@mpfrontend/access-react 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @mpfrontend/access-react
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Part of [MP Frontend](https://github.com/panahister/mpfrontend), released to the public npm registry as one cohort: every `@mpfrontend`
+package at the same exact version. Runtime: client, with a server-only entry. Install it through a workspace that `mpfrontend init`
+created, which pins the cohort and binds the scope to the registry in `.npmrc`. [Versioning](https://github.com/panahister/mpfrontend#versioning)
+states the compatibility policy and [Implementation status](https://github.com/panahister/mpfrontend/blob/main/docs/IMPLEMENTATION-STATUS.md) the
+evidence.
+
+React bindings for an access snapshot of `@mpfrontend/access-core`. The consumer's server decides what each
+person may see and do: it resolves its own rules into an explicit snapshot (context reference, revision, expiry,
+capabilities and fields) and sends it through the BFF. The UI shows menus, pages, actions and fields from that
+snapshot only; whatever it does not grant stays closed. A hidden control is not authorization: the BFF, the
+gateway and every service still check each request. No export takes a role name or reads a token claim, and
+nothing here calls the identity provider or a policy service.
+
+## Server entry: `@mpfrontend/access-react/server`
+
+`createAccessLoader({load, contextRef, keys, timeoutMs})` returns a function of one request object (for example
+`await headers()` in a server component). It calls the consumer's `load` (its own endpoint, reached through the
+BFF) with an abort signal bounded by `timeoutMs`, validates the answer at run time (shape, context reference and
+revision, expiry, the request's `contextRef`, the known `keys`) and memoizes the result for that request object.
+A malformed, expired or mismatched snapshot, a failed load and a slow one grant nothing.
+`clientSnapshot(result, keys)` keeps only the keys a provider's components need (`pageKeys` and `navigationKeys`
+of the page manifest), never identity or token data, and is `null` when nothing is granted.
+
+The entry is kept out of a browser bundle by its `browser` export condition, which resolves to a module that throws
+`ACCESS_SERVER_ENTRY_IN_BROWSER`. That holds for a bundler that reads export conditions; a bundler that does not reaches the
+server entry itself, which throws the same error when a `document` exists.
+
+## Client entry: `@mpfrontend/access-react`
+
+- `AccessProvider` holds one snapshot for its subtree and is read during server rendering, so the first paint
+  shows no forbidden entry. It validates the snapshot it receives (`keys` and `contextRef` when given). A new
+  snapshot replaces the old one whole. At `expiresAt` it closes every entry, on an idle screen too, with a timer.
+  When the window regains focus it calls `reload(signal)`, and the answer replaces the snapshot; an answer that
+  arrives after the snapshot was replaced is dropped. Work captured with `useAccessCapture()` is aborted and cannot
+  publish once the context or revision changes (`AuthorityFence`).
+- `useCapability(key)` returns whether the capability is granted. `useFieldState(key, {disabled, busy})` returns
+  `hidden`, `disabled` or `enabled`; a control that is already disabled or busy stays disabled. `useAccess()` returns
+  the reader for loops and forms (`ResourceForm` and `ResourceTable` of `@mpfrontend/ui` take it as `access`).
+  `useAccessScope()` returns the context reference and revision in use; `useAccessStatus()` returns `granted`,
+  `missing`, `invalid` or `expired`.
+- `AccessGuard` renders its children only when its capability is granted and otherwise nothing. A `fallback`, or
+  `whenDenied="disabled"` with a render function, only when that guard asks for it.
+- `AccessLink` renders no anchor, href, prefetch or focus target when denied; `as` takes the router's link
+  component, for example `next/link`.
+- `useNavigation(manifest)` builds navigation from the page manifest and the snapshot.
+
+A missing provider, a missing, malformed or expired snapshot and an unknown key close every kind of entry: menu,
+page, element and field. The browser decides no rule; a rule such as "open unless denied" is resolved by the
+consumer's server into the snapshot.
+
+## Page manifest
+
+`definePageManifest` (from `@mpfrontend/access-core`) lists every route once: the capability its page needs, the
+capability of its menu entry, its elements (an element's own stable id is its capability key unless it names
+another) and the field keys its components read, plus navigation groups. A test of the consumer runs
+`assertPageManifest(manifest, {routes: await appRoutes('src/app'), ids})`, with `appRoutes` from
+`@mpfrontend/access-react/testing`; it fails on a duplicate id, an id the app uses that the manifest does not
+register, and a route with no manifest entry.

package/dist/browser-refusal.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/browser-refusal.js

@@ -0,0 +1,4 @@
+// A browser bundle resolves the server entry to this module, so the loader never reaches a browser.
+throw new Error('ACCESS_SERVER_ENTRY_IN_BROWSER: import @mpfrontend/access-react/server only from server code');
+export {};
+//# sourceMappingURL=browser-refusal.js.map

package/dist/browser-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-refusal.js","sourceRoot":"","sources":["../src/browser-refusal.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;AAChH,OAAO,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+import { type ComponentPropsWithoutRef, type ElementType, type ReactNode } from 'react';
+import { type AccessKeys, type AccessReader, type ControlState, type FieldPresentation, type NavigationEntry, type PageManifest } from '@mpfrontend/access-core';
+/** granted: a valid snapshot is in use. Every other status closes every entry. */
+export type AccessStatus = 'granted' | 'missing' | 'invalid' | 'expired';
+/** The context reference and revision of the snapshot in use: the scope of data read under it. */
+export type AccessScope = Readonly<{
+    contextRef: string;
+    revision: string;
+}>;
+export type AccessCapture = Readonly<{
+    signal: AbortSignal;
+    assertCurrent: () => void;
+}>;
+export type AccessProviderProps = Readonly<{
+    /** The part of the snapshot this subtree needs, as the server sent it; it is validated before use. */
+    snapshot: unknown;
+    /** Asks the consumer's loader again, through its own route or the BFF. Called when the window regains focus. */
+    reload?: (signal: AbortSignal) => Promise<unknown>;
+    /** The keys this subtree knows; a snapshot that names another key is refused. */
+    keys?: AccessKeys;
+    /** The context this subtree is in; a snapshot of another context is refused. */
+    contextRef?: string;
+    now?: () => number;
+    children?: ReactNode;
+}>;
+/**
+ * Holds one access snapshot for its subtree, readable during server rendering. A new snapshot replaces the old one
+ * whole; at its expiry every entry closes, on an idle screen too; the loader is asked again when the window regains
+ * focus. Work captured under one context and revision is aborted and cannot publish once they change. The snapshot
+ * presents the server's decision; it never authorizes a request.
+ */
+export declare function AccessProvider({ snapshot, reload, keys, contextRef, now, children }: AccessProviderProps): import("react").FunctionComponentElement<import("react").ProviderProps<Readonly<{
+    reader: AccessReader;
+    status: AccessStatus;
+    scope: AccessScope | undefined;
+    capture: () => AccessCapture;
+    now: () => number;
+}>>>;
+/** The snapshot reader of the nearest provider; without a provider every entry is closed. */
+export declare function useAccess(): AccessReader;
+export declare function useAccessStatus(): AccessStatus;
+/** The context reference and revision in use, or undefined when no valid snapshot is held. */
+export declare function useAccessScope(): AccessScope | undefined;
+/**
+ * Captures the current context and revision for asynchronous work: abort with the signal and call assertCurrent
+ * before publishing a result. It throws AUTHORITY_CHANGED when no valid snapshot is held.
+ */
+export declare function useAccessCapture(): () => AccessCapture;
+export declare function useCapability(capability: string): boolean;
+/** hidden, disabled or enabled; a control that is already disabled or busy stays disabled. */
+export declare function useFieldState(key: string, state?: ControlState): FieldPresentation;
+/** The navigation that the manifest and the snapshot allow. */
+export declare function useNavigation(manifest: PageManifest): readonly NavigationEntry[];
+export type AccessGuardProps = Readonly<{
+    capability: string;
+    children?: ReactNode;
+    fallback?: ReactNode;
+    whenDenied?: never;
+}> | Readonly<{
+    capability: string;
+    whenDenied: 'disabled';
+    children: (state: Readonly<{
+        disabled: boolean;
+    }>) => ReactNode;
+    fallback?: never;
+}>;
+/**
+ * Renders its children only when the capability is granted, and otherwise nothing. A fallback, or children rendered
+ * in a disabled state, only when this guard asks for it.
+ */
+export declare function AccessGuard(props: AccessGuardProps): ReactNode;
+export type AccessLinkProps<C extends ElementType> = Readonly<{
+    capability: string;
+    as?: C;
+    fallback?: ReactNode;
+}> & Omit<ComponentPropsWithoutRef<C>, 'capability' | 'as' | 'fallback'>;
+/**
+ * A link that exists only when its capability is granted. When denied it renders no anchor, no href, no prefetch
+ * and no focus target: nothing, or the fallback this link asks for. `as` renders the router's own link component.
+ */
+export declare function AccessLink<C extends ElementType = 'a'>({ capability, as, fallback, ...props }: AccessLinkProps<C>): ReactNode;

package/dist/index.js

@@ -0,0 +1,127 @@
+'use client';
+import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { AuthorityFence, accessReader, buildNavigation, parsePageAccess } from '@mpfrontend/access-core';
+const refusedCapture = () => { throw new DOMException('AUTHORITY_CHANGED', 'AbortError'); };
+const CLOSED = Object.freeze({ reader: accessReader(undefined), status: 'missing', scope: undefined, capture: refusedCapture, now: Date.now });
+const AccessContext = createContext(CLOSED);
+// setTimeout holds at most 2^31-1 milliseconds; a longer lifetime re-arms the timer.
+const MAX_DELAY = 2147483647;
+/**
+ * Holds one access snapshot for its subtree, readable during server rendering. A new snapshot replaces the old one
+ * whole; at its expiry every entry closes, on an idle screen too; the loader is asked again when the window regains
+ * focus. Work captured under one context and revision is aborted and cannot publish once they change. The snapshot
+ * presents the server's decision; it never authorizes a request.
+ */
+export function AccessProvider({ snapshot, reload, keys, contextRef, now = Date.now, children }) {
+    const evaluate = (value) => {
+        if (value === undefined || value === null)
+            return { status: 'missing', snapshot: undefined };
+        const result = parsePageAccess(value, { now: now(), ...(keys ? { keys } : {}), ...(contextRef !== undefined ? { contextRef } : {}) });
+        return result.ok ? { status: 'granted', snapshot: result.access } : { status: result.reason === 'EXPIRED' ? 'expired' : 'invalid', snapshot: undefined };
+    };
+    const [held, setHeld] = useState(() => ({ source: snapshot, current: evaluate(snapshot) }));
+    let state = held;
+    if (held.source !== snapshot) {
+        // A new snapshot from the server replaces the held one whole during this render.
+        state = { source: snapshot, current: evaluate(snapshot) };
+        setHeld(state);
+    }
+    const { current } = state;
+    const fence = useRef(null);
+    if (!fence.current)
+        fence.current = new AuthorityFence();
+    const identity = current.snapshot ? current.snapshot.contextRef + '\n' + current.snapshot.revision : null;
+    // Idempotent for an unchanged identity; a change aborts the work captured under the previous one before any
+    // child reads the new scope.
+    fence.current.update(identity);
+    const latest = useRef(state);
+    useEffect(() => { latest.current = state; });
+    const expiresAt = current.snapshot?.expiresAt;
+    useEffect(() => {
+        if (expiresAt === undefined)
+            return;
+        let timer;
+        const check = () => {
+            const left = expiresAt - now();
+            if (left > 0) {
+                timer = setTimeout(check, Math.min(left, MAX_DELAY));
+                return;
+            }
+            setHeld(previous => previous.current.snapshot?.expiresAt === expiresAt && previous.current.status === 'granted'
+                ? { source: previous.source, current: { status: 'expired', snapshot: undefined } } : previous);
+        };
+        check();
+        return () => clearTimeout(timer);
+    }, [expiresAt, now]);
+    const reloadRef = useRef(reload);
+    useEffect(() => { reloadRef.current = reload; });
+    const canReload = reload !== undefined;
+    const evaluateRef = useRef(evaluate);
+    useEffect(() => { evaluateRef.current = evaluate; });
+    useEffect(() => {
+        if (!canReload)
+            return;
+        let controller;
+        const run = () => {
+            controller?.abort();
+            const own = controller = new AbortController(), startedWith = latest.current;
+            Promise.resolve().then(() => reloadRef.current?.(own.signal)).then(value => {
+                if (own.signal.aborted)
+                    return;
+                // A snapshot that replaced this one while the request was pending wins; the late answer is dropped.
+                setHeld(previous => previous === startedWith ? { source: previous.source, current: evaluateRef.current(value) } : previous);
+            }, () => undefined);
+        };
+        const visible = () => { if (document.visibilityState === 'visible')
+            run(); };
+        window.addEventListener('focus', run);
+        document.addEventListener('visibilitychange', visible);
+        return () => { controller?.abort(); window.removeEventListener('focus', run); document.removeEventListener('visibilitychange', visible); };
+    }, [canReload]);
+    const value = useMemo(() => {
+        const scope = current.snapshot ? Object.freeze({ contextRef: current.snapshot.contextRef, revision: current.snapshot.revision }) : undefined;
+        const owner = fence.current;
+        return Object.freeze({ reader: accessReader(current.snapshot, now), status: current.status, scope,
+            capture: identity === null ? refusedCapture : () => owner.capture(identity), now });
+    }, [current, identity, now]);
+    return createElement(AccessContext.Provider, { value }, children);
+}
+/** The snapshot reader of the nearest provider; without a provider every entry is closed. */
+export function useAccess() { return useContext(AccessContext).reader; }
+export function useAccessStatus() { return useContext(AccessContext).status; }
+/** The context reference and revision in use, or undefined when no valid snapshot is held. */
+export function useAccessScope() { return useContext(AccessContext).scope; }
+/**
+ * Captures the current context and revision for asynchronous work: abort with the signal and call assertCurrent
+ * before publishing a result. It throws AUTHORITY_CHANGED when no valid snapshot is held.
+ */
+export function useAccessCapture() { return useContext(AccessContext).capture; }
+export function useCapability(capability) { return useAccess().can(capability); }
+/** hidden, disabled or enabled; a control that is already disabled or busy stays disabled. */
+export function useFieldState(key, state = {}) { return useAccess().fieldState(key, state); }
+/** The navigation that the manifest and the snapshot allow. */
+export function useNavigation(manifest) {
+    const { reader, now } = useContext(AccessContext);
+    return buildNavigation(manifest, reader.snapshot, now());
+}
+/**
+ * Renders its children only when the capability is granted, and otherwise nothing. A fallback, or children rendered
+ * in a disabled state, only when this guard asks for it.
+ */
+export function AccessGuard(props) {
+    const granted = useCapability(props.capability);
+    if (props.whenDenied === 'disabled')
+        return props.children({ disabled: !granted });
+    return granted ? props.children : (props.fallback ?? null);
+}
+/**
+ * A link that exists only when its capability is granted. When denied it renders no anchor, no href, no prefetch
+ * and no focus target: nothing, or the fallback this link asks for. `as` renders the router's own link component.
+ */
+export function AccessLink({ capability, as, fallback, ...props }) {
+    const granted = useCapability(capability);
+    if (!granted)
+        return fallback ?? null;
+    return createElement(as ?? 'a', props);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AACb,OAAO,EAAC,aAAa,EAAC,aAAa,EAAC,UAAU,EAAC,SAAS,EAAC,OAAO,EAAC,MAAM,EAAC,QAAQ,EAChB,MAAM,OAAO,CAAC;AAC9E,OAAO,EAAC,cAAc,EAAC,YAAY,EAAC,eAAe,EAAC,eAAe,EACiE,MAAM,yBAAyB,CAAC;AAUpK,MAAM,cAAc,GAAC,GAAgB,EAAE,GAAC,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAC,YAAY,CAAC,CAAC,CAAA,CAAC,CAAC;AACnG,MAAM,MAAM,GAAO,MAAM,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,YAAY,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,SAAS,EAAC,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,cAAc,EAAC,GAAG,EAAC,IAAI,CAAC,GAAG,EAAC,CAAC,CAAC;AACxI,MAAM,aAAa,GAAC,aAAa,CAAQ,MAAM,CAAC,CAAC;AACjD,qFAAqF;AACrF,MAAM,SAAS,GAAC,UAAU,CAAC;AAe3B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAC,QAAQ,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,EAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAC,QAAQ,EAAqB;IACxG,MAAM,QAAQ,GAAC,CAAC,KAAa,EAAS,EAAE;QACtC,IAAG,KAAK,KAAG,SAAS,IAAE,KAAK,KAAG,IAAI;YAAC,OAAO,EAAC,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,SAAS,EAAC,CAAC;QAChF,MAAM,MAAM,GAAC,eAAe,CAAC,KAAK,EAAC,EAAC,GAAG,EAAC,GAAG,EAAE,EAAC,GAAG,CAAC,IAAI,CAAA,CAAC,CAAA,EAAC,IAAI,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,GAAG,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,EAAC,UAAU,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;QAChH,OAAO,MAAM,CAAC,EAAE,CAAA,CAAC,CAAA,EAAC,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,MAAM,CAAC,MAAM,EAAC,CAAA,CAAC,CAAA,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,KAAG,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,SAAS,EAAC,QAAQ,EAAC,SAAS,EAAC,CAAC;IACvI,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,EAAC,OAAO,CAAC,GAAC,QAAQ,CAAC,GAAE,EAAE,CAAA,CAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,GAAC,IAAI,CAAC;IACf,IAAG,IAAI,CAAC,MAAM,KAAG,QAAQ,EAAC,CAAC;QACzB,iFAAiF;QACjF,KAAK,GAAC,EAAC,MAAM,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,CAAC,QAAQ,CAAC,EAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,EAAC,OAAO,EAAC,GAAC,KAAK,CAAC;IACtB,MAAM,KAAK,GAAC,MAAM,CAAsB,IAAI,CAAC,CAAC;IAC9C,IAAG,CAAC,KAAK,CAAC,OAAO;QAAC,KAAK,CAAC,OAAO,GAAC,IAAI,cAAc,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAC,OAAO,CAAC,QAAQ,CAAA,CAAC,CAAA,OAAO,CAAC,QAAQ,CAAC,UAAU,GAAC,IAAI,GAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC;IAChG,4GAA4G;IAC5G,6BAA6B;IAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,SAAS,CAAC,GAAE,EAAE,GAAC,MAAM,CAAC,OAAO,GAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC5C,SAAS,CAAC,GAAE,EAAE;QACZ,IAAG,SAAS,KAAG,SAAS;YAAC,OAAO;QAChC,IAAI,KAA6C,CAAC;QAClD,MAAM,KAAK,GAAC,GAAE,EAAE;YACd,MAAM,IAAI,GAAC,SAAS,GAAC,GAAG,EAAE,CAAC;YAC3B,IAAG,IAAI,GAAC,CAAC,EAAC,CAAC;gBAAA,KAAK,GAAC,UAAU,CAAC,KAAK,EAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAC,SAAS,CAAC,CAAC,CAAC;gBAAA,OAAO;YAAA,CAAC;YACpE,OAAO,CAAC,QAAQ,CAAA,EAAE,CAAA,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,KAAG,SAAS,IAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAG,SAAS;gBACrG,CAAC,CAAA,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,SAAS,EAAC,QAAQ,EAAC,SAAS,EAAC,EAAC,CAAA,CAAC,CAAA,QAAQ,CAAC,CAAC;QACtF,CAAC,CAAC;QACF,KAAK,EAAE,CAAC;QACR,OAAO,GAAE,EAAE,CAAA,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,EAAC,CAAC,SAAS,EAAC,GAAG,CAAC,CAAC,CAAC;IAEnB,MAAM,SAAS,GAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,GAAE,EAAE,GAAC,SAAS,CAAC,OAAO,GAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAC,MAAM,KAAG,SAAS,CAAC;IACnC,MAAM,WAAW,GAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,SAAS,CAAC,GAAE,EAAE,GAAC,WAAW,CAAC,OAAO,GAAC,QAAQ,CAAC,CAAA,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,GAAE,EAAE;QACZ,IAAG,CAAC,SAAS;YAAC,OAAO;QACrB,IAAI,UAAoC,CAAC;QACzC,MAAM,GAAG,GAAC,GAAE,EAAE;YACZ,UAAU,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,GAAG,GAAC,UAAU,GAAC,IAAI,eAAe,EAAE,EAAC,WAAW,GAAC,MAAM,CAAC,OAAO,CAAC;YACtE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAE,EAAE,CAAA,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE;gBACtE,IAAG,GAAG,CAAC,MAAM,CAAC,OAAO;oBAAC,OAAO;gBAC7B,oGAAoG;gBACpG,OAAO,CAAC,QAAQ,CAAA,EAAE,CAAA,QAAQ,KAAG,WAAW,CAAA,CAAC,CAAA,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,OAAO,EAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAC,CAAA,CAAC,CAAA,QAAQ,CAAC,CAAC;YACjH,CAAC,EAAC,GAAE,EAAE,CAAA,SAAS,CAAC,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,IAAG,QAAQ,CAAC,eAAe,KAAG,SAAS;YAAC,GAAG,EAAE,CAAC,CAAA,CAAC,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,GAAG,CAAC,CAAC;QAAA,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAC,OAAO,CAAC,CAAC;QAC3F,OAAO,GAAE,EAAE,GAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,GAAG,CAAC,CAAC,CAAA,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAC,OAAO,CAAC,CAAC,CAAA,CAAC,CAAC;IACrI,CAAC,EAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEf,MAAM,KAAK,GAAC,OAAO,CAAQ,GAAE,EAAE;QAC7B,MAAM,KAAK,GAAC,OAAO,CAAC,QAAQ,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAC,QAAQ,EAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;QAClI,MAAM,KAAK,GAAC,KAAK,CAAC,OAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAC,GAAG,CAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,KAAK;YACzF,OAAO,EAAC,QAAQ,KAAG,IAAI,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,GAAE,EAAE,CAAA,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC;IAC7E,CAAC,EAAC,CAAC,OAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAC,EAAC,KAAK,EAAC,EAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS,KAAgB,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA,CAAC;AAClF,MAAM,UAAU,eAAe,KAAgB,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA,CAAC;AACxF,8FAA8F;AAC9F,MAAM,UAAU,cAAc,KAAyB,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAA,CAAC;AAC/F;;;GAGG;AACH,MAAM,UAAU,gBAAgB,KAAqB,OAAO,UAAU,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAA,CAAC;AAC/F,MAAM,UAAU,aAAa,CAAC,UAAiB,IAAU,OAAO,SAAS,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA,CAAC;AAC7F,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAU,EAAC,QAAmB,EAAE,IAAoB,OAAO,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,EAAC,KAAK,CAAC,CAAC,CAAA,CAAC;AAC5H,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAqB;IACjD,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,GAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,OAAO,eAAe,CAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,MAAM,OAAO,GAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAG,KAAK,CAAC,UAAU,KAAG,UAAU;QAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAC,QAAQ,EAAC,CAAC,OAAO,EAAC,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAA,CAAC,CAAA,KAAK,CAAC,QAAQ,CAAA,CAAC,CAAA,CAAC,KAAK,CAAC,QAAQ,IAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,UAAU,CAA4B,EAAC,UAAU,EAAC,EAAE,EAAC,QAAQ,EAAC,GAAG,KAAK,EAAoB;IACxG,MAAM,OAAO,GAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACxC,IAAG,CAAC,OAAO;QAAC,OAAO,QAAQ,IAAE,IAAI,CAAC;IAClC,OAAO,aAAa,CAAC,EAAE,IAAE,GAAG,EAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,34 @@
+import { type AccessKeys, type AccessRefusal, type PageAccess } from '@mpfrontend/access-core';
+/** The snapshot this request may use, or why it may use none. Only `ok` grants anything. */
+export type AccessResult = Readonly<{
+    ok: true;
+    access: PageAccess;
+}> | Readonly<{
+    ok: false;
+    reason: AccessRefusal | 'UNAVAILABLE';
+}>;
+export type AccessLoaderOptions<Request extends object> = Readonly<{
+    /**
+     * Reads the snapshot from the consumer's own endpoint through the BFF, forwarding the request's session. The
+     * consumer's server has already resolved its rules into explicit grants; this package decides none.
+     */
+    load: (request: Request, signal: AbortSignal) => Promise<unknown>;
+    /** The context reference this request is in; a snapshot of another context, or of none, is refused. */
+    contextRef: (request: Request) => string | undefined | Promise<string | undefined>;
+    /** Every key the app knows (manifestKeys of its page manifest); a snapshot that names another key is refused. */
+    keys: AccessKeys;
+    /** The time bound of one load, in milliseconds. */
+    timeoutMs: number;
+    now?: () => number;
+}>;
+/**
+ * A server-only loader. It loads, validates (shape, revision, expiry, context reference, known keys) and memoizes the
+ * snapshot once per request object: pass the same object for one request, for example the headers of a server
+ * component's request. A failed or slow load, and a malformed, expired or mismatched snapshot, grant nothing.
+ */
+export declare function createAccessLoader<Request extends object>(options: AccessLoaderOptions<Request>): (request: Request) => Promise<AccessResult>;
+/**
+ * The part of the result that a provider receives: only the listed keys, never identity or token data. null when the
+ * result grants nothing, which the provider treats as a missing snapshot.
+ */
+export declare function clientSnapshot(result: AccessResult, keys: AccessKeys): PageAccess | null;

package/dist/server.js

@@ -0,0 +1,44 @@
+import { parsePageAccess, pickPageAccess } from '@mpfrontend/access-core';
+// A bundler that does not read the "browser" export condition still reaches this module: where a document exists it
+// refuses as well, so the loader never runs in a browser, whatever resolved the entry.
+if (typeof globalThis.document !== 'undefined')
+    throw new Error('ACCESS_SERVER_ENTRY_IN_BROWSER: import @mpfrontend/access-react/server only from server code');
+/**
+ * A server-only loader. It loads, validates (shape, revision, expiry, context reference, known keys) and memoizes the
+ * snapshot once per request object: pass the same object for one request, for example the headers of a server
+ * component's request. A failed or slow load, and a malformed, expired or mismatched snapshot, grant nothing.
+ */
+export function createAccessLoader(options) {
+    if (!Number.isInteger(options.timeoutMs) || options.timeoutMs <= 0)
+        throw new Error('ACCESS_LOAD_TIMEOUT_REQUIRED');
+    const memo = new WeakMap();
+    const read = async (request) => {
+        const signal = AbortSignal.timeout(options.timeoutMs);
+        try {
+            const timedOut = new Promise((_, reject) => signal.addEventListener('abort', () => reject(signal.reason), { once: true }));
+            const [value, contextRef] = await Promise.race([Promise.all([options.load(request, signal), options.contextRef(request)]), timedOut]);
+            if (contextRef === undefined)
+                return { ok: false, reason: 'CONTEXT_MISMATCH' };
+            return parsePageAccess(value, { now: (options.now ?? Date.now)(), contextRef, keys: options.keys });
+        }
+        catch {
+            return { ok: false, reason: 'UNAVAILABLE' };
+        }
+    };
+    return request => {
+        let pending = memo.get(request);
+        if (!pending) {
+            pending = read(request);
+            memo.set(request, pending);
+        }
+        return pending;
+    };
+}
+/**
+ * The part of the result that a provider receives: only the listed keys, never identity or token data. null when the
+ * result grants nothing, which the provider treats as a missing snapshot.
+ */
+export function clientSnapshot(result, keys) {
+    return result.ok ? pickPageAccess(result.access, keys) : null;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,EAAC,cAAc,EAAoD,MAAM,yBAAyB,CAAC;AAE1H,oHAAoH;AACpH,uFAAuF;AACvF,IAAG,OAAQ,UAAkC,CAAC,QAAQ,KAAG,WAAW;IAClE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;AAmBlH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAyB,OAAoC;IAC7F,IAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAE,OAAO,CAAC,SAAS,IAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAC,IAAI,OAAO,EAAiC,CAAC;IACxD,MAAM,IAAI,GAAC,KAAK,EAAC,OAAe,EAAuB,EAAE;QACvD,MAAM,MAAM,GAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAG,CAAC;YACF,MAAM,QAAQ,GAAC,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAC,MAAM,EAAC,EAAE,CAAA,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC;YACtH,MAAM,CAAC,KAAK,EAAC,UAAU,CAAC,GAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAC,EAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,QAAQ,CAAC,CAAC,CAAC;YAChI,IAAG,UAAU,KAAG,SAAS;gBAAC,OAAO,EAAC,EAAE,EAAC,KAAK,EAAC,MAAM,EAAC,kBAAkB,EAAC,CAAC;YACtE,OAAO,eAAe,CAAC,KAAK,EAAC,EAAC,GAAG,EAAC,CAAC,OAAO,CAAC,GAAG,IAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAC,UAAU,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,EAAC,CAAC,CAAC;QAC7F,CAAC;QAAA,MAAK,CAAC;YACL,OAAO,EAAC,EAAE,EAAC,KAAK,EAAC,MAAM,EAAC,aAAa,EAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,OAAO,CAAA,EAAE;QACd,IAAI,OAAO,GAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAG,CAAC,OAAO,EAAC,CAAC;YAAA,OAAO,GAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAA,IAAI,CAAC,GAAG,CAAC,OAAO,EAAC,OAAO,CAAC,CAAC;QAAA,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAC,IAAe;IAChE,OAAO,MAAM,CAAC,EAAE,CAAA,CAAC,CAAA,cAAc,CAAC,MAAM,CAAC,MAAM,EAAC,IAAI,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;AAC3D,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The page routes of a Next.js app folder, for a test of the page manifest: `/orders`, `/orders/[position]`.
+ * Route groups `(name)` add no segment; private folders `_name`, parallel slots `@name` and their pages are skipped.
+ */
+export declare function appRoutes(appDirectory: string): Promise<string[]>;

package/dist/testing.js

@@ -0,0 +1,24 @@
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+const PAGE = /^page\.(?:tsx|ts|jsx|js|mdx)$/;
+/**
+ * The page routes of a Next.js app folder, for a test of the page manifest: `/orders`, `/orders/[position]`.
+ * Route groups `(name)` add no segment; private folders `_name`, parallel slots `@name` and their pages are skipped.
+ */
+export async function appRoutes(appDirectory) {
+    const routes = [];
+    const visit = async (directory, segments) => {
+        for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (entry.isDirectory()) {
+                if (entry.name.startsWith('_') || entry.name.startsWith('@'))
+                    continue;
+                await visit(join(directory, entry.name), /^\(.*\)$/.test(entry.name) ? segments : [...segments, entry.name]);
+            }
+            else if (PAGE.test(entry.name))
+                routes.push('/' + segments.join('/'));
+        }
+    };
+    await visit(appDirectory, []);
+    return [...new Set(routes)].sort();
+}
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAE/B,MAAM,IAAI,GAAC,+BAA+B,CAAC;AAC3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,YAAmB;IACjD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,MAAM,KAAK,GAAC,KAAK,EAAC,SAAgB,EAAC,QAA0B,EAAC,EAAE;QAC9D,KAAI,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAC,EAAC,aAAa,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC;YAC5G,IAAG,KAAK,CAAC,WAAW,EAAE,EAAC,CAAC;gBACtB,IAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAC,SAAS;gBACnE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAC,KAAK,CAAC,IAAI,CAAC,EAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,CAAC,GAAG,QAAQ,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACxG,CAAC;iBAAK,IAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,CAAC,YAAY,EAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,46 @@
 {
   "name": "@mpfrontend/access-react",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/panahister/mpfrontend.git",
+    "directory": "packages/access-react"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "browser": "./dist/browser-refusal.js",
+      "import": "./dist/server.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@mpfrontend/access-core": "1.0.0"
+  },
+  "devDependencies": {
+    "@happy-dom/global-registrator": "20.14.5",
+    "happy-dom": "20.14.5"
+  },
+  "peerDependencies": {
+    "react": "^19.3.0"
+  }
 }