@polyester/sdk 0.0.0

package/dist/utils/cookie-es/cookie/serialize.js

@@ -0,0 +1,145 @@
+import { COOKIE_MAX_AGE_LIMIT } from "../_utils.js";
+//#region src/utils/cookie-es/cookie/serialize.ts
+/**
+* RegExp to match cookie-name in RFC 6265bis sec 4.1.1
+* This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+* which has been replaced by the token definition in RFC 7230 appendix B.
+*
+* cookie-name       = token
+* token             = 1*tchar
+* tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+*                     "*" / "+" / "-" / "." / "^" / "_" /
+*                     "`" / "|" / "~" / DIGIT / ALPHA
+*
+* Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+* Allow same range as cookie value, except `=`, which delimits end of name.
+*/
+const cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+/**
+* RegExp to match cookie-value in RFC 6265bis sec 4.1.1
+*
+* cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+* cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+*                     ; US-ASCII characters excluding CTLs,
+*                     ; whitespace DQUOTE, comma, semicolon,
+*                     ; and backslash
+*
+* Allowing more characters: https://github.com/jshttp/cookie/issues/191
+* Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+*/
+const cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+/**
+* RegExp to match domain-value in RFC 6265bis sec 4.1.1
+*
+* domain-value      = <subdomain>
+*                     ; defined in [RFC1034], Section 3.5, as
+*                     ; enhanced by [RFC1123], Section 2.1
+* <subdomain>       = <label> | <subdomain> "." <label>
+* <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+*                     Labels must be 63 characters or less.
+*                     'let-dig' not 'letter' in the first char, per RFC1123
+* <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+* <let-dig-hyp>     = <let-dig> | "-"
+* <let-dig>         = <letter> | <digit>
+* <letter>          = any one of the 52 alphabetic characters A through Z in
+*                     upper case and a through z in lower case
+* <digit>           = any one of the ten digits 0 through 9
+*
+* Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+*
+* > (Note that a leading %x2E ("."), if present, is ignored even though that
+* character is not permitted, but a trailing %x2E ("."), if present, will
+* cause the user agent to ignore the attribute.)
+*/
+const domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/**
+* RegExp to match path-value in RFC 6265bis sec 4.1.1
+*
+* path-value        = <any CHAR except CTLs or ";">
+* CHAR              = %x01-7F
+*                     ; defined in RFC 5234 appendix B.1
+*/
+const pathValueRegExp = /^[\u0020-\u003A\u003C-\u007E]*$/;
+const __toString = Object.prototype.toString;
+function serialize(_a0, _a1, _a2) {
+	const isObj = typeof _a0 === "object" && _a0 !== null;
+	const options = isObj ? _a1 : _a2;
+	const stringify = options?.stringify || JSON.stringify;
+	const cookie = isObj ? _a0 : {
+		..._a2,
+		name: _a0,
+		value: _a1 == void 0 ? "" : typeof _a1 === "string" ? _a1 : stringify(_a1)
+	};
+	const enc = options?.encode || encodeURIComponent;
+	if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
+	const value = cookie.value ? enc(cookie.value) : "";
+	if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
+	if (!cookie.secure) {
+		if (cookie.partitioned) throw new TypeError(`Partitioned cookies must have the Secure attribute`);
+		if (cookie.sameSite && String(cookie.sameSite).toLowerCase() === "none") throw new TypeError(`SameSite=None cookies must have the Secure attribute`);
+		if (cookie.name.length > 9 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95) {
+			const nameLower = cookie.name.toLowerCase();
+			if (nameLower.startsWith("__secure-") || nameLower.startsWith("__host-")) throw new TypeError(`${cookie.name} cookies must have the Secure attribute`);
+		}
+	}
+	if (cookie.name.length > 7 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95 && cookie.name.toLowerCase().startsWith("__host-")) {
+		if (cookie.path !== "/") throw new TypeError(`__Host- cookies must have Path=/`);
+		if (cookie.domain) throw new TypeError(`__Host- cookies must not have a Domain attribute`);
+	}
+	let str = cookie.name + "=" + value;
+	if (cookie.maxAge !== void 0) {
+		if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+		str += "; Max-Age=" + Math.max(0, Math.min(cookie.maxAge, COOKIE_MAX_AGE_LIMIT));
+	}
+	if (cookie.domain) {
+		if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+		str += "; Domain=" + cookie.domain;
+	}
+	if (cookie.path) {
+		if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
+		str += "; Path=" + cookie.path;
+	}
+	if (cookie.expires) {
+		if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+		str += "; Expires=" + cookie.expires.toUTCString();
+	}
+	if (cookie.httpOnly) str += "; HttpOnly";
+	if (cookie.secure) str += "; Secure";
+	if (cookie.partitioned) str += "; Partitioned";
+	if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
+		case "low":
+			str += "; Priority=Low";
+			break;
+		case "medium":
+			str += "; Priority=Medium";
+			break;
+		case "high":
+			str += "; Priority=High";
+			break;
+		default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+	}
+	if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
+		case true:
+		case "strict":
+			str += "; SameSite=Strict";
+			break;
+		case "lax":
+			str += "; SameSite=Lax";
+			break;
+		case "none":
+			str += "; SameSite=None";
+			break;
+		default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+	}
+	return str;
+}
+/**
+* Determine if value is a Date.
+*/
+function isDate(val) {
+	return __toString.call(val) === "[object Date]";
+}
+//#endregion
+export { serialize };
+
+//# sourceMappingURL=serialize.js.map

package/dist/utils/cookie-es/cookie/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","names":[],"sources":["../../../../src/utils/cookie-es/cookie/serialize.ts"],"sourcesContent":["// Based on https://github.com/jshttp/cookie (MIT)\n// Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>\n// Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>\n// Last sync: v1.1.1 (e264dfa)\n\nimport type {\n    Cookies,\n    SetCookie,\n    CookieStringifyOptions,\n    CookieSerializeOptions,\n} from \"./types.js\";\nimport { COOKIE_MAX_AGE_LIMIT } from \"../_utils.js\";\n\nexport type {\n    CookieParseOptions,\n    CookieSerializeOptions,\n    CookieStringifyOptions,\n    Cookies,\n    SetCookie,\n} from \"./types.js\";\n\n/**\n * RegExp to match cookie-name in RFC 6265bis sec 4.1.1\n * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2\n * which has been replaced by the token definition in RFC 7230 appendix B.\n *\n * cookie-name       = token\n * token             = 1*tchar\n * tchar             = \"!\" / \"#\" / \"$\" / \"%\" / \"&\" / \"'\" /\n *                     \"*\" / \"+\" / \"-\" / \".\" / \"^\" / \"_\" /\n *                     \"`\" / \"|\" / \"~\" / DIGIT / ALPHA\n *\n * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191\n * Allow same range as cookie value, except `=`, which delimits end of name.\n */\nconst cookieNameRegExp = /^[\\u0021-\\u003A\\u003C\\u003E-\\u007E]+$/;\n\n/**\n * RegExp to match cookie-value in RFC 6265bis sec 4.1.1\n *\n * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )\n * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E\n *                     ; US-ASCII characters excluding CTLs,\n *                     ; whitespace DQUOTE, comma, semicolon,\n *                     ; and backslash\n *\n * Allowing more characters: https://github.com/jshttp/cookie/issues/191\n * Comma, backslash, and DQUOTE are not part of the parsing algorithm.\n */\nconst cookieValueRegExp = /^[\\u0021-\\u003A\\u003C-\\u007E]*$/;\n\n/**\n * RegExp to match domain-value in RFC 6265bis sec 4.1.1\n *\n * domain-value      = <subdomain>\n *                     ; defined in [RFC1034], Section 3.5, as\n *                     ; enhanced by [RFC1123], Section 2.1\n * <subdomain>       = <label> | <subdomain> \".\" <label>\n * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]\n *                     Labels must be 63 characters or less.\n *                     'let-dig' not 'letter' in the first char, per RFC1123\n * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>\n * <let-dig-hyp>     = <let-dig> | \"-\"\n * <let-dig>         = <letter> | <digit>\n * <letter>          = any one of the 52 alphabetic characters A through Z in\n *                     upper case and a through z in lower case\n * <digit>           = any one of the ten digits 0 through 9\n *\n * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173\n *\n * > (Note that a leading %x2E (\".\"), if present, is ignored even though that\n * character is not permitted, but a trailing %x2E (\".\"), if present, will\n * cause the user agent to ignore the attribute.)\n */\nconst domainValueRegExp =\n    /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;\n\n/**\n * RegExp to match path-value in RFC 6265bis sec 4.1.1\n *\n * path-value        = <any CHAR except CTLs or \";\">\n * CHAR              = %x01-7F\n *                     ; defined in RFC 5234 appendix B.1\n */\nconst pathValueRegExp = /^[\\u0020-\\u003A\\u003C-\\u007E]*$/;\n\nconst __toString = Object.prototype.toString;\n\n/**\n * Stringify a cookies object into an HTTP `Cookie` header string.\n *\n * @param cookie - An object of cookie name-value pairs.\n * @param options - Stringify options (`encode`).\n * @returns A `Cookie` header string (e.g. `\"foo=bar; baz=qux\"`).\n */\nexport function stringifyCookie(cookie: Cookies, options?: CookieStringifyOptions): string {\n    const enc = options?.encode || encodeURIComponent;\n    const keys = Object.keys(cookie);\n    let str = \"\";\n\n    for (const [i, name] of keys.entries()) {\n        const val = cookie[name];\n        if (val === undefined) continue;\n\n        if (!cookieNameRegExp.test(name)) {\n            throw new TypeError(`cookie name is invalid: ${name}`);\n        }\n\n        const value = enc(val);\n\n        if (!cookieValueRegExp.test(value)) {\n            throw new TypeError(`cookie val is invalid: ${val}`);\n        }\n\n        if (i > 0) str += \"; \";\n        str += name + \"=\" + value;\n    }\n\n    return str;\n}\n\n/**\n * Serialize a cookie into a `Set-Cookie` header string.\n *\n * Accepts either a name-value pair with options or a `SetCookie` object.\n * Non-string values are coerced to strings. Validates name, value, domain,\n * and path against RFC 6265bis.\n *\n * @example\n * ```js\n * serialize(\"foo\", \"bar\", { httpOnly: true });\n * // => \"foo=bar; HttpOnly\"\n *\n * serialize({ name: \"foo\", value: \"bar\", secure: true });\n * // => \"foo=bar; Secure\"\n * ```\n */\nexport function serialize(cookie: SetCookie, options?: CookieStringifyOptions): string;\nexport function serialize(name: string, val: unknown, options?: CookieSerializeOptions): string;\nexport function serialize(\n    _a0: string | SetCookie,\n    _a1?: unknown,\n    _a2?: CookieSerializeOptions,\n): string {\n    const isObj = typeof _a0 === \"object\" && _a0 !== null;\n    const options = isObj ? (_a1 as CookieStringifyOptions) : _a2;\n    const stringify = options?.stringify || JSON.stringify;\n    const cookie = isObj\n        ? _a0\n        : {\n              ..._a2,\n              name: _a0,\n              value: _a1 == undefined ? \"\" : typeof _a1 === \"string\" ? _a1 : stringify(_a1),\n          };\n\n    const enc = options?.encode || encodeURIComponent;\n\n    if (!cookieNameRegExp.test(cookie.name)) {\n        throw new TypeError(`argument name is invalid: ${cookie.name}`);\n    }\n\n    const value = cookie.value ? enc(cookie.value) : \"\";\n\n    if (!cookieValueRegExp.test(value)) {\n        throw new TypeError(`argument val is invalid: ${cookie.value}`);\n    }\n\n    // RFC 6265bis: validate attributes requiring Secure\n    if (!cookie.secure) {\n        // CHIPS: Partitioned requires Secure\n        if (cookie.partitioned) {\n            throw new TypeError(`Partitioned cookies must have the Secure attribute`);\n        }\n        // RFC 6265bis sec 4.1.2.7: SameSite=None requires Secure\n        if (cookie.sameSite && String(cookie.sameSite).toLowerCase() === \"none\") {\n            throw new TypeError(`SameSite=None cookies must have the Secure attribute`);\n        }\n        // RFC 6265bis sec 4.1.3: __Secure- prefix requires Secure\n        if (\n            cookie.name.length > 9 &&\n            cookie.name.charCodeAt(0) === 95 /* _ */ &&\n            cookie.name.charCodeAt(1) === 95 /* _ */\n        ) {\n            const nameLower = cookie.name.toLowerCase();\n            if (nameLower.startsWith(\"__secure-\") || nameLower.startsWith(\"__host-\")) {\n                throw new TypeError(`${cookie.name} cookies must have the Secure attribute`);\n            }\n        }\n    }\n\n    // RFC 6265bis sec 4.1.3.2: __Host- prefix validation\n    if (\n        cookie.name.length > 7 &&\n        cookie.name.charCodeAt(0) === 95 /* _ */ &&\n        cookie.name.charCodeAt(1) === 95 /* _ */ &&\n        cookie.name.toLowerCase().startsWith(\"__host-\")\n    ) {\n        if (cookie.path !== \"/\") {\n            throw new TypeError(`__Host- cookies must have Path=/`);\n        }\n        if (cookie.domain) {\n            throw new TypeError(`__Host- cookies must not have a Domain attribute`);\n        }\n    }\n\n    let str = cookie.name + \"=\" + value;\n\n    if (cookie.maxAge !== undefined) {\n        if (!Number.isInteger(cookie.maxAge)) {\n            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);\n        }\n\n        // RFC 6265bis: clamp negative to 0, cap to 400-day limit\n        str += \"; Max-Age=\" + Math.max(0, Math.min(cookie.maxAge, COOKIE_MAX_AGE_LIMIT));\n    }\n\n    if (cookie.domain) {\n        if (!domainValueRegExp.test(cookie.domain)) {\n            throw new TypeError(`option domain is invalid: ${cookie.domain}`);\n        }\n\n        str += \"; Domain=\" + cookie.domain;\n    }\n\n    if (cookie.path) {\n        if (!pathValueRegExp.test(cookie.path)) {\n            throw new TypeError(`option path is invalid: ${cookie.path}`);\n        }\n\n        str += \"; Path=\" + cookie.path;\n    }\n\n    if (cookie.expires) {\n        if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) {\n            throw new TypeError(`option expires is invalid: ${cookie.expires}`);\n        }\n\n        str += \"; Expires=\" + cookie.expires.toUTCString();\n    }\n\n    if (cookie.httpOnly) {\n        str += \"; HttpOnly\";\n    }\n\n    if (cookie.secure) {\n        str += \"; Secure\";\n    }\n\n    if (cookie.partitioned) {\n        str += \"; Partitioned\";\n    }\n\n    if (cookie.priority) {\n        const priority =\n            typeof cookie.priority === \"string\" ? cookie.priority.toLowerCase() : undefined;\n        switch (priority) {\n            case \"low\": {\n                str += \"; Priority=Low\";\n                break;\n            }\n            case \"medium\": {\n                str += \"; Priority=Medium\";\n                break;\n            }\n            case \"high\": {\n                str += \"; Priority=High\";\n                break;\n            }\n            default: {\n                throw new TypeError(`option priority is invalid: ${cookie.priority}`);\n            }\n        }\n    }\n\n    if (cookie.sameSite) {\n        const sameSite =\n            typeof cookie.sameSite === \"string\" ? cookie.sameSite.toLowerCase() : cookie.sameSite;\n        switch (sameSite) {\n            case true:\n            case \"strict\": {\n                str += \"; SameSite=Strict\";\n                break;\n            }\n            case \"lax\": {\n                str += \"; SameSite=Lax\";\n                break;\n            }\n            case \"none\": {\n                str += \"; SameSite=None\";\n                break;\n            }\n            default: {\n                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);\n            }\n        }\n    }\n\n    return str;\n}\n\n// --- Internal Utils ---\n\n/**\n * Determine if value is a Date.\n */\nfunction isDate(val: unknown): val is Date {\n    return __toString.call(val) === \"[object Date]\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmCA,MAAM,mBAAmB;;;;;;;;;;;;;AAczB,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;AAyB1B,MAAM,oBACF;;;;;;;;AASJ,MAAM,kBAAkB;AAExB,MAAM,aAAa,OAAO,UAAU;AAqDpC,SAAgB,UACZ,KACA,KACA,KACM;CACN,MAAM,QAAQ,OAAO,QAAQ,YAAY,QAAQ;CACjD,MAAM,UAAU,QAAS,MAAiC;CAC1D,MAAM,YAAY,SAAS,aAAa,KAAK;CAC7C,MAAM,SAAS,QACT,MACA;EACI,GAAG;EACH,MAAM;EACN,OAAO,OAAO,KAAA,IAAY,KAAK,OAAO,QAAQ,WAAW,MAAM,UAAU,GAAG;CAChF;CAEN,MAAM,MAAM,SAAS,UAAU;CAE/B,IAAI,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAClC,MAAM,IAAI,UAAU,6BAA6B,OAAO,MAAM;CAGlE,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,KAAK,IAAI;CAEjD,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAC7B,MAAM,IAAI,UAAU,4BAA4B,OAAO,OAAO;CAIlE,IAAI,CAAC,OAAO,QAAQ;EAEhB,IAAI,OAAO,aACP,MAAM,IAAI,UAAU,oDAAoD;EAG5E,IAAI,OAAO,YAAY,OAAO,OAAO,QAAQ,CAAC,CAAC,YAAY,MAAM,QAC7D,MAAM,IAAI,UAAU,sDAAsD;EAG9E,IACI,OAAO,KAAK,SAAS,KACrB,OAAO,KAAK,WAAW,CAAC,MAAM,MAC9B,OAAO,KAAK,WAAW,CAAC,MAAM,IAChC;GACE,MAAM,YAAY,OAAO,KAAK,YAAY;GAC1C,IAAI,UAAU,WAAW,WAAW,KAAK,UAAU,WAAW,SAAS,GACnE,MAAM,IAAI,UAAU,GAAG,OAAO,KAAK,wCAAwC;EAEnF;CACJ;CAGA,IACI,OAAO,KAAK,SAAS,KACrB,OAAO,KAAK,WAAW,CAAC,MAAM,MAC9B,OAAO,KAAK,WAAW,CAAC,MAAM,MAC9B,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,SAAS,GAChD;EACE,IAAI,OAAO,SAAS,KAChB,MAAM,IAAI,UAAU,kCAAkC;EAE1D,IAAI,OAAO,QACP,MAAM,IAAI,UAAU,kDAAkD;CAE9E;CAEA,IAAI,MAAM,OAAO,OAAO,MAAM;CAE9B,IAAI,OAAO,WAAW,KAAA,GAAW;EAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,MAAM,GAC/B,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAIpE,OAAO,eAAe,KAAK,IAAI,GAAG,KAAK,IAAI,OAAO,QAAQ,oBAAoB,CAAC;CACnF;CAEA,IAAI,OAAO,QAAQ;EACf,IAAI,CAAC,kBAAkB,KAAK,OAAO,MAAM,GACrC,MAAM,IAAI,UAAU,6BAA6B,OAAO,QAAQ;EAGpE,OAAO,cAAc,OAAO;CAChC;CAEA,IAAI,OAAO,MAAM;EACb,IAAI,CAAC,gBAAgB,KAAK,OAAO,IAAI,GACjC,MAAM,IAAI,UAAU,2BAA2B,OAAO,MAAM;EAGhE,OAAO,YAAY,OAAO;CAC9B;CAEA,IAAI,OAAO,SAAS;EAChB,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,OAAO,QAAQ,QAAQ,CAAC,GACpE,MAAM,IAAI,UAAU,8BAA8B,OAAO,SAAS;EAGtE,OAAO,eAAe,OAAO,QAAQ,YAAY;CACrD;CAEA,IAAI,OAAO,UACP,OAAO;CAGX,IAAI,OAAO,QACP,OAAO;CAGX,IAAI,OAAO,aACP,OAAO;CAGX,IAAI,OAAO,UAGP,QADI,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,YAAY,IAAI,KAAA,GAC1E;EACI,KAAK;GACD,OAAO;GACP;EAEJ,KAAK;GACD,OAAO;GACP;EAEJ,KAAK;GACD,OAAO;GACP;EAEJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAE5E;CAGJ,IAAI,OAAO,UAGP,QADI,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,YAAY,IAAI,OAAO,UACjF;EACI,KAAK;EACL,KAAK;GACD,OAAO;GACP;EAEJ,KAAK;GACD,OAAO;GACP;EAEJ,KAAK;GACD,OAAO;GACP;EAEJ,SACI,MAAM,IAAI,UAAU,+BAA+B,OAAO,UAAU;CAE5E;CAGJ,OAAO;AACX;;;;AAOA,SAAS,OAAO,KAA2B;CACvC,OAAO,WAAW,KAAK,GAAG,MAAM;AACpC"}

package/dist/utils/cookies.d.ts

@@ -0,0 +1,7 @@
+//#region src/utils/cookies.d.ts
+type CookieGetter = Record<string, string> | {
+  get(name: string): string | undefined;
+} | Request;
+//#endregion
+export { CookieGetter };
+//# sourceMappingURL=cookies.d.ts.map

package/dist/utils/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","names":[],"sources":["../../src/utils/cookies.ts"],"mappings":";KA6DY,eACN;EACE,IAAI;IACN"}

package/dist/utils/cookies.js

@@ -0,0 +1,110 @@
+import { isLocalNetworkHost } from "./is-dev.js";
+import { parse } from "./cookie-es/cookie/parse.js";
+import { serialize } from "./cookie-es/cookie/serialize.js";
+//#region src/utils/cookies.ts
+/**
+* Whether auth cookies should carry the `Secure` attribute.
+*
+* On https pages: always Secure. On plaintext pages, browsers silently DROP
+* Secure cookies (localhost excepted), so dev against a LAN IP — e.g. phone
+* testing http://192.168.x.x — logged users out instantly because the freshly
+* written session cookies never persisted. The downgrade is therefore allowed
+* ONLY on local/private-network hosts; on a public hostname served over http
+* (a misconfigured production deployment) cookies stay Secure so auth fails
+* closed instead of shipping session cookies over plaintext.
+*/
+function shouldSecureCookies() {
+	if (typeof window === "undefined") return true;
+	if (window.location.protocol === "https:") return true;
+	return !isLocalNetworkHost(window.location.hostname);
+}
+/**
+* Writes a browser cookie.
+*/
+function setCookie({ name, value, options }) {
+	if (typeof document === "undefined") return;
+	document.cookie = serialize(name, value, options);
+}
+/**
+* Reads a browser cookie by name.
+*/
+function getCookie(name) {
+	if (typeof document === "undefined") return;
+	return parse(document.cookie)[name];
+}
+/**
+* Deletes a browser cookie by name.
+*/
+function deleteCookie(name, options) {
+	if (typeof document === "undefined") return;
+	document.cookie = serialize(name, "", {
+		path: options?.path ?? "/",
+		expires: /* @__PURE__ */ new Date("Thu, 01 Jan 1970 00:00:00 GMT")
+	});
+}
+/**
+* Parses cookies from a Request header.
+*/
+function parseCookiesFromRequest(request) {
+	const cookieHeader = request.headers.get("cookie");
+	if (!cookieHeader) return {};
+	return parse(cookieHeader);
+}
+/**
+* Reads a cookie value from either a cookie map or cookie getter.
+*/
+function getCookieValue(cookies, name) {
+	if (cookies instanceof Request) return parseCookiesFromRequest(cookies)[name];
+	if (typeof cookies.get === "function") return cookies.get(name);
+	return cookies[name];
+}
+/**
+* A generic class for managing cookies on the client side.
+* Provides a consistent interface for getting, setting, and deleting cookies.
+*
+* @example
+* ```ts
+* const cookieManager = new CookieManager({ name: "my-cookie" });
+* cookieManager.get();
+* cookieManager.set("my-value");
+* cookieManager.clear();
+* ```
+*/
+var CookieManager = class {
+	#name;
+	constructor(opts) {
+		this.#name = opts.name;
+	}
+	/**
+	* Reads the managed cookie value.
+	*/
+	get() {
+		return getCookie(this.#name) ?? null;
+	}
+	/**
+	* Writes the managed cookie value.
+	*/
+	set(token, options) {
+		setCookie({
+			name: this.#name,
+			value: token,
+			options: {
+				path: options?.path ?? "/",
+				sameSite: options?.sameSite ?? "lax",
+				secure: options?.secure ?? shouldSecureCookies(),
+				maxAge: options?.maxAge,
+				expires: options?.expires
+			}
+		});
+	}
+	/**
+	* Clears the managed cookie value.
+	*/
+	clear(options) {
+		deleteCookie(this.#name, options);
+	}
+};
+//#endregion
+export { CookieManager, deleteCookie, getCookie, getCookieValue, parseCookiesFromRequest, setCookie, shouldSecureCookies };
+
+//# sourceMappingURL=cookies.js.map

package/dist/utils/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","names":["serializeCookie","parseCookie","#name"],"sources":["../../src/utils/cookies.ts"],"sourcesContent":["import {\n    type Cookies,\n    type CookieSerializeOptions,\n    parseCookie,\n    serializeCookie,\n} from \"./cookie-es/index.js\";\nimport { isLocalNetworkHost } from \"./is-dev.js\";\n\n/**\n * Whether auth cookies should carry the `Secure` attribute.\n *\n * On https pages: always Secure. On plaintext pages, browsers silently DROP\n * Secure cookies (localhost excepted), so dev against a LAN IP — e.g. phone\n * testing http://192.168.x.x — logged users out instantly because the freshly\n * written session cookies never persisted. The downgrade is therefore allowed\n * ONLY on local/private-network hosts; on a public hostname served over http\n * (a misconfigured production deployment) cookies stay Secure so auth fails\n * closed instead of shipping session cookies over plaintext.\n */\nexport function shouldSecureCookies(): boolean {\n    if (typeof window === \"undefined\") return true;\n    if (window.location.protocol === \"https:\") return true;\n    return !isLocalNetworkHost(window.location.hostname);\n}\n\ninterface SetCookieParams {\n    name: string;\n    value: string;\n    options: CookieSerializeOptions;\n}\n\n/**\n * Writes a browser cookie.\n */\nexport function setCookie({ name, value, options }: SetCookieParams): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, value, options);\n}\n\n/**\n * Reads a browser cookie by name.\n */\nexport function getCookie(name: string): string | undefined {\n    if (typeof document === \"undefined\") return;\n\n    return parseCookie(document.cookie)[name];\n}\n\n/**\n * Deletes a browser cookie by name.\n */\nexport function deleteCookie(name: string, options?: { path?: string }): void {\n    if (typeof document === \"undefined\") return;\n\n    document.cookie = serializeCookie(name, \"\", {\n        path: options?.path ?? \"/\",\n        expires: new Date(\"Thu, 01 Jan 1970 00:00:00 GMT\"),\n    });\n}\n\nexport type CookieGetter =\n    | Record<string, string>\n    | { get(name: string): string | undefined }\n    | Request;\n\n/**\n * Parses cookies from a Request header.\n */\nexport function parseCookiesFromRequest(request: Request): Cookies {\n    const cookieHeader = request.headers.get(\"cookie\");\n    if (!cookieHeader) return {};\n\n    return parseCookie(cookieHeader);\n}\n\n/**\n * Reads a cookie value from either a cookie map or cookie getter.\n */\nexport function getCookieValue(cookies: CookieGetter, name: string): string | undefined {\n    if (cookies instanceof Request) {\n        const parsed = parseCookiesFromRequest(cookies);\n        return parsed[name];\n    }\n    if (typeof cookies.get === \"function\") {\n        return cookies.get(name);\n    }\n    return (cookies as Record<string, string>)[name];\n}\n\ninterface CookieManagerOptions {\n    /**\n     * The name of the cookie to manage.\n     */\n    name: string;\n}\n\n/**\n * A generic class for managing cookies on the client side.\n * Provides a consistent interface for getting, setting, and deleting cookies.\n *\n * @example\n * ```ts\n * const cookieManager = new CookieManager({ name: \"my-cookie\" });\n * cookieManager.get();\n * cookieManager.set(\"my-value\");\n * cookieManager.clear();\n * ```\n */\nexport class CookieManager {\n    #name: string;\n    constructor(opts: CookieManagerOptions) {\n        this.#name = opts.name;\n    }\n    /**\n     * Reads the managed cookie value.\n     */\n    get(): string | null {\n        const token = getCookie(this.#name);\n        return token ?? null;\n    }\n\n    /**\n     * Writes the managed cookie value.\n     */\n    set(\n        token: string,\n        options?: {\n            path?: string;\n            secure?: boolean;\n            sameSite?: \"lax\" | \"strict\" | \"none\";\n            maxAge?: number;\n            expires?: Date;\n        },\n    ): void {\n        setCookie({\n            name: this.#name,\n            value: token,\n            options: {\n                path: options?.path ?? \"/\",\n                sameSite: options?.sameSite ?? \"lax\",\n                secure: options?.secure ?? shouldSecureCookies(),\n                maxAge: options?.maxAge,\n                expires: options?.expires,\n            },\n        });\n    }\n\n    /**\n     * Clears the managed cookie value.\n     */\n    clear(options?: { path?: string }): void {\n        deleteCookie(this.#name, options);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,SAAgB,sBAA+B;CAC3C,IAAI,OAAO,WAAW,aAAa,OAAO;CAC1C,IAAI,OAAO,SAAS,aAAa,UAAU,OAAO;CAClD,OAAO,CAAC,mBAAmB,OAAO,SAAS,QAAQ;AACvD;;;;AAWA,SAAgB,UAAU,EAAE,MAAM,OAAO,WAAkC;CACvE,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASA,UAAgB,MAAM,OAAO,OAAO;AAC1D;;;;AAKA,SAAgB,UAAU,MAAkC;CACxD,IAAI,OAAO,aAAa,aAAa;CAErC,OAAOC,MAAY,SAAS,MAAM,CAAC,CAAC;AACxC;;;;AAKA,SAAgB,aAAa,MAAc,SAAmC;CAC1E,IAAI,OAAO,aAAa,aAAa;CAErC,SAAS,SAASD,UAAgB,MAAM,IAAI;EACxC,MAAM,SAAS,QAAQ;EACvB,yBAAS,IAAI,KAAK,+BAA+B;CACrD,CAAC;AACL;;;;AAUA,SAAgB,wBAAwB,SAA2B;CAC/D,MAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ;CACjD,IAAI,CAAC,cAAc,OAAO,CAAC;CAE3B,OAAOC,MAAY,YAAY;AACnC;;;;AAKA,SAAgB,eAAe,SAAuB,MAAkC;CACpF,IAAI,mBAAmB,SAEnB,OADe,wBAAwB,OAC3B,CAAC,CAAC;CAElB,IAAI,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,IAAI,IAAI;CAE3B,OAAQ,QAAmC;AAC/C;;;;;;;;;;;;;AAqBA,IAAa,gBAAb,MAA2B;CACvB;CACA,YAAY,MAA4B;EACpC,KAAKC,QAAQ,KAAK;CACtB;;;;CAIA,MAAqB;EAEjB,OADc,UAAU,KAAKA,KAClB,KAAK;CACpB;;;;CAKA,IACI,OACA,SAOI;EACJ,UAAU;GACN,MAAM,KAAKA;GACX,OAAO;GACP,SAAS;IACL,MAAM,SAAS,QAAQ;IACvB,UAAU,SAAS,YAAY;IAC/B,QAAQ,SAAS,UAAU,oBAAoB;IAC/C,QAAQ,SAAS;IACjB,SAAS,SAAS;GACtB;EACJ,CAAC;CACL;;;;CAKA,MAAM,SAAmC;EACrC,aAAa,KAAKA,OAAO,OAAO;CACpC;AACJ"}

package/dist/utils/errors.d.ts

@@ -0,0 +1,36 @@
+//#region src/utils/errors.d.ts
+/**
+ * Whether the backend signalled that the requested resource does not exist.
+ * Prefer `err instanceof ResourceNotFoundError`; this predicate also covers
+ * raw `ConnectError`s (NotFound or the auth resource-not-found detail).
+ */
+declare function isResourceNotFoundError(err: unknown): boolean;
+/** Whether an optimistic-concurrency update used a stale resource revision. */
+declare function isRevisionConflictError(err: unknown): boolean;
+/** Whether a policy mutation failed because the policy is still attached to a resource. */
+declare function isPolicyInUseError(err: unknown): boolean;
+/** Whether a policy mutation failed because the policy is locked. */
+declare function isPolicyLockedError(err: unknown): boolean;
+/** Whether the policy and target account belong to different scopes. */
+declare function isPolicyScopeMismatchError(err: unknown): boolean;
+/**
+ * Whether an error is retryable (network/timeout) for idempotent operations.
+ * Uses same requestId on retry; backend dedupes within 2min.
+ * Prefer `err instanceof TransientError` or `err.retryable` on typed errors.
+ */
+declare function isRetryableError(err: unknown): boolean;
+/**
+ * Diagnostic formatter for SDK and ConnectRPC errors.
+ * Typed SDK errors already carry normalized messages; for raw ConnectErrors
+ * this strips leading "[CODE]" prefixes. Falls back to a friendly default.
+ * The returned message may contain backend implementation details. Never render
+ * it to a user; use {@link formatUserFacingError} at presentation boundaries.
+ * @param err - The error to format.
+ * @param fallback - The fallback message when no message is available.
+ * @returns The formatted error message.
+ */
+declare function formatConnectError(err: unknown, fallback?: string): string;
+declare function formatUserFacingError(error: unknown, fallback: string): string;
+//#endregion
+export { formatConnectError, formatUserFacingError, isPolicyInUseError, isPolicyLockedError, isPolicyScopeMismatchError, isResourceNotFoundError, isRetryableError, isRevisionConflictError };
+//# sourceMappingURL=errors.d.ts.map

package/dist/utils/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../../src/utils/errors.ts"],"mappings":";;;;;;iBAoCgB,wBAAwB;;iBAcxB,wBAAwB;;iBAsBxB,mBAAmB;;iBAKnB,oBAAoB;;iBAKpB,2BAA2B;;;;;;iBAS3B,iBAAiB;;;;;;;;;;;iBAiBjB,mBACZ,cACA;iBA0CY,sBAAsB,gBAAgB"}

package/dist/utils/errors.js

@@ -0,0 +1,111 @@
+import { AuthErrorDetailSchema } from "../gen/auth/v1/auth_pb.js";
+import { NetworkError, PolicyInUseError, PolicyLockedError, PolicyScopeMismatchError, PolyesterError, RateLimitError, ResourceNotFoundError, RevisionConflictError, ServiceUnavailableError, TimeoutError, isAbortError } from "../shared/errors.js";
+import { getNormalizedConnectMessage, toPolyesterError } from "../shared/connect-error-mapping.js";
+import { Code, ConnectError } from "@connectrpc/connect";
+//#region src/utils/errors.ts
+function hasAuthErrorCode(err, code) {
+	return ConnectError.from(err).findDetails(AuthErrorDetailSchema).some((detail) => detail.code === code);
+}
+/**
+* Unwraps a typed SDK error to the underlying `ConnectError` (kept as `cause`)
+* so legacy heuristics keep working on raw backend details.
+*/
+function unwrapCause(err) {
+	return err instanceof PolyesterError && err.cause !== void 0 ? err.cause : err;
+}
+/**
+* Whether the backend signalled that the requested resource does not exist.
+* Prefer `err instanceof ResourceNotFoundError`; this predicate also covers
+* raw `ConnectError`s (NotFound or the auth resource-not-found detail).
+*/
+function isResourceNotFoundError(err) {
+	const mapped = toPolyesterError(err);
+	if (mapped instanceof ResourceNotFoundError) return true;
+	if (mapped instanceof PolyesterError && mapped.cause === void 0) return false;
+	const target = unwrapCause(mapped);
+	return hasAuthErrorCode(target, 10) || ConnectError.from(target).code === Code.NotFound;
+}
+/** Whether an optimistic-concurrency update used a stale resource revision. */
+function isRevisionConflictError(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== void 0 && current !== null && !seen.has(current)) {
+		seen.add(current);
+		if (toPolyesterError(current) instanceof RevisionConflictError) return true;
+		const connectError = ConnectError.from(current);
+		if ((connectError.code === Code.Unknown || connectError.code === Code.Aborted) && /\brevision conflict\b/i.test(getNormalizedConnectMessage(connectError))) return true;
+		current = typeof current === "object" && "cause" in current ? current.cause : void 0;
+	}
+	return false;
+}
+/** Whether a policy mutation failed because the policy is still attached to a resource. */
+function isPolicyInUseError(err) {
+	return toPolyesterError(err) instanceof PolicyInUseError;
+}
+/** Whether a policy mutation failed because the policy is locked. */
+function isPolicyLockedError(err) {
+	return toPolyesterError(err) instanceof PolicyLockedError;
+}
+/** Whether the policy and target account belong to different scopes. */
+function isPolicyScopeMismatchError(err) {
+	return toPolyesterError(err) instanceof PolicyScopeMismatchError;
+}
+/**
+* Whether an error is retryable (network/timeout) for idempotent operations.
+* Uses same requestId on retry; backend dedupes within 2min.
+* Prefer `err instanceof TransientError` or `err.retryable` on typed errors.
+*/
+function isRetryableError(err) {
+	if (isAbortError(err)) return false;
+	if (err instanceof PolyesterError) return err.retryable;
+	const ce = ConnectError.from(err);
+	return ce.code === Code.Unavailable || ce.code === Code.DeadlineExceeded;
+}
+/**
+* Diagnostic formatter for SDK and ConnectRPC errors.
+* Typed SDK errors already carry normalized messages; for raw ConnectErrors
+* this strips leading "[CODE]" prefixes. Falls back to a friendly default.
+* The returned message may contain backend implementation details. Never render
+* it to a user; use {@link formatUserFacingError} at presentation boundaries.
+* @param err - The error to format.
+* @param fallback - The fallback message when no message is available.
+* @returns The formatted error message.
+*/
+function formatConnectError(err, fallback = "Request failed. Please try again.") {
+	if (err == null) return fallback;
+	if (err instanceof PolyesterError) return err.message || fallback;
+	return getNormalizedConnectMessage(err) || fallback;
+}
+/**
+* Formats an untrusted failure for direct display to a user.
+*
+* This function never returns an exception or backend message. A small allowlist
+* of typed transport conditions receives SDK-owned copy; every other failure
+* returns the caller-owned fallback.
+*/
+function userFacingTransportMessage(error) {
+	if (error instanceof RateLimitError) return "You've made too many requests. Wait a moment and try again.";
+	if (error instanceof TimeoutError) return "This is taking longer than expected. Try again.";
+	if (error instanceof ServiceUnavailableError) return "This service is temporarily unavailable. Try again in a few minutes.";
+	if (error instanceof NetworkError) return "We couldn't connect. Check your internet connection and try again.";
+	if (error instanceof ConnectError) {
+		if (error.code === Code.ResourceExhausted) return "You've made too many requests. Wait a moment and try again.";
+		if (error.code === Code.DeadlineExceeded) return "This is taking longer than expected. Try again.";
+		if (error.code === Code.Unavailable) return "This service is temporarily unavailable. Try again in a few minutes.";
+	}
+}
+function formatUserFacingError(error, fallback) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const fromMapped = userFacingTransportMessage(toPolyesterError(current));
+		if (fromMapped !== void 0) return fromMapped;
+		const fromCurrent = userFacingTransportMessage(current);
+		if (fromCurrent !== void 0) return fromCurrent;
+		current = typeof current === "object" && current !== null && "cause" in current ? current.cause : void 0;
+	}
+	return fallback;
+}
+//#endregion
+export { formatConnectError, formatUserFacingError, isPolicyInUseError, isPolicyLockedError, isPolicyScopeMismatchError, isResourceNotFoundError, isRetryableError, isRevisionConflictError };
+
+//# sourceMappingURL=errors.js.map

package/dist/utils/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","names":[],"sources":["../../src/utils/errors.ts"],"sourcesContent":["import { Code, ConnectError } from \"@connectrpc/connect\";\nimport { AuthErrorCode, AuthErrorDetailSchema } from \"../gen/auth/v1/auth_pb.js\";\nimport { getNormalizedConnectMessage, toPolyesterError } from \"../shared/connect-error-mapping.js\";\nimport {\n    isAbortError,\n    NetworkError,\n    PolicyInUseError,\n    PolicyLockedError,\n    PolicyScopeMismatchError,\n    PolyesterError,\n    RateLimitError,\n    ResourceNotFoundError,\n    RevisionConflictError,\n    ServiceUnavailableError,\n    TimeoutError,\n} from \"../shared/errors.js\";\n\nfunction hasAuthErrorCode(err: unknown, code: AuthErrorCode): boolean {\n    return ConnectError.from(err)\n        .findDetails(AuthErrorDetailSchema)\n        .some((detail) => detail.code === code);\n}\n\n/**\n * Unwraps a typed SDK error to the underlying `ConnectError` (kept as `cause`)\n * so legacy heuristics keep working on raw backend details.\n */\nfunction unwrapCause(err: unknown): unknown {\n    return err instanceof PolyesterError && err.cause !== undefined ? err.cause : err;\n}\n\n/**\n * Whether the backend signalled that the requested resource does not exist.\n * Prefer `err instanceof ResourceNotFoundError`; this predicate also covers\n * raw `ConnectError`s (NotFound or the auth resource-not-found detail).\n */\nexport function isResourceNotFoundError(err: unknown): boolean {\n    // Connect can re-wrap interceptor errors as an Unknown ConnectError whose\n    // cause is the typed SDK error. Normalize first to recover that cause.\n    const mapped = toPolyesterError(err);\n    if (mapped instanceof ResourceNotFoundError) return true;\n    if (mapped instanceof PolyesterError && mapped.cause === undefined) return false;\n    const target = unwrapCause(mapped);\n    return (\n        hasAuthErrorCode(target, AuthErrorCode.AUTH_RESOURCE_NOT_FOUND) ||\n        ConnectError.from(target).code === Code.NotFound\n    );\n}\n\n/** Whether an optimistic-concurrency update used a stale resource revision. */\nexport function isRevisionConflictError(err: unknown): boolean {\n    const seen = new Set<unknown>();\n    let current = err;\n    while (current !== undefined && current !== null && !seen.has(current)) {\n        seen.add(current);\n        if (toPolyesterError(current) instanceof RevisionConflictError) return true;\n        const connectError = ConnectError.from(current);\n        if (\n            (connectError.code === Code.Unknown || connectError.code === Code.Aborted) &&\n            /\\brevision conflict\\b/i.test(getNormalizedConnectMessage(connectError))\n        ) {\n            return true;\n        }\n        current =\n            typeof current === \"object\" && \"cause\" in current\n                ? (current as { cause?: unknown }).cause\n                : undefined;\n    }\n    return false;\n}\n\n/** Whether a policy mutation failed because the policy is still attached to a resource. */\nexport function isPolicyInUseError(err: unknown): boolean {\n    return toPolyesterError(err) instanceof PolicyInUseError;\n}\n\n/** Whether a policy mutation failed because the policy is locked. */\nexport function isPolicyLockedError(err: unknown): boolean {\n    return toPolyesterError(err) instanceof PolicyLockedError;\n}\n\n/** Whether the policy and target account belong to different scopes. */\nexport function isPolicyScopeMismatchError(err: unknown): boolean {\n    return toPolyesterError(err) instanceof PolicyScopeMismatchError;\n}\n\n/**\n * Whether an error is retryable (network/timeout) for idempotent operations.\n * Uses same requestId on retry; backend dedupes within 2min.\n * Prefer `err instanceof TransientError` or `err.retryable` on typed errors.\n */\nexport function isRetryableError(err: unknown): boolean {\n    if (isAbortError(err)) return false;\n    if (err instanceof PolyesterError) return err.retryable;\n    const ce = ConnectError.from(err);\n    return ce.code === Code.Unavailable || ce.code === Code.DeadlineExceeded;\n}\n\n/**\n * Diagnostic formatter for SDK and ConnectRPC errors.\n * Typed SDK errors already carry normalized messages; for raw ConnectErrors\n * this strips leading \"[CODE]\" prefixes. Falls back to a friendly default.\n * The returned message may contain backend implementation details. Never render\n * it to a user; use {@link formatUserFacingError} at presentation boundaries.\n * @param err - The error to format.\n * @param fallback - The fallback message when no message is available.\n * @returns The formatted error message.\n */\nexport function formatConnectError(\n    err: unknown,\n    fallback = \"Request failed. Please try again.\",\n): string {\n    if (err == null) return fallback;\n    if (err instanceof PolyesterError) return err.message || fallback;\n    const withoutCode = getNormalizedConnectMessage(err);\n    return withoutCode || fallback;\n}\n\n/**\n * Formats an untrusted failure for direct display to a user.\n *\n * This function never returns an exception or backend message. A small allowlist\n * of typed transport conditions receives SDK-owned copy; every other failure\n * returns the caller-owned fallback.\n */\nfunction userFacingTransportMessage(error: unknown): string | undefined {\n    if (error instanceof RateLimitError) {\n        return \"You've made too many requests. Wait a moment and try again.\";\n    }\n    if (error instanceof TimeoutError) return \"This is taking longer than expected. Try again.\";\n    if (error instanceof ServiceUnavailableError) {\n        return \"This service is temporarily unavailable. Try again in a few minutes.\";\n    }\n    if (error instanceof NetworkError) {\n        return \"We couldn't connect. Check your internet connection and try again.\";\n    }\n\n    if (error instanceof ConnectError) {\n        if (error.code === Code.ResourceExhausted) {\n            return \"You've made too many requests. Wait a moment and try again.\";\n        }\n        if (error.code === Code.DeadlineExceeded) {\n            return \"This is taking longer than expected. Try again.\";\n        }\n        if (error.code === Code.Unavailable) {\n            return \"This service is temporarily unavailable. Try again in a few minutes.\";\n        }\n    }\n\n    return undefined;\n}\n\nexport function formatUserFacingError(error: unknown, fallback: string): string {\n    // Walk the cause chain and normalize ConnectErrors so wrapped submit failures\n    // (e.g. Error → ConnectError[unknown] \"Service temporarily unavailable.\")\n    // still hit the transport allowlist.\n    let current: unknown = error;\n    for (let depth = 0; depth < 5 && current != null; depth++) {\n        const mapped = toPolyesterError(current);\n        const fromMapped = userFacingTransportMessage(mapped);\n        if (fromMapped !== undefined) return fromMapped;\n        const fromCurrent = userFacingTransportMessage(current);\n        if (fromCurrent !== undefined) return fromCurrent;\n\n        current =\n            typeof current === \"object\" && current !== null && \"cause\" in current\n                ? (current as { cause?: unknown }).cause\n                : undefined;\n    }\n\n    return fallback;\n}\n"],"mappings":";;;;;AAiBA,SAAS,iBAAiB,KAAc,MAA8B;CAClE,OAAO,aAAa,KAAK,GAAG,CAAC,CACxB,YAAY,qBAAqB,CAAC,CAClC,MAAM,WAAW,OAAO,SAAS,IAAI;AAC9C;;;;;AAMA,SAAS,YAAY,KAAuB;CACxC,OAAO,eAAe,kBAAkB,IAAI,UAAU,KAAA,IAAY,IAAI,QAAQ;AAClF;;;;;;AAOA,SAAgB,wBAAwB,KAAuB;CAG3D,MAAM,SAAS,iBAAiB,GAAG;CACnC,IAAI,kBAAkB,uBAAuB,OAAO;CACpD,IAAI,kBAAkB,kBAAkB,OAAO,UAAU,KAAA,GAAW,OAAO;CAC3E,MAAM,SAAS,YAAY,MAAM;CACjC,OACI,iBAAiB,QAAA,EAA6C,KAC9D,aAAa,KAAK,MAAM,CAAC,CAAC,SAAS,KAAK;AAEhD;;AAGA,SAAgB,wBAAwB,KAAuB;CAC3D,MAAM,uBAAO,IAAI,IAAa;CAC9B,IAAI,UAAU;CACd,OAAO,YAAY,KAAA,KAAa,YAAY,QAAQ,CAAC,KAAK,IAAI,OAAO,GAAG;EACpE,KAAK,IAAI,OAAO;EAChB,IAAI,iBAAiB,OAAO,aAAa,uBAAuB,OAAO;EACvE,MAAM,eAAe,aAAa,KAAK,OAAO;EAC9C,KACK,aAAa,SAAS,KAAK,WAAW,aAAa,SAAS,KAAK,YAClE,yBAAyB,KAAK,4BAA4B,YAAY,CAAC,GAEvE,OAAO;EAEX,UACI,OAAO,YAAY,YAAY,WAAW,UACnC,QAAgC,QACjC,KAAA;CACd;CACA,OAAO;AACX;;AAGA,SAAgB,mBAAmB,KAAuB;CACtD,OAAO,iBAAiB,GAAG,aAAa;AAC5C;;AAGA,SAAgB,oBAAoB,KAAuB;CACvD,OAAO,iBAAiB,GAAG,aAAa;AAC5C;;AAGA,SAAgB,2BAA2B,KAAuB;CAC9D,OAAO,iBAAiB,GAAG,aAAa;AAC5C;;;;;;AAOA,SAAgB,iBAAiB,KAAuB;CACpD,IAAI,aAAa,GAAG,GAAG,OAAO;CAC9B,IAAI,eAAe,gBAAgB,OAAO,IAAI;CAC9C,MAAM,KAAK,aAAa,KAAK,GAAG;CAChC,OAAO,GAAG,SAAS,KAAK,eAAe,GAAG,SAAS,KAAK;AAC5D;;;;;;;;;;;AAYA,SAAgB,mBACZ,KACA,WAAW,qCACL;CACN,IAAI,OAAO,MAAM,OAAO;CACxB,IAAI,eAAe,gBAAgB,OAAO,IAAI,WAAW;CAEzD,OADoB,4BAA4B,GAC/B,KAAK;AAC1B;;;;;;;;AASA,SAAS,2BAA2B,OAAoC;CACpE,IAAI,iBAAiB,gBACjB,OAAO;CAEX,IAAI,iBAAiB,cAAc,OAAO;CAC1C,IAAI,iBAAiB,yBACjB,OAAO;CAEX,IAAI,iBAAiB,cACjB,OAAO;CAGX,IAAI,iBAAiB,cAAc;EAC/B,IAAI,MAAM,SAAS,KAAK,mBACpB,OAAO;EAEX,IAAI,MAAM,SAAS,KAAK,kBACpB,OAAO;EAEX,IAAI,MAAM,SAAS,KAAK,aACpB,OAAO;CAEf;AAGJ;AAEA,SAAgB,sBAAsB,OAAgB,UAA0B;CAI5E,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,WAAW,MAAM,SAAS;EAEvD,MAAM,aAAa,2BADJ,iBAAiB,OACmB,CAAC;EACpD,IAAI,eAAe,KAAA,GAAW,OAAO;EACrC,MAAM,cAAc,2BAA2B,OAAO;EACtD,IAAI,gBAAgB,KAAA,GAAW,OAAO;EAEtC,UACI,OAAO,YAAY,YAAY,YAAY,QAAQ,WAAW,UACvD,QAAgC,QACjC,KAAA;CACd;CAEA,OAAO;AACX"}

package/dist/utils/event-emitter.d.ts

@@ -0,0 +1,31 @@
+//#region src/utils/event-emitter.d.ts
+type EventCallback<T = unknown> = (data: T) => void;
+/**
+ * Minimal typed event emitter used by SDK services to publish auth and lifecycle state changes.
+ */
+declare class EventEmitter<TEvents extends { [K in keyof TEvents]: unknown; }> {
+  #private;
+  /**
+   * Registers an event listener and returns an unsubscribe function.
+   */
+  on<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void;
+  /**
+   * Registers an event listener that runs at most once.
+   */
+  once<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void;
+  /**
+   * Emits an event to all registered listeners.
+   */
+  emit<K extends keyof TEvents>(event: K, data: TEvents[K]): void;
+  /**
+   * Removes a previously registered event listener.
+   */
+  off<K extends keyof TEvents>(event: K, callback?: EventCallback<TEvents[K]>): void;
+  /**
+   * Removes every registered event listener.
+   */
+  removeAllListeners(): void;
+}
+//#endregion
+export { EventEmitter };
+//# sourceMappingURL=event-emitter.d.ts.map

package/dist/utils/event-emitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-emitter.d.ts","names":[],"sources":["../../src/utils/event-emitter.ts"],"mappings":";KAAK,cAAc,gBAAgB,MAAM;;;;cAK5B,aAAa,mBAAmB,WAAW;;;;;EAMpD,GAAG,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EActE,KAAK,gBAAgB,SAAS,OAAO,GAAG,UAAU,cAAc,QAAQ;;;;EAWxE,KAAK,gBAAgB,SAAS,OAAO,GAAG,MAAM,QAAQ;;;;EAYtD,IAAI,gBAAgB,SAAS,OAAO,GAAG,WAAW,cAAc,QAAQ;;;;EAWxE"}

package/dist/utils/event-emitter.js

@@ -0,0 +1,51 @@
+//#region src/utils/event-emitter.ts
+/**
+* Minimal typed event emitter used by SDK services to publish auth and lifecycle state changes.
+*/
+var EventEmitter = class {
+	#listeners = /* @__PURE__ */ new Map();
+	/**
+	* Registers an event listener and returns an unsubscribe function.
+	*/
+	on(event, callback) {
+		if (!this.#listeners.has(event)) this.#listeners.set(event, /* @__PURE__ */ new Set());
+		this.#listeners.get(event).add(callback);
+		return () => {
+			this.#listeners.get(event)?.delete(callback);
+		};
+	}
+	/**
+	* Registers an event listener that runs at most once.
+	*/
+	once(event, callback) {
+		const unsubscribe = this.on(event, (data) => {
+			unsubscribe();
+			callback(data);
+		});
+		return unsubscribe;
+	}
+	/**
+	* Emits an event to all registered listeners.
+	*/
+	emit(event, data) {
+		const callbacks = this.#listeners.get(event);
+		if (callbacks) for (const callback of callbacks) callback(data);
+	}
+	/**
+	* Removes a previously registered event listener.
+	*/
+	off(event, callback) {
+		if (callback) this.#listeners.get(event)?.delete(callback);
+		else this.#listeners.delete(event);
+	}
+	/**
+	* Removes every registered event listener.
+	*/
+	removeAllListeners() {
+		this.#listeners.clear();
+	}
+};
+//#endregion
+export { EventEmitter };
+
+//# sourceMappingURL=event-emitter.js.map

package/dist/utils/event-emitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-emitter.js","names":["#listeners"],"sources":["../../src/utils/event-emitter.ts"],"sourcesContent":["type EventCallback<T = unknown> = (data: T) => void;\n\n/**\n * Minimal typed event emitter used by SDK services to publish auth and lifecycle state changes.\n */\nexport class EventEmitter<TEvents extends { [K in keyof TEvents]: unknown }> {\n    #listeners: Map<keyof TEvents, Set<EventCallback>> = new Map();\n\n    /**\n     * Registers an event listener and returns an unsubscribe function.\n     */\n    on<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        if (!this.#listeners.has(event)) {\n            this.#listeners.set(event, new Set());\n        }\n        this.#listeners.get(event)!.add(callback as EventCallback);\n\n        return () => {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        };\n    }\n\n    /**\n     * Registers an event listener that runs at most once.\n     */\n    once<K extends keyof TEvents>(event: K, callback: EventCallback<TEvents[K]>): () => void {\n        const unsubscribe = this.on(event, (data) => {\n            unsubscribe();\n            callback(data);\n        });\n        return unsubscribe;\n    }\n\n    /**\n     * Emits an event to all registered listeners.\n     */\n    emit<K extends keyof TEvents>(event: K, data: TEvents[K]): void {\n        const callbacks = this.#listeners.get(event);\n        if (callbacks) {\n            for (const callback of callbacks) {\n                callback(data);\n            }\n        }\n    }\n\n    /**\n     * Removes a previously registered event listener.\n     */\n    off<K extends keyof TEvents>(event: K, callback?: EventCallback<TEvents[K]>): void {\n        if (callback) {\n            this.#listeners.get(event)?.delete(callback as EventCallback);\n        } else {\n            this.#listeners.delete(event);\n        }\n    }\n\n    /**\n     * Removes every registered event listener.\n     */\n    removeAllListeners(): void {\n        this.#listeners.clear();\n    }\n}\n"],"mappings":";;;;AAKA,IAAa,eAAb,MAA6E;CACzE,6BAAqD,IAAI,IAAI;;;;CAK7D,GAA4B,OAAU,UAAiD;EACnF,IAAI,CAAC,KAAKA,WAAW,IAAI,KAAK,GAC1B,KAAKA,WAAW,IAAI,uBAAO,IAAI,IAAI,CAAC;EAExC,KAAKA,WAAW,IAAI,KAAK,CAAC,CAAE,IAAI,QAAyB;EAEzD,aAAa;GACT,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;EAChE;CACJ;;;;CAKA,KAA8B,OAAU,UAAiD;EACrF,MAAM,cAAc,KAAK,GAAG,QAAQ,SAAS;GACzC,YAAY;GACZ,SAAS,IAAI;EACjB,CAAC;EACD,OAAO;CACX;;;;CAKA,KAA8B,OAAU,MAAwB;EAC5D,MAAM,YAAY,KAAKA,WAAW,IAAI,KAAK;EAC3C,IAAI,WACA,KAAK,MAAM,YAAY,WACnB,SAAS,IAAI;CAGzB;;;;CAKA,IAA6B,OAAU,UAA4C;EAC/E,IAAI,UACA,KAAKA,WAAW,IAAI,KAAK,CAAC,EAAE,OAAO,QAAyB;OAE5D,KAAKA,WAAW,OAAO,KAAK;CAEpC;;;;CAKA,qBAA2B;EACvB,KAAKA,WAAW,MAAM;CAC1B;AACJ"}

package/dist/utils/evm.d.ts

@@ -0,0 +1,33 @@
+//#region src/utils/evm.d.ts
+/**
+ * Minimal EVM helpers backed by @noble/hashes.
+ *
+ * The SDK core previously imported these five utilities from viem. Rolldown
+ * groups all shared viem modules into a single chunk, so those tiny static
+ * imports forced viem's entire abi/actions graph (~270 KB emitted) into the
+ * app shell and the server's eager exec path, even though everything heavy is
+ * loaded lazily. Semantics mirror the viem calls they replaced:
+ * `isAddress(x, { strict: false })`, `getAddress`, `keccak256`,
+ * `stringToBytes`, `hexToBytes`.
+ */
+type EvmHex = `0x${string}`;
+/** Format-only address check (viem `isAddress(value, { strict: false })`). */
+declare function isEvmAddress(value: string): value is EvmHex;
+/**
+ * viem `isAddress(value)` default-mode parity: format check plus EIP-55
+ * checksum validation for any address that is not all-lowercase.
+ */
+declare function isEvmAddressStrict(value: string): value is EvmHex;
+/** EIP-55 checksummed address (viem `getAddress`); throws on invalid input. */
+declare function checksumEvmAddress(value: string): EvmHex;
+/** keccak-256 of raw bytes, hex-encoded (viem `keccak256(bytes)`). */
+declare function keccak256Hex(bytes: Uint8Array): EvmHex;
+/** UTF-8 encode (viem `stringToBytes`). */
+declare function evmUtf8ToBytes(value: string): Uint8Array;
+/** UTF-8 string to 0x-prefixed hex (viem `stringToHex`). */
+declare function evmUtf8ToHex(value: string): EvmHex;
+/** 0x-prefixed hex to bytes (viem `hexToBytes`); throws on malformed input. */
+declare function evmHexToBytes(value: string): Uint8Array;
+//#endregion
+export { EvmHex, checksumEvmAddress, evmHexToBytes, evmUtf8ToBytes, evmUtf8ToHex, isEvmAddress, isEvmAddressStrict, keccak256Hex };
+//# sourceMappingURL=evm.d.ts.map

package/dist/utils/evm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evm.d.ts","names":[],"sources":["../../src/utils/evm.ts"],"mappings":";;;;;;;;;;;;KAgBY;;iBAKI,aAAa,gBAAgB,SAAS;;;;;iBAQtC,mBAAmB,gBAAgB,SAAS;;iBAS5C,mBAAmB,gBAAgB;;iBAiBnC,aAAa,OAAO,aAAa;;iBAKjC,eAAe,gBAAgB;;iBAK/B,aAAa,gBAAgB;;iBAK7B,cAAc,gBAAgB"}