@plantops/web-kit 0.1.0

package/README.md

@@ -0,0 +1,88 @@
+# @plantops/web-kit
+
+The React runtime a PlantOps console needs to talk to the IAM — the stateful
+counterpart to [`@plantops/ui`](../ui).
+
+Where that library renders, this one *knows things*: which client to call, where
+the tokens live, who is signed in, what they may do, and what their menu is.
+Between them they are everything a new console needs that is not its own
+screens — which is the point, because gatepass and visitor management are next
+(Doc 00 §9) and neither should reimplement sign-in.
+
+## The whole of a console's setup
+
+```tsx
+'use client';
+import { PlantOpsProvider } from '@plantops/web-kit';
+
+export function Providers({ children }) {
+  return (
+    <PlantOpsProvider baseUrl={process.env.NEXT_PUBLIC_IAM_API_URL ?? '/api'}>
+      {children}
+    </PlantOpsProvider>
+  );
+}
+```
+
+The fallback is a *path*, not an origin. `/api` resolves against whatever origin
+served the page, so one build of a console runs at any hostname with nothing
+customer-specific inlined into its bundle (Doc 11 §3); the environment variable
+is for the case where the console and the API are genuinely on different origins
+— local development, or a console hosted separately from its API. Either way the
+transport composes `baseUrl + path`, and nothing below the provider can tell
+which form it was given.
+
+`PlantOpsProvider` nests theme → antd's feedback hooks → IAM client → session →
+grants, in the order they depend on each other. That ordering is the part that is
+easy to get wrong and impossible to notice: mount the grants provider above the
+client and every permission answers `false` with no error anywhere.
+
+## What it gives you
+
+| Hook / component | For |
+|---|---|
+| `useAuth()` | `status`, `subject`, `login`, `logout`, `endedReason`, `lastClientSlug` |
+| `useIam()` | The typed `IamClient`, for anything the hooks do not cover |
+| `useGrants()` | The resolved `ResolvedGrants`, fetched once per session |
+| `usePermission(key)` / `usePermissions()` / `<Permitted>` | Permission-aware controls (Doc 09 §4) |
+| `useNavigation()` | The pruned menu from `GET /iam/navigation` (Doc 05) |
+| `useAsync(fn, deps)` | One endpoint, a skeleton, an error, a retry — without the race |
+| `useNotices()` | Themed toasts, including the Doc 09 §4 "access updates may take a few seconds" notice |
+| `<RequireAuth>` | The gate in front of authenticated screens |
+| `describeError(e)` | Any thrown value → code, copy, request id, field details |
+| `BrowserTokenStore` | `localStorage` + cross-tab session sync |
+| `pathCovers` / `holdsPermissionAt` | The `ltree` coverage test, client-side |
+
+## What it deliberately does not do
+
+- **No router.** Redirects are callbacks. A `next/navigation` import would pin
+  every future console to one framework and make the components untestable
+  without it. `RequireAuth` takes `onUnauthenticated`; the app decides where the
+  login screen is and how a deep link survives sign-in.
+- **No authorisation.** `usePermission` hides controls the subject cannot use;
+  the server decides (Doc 09 §4). `claims.ts` reads the access token *unverified*
+  and says so at length — those values may be rendered and must never be used to
+  decide.
+- **No data-fetching framework.** `useAsync` is forty lines and covers what an
+  admin console does. The two genuinely shared reads — grants and navigation —
+  are fetched once by their own providers.
+
+## Session handling, in one paragraph
+
+Tokens live in `localStorage` (`BrowserTokenStore`; the reasoning, including the
+XSS trade-off against a cross-origin cookie, is in that file's header).
+`IamClient` renews an access token before it lapses and retries a `401` after a
+*single* shared refresh; `IamProvider` adds a keepalive so a console left open on
+a dashboard renews silently rather than failing on the next click. A session ends
+in exactly one way — a `null` write to the token store — whether the user signed
+out, a refresh was refused (Doc 03 §4.1), or another tab did either.
+
+## Tests
+
+```sh
+npx nx test @plantops/web-kit
+```
+
+`iam-provider.spec.tsx` drives the real provider, the real `IamClient` and the
+real token store, replacing only the socket: sign in, reload, sign out, another
+tab, and a refused refresh.

package/dist/claims.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Reading the access token's claims in the browser — for display, never for a
+ * decision.
+ *
+ * ## Why this is safe, and where the line is
+ *
+ * A JWT's payload is base64url, not encryption: anyone holding the token can
+ * read it, and doing so tells the console the subject id, the tenant, the
+ * session id and the expiry (Doc 03 §2). That is exactly what the header and
+ * the session-expiry indicator need, and fetching it from `POST /iam/introspect`
+ * instead would be a network round trip to learn something already in hand.
+ *
+ * The line is that **nothing here is verified**. The signature is not checked —
+ * this library has no JWKS and no business having one. So these values may be
+ * used to render, and must never be used to decide. Concretely: the console
+ * does not read `cid` and conclude the user is a platform admin, and does not
+ * read any claim to decide whether to allow an action. Authorisation comes from
+ * `/iam/permissions/resolve` (Doc 04) and, in the end, from the server refusing
+ * (Doc 09 §4 — "client-side hiding is UX, not security"). Doc 03 §2 removes the
+ * temptation at the source by keeping permissions, roles and scopes *out* of
+ * the token entirely.
+ */
+import type { JwtClaims } from '@plantops/contracts';
+/** The claims, as read from an unverified token. Display only. */
+export type UnverifiedClaims = JwtClaims;
+/**
+ * The claims of an access token, or `null` if it is not a readable JWT.
+ *
+ * Every failure — wrong segment count, unparseable JSON, missing claims —
+ * answers `null` rather than throwing. A malformed token means "not signed in",
+ * which the caller already has to handle; an exception at render time would
+ * mean a blank console.
+ */
+export declare function readTokenClaims(accessToken: string | null): UnverifiedClaims | null;
+//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAmCzC;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAmCnF"}

package/dist/claims.js

@@ -0,0 +1,76 @@
+'use client';
+/**
+ * Bytes → text, without assuming `TextDecoder` exists.
+ *
+ * It does in every browser, and it does *not* in a jsdom test environment,
+ * where jest does not expose Node's copy as a global. Percent-decoding is the
+ * fallback because it needs nothing but the language: `decodeURIComponent`
+ * performs the UTF-8 decode itself.
+ */
+function bytesToUtf8(bytes) {
+    if (typeof TextDecoder === 'function')
+        return new TextDecoder().decode(bytes);
+    let percentEncoded = '';
+    for (const byte of bytes)
+        percentEncoded += `%${byte.toString(16).padStart(2, '0')}`;
+    return decodeURIComponent(percentEncoded);
+}
+function decodeBase64Url(segment) {
+    const padded = segment.replace(/-/g, '+').replace(/_/g, '/');
+    try {
+        if (typeof globalThis.atob === 'function') {
+            // `atob` yields one char per byte; the payload is UTF-8, so it is decoded
+            // rather than used directly — a name or a label outside Latin-1 would
+            // otherwise come back mangled.
+            const binary = globalThis.atob(padded);
+            return bytesToUtf8(Uint8Array.from(binary, (char) => char.charCodeAt(0)));
+        }
+        // Server rendering, where `atob` may be absent.
+        return Buffer.from(padded, 'base64').toString('utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The claims of an access token, or `null` if it is not a readable JWT.
+ *
+ * Every failure — wrong segment count, unparseable JSON, missing claims —
+ * answers `null` rather than throwing. A malformed token means "not signed in",
+ * which the caller already has to handle; an exception at render time would
+ * mean a blank console.
+ */
+export function readTokenClaims(accessToken) {
+    if (accessToken === null)
+        return null;
+    const segments = accessToken.split('.');
+    if (segments.length !== 3)
+        return null;
+    const json = decodeBase64Url(segments[1] ?? '');
+    if (json === null)
+        return null;
+    try {
+        const parsed = JSON.parse(json);
+        if (typeof parsed !== 'object' || parsed === null)
+            return null;
+        const claims = parsed;
+        if (typeof claims.sub !== 'string' ||
+            typeof claims.cid !== 'string' ||
+            typeof claims.sid !== 'string' ||
+            (claims.sty !== 'user' && claims.sty !== 'service')) {
+            return null;
+        }
+        return {
+            iss: typeof claims.iss === 'string' ? claims.iss : '',
+            sub: claims.sub,
+            sty: claims.sty,
+            cid: claims.cid,
+            sid: claims.sid,
+            iat: typeof claims.iat === 'number' ? claims.iat : 0,
+            exp: typeof claims.exp === 'number' ? claims.exp : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Turning whatever `catch` produced into something a screen can render.
+ *
+ * `@plantops/iam-client` throws two classes — `IamApiError` for a refusal the
+ * IAM made, `IamTransportError` for a request that never got an answer — and a
+ * screen may also be handed a `TypeError` from its own code. All three arrive
+ * at the same `catch`, and every screen would otherwise grow the same
+ * `instanceof` ladder.
+ *
+ * The result pairs the machine-readable facts (code, status, request id) with
+ * the human-readable copy from `@plantops/ui`, so the caller renders a
+ * `<ScreenError>` without knowing which of the three it caught.
+ */
+import type { IamErrorCode } from '@plantops/contracts';
+import { type ErrorCopy } from '@plantops/ui';
+export interface DescribedError {
+    /** The Doc 06 §2 code, or `null` when nothing answered. */
+    code: IamErrorCode | null;
+    status: number | null;
+    /** Words for a person. */
+    copy: ErrorCopy;
+    /** The server's own message, when it says more than the copy does. */
+    detail: string | null;
+    /** Correlates with server logs and the audit trail. */
+    requestId: string | null;
+    /** Field-level complaints; only a `VALIDATION_FAILED` carries them. */
+    details: readonly {
+        field: string;
+        message: string;
+    }[];
+}
+/** Normalises any thrown value into {@link DescribedError}. */
+export declare function describeError(error: unknown): DescribedError;
+/**
+ * True when the failure means "you may not", rather than "that went wrong".
+ *
+ * The distinction a screen acts on: a denial is a final answer that deserves an
+ * explanation panel, where a transient failure deserves a retry button. Both
+ * 403 codes count — `PERMISSION_DENIED` (no such permission) and `SCOPE_DENIED`
+ * (the permission, but not here) — because to the person looking at the screen
+ * they are the same wall, differing only in what they should ask for.
+ */
+export declare function isAccessDenial(error: unknown): boolean;
+/** True when the session is gone and the console should return to the login page. */
+export declare function isAuthenticationFailure(error: unknown): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAElF,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0BAA0B;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uDAAuD;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxD;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAiC5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D"}

package/dist/errors.js

@@ -0,0 +1,52 @@
+'use client';
+import { IamApiError, IamClientError } from '@plantops/iam-client';
+import { errorCopyFor, TRANSPORT_ERROR_COPY } from '@plantops/ui';
+/** Normalises any thrown value into {@link DescribedError}. */
+export function describeError(error) {
+    if (error instanceof IamApiError) {
+        return {
+            code: error.code,
+            status: error.status,
+            copy: errorCopyFor(error.code),
+            detail: error.message,
+            requestId: error.requestId,
+            details: error.details,
+        };
+    }
+    if (error instanceof IamClientError) {
+        // A transport failure: DNS, TLS, a cut connection, a timeout, or a body
+        // that would not parse. Nothing was decided about the request.
+        return {
+            code: null,
+            status: null,
+            copy: TRANSPORT_ERROR_COPY,
+            detail: error.message,
+            requestId: null,
+            details: [],
+        };
+    }
+    return {
+        code: null,
+        status: null,
+        copy: TRANSPORT_ERROR_COPY,
+        detail: error instanceof Error ? error.message : null,
+        requestId: null,
+        details: [],
+    };
+}
+/**
+ * True when the failure means "you may not", rather than "that went wrong".
+ *
+ * The distinction a screen acts on: a denial is a final answer that deserves an
+ * explanation panel, where a transient failure deserves a retry button. Both
+ * 403 codes count — `PERMISSION_DENIED` (no such permission) and `SCOPE_DENIED`
+ * (the permission, but not here) — because to the person looking at the screen
+ * they are the same wall, differing only in what they should ask for.
+ */
+export function isAccessDenial(error) {
+    return error instanceof IamApiError && error.status === 403;
+}
+/** True when the session is gone and the console should return to the login page. */
+export function isAuthenticationFailure(error) {
+    return error instanceof IamApiError && error.status === 401;
+}

package/dist/grants-provider.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The signed-in subject's resolved grants, fetched once per session.
+ *
+ * `GET /iam/permissions/resolve` answers WHO × WHAT × WHERE for the bearer
+ * (Doc 04 §4) and is not paginated — it is one cacheable unit. A console needs
+ * it constantly: every permission-aware button consults it (Doc 09 §4). Fetched
+ * per component that asks, a screen with a dozen guarded controls would issue a
+ * dozen identical requests; fetched once here, it issues one.
+ *
+ * `IamClient.grants()` already caches with a short TTL, so this provider is
+ * mostly about *React* — giving every consumer the same object identity, and a
+ * single place to invalidate from.
+ *
+ * ## Staleness is expected, and is the server's business
+ *
+ * Doc 04 §7 says grant changes invalidate the server's cache immediately, and
+ * Doc 09 §4 asks the console to tell an admin that "access updates may take a
+ * few seconds" after a role or binding change. So this provider does not try to
+ * be clever: it holds what it fetched, exposes {@link GrantsContextValue.reload}
+ * for the screen that just changed something, and re-fetches when the identity
+ * changes. Anything it shows that is out of date is corrected by the server the
+ * moment the user actually tries the action.
+ */
+import type { ResolvedGrants } from '@plantops/contracts';
+import * as React from 'react';
+export interface GrantsContextValue {
+    /** `undefined` until the first resolve lands. */
+    grants: ResolvedGrants | undefined;
+    loading: boolean;
+    error: unknown;
+    /** Re-resolves, bypassing the client's cache. */
+    reload: () => void;
+}
+export declare function useGrants(): GrantsContextValue;
+export interface GrantsProviderProps {
+    children: React.ReactNode;
+    /**
+     * Narrows the resolve to one application's slice (Doc 06 §11).
+     *
+     * The admin console leaves it unset — it spans the IAM's whole permission
+     * namespace. A single-application console (gatepass, visitor) sets it, and
+     * gets a smaller answer that changes less often.
+     */
+    applicationId?: string;
+}
+/**
+ * Supplies {@link useGrants}. Mounted by `IamProvider`; a console does not
+ * normally render it directly.
+ */
+export declare function GrantsProvider({ children, applicationId, }: GrantsProviderProps): React.ReactElement;
+//# sourceMappingURL=grants-provider.d.ts.map

package/dist/grants-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-provider.d.ts","sourceRoot":"","sources":["../src/grants-provider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAID,wBAAgB,SAAS,IAAI,kBAAkB,CAM9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,aAAa,GACd,EAAE,mBAAmB,GAAG,KAAK,CAAC,YAAY,CAsC1C"}

package/dist/grants-provider.js

@@ -0,0 +1,46 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import * as React from 'react';
+import { useAuth, useIam } from './iam-provider';
+import { useAsync } from './use-async';
+const GrantsContext = React.createContext(null);
+export function useGrants() {
+    const value = React.useContext(GrantsContext);
+    if (value === null) {
+        throw new Error('useGrants() requires an <IamProvider> above it in the tree.');
+    }
+    return value;
+}
+/**
+ * Supplies {@link useGrants}. Mounted by `IamProvider`; a console does not
+ * normally render it directly.
+ */
+export function GrantsProvider({ children, applicationId, }) {
+    const client = useIam();
+    const { status, subject } = useAuth();
+    const state = useAsync(() => client.grants(applicationId === undefined ? {} : { applicationId }), 
+    // Keyed on the subject, not merely on "authenticated": signing out and
+    // straight back in as someone else must re-resolve. `IamClient` empties its
+    // own cache on any identity change for the same reason.
+    [client, subject?.id, subject?.sessionId, applicationId], { enabled: status === 'authenticated' });
+    // `state.reload` rather than `state`: the state object is new on every render,
+    // and depending on it would give every consumer of this context a new value
+    // each time — which for a context read by every permission-aware control in
+    // the console is a re-render of the whole screen per keystroke elsewhere.
+    const stateReload = state.reload;
+    const reload = React.useCallback(() => {
+        client.invalidateGrants(applicationId);
+        stateReload();
+    }, [client, applicationId, stateReload]);
+    const value = React.useMemo(() => ({
+        grants: status === 'authenticated' ? state.data : undefined,
+        // `initializing` counts as loading. The resolve has not been *asked for*
+        // yet at that point, so `useAsync` honestly reports `loading: false` —
+        // but a screen reading this to decide between a skeleton and "you have no
+        // access" would take that as an answer, and give the wrong one.
+        loading: state.loading || status === 'initializing',
+        error: state.error,
+        reload,
+    }), [status, state.data, state.loading, state.error, reload]);
+    return _jsx(GrantsContext.Provider, { value: value, children: children });
+}

package/dist/iam-provider.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The one provider a PlantOps console mounts to become an IAM client.
+ *
+ * It owns the `IamClient`, the browser token store, and the answer to "is
+ * someone signed in". Everything else in this library — grants, permissions,
+ * navigation — reads from it.
+ *
+ * ## Why the client and the session state live in one component
+ *
+ * They are one thing wearing two hats. `IamClient` already performs the token
+ * lifecycle: it renews an access token before it lapses, it retries a `401`
+ * after a single shared refresh, and it drops the pair when a refresh is
+ * refused (`libs/iam-client/src/auth.ts`). React needs to *know* when that
+ * happens, and splitting the client into one provider and the session state
+ * into another means wiring a callback from the first into the second and
+ * hoping neither remounts. Instead the store is observable, both providers'
+ * jobs happen here, and the two can never disagree.
+ *
+ * ## Three ways a session ends, all handled the same way
+ *
+ * The user signs out; a refresh is refused because the token was revoked,
+ * expired or replayed (Doc 03 §4.1); or another tab does either. All three end
+ * as a `null` write to the token store, and the store's subscription is what
+ * flips this provider to `unauthenticated` — so the console reacts identically
+ * whether the reason was local, remote or in a different tab.
+ *
+ * ## Silent refresh
+ *
+ * `IamClient` renews on demand: the renewal happens when a request asks for a
+ * token. A console that has been sitting on a dashboard for twenty minutes
+ * makes no requests, so its access token lapses and the *next* click pays for a
+ * refresh — or fails, if the refresh token has expired meanwhile. The keepalive
+ * below asks for the token on a timer and when the tab regains focus, which
+ * turns that into a renewal nobody sees. It is not a second refresh mechanism:
+ * it calls the same single-flight `accessToken()` every request calls.
+ */
+import { IamClient, type FetchLike, type LoginInput, type SessionEndReason } from '@plantops/iam-client';
+import * as React from 'react';
+export type AuthStatus = 'initializing' | 'authenticated' | 'unauthenticated';
+/** Who is signed in, as far as the browser can tell. Display only — see `claims.ts`. */
+export interface AuthSubject {
+    /** `sub` — the user or service-account id. */
+    id: string;
+    /** `sty` — human or machine. */
+    type: 'user' | 'service';
+    /** `cid` — the tenant. */
+    clientId: string;
+    /** `sid` — the session, which is what `POST /auth/sessions/:id/revoke` kills. */
+    sessionId: string;
+    /** Epoch milliseconds the access token lapses at. */
+    expiresAt: number;
+    /** What the person typed at the login screen, kept so the header can say it. */
+    email: string | null;
+    clientSlug: string | null;
+}
+export interface AuthContextValue {
+    status: AuthStatus;
+    subject: AuthSubject | null;
+    /** Why the last session ended — `'refresh_failed'` is worth telling the user. */
+    endedReason: SessionEndReason | null;
+    login: (input: LoginInput) => Promise<void>;
+    logout: () => Promise<void>;
+    /**
+     * The tenant of the last successful sign-in, for pre-filling the login form.
+     *
+     * Survives sign-out on purpose: the client slug is not a secret, and asking
+     * someone to retype their organisation's name every morning is the kind of
+     * friction that gets a console described as annoying.
+     */
+    lastClientSlug: string | null;
+}
+/** The typed IAM client. Throws outside an {@link IamProvider}. */
+export declare function useIam(): IamClient;
+/** Session state and the sign-in/sign-out actions. */
+export declare function useAuth(): AuthContextValue;
+export interface IamProviderProps {
+    /** The API origin, without the `/iam` or `/auth` prefix. */
+    baseUrl: string;
+    children: React.ReactNode;
+    /** `localStorage` slot for the token pair. */
+    storageKey?: string;
+    /** Remembers the tenant across sign-outs, for the login form. */
+    clientSlugStorageKey?: string;
+    /** Abort a request that has taken this long. */
+    timeoutMs?: number;
+    /**
+     * Overrides the runtime's `fetch` — for a test, or for instrumentation.
+     *
+     * The escape hatch that keeps this provider testable without a network: a
+     * spec supplies a function and asserts on what the console actually sent.
+     */
+    fetch?: FetchLike;
+}
+export declare function IamProvider({ baseUrl, children, storageKey, clientSlugStorageKey, timeoutMs, fetch, }: IamProviderProps): React.ReactElement;
+//# sourceMappingURL=iam-provider.d.ts.map

package/dist/iam-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-provider.d.ts","sourceRoot":"","sources":["../src/iam-provider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,SAAS,EACT,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAa/B,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAE9E,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAKD,mEAAmE;AACnE,wBAAgB,MAAM,IAAI,SAAS,CAMlC;AAED,sDAAsD;AACtD,wBAAgB,OAAO,IAAI,gBAAgB,CAM1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAsCD,wBAAgB,WAAW,CAAC,EAC1B,OAAO,EACP,QAAQ,EACR,UAA8B,EAC9B,oBAA8C,EAC9C,SAAS,EACT,KAAK,GACN,EAAE,gBAAgB,GAAG,KAAK,CAAC,YAAY,CAkHvC"}