@object-ui/auth 17.5.0 → 17.7.0

package/dist/invitation-status.d.ts

@@ -0,0 +1,59 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Invitation status vocabulary — the console's ONE entry point for it.
+ *
+ * ## Why this is a module and not a doc comment
+ *
+ * `AuthInvitation.status` was declared as an open `string` while its own doc
+ * comment enumerated exactly four members (objectui#3879). A comment cannot be
+ * enforced, so every consumer had to be liberal in turn: `InvitationsPage`
+ * carried a `default: 'secondary'` arm in its badge-variant switch and a
+ * `defaultValue: inv.status` that would render the raw wire string as UI copy —
+ * in all ten packs — for any value the enumeration did not cover. Declared =
+ * enforced (AGENTS.md #0.1): the union now lives in the type, and the wire
+ * boundary in `createAuthClient` is the one place an unvalidated string may
+ * become one.
+ *
+ * ## The vocabulary is CLOSED — and derived, not mirrored
+ *
+ * The producer is better-auth's organization plugin, whose own
+ * `InvitationStatus` is `'pending' | 'accepted' | 'rejected' | 'canceled'`
+ * (`better-auth/client/plugins`; the framework stores it in
+ * `sys_invitation.status`). This module BINDS that type instead of restating it,
+ * for the same reason `org-roles.ts` binds the spec's
+ * `BUILTIN_MEMBERSHIP_ROLES`: a member-for-member copy is precisely the state
+ * one upstream release away from drifting silently.
+ *
+ * The runtime list is derived from a total `Record` keyed by that union, so the
+ * compile-time half and the runtime half cannot disagree — a fifth status
+ * upstream fails to compile HERE (the map is missing a key) rather than slipping
+ * past the boundary check and out onto a badge.
+ *
+ * What stays LOCAL, deliberately: everything about *display*. The filter tabs'
+ * `StatusFilter` (which adds an `all` pseudo-member) and the badge variants are
+ * screen concerns and live with the screen — the same boundary `org-roles.ts`
+ * draws for its labels and grade ladder.
+ */
+import type { InvitationStatus } from 'better-auth/client/plugins';
+/**
+ * Status an organization invitation can carry — better-auth's own union, bound
+ * rather than copied.
+ */
+export type AuthInvitationStatus = InvitationStatus;
+/** Every status an invitation can carry, in the order the screens list them. */
+export declare const AUTH_INVITATION_STATUSES: readonly AuthInvitationStatus[];
+/**
+ * Narrow an unvalidated wire value onto the closed status set.
+ *
+ * The ONE place a `string` may become an `AuthInvitationStatus`. Everything
+ * downstream reads the narrowed type and therefore needs no fallback arm — which
+ * is the whole point: a tolerant consumer is where an unexpected value hides.
+ */
+export declare function isAuthInvitationStatus(value: unknown): value is AuthInvitationStatus;
+//# sourceMappingURL=invitation-status.d.ts.map

package/dist/invitation-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-status.d.ts","sourceRoot":"","sources":["../src/invitation-status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAcpD,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,SAAS,oBAAoB,EACrC,CAAC;AAKhC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}

package/dist/invitation-status.js

@@ -0,0 +1,32 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Total map over the union — the compile-time half of the pin. Values are the
+ * members themselves so the runtime list below is DERIVED rather than restated
+ * (one literal list, not two).
+ */
+const STATUS_MEMBERS = {
+    pending: 'pending',
+    accepted: 'accepted',
+    rejected: 'rejected',
+    canceled: 'canceled',
+};
+/** Every status an invitation can carry, in the order the screens list them. */
+export const AUTH_INVITATION_STATUSES = Object.values(STATUS_MEMBERS);
+/** Membership test backing the guard. `Set` so the check stays O(1) per row. */
+const STATUS_LOOKUP = new Set(AUTH_INVITATION_STATUSES);
+/**
+ * Narrow an unvalidated wire value onto the closed status set.
+ *
+ * The ONE place a `string` may become an `AuthInvitationStatus`. Everything
+ * downstream reads the narrowed type and therefore needs no fallback arm — which
+ * is the whole point: a tolerant consumer is where an unexpected value hides.
+ */
+export function isAuthInvitationStatus(value) {
+    return typeof value === 'string' && STATUS_LOOKUP.has(value);
+}

package/dist/types.d.ts

@@ -8,6 +8,7 @@
 import type React from 'react';
 import type { AuthUser as SpecAuthUser, DelegableScope, DelegableAdminScope } from '@objectstack/spec/contracts';
 import type { TenancyPosture } from '@objectstack/spec/security';
+import type { AuthInvitationStatus } from './invitation-status.js';
 /**
  * Authentication types for @object-ui/auth
  */
@@ -55,8 +56,6 @@ export interface AuthUser extends SpecAuthUser {
     image?: string;
     /** Primary role */
     role?: string;
-    /** All assigned roles */
-    roles?: string[];
     /** Email verification status */
     emailVerified?: boolean;
     /** Additional user metadata */
@@ -121,6 +120,19 @@ export interface SignUpData {
     name: string;
     email: string;
     password: string;
+    /**
+     * Where the email-verification link lands once the address is verified —
+     * e.g. the invitation page the user registered from (objectui#10893).
+     * Sent verbatim as better-auth's `/sign-up/email` `callbackURL`; omitted,
+     * the server's default (`/`) applies.
+     *
+     * better-auth accepts only a root-relative path (`/_console/…`) or an
+     * absolute URL on a trusted origin. Anything else — including a
+     * document-relative `./…` — is refused with `INVALID_CALLBACK_URL` and the
+     * WHOLE sign-up fails, so resolve an SPA route against its mount before
+     * passing it here.
+     */
+    callbackURL?: string;
 }
 /** Auth client configuration */
 export interface AuthClientConfig {
@@ -223,7 +235,7 @@ export interface AuthPublicConfig {
          * better-auth admin plugin mounted server-side (`auth.plugins.admin`;
          * SCIM forces it on). Gates the admin user-management surfaces — the
          * sys_user create/set-password actions and the identity import wizard
-         * entry (framework#2766 / #2782).
+         * entry (framework#2766 / objectstack-ai/objectstack#2782).
          */
         admin?: boolean;
         /**
@@ -442,8 +454,16 @@ export interface AuthInvitation {
     email: string;
     /** Role to be granted upon acceptance */
     role: string;
-    /** Status: 'pending' | 'accepted' | 'rejected' | 'canceled' */
-    status: string;
+    /**
+     * Lifecycle status, as the CLOSED set better-auth stores.
+     *
+     * Was an open `string` with the four members living in this comment, which
+     * left every consumer to be liberal about the fifth value that comment could
+     * not forbid (objectui#3879). The union is `AuthInvitationStatus` now, and
+     * `createAuthClient` narrows the wire value onto it at the boundary — so a
+     * screen reading this field can switch on it exhaustively.
+     */
+    status: AuthInvitationStatus;
     /** Expiration timestamp */
     expiresAt?: string;
     /** ID of the inviting user */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,EACV,QAAQ,IAAI,YAAY,EACxB,cAAc,EACd,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;GAEG;AAEH;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,YAAY;IAC5C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IAUd,gCAAgC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWjG;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2BAA2B;AAC3B,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sBAAsB;IACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2BAA2B;IAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,0BAA0B;AAC1B,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,mBAAmB;AACnB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,gCAAgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;;;;;;WAUG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB;;;;;WAKG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;;;;;;WASG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;WAIG;QACH,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B;;;WAGG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;WAMG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;;;;WAOG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;;WASG;QACH,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACpG,0FAA0F;IAC1F,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5H,eAAe;IACf,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF,6BAA6B;IAC7B,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,yEAAyE;IACzE,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,gCAAgC;IAChC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACnH,uGAAuG;IACvG,uBAAuB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IAC5H,8EAA8E;IAC9E,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6DAA6D;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,gGAAgG;IAChG,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,gFAAgF;IAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtF,oEAAoE;IACpE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,gFAAgF;IAChF,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7D,gFAAgF;IAChF,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/F,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvG,0DAA0D;IAC1D,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC3E,8CAA8C;IAC9C,qBAAqB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9D,iFAAiF;IACjF,eAAe,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC9D,qCAAqC;IACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,yCAAyC;IACzC,YAAY,EAAE,CAAC,IAAI,EAAE;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb;;;;;WAKG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,6BAA6B;IAC7B,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,kCAAkC;IAClC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/I,6BAA6B;IAC7B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAIpD,iEAAiE;IACjE,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,yCAAyC;IACzC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,+CAA+C;IAC/C,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,qDAAqD;IACrD,mBAAmB,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC5C,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0BAA0B;AAC1B,MAAM,WAAW,sBAAsB;IACrC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/useAuth.d.ts

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { type AuthContextValue } from './AuthContext';
+import { type AuthContextValue } from './AuthContext.js';
 /**
  * Hook to access authentication state and methods.
  * Must be used within an AuthProvider.

package/dist/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CA6D1C"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,gBAAgB,CAiE1C"}

package/dist/useAuth.js

@@ -6,7 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import { useContext } from 'react';
-import { AuthCtx } from './AuthContext';
+import { AuthCtx } from './AuthContext.js';
 /**
  * Hook to access authentication state and methods.
  * Must be used within an AuthProvider.
@@ -60,6 +60,10 @@ export function useAuth() {
             activeOrganization: null,
             activeMember: null,
             isOrganizationsLoading: false,
+            // Nothing to resolve without a provider — same reasoning as `isLoading`
+            // above, which is `false` here for the same reason. A consumer gating on
+            // this must render through in a provider-less embed, not hang.
+            isMembershipResolved: true,
             switchOrganization: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             createOrganization: async () => { throw new Error('useAuth must be used within an AuthProvider'); },
             refreshOrganizations: async () => { throw new Error('useAuth must be used within an AuthProvider'); },

package/dist/useWorkspaceAdminStatus.d.ts

@@ -0,0 +1,134 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The workspace-admin verdict AND whether it is worth acting on yet.
+ *
+ * These are two different facts and they were one boolean until objectui#5619.
+ * See {@link useWorkspaceAdminStatus} for why collapsing them was a defect.
+ */
+export interface WorkspaceAdminStatus {
+    /**
+     * True only when adminship is CONFIRMED by one of the legs below.
+     * While `isResolved` is false this is `false` because nothing has said
+     * otherwise yet — NOT because the viewer is known not to be an admin.
+     */
+    isAdmin: boolean;
+    /**
+     * Whether every input `isAdmin` depends on has arrived. Gate any branch
+     * whose wrong side is expensive — a refusal screen, a `<Navigate>`, a nav
+     * entry that would have to be added back — on this being true.
+     */
+    isResolved: boolean;
+}
+/**
+ * Whether the current user has owner/admin privileges, and whether that answer
+ * has finished resolving.
+ *
+ * Sources considered (any one is sufficient):
+ *  - LEG 1 — the active organization member row (multi-tenant mode).
+ *  - LEG 2 — the top-level `user.role` scalar from the session: legacy
+ *    deployments that still store an admin role on the user row.
+ *  - LEG 3a — `user.isPlatformAdmin` from the session: the server's ADR-0095
+ *    posture RUNG, and the ONLY leg that sees a platform administrator whose
+ *    adminship comes from the `admin_full_access` permission set. On a
+ *    single-tenant deployment there is no member row to read (leg 1) and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so this
+ *    flag is the whole signal for that viewer. Measured on a live protocol-17
+ *    server in objectui#5389 — the captured payload there carries
+ *    `isPlatformAdmin: true` — and pinned by
+ *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *  - LEG 3b — `user.positions[]` from the session, judged against
+ *    {@link ADMIN_POSITION_NAMES} rather than {@link ADMIN_ROLES}: the
+ *    canonical TENANT-scoped identity names the server derives from the active
+ *    organization's membership row (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is what lets a tenant administrator resolve on the
+ *    first frame instead of waiting for leg 1 (see the objectui#5619 section
+ *    below).
+ *
+ * ## Why 3a and 3b are two legs and not one (objectui#8291)
+ *
+ * This docblock used to argue the opposite, and a future reader who finds that
+ * argument standing will re-introduce the defect it now describes. It said:
+ * do not read `user.isPlatformAdmin` alongside `positions`, because the server
+ * computes the flag as `'platform_admin' in positions` from the same
+ * expression, so reading both would be two spellings for one fact with no way
+ * to disagree usefully and every way to drift.
+ *
+ * **That was true and it is now false.** Framework objectstack#15948 (a
+ * declared BREAKING change) redefined what `positions[]` IS. It used to be the
+ * `sys_user.role` scalar split on commas; it is now built by
+ * `resolveUserAuthzGrants` and carries ADR-0057 D4 `sys_user_position`
+ * assignments. That table is `apiEnabled` and its `position` values are
+ * unconstrained, so a caller holding tenant-administration authority can mint
+ * a row spelling `platform_admin` for one of their own users — and the name
+ * lands on `positions[]` verbatim.
+ *
+ * The two therefore no longer say one thing:
+ *
+ *  - `isPlatformAdmin` is `grants.posture === 'PLATFORM_ADMIN'` — derived from
+ *    an UNSCOPED `admin_full_access` grant (or a verified email on the
+ *    deployment's declared administrator list) and from nothing else. It is
+ *    byte-for-byte what the server's own `hasPlatformAdminStanding` returns.
+ *  - `positions[]` is the security AXIS, which is a wider thing: it is the set
+ *    of names a request resolves to, including names a tenant wrote.
+ *
+ * They can now disagree, and when they do **the rung is right** — enforcement
+ * agrees with the rung, so the array's extra name buys nothing except a
+ * Console that paints platform-administrator surfaces at a principal every
+ * underlying call refuses. `resolve-authz-context.ts` states the rule at
+ * `hasPlatformAdminStanding`: read the RUNG, never
+ * `positions.includes('platform_admin')`. The framework moved four server-side
+ * sites onto it (`plugin-sharing`, `plugin-approvals`, `plugin-security`,
+ * `runtime`); this hook is the same read on the client side of the wire.
+ *
+ * ⛔ So: never put `platform_admin` back into {@link ADMIN_POSITION_NAMES},
+ * and never widen leg 3b back to {@link ADMIN_ROLES}. The name is not the
+ * authority. Every server that publishes `positions` publishes
+ * `isPlatformAdmin` beside it — `customSession` returns them in one object
+ * literal — so nothing is lost by reading the narrow one.
+ *
+ * `positions` also remains the ONE published spelling of the array itself. It
+ * is deliberately not read alongside the retired `roles` (ADR-0090 D3 renamed
+ * with no deprecation window and bans resurrecting the old name as a
+ * fallback).
+ *
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user
+ * (`role: 'admin'`, which leg 2 reads), so this returns `isAdmin: true` for
+ * dev/demo setups.
+ *
+ * ## Why this returns a pair and not a boolean (objectui#5619)
+ *
+ * It used to return a bare `boolean`, which gave "not resolved yet" and
+ * "resolved: not an admin" the same answer — `false`. Leg 1 is not settled
+ * when a console page first mounts: `AuthProvider.refreshActiveMember` runs
+ * from its own effect, keyed on `activeOrganization`, which itself appears
+ * only after `listOrganizations()` → `getActiveOrganization()` (→ the ADR-0081
+ * single-membership `setActiveOrganization()` repair) resolve. So an
+ * administrator whose adminship lives ONLY in the member row rendered at least
+ * once as a non-admin, and every gate downstream acted on it: two marketplace
+ * surfaces painted `MarketplaceAccessDenied` at a real administrator, the
+ * console chrome dropped and re-added a nav entry, and `AppContent` fired a
+ * `<Navigate to="/home" replace>` that the later flip cannot undo.
+ *
+ * Legs 2 and 3b DO cover that viewer whenever the session was minted with an
+ * active organization stamped on it — framework `auth-manager.ts` reads
+ * `session.activeOrganizationId` and, when it is set, maps the member row into
+ * `positions[]` as `org_owner`/`org_admin`. Those two names are exactly why
+ * objectui#8291 kept leg 3b alive rather than deleting the array read
+ * outright. The window is therefore not "every tenant admin" as first
+ * reported, but "every session that reaches the console without that stamp",
+ * which is exactly the path `refreshOrganizations`' ADR-0081 repair exists to
+ * serve.
+ *
+ * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
+ * admin is a final answer, and the legs still in flight can only agree with it.
+ * Callers therefore never wait on a verdict they already have — an admin
+ * detected through the rung or through `positions` pays nothing for this gate.
+ */
+export declare function useWorkspaceAdminStatus(): WorkspaceAdminStatus;
+//# sourceMappingURL=useWorkspaceAdminStatus.d.ts.map

package/dist/useWorkspaceAdminStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useWorkspaceAdminStatus.d.ts","sourceRoot":"","sources":["../src/useWorkspaceAdminStatus.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsFH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwGG;AACH,wBAAgB,uBAAuB,IAAI,oBAAoB,CAmB9D"}

package/dist/useWorkspaceAdminStatus.js

@@ -0,0 +1,208 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import { useAuth } from './useAuth.js';
+/**
+ * The vocabulary of the two SCALAR legs — a membership row's `role` (leg 1)
+ * and the stored `user.role` (leg 2).
+ *
+ * Both are single values written by a path the tenant does not control: leg 1
+ * is better-auth's `sys_member.role`, capped at the issuer's own grade on
+ * every issuance path; leg 2 is `sys_user.role`, which framework ADR-0092 D2's
+ * identity write guard refuses under a user context. A name found in either is
+ * therefore evidence.
+ *
+ * ⛔ This set is NOT the vocabulary for `user.positions[]` — see
+ * {@link ADMIN_POSITION_NAMES} for the narrower one that leg 3b uses, and the
+ * hook's docblock for why the two had to be separated (objectui#8291).
+ */
+const ADMIN_ROLES = new Set([
+    'owner',
+    'admin',
+    'super_admin',
+    'superadmin',
+    'platform_admin',
+    'system_admin',
+    // ADR-0068 canonical names. `mapMembershipRole` normalizes raw better-auth
+    // owner/admin to org_owner/org_admin before they reach a session payload, so
+    // a membership role can arrive here in either spelling depending on which
+    // surface produced it. Accept both so admin detection survives the removal
+    // of the `user.role = 'admin'` overwrite footgun.
+    'org_owner',
+    'org_admin',
+]);
+/**
+ * The vocabulary of leg 3b — the only names honoured when found in
+ * `user.positions[]`.
+ *
+ * Deliberately NOT {@link ADMIN_ROLES}. `positions[]` is a tenant-WRITABLE
+ * array (see the hook's docblock), so the question for each name is not "does
+ * it sound like an admin" but "does a trusted server derivation ever put it
+ * here". Decided name by name in objectui#8291:
+ *
+ *  - `org_owner`, `org_admin` — KEPT. `resolveUserAuthzGrants` emits exactly
+ *    these from the ACTIVE organization's `sys_member.role` through
+ *    `mapMembershipRole`, so a hit is usually the real membership row arriving
+ *    ahead of leg 1. A `sys_user_position` row CAN also spell them, but that
+ *    row is written by a caller who already holds tenant-administration
+ *    authority over the same organization (framework `DelegatedAdminGate`), so
+ *    what they mint is a second spelling of an authority they have — not a
+ *    crossing of any boundary. This is also the framework's own line: its
+ *    four-site sweep left every TENANT_ADMIN arm untouched and moved only the
+ *    platform ones.
+ *  - `platform_admin` — DROPPED, and replaced by leg 3a. It is the name a
+ *    tenant can mint to claim authority it does not have, and the array cannot
+ *    tell a minted one from a genuine one: `resolveUserAuthzGrants` pushes the
+ *    built-in name only when it is not already present, so both cases produce
+ *    a byte-identical array.
+ *  - `owner`, `admin`, `super_admin`, `superadmin`, `system_admin` — DROPPED.
+ *    No server derivation emits any of them into `positions[]` at all: the
+ *    membership leg normalizes `owner`/`admin` to `org_*` first, and the other
+ *    three are not built-in identity names in any framework vocabulary. A hit
+ *    on one could therefore ONLY be a `sys_user_position` row — all exposure,
+ *    no signal. They stay in {@link ADMIN_ROLES}, where they are the raw
+ *    scalars legs 1 and 2 legitimately read.
+ */
+const ADMIN_POSITION_NAMES = new Set([
+    'org_owner',
+    'org_admin',
+]);
+/**
+ * One name from either SCALAR source — a membership role or the stored
+ * `user.role` scalar. The two draw on one vocabulary by design (ADR-0068 D2
+ * maps a membership `owner`/`admin` onto the canonical `org_owner`/`org_admin`
+ * that {@link ADMIN_ROLES} also carries), so one predicate serves both.
+ */
+function isAdminRole(role) {
+    return typeof role === 'string' && ADMIN_ROLES.has(role.toLowerCase());
+}
+/** One entry of `user.positions[]`, judged against the narrower vocabulary. */
+function isAdminPosition(position) {
+    return typeof position === 'string' && ADMIN_POSITION_NAMES.has(position.toLowerCase());
+}
+/**
+ * Whether the current user has owner/admin privileges, and whether that answer
+ * has finished resolving.
+ *
+ * Sources considered (any one is sufficient):
+ *  - LEG 1 — the active organization member row (multi-tenant mode).
+ *  - LEG 2 — the top-level `user.role` scalar from the session: legacy
+ *    deployments that still store an admin role on the user row.
+ *  - LEG 3a — `user.isPlatformAdmin` from the session: the server's ADR-0095
+ *    posture RUNG, and the ONLY leg that sees a platform administrator whose
+ *    adminship comes from the `admin_full_access` permission set. On a
+ *    single-tenant deployment there is no member row to read (leg 1) and the
+ *    server deliberately no longer overwrites `user.role` (leg 2), so this
+ *    flag is the whole signal for that viewer. Measured on a live protocol-17
+ *    server in objectui#5389 — the captured payload there carries
+ *    `isPlatformAdmin: true` — and pinned by
+ *    `__tests__/workspaceAdminPositions-5389.test.tsx`.
+ *  - LEG 3b — `user.positions[]` from the session, judged against
+ *    {@link ADMIN_POSITION_NAMES} rather than {@link ADMIN_ROLES}: the
+ *    canonical TENANT-scoped identity names the server derives from the active
+ *    organization's membership row (ADR-0068 D1/D2, renamed from `roles` by
+ *    ADR-0090 D3). This is what lets a tenant administrator resolve on the
+ *    first frame instead of waiting for leg 1 (see the objectui#5619 section
+ *    below).
+ *
+ * ## Why 3a and 3b are two legs and not one (objectui#8291)
+ *
+ * This docblock used to argue the opposite, and a future reader who finds that
+ * argument standing will re-introduce the defect it now describes. It said:
+ * do not read `user.isPlatformAdmin` alongside `positions`, because the server
+ * computes the flag as `'platform_admin' in positions` from the same
+ * expression, so reading both would be two spellings for one fact with no way
+ * to disagree usefully and every way to drift.
+ *
+ * **That was true and it is now false.** Framework objectstack#15948 (a
+ * declared BREAKING change) redefined what `positions[]` IS. It used to be the
+ * `sys_user.role` scalar split on commas; it is now built by
+ * `resolveUserAuthzGrants` and carries ADR-0057 D4 `sys_user_position`
+ * assignments. That table is `apiEnabled` and its `position` values are
+ * unconstrained, so a caller holding tenant-administration authority can mint
+ * a row spelling `platform_admin` for one of their own users — and the name
+ * lands on `positions[]` verbatim.
+ *
+ * The two therefore no longer say one thing:
+ *
+ *  - `isPlatformAdmin` is `grants.posture === 'PLATFORM_ADMIN'` — derived from
+ *    an UNSCOPED `admin_full_access` grant (or a verified email on the
+ *    deployment's declared administrator list) and from nothing else. It is
+ *    byte-for-byte what the server's own `hasPlatformAdminStanding` returns.
+ *  - `positions[]` is the security AXIS, which is a wider thing: it is the set
+ *    of names a request resolves to, including names a tenant wrote.
+ *
+ * They can now disagree, and when they do **the rung is right** — enforcement
+ * agrees with the rung, so the array's extra name buys nothing except a
+ * Console that paints platform-administrator surfaces at a principal every
+ * underlying call refuses. `resolve-authz-context.ts` states the rule at
+ * `hasPlatformAdminStanding`: read the RUNG, never
+ * `positions.includes('platform_admin')`. The framework moved four server-side
+ * sites onto it (`plugin-sharing`, `plugin-approvals`, `plugin-security`,
+ * `runtime`); this hook is the same read on the client side of the wire.
+ *
+ * ⛔ So: never put `platform_admin` back into {@link ADMIN_POSITION_NAMES},
+ * and never widen leg 3b back to {@link ADMIN_ROLES}. The name is not the
+ * authority. Every server that publishes `positions` publishes
+ * `isPlatformAdmin` beside it — `customSession` returns them in one object
+ * literal — so nothing is lost by reading the narrow one.
+ *
+ * `positions` also remains the ONE published spelling of the array itself. It
+ * is deliberately not read alongside the retired `roles` (ADR-0090 D3 renamed
+ * with no deprecation window and bans resurrecting the old name as a
+ * fallback).
+ *
+ * In preview-mode / no-auth-enabled mode the provider seeds an admin user
+ * (`role: 'admin'`, which leg 2 reads), so this returns `isAdmin: true` for
+ * dev/demo setups.
+ *
+ * ## Why this returns a pair and not a boolean (objectui#5619)
+ *
+ * It used to return a bare `boolean`, which gave "not resolved yet" and
+ * "resolved: not an admin" the same answer — `false`. Leg 1 is not settled
+ * when a console page first mounts: `AuthProvider.refreshActiveMember` runs
+ * from its own effect, keyed on `activeOrganization`, which itself appears
+ * only after `listOrganizations()` → `getActiveOrganization()` (→ the ADR-0081
+ * single-membership `setActiveOrganization()` repair) resolve. So an
+ * administrator whose adminship lives ONLY in the member row rendered at least
+ * once as a non-admin, and every gate downstream acted on it: two marketplace
+ * surfaces painted `MarketplaceAccessDenied` at a real administrator, the
+ * console chrome dropped and re-added a nav entry, and `AppContent` fired a
+ * `<Navigate to="/home" replace>` that the later flip cannot undo.
+ *
+ * Legs 2 and 3b DO cover that viewer whenever the session was minted with an
+ * active organization stamped on it — framework `auth-manager.ts` reads
+ * `session.activeOrganizationId` and, when it is set, maps the member row into
+ * `positions[]` as `org_owner`/`org_admin`. Those two names are exactly why
+ * objectui#8291 kept leg 3b alive rather than deleting the array read
+ * outright. The window is therefore not "every tenant admin" as first
+ * reported, but "every session that reaches the console without that stamp",
+ * which is exactly the path `refreshOrganizations`' ADR-0081 repair exists to
+ * serve.
+ *
+ * `isResolved` is deliberately true the moment `isAdmin` is true: a confirmed
+ * admin is a final answer, and the legs still in flight can only agree with it.
+ * Callers therefore never wait on a verdict they already have — an admin
+ * detected through the rung or through `positions` pays nothing for this gate.
+ */
+export function useWorkspaceAdminStatus() {
+    const { activeMember, user, isLoading, isMembershipResolved } = useAuth();
+    const positions = user?.positions;
+    const isAdmin = isAdminRole(activeMember?.role) ||
+        isAdminRole(user?.role) ||
+        // Leg 3a — `=== true` on purpose. A session that never published the flag
+        // must read as "no platform standing", not as a truthy unknown.
+        user?.isPlatformAdmin === true ||
+        (Array.isArray(positions) && positions.some(isAdminPosition));
+    if (isAdmin)
+        return { isAdmin: true, isResolved: true };
+    // Legs 2, 3a and 3b are settled once the session has landed (`isLoading`);
+    // leg 1 is settled once the organization/member pipeline has reached a
+    // terminal state (`isMembershipResolved`). Both, because a viewer can be an
+    // admin through either.
+    return { isAdmin: false, isResolved: !isLoading && isMembershipResolved };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "17.5.0",
+  "version": "17.7.0",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
@@ -30,9 +30,8 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@objectstack/spec": "^17.0.0-rc.6",
-    "better-auth": "^1.6.26",
-    "@object-ui/types": "17.5.0"
+    "@objectstack/spec": "^17.0.0",
+    "better-auth": "^1.7.2"
   },
   "devDependencies": {
     "@types/react": "19.2.18",
@@ -62,9 +61,9 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist",
-    "test": "vitest run",
+    "build": "tsc && node ../../scripts/check-dist-completeness.mjs",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "test": "vitest run --root ../.. packages/auth/",
     "type-check": "tsc --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint ."
   }

package/dist/useIsWorkspaceAdmin.d.ts

@@ -1,21 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * Returns true when the current user has owner/admin privileges.
- *
- * Sources considered (any one is sufficient):
- *  - The active organization member row (multi-tenant mode).
- *  - The top-level `user.role` / `user.roles` from the session — this covers
- *    platform / system administrators in single-tenant deployments where
- *    there is no `activeMember` row to read a role from.
- *
- * In preview-mode / no-auth-enabled mode the provider seeds an admin user,
- * so this returns `true` for dev/demo setups.
- */
-export declare function useIsWorkspaceAdmin(): boolean;
-//# sourceMappingURL=useIsWorkspaceAdmin.d.ts.map

package/dist/useIsWorkspaceAdmin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useIsWorkspaceAdmin.d.ts","sourceRoot":"","sources":["../src/useIsWorkspaceAdmin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}