@kerne/react 1.1.0 → 1.3.0

package/dist/chunk-TYNZ2WU7.cjs

@@ -1,1285 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;"use client";
-
-// src/ui/i18n.ts
-var _react = require('react');
-var defaultLocalization = {
-  common: {
-    email: "E-mail",
-    emailPlaceholder: "you@company.com",
-    password: "Password",
-    passwordPlaceholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
-    name: "Name",
-    namePlaceholder: "Ada Lovelace",
-    cancel: "Cancel",
-    continue: "Continue",
-    or: "or",
-    thisApp: "This app",
-    backToSignIn: "Back to sign in",
-    sending: "Sending...",
-    continueWith: "Continue with {provider}",
-    securedByKerne: "Secured by Kerne",
-    loading: "Loading",
-    showPassword: "Show password",
-    hidePassword: "Hide password",
-    capsLockOn: "Caps Lock is on",
-    passwordHint: "At least {count} characters",
-    passwordRequireUppercase: "One uppercase letter",
-    passwordRequireNumber: "One number",
-    passwordRequireSymbol: "One special character",
-    strengthLabel: "Password strength",
-    strengthWeak: "Weak",
-    strengthFair: "Fair",
-    strengthGood: "Good",
-    strengthStrong: "Strong"
-  },
-  signIn: {
-    title: "Welcome back",
-    signUpPrompt: "First time here?",
-    signUpLink: "Sign up for free",
-    signUpForApp: "Sign up for {app}",
-    submit: "Sign in",
-    submitting: "Signing in...",
-    magicSubmit: "Send me a sign-in link",
-    magicSubmitting: "Sending link...",
-    magicSubtitle: "We will email you a link to sign in.",
-    forgotPassword: "Forgot password?",
-    useMagicLink: "Send me a sign-in link instead",
-    usePassword: "Sign in with a password",
-    linkSent: "Check your inbox - if an account exists for {email}, a sign-in link is on its way.",
-    unavailable: "Sign-in is not available right now. Contact your administrator.",
-    loadFailed: "Could not load sign-in options. Please refresh the page."
-  },
-  signUp: {
-    title: "Create your account",
-    titleWithApp: "Create your {app} account",
-    signInPrompt: "Already have an account?",
-    signInLink: "Sign in",
-    submit: "Create account",
-    submitting: "Creating account...",
-    magicSubmit: "Send me a sign-up link",
-    magicSubmitting: "Sending link...",
-    invitationCode: "Invitation code",
-    invitationNeeded: "You need an invitation to sign up.",
-    closedTitle: "Sign-ups are closed",
-    closedBody: "{app} is not accepting new accounts right now.",
-    linkSent: "Check your inbox - we sent a link to {email}. Opening it confirms your address and signs you in.",
-    useMagicLink: "Send me a sign-up link instead",
-    usePassword: "Sign up with a password",
-    unavailable: "Sign-up is not available right now. Contact your administrator.",
-    loadFailed: "Could not load sign-up options. Please refresh the page."
-  },
-  resetPassword: {
-    requestTitle: "Reset your password",
-    requestSubtitle: "We will email you a link to choose a new password.",
-    requestSubmit: "Send me a reset link",
-    requestSubmitting: "Sending link...",
-    requestSent: "Check your inbox - if an account exists for {email}, a reset link is on its way.",
-    rememberedPrompt: "Remembered it?",
-    title: "Choose a new password",
-    subtitle: "Pick something you have not used before.",
-    newPassword: "New password",
-    confirmPassword: "Confirm new password",
-    mismatch: "Both passwords must match.",
-    submit: "Update password",
-    submitting: "Updating...",
-    doneTitle: "Password updated",
-    doneBody: "You can now sign in with your new password.",
-    incompleteTitle: "This link is incomplete",
-    incompleteBody: "It is missing its reset token. Request a new reset email and try again."
-  },
-  magicLink: {
-    pendingTitle: "Signing you in",
-    pendingBody: "One moment while we verify your link.",
-    doneTitle: "You're signed in",
-    doneBody: "You can close this tab if it does not redirect on its own.",
-    failedTitle: "This link didn't work",
-    missingToken: "This link is missing its sign-in token."
-  },
-  verifyEmail: {
-    title: "Verify your email",
-    subtitle: "Enter the 6-digit code we emailed you.",
-    code: "Verification code",
-    submit: "Verify email",
-    submitting: "Verifying...",
-    resend: "Didn't get it? Send a new code",
-    resent: "A new code is on its way.",
-    verifyingTitle: "Verifying your email",
-    verifyingBody: "One moment while we confirm your link.",
-    doneTitle: "Email verified",
-    doneBody: "Your address is confirmed. You can continue.",
-    failedTitle: "This link didn't work",
-    newCode: "Send a new code"
-  },
-  activate: {
-    title: "Activate your account",
-    credentialsSubtitle: "Set a password for {email} to finish.",
-    magicSubtitle: "Confirm {email} to finish setting up your account.",
-    confirmPassword: "Confirm password",
-    mismatch: "Both passwords must match.",
-    submit: "Activate my account",
-    submitting: "Activating...",
-    failedTitle: "This link didn't work",
-    missingToken: "It is missing its activation token. Ask for a new invitation.",
-    goToSignIn: "Go to sign in"
-  },
-  waitlist: {
-    title: "Join the waitlist",
-    subtitle: "We will email you when a spot opens up.",
-    submit: "Join the waitlist",
-    submitting: "Adding you...",
-    joined: "You're on the list. We will be in touch."
-  },
-  profile: {
-    navLabel: "Account sections",
-    tabProfile: "Profile",
-    tabSecurity: "Security",
-    tabBilling: "Billing",
-    profileTitle: "Profile",
-    profileDesc: "Your name and the address you sign in with.",
-    securityTitle: "Security",
-    securityDesc: "Manage your password and your account.",
-    billingTitle: "Billing",
-    billingDesc: "Your plan, what you have used, and how to change it.",
-    firstName: "First name",
-    firstNamePlaceholder: "Ada",
-    lastName: "Last name",
-    lastNamePlaceholder: "Lovelace",
-    save: "Save",
-    saving: "Saving...",
-    saved: "Your profile has been saved.",
-    emailSectionTitle: "Email address",
-    emailSectionDesc: "The address you sign in with. Contact support to change it.",
-    verified: "Verified",
-    unverified: "Unverified",
-    verify: "Verify",
-    verificationSent: "Verification email sent.",
-    unnamed: "Unnamed"
-  },
-  security: {
-    passwordTitle: "Password",
-    passwordDesc: "Used together with your email to sign in.",
-    currentPassword: "Current password",
-    newPassword: "New password",
-    confirmPassword: "Confirm new password",
-    submit: "Change password",
-    submitting: "Changing...",
-    changed: "Your password has been changed.",
-    mismatch: "Both passwords must match.",
-    sameAsCurrent: "Your new password must differ from the current one.",
-    deleteTitle: "Delete account",
-    deleteDesc: "Deactivates your account and signs you out. Contact support if you need it back.",
-    deleteAction: "Delete my account",
-    deleteConfirm: "Yes, delete my account",
-    deleting: "Deleting..."
-  },
-  billing: {
-    currentPlan: "Current plan",
-    plan: "Plan",
-    price: "Price",
-    status: "Status",
-    renews: "Renews",
-    ends: "Ends",
-    trialEnds: "Trial ends",
-    managePortal: "Manage billing",
-    opening: "Opening...",
-    freePlan: "You are on the free plan.",
-    seePlans: "See plans",
-    cancelNotice: "Your plan is set to end - you keep access until the date above.",
-    cancelSubscription: "Cancel subscription",
-    canceling: "Canceling...",
-    cancelConfirmTitle: "Cancel your subscription?",
-    cancelConfirmBody: "You'll keep access until the end of the current billing period.",
-    cancelConfirmButton: "Yes, cancel",
-    cancelConfirmDismiss: "Never mind",
-    changePlan: "Change plan",
-    current: "Current",
-    switchTo: "Switch",
-    switching: "Switching...",
-    switchConfirmTitle: "Switch to {plan}?",
-    switchConfirmBody: "This applies right away, and your next invoice reflects the price difference for the rest of this period.",
-    switchConfirmButton: "Yes, switch",
-    switchConfirmDismiss: "Never mind",
-    noPlans: "No other plans are available right now.",
-    notOnInterval: "Not available on this interval",
-    loadFailed: "Could not load your plan right now.",
-    loadingPlan: "Loading subscription",
-    loadingPlans: "Loading plans",
-    intervalGroupLabel: "Billing interval",
-    // Rendered after a price, as "12 € / month". A language that needs another
-    // shape overrides the whole label rather than these fragments.
-    intervalMonth: "month",
-    intervalYear: "year",
-    intervalWeek: "week",
-    intervalDay: "day",
-    statusActive: "Active",
-    statusTrialing: "Trial",
-    statusPastDue: "Payment due",
-    statusCanceled: "Canceled",
-    statusUnpaid: "Unpaid",
-    statusPaused: "Paused"
-  },
-  usage: {
-    title: "Usage",
-    subtitle: "Counted against your plan for the current period.",
-    used: "{count} used",
-    nothingMetered: "Nothing metered on your plan - you have no usage limits to watch.",
-    overage: "{count} over your included amount - at no extra charge.",
-    overageBilled: "{count} over your included amount - the extra is billed on top of your plan.",
-    limitReached: "You have reached your limit.",
-    capReached: "You've reached your billing cap for this period - everything past this is free.",
-    billedAmount: "{amount} billed this period.",
-    loading: "Loading usage",
-    loadFailed: "Could not load your usage right now."
-  },
-  pricing: {
-    getStarted: "Get started",
-    billedAt: "Billed {amount} / {interval}",
-    save: "Save {percent}%",
-    unlimited: "Unlimited",
-    moreFeatures: "+{count} more",
-    loading: "Loading plans",
-    loadFailed: "Could not load plans right now."
-  },
-  checkout: {
-    confirmingTitle: "Confirming your payment",
-    confirmingBody: "This takes a few seconds - please keep this tab open.",
-    pendingTitle: "Payment received",
-    pendingBody: "Your plan is still being activated. It usually lands within a minute - refresh if it has not appeared by then.",
-    doneTitle: "You're all set",
-    doneBody: "Your subscription is active. Thank you.",
-    cancelTitle: "Checkout cancelled",
-    cancelBody: "Nothing was charged. You can pick a plan whenever you are ready.",
-    backToPlans: "Back to plans"
-  },
-  upgrade: {
-    quotaTitle: "You've used all your {feature}",
-    quotaBody: "You have used {used} of {limit} this period. Upgrade for a higher limit.",
-    featureTitle: "{feature} is not on your plan",
-    featureBody: "Upgrade your plan to unlock {feature}.",
-    action: "See plans",
-    checking: "Checking access"
-  },
-  account: {
-    menuLabel: "Account menu",
-    signOut: "Sign out"
-  },
-  errors: {
-    generic: "Something went wrong. Please try again.",
-    // Auth (K1xxx)
-    K1001: "Registration is not open right now.",
-    K1002: "This app has reached its user limit.",
-    K1003: "This invitation link is no longer valid.",
-    K1004: "That invitation code is not valid.",
-    K1005: "Invalid email or password.",
-    K1006: "This link has expired. Request a new one.",
-    K1007: "This link is missing its token.",
-    K1008: "An account already exists for this email.",
-    K1009: "That email address does not look valid.",
-    K1010: "Please choose a stronger password.",
-    K1011: "Please verify your email address first.",
-    K1012: "You need to sign in to continue.",
-    // Validation (K2xxx)
-    K2001: "Some of the details you entered are not valid.",
-    K2002: "Please fill in every required field.",
-    K2003: "Some of the details you entered are not valid.",
-    K2005: "That value is already taken.",
-    // Permissions (K3xxx)
-    K3002: "You do not have permission to do that.",
-    K3004: "That action is not available on your account.",
-    // Resources (K4xxx)
-    K4001: "We could not find what you were looking for.",
-    K4003: "We could not find that account.",
-    // Billing (K5xxx)
-    K5001: "You've reached the limit included in your plan.",
-    K5002: "Your plan does not include this. Upgrade to continue.",
-    K5003: "Your payment could not be processed.",
-    // Rate limiting (K6xxx)
-    K6001: "Too many attempts. Please wait a moment and try again."
-  }
-};
-var LocalizationContext = _react.createContext.call(void 0, defaultLocalization);
-function mergeLocalization(override) {
-  if (!override) return defaultLocalization;
-  const merged = { ...defaultLocalization };
-  for (const groupKey of Object.keys(defaultLocalization)) {
-    const group = override[groupKey];
-    if (group) {
-      merged[groupKey] = {
-        ...defaultLocalization[groupKey],
-        ...group
-      };
-    }
-  }
-  return merged;
-}
-function useLocalization() {
-  return _react.useContext.call(void 0, LocalizationContext);
-}
-function fill(template, values) {
-  return template.replace(
-    /\{(\w+)\}/g,
-    (match, key) => key in values ? String(values[key]) : match
-  );
-}
-function fillNode(template, values) {
-  return template.split(/(\{\w+\})/g).map((part, index) => {
-    const placeholder = /^\{(\w+)\}$/.exec(part);
-    if (placeholder && placeholder[1] in values) {
-      return _react.createElement.call(void 0, _react.Fragment, { key: index }, values[placeholder[1]]);
-    }
-    return part;
-  });
-}
-function resolveErrorMessage(error, l10n) {
-  const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
-  if (code && l10n.errors[code]) return l10n.errors[code];
-  return l10n.errors.generic;
-}
-function useErrorResolver() {
-  const l10n = useLocalization();
-  return _react.useCallback.call(void 0, (error) => resolveErrorMessage(error, l10n), [l10n]);
-}
-
-// src/provider.tsx
-
-var _server = require('@kerne/server');
-var _jsxruntime = require('react/jsx-runtime');
-var DEFAULT_STORAGE_KEY = "kerne_auth";
-var DEFAULT_REFRESH_BUFFER = 60;
-var HANDOFF_QUERY_PARAM = "kerne_handoff";
-var KerneClient = (_class = class {
-  
-  
-  
-  
-  
-  
-  
-  __init() {this.refreshTimer = null}
-  __init2() {this.listeners = /* @__PURE__ */ new Set()}
-  __init3() {this._user = null}
-  __init4() {this._token = null}
-  __init5() {this._refreshToken = null}
-  __init6() {this._expiresAt = null}
-  __init7() {this._isLoading = true}
-  __init8() {this._authConfigPromise = null}
-  
-  
-  constructor(config) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);_class.prototype.__init4.call(this);_class.prototype.__init5.call(this);_class.prototype.__init6.call(this);_class.prototype.__init7.call(this);_class.prototype.__init8.call(this);
-    this.baseUrl = _nullishCoalesce(config.baseUrl, () => ( "https://api.kerne.io"));
-    this.appId = config.appId;
-    this.storage = _nullishCoalesce(config.storage, () => ( (typeof window !== "undefined" ? localStorage : null)));
-    this.storageKey = _nullishCoalesce(config.storageKey, () => ( DEFAULT_STORAGE_KEY));
-    this.onAuthChange = config.onAuthChange;
-    this.onHandoffError = config.onHandoffError;
-    this.autoRefresh = _nullishCoalesce(config.autoRefresh, () => ( true));
-    this.refreshBuffer = _nullishCoalesce(config.refreshBuffer, () => ( DEFAULT_REFRESH_BUFFER));
-    this.kerne = new (0, _server.Kerne)({
-      baseUrl: this.baseUrl,
-      appId: this.appId,
-      timeout: config.timeout,
-      onUnauthorized: () => {
-        if (process.env.NODE_ENV === "development") {
-          console.warn("[Kerne] 401 received. Auto-logout disabled in dev.");
-          return;
-        }
-        this.clearSession();
-      }
-    });
-    this.loadSession();
-  }
-  subscribe(listener) {
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-  notify() {
-    this.listeners.forEach((l) => l());
-  }
-  get user() {
-    return this._user;
-  }
-  get token() {
-    return this._token;
-  }
-  get isAuthenticated() {
-    return this._token !== null;
-  }
-  get isLoading() {
-    return this._isLoading;
-  }
-  loadSession() {
-    const handoffCode = this.getHandoffCodeFromUrl();
-    if (handoffCode) {
-      void this.exchangeHandoffOnLoad(handoffCode);
-      return;
-    }
-    if (!this.storage) {
-      this._isLoading = false;
-      this.notify();
-      return;
-    }
-    try {
-      const data = this.storage.getItem(this.storageKey);
-      if (data) {
-        const { user, token, refresh_token, expires_at } = JSON.parse(data);
-        const expiresAt = expires_at ? new Date(expires_at) : null;
-        if (!expiresAt || expiresAt > /* @__PURE__ */ new Date()) {
-          this._user = user;
-          this._token = token;
-          this._refreshToken = _nullishCoalesce(refresh_token, () => ( null));
-          this._expiresAt = expiresAt;
-          this.kerne = this.kerne.withToken(token);
-          this.scheduleRefresh();
-        } else if (refresh_token && this.autoRefresh) {
-          this._refreshToken = refresh_token;
-          void this.refreshOnLoad();
-          return;
-        } else {
-          this.storage.removeItem(this.storageKey);
-        }
-      }
-    } catch (e) {
-      console.error("[Kerne] Failed to load session:", e);
-      _optionalChain([this, 'access', _ => _.storage, 'optionalAccess', _2 => _2.removeItem, 'call', _3 => _3(this.storageKey)]);
-    }
-    this._isLoading = false;
-    this.notify();
-  }
-  getHandoffCodeFromUrl() {
-    if (typeof window === "undefined") return null;
-    return new URLSearchParams(window.location.search).get(HANDOFF_QUERY_PARAM);
-  }
-  /**
-   * Strips only `kerne_handoff` from the URL, leaving the rest of the
-   * path/query (e.g. a `return_to` the host app added) untouched - and
-   * without adding a history entry, so back-navigation doesn't resurrect it.
-   */
-  stripHandoffParamFromUrl() {
-    if (typeof window === "undefined") return;
-    const url = new URL(window.location.href);
-    url.searchParams.delete(HANDOFF_QUERY_PARAM);
-    window.history.replaceState(window.history.state, "", url.toString());
-  }
-  /**
-   * Same shape as `refreshOnLoad`: a bootstrap-only path invoked once from
-   * `loadSession()` when a `kerne_handoff` code is present in the URL,
-   * entirely invisible to the host app - no code on their end required.
-   *
-   * Works no matter which page the browser lands on: `redirectUrl` is a hard
-   * navigation (`window.location.href`), so the destination reloads the SDK
-   * fresh and `loadSession()` reads the code straight off that page's own
-   * URL - there is no dependency on a specific "callback route", as long as
-   * `KerneProvider` wraps whatever the host renders there (normally true when
-   * it is mounted once at the app root).
-   *
-   * One retry on a transient failure (network blip, 5xx) - worth it because
-   * the code was never reached by the server in that case, so it is still
-   * unspent. A 4xx (invalid/expired/already-consumed) is not retried: the
-   * code is gone, retrying only delays the "logged out" outcome.
-   */
-  async exchangeHandoffOnLoad(code) {
-    try {
-      for (let attempt = 0; ; attempt++) {
-        try {
-          const response = await this.kerne.auth.exchangeHandoff(code);
-          await this.saveSession(response);
-          return;
-        } catch (e) {
-          const statusCode = e.statusCode;
-          const transient = statusCode === 0 || typeof statusCode === "number" && statusCode >= 500;
-          if (transient && attempt === 0) {
-            await new Promise((resolve) => setTimeout(resolve, 400));
-            continue;
-          }
-          console.warn("[Kerne] Handoff exchange failed:", e);
-          _optionalChain([this, 'access', _4 => _4.onHandoffError, 'optionalCall', _5 => _5(e)]);
-          return;
-        }
-      }
-    } finally {
-      this.stripHandoffParamFromUrl();
-      this._isLoading = false;
-      this.notify();
-    }
-  }
-  async refreshOnLoad() {
-    try {
-      const response = await this.kerne.auth.refreshToken({
-        refresh_token: this._refreshToken
-      });
-      await this.saveSession(response);
-    } catch (e) {
-      console.warn("[Kerne] Startup refresh failed, clearing session:", e);
-      this._refreshToken = null;
-      _optionalChain([this, 'access', _6 => _6.storage, 'optionalAccess', _7 => _7.removeItem, 'call', _8 => _8(this.storageKey)]);
-    } finally {
-      this._isLoading = false;
-      this.notify();
-    }
-  }
-  /**
-   * `AuthResponse.user` is the minimal `{id, email, role}` claim set the
-   * token endpoint returns, not the full profile (`User`) - so this always
-   * follows up with `users.me()` rather than assigning it directly (that
-   * used to leave `_user` looking like a `User` while actually missing
-   * `email_verified`/`first_name`/`avatar`/etc).
-   */
-  async saveSession(response) {
-    this._token = response.token;
-    this._refreshToken = response.refresh_token;
-    this._expiresAt = response.expires_at ? new Date(response.expires_at) : null;
-    this.kerne = this.kerne.withToken(response.token);
-    try {
-      this._user = await this.kerne.users.me();
-    } catch (e) {
-      const sameUser = _optionalChain([this, 'access', _9 => _9._user, 'optionalAccess', _10 => _10.id]) === _optionalChain([response, 'access', _11 => _11.user, 'optionalAccess', _12 => _12.id]);
-      console.error("[Kerne] Failed to load the user profile:", e);
-      this._user = sameUser ? this._user : null;
-    }
-    if (this.storage) {
-      this.storage.setItem(
-        this.storageKey,
-        JSON.stringify({
-          user: this._user,
-          token: response.token,
-          refresh_token: response.refresh_token,
-          expires_at: response.expires_at
-        })
-      );
-    }
-    this.scheduleRefresh();
-    _optionalChain([this, 'access', _13 => _13.onAuthChange, 'optionalCall', _14 => _14(this._user)]);
-    this.notify();
-  }
-  clearSession() {
-    this._user = null;
-    this._token = null;
-    this._refreshToken = null;
-    this._expiresAt = null;
-    this.cancelRefresh();
-    if (this.storage) {
-      this.storage.removeItem(this.storageKey);
-    }
-    _optionalChain([this, 'access', _15 => _15.onAuthChange, 'optionalCall', _16 => _16(null)]);
-    this.notify();
-  }
-  scheduleRefresh() {
-    if (!this.autoRefresh || !this._expiresAt) return;
-    this.cancelRefresh();
-    const now = Date.now();
-    const expiry = this._expiresAt.getTime();
-    const refreshAt = expiry - this.refreshBuffer * 1e3;
-    const delay = Math.max(0, refreshAt - now);
-    if (delay > 0) {
-      this.refreshTimer = setTimeout(() => this.silentRefresh(), delay);
-    }
-  }
-  cancelRefresh() {
-    if (this.refreshTimer) {
-      clearTimeout(this.refreshTimer);
-      this.refreshTimer = null;
-    }
-  }
-  async silentRefresh() {
-    if (!this._refreshToken) return;
-    try {
-      const response = await this.kerne.auth.refreshToken({ refresh_token: this._refreshToken });
-      await this.saveSession(response);
-      console.debug("[Kerne] Session refreshed silently");
-    } catch (e) {
-      console.warn("[Kerne] Silent refresh failed:", e);
-    }
-  }
-  async register(params) {
-    const [firstName, ...lastNameParts] = (params.name || "").split(" ");
-    const response = await this.kerne.auth.signup({
-      email: params.email,
-      password: params.password,
-      first_name: firstName || void 0,
-      last_name: lastNameParts.join(" ") || void 0,
-      invitationToken: params.invitationToken,
-      invitationCode: params.invitationCode
-    });
-    await this.saveSession(response);
-    return response;
-  }
-  async login(params) {
-    const response = await this.kerne.auth.login(params);
-    await this.saveSession(response);
-    return response;
-  }
-  /** Manually trigger a token refresh - normally handled automatically by `autoRefresh`. */
-  async refreshToken() {
-    if (!this._refreshToken) return null;
-    const response = await this.kerne.auth.refreshToken({ refresh_token: this._refreshToken });
-    await this.saveSession(response);
-    return response;
-  }
-  logout() {
-    this.clearSession();
-  }
-  async refreshUser() {
-    if (!this._token) return null;
-    try {
-      const user = await this.kerne.users.me();
-      this._user = user;
-      _optionalChain([this, 'access', _17 => _17.onAuthChange, 'optionalCall', _18 => _18(user)]);
-      this.notify();
-      return user;
-    } catch (e2) {
-      this.clearSession();
-      return null;
-    }
-  }
-  // No `avatar` here - UpdateUserDto doesn't accept it server-side
-  // (`forbidNonWhitelisted` rejects the field with a 400).
-  async updateProfile(params) {
-    if (!this._user) throw new Error("User not authenticated");
-    const updated = await this.kerne.users.update(this._user.id, params);
-    this._user = updated;
-    if (this.storage && this._token) {
-      try {
-        const data = this.storage.getItem(this.storageKey);
-        if (data) {
-          const session = JSON.parse(data);
-          session.user = updated;
-          this.storage.setItem(this.storageKey, JSON.stringify(session));
-        }
-      } catch (e) {
-      }
-    }
-    _optionalChain([this, 'access', _19 => _19.onAuthChange, 'optionalCall', _20 => _20(updated)]);
-    this.notify();
-    return updated;
-  }
-  async updatePassword(params) {
-    await this.kerne.auth.changePassword(params);
-  }
-  /** Soft-deletes (deactivates) the caller's own account, then clears the local session. */
-  async requestAccountDeletion() {
-    await this.kerne.auth.requestAccountDeletion();
-    this.clearSession();
-  }
-  /** Forgot-password flow (logged out) - sends the reset email. */
-  async requestPasswordReset(email, callbackUrl) {
-    await this.kerne.auth.requestPasswordReset(email, callbackUrl);
-  }
-  /** Confirms a password reset with the token from the email. */
-  async confirmPasswordReset(token, password) {
-    await this.kerne.auth.confirmPasswordReset(token, password);
-  }
-  /**
-   * Sends a magic-link email (logged out). Anti-enumeration: always resolves,
-   * regardless of whether the email is registered.
-   */
-  async startPasswordless(email, callbackUrl, invitation) {
-    await this.kerne.auth.startPasswordless(email, callbackUrl, invitation);
-  }
-  /** Completes a magic-link login using the `token` query param from the emailed link. */
-  async loginWithMagicLink(token) {
-    const response = await this.kerne.auth.loginWithMagicLink(token);
-    await this.saveSession(response);
-    return response;
-  }
-  // Account Activation
-  // Same token/endpoint for an admin-created user and a self-service
-  // magic-link signup confirmation - see AuthResource.getActivationContext.
-  /** Read-only: which UI to render for an activation token, without consuming it. */
-  async getActivationContext(token) {
-    return this.kerne.auth.getActivationContext(token);
-  }
-  /** Completes activation (sets a password or confirms magic-link mode), then logs the user in. */
-  async completeActivation(token, password) {
-    const response = await this.kerne.auth.completeActivation(token, password);
-    await this.saveSession(response);
-    return response;
-  }
-  // Cross-Origin Session Handoff
-  // For apps/portal (auth hosted on its own origin): call this at the end of
-  // a successful auth flow (login/magic-link/register/activation) instead of
-  // a plain `window.location.href = url` whenever `url` isn't same-origin -
-  // the exchange on the other end is picked up automatically by
-  // `exchangeHandoffOnLoad()`, no code required on the tenant app's side.
-  /**
-   * Mints a handoff code for the current session and redirects the browser
-   * to `url` with it attached (`?kerne_handoff=...`) - never the real
-   * token/refresh_token, which would otherwise leak into server logs,
-   * browser history, and third-party `Referer` headers on the landing page.
-   */
-  async redirectWithSession(url) {
-    const { code } = await this.kerne.auth.handoff();
-    const separator = url.includes("?") ? "&" : "?";
-    const target = `${url}${separator}${HANDOFF_QUERY_PARAM}=${encodeURIComponent(code)}`;
-    if (typeof window !== "undefined") window.location.href = target;
-  }
-  /**
-   * The tenant's public auth config - which sign-in methods to render, whether
-   * registration is open, whether to show Kerne branding.
-   *
-   * Deduped on the in-flight promise rather than the resolved value: the
-   * prebuilt forms all read this on mount, and two of them mounted together
-   * (a login screen with a register link prefetching) would otherwise fire two
-   * identical requests before either resolved. Cached for the client's
-   * lifetime - this config changes on the order of "the owner edited their
-   * settings", not per render.
-   */
-  async getAuthConfig() {
-    if (!this._authConfigPromise) {
-      this._authConfigPromise = this.kerne.auth.config().catch((e) => {
-        this._authConfigPromise = null;
-        throw e;
-      });
-    }
-    return this._authConfigPromise;
-  }
-  /**
-   * Errors are not swallowed here (unlike the old implementation, which
-   * caught everything and returned `false`) - a 401/500 must not be
-   * indistinguishable from a real denial, that's exactly what let the
-   * `has_access`/`allowed` mismatch below ship unnoticed. Callers that want
-   * a fail-closed boolean regardless of the reason (e.g. `<Access>`)
-   * catch around this themselves.
-   */
-  async allows(featureKey, requested) {
-    const check = await this.kerne.check(featureKey, { requested });
-    return check.allowed;
-  }
-  /** Full entitlement detail (limit/used/remaining/overage) - use `allows()` for a plain boolean. */
-  async check(featureKey, requested) {
-    return this.kerne.check(featureKey, { requested });
-  }
-  async createCheckout(planPriceId, options) {
-    const { url } = await this.kerne.billing.checkout(planPriceId, options);
-    return url;
-  }
-  async openCheckout(planPriceId, options) {
-    const url = await this.createCheckout(planPriceId, options);
-    if (typeof window !== "undefined") window.location.href = url;
-  }
-  async createPortal(returnUrl) {
-    const { url } = await this.kerne.billing.portal({ returnUrl });
-    return url;
-  }
-  async openPortal(returnUrl) {
-    const url = await this.createPortal(returnUrl);
-    if (typeof window !== "undefined") window.location.href = url;
-  }
-  async getSubscription(productSlug) {
-    const subs = await this.kerne.billing.subscriptions.list({
-      productSlug,
-      subjectType: "USER"
-    });
-    const active = subs.find(
-      (s) => s.status === "ACTIVE" || s.status === "TRIALING" || s.status === "PAST_DUE"
-    );
-    return _nullishCoalesce(active, () => ( null));
-  }
-  /** `immediately: true` ends it now; otherwise cancels at period end (API default). */
-  async cancelSubscription(subscriptionId, immediately) {
-    return this.kerne.billing.subscriptions.cancel(subscriptionId, immediately);
-  }
-  /** Swaps the plan/price, effective immediately - deferring a downgrade isn't supported yet. */
-  async changeSubscriptionPlan(subscriptionId, planPriceId, options) {
-    return this.kerne.billing.subscriptions.changePlanPrice(subscriptionId, planPriceId, options);
-  }
-  /** Public pricing data - omit `productIdOrSlug` for the tenant's default product. */
-  async getPlans(productIdOrSlug) {
-    return this.kerne.billing.plans(productIdOrSlug);
-  }
-  /** Every entitlement for the current user in one call - for a "your plan" screen. */
-  async getEntitlements() {
-    return this.kerne.entitlements();
-  }
-  /** Usage for the current user - all QUOTA features, or one via `featureKey`. */
-  async getUsage(featureKey) {
-    return this.kerne.usage({ featureKey });
-  }
-  async joinWaitlist(params) {
-    return this.kerne.waitlist.join(params);
-  }
-  /** Validate an invitation token before showing the registration form. */
-  async validateInvitationToken(token) {
-    return this.kerne.invitations.validateToken(token);
-  }
-  /** Validate an invitation code before showing the registration form. */
-  async validateInvitationCode(code) {
-    return this.kerne.invitations.validateCode(code);
-  }
-  async sendVerificationEmail(verificationType = "code", callbackUrl) {
-    await this.kerne.auth.sendVerificationEmail(verificationType, callbackUrl);
-  }
-  async verifyEmailWithCode(code) {
-    return await this.kerne.auth.verifyEmailWithCode(code);
-  }
-  async verifyEmailWithLink(token) {
-    return await this.kerne.auth.verifyEmailWithLink(token);
-  }
-  async getVerificationStatus() {
-    return await this.kerne.auth.getVerificationStatus();
-  }
-}, _class);
-var KerneContext = _react.createContext.call(void 0, null);
-function KerneProvider({ children, localization, ...config }) {
-  const clientRef = _react.useRef.call(void 0, null);
-  const client = _react.useMemo.call(void 0, () => {
-    if (!clientRef.current) {
-      clientRef.current = new KerneClient(config);
-    }
-    return clientRef.current;
-  }, [config.appId, config.baseUrl]);
-  _react.useEffect.call(void 0, () => {
-    return () => {
-      _optionalChain([client, 'access', _21 => _21.cancelRefresh, 'optionalCall', _22 => _22()]);
-    };
-  }, [client]);
-  const l10n = _react.useMemo.call(void 0, () => mergeLocalization(localization), [localization]);
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, KerneContext.Provider, { value: client, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, LocalizationContext.Provider, { value: l10n, children }) });
-}
-
-// src/hooks.ts
-
-function useClient() {
-  const context = _react.useContext.call(void 0, KerneContext);
-  if (!context) {
-    throw new Error("useClient must be used within a KerneProvider");
-  }
-  return context;
-}
-function useAuth() {
-  const client = useClient();
-  const user = _react.useSyncExternalStore.call(void 0, 
-    (callback) => client.subscribe(callback),
-    () => client.user,
-    () => client.user
-    // Server snapshot
-  );
-  const token = _react.useSyncExternalStore.call(void 0, 
-    (callback) => client.subscribe(callback),
-    () => client.token,
-    () => null
-    // Server always null
-  );
-  const isAuthenticated = _react.useSyncExternalStore.call(void 0, 
-    (callback) => client.subscribe(callback),
-    () => client.isAuthenticated,
-    () => false
-    // Server always unauthenticated
-  );
-  const isLoading = _react.useSyncExternalStore.call(void 0, 
-    (callback) => client.subscribe(callback),
-    () => client.isLoading,
-    () => true
-    // Server always loading
-  );
-  return {
-    user,
-    token,
-    isAuthenticated,
-    isLoading,
-    login: _react.useCallback.call(void 0, 
-      (params) => client.login(params),
-      [client]
-    ),
-    register: _react.useCallback.call(void 0, 
-      (params) => client.register(params),
-      [client]
-    ),
-    logout: _react.useCallback.call(void 0, () => client.logout(), [client]),
-    refreshUser: _react.useCallback.call(void 0, () => client.refreshUser(), [client]),
-    refreshToken: _react.useCallback.call(void 0, () => client.refreshToken(), [client]),
-    updateProfile: _react.useCallback.call(void 0, 
-      (params) => client.updateProfile(params),
-      [client]
-    ),
-    updatePassword: _react.useCallback.call(void 0, 
-      (params) => client.updatePassword(params),
-      [client]
-    ),
-    requestAccountDeletion: _react.useCallback.call(void 0, () => client.requestAccountDeletion(), [client]),
-    requestPasswordReset: _react.useCallback.call(void 0, 
-      (email, callbackUrl) => client.requestPasswordReset(email, callbackUrl),
-      [client]
-    ),
-    confirmPasswordReset: _react.useCallback.call(void 0, 
-      (token2, password) => client.confirmPasswordReset(token2, password),
-      [client]
-    ),
-    // Magic link
-    startPasswordless: _react.useCallback.call(void 0, 
-      (email, callbackUrl, invitation) => client.startPasswordless(email, callbackUrl, invitation),
-      [client]
-    ),
-    loginWithMagicLink: _react.useCallback.call(void 0, (token2) => client.loginWithMagicLink(token2), [client]),
-    // Email verification
-    sendVerificationEmail: _react.useCallback.call(void 0, 
-      (verificationType = "code", callbackUrl) => client.sendVerificationEmail(verificationType, callbackUrl),
-      [client]
-    ),
-    verifyEmailWithCode: _react.useCallback.call(void 0, (code) => client.verifyEmailWithCode(code), [client]),
-    verifyEmailWithLink: _react.useCallback.call(void 0, 
-      (token2) => client.verifyEmailWithLink(token2),
-      [client]
-    ),
-    getVerificationStatus: _react.useCallback.call(void 0, () => client.getVerificationStatus(), [client]),
-    // Account activation (admin-created user, or self-service magic-link signup confirmation)
-    getActivationContext: _react.useCallback.call(void 0, 
-      (token2) => client.getActivationContext(token2),
-      [client]
-    ),
-    completeActivation: _react.useCallback.call(void 0, 
-      (token2, password) => client.completeActivation(token2, password),
-      [client]
-    ),
-    // Cross-origin handoff (apps/portal -> tenant app_url) - see redirectWithSession on KerneClient.
-    redirectWithSession: _react.useCallback.call(void 0, (url) => client.redirectWithSession(url), [client])
-  };
-}
-function useCheckout() {
-  const client = useClient();
-  return {
-    createCheckout: _react.useCallback.call(void 0, 
-      (planPriceId, options) => client.createCheckout(planPriceId, options),
-      [client]
-    ),
-    openCheckout: _react.useCallback.call(void 0, 
-      (planPriceId, options) => client.openCheckout(planPriceId, options),
-      [client]
-    )
-  };
-}
-function usePortal() {
-  const client = useClient();
-  return {
-    createPortal: _react.useCallback.call(void 0, (returnUrl) => client.createPortal(returnUrl), [client]),
-    openPortal: _react.useCallback.call(void 0, (returnUrl) => client.openPortal(returnUrl), [client])
-  };
-}
-function useCancelSubscription() {
-  const client = useClient();
-  const [isCanceling, setIsCanceling] = _react.useState.call(void 0, false);
-  const cancelSubscription = _react.useCallback.call(void 0, 
-    async (subscriptionId, immediately) => {
-      setIsCanceling(true);
-      try {
-        return await client.cancelSubscription(subscriptionId, immediately);
-      } finally {
-        setIsCanceling(false);
-      }
-    },
-    [client]
-  );
-  return { cancelSubscription, isCanceling };
-}
-function useChangePlan() {
-  const client = useClient();
-  const [isChanging, setIsChanging] = _react.useState.call(void 0, false);
-  const changePlan = _react.useCallback.call(void 0, 
-    async (subscriptionId, planPriceId, options) => {
-      setIsChanging(true);
-      try {
-        return await client.changeSubscriptionPlan(subscriptionId, planPriceId, options);
-      } finally {
-        setIsChanging(false);
-      }
-    },
-    [client]
-  );
-  return { changePlan, isChanging };
-}
-function usePlanSwitch(subscription, refetchSubscription, options) {
-  const { openCheckout } = useCheckout();
-  const { changePlan } = useChangePlan();
-  const [pending, setPending] = _react.useState.call(void 0, null);
-  const [switching, setSwitching] = _react.useState.call(void 0, false);
-  const [switchError, setSwitchError] = _react.useState.call(void 0, null);
-  const [checkoutPriceId, setCheckoutPriceId] = _react.useState.call(void 0, null);
-  const [checkoutError, setCheckoutError] = _react.useState.call(void 0, null);
-  const successUrl = _optionalChain([options, 'optionalAccess', _23 => _23.successUrl]);
-  const cancelUrl = _optionalChain([options, 'optionalAccess', _24 => _24.cancelUrl]);
-  const selectPlan = _react.useCallback.call(void 0, 
-    async (plan, price) => {
-      if (subscription) {
-        setSwitchError(null);
-        setPending({ plan, price });
-        return;
-      }
-      setCheckoutError(null);
-      setCheckoutPriceId(price.id);
-      try {
-        await openCheckout(price.id, { successUrl, cancelUrl });
-      } catch (e) {
-        setCheckoutError(e);
-        setCheckoutPriceId(null);
-      }
-    },
-    [subscription, openCheckout, successUrl, cancelUrl]
-  );
-  const confirmSwitch = _react.useCallback.call(void 0, async () => {
-    if (!pending || !subscription) return;
-    setSwitching(true);
-    setSwitchError(null);
-    try {
-      await changePlan(subscription.id, pending.price.id);
-      setPending(null);
-      refetchSubscription();
-    } catch (e) {
-      setSwitchError(e);
-    } finally {
-      setSwitching(false);
-    }
-  }, [pending, subscription, changePlan, refetchSubscription]);
-  const dismissSwitch = _react.useCallback.call(void 0, () => {
-    setPending(null);
-    setSwitchError(null);
-  }, []);
-  return {
-    pending,
-    switching,
-    switchError,
-    checkoutPriceId,
-    checkoutError,
-    selectPlan,
-    confirmSwitch,
-    dismissSwitch
-  };
-}
-function useAccess(featureKey, requested) {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    details: null,
-    // Fails closed: an unresolved or failed check must never read as a yes,
-    // since this is what gates paid capability.
-    allowed: false,
-    isLoading: true,
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    let mounted = true;
-    client.check(featureKey, requested).then((details) => {
-      if (mounted) {
-        setState({ details, allowed: details.allowed, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ details: null, allowed: false, isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client, featureKey, requested]);
-  return state;
-}
-function useSubscription(productSlug) {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    subscription: null,
-    isLoading: true,
-    error: null
-  });
-  const fetchOnce = _react.useCallback.call(void 0, 
-    (mountedRef) => {
-      client.getSubscription(productSlug).then((subscription) => {
-        if (mountedRef.current) {
-          setState({ subscription, isLoading: false, error: null });
-        }
-      }).catch((error) => {
-        if (mountedRef.current) {
-          setState({ subscription: null, isLoading: false, error });
-        }
-      });
-    },
-    [client, productSlug]
-  );
-  _react.useEffect.call(void 0, () => {
-    const mountedRef = { current: true };
-    fetchOnce(mountedRef);
-    return () => {
-      mountedRef.current = false;
-    };
-  }, [fetchOnce]);
-  const refetch = _react.useCallback.call(void 0, () => {
-    setState((prev) => ({ ...prev, isLoading: true }));
-    fetchOnce({ current: true });
-  }, [fetchOnce]);
-  const isActive = _optionalChain([state, 'access', _25 => _25.subscription, 'optionalAccess', _26 => _26.status]) === "ACTIVE" || _optionalChain([state, 'access', _27 => _27.subscription, 'optionalAccess', _28 => _28.status]) === "TRIALING";
-  const planSlug = _optionalChain([state, 'access', _29 => _29.subscription, 'optionalAccess', _30 => _30.plan, 'optionalAccess', _31 => _31.slug]);
-  return {
-    ...state,
-    isActive,
-    planSlug,
-    refetch
-  };
-}
-function usePlans(productIdOrSlug) {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    plans: [],
-    isLoading: true,
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    let mounted = true;
-    client.getPlans(productIdOrSlug).then((plans) => {
-      if (mounted) {
-        setState({ plans, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ plans: [], isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client, productIdOrSlug]);
-  return state;
-}
-function useAuthConfig() {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    config: null,
-    isLoading: true,
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    let mounted = true;
-    client.getAuthConfig().then((config) => {
-      if (mounted) {
-        setState({ config, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ config: null, isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client]);
-  return state;
-}
-function useEntitlements() {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    entitlements: null,
-    isLoading: true,
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    let mounted = true;
-    client.getEntitlements().then((entitlements) => {
-      if (mounted) {
-        setState({ entitlements, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ entitlements: null, isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client]);
-  return state;
-}
-function useUsage(featureKey) {
-  const client = useClient();
-  const [state, setState] = _react.useState.call(void 0, {
-    usage: [],
-    isLoading: true,
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    let mounted = true;
-    client.getUsage(featureKey).then((usage) => {
-      if (mounted) {
-        setState({ usage, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ usage: [], isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client, featureKey]);
-  return state;
-}
-function useWaitlist() {
-  const client = useClient();
-  return {
-    join: _react.useCallback.call(void 0, (params) => client.joinWaitlist(params), [client])
-  };
-}
-function useInvitation(params) {
-  const client = useClient();
-  const { token, code } = params;
-  const [state, setState] = _react.useState.call(void 0, {
-    result: null,
-    isLoading: !!(token || code),
-    error: null
-  });
-  _react.useEffect.call(void 0, () => {
-    if (!token && !code) {
-      setState({ result: null, isLoading: false, error: null });
-      return;
-    }
-    let mounted = true;
-    const validate = token ? client.validateInvitationToken(token) : client.validateInvitationCode(code);
-    validate.then((result) => {
-      if (mounted) {
-        setState({ result, isLoading: false, error: null });
-      }
-    }).catch((error) => {
-      if (mounted) {
-        setState({ result: null, isLoading: false, error });
-      }
-    });
-    return () => {
-      mounted = false;
-    };
-  }, [client, token, code]);
-  return state;
-}
-function useUser() {
-  const { user, isLoading, updateProfile } = useAuth();
-  return {
-    user,
-    isLoading,
-    update: updateProfile,
-    // Computed properties
-    fullName: user ? `${user.first_name || ""} ${user.last_name || ""}`.trim() : null,
-    initials: user ? `${_optionalChain([user, 'access', _32 => _32.first_name, 'optionalAccess', _33 => _33[0]]) || ""}${_optionalChain([user, 'access', _34 => _34.last_name, 'optionalAccess', _35 => _35[0]]) || ""}`.toUpperCase() : null,
-    email: _optionalChain([user, 'optionalAccess', _36 => _36.email]) || null,
-    emailVerified: _optionalChain([user, 'optionalAccess', _37 => _37.email_verified]) || false
-  };
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.defaultLocalization = defaultLocalization; exports.useLocalization = useLocalization; exports.fill = fill; exports.fillNode = fillNode; exports.useErrorResolver = useErrorResolver; exports.KerneClient = KerneClient; exports.KerneContext = KerneContext; exports.KerneProvider = KerneProvider; exports.useClient = useClient; exports.useAuth = useAuth; exports.useCheckout = useCheckout; exports.usePortal = usePortal; exports.useCancelSubscription = useCancelSubscription; exports.useChangePlan = useChangePlan; exports.usePlanSwitch = usePlanSwitch; exports.useAccess = useAccess; exports.useSubscription = useSubscription; exports.usePlans = usePlans; exports.useAuthConfig = useAuthConfig; exports.useEntitlements = useEntitlements; exports.useUsage = useUsage; exports.useWaitlist = useWaitlist; exports.useInvitation = useInvitation; exports.useUser = useUser;