@kestack/web-platform 0.0.0-stage → 0.0.1

package/dist/app/assemble/assemble.js

@@ -0,0 +1,186 @@
+import { cloudProtocol, deviceProtocol } from "../apis/apis.js";
+import { OpenSessionProvider, useOpenedOrNone } from "../session/react.js";
+import { defineSession } from "../session/define.js";
+import { keepSyncs } from "../session/keeper.js";
+import { openSession } from "../session/open.js";
+import { createGate } from "../gate/gate.js";
+import { gateReact } from "../gate/react.js";
+import { publicClients } from "./public.js";
+import { Context, Effect, Layer } from "effect";
+import { useSyncExternalStore } from "react";
+import { namedAccountsTable, signIn } from "@kestack/auth-toolkit/client";
+import { Sync } from "@kestack/std-toolkit/sync";
+import { jsx } from "react/jsx-runtime";
+//#region src/app/assemble/assemble.tsx
+/** What runs while the app is on one Backend: how a Session reaches each
+* API, where its Std Sync is kept, and what deletes signed-out users'. */
+var Link = class extends Context.Service()("@kestack/web-platform/app/Link") {};
+/** An app's parts with no Accounts: its APIs and its cache. */
+const makeCore = (config) => {
+	let made;
+	const host = () => made ??= config.host();
+	const apis = config.apis ?? {};
+	const names = Object.keys(apis);
+	let loaded;
+	const loadDevice = () => loaded ??= Promise.resolve(config.device(host().storage));
+	const cloudProtocols = (token = null) => Object.fromEntries(names.map((name) => [name, cloudProtocol(apis[name], host().cloud.url, token)]));
+	const deviceProtocols = async () => {
+		const handlers = await loadDevice();
+		return Object.fromEntries(names.map((name) => [name, deviceProtocol(apis[name], handlers[name])]));
+	};
+	const protocolOf = async (backend, name) => backend === "device" ? (await deviceProtocols())[name] : cloudProtocols()[name];
+	let cacheMade;
+	const cache = () => cacheMade ??= config.cache(host().storage);
+	return {
+		host,
+		apis,
+		hasDevice: config.device !== void 0,
+		cloudProtocols,
+		deviceProtocols,
+		protocolOf,
+		cache
+	};
+};
+/** The Backend an app with no Accounts runs on: the one its launch asked
+* for, else the cloud, and changed by hand. */
+const backendStore = (core) => {
+	let backend = null;
+	const listeners = /* @__PURE__ */ new Set();
+	const current = () => {
+		if (backend === null) backend = core.host().lifecycle.launchBackend() === "device" && core.hasDevice ? "device" : "cloud";
+		return backend;
+	};
+	return {
+		current,
+		subscribe: (changed) => {
+			listeners.add(changed);
+			return () => void listeners.delete(changed);
+		},
+		set: (next) => {
+			backend = next === "device" && core.hasDevice ? "device" : "cloud";
+			listeners.forEach((changed) => changed());
+		}
+	};
+};
+function createApp(config) {
+	const core = makeCore(config);
+	return config.auth === void 0 ? publicApp(core) : authApp(core, config.auth);
+}
+const publicApp = (core) => {
+	const backend = backendStore(core);
+	const publics = publicClients(core.apis, {
+		backend: backend.current,
+		protocol: core.protocolOf
+	});
+	return {
+		/** Where the app runs. */
+		host: core.host,
+		/** This device's cache, opened on first use. */
+		cache: core.cache,
+		/** One API's client. */
+		useApi: (name) => publics[name],
+		/** The Backend the app runs on, and changing it. */
+		useBackend: () => ({
+			backend: useSyncExternalStore(backend.subscribe, backend.current, () => "cloud"),
+			setBackend: backend.set
+		})
+	};
+};
+const authApp = (core, auth) => {
+	const { host, apis } = core;
+	const session = auth.session ?? defineSession(apis, () => Effect.void);
+	const gate = createGate({
+		host,
+		cloud: () => {
+			const cloudSignIn = host().cloud.signIn;
+			if (cloudSignIn === void 0) throw new Error("An app with auth needs a Host that signs in");
+			return Layer.mergeAll(cloudSignIn, Layer.sync(Link, () => ({
+				protocols: (token) => core.cloudProtocols(token),
+				store: host().storage.sync,
+				keep: (userIds) => Effect.tryPromise(() => keepSyncs(userIds, host().storage.sync)).pipe(Effect.catch((error) => Effect.logWarning("[syncs]", error)), Effect.asVoid)
+			})));
+		},
+		...core.hasDevice && { device: async (choose) => {
+			const protocols = await core.deviceProtocols();
+			return Layer.mergeAll(signIn.named({
+				choose,
+				storage: host().storage.table(namedAccountsTable, "device")
+			}), Layer.succeed(Link, {
+				protocols: () => protocols,
+				store: Sync.memory(),
+				keep: () => Effect.void
+			}));
+		} },
+		session: (account, token, status) => Effect.gen(function* () {
+			const { protocols, store } = yield* Link;
+			return yield* openSession({
+				apis,
+				protocols: protocols(token),
+				store,
+				account,
+				token,
+				status,
+				open: session.open,
+				service: session.Service
+			});
+		}),
+		keep: (userIds) => Link.use((link) => link.keep(userIds))
+	});
+	const react = gateReact(gate);
+	const publics = publicClients(apis, {
+		backend: () => gate.backend() ?? "cloud",
+		protocol: core.protocolOf
+	});
+	function Provide(props) {
+		return /* @__PURE__ */ jsx(OpenSessionProvider, {
+			opened: react.useSession(),
+			children: props.children
+		});
+	}
+	/**
+	* Renders `children` while an Account is open, `fallback` otherwise (a
+	* node, or one per view). Everything inside remounts on an Account
+	* Switch, so wrap as little as the part that needs an Account.
+	*/
+	function SignedIn(props) {
+		return /* @__PURE__ */ jsx(react.SignedIn, {
+			fallback: props.fallback,
+			children: /* @__PURE__ */ jsx(Provide, { children: props.children })
+		});
+	}
+	return {
+		/** Where the app runs. */
+		host,
+		/** The Gate itself, outside React: for tests and non-React code. */
+		gate,
+		/** This device's cache, opened on first use. */
+		cache: core.cache,
+		SignedIn,
+		SignedOut: react.SignedOut,
+		/** The Gate, anywhere: what it shows, the Backend, online, signing in. */
+		useGate: react.useGate,
+		/** The Accounts signed in, what is done with them, and `manage`: the
+		* sign-in service's page for them. Only inside `SignedIn`. */
+		useAccounts: () => ({
+			...react.useAccounts(),
+			manage: () => host().cloud.manageAccounts?.() ?? Promise.resolve()
+		}),
+		/** The open Session's value; only inside `SignedIn`. */
+		useSession: session.use,
+		/** Runs an Effect in the open Session; only inside `SignedIn`. */
+		useRun: session.useRun,
+		/** Whether the open Account has been confirmed, live. */
+		useStatus: session.useStatus,
+		/** One API's client: signed as the open Account inside `SignedIn`, and
+		* as nobody outside it, where only a public call goes out. */
+		useApi: (name) => {
+			return useOpenedOrNone()?.apis[name] ?? publics[name];
+		},
+		/** The open Session, for Effect code: `yield* app.Session`. */
+		Session: session.Service
+	};
+};
+//#endregion
+export { createApp };
+
+//# sourceMappingURL=assemble.js.map

package/dist/app/assemble/assemble.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assemble.js","names":[],"sources":["../../../src/app/assemble/assemble.tsx"],"sourcesContent":["import { Context, Effect, Layer } from 'effect';\nimport type { RpcClient } from 'effect/rpc';\nimport { type ReactNode, useSyncExternalStore } from 'react';\nimport {\n  namedAccountsTable,\n  signIn,\n  type SignIn,\n} from '@kestack/auth-toolkit/client';\nimport { Sync, type SyncStore } from '@kestack/std-toolkit/sync';\nimport {\n  type ApiClients,\n  type Apis,\n  cloudProtocol,\n  type DeviceBackends,\n  deviceProtocol,\n} from '../apis/index.ts';\nimport { createGate, gateReact, type GateView } from '../gate/index.ts';\nimport type { Backend, Host, Storage } from '../host/index.ts';\nimport {\n  defineSession,\n  keepSyncs,\n  type Opened,\n  OpenSessionProvider,\n  openSession,\n  type SessionDef,\n  useOpenedOrNone,\n} from '../session/index.ts';\nimport { publicClients } from './public.ts';\n\n/** What an app with auth gives: what one Account keeps while it is\n * active. Without a Session, `SignedIn` still works and every API is still\n * signed; there is just nothing of the app's own to keep. */\nexport interface AuthConfig<A extends Apis, S> {\n  readonly session?: SessionDef<A, S>;\n}\n\n/** What an app gives `createApp`, each part switching on only what needs\n * it. */\nexport interface AppConfig<A extends Apis, S, C> {\n  /** Where the app runs, made the first time anything asks. */\n  readonly host: () => Host;\n  /** The app's APIs, by name. */\n  readonly apis?: A;\n  /** The device Backend: every API's handlers, run in the app on the\n   * device's own Storage, or what loads them the first time it is chosen.\n   * Without it, the app has only the cloud Backend. */\n  readonly device?: (\n    storage: Storage,\n  ) => DeviceBackends<A> | Promise<DeviceBackends<A>>;\n  /** Signing in: several Accounts on this device, one open at a time, each\n   * with its own Session. Without it, the app has no Accounts. */\n  readonly auth?: AuthConfig<A, S>;\n  /** What only this device keeps and belongs to no user, such as Settings,\n   * opened on first use. */\n  readonly cache?: (storage: Storage) => C;\n}\n\ntype NotOpen<S> = Exclude<GateView<S>, { kind: 'open' }>;\n\n/** What runs while the app is on one Backend: how a Session reaches each\n * API, where its Std Sync is kept, and what deletes signed-out users'. */\nclass Link extends Context.Service<\n  Link,\n  {\n    /** Each API's protocol for an Account whose token `token` gives. */\n    readonly protocols: (\n      token: Effect.Effect<string>,\n    ) => Readonly<Record<string, Layer.Layer<RpcClient.Protocol>>>;\n    readonly store: SyncStore;\n    readonly keep: (userIds: ReadonlyArray<string>) => Effect.Effect<void>;\n  }\n>()('@kestack/web-platform/app/Link') {}\n\n/** An app's parts with no Accounts: its APIs and its cache. */\nconst makeCore = <A extends Apis, C>(\n  config: Pick<AppConfig<A, unknown, C>, 'host' | 'apis' | 'device' | 'cache'>,\n) => {\n  let made: Host | undefined;\n  const host = () => (made ??= config.host());\n  const apis = (config.apis ?? {}) as A;\n  const names = Object.keys(apis);\n\n  let loaded: Promise<DeviceBackends<A>> | undefined;\n  const loadDevice = () =>\n    (loaded ??= Promise.resolve(config.device!(host().storage)));\n\n  const cloudProtocols = (token: Effect.Effect<string> | null = null) =>\n    Object.fromEntries(\n      names.map((name) => [\n        name,\n        cloudProtocol(apis[name]!, host().cloud.url, token),\n      ]),\n    );\n  const deviceProtocols = async () => {\n    const handlers = await loadDevice();\n    return Object.fromEntries(\n      names.map((name) => [\n        name,\n        deviceProtocol(apis[name]!, handlers[name] as never),\n      ]),\n    );\n  };\n  const protocolOf = async (backend: Backend, name: string) =>\n    backend === 'device'\n      ? (await deviceProtocols())[name]!\n      : cloudProtocols()[name]!;\n\n  let cacheMade: C | undefined;\n  const cache = () => (cacheMade ??= config.cache!(host().storage));\n\n  return {\n    host,\n    apis,\n    hasDevice: config.device !== undefined,\n    cloudProtocols,\n    deviceProtocols,\n    protocolOf,\n    cache,\n  };\n};\n\n/** The Backend an app with no Accounts runs on: the one its launch asked\n * for, else the cloud, and changed by hand. */\nconst backendStore = (core: ReturnType<typeof makeCore>) => {\n  let backend: Backend | null = null;\n  const listeners = new Set<() => void>();\n  const current = (): Backend => {\n    if (backend === null) {\n      const asked = core.host().lifecycle.launchBackend();\n      backend = asked === 'device' && core.hasDevice ? 'device' : 'cloud';\n    }\n    return backend;\n  };\n  return {\n    current,\n    subscribe: (changed: () => void) => {\n      listeners.add(changed);\n      return () => void listeners.delete(changed);\n    },\n    set: (next: Backend) => {\n      backend = next === 'device' && core.hasDevice ? 'device' : 'cloud';\n      listeners.forEach((changed) => changed());\n    },\n  };\n};\n\n/**\n * An app on any platform. Nothing runs until a screen first asks, so it\n * can be made where the Host is not there yet, as on a web server. With\n * `auth`, it runs sign-in on this device on the cloud or the device\n * Backend, and opens one Session per active Account, with every API signed\n * as them and a Std Sync named for them; the app's Session says what that\n * Session holds, this says when. Make one per app. The Web Platform's\n * `createApp` calls it with the browser's Host; tests call it with one in\n * memory.\n */\nexport function createApp<A extends Apis, S, C = never>(\n  config: AppConfig<A, S, C> & { readonly auth: AuthConfig<A, S> },\n): AuthApp<A, S, C>;\nexport function createApp<A extends Apis, C = never>(\n  config: AppConfig<A, never, C> & { readonly auth?: undefined },\n): PublicApp<A, C>;\nexport function createApp<A extends Apis, S, C>(\n  config: AppConfig<A, S, C>,\n): AuthApp<A, S, C> | PublicApp<A, C> {\n  const core = makeCore(config);\n  return config.auth === undefined\n    ? publicApp(core)\n    : authApp(core, config.auth);\n}\n\nconst publicApp = <A extends Apis, C>(\n  core: ReturnType<typeof makeCore<A, C>>,\n) => {\n  const backend = backendStore(core);\n  const publics = publicClients(core.apis, {\n    backend: backend.current,\n    protocol: core.protocolOf,\n  });\n  return {\n    /** Where the app runs. */\n    host: core.host,\n    /** This device's cache, opened on first use. */\n    cache: core.cache,\n    /** One API's client. */\n    useApi: <K extends keyof A & string>(name: K): ApiClients<A>[K] =>\n      publics[name],\n    /** The Backend the app runs on, and changing it. */\n    useBackend: () => ({\n      backend: useSyncExternalStore(\n        backend.subscribe,\n        backend.current,\n        () => 'cloud' as const,\n      ),\n      setBackend: backend.set,\n    }),\n  };\n};\n\n/** An app with no Accounts, as `createApp` makes it. */\nexport type PublicApp<A extends Apis, C> = ReturnType<typeof publicApp<A, C>>;\n\nconst authApp = <A extends Apis, S, C>(\n  core: ReturnType<typeof makeCore<A, C>>,\n  auth: AuthConfig<A, S>,\n) => {\n  const { host, apis } = core;\n  const session =\n    auth.session ??\n    (defineSession(apis, () => Effect.void) as unknown as SessionDef<A, S>);\n\n  const gate = createGate<Opened<S>, Link>({\n    host,\n    cloud: () => {\n      const cloudSignIn = host().cloud.signIn;\n      if (cloudSignIn === undefined)\n        throw new Error('An app with auth needs a Host that signs in');\n      return Layer.mergeAll(\n        cloudSignIn,\n        Layer.sync(Link, () => ({\n          protocols: (token) => core.cloudProtocols(token),\n          store: host().storage.sync,\n          keep: (userIds) =>\n            Effect.tryPromise(() =>\n              keepSyncs(userIds, host().storage.sync),\n            ).pipe(\n              Effect.catch((error) => Effect.logWarning('[syncs]', error)),\n              Effect.asVoid,\n            ),\n        })),\n      ) as Layer.Layer<SignIn | Link>;\n    },\n    ...(core.hasDevice && {\n      device: async (choose) => {\n        const protocols = await core.deviceProtocols();\n        return Layer.mergeAll(\n          signIn.named({\n            choose,\n            storage: host().storage.table(namedAccountsTable, 'device'),\n          }),\n          Layer.succeed(Link, {\n            protocols: () => protocols,\n            // The device Backend keeps everything already: a Session's Std\n            // Sync lives in memory, and there is nothing to delete.\n            store: Sync.memory(),\n            keep: () => Effect.void,\n          }),\n        );\n      },\n    }),\n    session: (account, token, status) =>\n      Effect.gen(function* () {\n        const { protocols, store } = yield* Link;\n        return yield* openSession({\n          apis,\n          protocols: protocols(token) as never,\n          store,\n          account,\n          token,\n          status,\n          open: session.open,\n          service: session.Service,\n        });\n      }),\n    keep: (userIds) => Link.use((link) => link.keep(userIds)),\n  });\n  const react = gateReact(gate);\n  const publics = publicClients(apis, {\n    backend: () => gate.backend() ?? 'cloud',\n    protocol: core.protocolOf,\n  });\n\n  // Gives the open Session to everything under SignedIn.\n  function Provide(props: { readonly children: ReactNode }) {\n    return (\n      <OpenSessionProvider opened={react.useSession() as Opened<unknown>}>\n        {props.children}\n      </OpenSessionProvider>\n    );\n  }\n\n  /**\n   * Renders `children` while an Account is open, `fallback` otherwise (a\n   * node, or one per view). Everything inside remounts on an Account\n   * Switch, so wrap as little as the part that needs an Account.\n   */\n  function SignedIn(props: {\n    readonly children: ReactNode;\n    readonly fallback?: ReactNode | ((view: NotOpen<S>) => ReactNode);\n  }) {\n    return (\n      <react.SignedIn\n        fallback={\n          props.fallback as\n            | ReactNode\n            | ((view: NotOpen<Opened<S>>) => ReactNode)\n        }\n      >\n        <Provide>{props.children}</Provide>\n      </react.SignedIn>\n    );\n  }\n\n  return {\n    /** Where the app runs. */\n    host,\n    /** The Gate itself, outside React: for tests and non-React code. */\n    gate,\n    /** This device's cache, opened on first use. */\n    cache: core.cache,\n    SignedIn,\n    SignedOut: react.SignedOut,\n    /** The Gate, anywhere: what it shows, the Backend, online, signing in. */\n    useGate: react.useGate,\n    /** The Accounts signed in, what is done with them, and `manage`: the\n     * sign-in service's page for them. Only inside `SignedIn`. */\n    useAccounts: () => ({\n      ...react.useAccounts(),\n      manage: () => host().cloud.manageAccounts?.() ?? Promise.resolve(),\n    }),\n    /** The open Session's value; only inside `SignedIn`. */\n    useSession: session.use,\n    /** Runs an Effect in the open Session; only inside `SignedIn`. */\n    useRun: session.useRun,\n    /** Whether the open Account has been confirmed, live. */\n    useStatus: session.useStatus,\n    /** One API's client: signed as the open Account inside `SignedIn`, and\n     * as nobody outside it, where only a public call goes out. */\n    useApi: <K extends keyof A & string>(name: K): ApiClients<A>[K] => {\n      const opened = useOpenedOrNone();\n      return (opened?.apis[name] ?? publics[name]) as ApiClients<A>[K];\n    },\n    /** The open Session, for Effect code: `yield* app.Session`. */\n    Session: session.Service,\n  };\n};\n\n/** An app with Accounts, as `createApp` makes it. */\nexport type AuthApp<A extends Apis, S, C> = ReturnType<typeof authApp<A, S, C>>;\n"],"mappings":";;;;;;;;;;;;;;;;AA6DA,IAAM,OAAN,cAAmB,QAAQ,QAUzB,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;;AAGvC,MAAM,YACJ,WACG;CACH,IAAI;CACJ,MAAM,aAAc,SAAS,OAAO,KAAK;CACzC,MAAM,OAAQ,OAAO,QAAQ,CAAC;CAC9B,MAAM,QAAQ,OAAO,KAAK,IAAI;CAE9B,IAAI;CACJ,MAAM,mBACH,WAAW,QAAQ,QAAQ,OAAO,OAAQ,KAAK,CAAC,CAAC,OAAO,CAAC;CAE5D,MAAM,kBAAkB,QAAsC,SAC5D,OAAO,YACL,MAAM,KAAK,SAAS,CAClB,MACA,cAAc,KAAK,OAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,KAAK,CACpD,CAAC,CACH;CACF,MAAM,kBAAkB,YAAY;EAClC,MAAM,WAAW,MAAM,WAAW;EAClC,OAAO,OAAO,YACZ,MAAM,KAAK,SAAS,CAClB,MACA,eAAe,KAAK,OAAQ,SAAS,KAAc,CACrD,CAAC,CACH;CACF;CACA,MAAM,aAAa,OAAO,SAAkB,SAC1C,YAAY,YACP,MAAM,gBAAgB,EAAA,CAAG,QAC1B,eAAe,CAAC,CAAC;CAEvB,IAAI;CACJ,MAAM,cAAe,cAAc,OAAO,MAAO,KAAK,CAAC,CAAC,OAAO;CAE/D,OAAO;EACL;EACA;EACA,WAAW,OAAO,WAAW,KAAA;EAC7B;EACA;EACA;EACA;CACF;AACF;;;AAIA,MAAM,gBAAgB,SAAsC;CAC1D,IAAI,UAA0B;CAC9B,MAAM,4BAAY,IAAI,IAAgB;CACtC,MAAM,gBAAyB;EAC7B,IAAI,YAAY,MAEd,UADc,KAAK,KAAK,CAAC,CAAC,UAAU,cACtB,MAAM,YAAY,KAAK,YAAY,WAAW;EAE9D,OAAO;CACT;CACA,OAAO;EACL;EACA,YAAY,YAAwB;GAClC,UAAU,IAAI,OAAO;GACrB,aAAa,KAAK,UAAU,OAAO,OAAO;EAC5C;EACA,MAAM,SAAkB;GACtB,UAAU,SAAS,YAAY,KAAK,YAAY,WAAW;GAC3D,UAAU,SAAS,YAAY,QAAQ,CAAC;EAC1C;CACF;AACF;AAkBA,SAAgB,UACd,QACoC;CACpC,MAAM,OAAO,SAAS,MAAM;CAC5B,OAAO,OAAO,SAAS,KAAA,IACnB,UAAU,IAAI,IACd,QAAQ,MAAM,OAAO,IAAI;AAC/B;AAEA,MAAM,aACJ,SACG;CACH,MAAM,UAAU,aAAa,IAAI;CACjC,MAAM,UAAU,cAAc,KAAK,MAAM;EACvC,SAAS,QAAQ;EACjB,UAAU,KAAK;CACjB,CAAC;CACD,OAAO;;EAEL,MAAM,KAAK;;EAEX,OAAO,KAAK;;EAEZ,SAAqC,SACnC,QAAQ;;EAEV,mBAAmB;GACjB,SAAS,qBACP,QAAQ,WACR,QAAQ,eACF,OACR;GACA,YAAY,QAAQ;EACtB;CACF;AACF;AAKA,MAAM,WACJ,MACA,SACG;CACH,MAAM,EAAE,MAAM,SAAS;CACvB,MAAM,UACJ,KAAK,WACJ,cAAc,YAAY,OAAO,IAAI;CAExC,MAAM,OAAO,WAA4B;EACvC;EACA,aAAa;GACX,MAAM,cAAc,KAAK,CAAC,CAAC,MAAM;GACjC,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,6CAA6C;GAC/D,OAAO,MAAM,SACX,aACA,MAAM,KAAK,aAAa;IACtB,YAAY,UAAU,KAAK,eAAe,KAAK;IAC/C,OAAO,KAAK,CAAC,CAAC,QAAQ;IACtB,OAAO,YACL,OAAO,iBACL,UAAU,SAAS,KAAK,CAAC,CAAC,QAAQ,IAAI,CACxC,CAAC,CAAC,KACA,OAAO,OAAO,UAAU,OAAO,WAAW,WAAW,KAAK,CAAC,GAC3D,OAAO,MACT;GACJ,EAAE,CACJ;EACF;EACA,GAAI,KAAK,aAAa,EACpB,QAAQ,OAAO,WAAW;GACxB,MAAM,YAAY,MAAM,KAAK,gBAAgB;GAC7C,OAAO,MAAM,SACX,OAAO,MAAM;IACX;IACA,SAAS,KAAK,CAAC,CAAC,QAAQ,MAAM,oBAAoB,QAAQ;GAC5D,CAAC,GACD,MAAM,QAAQ,MAAM;IAClB,iBAAiB;IAGjB,OAAO,KAAK,OAAO;IACnB,YAAY,OAAO;GACrB,CAAC,CACH;EACF,EACF;EACA,UAAU,SAAS,OAAO,WACxB,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,WAAW,UAAU,OAAO;GACpC,OAAO,OAAO,YAAY;IACxB;IACA,WAAW,UAAU,KAAK;IAC1B;IACA;IACA;IACA;IACA,MAAM,QAAQ;IACd,SAAS,QAAQ;GACnB,CAAC;EACH,CAAC;EACH,OAAO,YAAY,KAAK,KAAK,SAAS,KAAK,KAAK,OAAO,CAAC;CAC1D,CAAC;CACD,MAAM,QAAQ,UAAU,IAAI;CAC5B,MAAM,UAAU,cAAc,MAAM;EAClC,eAAe,KAAK,QAAQ,KAAK;EACjC,UAAU,KAAK;CACjB,CAAC;CAGD,SAAS,QAAQ,OAAyC;EACxD,OACE,oBAAC,qBAAD;GAAqB,QAAQ,MAAM,WAAW;GAC3C,UAAA,MAAM;EACY,CAAA;CAEzB;;;;;;CAOA,SAAS,SAAS,OAGf;EACD,OACE,oBAAC,MAAM,UAAP;GACE,UACE,MAAM;GAKR,UAAA,oBAAC,SAAD,EAAA,UAAU,MAAM,SAAkB,CAAA;EACpB,CAAA;CAEpB;CAEA,OAAO;;EAEL;;EAEA;;EAEA,OAAO,KAAK;EACZ;EACA,WAAW,MAAM;;EAEjB,SAAS,MAAM;;;EAGf,oBAAoB;GAClB,GAAG,MAAM,YAAY;GACrB,cAAc,KAAK,CAAC,CAAC,MAAM,iBAAiB,KAAK,QAAQ,QAAQ;EACnE;;EAEA,YAAY,QAAQ;;EAEpB,QAAQ,QAAQ;;EAEhB,WAAW,QAAQ;;;EAGnB,SAAqC,SAA8B;GAEjE,OADe,gBACF,CAAC,EAAE,KAAK,SAAS,QAAQ;EACxC;;EAEA,SAAS,QAAQ;CACnB;AACF"}

package/dist/app/assemble/index.d.ts

@@ -0,0 +1,2 @@
+import { AppConfig, AuthApp, AuthConfig, PublicApp, createApp } from "./assemble.js";
+export { type AppConfig, type AuthApp, type AuthConfig, type PublicApp, createApp };

package/dist/app/assemble/index.js

@@ -0,0 +1,2 @@
+import { createApp } from "./assemble.js";
+export { createApp };

package/dist/app/assemble/public.d.ts

@@ -0,0 +1,18 @@
+import { ApiClients, Apis } from "../apis/apis.js";
+import "../apis/index.js";
+import { Backend } from "../host/host.js";
+import "../host/index.js";
+import { Layer } from "effect";
+import { RpcClient } from "effect/rpc";
+//#region src/app/assemble/public.d.ts
+/**
+ * Every API's client signed as nobody, on whichever Backend runs when a
+ * call is made: a public call goes out as it is, and a guarded one fails
+ * Unauthenticated without being sent. For calls outside `SignedIn`.
+ */
+export declare const publicClients: <A extends Apis>(apis: A, options: {
+  readonly backend: () => Backend;
+  readonly protocol: (backend: Backend, name: string) => Promise<Layer.Layer<RpcClient.Protocol>>;
+}) => ApiClients<A>;
+//#endregion
+//# sourceMappingURL=public.d.ts.map

package/dist/app/assemble/public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.ts","names":[],"sources":["../../../src/app/assemble/public.ts"],"mappings":";;;;;;;;;;;;qBAwBa,gBAAiB,UAAU,MAAI,MACpC,GAAC;WAEI,eAAe;WACf,WACP,SAAS,SACT,iBACG,QAAQ,MAAM,MAAM,UAAU;MAEpC,WAAW"}

package/dist/app/assemble/public.js

@@ -0,0 +1,41 @@
+import { Context, Effect, Layer, ManagedRuntime, Stream } from "effect";
+import { RpcClient, RpcSchema } from "effect/rpc";
+import { Authz } from "@kestack/auth-toolkit/guard";
+//#region src/app/assemble/public.ts
+/**
+* Every API's client signed as nobody, on whichever Backend runs when a
+* call is made: a public call goes out as it is, and a guarded one fails
+* Unauthenticated without being sent. For calls outside `SignedIn`.
+*/
+const publicClients = (apis, options) => {
+	const made = /* @__PURE__ */ new Map();
+	const clientOf = (name) => {
+		const backend = options.backend();
+		const key = `${backend}/${name}`;
+		let client = made.get(key);
+		if (client === void 0) {
+			client = options.protocol(backend, name).then((protocol) => {
+				const Key = Context.Service(`@kestack/web-platform/PublicClient/${key}`);
+				return ManagedRuntime.make(Layer.effect(Key, RpcClient.make(apis[name].group)).pipe(Layer.provide([protocol, Authz.bearer(() => null)]))).runPromise(Effect.gen(function* () {
+					return yield* Key;
+				}));
+			});
+			made.set(key, client);
+			client.catch(() => {
+				if (made.get(key) === client) made.delete(key);
+			});
+		}
+		return client;
+	};
+	return Object.fromEntries(Object.entries(apis).map(([name, { group }]) => {
+		return [name, Object.fromEntries([...group.requests.values()].map((rpc) => {
+			const client = Effect.promise(() => clientOf(name));
+			const call = RpcSchema.isStreamSchema(rpc.successSchema) ? (...args) => Stream.unwrap(Effect.map(client, (made) => made[rpc._tag](...args))) : (...args) => Effect.flatMap(client, (made) => made[rpc._tag](...args));
+			return [rpc._tag, call];
+		}))];
+	}));
+};
+//#endregion
+export { publicClients };
+
+//# sourceMappingURL=public.js.map

package/dist/app/assemble/public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.js","names":["Client"],"sources":["../../../src/app/assemble/public.ts"],"sourcesContent":["import {\n  Context,\n  Effect,\n  Layer,\n  ManagedRuntime,\n  type Schema,\n  Stream,\n} from 'effect';\nimport { type RpcClient, RpcClient as Client, RpcSchema } from 'effect/rpc';\nimport { Authz } from '@kestack/auth-toolkit/guard';\nimport type { ApiClients, Apis } from '../apis/index.ts';\nimport type { Backend } from '../host/index.ts';\n\ninterface PublicClient {\n  readonly '@kestack/web-platform/PublicClient': unique symbol;\n}\n\ntype AnyCall = (...args: ReadonlyArray<unknown>) => unknown;\n\n/**\n * Every API's client signed as nobody, on whichever Backend runs when a\n * call is made: a public call goes out as it is, and a guarded one fails\n * Unauthenticated without being sent. For calls outside `SignedIn`.\n */\nexport const publicClients = <A extends Apis>(\n  apis: A,\n  options: {\n    readonly backend: () => Backend;\n    readonly protocol: (\n      backend: Backend,\n      name: string,\n    ) => Promise<Layer.Layer<RpcClient.Protocol>>;\n  },\n): ApiClients<A> => {\n  // One client per Backend and API, made on its first call.\n  const made = new Map<string, Promise<Record<string, AnyCall>>>();\n  const clientOf = (name: string) => {\n    const backend = options.backend();\n    const key = `${backend}/${name}`;\n    let client = made.get(key);\n    if (client === undefined) {\n      client = options.protocol(backend, name).then((protocol) => {\n        const Key = Context.Service<PublicClient, Record<string, AnyCall>>(\n          `@kestack/web-platform/PublicClient/${key}`,\n        );\n        const runtime = ManagedRuntime.make(\n          Layer.effect(\n            Key,\n            Client.make(apis[name]!.group) as unknown as Effect.Effect<\n              Record<string, AnyCall>\n            >,\n          ).pipe(Layer.provide([protocol, Authz.bearer(() => null)])),\n        );\n        return runtime.runPromise(\n          Effect.gen(function* () {\n            return yield* Key;\n          }),\n        );\n      });\n      made.set(key, client);\n      // A load that failed is tried again on the next call.\n      client.catch(() => {\n        if (made.get(key) === client) made.delete(key);\n      });\n    }\n    return client;\n  };\n\n  return Object.fromEntries(\n    Object.entries(apis).map(([name, { group }]) => {\n      const calls = Object.fromEntries(\n        [...group.requests.values()].map((rpc) => {\n          const client = Effect.promise(() => clientOf(name));\n          const call = RpcSchema.isStreamSchema(\n            (rpc as unknown as { readonly successSchema: Schema.Top })\n              .successSchema,\n          )\n            ? (...args: ReadonlyArray<unknown>) =>\n                Stream.unwrap(\n                  Effect.map(\n                    client,\n                    (made) =>\n                      made[rpc._tag]!(...args) as Stream.Stream<unknown>,\n                  ),\n                )\n            : (...args: ReadonlyArray<unknown>) =>\n                Effect.flatMap(\n                  client,\n                  (made) =>\n                    made[rpc._tag]!(...args) as Effect.Effect<unknown, unknown>,\n                );\n          return [rpc._tag, call];\n        }),\n      );\n      return [name, calls];\n    }),\n  ) as unknown as ApiClients<A>;\n};\n"],"mappings":";;;;;;;;;AAwBA,MAAa,iBACX,MACA,YAOkB;CAElB,MAAM,uBAAO,IAAI,IAA8C;CAC/D,MAAM,YAAY,SAAiB;EACjC,MAAM,UAAU,QAAQ,QAAQ;EAChC,MAAM,MAAM,GAAG,QAAQ,GAAG;EAC1B,IAAI,SAAS,KAAK,IAAI,GAAG;EACzB,IAAI,WAAW,KAAA,GAAW;GACxB,SAAS,QAAQ,SAAS,SAAS,IAAI,CAAC,CAAC,MAAM,aAAa;IAC1D,MAAM,MAAM,QAAQ,QAClB,sCAAsC,KACxC;IASA,OARgB,eAAe,KAC7B,MAAM,OACJ,KACAA,UAAO,KAAK,KAAK,KAAK,CAAE,KAAK,CAG/B,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,UAAU,MAAM,aAAa,IAAI,CAAC,CAAC,CAAC,CAE/C,CAAC,CAAC,WACb,OAAO,IAAI,aAAa;KACtB,OAAO,OAAO;IAChB,CAAC,CACH;GACF,CAAC;GACD,KAAK,IAAI,KAAK,MAAM;GAEpB,OAAO,YAAY;IACjB,IAAI,KAAK,IAAI,GAAG,MAAM,QAAQ,KAAK,OAAO,GAAG;GAC/C,CAAC;EACH;EACA,OAAO;CACT;CAEA,OAAO,OAAO,YACZ,OAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa;EAyB9C,OAAO,CAAC,MAxBM,OAAO,YACnB,CAAC,GAAG,MAAM,SAAS,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;GACxC,MAAM,SAAS,OAAO,cAAc,SAAS,IAAI,CAAC;GAClD,MAAM,OAAO,UAAU,eACpB,IACE,aACL,KACK,GAAG,SACF,OAAO,OACL,OAAO,IACL,SACC,SACC,KAAK,IAAI,KAAK,CAAE,GAAG,IAAI,CAC3B,CACF,KACD,GAAG,SACF,OAAO,QACL,SACC,SACC,KAAK,IAAI,KAAK,CAAE,GAAG,IAAI,CAC3B;GACN,OAAO,CAAC,IAAI,MAAM,IAAI;EACxB,CAAC,CAEe,CAAC;CACrB,CAAC,CACH;AACF"}

package/dist/app/gate/domain/check.d.ts

@@ -0,0 +1,33 @@
+import { Held, User } from "./types.js";
+import { Device } from "./services.js";
+import { Effect, Schema } from "effect";
+import { SignIn } from "@kestack/auth-toolkit/client";
+//#region src/app/gate/domain/check.d.ts
+declare const Unreachable_base: Schema.Class<Unreachable, Schema.Struct<{
+  readonly _tag: Schema.tag<"Unreachable">;
+}>, import("effect/Cause").YieldableError>;
+/** The Backend could not be reached, and nobody was open here before to
+ * open without it. */
+export declare class Unreachable extends Unreachable_base {}
+/** Who is signed in, and whose Session to open. */
+export type Checked = {
+  readonly accounts: ReadonlyArray<Held>;
+  /** Null with nobody to open, or while an account is lost. */
+  readonly chosen: Held | null;
+  /** The account found lost, still waiting for the User. */
+  readonly lost: User | null;
+  /** Whether the Backend answered; when it did not, everything is as the
+   * device remembers it. */
+  readonly answered: boolean;
+};
+/**
+ * Asks the Backend who is signed in, remembers it, and chooses the Active
+ * Account. `open` is the account open now: if the Backend no longer names
+ * it, and this device did not sign it out, it is lost, and stays lost until
+ * the User signs in to it again or someone new signs in. What the device
+ * keeps for anyone else is deleted. When the Backend can't be reached, the
+ * Remembered Accounts stand in for its answer.
+ */
+export declare const check: (open: User | null) => Effect.Effect<Checked, Unreachable, SignIn | Device>;
+//#endregion
+//# sourceMappingURL=check.d.ts.map

package/dist/app/gate/domain/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","names":[],"sources":["../../../../src/app/gate/domain/check.ts"],"mappings":";;;;;;;;;;qBAOa,oBAAoB;;YAKrB;WACD,UAAU,cAAc;;WAExB,QAAQ;;WAER,MAAM;;;WAGN;;;;;;;;;;qBAcE,QAAK,MACV,gBACL,OAAO,OAAO,SAAS,aAAa,SAAS"}

package/dist/app/gate/domain/check.js

@@ -0,0 +1,50 @@
+import { Device } from "./services.js";
+import { Effect, Schema } from "effect";
+import { SignIn } from "@kestack/auth-toolkit/client";
+//#region src/app/gate/domain/check.ts
+/** The Backend could not be reached, and nobody was open here before to
+* open without it. */
+var Unreachable = class extends Schema.Error("@kestack/auth-toolkit/gate/Unreachable")({ _tag: Schema.tag("Unreachable") }) {};
+const activeOf = (accounts) => accounts.find(({ active }) => active) ?? accounts[0] ?? null;
+/**
+* Asks the Backend who is signed in, remembers it, and chooses the Active
+* Account. `open` is the account open now: if the Backend no longer names
+* it, and this device did not sign it out, it is lost, and stays lost until
+* the User signs in to it again or someone new signs in. What the device
+* keeps for anyone else is deleted. When the Backend can't be reached, the
+* Remembered Accounts stand in for its answer.
+*/
+const check = (open) => Effect.gen(function* () {
+	const signIn = yield* SignIn;
+	const device = yield* Device;
+	const remembered = yield* device.remembered;
+	const listed = yield* Effect.result(signIn.list);
+	if (listed._tag === "Failure") {
+		const chosen = remembered.lost === null ? activeOf(remembered.accounts) : null;
+		if (remembered.lost === null && chosen === null) return yield* new Unreachable();
+		return {
+			...remembered,
+			chosen,
+			answered: false
+		};
+	}
+	const accounts = listed.success;
+	const named = (id) => accounts.some(({ user }) => user.id === id);
+	const someoneNew = accounts.some(({ user }) => !remembered.accounts.some((was) => was.user.id === user.id));
+	const lost = remembered.lost !== null ? named(remembered.lost.id) || someoneNew ? null : remembered.lost : open !== null && !named(open.id) && !(yield* device.signedOutHere(open.id)) ? open : null;
+	yield* device.remember({
+		accounts,
+		lost
+	});
+	yield* device.keep([...accounts.map(({ user }) => user.id), ...lost === null ? [] : [lost.id]]);
+	return {
+		accounts,
+		chosen: lost === null ? activeOf(accounts) : null,
+		lost,
+		answered: true
+	};
+});
+//#endregion
+export { Unreachable, check };
+
+//# sourceMappingURL=check.js.map

package/dist/app/gate/domain/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","names":[],"sources":["../../../../src/app/gate/domain/check.ts"],"sourcesContent":["import { Effect, Schema } from 'effect';\nimport { SignIn } from '@kestack/auth-toolkit/client';\nimport { Device } from './services.ts';\nimport type { Held, User } from './types.ts';\n\n/** The Backend could not be reached, and nobody was open here before to\n * open without it. */\nexport class Unreachable extends Schema.Error<Unreachable>(\n  '@kestack/auth-toolkit/gate/Unreachable',\n)({ _tag: Schema.tag('Unreachable') }) {}\n\n/** Who is signed in, and whose Session to open. */\nexport type Checked = {\n  readonly accounts: ReadonlyArray<Held>;\n  /** Null with nobody to open, or while an account is lost. */\n  readonly chosen: Held | null;\n  /** The account found lost, still waiting for the User. */\n  readonly lost: User | null;\n  /** Whether the Backend answered; when it did not, everything is as the\n   * device remembers it. */\n  readonly answered: boolean;\n};\n\nconst activeOf = (accounts: ReadonlyArray<Held>) =>\n  accounts.find(({ active }) => active) ?? accounts[0] ?? null;\n\n/**\n * Asks the Backend who is signed in, remembers it, and chooses the Active\n * Account. `open` is the account open now: if the Backend no longer names\n * it, and this device did not sign it out, it is lost, and stays lost until\n * the User signs in to it again or someone new signs in. What the device\n * keeps for anyone else is deleted. When the Backend can't be reached, the\n * Remembered Accounts stand in for its answer.\n */\nexport const check = (\n  open: User | null,\n): Effect.Effect<Checked, Unreachable, SignIn | Device> =>\n  Effect.gen(function* () {\n    const signIn = yield* SignIn;\n    const device = yield* Device;\n    const remembered = yield* device.remembered;\n    const listed = yield* Effect.result(signIn.list);\n    if (listed._tag === 'Failure') {\n      const chosen =\n        remembered.lost === null ? activeOf(remembered.accounts) : null;\n      if (remembered.lost === null && chosen === null)\n        return yield* new Unreachable();\n      return { ...remembered, chosen, answered: false };\n    }\n    const accounts: ReadonlyArray<Held> = listed.success;\n    const named = (id: string) => accounts.some(({ user }) => user.id === id);\n    const someoneNew = accounts.some(\n      ({ user }) => !remembered.accounts.some((was) => was.user.id === user.id),\n    );\n    const lost =\n      remembered.lost !== null\n        ? named(remembered.lost.id) || someoneNew\n          ? null\n          : remembered.lost\n        : open !== null &&\n            !named(open.id) &&\n            !(yield* device.signedOutHere(open.id))\n          ? open\n          : null;\n    yield* device.remember({ accounts, lost });\n    yield* device.keep([\n      ...accounts.map(({ user }) => user.id),\n      ...(lost === null ? [] : [lost.id]),\n    ]);\n    return {\n      accounts,\n      chosen: lost === null ? activeOf(accounts) : null,\n      lost,\n      answered: true,\n    };\n  });\n"],"mappings":";;;;;;AAOA,IAAa,cAAb,cAAiC,OAAO,MACtC,wCACF,CAAC,CAAC,EAAE,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;AAcxC,MAAM,YAAY,aAChB,SAAS,MAAM,EAAE,aAAa,MAAM,KAAK,SAAS,MAAM;;;;;;;;;AAU1D,MAAa,SACX,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO;CACtB,MAAM,SAAS,OAAO;CACtB,MAAM,aAAa,OAAO,OAAO;CACjC,MAAM,SAAS,OAAO,OAAO,OAAO,OAAO,IAAI;CAC/C,IAAI,OAAO,SAAS,WAAW;EAC7B,MAAM,SACJ,WAAW,SAAS,OAAO,SAAS,WAAW,QAAQ,IAAI;EAC7D,IAAI,WAAW,SAAS,QAAQ,WAAW,MACzC,OAAO,OAAO,IAAI,YAAY;EAChC,OAAO;GAAE,GAAG;GAAY;GAAQ,UAAU;EAAM;CAClD;CACA,MAAM,WAAgC,OAAO;CAC7C,MAAM,SAAS,OAAe,SAAS,MAAM,EAAE,WAAW,KAAK,OAAO,EAAE;CACxE,MAAM,aAAa,SAAS,MACzB,EAAE,WAAW,CAAC,WAAW,SAAS,MAAM,QAAQ,IAAI,KAAK,OAAO,KAAK,EAAE,CAC1E;CACA,MAAM,OACJ,WAAW,SAAS,OAChB,MAAM,WAAW,KAAK,EAAE,KAAK,aAC3B,OACA,WAAW,OACb,SAAS,QACP,CAAC,MAAM,KAAK,EAAE,KACd,EAAE,OAAO,OAAO,cAAc,KAAK,EAAE,KACrC,OACA;CACR,OAAO,OAAO,SAAS;EAAE;EAAU;CAAK,CAAC;CACzC,OAAO,OAAO,KAAK,CACjB,GAAG,SAAS,KAAK,EAAE,WAAW,KAAK,EAAE,GACrC,GAAI,SAAS,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CACnC,CAAC;CACD,OAAO;EACL;EACA,QAAQ,SAAS,OAAO,SAAS,QAAQ,IAAI;EAC7C;EACA,UAAU;CACZ;AACF,CAAC"}

package/dist/app/gate/domain/index.d.ts

@@ -0,0 +1,4 @@
+import { GateNotice, GateView, Held, User } from "./types.js";
+import { Device, Sessions, Switching } from "./services.js";
+import { gateMachine } from "./machine.js";
+export { Device, type GateNotice, type GateView, type Held, Sessions, Switching, type User, gateMachine };

package/dist/app/gate/domain/index.js

@@ -0,0 +1,3 @@
+import { Device, Sessions, Switching } from "./services.js";
+import { gateMachine } from "./machine.js";
+export { Device, Sessions, Switching, gateMachine };

package/dist/app/gate/domain/machine.d.ts

@@ -0,0 +1,180 @@
+import { Held, User } from "./types.js";
+import { Device, Remembered, Sessions, Switching } from "./services.js";
+import { Checked, Unreachable } from "./check.js";
+import { Schema } from "effect";
+import { SignIn } from "@kestack/auth-toolkit/client";
+//#region src/app/gate/domain/machine.d.ts
+/** Everything the Gate knows about who is signed in, and the open Session. */
+export type GateContext = {
+  /** Every Signed-in Account on this device. */
+  readonly accounts: ReadonlyArray<Held>;
+  /** Whose Session is open, or opening. */
+  readonly account: Held | null;
+  /** What the open Session gave, from when it is ready until it
+   * ends. */
+  readonly session: unknown;
+  /** Whether the last check failed with nobody to open without it. */
+  readonly unreachable: boolean;
+  /** Whether the browser-wide Account Switch to `account` is still owed. */
+  readonly pending: boolean;
+  /** Whether `accounts` were just checked, so the open needs no check. */
+  readonly fresh: boolean;
+  /** How many times in a row `account` failed to open. */
+  readonly failures: number;
+  /** The account found lost, until the User signs in to it again or opens
+   * another. */
+  readonly lost: User | null;
+};
+type Verify = {
+  readonly account: Held;
+  readonly pending: boolean;
+  readonly fresh: boolean;
+};
+type SignOut = {
+  readonly account: Held | null;
+  readonly quiet: ReadonlyArray<string>;
+};
+/**
+ * The Gate's lifecycle on one Backend. An account the device remembers opens
+ * first and is confirmed behind it (Open First); with nobody remembered it
+ * finds who is signed in. It holds the Active Account's Session
+ * open until an Account Switch, a sign-out, or the account turning out to
+ * be signed out (Account Lost). Leaving `open` ends the Session, so
+ * nothing of one account outlives its state.
+ */
+export declare const gateMachine: import("xstate").StateMachine<GateContext & import("xstate").MachineContext, import("xstate").InferEvents<{
+  CHECK: import("xstate").StandardSchemaV1<{}, {}> & Schema.Struct<{}>;
+  SWITCH: import("xstate").StandardSchemaV1<{
+    readonly userId: string;
+  }, {
+    readonly userId: string;
+  }> & Schema.Struct<{
+    readonly userId: Schema.String;
+  }>;
+  SIGN_OUT: import("xstate").StandardSchemaV1<{}, {}> & Schema.Struct<{}>;
+  SIGN_OUT_EVERYONE: import("xstate").StandardSchemaV1<{}, {}> & Schema.Struct<{}>;
+  RETRY: import("xstate").StandardSchemaV1<{}, {}> & Schema.Struct<{}>;
+  SESSION_OPENED: import("xstate").StandardSchemaV1<{
+    readonly session: unknown;
+  }, {
+    readonly session: unknown;
+  }> & Schema.Struct<{
+    readonly session: Schema.Unknown;
+  }>;
+}>, {
+  [x: string]: import("xstate").AnyActor;
+}, "checking" | "forgetting" | "signedOut" | "signingOut" | "starting" | "unopenable" | {
+  accountLost: "idle" | "verifying";
+} | {
+  open: "opening" | {
+    ready: "idle" | "verifying";
+  };
+}, string, unknown, undefined, {
+  type: string;
+}, never, {
+  input: undefined;
+} & {
+  id: "gate";
+} & {
+  initial: "starting";
+} & {
+  states: {
+    readonly starting: {
+      input: undefined;
+    } & {
+      invoke: {
+        src: "remembered";
+      };
+    };
+    readonly checking: {
+      input: undefined;
+    } & {
+      invoke: {
+        src: "checking";
+      };
+    };
+    readonly signedOut: {
+      input: undefined;
+    };
+    readonly signingOut: {
+      input: undefined;
+    } & {
+      invoke: {
+        src: "signingOut";
+      };
+    };
+    readonly accountLost: {
+      input: undefined;
+    } & {
+      initial: "verifying";
+    } & {
+      states: {
+        readonly idle: {
+          input: undefined;
+        };
+        readonly verifying: {
+          input: undefined;
+        } & {
+          invoke: {
+            src: "checking";
+          };
+        };
+      };
+    };
+    readonly forgetting: {
+      input: undefined;
+    } & {
+      invoke: {
+        src: "forgetting";
+      };
+    };
+    readonly unopenable: {
+      input: undefined;
+    };
+    readonly open: {
+      input: undefined;
+    } & {
+      initial: "opening";
+    } & {
+      invoke: {
+        src: "session";
+      };
+    } & {
+      states: {
+        readonly opening: {
+          input: undefined;
+        };
+        readonly ready: {
+          input: undefined;
+        } & {
+          initial: "verifying";
+        } & {
+          states: {
+            readonly idle: {
+              input: undefined;
+            };
+            readonly verifying: {
+              input: undefined;
+            } & {
+              invoke: {
+                src: "verifying";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {}, {
+  session: import("@xstate/effect").EffectActorLogic<undefined, never, Held, Sessions>;
+  remembered: import("@xstate/effect").EffectActorLogic<Remembered, never, undefined, Device>;
+  checking: import("@xstate/effect").EffectActorLogic<Checked, Unreachable, undefined, Device | SignIn>;
+  verifying: import("@xstate/effect").EffectActorLogic<Checked | null, unknown, Verify, Device | SignIn | Switching>;
+  signingOut: import("@xstate/effect").EffectActorLogic<void, import("@kestack/auth-toolkit/client").Unreachable, SignOut, SignIn | Switching>;
+  forgetting: import("@xstate/effect").EffectActorLogic<void, never, User, Device | Switching>;
+}, {}, {}, never, never> & {
+  readonly id: "gate";
+  readonly version: undefined;
+};
+//#endregion
+//# sourceMappingURL=machine.d.ts.map

package/dist/app/gate/domain/machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.ts","names":["_$__check_ts0.Unreachable"],"sources":["../../../../src/app/gate/domain/machine.ts"],"mappings":";;;;;;;YAQY;;WAED,UAAU,cAAc;;WAExB,SAAS;;;WAGT;;WAEA;;WAEA;;WAEA;;WAEA;;;WAGA,MAAM;;KAiDZ;WACM,SAAS;WACT;WACA;;KA6CN;WACM,SAAS;WACT,OAAO;;;;;;;;;;qBA2GL,8BAAW,aAAA,+BAAA,iCAAA"}