SACY;CACZ,MAAM,cAAc,MAAM,SAAS,GAAG,IAAI,SAAS;AACnD,KAAI,eAAe,EAAG,QAAO;CAE7B,MAAM,kBAAkB,SAAS,mBAAmB;CACpD,MAAM,gBAAgB,mBAAmB,OACrC,KAAK,IAAI,GAAG,MAAM,SAAS,GAAG,gBAAgB,SAAS,CAAC,GACxD;CAEJ,MAAM,oBAAoB,iBAAiB,OACvC,KAAK,IAAI,gBAAgB,KAAM,wBAAwB,GACvD;CACJ,MAAM,qBAAqB,iBAAiB,OACxC,KAAK,IAAI,gBAAgB,IAAK,yBAAyB,GACvD;AAEJ,KAAI,eAAe,kBAAmB,QAAO;AAC7C,KAAI,eAAe,mBAAoB,QAAO;AAC9C,QAAO"}

package/dist/helpers/support-sla.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/helpers/support-sla.test.js

@@ -0,0 +1,102 @@
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let vitest = require("vitest");
+let __support_sla_js = require("./support-sla.js");
+
+//#region src/helpers/support-sla.test.ts
+const enabledSla = {
+	enabled: true,
+	firstResponseMinutes: 60,
+	nextResponseMinutes: 120
+};
+(0, vitest.describe)("computeFirstResponseDueAt", () => {
+	const now = /* @__PURE__ */ new Date("2026-04-22T12:00:00.000Z");
+	(0, vitest.it)("returns null when SLA is disabled", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeFirstResponseDueAt)(now, {
+			...enabledSla,
+			enabled: false
+		})).toBeNull();
+	});
+	(0, vitest.it)("returns null when no target is set", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeFirstResponseDueAt)(now, {
+			...enabledSla,
+			firstResponseMinutes: null
+		})).toBeNull();
+	});
+	(0, vitest.it)("adds the configured minutes to now", () => {
+		const due = (0, __support_sla_js.computeFirstResponseDueAt)(now, enabledSla);
+		(0, vitest.expect)(due).not.toBeNull();
+		(0, vitest.expect)(due.toISOString()).toBe("2026-04-22T13:00:00.000Z");
+	});
+	(0, vitest.it)("returns null when the configured value is non-positive", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeFirstResponseDueAt)(now, {
+			...enabledSla,
+			firstResponseMinutes: 0
+		})).toBeNull();
+	});
+});
+(0, vitest.describe)("computeNextResponseDueAt", () => {
+	const now = /* @__PURE__ */ new Date("2026-04-22T12:00:00.000Z");
+	(0, vitest.it)("returns null when SLA is disabled", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeNextResponseDueAt)(now, {
+			...enabledSla,
+			enabled: false
+		})).toBeNull();
+	});
+	(0, vitest.it)("returns null when no target is set", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeNextResponseDueAt)(now, {
+			...enabledSla,
+			nextResponseMinutes: null
+		})).toBeNull();
+	});
+	(0, vitest.it)("adds the configured next-response minutes to now", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeNextResponseDueAt)(now, enabledSla).toISOString()).toBe("2026-04-22T14:00:00.000Z");
+	});
+});
+(0, vitest.describe)("computeSlaUrgency", () => {
+	const now = /* @__PURE__ */ new Date("2026-04-22T12:00:00.000Z");
+	(0, vitest.it)("returns 'overdue' when the due timestamp is in the past", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(/* @__PURE__ */ new Date(now.getTime() - 1), now)).toBe("overdue");
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(/* @__PURE__ */ new Date(now.getTime() - 6e4), now)).toBe("overdue");
+	});
+	(0, vitest.it)("returns 'overdue' when the due timestamp is exactly now", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(now, now)).toBe("overdue");
+	});
+	(0, vitest.it)("returns 'urgent' within the urgent threshold", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + 6e4), now)).toBe("urgent");
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + __support_sla_js.SLA_URGENT_THRESHOLD_MS), now)).toBe("urgent");
+	});
+	(0, vitest.it)("returns 'warning' within the warning threshold", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + __support_sla_js.SLA_URGENT_THRESHOLD_MS + 6e4), now)).toBe("warning");
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + __support_sla_js.SLA_WARNING_THRESHOLD_MS), now)).toBe("warning");
+	});
+	(0, vitest.it)("returns 'ok' when comfortably before the warning threshold", () => {
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + __support_sla_js.SLA_WARNING_THRESHOLD_MS + 6e4), now)).toBe("ok");
+		(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(new Date(now.getTime() + 1440 * 60 * 1e3), now)).toBe("ok");
+	});
+	(0, vitest.describe)("with a windowStartedAt", () => {
+		(0, vitest.it)("scales thresholds down for short SLA windows so t=0 is not immediately urgent", () => {
+			const windowStartedAt = now;
+			const dueAt = new Date(now.getTime() + 5 * 6e4);
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, now, { windowStartedAt })).toBe("ok");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, new Date(now.getTime() + 2 * 6e4), { windowStartedAt })).toBe("ok");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, new Date(now.getTime() + 3 * 6e4), { windowStartedAt })).toBe("warning");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, new Date(now.getTime() + 4 * 6e4), { windowStartedAt })).toBe("urgent");
+		});
+		(0, vitest.it)("caps thresholds at the fixed wall-clock windows for long SLAs", () => {
+			const windowStartedAt = now;
+			const dueAt = new Date(now.getTime() + 1440 * 60 * 1e3);
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, /* @__PURE__ */ new Date(dueAt.getTime() - 7200 * 1e3), { windowStartedAt })).toBe("ok");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, /* @__PURE__ */ new Date(dueAt.getTime() - 45 * 6e4), { windowStartedAt })).toBe("warning");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, /* @__PURE__ */ new Date(dueAt.getTime() - 10 * 6e4), { windowStartedAt })).toBe("urgent");
+		});
+		(0, vitest.it)("falls back to fixed thresholds when windowStartedAt is nullish", () => {
+			const dueAt = new Date(now.getTime() + 30 * 6e4);
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, now)).toBe("warning");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, now, { windowStartedAt: null })).toBe("warning");
+			(0, vitest.expect)((0, __support_sla_js.computeSlaUrgency)(dueAt, now, { windowStartedAt: void 0 })).toBe("warning");
+		});
+	});
+});
+
+//#endregion
+//# sourceMappingURL=support-sla.test.js.map

package/dist/helpers/support-sla.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-sla.test.js","names":["SLA_URGENT_THRESHOLD_MS","SLA_WARNING_THRESHOLD_MS"],"sources":["../../src/helpers/support-sla.test.ts"],"sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport {\n  computeFirstResponseDueAt,\n  computeNextResponseDueAt,\n  computeSlaUrgency,\n  SLA_URGENT_THRESHOLD_MS,\n  SLA_WARNING_THRESHOLD_MS,\n  type SupportSlaConfig,\n} from \"./support-sla\";\n\nconst enabledSla: SupportSlaConfig = {\n  enabled: true,\n  firstResponseMinutes: 60,\n  nextResponseMinutes: 120,\n};\n\ndescribe(\"computeFirstResponseDueAt\", () => {\n  const now = new Date(\"2026-04-22T12:00:00.000Z\");\n\n  it(\"returns null when SLA is disabled\", () => {\n    expect(computeFirstResponseDueAt(now, { ...enabledSla, enabled: false })).toBeNull();\n  });\n\n  it(\"returns null when no target is set\", () => {\n    expect(computeFirstResponseDueAt(now, { ...enabledSla, firstResponseMinutes: null })).toBeNull();\n  });\n\n  it(\"adds the configured minutes to now\", () => {\n    const due = computeFirstResponseDueAt(now, enabledSla);\n    expect(due).not.toBeNull();\n    expect(due!.toISOString()).toBe(\"2026-04-22T13:00:00.000Z\");\n  });\n\n  it(\"returns null when the configured value is non-positive\", () => {\n    expect(computeFirstResponseDueAt(now, { ...enabledSla, firstResponseMinutes: 0 })).toBeNull();\n  });\n});\n\ndescribe(\"computeNextResponseDueAt\", () => {\n  const now = new Date(\"2026-04-22T12:00:00.000Z\");\n\n  it(\"returns null when SLA is disabled\", () => {\n    expect(computeNextResponseDueAt(now, { ...enabledSla, enabled: false })).toBeNull();\n  });\n\n  it(\"returns null when no target is set\", () => {\n    expect(computeNextResponseDueAt(now, { ...enabledSla, nextResponseMinutes: null })).toBeNull();\n  });\n\n  it(\"adds the configured next-response minutes to now\", () => {\n    const due = computeNextResponseDueAt(now, enabledSla);\n    expect(due!.toISOString()).toBe(\"2026-04-22T14:00:00.000Z\");\n  });\n});\n\ndescribe(\"computeSlaUrgency\", () => {\n  const now = new Date(\"2026-04-22T12:00:00.000Z\");\n\n  it(\"returns 'overdue' when the due timestamp is in the past\", () => {\n    expect(computeSlaUrgency(new Date(now.getTime() - 1), now)).toBe(\"overdue\");\n    expect(computeSlaUrgency(new Date(now.getTime() - 60_000), now)).toBe(\"overdue\");\n  });\n\n  it(\"returns 'overdue' when the due timestamp is exactly now\", () => {\n    expect(computeSlaUrgency(now, now)).toBe(\"overdue\");\n  });\n\n  it(\"returns 'urgent' within the urgent threshold\", () => {\n    expect(computeSlaUrgency(new Date(now.getTime() + 60_000), now)).toBe(\"urgent\");\n    expect(computeSlaUrgency(new Date(now.getTime() + SLA_URGENT_THRESHOLD_MS), now)).toBe(\"urgent\");\n  });\n\n  it(\"returns 'warning' within the warning threshold\", () => {\n    expect(computeSlaUrgency(new Date(now.getTime() + SLA_URGENT_THRESHOLD_MS + 60_000), now)).toBe(\"warning\");\n    expect(computeSlaUrgency(new Date(now.getTime() + SLA_WARNING_THRESHOLD_MS), now)).toBe(\"warning\");\n  });\n\n  it(\"returns 'ok' when comfortably before the warning threshold\", () => {\n    expect(computeSlaUrgency(new Date(now.getTime() + SLA_WARNING_THRESHOLD_MS + 60_000), now)).toBe(\"ok\");\n    expect(computeSlaUrgency(new Date(now.getTime() + 24 * 60 * 60 * 1000), now)).toBe(\"ok\");\n  });\n\n  describe(\"with a windowStartedAt\", () => {\n    it(\"scales thresholds down for short SLA windows so t=0 is not immediately urgent\", () => {\n      // 5-minute SLA window: due 5 min after it started.\n      const windowStartedAt = now;\n      const dueAt = new Date(now.getTime() + 5 * 60_000);\n      // Right at the start, 5 min remaining — should be 'ok' (>50% of window remaining).\n      expect(computeSlaUrgency(dueAt, now, { windowStartedAt })).toBe(\"ok\");\n      // At t+2min (3 min remaining, 60% of window remaining) — still 'ok'.\n      const twoMinLater = new Date(now.getTime() + 2 * 60_000);\n      expect(computeSlaUrgency(dueAt, twoMinLater, { windowStartedAt })).toBe(\"ok\");\n      // At t+3min (2 min remaining, 40% of window) — 'warning'.\n      const threeMinLater = new Date(now.getTime() + 3 * 60_000);\n      expect(computeSlaUrgency(dueAt, threeMinLater, { windowStartedAt })).toBe(\"warning\");\n      // At t+4min (1 min remaining, 20% of window) — 'urgent'.\n      const fourMinLater = new Date(now.getTime() + 4 * 60_000);\n      expect(computeSlaUrgency(dueAt, fourMinLater, { windowStartedAt })).toBe(\"urgent\");\n    });\n\n    it(\"caps thresholds at the fixed wall-clock windows for long SLAs\", () => {\n      // 24-hour SLA window.\n      const windowStartedAt = now;\n      const dueAt = new Date(now.getTime() + 24 * 60 * 60 * 1000);\n      // 2 hours remaining (long past the 50% mark of the 24h window) — should\n      // still be 'ok' because the warning cap is 60 min.\n      const tMinusTwoHours = new Date(dueAt.getTime() - 2 * 60 * 60 * 1000);\n      expect(computeSlaUrgency(dueAt, tMinusTwoHours, { windowStartedAt })).toBe(\"ok\");\n      // 45 minutes remaining — 'warning' (inside the 60-min cap).\n      const tMinus45Min = new Date(dueAt.getTime() - 45 * 60_000);\n      expect(computeSlaUrgency(dueAt, tMinus45Min, { windowStartedAt })).toBe(\"warning\");\n      // 10 minutes remaining — 'urgent' (inside the 15-min cap).\n      const tMinus10Min = new Date(dueAt.getTime() - 10 * 60_000);\n      expect(computeSlaUrgency(dueAt, tMinus10Min, { windowStartedAt })).toBe(\"urgent\");\n    });\n\n    it(\"falls back to fixed thresholds when windowStartedAt is nullish\", () => {\n      const dueAt = new Date(now.getTime() + 30 * 60_000);\n      expect(computeSlaUrgency(dueAt, now)).toBe(\"warning\");\n      expect(computeSlaUrgency(dueAt, now, { windowStartedAt: null })).toBe(\"warning\");\n      expect(computeSlaUrgency(dueAt, now, { windowStartedAt: undefined })).toBe(\"warning\");\n    });\n  });\n});\n"],"mappings":";;;;;AAUA,MAAM,aAA+B;CACnC,SAAS;CACT,sBAAsB;CACtB,qBAAqB;CACtB;qBAEQ,mCAAmC;CAC1C,MAAM,sBAAM,IAAI,KAAK,2BAA2B;AAEhD,gBAAG,2CAA2C;AAC5C,qEAAiC,KAAK;GAAE,GAAG;GAAY,SAAS;GAAO,CAAC,CAAC,CAAC,UAAU;GACpF;AAEF,gBAAG,4CAA4C;AAC7C,qEAAiC,KAAK;GAAE,GAAG;GAAY,sBAAsB;GAAM,CAAC,CAAC,CAAC,UAAU;GAChG;AAEF,gBAAG,4CAA4C;EAC7C,MAAM,sDAAgC,KAAK,WAAW;AACtD,qBAAO,IAAI,CAAC,IAAI,UAAU;AAC1B,qBAAO,IAAK,aAAa,CAAC,CAAC,KAAK,2BAA2B;GAC3D;AAEF,gBAAG,gEAAgE;AACjE,qEAAiC,KAAK;GAAE,GAAG;GAAY,sBAAsB;GAAG,CAAC,CAAC,CAAC,UAAU;GAC7F;EACF;qBAEO,kCAAkC;CACzC,MAAM,sBAAM,IAAI,KAAK,2BAA2B;AAEhD,gBAAG,2CAA2C;AAC5C,oEAAgC,KAAK;GAAE,GAAG;GAAY,SAAS;GAAO,CAAC,CAAC,CAAC,UAAU;GACnF;AAEF,gBAAG,4CAA4C;AAC7C,oEAAgC,KAAK;GAAE,GAAG;GAAY,qBAAqB;GAAM,CAAC,CAAC,CAAC,UAAU;GAC9F;AAEF,gBAAG,0DAA0D;AAE3D,oEADqC,KAAK,WAAW,CACzC,aAAa,CAAC,CAAC,KAAK,2BAA2B;GAC3D;EACF;qBAEO,2BAA2B;CAClC,MAAM,sBAAM,IAAI,KAAK,2BAA2B;AAEhD,gBAAG,iEAAiE;AAClE,6EAAyB,IAAI,KAAK,IAAI,SAAS,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU;AAC3E,6EAAyB,IAAI,KAAK,IAAI,SAAS,GAAG,IAAO,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU;GAChF;AAEF,gBAAG,iEAAiE;AAClE,6DAAyB,KAAK,IAAI,CAAC,CAAC,KAAK,UAAU;GACnD;AAEF,gBAAG,sDAAsD;AACvD,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAG,IAAO,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS;AAC/E,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAGA,yCAAwB,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS;GAChG;AAEF,gBAAG,wDAAwD;AACzD,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAGA,2CAA0B,IAAO,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU;AAC1G,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAGC,0CAAyB,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU;GAClG;AAEF,gBAAG,oEAAoE;AACrE,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAGA,4CAA2B,IAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK;AACtG,6DAAyB,IAAI,KAAK,IAAI,SAAS,GAAG,OAAU,KAAK,IAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK;GACxF;AAEF,sBAAS,gCAAgC;AACvC,iBAAG,uFAAuF;GAExF,MAAM,kBAAkB;GACxB,MAAM,QAAQ,IAAI,KAAK,IAAI,SAAS,GAAG,IAAI,IAAO;AAElD,8DAAyB,OAAO,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK;AAGrE,8DAAyB,OADL,IAAI,KAAK,IAAI,SAAS,GAAG,IAAI,IAAO,EACX,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK;AAG7E,8DAAyB,OADH,IAAI,KAAK,IAAI,SAAS,GAAG,IAAI,IAAO,EACX,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,UAAU;AAGpF,8DAAyB,OADJ,IAAI,KAAK,IAAI,SAAS,GAAG,IAAI,IAAO,EACX,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,SAAS;IAClF;AAEF,iBAAG,uEAAuE;GAExE,MAAM,kBAAkB;GACxB,MAAM,QAAQ,IAAI,KAAK,IAAI,SAAS,GAAG,OAAU,KAAK,IAAK;AAI3D,8DAAyB,uBADF,IAAI,KAAK,MAAM,SAAS,GAAG,OAAc,IAAK,EACrB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK;AAGhF,8DAAyB,uBADL,IAAI,KAAK,MAAM,SAAS,GAAG,KAAK,IAAO,EACd,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,UAAU;AAGlF,8DAAyB,uBADL,IAAI,KAAK,MAAM,SAAS,GAAG,KAAK,IAAO,EACd,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,SAAS;IACjF;AAEF,iBAAG,wEAAwE;GACzE,MAAM,QAAQ,IAAI,KAAK,IAAI,SAAS,GAAG,KAAK,IAAO;AACnD,8DAAyB,OAAO,IAAI,CAAC,CAAC,KAAK,UAAU;AACrD,8DAAyB,OAAO,KAAK,EAAE,iBAAiB,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU;AAChF,8DAAyB,OAAO,KAAK,EAAE,iBAAiB,QAAW,CAAC,CAAC,CAAC,KAAK,UAAU;IACrF;GACF;EACF"}

package/dist/helpers/vault/client-side.d.ts

@@ -0,0 +1,16 @@
+//#region src/helpers/vault/client-side.d.ts
+/**
+ * Use to hash the key so the server cannot infer it.
+ */
+declare function hashKey(secret: string, key: string): Promise<string>;
+/**
+ * Use to encrypt the value so that the server cannot read the value without knowing the key.
+ */
+declare function encryptValue(secret: string, key: string, value: string): Promise<string>;
+/**
+ * Use to decrypt the value. See encryptValue.
+ */
+declare function decryptValue(secret: string, key: string, encryptedValue: string): Promise<string>;
+//#endregion
+export { decryptValue, encryptValue, hashKey };
+//# sourceMappingURL=client-side.d.ts.map

package/dist/helpers/vault/client-side.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-side.d.ts","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"mappings":";;AAoBA;;iBAAsB,OAAA,CAAQ,MAAA,UAAgB,GAAA,WAAW,OAAA;;;;iBAWnC,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,KAAA,WAAa,OAAA;;;AAA7E;iBAcsB,YAAA,CAAa,MAAA,UAAgB,GAAA,UAAa,cAAA,WAAsB,OAAA"}

package/dist/helpers/vault/client-side.js

@@ -0,0 +1,73 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../../chunk-BE-pF4vm.js');
+let ______utils_bytes_js = require("../../utils/bytes.js");
+let ______utils_crypto_js = require("../../utils/crypto.js");
+
+//#region src/helpers/vault/client-side.ts
+const hashPurpose = "stack-data-vault-client-side-encryption-key-hash";
+const encryptionSecretPurpose = "stack-data-vault-client-side-encryption-value-encryption-key-hash";
+const encryptionValuePurpose = "stack-data-vault-client-side-encryption-value-encryption-value-encryption";
+async function getDerivedKey(secret, key) {
+	return await (0, ______utils_crypto_js.iteratedHash)({
+		purpose: encryptionSecretPurpose,
+		extra: secret,
+		value: key,
+		iterations: 1e5
+	});
+}
+/**
+* Use to hash the key so the server cannot infer it.
+*/
+async function hashKey(secret, key) {
+	return (0, ______utils_bytes_js.encodeBase64)(await (0, ______utils_crypto_js.hash)({
+		purpose: hashPurpose,
+		extra: secret,
+		value: await getDerivedKey(secret, key)
+	}));
+}
+/**
+* Use to encrypt the value so that the server cannot read the value without knowing the key.
+*/
+async function encryptValue(secret, key, value) {
+	return (0, ______utils_bytes_js.encodeBase64)(await (0, ______utils_crypto_js.encrypt)({
+		purpose: encryptionValuePurpose,
+		secret: await getDerivedKey(secret, key),
+		value: new TextEncoder().encode(value)
+	}));
+}
+/**
+* Use to decrypt the value. See encryptValue.
+*/
+async function decryptValue(secret, key, encryptedValue) {
+	const bytesResult = await (0, ______utils_crypto_js.decrypt)({
+		purpose: encryptionValuePurpose,
+		secret: await getDerivedKey(secret, key),
+		cipher: (0, ______utils_bytes_js.decodeBase64)(encryptedValue)
+	});
+	if (bytesResult.status === "error") throw new Error("Data vault client-side decryption failed. Are you sure you're using the correct secret?", { cause: bytesResult.error });
+	return new TextDecoder().decode(bytesResult.data);
+}
+(void 0)?.describe("encryptValue & decryptValue", () => {
+	(void 0)?.it("should encrypt and decrypt a value", async ({ expect }) => {
+		const secret = "test-secret";
+		const value = "test-value";
+		expect(await decryptValue(secret, "key", await encryptValue(secret, "key", value))).toEqual(value);
+	});
+	(void 0)?.it("should not decrypt a value with a different secret", async ({ expect }) => {
+		await expect(decryptValue("different-secret", "key", await encryptValue("test-secret", "key", "test-value"))).rejects.toThrow();
+	});
+	(void 0)?.it("should not decrypt a value with a different key", async ({ expect }) => {
+		const secret = "test-secret";
+		await expect(decryptValue(secret, "different-key", await encryptValue(secret, "key", "test-value"))).rejects.toThrow();
+	});
+	(void 0)?.it("should not decrypt a value if the cipher was tampered with", async ({ expect }) => {
+		const secret = "test-secret";
+		await expect(decryptValue(secret, "key", await encryptValue(secret, "key", "test-value") + "7")).rejects.toThrow();
+	});
+});
+
+//#endregion
+exports.decryptValue = decryptValue;
+exports.encryptValue = encryptValue;
+exports.hashKey = hashKey;
+//# sourceMappingURL=client-side.js.map

package/dist/helpers/vault/client-side.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-side.js","names":[],"sources":["../../../src/helpers/vault/client-side.ts"],"sourcesContent":["import { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt, hash, iteratedHash } from \"../../utils/crypto\";\n\nconst hashPurpose = \"stack-data-vault-client-side-encryption-key-hash\";\nconst encryptionSecretPurpose = \"stack-data-vault-client-side-encryption-value-encryption-key-hash\";\nconst encryptionValuePurpose = \"stack-data-vault-client-side-encryption-value-encryption-value-encryption\";\n\n\nasync function getDerivedKey(secret: string, key: string) {\n  return await iteratedHash({\n    purpose: encryptionSecretPurpose,\n    extra: secret,\n    value: key,\n    iterations: 100_000,\n  });\n}\n\n/**\n * Use to hash the key so the server cannot infer it.\n */\nexport async function hashKey(secret: string, key: string) {\n  return encodeBase64(await hash({\n    purpose: hashPurpose,\n    extra: secret,\n    value: await getDerivedKey(secret, key),\n  }));\n}\n\n/**\n * Use to encrypt the value so that the server cannot read the value without knowing the key.\n */\nexport async function encryptValue(secret: string, key: string, value: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytes = await encrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    value: new TextEncoder().encode(value)\n  });\n  return encodeBase64(bytes);\n}\n\n/**\n * Use to decrypt the value. See encryptValue.\n */\nexport async function decryptValue(secret: string, key: string, encryptedValue: string) {\n  const valueEncryptionDerivedKey = await getDerivedKey(secret, key);\n\n  const bytesResult = await decrypt({\n    purpose: encryptionValuePurpose,\n    secret: valueEncryptionDerivedKey,\n    cipher: decodeBase64(encryptedValue),\n  });\n  if (bytesResult.status === \"error\") throw new Error(\"Data vault client-side decryption failed. Are you sure you're using the correct secret?\", { cause: bytesResult.error });\n  return new TextDecoder().decode(bytesResult.data);\n}\n\n\nimport.meta.vitest?.describe(\"encryptValue & decryptValue\", () => {\n  import.meta.vitest?.it(\"should encrypt and decrypt a value\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const decrypted = await decryptValue(secret, \"key\", encrypted);\n    expect(decrypted).toEqual(value);\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different secret\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(\"different-secret\", \"key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value with a different key\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    await expect(decryptValue(secret, \"different-key\", encrypted)).rejects.toThrow();\n  });\n\n  import.meta.vitest?.it(\"should not decrypt a value if the cipher was tampered with\", async ({ expect }) => {\n    const secret = \"test-secret\";\n    const value = \"test-value\";\n    const encrypted = await encryptValue(secret, \"key\", value);\n    const tampered = encrypted + \"7\";\n    await expect(decryptValue(secret, \"key\", tampered)).rejects.toThrow();\n  });\n});\n"],"mappings":";;;;;;AAGA,MAAM,cAAc;AACpB,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;AAG/B,eAAe,cAAc,QAAgB,KAAa;AACxD,QAAO,8CAAmB;EACxB,SAAS;EACT,OAAO;EACP,OAAO;EACP,YAAY;EACb,CAAC;;;;;AAMJ,eAAsB,QAAQ,QAAgB,KAAa;AACzD,+CAAoB,sCAAW;EAC7B,SAAS;EACT,OAAO;EACP,OAAO,MAAM,cAAc,QAAQ,IAAI;EACxC,CAAC,CAAC;;;;;AAML,eAAsB,aAAa,QAAgB,KAAa,OAAe;AAQ7E,+CALc,yCAAc;EAC1B,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,OAAO,IAAI,aAAa,CAAC,OAAO,MAAK;EACtC,CAAC,CACwB;;;;;AAM5B,eAAsB,aAAa,QAAgB,KAAa,gBAAwB;CAGtF,MAAM,cAAc,yCAAc;EAChC,SAAS;EACT,QAJgC,MAAM,cAAc,QAAQ,IAAI;EAKhE,+CAAqB,eAAe;EACrC,CAAC;AACF,KAAI,YAAY,WAAW,QAAS,OAAM,IAAI,MAAM,2FAA2F,EAAE,OAAO,YAAY,OAAO,CAAC;AAC5K,QAAO,IAAI,aAAa,CAAC,OAAO,YAAY,KAAK;;CAInD,SAAW,SAAS,qCAAqC;AACvD,WAAW,GAAC,sCAAwC,OAAO,EAAE,aAAS;EACpE,MAAM,SAAS;EACf,MAAM,QAAQ;AAGd,SADkB,MAAM,aAAa,QAAQ,OAD3B,MAAM,aAAa,QAAQ,OAAO,MAAM,CACI,CAC7C,CAAC,QAAQ,MAAM;GAChC;AAEF,WAAW,GAAC,sDAAwD,OAAO,EAAE,aAAS;AAIpF,QAAM,OAAO,aAAa,oBAAoB,OAD5B,MAAM,aAFT,eAE8B,OAD/B,aAC4C,CACK,CAAC,CAAC,QAAQ,SAAS;GAClF;AAEF,WAAW,GAAC,mDAA8C,OAAc,EAAE,aAAS;EACjF,MAAM,SAAS;AAGf,QAAM,OAAO,aAAa,QAAQ,iBADhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,CACG,CAAC,CAAC,QAAQ,SAAS;GAChF;AAEF,WAAW,GAAC,8DAAyD,OAAc,EAAE,aAAS;EAC5F,MAAM,SAAS;AAIf,QAAM,OAAO,aAAa,QAAQ,OAFhB,MAAM,aAAa,QAAQ,OAD/B,aAC4C,GAC7B,IACqB,CAAC,CAAC,QAAQ,SAAS;GACrE;EACF"}

package/dist/helpers/vault/server-side.d.ts

@@ -0,0 +1,9 @@
+//#region src/helpers/vault/server-side.d.ts
+declare function encryptWithKms(value: string): Promise<{
+  edkBase64: string;
+  ciphertextBase64: string;
+}>;
+declare function decryptWithKms(encrypted: Awaited<ReturnType<typeof encryptWithKms>>): Promise<string>;
+//#endregion
+export { decryptWithKms, encryptWithKms };
+//# sourceMappingURL=server-side.d.ts.map

package/dist/helpers/vault/server-side.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-side.d.ts","names":[],"sources":["../../../src/helpers/vault/server-side.ts"],"mappings":";iBAyHsB,cAAA,CAAe,KAAA,WAAa,OAAA;;;;iBAc5B,cAAA,CAAe,SAAA,EAAW,OAAA,CAAQ,UAAA,QAAkB,cAAA,KAAgB,OAAA"}

package/dist/helpers/vault/server-side.js

@@ -0,0 +1,126 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../../chunk-BE-pF4vm.js');
+let ______utils_bytes_js = require("../../utils/bytes.js");
+let ______utils_crypto_js = require("../../utils/crypto.js");
+let _aws_sdk_client_kms = require("@aws-sdk/client-kms");
+let ______utils_env_js = require("../../utils/env.js");
+let ______utils_results_js = require("../../utils/results.js");
+
+//#region src/helpers/vault/server-side.ts
+async function getAwsCredentials() {
+	const vercelRoleArn = (0, ______utils_env_js.getEnvVariable)("STACK_AWS_VERCEL_OIDC_ROLE_ARN", "");
+	if (vercelRoleArn) {
+		const { awsCredentialsProvider } = await import("@vercel/functions/oidc");
+		return awsCredentialsProvider({ roleArn: vercelRoleArn });
+	}
+	const gcpWifRoleArn = (0, ______utils_env_js.getEnvVariable)("STACK_AWS_GCP_WIF_ROLE_ARN", "");
+	if (gcpWifRoleArn) {
+		const { fromWebToken } = await import("@aws-sdk/credential-provider-web-identity");
+		const audience = (0, ______utils_env_js.getEnvVariable)("STACK_AWS_GCP_WIF_AUDIENCE", "sts.amazonaws.com");
+		return async () => {
+			return await fromWebToken({
+				roleArn: gcpWifRoleArn,
+				roleSessionName: "stack-backend-cloudrun",
+				webIdentityToken: await fetchGcpIdToken(audience)
+			})();
+		};
+	}
+	return {
+		accessKeyId: (0, ______utils_env_js.getEnvVariable)("STACK_AWS_ACCESS_KEY_ID"),
+		secretAccessKey: (0, ______utils_env_js.getEnvVariable)("STACK_AWS_SECRET_ACCESS_KEY")
+	};
+}
+/**
+* Fetches a GCP ID token from the metadata server (available on Cloud Run, GCE, GKE).
+* The token is a Google-signed JWT with the specified audience, suitable for
+* AWS STS AssumeRoleWithWebIdentity.
+*/
+async function fetchGcpIdToken(audience) {
+	const metadataUrl = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=${encodeURIComponent(audience)}`;
+	const response = await fetch(metadataUrl, { headers: { "Metadata-Flavor": "Google" } });
+	if (!response.ok) throw new Error(`Failed to fetch GCP ID token: ${response.status} ${await response.text()}`);
+	return await response.text();
+}
+let kmsClientCache;
+async function getKmsClient() {
+	if (!kmsClientCache) kmsClientCache = new _aws_sdk_client_kms.KMSClient({
+		region: (0, ______utils_env_js.getEnvVariable)("STACK_AWS_REGION"),
+		endpoint: (0, ______utils_env_js.getEnvVariable)("STACK_AWS_KMS_ENDPOINT"),
+		credentials: await getAwsCredentials()
+	});
+	return kmsClientCache;
+}
+async function getOrCreateKekId() {
+	const id = "alias/stack-data-vault-server-side-kek";
+	const kms = await getKmsClient();
+	try {
+		const describeResult = await kms.send(new _aws_sdk_client_kms.DescribeKeyCommand({ KeyId: id }));
+		if (describeResult.KeyMetadata?.KeyId) return describeResult.KeyMetadata.KeyId;
+	} catch (e) {
+		if (e instanceof Error && e.name !== "NotFoundException") throw e;
+	}
+	const { KeyMetadata } = await kms.send(new _aws_sdk_client_kms.CreateKeyCommand({
+		KeyUsage: "ENCRYPT_DECRYPT",
+		Description: "DataVault KEK"
+	}));
+	await kms.send(new _aws_sdk_client_kms.CreateAliasCommand({
+		AliasName: id,
+		TargetKeyId: KeyMetadata.KeyId
+	}));
+	return id;
+}
+async function genDEK() {
+	const kekId = await getOrCreateKekId();
+	const out = await (await getKmsClient()).send(new _aws_sdk_client_kms.GenerateDataKeyCommand({
+		KeyId: kekId,
+		KeySpec: "AES_256"
+	}));
+	if (!out.Plaintext || !out.CiphertextBlob) throw new Error("GenerateDataKey failed");
+	return {
+		dekBytes: out.Plaintext,
+		edkBytes: out.CiphertextBlob
+	};
+}
+async function unwrapDEK(edk_b64) {
+	const edkBytes = (0, ______utils_bytes_js.decodeBase64)(edk_b64);
+	const out = await (await getKmsClient()).send(new _aws_sdk_client_kms.DecryptCommand({ CiphertextBlob: edkBytes }));
+	if (!out.Plaintext) throw new Error("KMS Decrypt failed");
+	return {
+		dekBytes: out.Plaintext,
+		edkBytes
+	};
+}
+async function encryptWithKms(value) {
+	const { dekBytes, edkBytes } = await genDEK();
+	try {
+		const ciphertext = await (0, ______utils_crypto_js.encrypt)({
+			purpose: "stack-data-vault-server-side-encryption",
+			secret: dekBytes,
+			value: new TextEncoder().encode(value)
+		});
+		return {
+			edkBase64: (0, ______utils_bytes_js.encodeBase64)(edkBytes),
+			ciphertextBase64: (0, ______utils_bytes_js.encodeBase64)(ciphertext)
+		};
+	} finally {
+		dekBytes.fill(0);
+	}
+}
+async function decryptWithKms(encrypted) {
+	const { dekBytes } = await unwrapDEK(encrypted.edkBase64);
+	try {
+		const value = ______utils_results_js.Result.orThrow(await (0, ______utils_crypto_js.decrypt)({
+			purpose: "stack-data-vault-server-side-encryption",
+			secret: dekBytes,
+			cipher: (0, ______utils_bytes_js.decodeBase64)(encrypted.ciphertextBase64)
+		}));
+		return new TextDecoder().decode(value);
+	} finally {
+		dekBytes.fill(0);
+	}
+}
+
+//#endregion
+exports.decryptWithKms = decryptWithKms;
+exports.encryptWithKms = encryptWithKms;
+//# sourceMappingURL=server-side.js.map

package/dist/helpers/vault/server-side.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-side.js","names":["KMSClient","DescribeKeyCommand","CreateKeyCommand","CreateAliasCommand","GenerateDataKeyCommand","DecryptCommand","Result"],"sources":["../../../src/helpers/vault/server-side.ts"],"sourcesContent":["import {\n  CreateAliasCommand,\n  CreateKeyCommand,\n  DecryptCommand,\n  DescribeKeyCommand,\n  GenerateDataKeyCommand,\n  KMSClient\n} from \"@aws-sdk/client-kms\";\nimport { decodeBase64, encodeBase64 } from \"../../utils/bytes\";\nimport { decrypt, encrypt } from \"../../utils/crypto\";\nimport { getEnvVariable } from \"../../utils/env\";\nimport { Result } from \"../../utils/results\";\n\n\nasync function getAwsCredentials() {\n  // 1. Vercel OIDC: Vercel injects an OIDC token that can be exchanged for AWS credentials\n  const vercelRoleArn = getEnvVariable(\"STACK_AWS_VERCEL_OIDC_ROLE_ARN\", \"\");\n  if (vercelRoleArn) {\n    const { awsCredentialsProvider } = await import(\"@vercel/functions/oidc\");\n    return awsCredentialsProvider({ roleArn: vercelRoleArn });\n  }\n\n  // 2. GCP Workload Identity Federation: Cloud Run gets a GCP ID token from the metadata server,\n  //    then exchanges it for temporary AWS credentials via STS AssumeRoleWithWebIdentity.\n  //    Requires:\n  //      - An OIDC identity provider in AWS IAM (issuer: https://accounts.google.com)\n  //      - An IAM role with a trust policy allowing the GCP service account\n  //      - STACK_AWS_GCP_WIF_ROLE_ARN set to that role's ARN\n  //      - STACK_AWS_GCP_WIF_AUDIENCE set to the audience configured in the AWS OIDC provider\n  const gcpWifRoleArn = getEnvVariable(\"STACK_AWS_GCP_WIF_ROLE_ARN\", \"\");\n  if (gcpWifRoleArn) {\n    const { fromWebToken } = await import(\"@aws-sdk/credential-provider-web-identity\");\n    const audience = getEnvVariable(\"STACK_AWS_GCP_WIF_AUDIENCE\", \"sts.amazonaws.com\");\n    // Return a provider that fetches a fresh GCP ID token on each invocation.\n    // GCP metadata tokens expire after ~1h, so we can't bake a single token into the closure.\n    return async () => {\n      return await fromWebToken({\n        roleArn: gcpWifRoleArn,\n        roleSessionName: \"stack-backend-cloudrun\",\n        webIdentityToken: await fetchGcpIdToken(audience),\n      })();\n    };\n  }\n\n  // 3. Static credentials: fallback for self-hosted / local development\n  return {\n    accessKeyId: getEnvVariable(\"STACK_AWS_ACCESS_KEY_ID\"),\n    secretAccessKey: getEnvVariable(\"STACK_AWS_SECRET_ACCESS_KEY\"),\n  };\n}\n\n/**\n * Fetches a GCP ID token from the metadata server (available on Cloud Run, GCE, GKE).\n * The token is a Google-signed JWT with the specified audience, suitable for\n * AWS STS AssumeRoleWithWebIdentity.\n */\nasync function fetchGcpIdToken(audience: string): Promise<string> {\n  const metadataUrl = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=${encodeURIComponent(audience)}`;\n  const response = await fetch(metadataUrl, {\n    headers: { \"Metadata-Flavor\": \"Google\" },\n  });\n  if (!response.ok) {\n    throw new Error(`Failed to fetch GCP ID token: ${response.status} ${await response.text()}`);\n  }\n  return await response.text();\n}\n\nlet kmsClientCache: KMSClient | undefined;\n\nasync function getKmsClient() {\n  if (!kmsClientCache) {\n    kmsClientCache = new KMSClient({\n      region: getEnvVariable(\"STACK_AWS_REGION\"),\n      endpoint: getEnvVariable(\"STACK_AWS_KMS_ENDPOINT\"),\n      credentials: await getAwsCredentials(),\n    });\n  }\n  return kmsClientCache;\n}\n\nasync function getOrCreateKekId(): Promise<string> {\n  const id = \"alias/stack-data-vault-server-side-kek\";\n  const kms = await getKmsClient();\n  try {\n    const describeResult = await kms.send(new DescribeKeyCommand({ KeyId: id }));\n    if (describeResult.KeyMetadata?.KeyId) return describeResult.KeyMetadata.KeyId;\n  } catch (e) {\n    if (e instanceof Error && e.name !== \"NotFoundException\") {\n      throw e;\n    }\n  }\n  const { KeyMetadata } = await kms.send(new CreateKeyCommand({\n    KeyUsage: \"ENCRYPT_DECRYPT\",\n    Description: \"DataVault KEK\"\n  }));\n  await kms.send(new CreateAliasCommand({ AliasName: id, TargetKeyId: KeyMetadata!.KeyId! }));\n  return id;\n}\n\nasync function genDEK() {\n  const kekId = await getOrCreateKekId();\n  const kms = await getKmsClient();\n  const out = await kms.send(new GenerateDataKeyCommand({ KeyId: kekId, KeySpec: \"AES_256\" }));\n  if (!out.Plaintext || !out.CiphertextBlob) throw new Error(\"GenerateDataKey failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes: out.CiphertextBlob,\n  };\n}\n\nasync function unwrapDEK(edk_b64: string) {\n  const edkBytes = decodeBase64(edk_b64);\n  const kms = await getKmsClient();\n  const out = await kms.send(new DecryptCommand({ CiphertextBlob: edkBytes }));\n  if (!out.Plaintext) throw new Error(\"KMS Decrypt failed\");\n  return {\n    dekBytes: out.Plaintext,\n    edkBytes,\n  };\n}\n\nexport async function encryptWithKms(value: string) {\n  const { dekBytes, edkBytes } = await genDEK();\n  try {\n    const ciphertext = await encrypt({\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      value: new TextEncoder().encode(value),\n    });\n    return { edkBase64: encodeBase64(edkBytes), ciphertextBase64: encodeBase64(ciphertext) };\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n\nexport async function decryptWithKms(encrypted: Awaited<ReturnType<typeof encryptWithKms>>) {\n  const { dekBytes } = await unwrapDEK(encrypted.edkBase64);\n  try {\n    const value = Result.orThrow(await decrypt({\n      purpose: \"stack-data-vault-server-side-encryption\",\n      secret: dekBytes,\n      cipher: decodeBase64(encrypted.ciphertextBase64),\n    }));\n    return new TextDecoder().decode(value);\n  } finally {\n    dekBytes.fill(0);\n  }\n}\n"],"mappings":";;;;;;;;;AAcA,eAAe,oBAAoB;CAEjC,MAAM,uDAA+B,kCAAkC,GAAG;AAC1E,KAAI,eAAe;EACjB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,SAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC;;CAU3D,MAAM,uDAA+B,8BAA8B,GAAG;AACtE,KAAI,eAAe;EACjB,MAAM,EAAE,iBAAiB,MAAM,OAAO;EACtC,MAAM,kDAA0B,8BAA8B,oBAAoB;AAGlF,SAAO,YAAY;AACjB,UAAO,MAAM,aAAa;IACxB,SAAS;IACT,iBAAiB;IACjB,kBAAkB,MAAM,gBAAgB,SAAS;IAClD,CAAC,EAAE;;;AAKR,QAAO;EACL,oDAA4B,0BAA0B;EACtD,wDAAgC,8BAA8B;EAC/D;;;;;;;AAQH,eAAe,gBAAgB,UAAmC;CAChE,MAAM,cAAc,0GAA0G,mBAAmB,SAAS;CAC1J,MAAM,WAAW,MAAM,MAAM,aAAa,EACxC,SAAS,EAAE,mBAAmB,UAAU,EACzC,CAAC;AACF,KAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,iCAAiC,SAAS,OAAO,GAAG,MAAM,SAAS,MAAM,GAAG;AAE9F,QAAO,MAAM,SAAS,MAAM;;AAG9B,IAAI;AAEJ,eAAe,eAAe;AAC5B,KAAI,CAAC,eACH,kBAAiB,IAAIA,8BAAU;EAC7B,+CAAuB,mBAAmB;EAC1C,iDAAyB,yBAAyB;EAClD,aAAa,MAAM,mBAAmB;EACvC,CAAC;AAEJ,QAAO;;AAGT,eAAe,mBAAoC;CACjD,MAAM,KAAK;CACX,MAAM,MAAM,MAAM,cAAc;AAChC,KAAI;EACF,MAAM,iBAAiB,MAAM,IAAI,KAAK,IAAIC,uCAAmB,EAAE,OAAO,IAAI,CAAC,CAAC;AAC5E,MAAI,eAAe,aAAa,MAAO,QAAO,eAAe,YAAY;UAClE,GAAG;AACV,MAAI,aAAa,SAAS,EAAE,SAAS,oBACnC,OAAM;;CAGV,MAAM,EAAE,gBAAgB,MAAM,IAAI,KAAK,IAAIC,qCAAiB;EAC1D,UAAU;EACV,aAAa;EACd,CAAC,CAAC;AACH,OAAM,IAAI,KAAK,IAAIC,uCAAmB;EAAE,WAAW;EAAI,aAAa,YAAa;EAAQ,CAAC,CAAC;AAC3F,QAAO;;AAGT,eAAe,SAAS;CACtB,MAAM,QAAQ,MAAM,kBAAkB;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,2CAAuB;EAAE,OAAO;EAAO,SAAS;EAAW,CAAC,CAAC;AAC5F,KAAI,CAAC,IAAI,aAAa,CAAC,IAAI,eAAgB,OAAM,IAAI,MAAM,yBAAyB;AACpF,QAAO;EACL,UAAU,IAAI;EACd,UAAU,IAAI;EACf;;AAGH,eAAe,UAAU,SAAiB;CACxC,MAAM,kDAAwB,QAAQ;CAEtC,MAAM,MAAM,OADA,MAAM,cAAc,EACV,KAAK,IAAIC,mCAAe,EAAE,gBAAgB,UAAU,CAAC,CAAC;AAC5E,KAAI,CAAC,IAAI,UAAW,OAAM,IAAI,MAAM,qBAAqB;AACzD,QAAO;EACL,UAAU,IAAI;EACd;EACD;;AAGH,eAAsB,eAAe,OAAe;CAClD,MAAM,EAAE,UAAU,aAAa,MAAM,QAAQ;AAC7C,KAAI;EACF,MAAM,aAAa,yCAAc;GAC/B,SAAS;GACT,QAAQ;GACR,OAAO,IAAI,aAAa,CAAC,OAAO,MAAM;GACvC,CAAC;AACF,SAAO;GAAE,kDAAwB,SAAS;GAAE,yDAA+B,WAAW;GAAE;WAChF;AACR,WAAS,KAAK,EAAE;;;AAIpB,eAAsB,eAAe,WAAuD;CAC1F,MAAM,EAAE,aAAa,MAAM,UAAU,UAAU,UAAU;AACzD,KAAI;EACF,MAAM,QAAQC,8BAAO,QAAQ,yCAAc;GACzC,SAAS;GACT,QAAQ;GACR,+CAAqB,UAAU,iBAAiB;GACjD,CAAC,CAAC;AACH,SAAO,IAAI,aAAa,CAAC,OAAO,MAAM;WAC9B;AACR,WAAS,KAAK,EAAE"}

package/dist/hooks/use-async-callback.d.ts

@@ -0,0 +1,8 @@
+import React from "react";
+
+//#region src/hooks/use-async-callback.d.ts
+declare function useAsyncCallback<A extends any[], R>(callback: (...args: A) => Promise<R>, deps: React.DependencyList): [cb: (...args: A) => Promise<R>, loading: boolean, error: unknown | undefined];
+declare function useAsyncCallbackWithLoggedError<A extends any[], R>(callback: (...args: A) => Promise<R>, deps: React.DependencyList): [cb: (...args: A) => Promise<R>, loading: boolean];
+//#endregion
+export { useAsyncCallback, useAsyncCallbackWithLoggedError };
+//# sourceMappingURL=use-async-callback.d.ts.map

package/dist/hooks/use-async-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-async-callback.d.ts","names":[],"sources":["../../src/hooks/use-async-callback.tsx"],"mappings":";;;iBAGgB,gBAAA,oBAAA,CACd,QAAA,MAAc,IAAA,EAAM,CAAA,KAAM,OAAA,CAAQ,CAAA,GAClC,IAAA,EAAM,KAAA,CAAM,cAAA,IACV,EAAA,MAAQ,IAAA,EAAM,CAAA,KAAM,OAAA,CAAQ,CAAA,GAAI,OAAA,WAAkB,KAAA;AAAA,iBAsBtC,+BAAA,oBAAA,CACd,QAAA,MAAc,IAAA,EAAM,CAAA,KAAM,OAAA,CAAQ,CAAA,GAClC,IAAA,EAAM,KAAA,CAAM,cAAA,IACV,EAAA,MAAQ,IAAA,EAAM,CAAA,KAAM,OAAA,CAAQ,CAAA,GAAI,OAAA"}

package/dist/hooks/use-async-callback.js

@@ -0,0 +1,42 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let react = require("react");
+react = require_chunk.__toESM(react);
+let ___utils_errors_js = require("../utils/errors.js");
+
+//#region src/hooks/use-async-callback.tsx
+function useAsyncCallback(callback, deps) {
+	const [error, setError] = react.default.useState(void 0);
+	const [loadingCount, setLoadingCount] = react.default.useState(0);
+	return [
+		react.default.useCallback(async (...args) => {
+			setLoadingCount((c) => c + 1);
+			try {
+				return await callback(...args);
+			} catch (e) {
+				setError(e);
+				throw e;
+			} finally {
+				setLoadingCount((c) => c - 1);
+			}
+		}, deps),
+		loadingCount > 0,
+		error
+	];
+}
+function useAsyncCallbackWithLoggedError(callback, deps) {
+	const [newCallback, loading] = useAsyncCallback(async (...args) => {
+		try {
+			return await callback(...args);
+		} catch (e) {
+			(0, ___utils_errors_js.captureError)("async-callback", e);
+			throw e;
+		}
+	}, deps);
+	return [newCallback, loading];
+}
+
+//#endregion
+exports.useAsyncCallback = useAsyncCallback;
+exports.useAsyncCallbackWithLoggedError = useAsyncCallbackWithLoggedError;
+//# sourceMappingURL=use-async-callback.js.map

package/dist/hooks/use-async-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-async-callback.js","names":["React"],"sources":["../../src/hooks/use-async-callback.tsx"],"sourcesContent":["import React from \"react\";\nimport { captureError } from \"../utils/errors\";\n\nexport function useAsyncCallback<A extends any[], R>(\n  callback: (...args: A) => Promise<R>,\n  deps: React.DependencyList\n): [cb: (...args: A) => Promise<R>, loading: boolean, error: unknown | undefined] {\n  const [error, setError] = React.useState<unknown | undefined>(undefined);\n  const [loadingCount, setLoadingCount] = React.useState(0);\n\n  const cb = React.useCallback(\n    async (...args: A) => {\n      setLoadingCount((c) => c + 1);\n      try {\n        return await callback(...args);\n      } catch (e) {\n        setError(e);\n        throw e;\n      } finally {\n        setLoadingCount((c) => c - 1);\n      }\n    },\n    deps,\n  );\n\n  return [cb, loadingCount > 0, error];\n}\n\nexport function useAsyncCallbackWithLoggedError<A extends any[], R>(\n  callback: (...args: A) => Promise<R>,\n  deps: React.DependencyList\n): [cb: (...args: A) => Promise<R>, loading: boolean] {\n  const [newCallback, loading] = useAsyncCallback<A, R>(async (...args) => {\n    try {\n      return await callback(...args);\n    } catch (e) {\n      captureError(\"async-callback\", e);\n      throw e;\n    }\n  }, deps);\n\n  return [newCallback, loading];\n}\n"],"mappings":";;;;;;;AAGA,SAAgB,iBACd,UACA,MACgF;CAChF,MAAM,CAAC,OAAO,YAAYA,cAAM,SAA8B,OAAU;CACxE,MAAM,CAAC,cAAc,mBAAmBA,cAAM,SAAS,EAAE;AAiBzD,QAAO;EAfIA,cAAM,YACf,OAAO,GAAG,SAAY;AACpB,oBAAiB,MAAM,IAAI,EAAE;AAC7B,OAAI;AACF,WAAO,MAAM,SAAS,GAAG,KAAK;YACvB,GAAG;AACV,aAAS,EAAE;AACX,UAAM;aACE;AACR,qBAAiB,MAAM,IAAI,EAAE;;KAGjC,KACD;EAEW,eAAe;EAAG;EAAM;;AAGtC,SAAgB,gCACd,UACA,MACoD;CACpD,MAAM,CAAC,aAAa,WAAW,iBAAuB,OAAO,GAAG,SAAS;AACvE,MAAI;AACF,UAAO,MAAM,SAAS,GAAG,KAAK;WACvB,GAAG;AACV,wCAAa,kBAAkB,EAAE;AACjC,SAAM;;IAEP,KAAK;AAER,QAAO,CAAC,aAAa,QAAQ"}

package/dist/hooks/use-async-external-store.d.ts

@@ -0,0 +1,9 @@
+import { AsyncResult } from "../utils/results.js";
+
+//#region src/hooks/use-async-external-store.d.ts
+declare function useAsyncExternalStore<T>(subscribe: (callback: (t: T) => void) => (() => void)): AsyncResult<T, never> & {
+  status: "ok" | "pending";
+};
+//#endregion
+export { useAsyncExternalStore };
+//# sourceMappingURL=use-async-external-store.d.ts.map

package/dist/hooks/use-async-external-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-async-external-store.d.ts","names":[],"sources":["../../src/hooks/use-async-external-store.tsx"],"mappings":";;;iBAGgB,qBAAA,GAAA,CACd,SAAA,GAAY,QAAA,GAAW,CAAA,EAAG,CAAA,6BACzB,WAAA,CAAY,CAAA;EAAc,MAAA;AAAA"}

package/dist/hooks/use-async-external-store.js

@@ -0,0 +1,22 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let react = require("react");
+let ___utils_results_js = require("../utils/results.js");
+
+//#region src/hooks/use-async-external-store.tsx
+function useAsyncExternalStore(subscribe) {
+	const [isAvailable, setIsAvailable] = (0, react.useState)(false);
+	const [value, setValue] = (0, react.useState)();
+	(0, react.useEffect)(() => {
+		return subscribe((value) => {
+			setValue(() => value);
+			setIsAvailable(() => true);
+		});
+	}, [subscribe]);
+	if (isAvailable) return ___utils_results_js.AsyncResult.ok(value);
+	else return ___utils_results_js.AsyncResult.pending();
+}
+
+//#endregion
+exports.useAsyncExternalStore = useAsyncExternalStore;
+//# sourceMappingURL=use-async-external-store.js.map

package/dist/hooks/use-async-external-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-async-external-store.js","names":["AsyncResult"],"sources":["../../src/hooks/use-async-external-store.tsx"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { AsyncResult } from \"../utils/results\";\n\nexport function useAsyncExternalStore<T>(\n  subscribe: (callback: (t: T) => void) => (() => void),\n): AsyncResult<T, never> & { status: \"ok\" | \"pending\" } {\n  // sure, the \"sync\" in useSyncExternalStore refers to \"synchronize a store\" and not \"sync/async\", but it's too good of a name to pass up on\n\n  const [isAvailable, setIsAvailable] = useState(false);\n  const [value, setValue] = useState<T>();\n  useEffect(() => {\n    const unsubscribe = subscribe((value: T) => {\n      setValue(() => value);\n      setIsAvailable(() => true);\n    });\n    return unsubscribe;\n  }, [subscribe]);\n\n  if (isAvailable) {\n    return AsyncResult.ok(value as T);\n  } else {\n    return AsyncResult.pending();\n  }\n}\n"],"mappings":";;;;;;AAGA,SAAgB,sBACd,WACsD;CAGtD,MAAM,CAAC,aAAa,sCAA2B,MAAM;CACrD,MAAM,CAAC,OAAO,iCAAyB;AACvC,4BAAgB;AAKd,SAJoB,WAAW,UAAa;AAC1C,kBAAe,MAAM;AACrB,wBAAqB,KAAK;IAC1B;IAED,CAAC,UAAU,CAAC;AAEf,KAAI,YACF,QAAOA,gCAAY,GAAG,MAAW;KAEjC,QAAOA,gCAAY,SAAS"}

package/dist/hooks/use-hash.d.ts

@@ -0,0 +1,5 @@
+//#region src/hooks/use-hash.d.ts
+declare const useHash: () => string;
+//#endregion
+export { useHash };
+//# sourceMappingURL=use-hash.d.ts.map

package/dist/hooks/use-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-hash.d.ts","names":[],"sources":["../../src/hooks/use-hash.tsx"],"mappings":";cAGa,OAAA"}

package/dist/hooks/use-hash.js

@@ -0,0 +1,17 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BE-pF4vm.js');
+let react = require("react");
+let ___utils_react_js = require("../utils/react.js");
+
+//#region src/hooks/use-hash.tsx
+const useHash = () => {
+	(0, ___utils_react_js.suspendIfSsr)("useHash");
+	return (0, react.useSyncExternalStore)((onChange) => {
+		const interval = setInterval(() => onChange(), 10);
+		return () => clearInterval(interval);
+	}, () => window.location.hash.substring(1));
+};
+
+//#endregion
+exports.useHash = useHash;
+//# sourceMappingURL=use-hash.js.map

package/dist/hooks/use-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-hash.js","names":[],"sources":["../../src/hooks/use-hash.tsx"],"sourcesContent":["import { useSyncExternalStore } from \"react\";\nimport { suspendIfSsr } from \"../utils/react\";\n\nexport const useHash = () => {\n  suspendIfSsr(\"useHash\");\n  return useSyncExternalStore(\n    (onChange) => {\n      const interval = setInterval(() => onChange(), 10);\n      return () => clearInterval(interval);\n    },\n    () => window.location.hash.substring(1)\n  );\n};\n\n"],"mappings":";;;;;;AAGA,MAAa,gBAAgB;AAC3B,qCAAa,UAAU;AACvB,yCACG,aAAa;EACZ,MAAM,WAAW,kBAAkB,UAAU,EAAE,GAAG;AAClD,eAAa,cAAc,SAAS;UAEhC,OAAO,SAAS,KAAK,UAAU,EAAE,CACxC"}

package/dist/hooks/use-hover.d.ts

@@ -0,0 +1,8 @@
+//#region src/hooks/use-hover.d.ts
+declare function useHover<T extends HTMLElement>(ref: React.RefObject<T>, options?: {
+  onMouseEnter?: () => void;
+  onMouseLeave?: () => void;
+}): boolean;
+//#endregion
+export { useHover };
+//# sourceMappingURL=use-hover.d.ts.map

package/dist/hooks/use-hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-hover.d.ts","names":[],"sources":["../../src/hooks/use-hover.tsx"],"mappings":";iBAGgB,QAAA,WAAmB,WAAA,CAAA,CACjC,GAAA,EAAK,KAAA,CAAM,SAAA,CAAU,CAAA,GACrB,OAAA;EACE,YAAA;EACA,YAAA;AAAA"}