@jcoder-stack/abp-react 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 the abp-react-start authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,86 @@
+# @jcoder-stack/abp-react
+
+`abp-react-start` 的运行时内核——从零自研的纯 React ABP 前端框架，总览见仓库根 README。
+
+各域按**子路径**导出，没有把所有东西糊在一起的根导出：一个根导出会让纯前端的 bundle 拖进 `proxy`/`auth` 这类服务端代码。
+
+| 子路径 | 职责 |
+| --- | --- |
+| `@jcoder-stack/abp-react/logger` | 同构日志：作用域、字段绑定、默认脱敏、env 开关 |
+| `@jcoder-stack/abp-react/core` | ABP 线上格式归一：application-configuration 的类型 + zod（容错解析）、`PagedResult<T>`、错误信封（`HttpError`/`toHttpError`） |
+| `@jcoder-stack/abp-react/auth` | 授权认证核心：登录策略层（OIDC/password）+ 会话层（加密分块 cookie、刷新、登出）；宿主无关、后端无关 |
+| `@jcoder-stack/abp-react/proxy` | ABP 代理网关与调用层：贴 Bearer 转发、401→刷新→重放、幂等重试、超时；策略头组装、会话代调、身份派生；ABP auth 运行时工厂 `createAbpAuthRuntime` 与登录/回调/登出/文化/租户 handler |
+| `@jcoder-stack/abp-react/permissions` | 权限判定原语 `isGranted` + 变参 checker |
+| `@jcoder-stack/abp-react/i18n` | 两层合并 translator（后端 ABP 资源覆盖前端词库），可注入 interpolate/plural |
+| `@jcoder-stack/abp-react/react` | `AppConfigProvider` / `SessionProvider` + hooks（用户/权限/设置/特性/本地化/菜单）+ `<PermissionGuard>`/`<FeatureGuard>` |
+| `@jcoder-stack/abp-react/router` | TanStack Router beforeLoad 路由守卫 `requireAuth` / `requirePermission` |
+
+## 安装
+
+```bash
+bun add @jcoder-stack/abp-react
+```
+
+多数项目是配合 `@jcoder-stack/cli` 使用的——`jc-abp init` 会把接线代码落进你的项目，之后这些文件归你维护。手工接线见下。
+
+## peerDependencies
+
+`react`、`@tanstack/react-router`、`zod` 三者全部声明为 **optional** peer：纯 BFF 消费者只用 `/proxy`、`/auth`，不该被逼装 React 与 router；纯前端消费者只用 `/react`、`/i18n`，也不该被逼装 zod。装哪几个由你实际用到的子路径决定，缺的那些包管理器不会报警。
+
+## 用法
+
+### 服务端：auth 运行时
+
+`createAbpAuthRuntime` 从环境变量读配置（`AUTH_ISSUER`、`AUTH_CLIENT_ID`、`AUTH_SESSION_SECRET`、`AUTH_REDIRECT_URI`、`AUTH_ABP_BASE_URL`），返回登录/回调/登出所需的一切。每个覆盖项都有默认值：
+
+```ts
+import { createAbpAuthRuntime } from "@jcoder-stack/abp-react/proxy";
+
+export const createRuntime = () =>
+  createAbpAuthRuntime(process.env, {
+    // cookies: { session: { name: "myapp_session", maxAge: 60 * 60 * 24 * 14 } },
+    // strategies: { password: false },
+    // proxy: { timeoutMs: 10_000, retries: 1 },
+    // session: { skewSeconds: 30, coalesceTtlMs: 5_000 },
+  });
+```
+
+`AUTH_SESSION_SECRET` 至少 32 字符——会话 cookie 用它经 HKDF 派生 AES-GCM 密钥，短于此长度会直接抛错而非静默产出弱密钥。
+
+### 客户端：Provider 与 hooks
+
+两个 Provider 分开挂：配置（本地化/设置/特性）与身份的失效时机不同，合成一个会让身份刷新连带重建 translator。
+
+```tsx
+import { AppConfigProvider, SessionProvider } from "@jcoder-stack/abp-react/react";
+
+<AppConfigProvider config={appState.config} messages={messages} fallbackCulture="en">
+  <SessionProvider identity={appState.identity} fetchIdentity={fetchIdentity}>
+    {children}
+  </SessionProvider>
+</AppConfigProvider>;
+```
+
+`messages` 需引用稳定（模块常量或 `useMemo`）——它参与 translator 的重建判定。回调 props（`onMissingKey`、`createTranslator`）经 ref 读取，写成内联箭头函数不会导致 context 重建。
+
+### 路由守卫
+
+```ts
+import { requireAuth, requirePermission } from "@jcoder-stack/abp-react/router";
+
+export const Route = createFileRoute("/_layout/_authed")({
+  beforeLoad: requireAuth(),
+});
+```
+
+守卫是**纯 UX**——真正的安全判定在 ABP 服务端。`requirePermission` 缺权限时跳 `/forbidden`；匿名用户没有任何 grantedPolicies，默认也会落到 403，传 `loginPath` 可让未认证访客先去登录：
+
+```ts
+beforeLoad: requirePermission(IdentityPermissions.Users.Default, {
+  loginPath: "/api/auth/login",
+});
+```
+
+推荐的做法仍是把受保护页面挂在一个跑 `requireAuth()` 的父路由下，`loginPath` 用于单独使用 `requirePermission` 的场景。
+
+两者都要求祖先路由的 `beforeLoad` 已把 `identity` 放进 route context；没放会抛出带指引的错误而不是静默放行。

package/dist/application-configuration-DhOZRqtz.d.ts

@@ -0,0 +1,170 @@
+import { z } from 'zod';
+
+declare const currentUserSchema: z.ZodObject<{
+    isAuthenticated: z.ZodBoolean;
+    id: z.ZodNullable<z.ZodString>;
+    userName: z.ZodNullable<z.ZodString>;
+    tenantId: z.ZodNullable<z.ZodString>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    surName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    emailVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    phoneNumber: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    phoneNumberVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    sessionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    impersonatorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    impersonatorTenantId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    impersonatorUserName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    impersonatorTenantName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roles: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>, z.ZodTransform<string[], string[] | null | undefined>>;
+}, z.core.$strip>;
+type CurrentUser = z.infer<typeof currentUserSchema>;
+declare const currentTenantSchema: z.ZodObject<{
+    id: z.ZodNullable<z.ZodString>;
+    name: z.ZodNullable<z.ZodString>;
+    isAvailable: z.ZodBoolean;
+}, z.core.$strip>;
+type CurrentTenant = z.infer<typeof currentTenantSchema>;
+declare const localizationSchema: z.ZodCatch<z.ZodObject<{
+    currentCulture: z.ZodCatch<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>>;
+    defaultResourceName: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    languages: z.ZodCatch<z.ZodPipe<z.ZodArray<z.ZodCatch<z.ZodNullable<z.ZodObject<{
+        cultureName: z.ZodString;
+        displayName: z.ZodString;
+    }, z.core.$strip>>>>, z.ZodTransform<{
+        cultureName: string;
+        displayName: string;
+    }[], ({
+        cultureName: string;
+        displayName: string;
+    } | null)[]>>>;
+    values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+}, z.core.$strip>>;
+type Localization = z.infer<typeof localizationSchema>;
+declare const applicationConfigurationShape: {
+    currentUser: z.ZodObject<{
+        isAuthenticated: z.ZodBoolean;
+        id: z.ZodNullable<z.ZodString>;
+        userName: z.ZodNullable<z.ZodString>;
+        tenantId: z.ZodNullable<z.ZodString>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        surName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        emailVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        phoneNumber: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        phoneNumberVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        sessionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorTenantId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorUserName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorTenantName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        roles: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>, z.ZodTransform<string[], string[] | null | undefined>>;
+    }, z.core.$strip>;
+    auth: z.ZodPipe<z.ZodNullable<z.ZodObject<{
+        grantedPolicies: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodBoolean>>>, z.ZodTransform<Record<string, boolean>, Record<string, boolean> | null | undefined>>;
+    }, z.core.$strip>>, z.ZodTransform<{
+        grantedPolicies: Record<string, boolean>;
+    }, {
+        grantedPolicies: Record<string, boolean>;
+    } | null>>;
+    setting: z.ZodCatch<z.ZodObject<{
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodCatch<z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>>>>;
+    }, z.core.$strip>>;
+    localization: z.ZodCatch<z.ZodObject<{
+        currentCulture: z.ZodCatch<z.ZodObject<{
+            name: z.ZodString;
+        }, z.core.$strip>>;
+        defaultResourceName: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        languages: z.ZodCatch<z.ZodPipe<z.ZodArray<z.ZodCatch<z.ZodNullable<z.ZodObject<{
+            cultureName: z.ZodString;
+            displayName: z.ZodString;
+        }, z.core.$strip>>>>, z.ZodTransform<{
+            cultureName: string;
+            displayName: string;
+        }[], ({
+            cultureName: string;
+            displayName: string;
+        } | null)[]>>>;
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    }, z.core.$strip>>;
+    currentTenant: z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+        name: z.ZodNullable<z.ZodString>;
+        isAvailable: z.ZodBoolean;
+    }, z.core.$strip>;
+    features: z.ZodCatch<z.ZodObject<{
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodCatch<z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>>>>;
+    }, z.core.$strip>>;
+};
+/** Runtime schema preserves unknown top-level keys (extraProperties / custom contributors); the exported type omits that index signature so server-fn return values stay serializable. */
+declare const applicationConfigurationSchema: z.ZodObject<{
+    currentUser: z.ZodObject<{
+        isAuthenticated: z.ZodBoolean;
+        id: z.ZodNullable<z.ZodString>;
+        userName: z.ZodNullable<z.ZodString>;
+        tenantId: z.ZodNullable<z.ZodString>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        surName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        emailVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        phoneNumber: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        phoneNumberVerified: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        sessionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorTenantId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorUserName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        impersonatorTenantName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        roles: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>, z.ZodTransform<string[], string[] | null | undefined>>;
+    }, z.core.$strip>;
+    auth: z.ZodPipe<z.ZodNullable<z.ZodObject<{
+        grantedPolicies: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodBoolean>>>, z.ZodTransform<Record<string, boolean>, Record<string, boolean> | null | undefined>>;
+    }, z.core.$strip>>, z.ZodTransform<{
+        grantedPolicies: Record<string, boolean>;
+    }, {
+        grantedPolicies: Record<string, boolean>;
+    } | null>>;
+    setting: z.ZodCatch<z.ZodObject<{
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodCatch<z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>>>>;
+    }, z.core.$strip>>;
+    localization: z.ZodCatch<z.ZodObject<{
+        currentCulture: z.ZodCatch<z.ZodObject<{
+            name: z.ZodString;
+        }, z.core.$strip>>;
+        defaultResourceName: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+        languages: z.ZodCatch<z.ZodPipe<z.ZodArray<z.ZodCatch<z.ZodNullable<z.ZodObject<{
+            cultureName: z.ZodString;
+            displayName: z.ZodString;
+        }, z.core.$strip>>>>, z.ZodTransform<{
+            cultureName: string;
+            displayName: string;
+        }[], ({
+            cultureName: string;
+            displayName: string;
+        } | null)[]>>>;
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    }, z.core.$strip>>;
+    currentTenant: z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+        name: z.ZodNullable<z.ZodString>;
+        isAvailable: z.ZodBoolean;
+    }, z.core.$strip>;
+    features: z.ZodCatch<z.ZodObject<{
+        values: z.ZodCatch<z.ZodRecord<z.ZodString, z.ZodCatch<z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>>>>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+type ApplicationConfiguration = z.infer<z.ZodObject<typeof applicationConfigurationShape>>;
+/** Parse ABP application-configuration.
+ *
+ *  Unknown top-level keys pass through. The setting, localization and features subtrees degrade
+ *  per leaf on shape drift, so one bad language entry or setting value never empties its table.
+ *  A null auth subtree (or null grantedPolicies) reads as nothing granted.
+ *
+ *  Degradations go to `opts.onError`. A hard failure (a broken currentUser, say) still throws,
+ *  but only after `opts.onError` has seen it. */
+declare function parseApplicationConfiguration(raw: unknown, opts?: {
+    onError?: (error: z.ZodError) => void;
+}): ApplicationConfiguration;
+
+export { type ApplicationConfiguration as A, type CurrentTenant as C, type Localization as L, type CurrentUser as a, applicationConfigurationSchema as b, currentTenantSchema as c, currentUserSchema as d, localizationSchema as l, parseApplicationConfiguration as p };

package/dist/auth.d.ts

@@ -0,0 +1,56 @@
+import { a as CookieOptions, T as TokenClient } from './oidc-7fu5kKVF.js';
+export { A as Auth, b as COOKIE_CHUNK_SIZE, C as Codec, c as CodecSchema, d as OidcMetadata, O as OidcStrategy, S as SessionManager, e as TokenClientConfig, f as TokenGrant, g as chunkCookieValue, h as clearChunkedCookie, i as clearCookie, j as createAuth, k as createCodec, l as createSessionManager, m as createTokenClient, n as discoverMetadata, o as oidcMetadataSchema, p as oidcStrategy, q as parseCookieHeader, r as readChunkedCookie, s as serializeCookie, t as toTokenResult } from './oidc-7fu5kKVF.js';
+import { e as Logger } from './logger-BSnS65IC.js';
+import { S as SessionStore, b as AuthStrategy } from './types-Bj0MpXtI.js';
+export { A as AuthSession, B as BeginInput, C as CompleteInput, F as FetchFn, H as Handshake, I as Identity, c as IdentityContext, a as IdentityResolver, T as TokenResult, d as authSessionSchema, e as authTokensSchema, h as handshakeSchema } from './types-Bj0MpXtI.js';
+import 'zod';
+
+/** 默认 SessionStore：把整个 AuthSession 密封进（超长时分块的）加密 cookie，自包含无后端。 */
+declare function createCookieSessionStore(opts: {
+    secret: string;
+    cookieName: string;
+    maxAge: number;
+    cookieOptions?: CookieOptions;
+    logger?: Logger;
+}): SessionStore;
+
+/** 解析 ASP.NET Core 文化 cookie 值（`c=zh-Hans|uic=zh-Hans`）为文化名，无则 null。 */
+declare function parseCultureCookie(value: string | undefined): string | null;
+/** 组 ASP.NET Core 文化 cookie 值。 */
+declare function formatCultureCookie(culture: string): string;
+
+type AuthErrorCode = 
+/** 调用方给策略喂了它不受理的输入。属于编程错误，不该当成用户可修复的失败渲染。 */
+"invalid_input" | "invalid_state"
+/** 握手密文超过服务端允许的寿命。 */
+ | "handshake_expired" | "invalid_nonce" | "exchange_failed" | "invalid_credentials" | "provider_denied" | "refresh_failed" | "session_open_failed" | "discovery_failed";
+/** 策略/会话层唯一的错误类型；适配层按 code 映射为 302 ?error= 或 { ok:false, error }。 */
+declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    constructor(code: AuthErrorCode, message?: string, opts?: {
+        cause?: unknown;
+    });
+}
+
+/** 解出 id_token 的 payload 段（不验签，签名验证属于 IdP↔BFF 的 TLS 信道 + code 交换信任）。 */
+declare function decodeIdTokenClaims(idToken: string): Record<string, unknown>;
+
+/** CSPRNG 随机串（base64url）；用于 state/nonce/PKCE verifier。 */
+declare function generateRandomString(byteLength?: number): string;
+/** PKCE S256 对：verifier + BASE64URL(SHA-256(verifier))。 */
+declare function generatePkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+
+/** 把用户提供的 returnUrl 限制为同源绝对路径；协议相对（"//"、"/\\"）、绝对 URL、含控制字符或空白的值回退为 "/"。 */
+declare function sanitizeReturnUrl(value: string | null | undefined): string;
+
+/** password grant（ROPC）策略：自绘登录页一步换 token，不经重定向。 */
+declare function passwordStrategy(cfg: {
+    tokenClient: TokenClient;
+    now?: () => number;
+    logger?: Logger;
+}): AuthStrategy;
+
+export { AuthError, type AuthErrorCode, AuthStrategy, CookieOptions, SessionStore, TokenClient, createCookieSessionStore, decodeIdTokenClaims, formatCultureCookie, generatePkce, generateRandomString, parseCultureCookie, passwordStrategy, sanitizeReturnUrl };

package/dist/auth.js

@@ -0,0 +1,58 @@
+import {
+  AuthError,
+  COOKIE_CHUNK_SIZE,
+  authSessionSchema,
+  authTokensSchema,
+  chunkCookieValue,
+  clearChunkedCookie,
+  clearCookie,
+  createAuth,
+  createCodec,
+  createCookieSessionStore,
+  createSessionManager,
+  createTokenClient,
+  decodeIdTokenClaims,
+  discoverMetadata,
+  formatCultureCookie,
+  generatePkce,
+  generateRandomString,
+  handshakeSchema,
+  oidcMetadataSchema,
+  oidcStrategy,
+  parseCookieHeader,
+  parseCultureCookie,
+  passwordStrategy,
+  readChunkedCookie,
+  sanitizeReturnUrl,
+  serializeCookie,
+  toTokenResult
+} from "./chunk-QQFH53SC.js";
+export {
+  AuthError,
+  COOKIE_CHUNK_SIZE,
+  authSessionSchema,
+  authTokensSchema,
+  chunkCookieValue,
+  clearChunkedCookie,
+  clearCookie,
+  createAuth,
+  createCodec,
+  createCookieSessionStore,
+  createSessionManager,
+  createTokenClient,
+  decodeIdTokenClaims,
+  discoverMetadata,
+  formatCultureCookie,
+  generatePkce,
+  generateRandomString,
+  handshakeSchema,
+  oidcMetadataSchema,
+  oidcStrategy,
+  parseCookieHeader,
+  parseCultureCookie,
+  passwordStrategy,
+  readChunkedCookie,
+  sanitizeReturnUrl,
+  serializeCookie,
+  toTokenResult
+};

package/dist/chunk-HWT6PBBS.js

@@ -0,0 +1,155 @@
+// src/core/abp-boolean.ts
+function isAbpTrue(value) {
+  return value?.toLowerCase() === "true";
+}
+
+// src/core/application-configuration.ts
+import { z } from "zod";
+var currentUserSchema = z.object({
+  isAuthenticated: z.boolean(),
+  id: z.string().nullable(),
+  userName: z.string().nullable(),
+  tenantId: z.string().nullable(),
+  email: z.string().nullable().optional(),
+  name: z.string().nullish(),
+  // `surName` is ABP's own casing on CurrentUserDto (the identity module's own DTOs use
+  // `surname`); mirroring the wire keeps the parse a pure shape check.
+  surName: z.string().nullish(),
+  emailVerified: z.boolean().nullish(),
+  phoneNumber: z.string().nullish(),
+  phoneNumberVerified: z.boolean().nullish(),
+  sessionId: z.string().nullish(),
+  impersonatorUserId: z.string().nullish(),
+  impersonatorTenantId: z.string().nullish(),
+  impersonatorUserName: z.string().nullish(),
+  impersonatorTenantName: z.string().nullish(),
+  // swagger marks CurrentUserDto.roles nullable, and ABP does send `null`; `.default([])` only
+  // covers the absent case, so a null would otherwise fail the whole config parse.
+  roles: z.array(z.string()).nullish().transform((roles) => roles ?? [])
+});
+var currentTenantSchema = z.object({
+  id: z.string().nullable(),
+  name: z.string().nullable(),
+  isAvailable: z.boolean()
+});
+var activeReporter = null;
+function degradeTo(fallback) {
+  return (ctx) => {
+    activeReporter?.(new z.ZodError(ctx.error.issues));
+    return fallback;
+  };
+}
+var languageSchema = z.object({ cultureName: z.string(), displayName: z.string() });
+var localizationSchema = z.object({
+  currentCulture: z.object({ name: z.string() }).catch(degradeTo({ name: "en" })),
+  defaultResourceName: z.string().nullish().catch(degradeTo(void 0)),
+  // A single drifted entry is dropped on its own, so it cannot take the rest of the list
+  // (and with it the whole localization subtree) down with it.
+  languages: z.array(languageSchema.nullable().catch(degradeTo(null))).transform((entries) => entries.filter((entry) => entry !== null)).catch(degradeTo([])),
+  values: z.record(z.string(), z.record(z.string(), z.string())).catch(degradeTo({}))
+}).catch(degradeTo({ currentCulture: { name: "en" }, languages: [], values: {} }));
+var abpValueSchema = z.string().nullish().transform((value) => value ?? void 0).catch(degradeTo(void 0));
+var abpValueTableSchema = z.object({ values: z.record(z.string(), abpValueSchema).catch(degradeTo({})) }).catch(degradeTo({ values: {} }));
+var applicationConfigurationShape = {
+  currentUser: currentUserSchema,
+  // swagger marks grantedPolicies nullable and the subtree can arrive null for an anonymous
+  // caller; a null converges to "nothing granted" (fail-closed) rather than throwing a white
+  // screen, while any other drift still fails fast per this file's contract.
+  auth: z.object({
+    grantedPolicies: z.record(z.string(), z.boolean()).nullish().transform((policies) => policies ?? {})
+  }).nullable().transform((auth) => auth ?? { grantedPolicies: {} }),
+  setting: abpValueTableSchema,
+  localization: localizationSchema,
+  currentTenant: currentTenantSchema,
+  features: abpValueTableSchema
+};
+var applicationConfigurationSchema = z.looseObject(applicationConfigurationShape);
+function parseApplicationConfiguration(raw, opts) {
+  const outerReporter = activeReporter;
+  activeReporter = opts?.onError ?? null;
+  let result;
+  try {
+    result = applicationConfigurationSchema.safeParse(raw);
+  } finally {
+    activeReporter = outerReporter;
+  }
+  if (!result.success) {
+    opts?.onError?.(result.error);
+    throw result.error;
+  }
+  return result.data;
+}
+
+// src/core/errors.ts
+import { z as z2 } from "zod";
+var HttpError = class extends Error {
+  status;
+  code;
+  validationErrors;
+  body;
+  constructor(status, message, options) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.code = options?.code;
+    this.validationErrors = options?.validationErrors;
+    this.body = options?.body;
+  }
+};
+function isAbpEnvelope(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return false;
+  const error = body.error;
+  return typeof error === "object" && error !== null;
+}
+var validationErrorsSchema = z2.array(
+  z2.object({
+    message: z2.string(),
+    members: z2.array(z2.string()).nullish().transform((members) => members ?? void 0)
+  })
+);
+function toValidationErrors(value) {
+  const parsed = validationErrorsSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function toHttpError(status, body) {
+  if (isAbpEnvelope(body)) {
+    const error = body.error;
+    return new HttpError(status, error.message ?? `HTTP ${status}`, {
+      code: error.code,
+      validationErrors: toValidationErrors(error.validationErrors),
+      body
+    });
+  }
+  return new HttpError(status, `HTTP ${status}`, { body });
+}
+
+// src/core/paged.ts
+function toPagedResult(dto) {
+  return { items: dto?.items ?? [], totalCount: dto?.totalCount ?? 0 };
+}
+function toAbpListParams(state) {
+  const pageSize = Math.max(1, state.pageSize);
+  const params = {
+    SkipCount: Math.max(0, state.pageIndex) * pageSize,
+    MaxResultCount: pageSize
+  };
+  if (state.sorting !== void 0 && state.sorting.length > 0) {
+    params.Sorting = state.sorting.map((s) => s.desc ? `${s.id} desc` : s.id).join(",");
+  }
+  const filter = state.filter?.trim();
+  if (filter) params.Filter = filter;
+  return params;
+}
+
+export {
+  isAbpTrue,
+  currentUserSchema,
+  currentTenantSchema,
+  localizationSchema,
+  applicationConfigurationSchema,
+  parseApplicationConfiguration,
+  HttpError,
+  toHttpError,
+  toPagedResult,
+  toAbpListParams
+};

package/dist/chunk-OK6PUP2E.js

@@ -0,0 +1,21 @@
+// src/permissions/is-granted.ts
+function isGranted(policies, policy, opts) {
+  const list = Array.isArray(policy) ? policy : [policy];
+  const strategy = opts?.strategy ?? "all";
+  return strategy === "all" ? list.every((p) => policies[p] === true) : list.some((p) => policies[p] === true);
+}
+
+// src/permissions/checker.ts
+function createPermissionChecker(policies) {
+  const check = (list, strategy) => list.length > 0 && isGranted(policies, list, { strategy });
+  const can = ((policy) => check(Array.isArray(policy) ? policy : [policy], "all"));
+  can.all = (...ps) => check(ps.flat(), "all");
+  can.any = (...ps) => check(ps.flat(), "any");
+  can.not = (policy) => !isGranted(policies, policy);
+  return can;
+}
+
+export {
+  isGranted,
+  createPermissionChecker
+};