@mapomodule/core 2.0.0-beta.1 → 2.0.0-beta.10

package/README.md

@@ -1,13 +1,13 @@
 # @mapomodule/core
 
-The service layer of Mapo. Provides the typed CRUD factory, auth composable, route middleware, the `$mapoFetch` interceptor, and the boot plugins that wire everything together.
+The service layer of Mapo: an auth-aware `$fetch`, a typed CRUD repository for Django REST Framework endpoints, the auth composable, the `auth`, `permissions` and `roles` route middleware, and a server-side plugin that loads the session before any page renders.
 
 ## Installation
 
-In a Nuxt 4 app — typically you don't install this directly; install the meta-package [`mapomodule`](../../mapomodule/) which registers `core` together with `@mapomodule/store`. If you really want it standalone:
+Apps get it through the meta-package [`mapomodule`](https://www.npmjs.com/package/mapomodule) and set its options at the top level of the `mapo` key. On its own:
 
 ```bash
-pnpm add @mapomodule/core
+pnpm add @mapomodule/core@next
 ```
 
 ```ts
@@ -16,31 +16,41 @@ export default defineNuxtConfig({
   modules: ["@mapomodule/core"],
   mapoCore: {
     authLoginUrl: "/api/auth/login",
-    userInfoApi: "/api/profiles/me/",
-    logoutUrl: "/api/auth/logout",
-    loginUrl: "/login",
   },
 });
 ```
 
-When installed via `mapomodule`, configure under the `mapo` key instead.
+It installs `@mapomodule/store` when the app does not register it. Mapo v2 is published on the `next` dist-tag while it is in beta.
 
-## What you get (auto-imported)
+## Options
 
-| API               | Purpose                                                                     |
-| ----------------- | --------------------------------------------------------------------------- |
-| `useCrud<T>(url)` | Typed CRUD repository: `list`, `get`, `create`, `update`, `patch`, `delete` |
-| `useMapoAuth()`   | `login`, `logout`, `fetchUser` — drives the auth store                      |
-| `useMapoFetch()`  | Pre-configured `$fetch` with 401/403 interceptors                           |
-| `useMapo()`       | Facade exposing the above as a single object                                |
-| `auth` middleware | Route middleware: redirects unauthenticated users to `loginUrl`             |
+| Option         | Default               | Description                                                               |
+| -------------- | --------------------- | ------------------------------------------------------------------------- |
+| `authLoginUrl` | `"/api/auth/login"`   | Endpoint called by `useMapoAuth().login()`                                |
+| `userInfoApi`  | `"/api/profiles/me/"` | Endpoint that returns the logged-in user, called server-side on page load |
+| `logoutUrl`    | `"/api/auth/logout"`  | Endpoint called by `useMapoAuth().logout()`                               |
+| `loginUrl`     | `"/login"`            | Route that the `auth` middleware and a 401 response redirect to           |
 
-## Dev workflow
+## What you get
 
-```bash
-pnpm dev:core   # from monorepo root — watch mode
-```
+Composables are auto-imported and the middleware is registered by name.
+
+| API                            | Purpose                                                                                                                                        |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `useCrud<T>(endpoint)`         | Repository over a DRF endpoint: `list`, `detail`, `create`, `update`, `partialUpdate`, `delete`, `options`, `updateOrCreate`, `updateOrder`    |
+| `useMapoAuth()`                | `login`, `logout` and `fetchUser`, kept in sync with `useAuthStore`                                                                            |
+| `useMapoFetch()`               | `{ fetch, loading }`: the `$mapoFetch` instance and a flag that is `true` while any request is in flight                                       |
+| `useMapo()`                    | One object exposing `$api`, `$auth`, `$snack` and `$confirm`                                                                                   |
+| `useCanAccessRoute(meta)`      | Whether the current user passes a route's `auth`, `roles` and `permissions` checks                                                             |
+| `$mapoFetch`                   | The `$fetch` instance behind all of the above: a 401 (except on logout) resets the session and redirects to `loginUrl`; a 403 shows a snackbar |
+| `auth`, `permissions`, `roles` | Route middleware driven by `definePageMeta` (`permissions: { model }` or a list of codenames, `roles`)                                         |
+
+Types such as `CrudRepository` and `PaginatedResponse` come from `mapomodule/types`.
 
-## Configuration
+## Documentation
 
-All endpoints fall back to the `MAPO_DEFAULTS` constant exported from this package. See [docs/modules/core](../../../docs/modules/core.md) for the full reference.
+- [@mapomodule/core](https://lotrekagency.github.io/mapo-new/modules/core)
+- [Auth & permissions](https://lotrekagency.github.io/mapo-new/howto/auth-permissions)
+- [Custom backend integration](https://lotrekagency.github.io/mapo-new/howto/backend-integration)
+- [Architecture & Integration Flows](https://lotrekagency.github.io/mapo-new/guide/architecture-flows)
+- [Composable & Function API Reference](https://lotrekagency.github.io/mapo-new/modules/api)

package/dist/index.d.mts

@@ -1 +1,14 @@
-export * from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/index.js";
+export { ApiResponse, AuthToken, CoreCookieEnum, Credentials, CrudConfig, CrudOptions, CrudRepository, ListParams, MultipartPolicy, MultipartPolicyEnum, PaginatedResponse } from '../dist/runtime/types.js';
+export { MapoApiLayer, MapoFacade } from '../dist/runtime/composables/useMapo.js';
+export { RoutePermissions, useCanAccessRoute } from '../dist/runtime/auth/useCanAccessRoute.js';
+export { useMapoFetch } from '../dist/runtime/utils/useMapoFetch.js';
+export { getErrorData, getErrorDetail, getErrorStatus } from '../dist/runtime/utils/fetchError.js';
+
+interface MapoOptions {
+    authLoginUrl?: string;
+    userInfoApi?: string;
+    logoutUrl?: string;
+    loginUrl?: string;
+}
+
+export type { MapoOptions };

package/dist/index.d.ts

@@ -1 +1,6 @@
-export * from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/index.js";
+export type * from "./module";
+export { MultipartPolicyEnum, CoreCookieEnum } from "./runtime/types";
+export { useCanAccessRoute } from "./runtime/auth/useCanAccessRoute";
+export { useMapoFetch } from "./runtime/utils/useMapoFetch";
+export { getErrorData, getErrorStatus, getErrorDetail, } from "./runtime/utils/fetchError";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,UAAU,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,4BAA4B,CAAC"}

package/dist/index.mjs

@@ -1,21 +1,4 @@
-import { createJiti } from "file:///home/runner/work/mapo-new/mapo-new/node_modules/.pnpm/jiti@2.6.1/node_modules/jiti/lib/jiti.mjs";
-
-const jiti = createJiti(import.meta.url, {
-  "interopDefault": true,
-  "alias": {
-    "@mapomodule/core": "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core"
-  },
-  "transformOptions": {
-    "babel": {
-      "plugins": []
-    }
-  }
-})
-
-/** @type {import("/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/index.js")} */
-const _module = await jiti.import("/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/index.ts");
-
-export const MultipartPolicyEnum = _module.MultipartPolicyEnum;
-export const CoreCookieEnum = _module.CoreCookieEnum;
-export const useCanAccessRoute = _module.useCanAccessRoute;
-export const useMapoFetch = _module.useMapoFetch;
+export { CoreCookieEnum, MultipartPolicyEnum } from '../dist/runtime/types.js';
+export { useCanAccessRoute } from '../dist/runtime/auth/useCanAccessRoute.js';
+export { useMapoFetch } from '../dist/runtime/utils/useMapoFetch.js';
+export { getErrorData, getErrorDetail, getErrorStatus } from '../dist/runtime/utils/fetchError.js';

package/dist/module.d.mts

@@ -1,2 +1,11 @@
-export * from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.js";
-export { default } from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.js";
+import { NuxtModule } from '@nuxt/schema';
+import { MapoOptions } from './index.mjs';
+export { ApiResponse, AuthToken, CoreCookieEnum, Credentials, CrudConfig, CrudOptions, CrudRepository, ListParams, MultipartPolicy, MultipartPolicyEnum, PaginatedResponse } from '../dist/runtime/types.js';
+export { MapoApiLayer, MapoFacade } from '../dist/runtime/composables/useMapo.js';
+export { RoutePermissions } from '../dist/runtime/auth/useCanAccessRoute.js';
+import '../dist/runtime/utils/useMapoFetch.js';
+import '../dist/runtime/utils/fetchError.js';
+
+declare const _default: NuxtModule<MapoOptions, MapoOptions, false>;
+
+export { MapoOptions, _default as default };

package/dist/module.d.ts

@@ -1,2 +1,10 @@
-export * from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.js";
-export { default } from "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.js";
+import type { NuxtModule } from "@nuxt/schema";
+import type { MapoOptions } from "./types";
+export type { MapoOptions } from "./types";
+export type { ListParams, PaginatedResponse, ApiResponse, CrudConfig, CrudOptions, CrudRepository, MultipartPolicy, Credentials, AuthToken, } from "./runtime/types";
+export { MultipartPolicyEnum, CoreCookieEnum } from "./runtime/types";
+export type { MapoFacade, MapoApiLayer } from "./runtime/composables/useMapo";
+export type { RoutePermissions } from "./runtime/auth/useCanAccessRoute";
+declare const _default: NuxtModule<MapoOptions, MapoOptions, false>;
+export default _default;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;;AAEzE,wBAkFqC"}

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@mapomodule/core",
   "configKey": "mapoCore",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.10",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,20 +1,78 @@
-import { createJiti } from "file:///home/runner/work/mapo-new/mapo-new/node_modules/.pnpm/jiti@2.6.1/node_modules/jiti/lib/jiti.mjs";
+import { readFileSync } from 'node:fs';
+import { defineNuxtModule, createResolver, addTypeTemplate, hasNuxtModule, installModule, addPlugin, addImports, addRouteMiddleware } from '@nuxt/kit';
+export { CoreCookieEnum, MultipartPolicyEnum } from '../dist/runtime/types.js';
 
-const jiti = createJiti(import.meta.url, {
-  "interopDefault": true,
-  "alias": {
-    "@mapomodule/core": "/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core"
+const MAPO_DEFAULTS = {
+  authLoginUrl: "/api/auth/login",
+  userInfoApi: "/api/profiles/me/",
+  logoutUrl: "/api/auth/logout",
+  loginUrl: "/login"
+};
+
+const module$1 = defineNuxtModule({
+  meta: {
+    name: "@mapomodule/core",
+    configKey: "mapoCore"
   },
-  "transformOptions": {
-    "babel": {
-      "plugins": []
+  defaults: MAPO_DEFAULTS,
+  async setup(options, nuxt) {
+    const resolver = createResolver(import.meta.url);
+    nuxt.options.build.transpile.push(resolver.resolve("./runtime"));
+    nuxt.options.imports.transform ??= {};
+    (nuxt.options.imports.transform.include ??= []).push(
+      /@mapomodule[\\/]core[\\/]/
+    );
+    addTypeTemplate({
+      filename: "types/mapo-core-page-meta.d.ts",
+      getContents: () => readFileSync(
+        resolver.resolve("./runtime/page-meta.nuxt.d.ts"),
+        "utf-8"
+      )
+    });
+    if (!hasNuxtModule("@mapomodule/store")) {
+      await installModule(await resolver.resolvePath("@mapomodule/store"));
     }
+    nuxt.options.runtimeConfig.public.mapoCore = {
+      ...MAPO_DEFAULTS,
+      ...options
+    };
+    addPlugin({ src: resolver.resolve("./runtime/plugins/00.fetch") });
+    addPlugin({
+      src: resolver.resolve("./runtime/plugins/01.init.server"),
+      mode: "server"
+    });
+    addImports([
+      { name: "useCrud", from: resolver.resolve("./runtime/api/crud") },
+      {
+        name: "useMapoAuth",
+        from: resolver.resolve("./runtime/auth/useMapoAuth")
+      },
+      {
+        name: "useMapo",
+        from: resolver.resolve("./runtime/composables/useMapo")
+      },
+      {
+        name: "useCanAccessRoute",
+        from: resolver.resolve("./runtime/auth/useCanAccessRoute")
+      },
+      {
+        name: "useMapoFetch",
+        from: resolver.resolve("./runtime/utils/useMapoFetch")
+      }
+    ]);
+    addRouteMiddleware({
+      name: "auth",
+      path: resolver.resolve("./runtime/middleware/auth")
+    });
+    addRouteMiddleware({
+      name: "permissions",
+      path: resolver.resolve("./runtime/middleware/permissions")
+    });
+    addRouteMiddleware({
+      name: "roles",
+      path: resolver.resolve("./runtime/middleware/roles")
+    });
   }
-})
-
-/** @type {import("/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.js")} */
-const _module = await jiti.import("/home/runner/work/mapo-new/mapo-new/packages/@mapomodule/core/src/module.ts");
+});
 
-export default _module?.default ?? _module;
-export const MultipartPolicyEnum = _module.MultipartPolicyEnum;
-export const CoreCookieEnum = _module.CoreCookieEnum;
+export { module$1 as default };

package/dist/runtime/__tests__/plugins/00.fetch.real.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=00.fetch.real.spec.d.ts.map

package/dist/runtime/__tests__/plugins/00.fetch.real.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"00.fetch.real.spec.d.ts","sourceRoot":"","sources":["../../../../src/runtime/__tests__/plugins/00.fetch.real.spec.ts"],"names":[],"mappings":""}

package/dist/runtime/__tests__/plugins/00.fetch.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=00.fetch.spec.d.ts.map

package/dist/runtime/__tests__/plugins/00.fetch.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"00.fetch.spec.d.ts","sourceRoot":"","sources":["../../../../src/runtime/__tests__/plugins/00.fetch.spec.ts"],"names":[],"mappings":""}

package/dist/runtime/__tests__/plugins/01.init.server.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=01.init.server.spec.d.ts.map

package/dist/runtime/__tests__/plugins/01.init.server.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"01.init.server.spec.d.ts","sourceRoot":"","sources":["../../../../src/runtime/__tests__/plugins/01.init.server.spec.ts"],"names":[],"mappings":""}

package/dist/runtime/__tests__/utils/fetchError.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fetchError.spec.d.ts.map

package/dist/runtime/__tests__/utils/fetchError.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchError.spec.d.ts","sourceRoot":"","sources":["../../../../src/runtime/__tests__/utils/fetchError.spec.ts"],"names":[],"mappings":""}

package/dist/runtime/api/crud.d.ts

@@ -0,0 +1,23 @@
+import type { CrudConfig, CrudRepository } from "../types";
+/**
+ * Creates a typed CRUD repository bound to a resource endpoint.
+ *
+ * The returned repository exposes common operations (`list`, `detail`, `create`,
+ * `update`, `partialUpdate`, `delete`) plus utility actions (`updateOrCreate`,
+ * `updateOrder`). Requests are executed through the shared Mapo fetch client.
+ *
+ * Configuration precedence:
+ * - `higherConf` defines repository-level default request options.
+ * - Per-call config arguments override repository-level defaults.
+ *
+ * Multipart handling:
+ * - Write methods pass payloads through `applyMultipartPolicy`, using
+ *   `MultipartPolicyEnum.Auto` unless overridden in `CrudOptions`.
+ *
+ * @typeParam T Entity type handled by the repository.
+ * @param endpoint Resource endpoint (normalized to a trailing-slash base path).
+ * @param higherConf Optional repository-level fetch configuration defaults.
+ * @returns A typed `CrudRepository<T>` for the specified endpoint.
+ */
+export declare function useCrud<T>(endpoint: string, higherConf?: CrudConfig): CrudRepository<T>;
+//# sourceMappingURL=crud.d.ts.map

package/dist/runtime/api/crud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud.d.ts","sourceRoot":"","sources":["../../../src/runtime/api/crud.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,UAAU,EAEV,cAAc,EACf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,CAAC,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,UAAU,GACtB,cAAc,CAAC,CAAC,CAAC,CAsGnB"}

package/dist/runtime/api/crud.js

@@ -0,0 +1,80 @@
+import { normalizeEndpoint } from "@mapomodule/utils";
+import { applyMultipartPolicy } from "./multipart.js";
+import { useMapoFetch } from "../utils/useMapoFetch.js";
+import { MultipartPolicyEnum } from "../types.js";
+export function useCrud(endpoint, higherConf) {
+  const base = normalizeEndpoint(endpoint);
+  function merged(local) {
+    return { ...higherConf, ...local };
+  }
+  function fetch(path, options) {
+    return useMapoFetch().fetch(path, options);
+  }
+  return {
+    list(params, config) {
+      return fetch(base, {
+        method: "GET",
+        params,
+        ...merged(config)
+      });
+    },
+    detail(id, config) {
+      return fetch(`${base}${id}/`, { method: "GET", ...merged(config) });
+    },
+    create(data, config, opts = {}) {
+      const body = applyMultipartPolicy(
+        data,
+        opts.multipart ?? MultipartPolicyEnum.Auto
+      );
+      return fetch(base, { method: "POST", body, ...merged(config) });
+    },
+    update(id, data, config, opts = {}) {
+      const body = applyMultipartPolicy(
+        data,
+        opts.multipart ?? MultipartPolicyEnum.Auto
+      );
+      return fetch(`${base}${id}/`, {
+        method: "PUT",
+        body,
+        ...merged(config)
+      });
+    },
+    partialUpdate(id, diff, config, opts = {}) {
+      const body = applyMultipartPolicy(
+        diff,
+        opts.multipart ?? MultipartPolicyEnum.Auto
+      );
+      return fetch(`${base}${id}/`, {
+        method: "PATCH",
+        body,
+        ...merged(config)
+      });
+    },
+    delete(id, config) {
+      return fetch(`${base}${id}/`, {
+        method: "DELETE",
+        ...merged(config)
+      });
+    },
+    options(config) {
+      return fetch(base, {
+        method: "OPTIONS",
+        ...merged(config)
+      });
+    },
+    updateOrCreate(data, config, opts) {
+      if (data.id) {
+        const { id, ...rest } = data;
+        return this.update(id, rest, config, opts);
+      }
+      return this.create(data, config, opts);
+    },
+    updateOrder(startId, endId, config) {
+      return fetch(`${base}update_order/`, {
+        method: "POST",
+        body: { startId, endId },
+        ...merged(config)
+      });
+    }
+  };
+}

package/dist/runtime/api/multipart.d.ts

@@ -0,0 +1,15 @@
+import type { MultipartPolicy } from "../types";
+/**
+ * Applies the configured multipart policy to a request payload.
+ *
+ * Policy behavior:
+ * - `Disable`: always return the original object payload.
+ * - `Force`: always return a `FormData` payload.
+ * - `Auto`: return `FormData` only when at least one `File`/`Blob` is present.
+ *
+ * @param payload Request payload object.
+ * @param policy Multipart transformation policy.
+ * @returns Either the original payload or a `FormData` instance.
+ */
+export declare function applyMultipartPolicy(payload: Record<string, unknown>, policy: MultipartPolicy): FormData | Record<string, unknown>;
+//# sourceMappingURL=multipart.d.ts.map

package/dist/runtime/api/multipart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multipart.d.ts","sourceRoot":"","sources":["../../../src/runtime/api/multipart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAyDhD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,EAAE,eAAe,GACtB,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKpC"}

package/dist/runtime/api/multipart.js

@@ -0,0 +1,31 @@
+import { MultipartPolicyEnum } from "../types.js";
+function collectFiles(obj, path = "") {
+  if (obj instanceof File || obj instanceof Blob) {
+    return [{ path, file: obj }];
+  }
+  if (Array.isArray(obj)) {
+    return obj.flatMap(
+      (item, i) => collectFiles(item, path ? `${path}.${i}` : String(i))
+    );
+  }
+  if (obj !== null && typeof obj === "object") {
+    return Object.entries(obj).flatMap(
+      ([key, val]) => collectFiles(val, path ? `${path}.${key}` : key)
+    );
+  }
+  return [];
+}
+function toFormData(obj) {
+  const files = collectFiles(obj);
+  const fd = new FormData();
+  fd.append("data", JSON.stringify(obj));
+  for (const { path, file } of files) {
+    fd.append(path, file);
+  }
+  return fd;
+}
+export function applyMultipartPolicy(payload, policy) {
+  if (policy === MultipartPolicyEnum.Disable) return payload;
+  if (policy === MultipartPolicyEnum.Force) return toFormData(payload);
+  return collectFiles(payload).length > 0 ? toFormData(payload) : payload;
+}

package/dist/runtime/auth/useCanAccessRoute.d.ts

@@ -0,0 +1,12 @@
+import type { RouteMeta } from "vue-router";
+/** Two-format permission spec: Django model shorthand or explicit codename list. */
+export type RoutePermissions = {
+    model: string;
+} | string[];
+/**
+ * Returns whether the current user can access a route based on its meta.
+ * Mirrors the logic of the `auth`, `permissions`, and `roles` middlewares
+ * so the sidebar and any UI that gates visibility stays in sync with navigation guards.
+ */
+export declare function useCanAccessRoute(meta: RouteMeta): boolean;
+//# sourceMappingURL=useCanAccessRoute.d.ts.map

package/dist/runtime/auth/useCanAccessRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useCanAccessRoute.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/useCanAccessRoute.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAoC1D"}

package/dist/runtime/auth/useCanAccessRoute.js

@@ -0,0 +1,28 @@
+import { useAuthStore } from "@mapomodule/store/runtime/stores/auth";
+export function useCanAccessRoute(meta) {
+  const auth = useAuthStore();
+  const raw = meta.middleware;
+  const middleware = Array.isArray(raw) ? raw : raw ? [raw] : [];
+  if (middleware.includes("auth") && !auth.isAuthenticated) return false;
+  if (middleware.includes("roles")) {
+    const required = meta.roles;
+    if (required?.length && !auth.info?.is_superuser) {
+      const userGroups = auth.info?.groups ?? [];
+      if (!required.some((r) => userGroups.includes(r))) return false;
+    }
+  }
+  if (middleware.includes("permissions")) {
+    const perms = meta.permissions;
+    if (perms && !auth.info?.is_superuser) {
+      if (Array.isArray(perms)) {
+        if (!perms.every((p) => auth.rawPermissions.includes(p))) return false;
+      } else {
+        const hasView = auth.rawPermissions.some(
+          (p) => p === `view_${perms.model}` || p.endsWith(`_${perms.model}`) && p.startsWith("view")
+        );
+        if (!hasView) return false;
+      }
+    }
+  }
+  return true;
+}

package/dist/runtime/auth/useMapoAuth.d.ts

@@ -0,0 +1,28 @@
+import type { Credentials } from "../types";
+/**
+ * Optional endpoint overrides for auth operations.
+ */
+type AuthOverrides = {
+    /** Login endpoint used to create the server session. */
+    authLoginUrl?: string;
+    /** Endpoint used to fetch the current authenticated user profile. */
+    userInfoApi?: string;
+    /** Logout endpoint used to invalidate the server session. */
+    logoutUrl?: string;
+};
+/**
+ * Provides authentication helpers built on top of the shared Mapo fetch client.
+ *
+ * Endpoints are resolved from runtime config and can be selectively overridden
+ * through `options`.
+ *
+ * @param options Optional endpoint overrides for login, logout, and user fetch.
+ * @returns Auth helpers: `login`, `logout`, and `fetchUser`.
+ */
+export declare function useMapoAuth(options?: AuthOverrides): {
+    login: (credentials: Credentials) => Promise<void>;
+    logout: () => Promise<void>;
+    fetchUser: () => Promise<void>;
+};
+export {};
+//# sourceMappingURL=useMapoAuth.d.ts.map

package/dist/runtime/auth/useMapoAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMapoAuth.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/useMapoAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAyB,MAAM,UAAU,CAAC;AAEnE;;GAEG;AACH,KAAK,aAAa,GAAG;IACnB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa;yBA8Bf,WAAW,KAAG,OAAO,CAAC,IAAI,CAAC;kBAepC,OAAO,CAAC,IAAI,CAAC;qBA9BV,OAAO,CAAC,IAAI,CAAC;EAiD1C"}

package/dist/runtime/auth/useMapoAuth.js

@@ -0,0 +1,38 @@
+import { useNuxtApp, navigateTo, useCookie, useRuntimeConfig } from "nuxt/app";
+import { useAuthStore } from "@mapomodule/store/runtime/stores/auth";
+import { CoreCookieEnum } from "../types.js";
+export function useMapoAuth(options) {
+  const rc = useRuntimeConfig().public.mapoCore;
+  const authLoginUrl = options?.authLoginUrl ?? rc.authLoginUrl;
+  const userInfoApi = options?.userInfoApi ?? rc.userInfoApi;
+  const logoutUrl = options?.logoutUrl ?? rc.logoutUrl;
+  const loginUrl = rc.loginUrl;
+  const { $mapoFetch } = useNuxtApp();
+  const authStore = useAuthStore();
+  async function fetchUser() {
+    const user = await $mapoFetch(userInfoApi, { method: "GET" });
+    authStore.setUser(user);
+  }
+  async function login(credentials) {
+    await $mapoFetch(authLoginUrl, { method: "POST", body: credentials });
+    await fetchUser();
+  }
+  async function logout() {
+    try {
+      await $mapoFetch(logoutUrl, { method: "GET" });
+    } finally {
+      useCookie(CoreCookieEnum.Session).value = null;
+      authStore.reset();
+      if (typeof localStorage !== "undefined") {
+        const toRemove = [];
+        for (let i = 0; i < localStorage.length; i++) {
+          const k = localStorage.key(i);
+          if (k?.startsWith("mapo:draft:")) toRemove.push(k);
+        }
+        toRemove.forEach((k) => localStorage.removeItem(k));
+      }
+      await navigateTo(loginUrl);
+    }
+  }
+  return { login, logout, fetchUser };
+}

package/dist/runtime/composables/useMapo.d.ts

@@ -0,0 +1,48 @@
+import { useSnackStore } from "@mapomodule/store/runtime/stores/snack";
+import { useConfirmStore } from "@mapomodule/store/runtime/stores/confirm";
+import { useMapoAuth } from "../auth/useMapoAuth";
+import type { MapoOptions } from "../../types";
+import type { CrudRepository } from "../types";
+/**
+ * API layer exposed by {@link useMapo}.
+ */
+export interface MapoApiLayer {
+    /**
+     * Creates a CRUD repository bound to the provided endpoint.
+     *
+     * @param endpoint API endpoint for the resource collection.
+     * @returns A typed repository with list/detail/create/update/delete helpers.
+     */
+    crud<T>(endpoint: string): CrudRepository<T>;
+}
+/**
+ * High-level facade that groups the most common Mapo runtime capabilities.
+ *
+ * This keeps feature access ergonomic in components by exposing API, auth,
+ * feedback stores, and resolved options from a single composable call.
+ */
+export interface MapoFacade {
+    /** Resource-oriented API helpers. */
+    $api: MapoApiLayer;
+    /** Authentication helpers (`login`, `logout`, `fetchUser`). */
+    $auth: ReturnType<typeof useMapoAuth>;
+    /** Global snackbar store for user feedback messages. */
+    $snack: ReturnType<typeof useSnackStore>;
+    /** Global confirm dialog store for destructive/critical actions. */
+    $confirm: ReturnType<typeof useConfirmStore>;
+    /** Effective options passed to the facade factory. */
+    $options: MapoOptions;
+}
+/**
+ * Creates the Mapo facade used across admin pages and composables.
+ *
+ * The facade is a convenience aggregator over lower-level composables/stores:
+ * - `$api.crud<T>(endpoint)` delegates to `useCrud<T>(endpoint)`.
+ * - `$auth` delegates to `useMapoAuth(options)` (same overrides).
+ * - `$snack` and `$confirm` expose the shared UI feedback stores.
+ *
+ * @param options Optional runtime overrides forwarded to the auth layer.
+ * @returns A `MapoFacade` with grouped API/auth/feedback capabilities.
+ */
+export declare function useMapo(options?: MapoOptions): MapoFacade;
+//# sourceMappingURL=useMapo.d.ts.map

package/dist/runtime/composables/useMapo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useMapo.d.ts","sourceRoot":"","sources":["../../../src/runtime/composables/useMapo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,+DAA+D;IAC/D,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IACtC,wDAAwD;IACxD,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;IACzC,oEAAoE;IACpE,QAAQ,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IAC7C,sDAAsD;IACtD,QAAQ,EAAE,WAAW,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAU7D"}