@pinnadash/account-sdk 0.1.0

package/README.md

@@ -0,0 +1,33 @@
+# @pinnadash/account-sdk
+
+Pinnadash 账户体系客户端 SDK(单一来源):PKCE 登录、深链回调、token 刷新、离线宽限、会员权益、付费墙。
+零依赖,Web Crypto + fetch,浏览器 / Workers / Tauri webview 通用。
+
+> 对接文档见 [INTEGRATION.md](./INTEGRATION.md)。本 README 只讲「单一来源分发」机制。
+
+## 单一来源规则(2026-09-18 起)
+
+全公司**只有本目录一份实现**(`packages/sdk/src/`,4 文件)。五个产品仓的拷贝一律由脚本分发,**禁止手改 vendor 目录**:
+
+```bash
+# 在 account_center 仓:
+node scripts/sync-account-sdk.mjs                # 全量分发到 5 产品仓
+node scripts/sync-account-sdk.mjs --only easy_clipboard
+node scripts/sync-account-sdk.mjs --check        # 对账(可挂 CI/rulecheck),漂移退出码 1
+```
+
+产品侧消费:tsconfig `paths` + vite `resolve.alias` 把 `@pinnadash/account-sdk`(及 `/desktop` `/paywall` `/login-ui` 子路径)映射到 `src/vendor/account-sdk/`。
+
+## 为什么还不是 npm 包
+
+npmjs 发布凭据未配。包名已按 `@pinnadash/account-sdk` 规范占位(业务 import 不含路径细节),凭据就位后:
+
+```bash
+npm publish   # packages/sdk 内;业务侧删 alias、加依赖即完成切换,import 零改动
+```
+
+## 改动流程
+
+1. 改 `packages/sdk/src/`(业务改动走各文件 region 或常规提交,测试在 `packages/sdk/test/`);
+2. `npx vitest run` + `npx tsc -p tsconfig.json --noEmit` 全绿;
+3. 跑同步脚本分发;各产品仓 `npm run build` 验证。

package/dist/desktop.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Desktop (Tauri) helpers: storage adapter, offline grace logic (design.md §5.3),
+ * deep-link callback parsing and display helpers shared by desktop products.
+ *
+ * Desktop differences from web:
+ *   - storage: Tauri app_data dir (file), NOT localStorage — survives reinstalls of webviews
+ *   - signed snapshot: the last valid session is re-verified against JWKS before use
+ *   - offline grace: after access token expiry, member access continues for GRACE_DAYS
+ *     as long as the locally-verified snapshot says member=true; past that, require login
+ *
+ * The grace logic is pure and tested here; the Tauri file IO is injected via StorageAdapter.
+ */
+import type { Session, StorageAdapter, Entitlements } from "./index.js";
+export declare const GRACE_DAYS = 7;
+/**
+ * Entitlement resolution for offline desktop:
+ *   1. valid session + member -> member
+ *   2. expired access token but within grace of `obtained_at + expires_in + grace`
+ *      AND snapshot says member -> member (degraded)
+ *   3. otherwise -> free
+ *
+ * Trial state is orthogonal to the member grace window: it is judged purely by
+ * absolute time from the snapshot (trials[product] > now), so going offline
+ * never extends a trial, and an expired token never strips one. Pass the
+ * product slug as trialProduct to have trialActive computed; otherwise false.
+ *
+ * nowSeconds is injectable for tests.
+ */
+export declare function resolveOfflineEntitlements(session: Session | null, nowSeconds: number, trialProduct?: string): Entitlements & {
+    degraded: boolean;
+    trialActive: boolean;
+};
+/**
+ * Tauri storage adapter factory. The app reads its snapshot file once at startup
+ * (createTauriStorageSync) and passes the seed value; all adapter ops stay
+ * synchronous, matching StorageAdapter. Writes flush asynchronously (fire-and-forget)
+ * through the io callbacks.
+ */
+export declare function createTauriStorage(io: {
+    seed: string | null;
+    write: (value: string) => Promise<void>;
+}): StorageAdapter;
+/** Session tamper check: structural validation (crypto verification of JWT happens
+ *  in Account Center's /v1/me and at exchange time; the snapshot only survives if
+ *  it was issued by the server — a forged JSON cannot pass refresh). */
+export declare function isPlausibleSession(raw: string): boolean;
+/**
+ * Parse a custom-scheme login callback URL, accepting only `<scheme>://auth/callback?code=***`.
+ * WHATWG URL parses the first segment of a custom scheme as the host
+ * (`scheme://auth/callback` → host="auth", pathname="/callback"; the single-slash form
+ * yields pathname="/auth/callback") — both shapes are normalized before matching,
+ * otherwise the callback never matches and login fails silently (recorded in the
+ * lessons ledger; do not "simplify" this back to a pathname comparison).
+ */
+export declare function parseDeepLinkCallback(rawUrl: string, scheme: string): URL | null;
+/**
+ * Extract the first deep-link URL from process argv. Windows single-instance
+ * callbacks arrive via argv / second-instance commandLine (same shape); null if absent.
+ */
+export declare function extractDeepLinkFromArgv(argv: string[], scheme: string): string | null;
+/**
+ * Display-only: decode the email claim from an access token (JWT) payload, used to
+ * show the account name offline. No signature verification (that happens server-side);
+ * returns "" on any failure so callers can omit the name instead of erroring.
+ */
+export declare function emailFromAccessToken(token: string | null | undefined): string;
+//# sourceMappingURL=desktop.d.ts.map

package/dist/desktop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop.d.ts","sourceRoot":"","sources":["../src/desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGxE,eAAO,MAAM,UAAU,IAAI,CAAC;AAG5B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,YAAY,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAgB5D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE;IACrC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC,GAAG,cAAc,CA8BjB;AAED;;wEAEwE;AACxE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAcvD;AAID;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAShF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAY7E"}

package/dist/desktop.js

@@ -0,0 +1,151 @@
+/**
+ * Desktop (Tauri) helpers: storage adapter, offline grace logic (design.md §5.3),
+ * deep-link callback parsing and display helpers shared by desktop products.
+ *
+ * Desktop differences from web:
+ *   - storage: Tauri app_data dir (file), NOT localStorage — survives reinstalls of webviews
+ *   - signed snapshot: the last valid session is re-verified against JWKS before use
+ *   - offline grace: after access token expiry, member access continues for GRACE_DAYS
+ *     as long as the locally-verified snapshot says member=true; past that, require login
+ *
+ * The grace logic is pure and tested here; the Tauri file IO is injected via StorageAdapter.
+ */
+import { trialActive as computeTrialActive } from "./index.js";
+export const GRACE_DAYS = 7;
+const GRACE_SECONDS = GRACE_DAYS * 24 * 3600;
+/**
+ * Entitlement resolution for offline desktop:
+ *   1. valid session + member -> member
+ *   2. expired access token but within grace of `obtained_at + expires_in + grace`
+ *      AND snapshot says member -> member (degraded)
+ *   3. otherwise -> free
+ *
+ * Trial state is orthogonal to the member grace window: it is judged purely by
+ * absolute time from the snapshot (trials[product] > now), so going offline
+ * never extends a trial, and an expired token never strips one. Pass the
+ * product slug as trialProduct to have trialActive computed; otherwise false.
+ *
+ * nowSeconds is injectable for tests.
+ */
+export function resolveOfflineEntitlements(session, nowSeconds, trialProduct) {
+    if (!session) {
+        return { member: false, plan: "free", scope: "all", expiresAt: null, startedAt: null, degraded: false, trialActive: false };
+    }
+    const tokenExpiresAt = session.obtained_at + session.expires_in;
+    const member = session.entitlements.member;
+    const trialActive = trialProduct ? computeTrialActive(session.entitlements, trialProduct, nowSeconds) : false;
+    if (nowSeconds < tokenExpiresAt) {
+        return { ...session.entitlements, degraded: false, trialActive };
+    }
+    // token expired: grace window applies to members only
+    if (member && nowSeconds < tokenExpiresAt + GRACE_SECONDS) {
+        return { ...session.entitlements, degraded: true, trialActive };
+    }
+    return { member: false, plan: "free", scope: "all", expiresAt: null, startedAt: null, degraded: member, trialActive };
+}
+/**
+ * Tauri storage adapter factory. The app reads its snapshot file once at startup
+ * (createTauriStorageSync) and passes the seed value; all adapter ops stay
+ * synchronous, matching StorageAdapter. Writes flush asynchronously (fire-and-forget)
+ * through the io callbacks.
+ */
+export function createTauriStorage(io) {
+    const cache = new Map();
+    if (io.seed) {
+        try {
+            const obj = JSON.parse(io.seed);
+            for (const [k, v] of Object.entries(obj))
+                cache.set(k, v);
+        }
+        catch {
+            /* corrupted snapshot: start clean */
+        }
+    }
+    function persist() {
+        const obj = {};
+        cache.forEach((v, k) => (obj[k] = v));
+        void io.write(JSON.stringify(obj));
+    }
+    return {
+        get(key) {
+            return cache.get(key) ?? null;
+        },
+        set(key, value) {
+            cache.set(key, value);
+            persist();
+        },
+        remove(key) {
+            cache.delete(key);
+            persist();
+        },
+    };
+}
+/** Session tamper check: structural validation (crypto verification of JWT happens
+ *  in Account Center's /v1/me and at exchange time; the snapshot only survives if
+ *  it was issued by the server — a forged JSON cannot pass refresh). */
+export function isPlausibleSession(raw) {
+    try {
+        const s = JSON.parse(raw);
+        return (typeof s.access_token === "string" &&
+            s.access_token.split(".").length === 3 && // JWT shape
+            typeof s.refresh_token === "string" &&
+            typeof s.expires_in === "number" &&
+            typeof s.obtained_at === "number" &&
+            typeof s.entitlements === "object");
+    }
+    catch {
+        return false;
+    }
+}
+// ---------- deep-link callback parsing (shared by desktop shells) ----------
+/**
+ * Parse a custom-scheme login callback URL, accepting only `<scheme>://auth/callback?code=***`.
+ * WHATWG URL parses the first segment of a custom scheme as the host
+ * (`scheme://auth/callback` → host="auth", pathname="/callback"; the single-slash form
+ * yields pathname="/auth/callback") — both shapes are normalized before matching,
+ * otherwise the callback never matches and login fails silently (recorded in the
+ * lessons ledger; do not "simplify" this back to a pathname comparison).
+ */
+export function parseDeepLinkCallback(rawUrl, scheme) {
+    try {
+        const parsed = new URL(rawUrl);
+        if (parsed.protocol !== `${scheme}:`)
+            return null;
+        const tail = parsed.hostname ? `/${parsed.hostname}${parsed.pathname}` : parsed.pathname;
+        return tail === "/auth/callback" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract the first deep-link URL from process argv. Windows single-instance
+ * callbacks arrive via argv / second-instance commandLine (same shape); null if absent.
+ */
+export function extractDeepLinkFromArgv(argv, scheme) {
+    const prefix = `${scheme}:`;
+    const hit = argv.find((arg) => arg.startsWith(prefix));
+    return hit ?? null;
+}
+/**
+ * Display-only: decode the email claim from an access token (JWT) payload, used to
+ * show the account name offline. No signature verification (that happens server-side);
+ * returns "" on any failure so callers can omit the name instead of erroring.
+ */
+export function emailFromAccessToken(token) {
+    if (!token)
+        return "";
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return "";
+    try {
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const json = atob(b64 + "=".repeat((4 - (b64.length % 4)) % 4));
+        const email = JSON.parse(json).email;
+        return typeof email === "string" ? email : "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=desktop.js.map

package/dist/desktop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop.js","sourceRoot":"","sources":["../src/desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,IAAI,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,MAAM,aAAa,GAAG,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAuB,EACvB,UAAkB,EAClB,YAAqB;IAErB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC9H,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;IAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAE9G,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IACD,sDAAsD;IACtD,IAAI,MAAM,IAAI,UAAU,GAAG,cAAc,GAAG,aAAa,EAAE,CAAC;QAC1D,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAGlC;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAA2B,CAAC;YAC1D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAED,SAAS,OAAO;QACd,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,GAAG,CAAC,GAAG;YACL,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAChC,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,CAAC,GAAG;YACR,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;wEAEwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAC9C,OAAO,CACL,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY;YACtD,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;YACnC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAChC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YACjC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,MAAc;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,MAAM,GAAG;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzF,OAAO,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC,KAAK,CAAC;QAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,129 @@
+/**
+ * @pinnadash/account-sdk — client SDK for Account Center.
+ *
+ * One account, every product. The SDK handles:
+ *   - login()        → redirect to Account Center (magic link / Google), with PKCE
+ *   - handleCallback() → exchange ?code=*** for tokens (PKCE)
+ *   - getEntitlements() → { member, plan, scope, expiresAt }
+ *   - refreshIfDue()  → rotate refresh token before access token expiry
+ *   - logout()        → revoke refresh token + clear local session
+ *
+ * Storage is pluggable: localStorage (web) by default, custom storage for
+ * Tauri/desktop (see README §desktop). Zero dependencies; uses Web Crypto +
+ * fetch only, so it runs in browsers, Workers and Tauri webviews.
+ */
+export interface Entitlements {
+    member: boolean;
+    plan: string;
+    scope: "all";
+    expiresAt: number | null;
+    /** 当前订阅创建时间(unix 秒);老 session 快照无此字段 */
+    startedAt?: number | null;
+    /** Pro 7 天试用(design.md §6.5):付费优先;老 session 快照无此字段 */
+    is_trial?: boolean;
+    /** 最近开启的活跃试用产品(client_id);多产品场景真源是 trials */
+    trial_product?: string | null;
+    /** 最近开启的活跃试用到期时间(unix 秒) */
+    trial_ends_at?: number | null;
+    /** 全量活跃试用映射 product → ends_at(判定本产品试用态用 trials[productSlug]) */
+    trials?: Record<string, number>;
+}
+/**
+ * 本产品试用结束时间(unix 秒);无试用记录返回 undefined。
+ * trials 映射是真源;老快照(无 trials 键)回退 is_trial/trial_product/trial_ends_at。
+ */
+export declare function trialEndsAt(ent: Entitlements, product: string): number | undefined;
+/** 试用按绝对时间判定(ends_at > now),不因离线/token 宽限延长 */
+export declare function trialActive(ent: Entitlements, product: string, now: number): boolean;
+export interface Session {
+    access_token: string;
+    refresh_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    entitlements: Entitlements;
+    obtained_at: number;
+}
+export interface AccountClientOptions {
+    /** Account Center base URL, e.g. https://account.example.com */
+    centerUrl: string;
+    /** Product slug = client_id registered in Account Center (src/lib/auth/redirects.ts) */
+    productSlug: string;
+    /** Where Account Center redirects back after login. Defaults to `${origin}/auth/callback`. */
+    redirectUri?: string;
+    /** Storage adapter. Defaults to localStorage; desktop passes its own. */
+    storage?: StorageAdapter;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+export interface StorageAdapter {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+}
+export declare class AccountError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, message: string, status?: number | undefined);
+}
+export declare function createAccountClient(opts: AccountClientOptions): {
+    /** True if a session exists locally (not necessarily valid — call getEntitlements). */
+    hasSession(): boolean;
+    /** Read the locally persisted session (desktop offline entitlement resolution). */
+    getSession(): Session | null;
+    /** Build the login URL without navigating (desktop opens it via system browser). */
+    createLoginUrl: () => Promise<string>;
+    /**
+     * Start login: navigate the browser to Account Center.
+     * PKCE verifier is stashed in storage and consumed by handleCallback().
+     */
+    login(): Promise<void>;
+    /**
+     * In-product email login: send the magic-link email without leaving the product.
+     * The email's verify link lands on this client's redirect_uri with ?code=***,
+     * then handleCallback() finishes the PKCE exchange as usual.
+     *
+     * Dev note: when the Account Center runs without RESEND_API_KEY (dev mode) the
+     * response includes login_token + verify_url so flows can be tested without mail.
+     */
+    requestMagicLink(email: string, turnstileToken?: string): Promise<{
+        ok: true;
+        message: string;
+        dev?: {
+            login_token: string;
+            verify_url: string;
+        };
+    }>;
+    /**
+     * Finish login on the callback page: read ?code=***, exchange with the stashed
+     * verifier. Returns the session. Safe to call on any page — returns null when
+     * no code param is present.
+     */
+    handleCallback(searchParams?: URLSearchParams | string): Promise<Session | null>;
+    /**
+     * Membership state. Force-refreshes from /v1/me when stale (or force=true),
+     * otherwise serves from the session's cached entitlements.
+     */
+    getEntitlements(force?: boolean): Promise<Entitlements>;
+    /**
+     * Rotate tokens if the access token is at/near expiry (or force=true).
+     * Returns the fresh session, or null when logged out / refresh rejected.
+     */
+    refreshIfDue(force?: boolean): Promise<Session | null>;
+    /**
+     * Start the 7-day Pro trial for this product (POST /v1/trial/start).
+     * Idempotent and once-per-account-per-product server-side; outcome maps
+     * HTTP 409 variants so callers can message without parsing errors.
+     */
+    startTrial(product: string): Promise<{
+        outcome: "started" | "active" | "already_member" | "trial_used";
+        trial?: {
+            product: string;
+            starts_at: number;
+            ends_at: number;
+        };
+    }>;
+    /** Revoke the refresh token server-side and clear local state. */
+    logout(): Promise<void>;
+};
+export type AccountClient = ReturnType<typeof createAccountClient>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4BAA4B;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlF;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED,MAAM,WAAW,OAAO;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAoCD,qBAAa,YAAa,SAAQ,KAAK;aAEnB,IAAI,EAAE,MAAM;aAEZ,MAAM,CAAC,EAAE,MAAM;IAHjC,YACkB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EAIhC;CACF;AAkCD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB;IA4C1D,uFAAuF;kBACzE,OAAO;IAIrB,mFAAmF;kBACrE,OAAO,GAAG,IAAI;IAI5B,oFAAoF;0BArBrD,OAAO,CAAC,MAAM,CAAC;IAwB9C;;;OAGG;aACY,OAAO,CAAC,IAAI,CAAC;IAS5B;;;;;;;OAOG;4BAEM,MAAM,mBACI,MAAM,GACtB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IA8B5F;;;;OAIG;kCACiC,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAwBtF;;;OAGG;sCACmC,OAAO,CAAC,YAAY,CAAC;IA0B3D;;;OAGG;mCACgC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAmB1D;;;;OAIG;wBAEQ,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,YAAY,CAAC;QAChE,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACjE,CAAC;IAqBF,kEAAkE;cAClD,OAAO,CAAC,IAAI,CAAC;EAYhC;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/index.js

@@ -0,0 +1,314 @@
+/**
+ * @pinnadash/account-sdk — client SDK for Account Center.
+ *
+ * One account, every product. The SDK handles:
+ *   - login()        → redirect to Account Center (magic link / Google), with PKCE
+ *   - handleCallback() → exchange ?code=*** for tokens (PKCE)
+ *   - getEntitlements() → { member, plan, scope, expiresAt }
+ *   - refreshIfDue()  → rotate refresh token before access token expiry
+ *   - logout()        → revoke refresh token + clear local session
+ *
+ * Storage is pluggable: localStorage (web) by default, custom storage for
+ * Tauri/desktop (see README §desktop). Zero dependencies; uses Web Crypto +
+ * fetch only, so it runs in browsers, Workers and Tauri webviews.
+ */
+/**
+ * 本产品试用结束时间(unix 秒);无试用记录返回 undefined。
+ * trials 映射是真源;老快照(无 trials 键)回退 is_trial/trial_product/trial_ends_at。
+ */
+export function trialEndsAt(ent, product) {
+    if (ent.trials)
+        return ent.trials[product];
+    if (ent.is_trial && ent.trial_product === product)
+        return ent.trial_ends_at ?? undefined;
+    return undefined;
+}
+/** 试用按绝对时间判定(ends_at > now),不因离线/token 宽限延长 */
+export function trialActive(ent, product, now) {
+    const endsAt = trialEndsAt(ent, product);
+    return endsAt !== undefined && endsAt > now;
+}
+// ---------- default web storage ----------
+const localStorageAdapter = {
+    get(key) {
+        try {
+            return localStorage.getItem(key);
+        }
+        catch {
+            return null;
+        }
+    },
+    set(key, value) {
+        try {
+            localStorage.setItem(key, value);
+        }
+        catch {
+            /* private mode: session stays memory-only */
+        }
+    },
+    remove(key) {
+        try {
+            localStorage.removeItem(key);
+        }
+        catch {
+            /* noop */
+        }
+    },
+};
+// ---------- constants ----------
+const SESSION_KEY = "account.session";
+const VERIFIER_KEY = "account.pkce.verifier";
+const REFRESH_AHEAD = 5 * 60; // refresh 5 min before expiry
+// ---------- errors ----------
+export class AccountError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "AccountError";
+    }
+}
+// ---------- helpers ----------
+function b64url(bytes) {
+    const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let bin = "";
+    arr.forEach((b) => (bin += String.fromCharCode(b)));
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function pkcePair() {
+    const arr = new Uint8Array(32);
+    crypto.getRandomValues(arr);
+    const verifier = b64url(arr);
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return { verifier, challenge: b64url(digest) };
+}
+async function parseJsonError(res) {
+    let code = "request_failed";
+    let message = `HTTP ${res.status}`;
+    try {
+        const body = (await res.json());
+        if (body.error)
+            code = body.error;
+        if (body.message)
+            message = body.message;
+    }
+    catch {
+        /* non-JSON error body */
+    }
+    throw new AccountError(code, message, res.status);
+}
+// ---------- client ----------
+export function createAccountClient(opts) {
+    const centerUrl = opts.centerUrl.replace(/\/+$/, "");
+    const storage = opts.storage ?? localStorageAdapter;
+    const now = opts.now ?? (() => Math.floor(Date.now() / 1000));
+    const redirectUri = opts.redirectUri ?? `${globalThis.location?.origin ?? ""}/auth/callback`;
+    function readSession() {
+        const raw = storage.get(SESSION_KEY);
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            storage.remove(SESSION_KEY);
+            return null;
+        }
+    }
+    function writeSession(s) {
+        const persisted = { ...s, obtained_at: now() };
+        storage.set(SESSION_KEY, JSON.stringify(persisted));
+        return persisted;
+    }
+    async function api(path, init) {
+        return fetch(`${centerUrl}${path}`, {
+            ...init,
+            headers: { "Content-Type": "application/json", ...(init?.headers ?? {}) },
+        });
+    }
+    /** 构造授权 URL 并持久化 PKCE verifier,但不导航。
+     *  桌面壳调用它后用系统浏览器打开 URL(回调经自定义 scheme 的 redirect_uri 回到应用)。 */
+    async function createLoginUrl() {
+        const { verifier, challenge } = await pkcePair();
+        storage.set(VERIFIER_KEY, JSON.stringify({ verifier, at: now() }));
+        return (`${centerUrl}/login/?client_id=${encodeURIComponent(opts.productSlug)}` +
+            `&redirect_uri=${encodeURIComponent(redirectUri)}` +
+            `&code_challenge=${encodeURIComponent(challenge)}`);
+    }
+    return {
+        /** True if a session exists locally (not necessarily valid — call getEntitlements). */
+        hasSession() {
+            return readSession() !== null;
+        },
+        /** Read the locally persisted session (desktop offline entitlement resolution). */
+        getSession() {
+            return readSession();
+        },
+        /** Build the login URL without navigating (desktop opens it via system browser). */
+        createLoginUrl,
+        /**
+         * Start login: navigate the browser to Account Center.
+         * PKCE verifier is stashed in storage and consumed by handleCallback().
+         */
+        async login() {
+            const url = await createLoginUrl();
+            if (globalThis.location) {
+                globalThis.location.assign(url);
+            }
+            else {
+                throw new AccountError("no_browser", "login() requires a browser context; desktop should open the URL via shell opener");
+            }
+        },
+        /**
+         * In-product email login: send the magic-link email without leaving the product.
+         * The email's verify link lands on this client's redirect_uri with ?code=***,
+         * then handleCallback() finishes the PKCE exchange as usual.
+         *
+         * Dev note: when the Account Center runs without RESEND_API_KEY (dev mode) the
+         * response includes login_token + verify_url so flows can be tested without mail.
+         */
+        async requestMagicLink(email, turnstileToken) {
+            const { verifier, challenge } = await pkcePair();
+            storage.set(VERIFIER_KEY, JSON.stringify({ verifier, at: now() }));
+            const res = await api("/v1/auth/magic-link", {
+                method: "POST",
+                body: JSON.stringify({
+                    email,
+                    client_id: opts.productSlug,
+                    redirect_uri: redirectUri,
+                    code_challenge: challenge,
+                    ...(turnstileToken ? { turnstile_token: turnstileToken } : {}),
+                }),
+            });
+            if (!res.ok)
+                await parseJsonError(res);
+            const data = (await res.json());
+            return {
+                ok: true,
+                message: data.message,
+                ...(data.login_token && data.verify_url
+                    ? { dev: { login_token: data.login_token, verify_url: data.verify_url } }
+                    : {}),
+            };
+        },
+        /**
+         * Finish login on the callback page: read ?code=***, exchange with the stashed
+         * verifier. Returns the session. Safe to call on any page — returns null when
+         * no code param is present.
+         */
+        async handleCallback(searchParams) {
+            const params = typeof searchParams === "string"
+                ? new URLSearchParams(searchParams)
+                : (searchParams ?? new URLSearchParams(globalThis.location?.search ?? ""));
+            const code = params.get("code");
+            if (!code)
+                return null;
+            const rawVerifier = storage.get(VERIFIER_KEY);
+            if (!rawVerifier) {
+                throw new AccountError("pkce_missing", "No pending PKCE verifier — call login() first");
+            }
+            const { verifier } = JSON.parse(rawVerifier);
+            storage.remove(VERIFIER_KEY);
+            const res = await api("/v1/auth/token", {
+                method: "POST",
+                body: JSON.stringify({ code, code_verifier: verifier, client_id: opts.productSlug }),
+            });
+            if (!res.ok)
+                await parseJsonError(res);
+            const session = (await res.json());
+            return writeSession(session);
+        },
+        /**
+         * Membership state. Force-refreshes from /v1/me when stale (or force=true),
+         * otherwise serves from the session's cached entitlements.
+         */
+        async getEntitlements(force = false) {
+            const session = readSession();
+            if (!session)
+                return { member: false, plan: "free", scope: "all", expiresAt: null, startedAt: null };
+            const fresh = force || now() >= session.obtained_at + REFRESH_AHEAD;
+            if (!fresh)
+                return session.entitlements;
+            // /v1/me both validates the token and returns live entitlements
+            const res = await fetch(`${centerUrl}/v1/me`, {
+                headers: { Authorization: `Bearer ${session.access_token}` },
+            });
+            if (res.status === 401) {
+                // access token expired → try refresh once, then retry me
+                const refreshed = await this.refreshIfDue(true);
+                if (!refreshed) {
+                    storage.remove(SESSION_KEY);
+                    return { member: false, plan: "free", scope: "all", expiresAt: null, startedAt: null };
+                }
+                return this.getEntitlements(false);
+            }
+            if (!res.ok)
+                await parseJsonError(res);
+            const me = (await res.json());
+            writeSession({ ...session, entitlements: me.entitlements });
+            return me.entitlements;
+        },
+        /**
+         * Rotate tokens if the access token is at/near expiry (or force=true).
+         * Returns the fresh session, or null when logged out / refresh rejected.
+         */
+        async refreshIfDue(force = false) {
+            const session = readSession();
+            if (!session)
+                return null;
+            const expiresAt = session.obtained_at + session.expires_in;
+            if (!force && now() < expiresAt - REFRESH_AHEAD)
+                return session;
+            const res = await api("/v1/auth/refresh", {
+                method: "POST",
+                body: JSON.stringify({ refresh_token: session.refresh_token }),
+            });
+            if (res.status === 401) {
+                storage.remove(SESSION_KEY);
+                return null;
+            }
+            if (!res.ok)
+                await parseJsonError(res);
+            const fresh = (await res.json());
+            return writeSession(fresh);
+        },
+        /**
+         * Start the 7-day Pro trial for this product (POST /v1/trial/start).
+         * Idempotent and once-per-account-per-product server-side; outcome maps
+         * HTTP 409 variants so callers can message without parsing errors.
+         */
+        async startTrial(product) {
+            const session = readSession();
+            if (!session)
+                throw new AccountError("unauthorized", "Login required before starting a trial");
+            const res = await api("/v1/trial/start", {
+                method: "POST",
+                headers: { Authorization: `Bearer ${session.access_token}` },
+                body: JSON.stringify({ product }),
+            });
+            if (res.status === 409) {
+                const body = (await res.json().catch(() => ({})));
+                return { outcome: body.error === "already_member" ? "already_member" : "trial_used" };
+            }
+            if (!res.ok)
+                await parseJsonError(res);
+            const data = (await res.json());
+            return { outcome: data.already ? "active" : "started", trial: data.trial };
+        },
+        /** Revoke the refresh token server-side and clear local state. */
+        async logout() {
+            const session = readSession();
+            if (session?.refresh_token) {
+                await api("/v1/auth/logout", {
+                    method: "POST",
+                    body: JSON.stringify({ refresh_token: session.refresh_token }),
+                }).catch(() => undefined); // best-effort; local logout always succeeds
+            }
+            storage.remove(SESSION_KEY);
+            storage.remove(VERIFIER_KEY);
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqBH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAiB,EAAE,OAAe;IAC5D,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,aAAa,IAAI,SAAS,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,WAAW,CAAC,GAAiB,EAAE,OAAe,EAAE,GAAW;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC;AAC9C,CAAC;AA8BD,4CAA4C;AAE5C,MAAM,mBAAmB,GAAmB;IAC1C,GAAG,CAAC,GAAG;QACL,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,KAAK;QACZ,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG;QACR,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,kCAAkC;AAElC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,8BAA8B;AAE5D,+BAA+B;AAE/B,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB,IAAI;IAEJ,MAAM;IAHxB,YACkB,IAAY,EAC5B,OAAe,EACC,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;oBAJC,IAAI;sBAEJ,MAAM;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,gCAAgC;AAEhC,SAAS,MAAM,CAAC,KAA+B;IAC7C,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,IAAI,GAAG,gBAAgB,CAAC;IAC5B,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,+BAA+B;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,gBAAgB,CAAC;IAE3E,SAAS,WAAW;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,CAAU;QAC9B,MAAM,SAAS,GAAY,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAkB;QACjD,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG,IAAI,EAAE,EAAE;YAClC,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED;kEAC8D;IAC9D,KAAK,UAAU,cAAc;QAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,CACL,GAAG,SAAS,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;YACvE,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YAClD,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,uFAAuF;QACvF,UAAU;YACR,OAAO,WAAW,EAAE,KAAK,IAAI,CAAC;QAChC,CAAC;QAED,mFAAmF;QACnF,UAAU;YACR,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,oFAAoF;QACpF,cAAc;QAEd;;;WAGG;QACH,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,kFAAkF,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,cAAuB;YAEvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAEnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,qBAAqB,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,WAAW;oBAC3B,YAAY,EAAE,WAAW;oBACzB,cAAc,EAAE,SAAS;oBACzB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU;oBACrC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE;oBACzE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,cAAc,CAAC,YAAuC;YAC1D,MAAM,MAAM,GACV,OAAO,YAAY,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC;gBACnC,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,+CAA+C,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAqC,CAAC;YACjF,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aACrF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC9C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,eAAe,CAAC,KAAK,GAAG,KAAK;YACjC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAErG,MAAM,KAAK,GAAG,KAAK,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC;YACpE,IAAI,CAAC,KAAK;gBAAE,OAAO,OAAO,CAAC,YAAY,CAAC;YAExC,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,QAAQ,EAAE;gBAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,yDAAyD;gBACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACzF,CAAC;gBACD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;YAChE,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,CAAC,YAAY,CAAC;QACzB,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,KAAK;YAC9B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,SAAS,GAAG,aAAa;gBAAE,OAAO,OAAO,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,kBAAkB,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC5C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,UAAU,CACd,OAAe;YAKf,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAAC;YAC/F,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,iBAAiB,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE;gBAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;gBACxE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,kEAAkE;QAClE,KAAK,CAAC,MAAM;YACV,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC3B,MAAM,GAAG,CAAC,iBAAiB,EAAE;oBAC3B,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;iBAC/D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,4CAA4C;YACzE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/login-ui.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @pinnadash/account-sdk/login-ui — ready-made login UI for products.
+ *
+ * 产品拿去就能用的登录界面:自带样式(scoped CSS,不污染宿主)、
+ * 内置 zh-CN / en-US 双语文案、Turnstile 预留。产品自行决定承载方式:
+ *
+ *   import { mountLoginPanel, openLoginModal } from "@pinnadash/account-sdk/login-ui";
+ *
+ *   // 嵌入页面任意容器(页面式)
+ *   mountLoginPanel("#login-root", account);
+ *
+ *   // 弹窗式
+ *   const modal = openLoginModal(account);
+ *   modal.close();
+ *
+ * 纯 DOM 实现(零依赖),与 SDK 其余部分一样只依赖 Web 标准。
+ * 登录完成的后续(?code= 回调)仍由产品的 handleCallback 页处理。
+ */
+import type { AccountClient } from "./index.js";
+export interface LoginPanelOptions {
+    /** 界面语言。缺省自动检测浏览器语言,检测失败回退 zh-CN。 */
+    locale?: string;
+    /** Turnstile site key(生产环境防机器人)。传入即渲染 Turnstile widget。 */
+    turnstileSiteKey?: string;
+    /** 邮件发送成功后的回调(用于埋点等)。 */
+    onLinkSent?: (email: string) => void;
+}
+export interface LoginPanelHandle {
+    /** 移除面板及其注入的样式引用(弹窗关闭时使用)。 */
+    destroy(): void;
+}
+/** 把登录面板挂载到容器(selector 或元素)。页面式与弹窗式共用。 */
+export declare function mountLoginPanel(container: string | HTMLElement, client: AccountClient, opts?: LoginPanelOptions): LoginPanelHandle;
+/** 弹窗式登录:创建全屏遮罩 + 面板;返回 close() 与 destroy()。 */
+export declare function openLoginModal(client: AccountClient, opts?: LoginPanelOptions): LoginPanelHandle & {
+    close(): void;
+};
+//# sourceMappingURL=login-ui.d.ts.map

package/dist/login-ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ui.d.ts","sourceRoot":"","sources":["../src/login-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAuDhD,MAAM,WAAW,iBAAiB;IAChC,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,OAAO,IAAI,IAAI,CAAC;CACjB;AAoMD,0CAA0C;AAC1C,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,WAAW,EAC/B,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,iBAAsB,GAC3B,gBAAgB,CAqBlB;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,iBAAsB,GAC3B,gBAAgB,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CA8BtC"}

package/dist/login-ui.js

@@ -0,0 +1,278 @@
+/**
+ * @pinnadash/account-sdk/login-ui — ready-made login UI for products.
+ *
+ * 产品拿去就能用的登录界面:自带样式(scoped CSS,不污染宿主)、
+ * 内置 zh-CN / en-US 双语文案、Turnstile 预留。产品自行决定承载方式:
+ *
+ *   import { mountLoginPanel, openLoginModal } from "@pinnadash/account-sdk/login-ui";
+ *
+ *   // 嵌入页面任意容器(页面式)
+ *   mountLoginPanel("#login-root", account);
+ *
+ *   // 弹窗式
+ *   const modal = openLoginModal(account);
+ *   modal.close();
+ *
+ * 纯 DOM 实现(零依赖),与 SDK 其余部分一样只依赖 Web 标准。
+ * 登录完成的后续(?code= 回调)仍由产品的 handleCallback 页处理。
+ */
+const MESSAGES = {
+    "zh-CN": {
+        title: "登录",
+        subtitle: "输入邮箱，我们会发送一次性登录链接。",
+        emailLabel: "邮箱地址",
+        emailPlaceholder: "name@example.com",
+        submit: "发送登录链接",
+        submitting: "正在发送…",
+        sentTitle: "请查收邮件",
+        sentBody: "登录链接已发送到 {email}，10 分钟内有效，点击邮件中的按钮即可完成登录。",
+        resend: "重新发送",
+        resendIn: "{s} 秒后可重新发送",
+        errorInvalidEmail: "请输入有效的邮箱地址。",
+        errorFailed: "发送失败：{message}",
+        devHint: "开发模式：点击链接完成登录",
+        footer: "登录即表示同意本产品的服务条款与隐私政策。",
+    },
+    "en-US": {
+        title: "Sign in",
+        subtitle: "Enter your email and we will send a one-time sign-in link.",
+        emailLabel: "Email address",
+        emailPlaceholder: "name@example.com",
+        submit: "Send sign-in link",
+        submitting: "Sending…",
+        sentTitle: "Check your inbox",
+        sentBody: "We sent a sign-in link to {email}. It expires in 10 minutes — click the button in the email to finish.",
+        resend: "Resend",
+        resendIn: "Resend available in {s}s",
+        errorInvalidEmail: "Please enter a valid email address.",
+        errorFailed: "Failed to send: {message}",
+        devHint: "Dev mode: open the link to sign in",
+        footer: "By signing in you agree to this product's terms and privacy policy.",
+    },
+};
+function detectLocale(pref) {
+    if (pref === "zh-CN" || pref === "en-US")
+        return pref;
+    const langs = pref ? [pref] : (typeof navigator !== "undefined" ? [...navigator.languages] : []);
+    for (const l of langs) {
+        if (/^zh/i.test(l))
+            return "zh-CN";
+        if (/^en/i.test(l))
+            return "en-US";
+    }
+    return "zh-CN";
+}
+// ---------- styles(scoped,前缀 acx- 防冲突) ----------
+const STYLE_ID = "acx-login-style";
+const CSS = `
+.acx-root { font-family: inherit; color: inherit; }
+.acx-card { max-width: 380px; margin: 0 auto; }
+.acx-title { margin: 0 0 4px; font-size: 20px; font-weight: 700; }
+.acx-subtitle { margin: 0 0 20px; font-size: 14px; opacity: .72; }
+.acx-field { display: grid; gap: 6px; margin-bottom: 14px; }
+.acx-label { font-size: 13px; font-weight: 600; }
+.acx-input { min-height: 42px; padding: 0 12px; font: inherit; border: 1px solid rgba(0,0,0,.18); border-radius: 8px; background: #fff; color: #111; }
+.acx-input:focus { outline: 2px solid #1f5fbf; outline-offset: 1px; }
+.acx-button { min-height: 42px; padding: 0 18px; font: inherit; font-weight: 600; color: #fff; background: #1f5fbf; border: 1px solid #1f5fbf; border-radius: 8px; cursor: pointer; }
+.acx-button:hover { background: #1a51a3; }
+.acx-button:disabled { opacity: .56; cursor: default; }
+.acx-status { margin: 12px 0 0; font-size: 14px; }
+.acx-status.is-error { color: #a3302f; }
+.acx-devlink { margin: 12px 0 0; font-size: 13px; word-break: break-all; }
+.acx-footer { margin: 18px 0 0; font-size: 12px; opacity: .6; }
+.acx-turnstile { margin-bottom: 14px; }
+.acx-overlay { position: fixed; inset: 0; z-index: 9999; display: flex; align-items: center; justify-content: center; background: rgba(10,16,28,.55); padding: 16px; }
+.acx-modal { position: relative; background: #fff; color: #17233b; border-radius: 12px; padding: 28px 24px; box-shadow: 0 12px 40px rgba(0,0,0,.25); }
+.acx-close { position: absolute; top: 10px; right: 10px; width: 32px; height: 32px; border: none; background: transparent; font-size: 18px; line-height: 1; cursor: pointer; color: inherit; border-radius: 6px; }
+.acx-close:hover { background: rgba(0,0,0,.06); }
+`;
+function ensureStyles(doc) {
+    if (doc.getElementById(STYLE_ID))
+        return;
+    const style = doc.createElement("style");
+    style.id = STYLE_ID;
+    style.textContent = CSS;
+    doc.head.appendChild(style);
+}
+function escapeHtml(text) {
+    return text
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+// ---------- Turnstile (预留:传 site key 即启用) ----------
+const TURNSTILE_SCRIPT_ID = "acx-turnstile-script";
+function renderTurnstile(doc, container, siteKey) {
+    return new Promise((resolve) => {
+        const w = doc.defaultView;
+        const finish = () => {
+            if (!w?.turnstile)
+                return resolve(null);
+            try {
+                const widgetId = w.turnstile.render(container, {
+                    sitekey: siteKey,
+                    callback: (token) => resolve(token),
+                });
+                if (!widgetId)
+                    resolve(null);
+            }
+            catch {
+                resolve(null);
+            }
+        };
+        if (w?.turnstile)
+            return finish();
+        if (!doc.getElementById(TURNSTILE_SCRIPT_ID)) {
+            const s = doc.createElement("script");
+            s.id = TURNSTILE_SCRIPT_ID;
+            s.src = "https://challenges.cloudflare.com/turnstile/v0/api.js";
+            s.async = true;
+            s.onload = finish;
+            s.onerror = () => resolve(null);
+            doc.head.appendChild(s);
+        }
+    });
+}
+function buildPanel(root, t) {
+    root.classList.add("acx-root", "acx-card");
+    root.innerHTML = `
+    <h2 class="acx-title">${escapeHtml(t.title)}</h2>
+    <p class="acx-subtitle">${escapeHtml(t.subtitle)}</p>
+    <form class="acx-form" novalidate>
+      <div class="acx-field">
+        <label class="acx-label" for="acx-email">${escapeHtml(t.emailLabel)}</label>
+        <input class="acx-input" id="acx-email" name="email" type="email" autocomplete="email"
+               placeholder="${escapeHtml(t.emailPlaceholder)}" required />
+      </div>
+      <div class="acx-turnstile" hidden></div>
+      <button class="acx-button" type="submit">${escapeHtml(t.submit)}</button>
+    </form>
+    <p class="acx-status" role="status" aria-live="polite"></p>
+    <p class="acx-footer">${escapeHtml(t.footer)}</p>
+  `;
+    const form = root.querySelector(".acx-form");
+    const email = root.querySelector("#acx-email");
+    const submit = root.querySelector(".acx-button");
+    const status = root.querySelector(".acx-status");
+    const turnstileBox = root.querySelector(".acx-turnstile");
+    return { form, email, submit, status, turnstileBox };
+}
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function setStatus(status, text, isError) {
+    status.textContent = text;
+    status.classList.toggle("is-error", isError);
+}
+function wirePanel(doc, els, client, opts, t) {
+    let busy = false;
+    let resendTimer;
+    const onSubmit = async (event) => {
+        event.preventDefault();
+        if (busy)
+            return;
+        const value = els.email.value.trim();
+        if (!EMAIL_RE.test(value)) {
+            setStatus(els.status, t.errorInvalidEmail, true);
+            return;
+        }
+        busy = true;
+        els.submit.disabled = true;
+        setStatus(els.status, t.submitting, false);
+        try {
+            let turnstileToken;
+            if (opts.turnstileSiteKey && !els.turnstileBox.hasChildNodes()) {
+                els.turnstileBox.hidden = false;
+                turnstileToken = (await renderTurnstile(doc, els.turnstileBox, opts.turnstileSiteKey)) ?? undefined;
+            }
+            const result = await client.requestMagicLink(value, turnstileToken);
+            setStatus(els.status, t.sentBody.replace("{email}", value), false);
+            // sent 面板:标题化提示 + 60s 重新发送倒计时(与服务端限频一致)
+            els.submit.disabled = true;
+            let wait = 60;
+            const tick = () => {
+                els.submit.textContent = wait > 0 ? t.resendIn.replace("{s}", String(wait)) : t.resend;
+                if (wait <= 0) {
+                    els.submit.disabled = false;
+                    busy = false;
+                    return;
+                }
+                wait -= 1;
+                resendTimer = doc.defaultView.setTimeout(tick, 1000);
+            };
+            tick();
+            if (result.dev?.verify_url) {
+                const dev = doc.createElement("p");
+                dev.className = "acx-devlink";
+                const a = doc.createElement("a");
+                a.href = result.dev.verify_url;
+                a.textContent = `${t.devHint} →`;
+                dev.appendChild(a);
+                els.status.after(dev);
+            }
+            opts.onLinkSent?.(value);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            setStatus(els.status, t.errorFailed.replace("{message}", message), true);
+            els.submit.disabled = false;
+            busy = false;
+        }
+    };
+    els.form.addEventListener("submit", onSubmit);
+    return () => {
+        els.form.removeEventListener("submit", onSubmit);
+        if (resendTimer !== undefined)
+            doc.defaultView?.clearTimeout(resendTimer);
+    };
+}
+/** 把登录面板挂载到容器(selector 或元素)。页面式与弹窗式共用。 */
+export function mountLoginPanel(container, client, opts = {}) {
+    const doc = container instanceof HTMLElement ? container.ownerDocument : globalThis.document;
+    const root = typeof container === "string"
+        ? doc.querySelector(container)
+        : container;
+    if (!root)
+        throw new Error("mountLoginPanel: container not found");
+    ensureStyles(doc);
+    const locale = detectLocale(opts.locale);
+    const t = MESSAGES[locale];
+    const els = buildPanel(root, t);
+    const unwire = wirePanel(doc, els, client, opts, t);
+    return {
+        destroy() {
+            unwire();
+            root.innerHTML = "";
+            root.classList.remove("acx-root", "acx-card");
+        },
+    };
+}
+/** 弹窗式登录:创建全屏遮罩 + 面板;返回 close() 与 destroy()。 */
+export function openLoginModal(client, opts = {}) {
+    const doc = globalThis.document;
+    ensureStyles(doc);
+    const overlay = doc.createElement("div");
+    overlay.className = "acx-overlay";
+    const modal = doc.createElement("div");
+    modal.className = "acx-modal";
+    const closeBtn = doc.createElement("button");
+    closeBtn.className = "acx-close";
+    closeBtn.type = "button";
+    closeBtn.setAttribute("aria-label", "Close");
+    closeBtn.textContent = "×";
+    const panel = doc.createElement("div");
+    modal.append(closeBtn, panel);
+    overlay.appendChild(modal);
+    doc.body.appendChild(overlay);
+    const handle = mountLoginPanel(panel, client, opts);
+    const close = () => {
+        handle.destroy();
+        overlay.remove();
+    };
+    closeBtn.addEventListener("click", close);
+    overlay.addEventListener("click", (e) => {
+        if (e.target === overlay)
+            close();
+    });
+    return { close, destroy: close };
+}
+//# sourceMappingURL=login-ui.js.map

package/dist/login-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-ui.js","sourceRoot":"","sources":["../src/login-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE;QACP,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,oBAAoB;QAC9B,UAAU,EAAE,MAAM;QAClB,gBAAgB,EAAE,kBAAkB;QACpC,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,2CAA2C;QACrD,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,aAAa;QACvB,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE,eAAe;QACxB,MAAM,EAAE,uBAAuB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,4DAA4D;QACtE,UAAU,EAAE,eAAe;QAC3B,gBAAgB,EAAE,kBAAkB;QACpC,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,wGAAwG;QAClH,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,0BAA0B;QACpC,iBAAiB,EAAE,qCAAqC;QACxD,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,oCAAoC;QAC7C,MAAM,EAAE,qEAAqE;KAC9E;CACO,CAAC;AAIX,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD,mDAAmD;AAEnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBX,CAAC;AAEF,SAAS,YAAY,CAAC,GAAa;IACjC,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC;IACpB,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;IACxB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,sDAAsD;AAEtD,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEnD,SAAS,eAAe,CACtB,GAAa,EACb,SAAsB,EACtB,OAAe;IAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,WAEL,CAAC;QACV,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,CAAC,CAAC,EAAE,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC7C,OAAO,EAAE,OAAO;oBAChB,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;iBAC5C,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,EAAE,SAAS;YAAE,OAAO,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,GAAG,mBAAmB,CAAC;YAC3B,CAAC,CAAC,GAAG,GAAG,uDAAuD,CAAC;YAChE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;YACf,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;YAClB,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,SAAS,UAAU,CAAC,IAAiB,EAAE,CAA6B;IAClE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG;4BACS,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;8BACjB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;;;mDAGD,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;;8BAE7C,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;;;iDAGX,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;4BAGzC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;GAC7C,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAkB,WAAW,CAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAmB,YAAY,CAAE,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAoB,aAAa,CAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAc,aAAa,CAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAc,gBAAgB,CAAE,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,SAAS,SAAS,CAAC,MAAmB,EAAE,IAAY,EAAE,OAAgB;IACpE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAChB,GAAa,EACb,GAAkB,EAClB,MAAqB,EACrB,IAAuB,EACvB,CAA6B;IAE7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAA+B,CAAC;IAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAY,EAAE,EAAE;QACtC,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,IAAI,IAAI;YAAE,OAAO;QACjB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,IAAI,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC3B,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,IAAI,cAAkC,CAAC;YACvC,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC/D,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC;gBAChC,cAAc,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,SAAS,CAAC;YACtG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACpE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACnE,wCAAwC;YACxC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvF,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBACd,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;oBAC5B,IAAI,GAAG,KAAK,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,CAAC;gBACV,WAAW,GAAG,GAAG,CAAC,WAAY,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC,CAAC;YACF,IAAI,EAAE,CAAC;YACP,IAAI,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnC,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC;gBAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACjC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC/B,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC;gBACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9C,OAAO,GAAG,EAAE;QACV,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,WAAW,KAAK,SAAS;YAAE,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,eAAe,CAC7B,SAA+B,EAC/B,MAAqB,EACrB,IAAI,GAAsB,EAAE;IAE5B,MAAM,GAAG,GAAG,SAAS,YAAY,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAE,UAAgD,CAAC,QAAQ,CAAC;IACpI,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAE,GAAG,CAAC,aAAa,CAAC,SAAS,CAAwB;QACtD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAEnE,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,OAAO;YACL,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,IAAI,GAAsB,EAAE;IAE5B,MAAM,GAAG,GAAI,UAAgD,CAAC,QAAQ,CAAC;IACvE,YAAY,CAAC,GAAG,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,CAAC,SAAS,GAAG,WAAW,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,SAAS,GAAG,WAAW,CAAC;IACjC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,KAAK,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC"}

package/dist/paywall.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Freemium paywall helper (design.md §7.2 reference implementation).
+ *
+ * Products define their own free/pro boundary; this module only translates
+ * entitlements into a gate decision and an upgrade action. Keep product-specific
+ * limits in the product, not here.
+ *
+ * Usage (web):
+ *   import { createPaywall } from "@pinnadash/account-sdk/paywall";
+ *   const paywall = createPaywall({ account, freeLimit: 10 });
+ *   const decision = await paywall.checkBatch(imageCount);
+ *   if (!decision.allowed) showUpgradeDialog(decision.reason);
+ */
+import type { AccountClient, Entitlements } from "./index.js";
+export interface PaywallOptions {
+    account: AccountClient;
+    /** Free tier batch limit (design.md suggestion: 10). Product may override. */
+    freeLimit?: number;
+    /** Called when the user should see the upgrade UI. */
+    onUpgradePrompt?: (reason: UpgradeReason) => void;
+}
+export type UpgradeReason = "batch_limit" | "pro_feature";
+export interface GateDecision {
+    allowed: boolean;
+    reason?: UpgradeReason;
+    /** What the user sees, e.g. "Free plan allows 10 images per batch". */
+    message: string;
+}
+export declare function createPaywall(opts: PaywallOptions): {
+    /** Sync entitlements into the paywall (call after login / on app start). */
+    sync(force?: boolean): Promise<Entitlements>;
+    isMember(): boolean;
+    /** Batch-size gate (design.md §7.2: free ≤ 10 images/batch). */
+    checkBatch(count: number): Promise<GateDecision>;
+    /** Feature gate (batch rename templates, watermark presets, etc.). */
+    checkFeature(featureName: string): GateDecision;
+    /** Deep link to the Account Center pricing page. */
+    upgradeUrl(): string;
+};
+//# sourceMappingURL=paywall.d.ts.map

package/dist/paywall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paywall.d.ts","sourceRoot":"","sources":["../src/paywall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;CACnD;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc;IAK9C,4EAA4E;IACtE,IAAI,mBAAiB,OAAO,CAAC,YAAY,CAAC;IAKhD,QAAQ,IAAI,OAAO;IAInB,gEAAgE;IAC1D,UAAU,QAAQ,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAetD,sEAAsE;IACtE,YAAY,cAAc,MAAM,GAAG,YAAY;IAa/C,oDAAoD;IACpD,UAAU,IAAI,MAAM;EAWvB"}

package/dist/paywall.js

@@ -0,0 +1,66 @@
+/**
+ * Freemium paywall helper (design.md §7.2 reference implementation).
+ *
+ * Products define their own free/pro boundary; this module only translates
+ * entitlements into a gate decision and an upgrade action. Keep product-specific
+ * limits in the product, not here.
+ *
+ * Usage (web):
+ *   import { createPaywall } from "@pinnadash/account-sdk/paywall";
+ *   const paywall = createPaywall({ account, freeLimit: 10 });
+ *   const decision = await paywall.checkBatch(imageCount);
+ *   if (!decision.allowed) showUpgradeDialog(decision.reason);
+ */
+export function createPaywall(opts) {
+    const freeLimit = opts.freeLimit ?? 10;
+    let cached = null;
+    return {
+        /** Sync entitlements into the paywall (call after login / on app start). */
+        async sync(force = false) {
+            cached = await opts.account.getEntitlements(force);
+            return cached;
+        },
+        isMember() {
+            return cached?.member ?? false;
+        },
+        /** Batch-size gate (design.md §7.2: free ≤ 10 images/batch). */
+        async checkBatch(count) {
+            const ent = cached ?? (await this.sync());
+            if (ent.member)
+                return { allowed: true, message: "Member: unlimited batch processing." };
+            if (count <= freeLimit) {
+                return { allowed: true, message: `Free plan: ${count}/${freeLimit} images.` };
+            }
+            const decision = {
+                allowed: false,
+                reason: "batch_limit",
+                message: `Free plan allows ${freeLimit} images per batch. Upgrade to Pro for unlimited batches.`,
+            };
+            opts.onUpgradePrompt?.(decision.reason);
+            return decision;
+        },
+        /** Feature gate (batch rename templates, watermark presets, etc.). */
+        checkFeature(featureName) {
+            if (this.isMember()) {
+                return { allowed: true, message: `${featureName} available.` };
+            }
+            const decision = {
+                allowed: false,
+                reason: "pro_feature",
+                message: `${featureName} is a Pro feature. Upgrade to unlock it.`,
+            };
+            opts.onUpgradePrompt?.("pro_feature");
+            return decision;
+        },
+        /** Deep link to the Account Center pricing page. */
+        upgradeUrl() {
+            const inner = opts.account;
+            const centerUrl = inner.opts?.centerUrl;
+            // 订阅归因(design.md §4.1):带上本产品 client_id,定价页转进 checkout customData
+            const slug = inner.opts?.productSlug;
+            const suffix = slug ? `?client_id=${encodeURIComponent(slug)}` : "";
+            return `${centerUrl ?? ""}/pricing/${suffix}`;
+        },
+    };
+}
+//# sourceMappingURL=paywall.js.map

package/dist/paywall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paywall.js","sourceRoot":"","sources":["../src/paywall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqBH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,OAAO;QACL,4EAA4E;QAC5E,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK;YACtB,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,QAAQ;YACN,OAAO,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC;QACjC,CAAC;QAED,gEAAgE;QAChE,KAAK,CAAC,UAAU,CAAC,KAAa;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;YACzF,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,SAAS,UAAU,EAAE,CAAC;YAChF,CAAC;YACD,MAAM,QAAQ,GAAiB;gBAC7B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,oBAAoB,SAAS,0DAA0D;aACjG,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,CAAC;YACzC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,sEAAsE;QACtE,YAAY,CAAC,WAAmB;YAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,aAAa,EAAE,CAAC;YACjE,CAAC;YACD,MAAM,QAAQ,GAAiB;gBAC7B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,GAAG,WAAW,0CAA0C;aAClE,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,oDAAoD;QACpD,UAAU;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,OAElB,CAAC;YACF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;YACxC,iEAAiE;YACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,SAAS,IAAI,EAAE,YAAY,MAAM,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@pinnadash/account-sdk",
+  "version": "0.1.0",
+  "description": "Pinnadash account system client SDK: PKCE login, deep-link callback, token refresh, offline grace, entitlements, paywall. Zero dependencies, Web Crypto + fetch, browser / Workers / Tauri webview.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./desktop": {
+      "types": "./dist/desktop.d.ts",
+      "default": "./dist/desktop.js"
+    },
+    "./paywall": {
+      "types": "./dist/paywall.d.ts",
+      "default": "./dist/paywall.js"
+    },
+    "./login-ui": {
+      "types": "./dist/login-ui.d.ts",
+      "default": "./dist/login-ui.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "INTEGRATION.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build && npm test",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "keywords": [
+    "pinnadash",
+    "account",
+    "pkce",
+    "entitlements",
+    "subscription"
+  ],
+  "license": "GPL-3.0",
+  "devDependencies": {
+    "jsdom": "^27.0.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.0"
+  }
+}